Stop Windows' autorun

[InsOp]

When inserting the device with switch1/2 it executes all commands in the payload file as expected, however windows then opens the folder of the newly inserted drive. Is there a way to surpress this without changing the attackmode?

[InsOp]

Sorry, couldnt find the edit button.

The problem is that when the device-window is opened, the focus is on it, too. so that Quack commands will be executed while having the wrong window focused.

[sWeed]

ALT - TAB
is the Answer

[InsOp]

thanks for the answer, but you cannot be sure whether the user has turned off autorun, so your solution would lead to maybe undesired actions.

[sWeed]

Quite hard to answer your question
What about asking the registry... if autorun is enabled/disabled..
REG QUERY .....
http://www.samlogic.net/articles/autorun-enable-disable-nodrivetypeautorun.htm

Give some more infos about your actions you want to execute...

[InsOp]

thats a better approach.

it really doesnt matter what i want to do - as soon as i insert the device the actions i want to execute could be compromised by the popping autorun window

[JumboPackets]

I would think that autorun wouldn't activate until you entered "mass storage" mode.  Could you start your payload in HID keyboard mode, send the commands to edit the registry to turn off autorun, and THEN switch to mass storage mode?

[Darren Kitchen]

One solution would be to use HID only in stage 1, then switch from HID to just STORAGE in stage 2.

Not knowing what payload you're referring to I'm not sure exactly what the stager would look like - so if you can provide any insight on that it would be helpful. 

 

[InsOp]

just the WiPassDump from the repo. thanks for the replies