Jump to content

Rewriting of "wallpaper-changer-of-doom"


jcardonne
 Share

Recommended Posts

If you open a powershell.exe prompt manually, and type in the command in the script 

iwr -Uri [URL]/doom.jpg -OutFile 'c:\windows\temp\doom.jpg'; Set-ItemProperty -path 'HKCU:\Control Panel\Desktop\' -name wallpaper -value 'c:\windows\temp\doom.jpg' ; 1..20|%{RUNDLL32.EXE USER32.DLL,UpdatePerUserSystemParameters ,1 ,True;sleep 1}; exit

what does the error say?

Link to comment
Share on other sites

Hmm, I sent Darren awhile back when he did a vlog on the wallpaper changer a p/Invoke version of it that would instantaneously change the wallpaper.  His version changed the same regkey but then looked through a command a bunch of times to get it to apply now.  The version I am going to post in pieces will do it the minute it is ran.

First, the unmanaged function that is part of windows API is:

public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni)

This changes parameters in Windows and adds the changes to the appropriate files.  The action parameter is what you are doing.  20 is changing wallpaper.  Parameter after that I forget but for setting wallpaper it is always 0.  Then the lvparam will be a string to the file you want to be the wallpaper followed by parameter to save to ini file and/or send changes to system (1 -bor 2).  They are binary or'ed because we want both set.

So, below is how I did it all in Powershell.

#First, here is the signature for the unmanaged command.
$sig = "[DllImport(`"user32.dll`", SetLastError = true, CharSet = CharSet.Auto)]public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni);"

# Next, we add it as a type, give it a name (if you want to use it straight out) and a namespace to separate it from the rest of our Posh session.
$SetWallpaper = add-type -MemberDefinition $sig -Name SetWallpaper -Namespace Win32Functions -PassThru

# Now, if you want to save what your old wallpaper was then the bottom will do it.
$oldwallpaper = (Get-ItemProperty -Path "HKCU:\\Control Panel\Desktop" -Name Wallpaper).Wallpaper

#Place path for new wallpaper in variable or skip this and use it right out where the variable is used at.
$newpaper = "c:\somewhere\something.bmp"
$SetWallpaper::SystemParametersInfo(20, 0, $newpaper, (0x01 -bor 0x02))

# If you were going to 1 line this then there is some prep work.  First, base64 the sig.  This makes it easier to use.
$enc = [System.Convert]::ToBase64String(([System.Text.Encoding]::ASCII.GetBytes($sig)))

# Now your command can be this on 1 line.
powershell -C "$sig='W0RsbEltcG9ydCgidXNlcjMyLmRsbCIsIFNldExhc3RFcnJvciA9IHRydWUsIENoYXJTZXQgPSBDaGFyU2V0LkF1dG8pXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIGludCBTeXN0ZW1QYXJhbWV0ZXJzSW5mbyhpbnQgdUFjdGlvbiwgaW50IHVQYXJhbSwgc3RyaW5nIGxwdlBhcmFtLCBpbnQgZnVXaW5JbmkpOw==';$SW=add-type -MemberDefinition ([System.Text.Encoding]::ASCII.GetString(([System.Convert]::FromBase64String($sig)))) -Name ShowWall -Namespace Win32 -passthru;$SW::SystemParametersInfo(20, 0, 'C:\somewhere\something.bmp', (0x01 -bor 0x02))"

 

That base64line is what was in $enc.  You could also just put it inside the decide command instead of in a variable first.

 

Enjoy.

 

Link to comment
Share on other sites

On 8/5/2019 at 8:12 PM, PoSHMagiC0de said:

Hmm, I sent Darren awhile back when he did a vlog on the wallpaper changer a p/Invoke version of it that would instantaneously change the wallpaper.  His version changed the same regkey but then looked through a command a bunch of times to get it to apply now.  The version I am going to post in pieces will do it the minute it is ran.

First, the unmanaged function that is part of windows API is:

public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni)

This changes parameters in Windows and adds the changes to the appropriate files.  The action parameter is what you are doing.  20 is changing wallpaper.  Parameter after that I forget but for setting wallpaper it is always 0.  Then the lvparam will be a string to the file you want to be the wallpaper followed by parameter to save to ini file and/or send changes to system (1 -bor 2).  They are binary or'ed because we want both set.

So, below is how I did it all in Powershell.


#First, here is the signature for the unmanaged command.
$sig = "[DllImport(`"user32.dll`", SetLastError = true, CharSet = CharSet.Auto)]public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni);"

# Next, we add it as a type, give it a name (if you want to use it straight out) and a namespace to separate it from the rest of our Posh session.
$SetWallpaper = add-type -MemberDefinition $sig -Name SetWallpaper -Namespace Win32Functions -PassThru

# Now, if you want to save what your old wallpaper was then the bottom will do it.
$oldwallpaper = (Get-ItemProperty -Path "HKCU:\\Control Panel\Desktop" -Name Wallpaper).Wallpaper

#Place path for new wallpaper in variable or skip this and use it right out where the variable is used at.
$newpaper = "c:\somewhere\something.bmp"
$SetWallpaper::SystemParametersInfo(20, 0, $newpaper, (0x01 -bor 0x02))

# If you were going to 1 line this then there is some prep work.  First, base64 the sig.  This makes it easier to use.
$enc = [System.Convert]::ToBase64String(([System.Text.Encoding]::ASCII.GetBytes($sig)))

# Now your command can be this on 1 line.
powershell -C "$sig='W0RsbEltcG9ydCgidXNlcjMyLmRsbCIsIFNldExhc3RFcnJvciA9IHRydWUsIENoYXJTZXQgPSBDaGFyU2V0LkF1dG8pXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIGludCBTeXN0ZW1QYXJhbWV0ZXJzSW5mbyhpbnQgdUFjdGlvbiwgaW50IHVQYXJhbSwgc3RyaW5nIGxwdlBhcmFtLCBpbnQgZnVXaW5JbmkpOw==';$SW=add-type -MemberDefinition ([System.Text.Encoding]::ASCII.GetString(([System.Convert]::FromBase64String($sig)))) -Name ShowWall -Namespace Win32 -passthru;$SW::SystemParametersInfo(20, 0, 'C:\somewhere\something.bmp', (0x01 -bor 0x02))"

 

That base64line is what was in $enc.  You could also just put it inside the decide command instead of in a variable first.

 

Enjoy.

 

Hey, thanks for your answer anyway. I am new so I have to take the time to understand little by little.  I promise I will answer you in more detail when I understand.

In the meantime here is an update of the WallPaper Prank Remake, I added a little documentation and a little line to erase some of our passage!
https://github.com/jcardonne/Bashbunny-payloads/blob/master/wallpaper-prank

If anyone has any problems or suggestions, I'm interested!

Affectionately,
jcardonne

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...