Rick roll windows payload help!

[Shanegal]

Can anyone help debug the Windows rickroll payload, I really want to use it but it doesn’t seem to work, it just boosts the volume at the specific time and nothing else? Unfortunately I don’t know enough about code at this point to do it myself but I am learning slowly, thanks in advance to anyone who can help

[Bob123]

Ok so first off what OS are you hoping to run this on?  With that said open powershell and type this:

start "https://youtu.be/v723HK_qR-4" but without the "".  I had to add them because without them this forum wanted to embed the video.  Anyways when you type that without the "" does powershell open your browser and start playing the Hak5 bash bunny video?

Lets get through these few items and then we can move on.

[Sene0]

Take a look at this. It's written for a RubberDucky, but I'm sure you could adapt it to the BashBunny really fast. Maybe something like this:

LED R 100
ATTACKMODE HID STORAGE
Q GUI r
Q DELAY 200
Q STRING cmd /Q /D /T:7F /F:OFF /V:ON /K mode con:cols=80 lines=1
Q ENTER

LED B 100
Q DELAY 200
Q copy E:\*.vbs %tmp%
Q ENTER
Q DELAY 200
Q STRING cd %tmp%
Q ENTER
Q DELAY 200
Q STRING d.vbs
Q ENTER
Q DELAY 200
Q ALT F4

LED G

Of course you would have to modify it according to your needs plus I'm sure it can be improved, but it might be a start for you.

 

You can quit the music from playing by signing out/restarting the computer. So you might adapt the script, to play the music even when you're signed out and add it as a Startup Process, so even that won't work. Also you might want to move the files to another directory than %tmp%, so the fun doesn't stop when you're clearing the temporary data.

[Sene0]

As I'm currently studying in a foreign country whose keyboard layout is somewhat problematic, I also thought about something that changes the keyboard layout to US, to make it universal. The script for that could be put on the Switch folder separately and executed via a bash script or somehow like this via the HID mode:

ATTACKMODE HID
QUACK keyboard_layout_change.txt

 

Furthermore I thought about a way to conceal the payload execution some more. If you use the payload_cmd.txt version and you manage to make it a one-liner, you could use this to start the cmd prompt minimized yet still execute the payload

cmd /C "start /MIN cmd /C command_here"