Update Demo.ps1
This commit is contained in:
112
Demo.ps1
112
Demo.ps1
@@ -1,3 +1,7 @@
|
||||
|
||||
|
||||
$demoStart = Get-Date
|
||||
|
||||
Add-Type -AssemblyName System.Drawing
|
||||
Add-Type -TypeDefinition @"
|
||||
using System;
|
||||
@@ -13,19 +17,22 @@ public class Wallpaper {
|
||||
# ----------------------------
|
||||
$clientName = "Ford"
|
||||
|
||||
# Use the RAW file URL from your repo
|
||||
# RAW URL from your repo
|
||||
$logoUrl = "https://git.svstools.com/syelle/Ducky/raw/branch/main/Ford.png"
|
||||
|
||||
# Optional local fallback if download fails
|
||||
$fallbackLogo = "C:\Temp\ford_logo.png"
|
||||
|
||||
# Temp working directory
|
||||
# Working folder
|
||||
$workDir = Join-Path $env:TEMP "ClientAwarenessDemo"
|
||||
New-Item -ItemType Directory -Path $workDir -Force | Out-Null
|
||||
|
||||
$downloadedLogo = Join-Path $workDir "ford_logo.png"
|
||||
$logoPath = $null
|
||||
|
||||
# How long before restoring the original wallpaper
|
||||
$restoreDelaySeconds = 30
|
||||
|
||||
# ----------------------------
|
||||
# Download logo
|
||||
# ----------------------------
|
||||
@@ -43,6 +50,13 @@ if (-not $logoPath -and (Test-Path $fallbackLogo)) {
|
||||
$logoPath = $fallbackLogo
|
||||
}
|
||||
|
||||
# ----------------------------
|
||||
# Save current wallpaper
|
||||
# ----------------------------
|
||||
$originalWallpaper = (Get-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallPaper -ErrorAction SilentlyContinue).WallPaper
|
||||
$originalWallpaperStyle = (Get-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -ErrorAction SilentlyContinue).WallpaperStyle
|
||||
$originalTileWallpaper = (Get-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -ErrorAction SilentlyContinue).TileWallpaper
|
||||
|
||||
# ----------------------------
|
||||
# Collect harmless live info
|
||||
# ----------------------------
|
||||
@@ -59,10 +73,37 @@ if ([string]::IsNullOrWhiteSpace($ipv4)) { $ipv4 = "Not found" }
|
||||
if ([string]::IsNullOrWhiteSpace($gateway)) { $gateway = "Not found" }
|
||||
if ([string]::IsNullOrWhiteSpace($dns)) { $dns = "Not found" }
|
||||
|
||||
# Try to get the primary adapter
|
||||
$adapterName = "Not found"
|
||||
try {
|
||||
$primaryAdapter = Get-NetIPConfiguration |
|
||||
Where-Object { $_.IPv4Address -and $_.NetAdapter.Status -eq 'Up' } |
|
||||
Select-Object -First 1
|
||||
|
||||
if ($primaryAdapter) {
|
||||
$adapterName = $primaryAdapter.InterfaceAlias
|
||||
if (-not $ipv4 -or $ipv4 -eq "Not found") {
|
||||
$ipv4 = $primaryAdapter.IPv4Address.IPAddress
|
||||
}
|
||||
if (-not $gateway -or $gateway -eq "Not found") {
|
||||
$gateway = $primaryAdapter.IPv4DefaultGateway.NextHop
|
||||
}
|
||||
if (-not $dns -or $dns -eq "Not found") {
|
||||
$dnsServers = $primaryAdapter.DNSServer.ServerAddresses
|
||||
if ($dnsServers) {
|
||||
$dns = ($dnsServers -join ", ")
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
catch {
|
||||
# fall back to parsed ipconfig values
|
||||
}
|
||||
|
||||
# ----------------------------
|
||||
# Simulated file names only
|
||||
# ----------------------------
|
||||
$fakeFiles = @(
|
||||
<#$fakeFiles = @(
|
||||
"Payroll_2025.xlsx",
|
||||
"Client_Contracts.docx",
|
||||
"VPN_Credentials.txt",
|
||||
@@ -74,6 +115,18 @@ $fakeFiles = @(
|
||||
"MFA_Recovery_Codes.txt",
|
||||
"Confidential_Pricing.pdf"
|
||||
)
|
||||
#>
|
||||
|
||||
$officeExtensions = @("*.doc","*.docx","*.xls","*.xlsx","*.ppt","*.pptx","*.pub","*.vsd","*.vsdx","*.one","*.rtf","*.csv")
|
||||
|
||||
$OfficeDocs = Get-ChildItem -Path $env:USERPROFILE -Recurse -File -Include $officeExtensions -ErrorAction SilentlyContinue |
|
||||
Select-Object FullName, Name, Extension, Length, LastWriteTime
|
||||
|
||||
# ----------------------------
|
||||
# Timing text
|
||||
# ----------------------------
|
||||
$elapsedSeconds = [math]::Round(((Get-Date) - $demoStart).TotalSeconds, 1)
|
||||
$timingText = "Demonstration completed in $elapsedSeconds seconds"
|
||||
|
||||
# ----------------------------
|
||||
# Create wallpaper canvas
|
||||
@@ -93,6 +146,7 @@ $accentColor = [System.Drawing.Color]::FromArgb(0,173,239)
|
||||
$textColor = [System.Drawing.Color]::White
|
||||
$mutedColor = [System.Drawing.Color]::FromArgb(190,190,190)
|
||||
$warnColor = [System.Drawing.Color]::FromArgb(255,210,90)
|
||||
$successColor = [System.Drawing.Color]::FromArgb(110,255,180)
|
||||
|
||||
$g.Clear($bgColor)
|
||||
|
||||
@@ -102,6 +156,7 @@ $accentBrush = New-Object System.Drawing.SolidBrush $accentColor
|
||||
$textBrush = New-Object System.Drawing.SolidBrush $textColor
|
||||
$mutedBrush = New-Object System.Drawing.SolidBrush $mutedColor
|
||||
$warnBrush = New-Object System.Drawing.SolidBrush $warnColor
|
||||
$successBrush = New-Object System.Drawing.SolidBrush $successColor
|
||||
$borderPen = New-Object System.Drawing.Pen $accentColor, 2
|
||||
|
||||
# Fonts
|
||||
@@ -109,6 +164,7 @@ $titleFont = New-Object System.Drawing.Font("Segoe UI", 28, [System.Drawing.Font
|
||||
$headerFont = New-Object System.Drawing.Font("Segoe UI", 16, [System.Drawing.FontStyle]::Bold)
|
||||
$bodyFont = New-Object System.Drawing.Font("Consolas", 15, [System.Drawing.FontStyle]::Regular)
|
||||
$smallFont = New-Object System.Drawing.Font("Segoe UI", 12, [System.Drawing.FontStyle]::Regular)
|
||||
$timingFont = New-Object System.Drawing.Font("Segoe UI", 14, [System.Drawing.FontStyle]::Bold)
|
||||
|
||||
# ----------------------------
|
||||
# Draw logo
|
||||
@@ -130,20 +186,22 @@ if ($logoPath -and (Test-Path $logoPath)) {
|
||||
$g.DrawString("$clientName Security Awareness Demonstration", $titleFont, $accentBrush, 60, 155)
|
||||
$g.DrawString("This workstation accepted commands in seconds.", $headerFont, $textBrush, 60, 210)
|
||||
$g.DrawString("Simulation only. No files were accessed, searched, copied, or transmitted.", $headerFont, $warnBrush, 60, 245)
|
||||
$g.DrawString($timingText, $timingFont, $successBrush, 60, 278)
|
||||
|
||||
# ----------------------------
|
||||
# Left panel: real harmless info
|
||||
# ----------------------------
|
||||
$leftRect = New-Object System.Drawing.Rectangle 60, 310, 760, 460
|
||||
$leftRect = New-Object System.Drawing.Rectangle 60, 320, 760, 490
|
||||
$g.FillRectangle($panelBrush, $leftRect)
|
||||
$g.DrawRectangle($borderPen, $leftRect)
|
||||
|
||||
$g.DrawString("Live harmless reconnaissance", $headerFont, $accentBrush, 80, 330)
|
||||
$g.DrawString("Live harmless reconnaissance", $headerFont, $accentBrush, 80, 340)
|
||||
|
||||
$y = 385
|
||||
$y = 395
|
||||
$lineGap = 42
|
||||
$g.DrawString("Hostname : $hostName", $bodyFont, $textBrush, 90, $y); $y += $lineGap
|
||||
$g.DrawString("User : $userName", $bodyFont, $textBrush, 90, $y); $y += $lineGap
|
||||
$g.DrawString("Adapter : $adapterName", $bodyFont, $textBrush, 90, $y); $y += $lineGap
|
||||
$g.DrawString("IPv4 : $ipv4", $bodyFont, $textBrush, 90, $y); $y += $lineGap
|
||||
$g.DrawString("Gateway : $gateway", $bodyFont, $textBrush, 90, $y); $y += $lineGap
|
||||
$g.DrawString("DNS : $dns", $bodyFont, $textBrush, 90, $y); $y += $lineGap + 10
|
||||
@@ -154,15 +212,15 @@ $g.DrawString("hostname whoami ipconfig", $bodyFont, $textBrush, 90, $y +
|
||||
# ----------------------------
|
||||
# Right panel: simulated file targets
|
||||
# ----------------------------
|
||||
$rightRect = New-Object System.Drawing.Rectangle 870, 310, 980, 560
|
||||
$rightRect = New-Object System.Drawing.Rectangle 870, 320, 980, 560
|
||||
$g.FillRectangle($panelBrush, $rightRect)
|
||||
$g.DrawRectangle($borderPen, $rightRect)
|
||||
|
||||
$g.DrawString("Simulated attacker targets", $headerFont, $accentBrush, 890, 330)
|
||||
$g.DrawString("Examples of the kinds of files a bad actor would likely search for:", $smallFont, $mutedBrush, 890, 370)
|
||||
$g.DrawString("Simulated attacker targets", $headerFont, $accentBrush, 890, 340)
|
||||
$g.DrawString("Examples of the kinds of files a bad actor would likely search for:", $smallFont, $mutedBrush, 890, 380)
|
||||
|
||||
$y2 = 420
|
||||
foreach ($file in $fakeFiles) {
|
||||
$y2 = 430
|
||||
foreach ($file in $OfficeDocs) {
|
||||
$g.DrawString("• $file", $bodyFont, $textBrush, 900, $y2)
|
||||
$y2 += 38
|
||||
}
|
||||
@@ -171,7 +229,9 @@ foreach ($file in $fakeFiles) {
|
||||
# Footer
|
||||
# ----------------------------
|
||||
$footerText = "Takeaway: brief physical access to an unlocked session can expose important information fast."
|
||||
$g.DrawString($footerText, $headerFont, $warnBrush, 60, 965)
|
||||
$restoreText = "Original wallpaper will be restored in $restoreDelaySeconds seconds."
|
||||
$g.DrawString($footerText, $headerFont, $warnBrush, 60, 935)
|
||||
$g.DrawString($restoreText, $smallFont, $mutedBrush, 60, 975)
|
||||
|
||||
# ----------------------------
|
||||
# Save wallpaper
|
||||
@@ -189,15 +249,41 @@ $accentBrush.Dispose()
|
||||
$textBrush.Dispose()
|
||||
$mutedBrush.Dispose()
|
||||
$warnBrush.Dispose()
|
||||
$successBrush.Dispose()
|
||||
$borderPen.Dispose()
|
||||
$titleFont.Dispose()
|
||||
$headerFont.Dispose()
|
||||
$bodyFont.Dispose()
|
||||
$smallFont.Dispose()
|
||||
$timingFont.Dispose()
|
||||
|
||||
# ----------------------------
|
||||
# Set wallpaper style and apply
|
||||
# Apply wallpaper
|
||||
# ----------------------------
|
||||
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -Value "10"
|
||||
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -Value "0"
|
||||
[Wallpaper]::SystemParametersInfo(20, 0, $outPath, 3) | Out-Null
|
||||
|
||||
# ----------------------------
|
||||
# Restore original wallpaper
|
||||
# ----------------------------
|
||||
if (-not [string]::IsNullOrWhiteSpace($originalWallpaper) -and (Test-Path $originalWallpaper)) {
|
||||
Start-Job -ScriptBlock {
|
||||
param($delay, $wallpaper, $style, $tile)
|
||||
|
||||
Start-Sleep -Seconds $delay
|
||||
|
||||
Add-Type -TypeDefinition @"
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
public class WallpaperRestore {
|
||||
[DllImport("user32.dll", SetLastError=true)]
|
||||
public static extern bool SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni);
|
||||
}
|
||||
"@
|
||||
|
||||
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -Value $style
|
||||
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -Value $tile
|
||||
[WallpaperRestore]::SystemParametersInfo(20, 0, $wallpaper, 3) | Out-Null
|
||||
} -ArgumentList $restoreDelaySeconds, $originalWallpaper, $originalWallpaperStyle, $originalTileWallpaper | Out-Null
|
||||
}
|
||||
Reference in New Issue
Block a user