diff --git a/Demo.ps1 b/Demo.ps1 index ec0f00f..a854f8d 100644 --- a/Demo.ps1 +++ b/Demo.ps1 @@ -1,3 +1,7 @@ + + +$demoStart = Get-Date + Add-Type -AssemblyName System.Drawing Add-Type -TypeDefinition @" using System; @@ -13,19 +17,22 @@ public class Wallpaper { # ---------------------------- $clientName = "Ford" -# Use the RAW file URL from your repo +# RAW URL from your repo $logoUrl = "https://git.svstools.com/syelle/Ducky/raw/branch/main/Ford.png" # Optional local fallback if download fails $fallbackLogo = "C:\Temp\ford_logo.png" -# Temp working directory +# Working folder $workDir = Join-Path $env:TEMP "ClientAwarenessDemo" New-Item -ItemType Directory -Path $workDir -Force | Out-Null $downloadedLogo = Join-Path $workDir "ford_logo.png" $logoPath = $null +# How long before restoring the original wallpaper +$restoreDelaySeconds = 30 + # ---------------------------- # Download logo # ---------------------------- @@ -43,6 +50,13 @@ if (-not $logoPath -and (Test-Path $fallbackLogo)) { $logoPath = $fallbackLogo } +# ---------------------------- +# Save current wallpaper +# ---------------------------- +$originalWallpaper = (Get-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallPaper -ErrorAction SilentlyContinue).WallPaper +$originalWallpaperStyle = (Get-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -ErrorAction SilentlyContinue).WallpaperStyle +$originalTileWallpaper = (Get-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -ErrorAction SilentlyContinue).TileWallpaper + # ---------------------------- # Collect harmless live info # ---------------------------- @@ -59,10 +73,37 @@ if ([string]::IsNullOrWhiteSpace($ipv4)) { $ipv4 = "Not found" } if ([string]::IsNullOrWhiteSpace($gateway)) { $gateway = "Not found" } if ([string]::IsNullOrWhiteSpace($dns)) { $dns = "Not found" } +# Try to get the primary adapter +$adapterName = "Not found" +try { + $primaryAdapter = Get-NetIPConfiguration | + Where-Object { $_.IPv4Address -and $_.NetAdapter.Status -eq 'Up' } | + Select-Object -First 1 + + if ($primaryAdapter) { + $adapterName = $primaryAdapter.InterfaceAlias + if (-not $ipv4 -or $ipv4 -eq "Not found") { + $ipv4 = $primaryAdapter.IPv4Address.IPAddress + } + if (-not $gateway -or $gateway -eq "Not found") { + $gateway = $primaryAdapter.IPv4DefaultGateway.NextHop + } + if (-not $dns -or $dns -eq "Not found") { + $dnsServers = $primaryAdapter.DNSServer.ServerAddresses + if ($dnsServers) { + $dns = ($dnsServers -join ", ") + } + } + } +} +catch { + # fall back to parsed ipconfig values +} + # ---------------------------- # Simulated file names only # ---------------------------- -$fakeFiles = @( +<#$fakeFiles = @( "Payroll_2025.xlsx", "Client_Contracts.docx", "VPN_Credentials.txt", @@ -74,6 +115,18 @@ $fakeFiles = @( "MFA_Recovery_Codes.txt", "Confidential_Pricing.pdf" ) +#> + +$officeExtensions = @("*.doc","*.docx","*.xls","*.xlsx","*.ppt","*.pptx","*.pub","*.vsd","*.vsdx","*.one","*.rtf","*.csv") + +$OfficeDocs = Get-ChildItem -Path $env:USERPROFILE -Recurse -File -Include $officeExtensions -ErrorAction SilentlyContinue | + Select-Object FullName, Name, Extension, Length, LastWriteTime + +# ---------------------------- +# Timing text +# ---------------------------- +$elapsedSeconds = [math]::Round(((Get-Date) - $demoStart).TotalSeconds, 1) +$timingText = "Demonstration completed in $elapsedSeconds seconds" # ---------------------------- # Create wallpaper canvas @@ -93,6 +146,7 @@ $accentColor = [System.Drawing.Color]::FromArgb(0,173,239) $textColor = [System.Drawing.Color]::White $mutedColor = [System.Drawing.Color]::FromArgb(190,190,190) $warnColor = [System.Drawing.Color]::FromArgb(255,210,90) +$successColor = [System.Drawing.Color]::FromArgb(110,255,180) $g.Clear($bgColor) @@ -102,6 +156,7 @@ $accentBrush = New-Object System.Drawing.SolidBrush $accentColor $textBrush = New-Object System.Drawing.SolidBrush $textColor $mutedBrush = New-Object System.Drawing.SolidBrush $mutedColor $warnBrush = New-Object System.Drawing.SolidBrush $warnColor +$successBrush = New-Object System.Drawing.SolidBrush $successColor $borderPen = New-Object System.Drawing.Pen $accentColor, 2 # Fonts @@ -109,6 +164,7 @@ $titleFont = New-Object System.Drawing.Font("Segoe UI", 28, [System.Drawing.Font $headerFont = New-Object System.Drawing.Font("Segoe UI", 16, [System.Drawing.FontStyle]::Bold) $bodyFont = New-Object System.Drawing.Font("Consolas", 15, [System.Drawing.FontStyle]::Regular) $smallFont = New-Object System.Drawing.Font("Segoe UI", 12, [System.Drawing.FontStyle]::Regular) +$timingFont = New-Object System.Drawing.Font("Segoe UI", 14, [System.Drawing.FontStyle]::Bold) # ---------------------------- # Draw logo @@ -130,20 +186,22 @@ if ($logoPath -and (Test-Path $logoPath)) { $g.DrawString("$clientName Security Awareness Demonstration", $titleFont, $accentBrush, 60, 155) $g.DrawString("This workstation accepted commands in seconds.", $headerFont, $textBrush, 60, 210) $g.DrawString("Simulation only. No files were accessed, searched, copied, or transmitted.", $headerFont, $warnBrush, 60, 245) +$g.DrawString($timingText, $timingFont, $successBrush, 60, 278) # ---------------------------- # Left panel: real harmless info # ---------------------------- -$leftRect = New-Object System.Drawing.Rectangle 60, 310, 760, 460 +$leftRect = New-Object System.Drawing.Rectangle 60, 320, 760, 490 $g.FillRectangle($panelBrush, $leftRect) $g.DrawRectangle($borderPen, $leftRect) -$g.DrawString("Live harmless reconnaissance", $headerFont, $accentBrush, 80, 330) +$g.DrawString("Live harmless reconnaissance", $headerFont, $accentBrush, 80, 340) -$y = 385 +$y = 395 $lineGap = 42 $g.DrawString("Hostname : $hostName", $bodyFont, $textBrush, 90, $y); $y += $lineGap $g.DrawString("User : $userName", $bodyFont, $textBrush, 90, $y); $y += $lineGap +$g.DrawString("Adapter : $adapterName", $bodyFont, $textBrush, 90, $y); $y += $lineGap $g.DrawString("IPv4 : $ipv4", $bodyFont, $textBrush, 90, $y); $y += $lineGap $g.DrawString("Gateway : $gateway", $bodyFont, $textBrush, 90, $y); $y += $lineGap $g.DrawString("DNS : $dns", $bodyFont, $textBrush, 90, $y); $y += $lineGap + 10 @@ -154,15 +212,15 @@ $g.DrawString("hostname whoami ipconfig", $bodyFont, $textBrush, 90, $y + # ---------------------------- # Right panel: simulated file targets # ---------------------------- -$rightRect = New-Object System.Drawing.Rectangle 870, 310, 980, 560 +$rightRect = New-Object System.Drawing.Rectangle 870, 320, 980, 560 $g.FillRectangle($panelBrush, $rightRect) $g.DrawRectangle($borderPen, $rightRect) -$g.DrawString("Simulated attacker targets", $headerFont, $accentBrush, 890, 330) -$g.DrawString("Examples of the kinds of files a bad actor would likely search for:", $smallFont, $mutedBrush, 890, 370) +$g.DrawString("Simulated attacker targets", $headerFont, $accentBrush, 890, 340) +$g.DrawString("Examples of the kinds of files a bad actor would likely search for:", $smallFont, $mutedBrush, 890, 380) -$y2 = 420 -foreach ($file in $fakeFiles) { +$y2 = 430 +foreach ($file in $OfficeDocs) { $g.DrawString("• $file", $bodyFont, $textBrush, 900, $y2) $y2 += 38 } @@ -171,7 +229,9 @@ foreach ($file in $fakeFiles) { # Footer # ---------------------------- $footerText = "Takeaway: brief physical access to an unlocked session can expose important information fast." -$g.DrawString($footerText, $headerFont, $warnBrush, 60, 965) +$restoreText = "Original wallpaper will be restored in $restoreDelaySeconds seconds." +$g.DrawString($footerText, $headerFont, $warnBrush, 60, 935) +$g.DrawString($restoreText, $smallFont, $mutedBrush, 60, 975) # ---------------------------- # Save wallpaper @@ -189,15 +249,41 @@ $accentBrush.Dispose() $textBrush.Dispose() $mutedBrush.Dispose() $warnBrush.Dispose() +$successBrush.Dispose() $borderPen.Dispose() $titleFont.Dispose() $headerFont.Dispose() $bodyFont.Dispose() $smallFont.Dispose() +$timingFont.Dispose() # ---------------------------- -# Set wallpaper style and apply +# Apply wallpaper # ---------------------------- Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -Value "10" Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -Value "0" -[Wallpaper]::SystemParametersInfo(20, 0, $outPath, 3) | Out-Null \ No newline at end of file +[Wallpaper]::SystemParametersInfo(20, 0, $outPath, 3) | Out-Null + +# ---------------------------- +# Restore original wallpaper +# ---------------------------- +if (-not [string]::IsNullOrWhiteSpace($originalWallpaper) -and (Test-Path $originalWallpaper)) { + Start-Job -ScriptBlock { + param($delay, $wallpaper, $style, $tile) + + Start-Sleep -Seconds $delay + + Add-Type -TypeDefinition @" +using System; +using System.Runtime.InteropServices; +public class WallpaperRestore { + [DllImport("user32.dll", SetLastError=true)] + public static extern bool SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); +} +"@ + + Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -Value $style + Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -Value $tile + [WallpaperRestore]::SystemParametersInfo(20, 0, $wallpaper, 3) | Out-Null + } -ArgumentList $restoreDelaySeconds, $originalWallpaper, $originalWallpaperStyle, $originalTileWallpaper | Out-Null +} \ No newline at end of file