Exfiltration. Steal files.

[Anonymous H@cker]

Hey guys..
Can someone help me out with this cmdlet error ?
I've flashed my duck with no probs..
No spelling error from the scripts.

When i keyed this manually with win+r key...

STRING powershell ".((gwmi win32_volume -f 'label=''_''').Name+'d.cmd')"

It created a folder inside of slurp but with no files exfiltrated..

And whenever i tried to run the inject with twin duck(1)..
I got this error popped out instead. Did i missed something here ?

Thank you.
 

[RazerBlade]

Is your rubber ducky named:_

And have you placed d.cmd in onto your rubber ducky

[Broti]

On 3.11.2017 at 10:01 PM, Anonymous H@cker said:

STRING powershell ".((gwmi win32_volume -f 'label=''_''').Name+'d.cmd')"

Maybe you're missing a backslash. Could you try .Name+'\d.cmd')" ?

[Anonymous H@cker]

20 hours ago, RazerBlade said:

Is your rubber ducky named:_

And have you placed d.cmd in onto your rubber ducky

Yep....I got all cmd + vbs + slurp in the same directory. Still no luck.

 

19 hours ago, Broti said:

Maybe you're missing a backslash. Could you try .Name+'\d.cmd')" ?

Still not working same error...I watched the tutorials too just to make sure everything was correct.
Is there any other similar alternatives for exfiltrations ??


 

[Anonymous H@cker]

a

On 11/7/2017 at 12:53 PM, kdodge said:

open a prompt, and try the command piece by piece. start with just the inner part:

gwmi win32_volume -f 'label=''_'''

 

see if you get anything or not

Figured why it doesn't work. The rubber ducky doesn't get into proper dfu mode. Re-flash the ducky and it works fine now. Thanks for the help guys !