■ ■ ■ ■ ■ ■
Payloads/Flip-Wallpaper-Troll/Wallpaper-Troll.ps1
| skipped 405 lines |
406 | 406 | | |
407 | 407 | | #---------------------------------------------------------------------------------------------------- |
408 | 408 | | |
| 409 | + | function Target-Comes { |
| 410 | + | Add-Type -AssemblyName System.Windows.Forms |
| 411 | + | $originalPOS = [System.Windows.Forms.Cursor]::Position.X |
| 412 | + | $o=New-Object -ComObject WScript.Shell |
| 413 | + | |
| 414 | + | while (1) { |
| 415 | + | $pauseTime = 3 |
| 416 | + | if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){ |
| 417 | + | break |
| 418 | + | } |
| 419 | + | else { |
| 420 | + | $o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime |
| 421 | + | } |
| 422 | + | } |
| 423 | + | } |
| 424 | + | |
| 425 | + | #---------------------------------------------------------------------------------------------------- |
| 426 | + | |
| 427 | + | Target-Comes |
| 428 | + | |
409 | 429 | | Set-WallPaper -Image "$Env:USERPROFILE\Desktop\$ImageName.jpg" -Style Center |
410 | 430 | | |
411 | 431 | | clean-exfil |
| skipped 2 lines |