Files
bashbunny-payloads/payloads/library/prank/Win_PoSH_ReplaceCursor/payload.txt
cribb-it e1700bdc91 New payload - Replace Cursor (#437)
* New payload - Replace Cursor

* Added Cursor - follow the white rabbit

* Update Readme
2021-12-21 17:31:08 -06:00

20 lines
497 B
Plaintext

# Title: Replace Cursor
# Description: Replaces the standard arrow with a little bash bunny.
# Author: Cribbit
# Version: 1.0
# Category: Pranks
# Target: Windows (Powershell 5.1+)
# Attackmodes: HID & STORAGE
# Extensions: Run
LED SETUP
GET SWITCH_POSITION
ATTACKMODE HID STORAGE
LED ATTACK
RUN WIN "powershell -Noni -NoP -W h -EP Bypass .((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\ps.ps1')"
LED FINNISH