Exfiltrate NTLM Hash - Windows ✅

A Rubber Ducky payload to exfiltrate NTLM hash files from a Windows machine onto the SD card.

Description

This payload script captures and exfiltrates NTLM hash files from a Windows machine. It uses PowerShell commands to locate and save the SAM and SYSTEM files, which contain hashed user passwords, onto the Rubber Ducky's SD card for later extraction and analysis. Upon successful file extraction, the payload triggers a visual confirmation by blinking the Caps Lock LED

Settings

• Drive Label: Set the target drive label for Rubber Ducky storage (default: DUCKY).

• Blink Count: Adjust the number of Caps Lock LED blinks by setting the #numBlinks variable (default is 9 blinks).

Credits

Luu176

GitHub