PowerShell error

[benmorgulec]

I'm having an issue where I'm trying to hit enter on a string within PowerShell it doesn't register.  If I type the same string our and manually hit enter it works fine.  Anyone have a solution?

[dark_pyrro]

You need to be more specific about the use case scenario. What is the payload looking like? At what stage does the issue occur? Any error messages? What encoder did you use?

[benmorgulec]

The specific line I'm having trouble with is copying the path of the USB (with twin duck) within PowerShell.  This occurs immediately within PowerShell, it's the first string that it runs after it pulls up PowerShell with GUI r (run).  When I input the string and hit enter using the ducky all I get after is a blank terminal.  When I do it without the ducky it shows up as normal with the file path and user on the left hand side.  I am using the ducktoolkit encoder with the original rubber ducky.

[dark_pyrro]

Still need more info about the payload, or at least the string that isn't working. What does it looks like?

[benmorgulec]

STRING $usbPath = GetWMIObject Win32_Volume | ? {$_.Label -eq 'DUCKY' } | select name

[dark_pyrro]

Try

STRING $usbPath = Get-WmiObject -Class Win32_Volume | where {$_.Label -eq 'DUCKY'} | select -expand name

 

[benmorgulec]

I'll do that and let you know how it goes!  The weird thing though is that the original string does work if it's manually typed or even copied and pasted in when not used with the ducky.

I've even written a script to have the ducky type the string out in notepad, copy it, open PowerShell, and paste it and that still didn't work.

I will see if this one works though.

[dark_pyrro]

Just created a payload and it works for me. Not using the 1st gen Ducky with twinduck firmware, but the new gen Ducky. However, it should work the same.

[coco]

On 1/13/2023 at 1:41 PM, benmorgulec said:

$usbPath = Get-WmiObject -Class Win32_Volume | Where-Object {$_.Label -eq 'DUCKY'} | Select-Object -ExpandProperty Name