RoganDawes/P4wnP1

Features

• HID Covert Channels - Emulates keyboards and mice to execute automated keystroke payloads and establish covert HID communication channels.
• DuckyScript Payload Runners - Runs Rubber Ducky compatible scripts on demand, triggered remotely through HID, WiFi, Bluetooth, or internet relay.
• Air-Gapped Remote Access - Relays HID backdoor sessions over WiFi or Bluetooth to provide remote shell access to isolated, air-gapped targets.
• HID-Based Shell Relays - Relays interactive shell sessions over raw HID reports between air-gapped targets and WiFi-connected attacker devices.
• WiFi Bridge Tools - Provides wireless bridge access and SSH connectivity to air-gapped systems through emulated USB peripherals and network interfaces.
• Multi-Trigger Payload Runners - Executes DuckyScript and custom bash payloads triggered by HID, WiFi, Bluetooth, or keyboard LED events for automated target interaction.
• Composite USB Device Emulations - Provides composite USB device emulation combining HID, mass storage, and network interfaces from a single hardware device.
• Composite USB Interface Emulations - Presents the device as a composite USB interface combining HID, mass storage, RNDIS, CDC ECM, and serial connections simultaneously.
• In-Memory Payload Execution - Delivers and runs multi-stage PowerShell payloads entirely in system memory without writing to disk.
• Remote Keystroke Injection - Sends arbitrary keystrokes or executes DuckyScript payloads on the target from a backdoor shell over HID or WiFi.
• Lock Screen Credential Theft - Automates credential theft from a locked Windows machine by capturing hashes through network redirection, cracking them, and typing the password to unlock the target.
• Event-Triggered Bash Payloads - Executes bash payloads when events occur like network link up, target IP assignment, or SSH login.
• HID Brute-Force Tools - Automates brute-force unlocking of Windows 10 login screens using weak password lists through HID keyboard emulation.
• HID File Transfers - Uploads and downloads files between the device and the target over the raw HID channel.
• Man-in-the-Middle Frameworks - Spoofs network interfaces to route target traffic through the device for interception and relay over WiFi.
• RNDIS Gateway Spoofers - Spoofs RNDIS network interfaces to force target traffic through the device for man-in-the-middle interception.
• RNDIS Gateway Spoofing - Fakes a high-speed RNDIS network interface to force the target to route traffic through the device for man-in-the-middle attacks.
• RNDIS MITM Bridges - Spoofs RNDIS network interfaces to intercept and route target traffic over WiFi for credential theft and network analysis.
• Lock Screen Backdoors - Plants a SYSTEM-level command shell accessible from the lock screen via sticky keys using a registry-based approach without filesystem changes.
• USB Mass Storage Exfiltrators - Types a PowerShell script via keyboard to dump stored credentials from Microsoft Edge or Internet Explorer and saves them to a USB drive.
• Browser Credential Dumpers - Extracts stored browser credentials from targets and copies them to an emulated USB mass storage drive for exfiltration.
• Remote Process Management - Creates, interacts with, and kills multiple remote processes on the target through the covert HID channel.

Star history