OMG ET Phone Home

OMG ET Phone Home
Download Copy
Title: OMG ET Phone Home
Author: I am Jakoby

A script I put together to locate your stolen devices, or your *stolen* baited devices. This program is meant to locate your devices. Save the execution file on the boot partition of your devices and when someone plugs it into their computer Using a one liner in the run box a script will be downloaded and executed that grabs the Name and email of the associated microsoft account and the latitude and longitude of where the device was activated. This information is stored in a text document that is then uploaded to your dropbox. Finally the end of the script will delete the runbox and powershell history and delete the files in the TMP Folder and Recycle Bin.

Incident Response, or simply IR, is all about managing the aftermath of a security breach. It's all about identifying, minimizing and containing damage as quickly as possible, as well as remediation such that the risk of additional incidents are minimized. A good incident response plan outlines the responsibilities of all parties, in addition to the procedures the organization takes to manage the incident. Having containment payloads developed, tested and at the ready before an incident will save valuable time when needed. See all incident response payloads.

This payload is for OMG — a platform built for covert field-use with features that enhance remote execution, stealth and forensics evasion, all while being able to quickly change your tooling on the fly.

Submit your own payload, or browse more featured OMG Payloads.

 

 

Related Payloads

Global Powershell Logging and Transcription
Global Powershell Logging and Transcription
This payload executes a script that logs all PowerShell input and output to a text file in the documents folder.
Read More
USB Poison
USB Poison
This payload executes a script that waits for new USB flash storage devices to be connected. When a new device connects,
Read More
Execute commands as NT AUTHORITY\SYSTEM with TrustedInstaller privileges
Execute commands as NT AUTHORITY\SYSTEM with TrustedInstaller privileges
This payload launches a new cmd.exe process with elevated privileges under TrustedInstaller, by setting the TrustedInsta
Read More