Ducky and Desktop Goose help

[Th4ntis]

So as a fun prank I would like to try to make a script to download and run Desktop Goose onto a PC and execute it. My only issue is I don't have much powershell experience. I'm aiming to download the file, extract it to their Documents folder or somewhere similar, and run the .exe. I'm not sure exactly what to google as when I have usually you need a URL to file, but when I go to download it, the URL when hovering the button is "javascript:void(0);". Could someone maybe point me in the right direction how I could start this process?

[uintdev]

To make this barebones as possible, here is a working example but in cURL (note: this is a POST request -- it checks if the CSRF cookie value matches up with what is POSTed):

curl 'https://samperson.itch.io/desktop-goose/file/1957163' -H 'Cookie: itchio_token=a' --data-raw 'csrf_token=a'

If successful, this would return a JSON response. This includes the key named 'url' and 'external'. The 'url' key will have a value containing the 'generated' valid URL to the download (it does expire). You would then use that URL to download the archive.

Do note that as itch does use Cloudflare, it is possible for the request to be blocked due to missing headers such as the user agent.

 

This is only one piece of the puzzle. As this is a USB Rubber Ducky, a script that does all of that either has to be typed out or you'll have to use the 'twin duck' firmware (for simultaneous [slow] mass storage) and create the software / script so that the payload is way more sped up (by directly executing it [on the USB Rubber Ducky] rather than typing it out).

Edited February 29, 2020 by uintdev