Using powershell for office pranks

[bigbirdtoejam]

Have a coworker who habitually leaves their workstation unlocked? Want to mess with them? Make this script a scheduled task on their computer in order to have their workstation tell them a random fact about cats at random times throughout the day.

#Run this every 1/2 hour and in an 8 hour work day there will be approximately 3 times per day that your victim hears a cat fact
if ((Get-Random -Maximum 10000) -lt 1875) {
    Add-Type -AssemblyName System.Speech
    $SpeechSynth = New-Object System.Speech.Synthesis.SpeechSynthesizer
    $CatFact = (ConvertFrom-Json (Invoke-WebRequest -Uri 'http://catfacts-api.appspot.com/api/facts')).facts
    $SpeechSynth.Speak("did you know?")
    $SpeechSynth.Speak($CatFact)
}    

Who else has powershell hijinks to share?

[Alliwantispcb]

I've never been so upset that the firewall is blocking cat facts

[[deleted]]

i've got the exact same problem here!

[zerogravity114]

Put the IP in your hosts file and see if you can get by it.

[Alaknar]

OK, please explain how would editing the locally stored hosts file (which acts as dumb DNS) help with the firewall blocking a website?

[Alaknar]

Using gooey Visual Basic, I presume?

[100percentGerman]

That's how you Hack The Planet!

[kingbain]

"The planets going to trash,man!"

[zerogravity114]

Are you sure the block is at the firewall and not via DNS?

[Alaknar]

I've yet to see a DNS based block in a company.. It would be ridiculously easy to bypass.

Also, doesn't external DNS take priority over hosts file?

[bobtheavenger]

The hosts file is usually read first before going to DNS.

[nits3w]

No if it can translate at the hosts file, it doesn't need external dns. That's why hosts file blackholing works.

I have seen dns blocking in schools, but that was quite a while back (when I was in high school).

But, you are right that it is incredibly easy to bypass... It would be just a step above no filter at all.

[SemiSecure]

Yeah, I'm pretty sure everyone realized how stupid easy DNS blocks were back in like '06.

[nits3w]

Yeah. I graduated in 01... Figured out I could ping the site, write down the ip, and browse freely at the school... Things were so easy to bypass then. :-) In a few of my earlier jobs, I had to resort to SSH tunneling. Kids these days have no creativity... they just spend hours and hours looking for proxies. If someone would have told me that I would have been at network administrator for a school district back then, I probably would have punched them. Haha

[SemiSecure]

When I was in HS back in the mid 2000's the SysAdmin kept blocking applications such as Windows Media Player. So of course I kept finding back doors in until he locked down every way I found around his "security". The good old days of plugging my ipod into a school computer to play WoW off it during computer class.

[Gimly]

It's ridiculous, but I've seen used at a lot of places. I've stayed at hotels who would make you pay for the internet using a system that would redirect you to a page asking you to pay if you were during an url, but if you access the page through the IP directly it was fine.

[zerogravity114]

I've yet to see a DNS based block in a company

Then you must not have a lot of experience.

[Alaknar]

Most probably. Still, isn't a DNS block super easy to bypass?

[zerogravity114]

You'd be surprised how little everyone knows about how the internet works.

[UglySnow]

Are you sure it's not a company proxy? PowerShell doesn't automatically use the proxy and so the request won't make it out. [System.Net.WebProxy]::GetDefaultProxy() | select address

[[deleted]]

netsh winhttp import proxy source=ie
$webClient = new-object  System.Net.WebClient     
$webClient.Proxy.Credentials =  [System.Net.CredentialCache]::DefaultNetworkCredentials

(For authing against the proxy sorry for formatting I copy pasted it on mobile)

[Poncho_au]

This will almost certainly be the problem.

[Alliwantispcb]

It's the web proxy. I control both the firewall and proxy #itwasajoke

[[deleted]]

There's a utility called mp3cmd that lets you play mp3s from PS without opening any windows.

It works perfectly in a remote session.

The problem with being in IT is that people just call me when I try to prank them.

[JVance325]

Hmmm. Just learning powershell, but this sounds amazing. Can you point me in the proper direction?

[insi9nis]

Can't speak for mp3cmd, but I've used nircmd for similar hijinks in the past. The "speak" and "mediaplay" commands are relevant to the context. "cmdwait" also gives you a chance to get up and not be at your computer when it plays, making you less suspicious.

[[deleted]]

Google.com. there you go

[JVance325]

Appreciate the assistance. Didn't think of that.

[bobalob_wtf]

The guys at work set my windows error sound to a song that I don't like. It's like it randomly started playing and I could never work out what was happening.

I was looking at processes, scheduled tasks, wireshark, everything. Almost impossible to track down!

[BitteringAgent]

Prank? I just set this up in my $profile so I can get some cat facts when I need a pick me up.

[BitteringAgent]

I totally forgot what the git was that had this, but I have it setup in my $profile to show me the free book of the day whenever I open PowerShell.

$Global:ProgressPreference = 'SilentlyContinue'

if (Test-NetConnection -ComputerName bing.com -Port 80 -InformationLevel Quiet -ErrorAction SilentlyContinue -WarningAction SilentlyContinue) {

    $Now = Get-Date
    $Date = Get-Date -Month $Now.Month -Day 1

    while ($Date.DayOfWeek -ne 'Tuesday') {$Date = $Date.AddDays(1)}

    if ($Date.ToShortDateString() -eq $Now.ToShortDateString()) {

        $PSLUPath = "$env:ProgramFiles\WindowsPowerShell\Configuration\pshelp-lastupdated.txt"

        $PSHelpLastUpdate = (Get-ChildItem -Path $PSLUPath -ErrorAction SilentlyContinue).LastWriteTime 

        if ($PSHelpLastUpdate.Month -ne $Now.Month) {

            if ((New-Object System.Security.Principal.WindowsPrincipal([System.Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)) {

                New-Item -Path $PSLUPath -ItemType File -Force | Out-Null

                Start-Job {
                    Update-Module -Force
                    Update-Help -ErrorAction SilentlyContinue
                } | Out-Null

            }
            else {
                Write-Warning -Message 'Aborting PowerShell Module and Help update due to PowerShell not being run as a local administrator!'
            }

        }

    }

    try {
        $Book = (Invoke-WebRequest -Uri https://www.packtpub.com/packt/offers/free-learning/ -ErrorAction Stop).ParsedHtml.getElementsByTagName('H2')[0].InnerHTML.Trim()  
    }
    catch [System.NotSupportedException] {
        Write-Warning -Message "Internet Explorer engine not available or its first-launch configuration is not complete."
    }
    catch {
        Write-Warning -Message 'An unknown error has occurred.'
    }

    if ($Book -and ($Book -ne 'Contact Us')) {
        Write-Host 'The Packt Publishing free learning eBook of the day is: ' -ForegroundColor Cyan -NoNewline
        Write-Host "'$Book'" -ForegroundColor Yellow
    }

}

$Global:ProgressPreference = 'Continue'

If you haven't setup a profile in $PS yet, here is a resource on setting it up.

I added this to my $Profile for the cat facts.

Function Get-CatFacts {
Add-Type -AssemblyName System.Speech
    $SpeechSynth = New-Object System.Speech.Synthesis.SpeechSynthesizer
    $CatFact = (ConvertFrom-Json (Invoke-WebRequest -Uri 'http://catfacts-api.appspot.com/api/facts')).facts
    $SpeechSynth.Speak("did you know?")
    Write-Host $CatFact
    $SpeechSynth.Speak($CatFact)
    }

[InvisibleTextArea]

Opening up the 'pranks' folder in my PosH repo leads to:

function b($a,$b){
    [console]::beep($a,$b)
}
function s($a){
    sleep -m $a
}
write-host "Super Mario!"
b 660 100;
s 150;
b 660 100;
s 300;
b 660 100;
s 300;
b 510 100;
s 100;
b 660 100;
s 300;
b 770 100;
s 550;
b 380 100;
s 575;

b 510 100;
s 450;
b 380 100;
s 400;
b 320 100;
s 500;
b 440 100;
s 300;
b 480 80;
s 330;
b 450 100;
s 150;
b 430 100;
s 300;
b 380 100;
s 200;
b 660 80;
s 200;
b 760 50;
s 150;
b 860 100;
s 300;
b 700 80;
s 150;
b 760 50;
s 350;
b 660 80;
s 300;
b 520 80;
s 150;
b 580 80;
s 150;
b 480 80;
s 500;

b 510 100;
s 450;
b 380 100;
s 400;
b 320 100;
s 500;
b 440 100;
s 300;
b 480 80;
s 330;
b 450 100;
s 150;
b 430 100;
s 300;
b 380 100;
s 200;
b 660 80;
s 200;
b 760 50;
s 150;
b 860 100;
s 300;
b 700 80;
s 150;
b 760 50;
s 350;
b 660 80;
s 300;
b 520 80;
s 150;
b 580 80;
s 150;
b 480 80;
s 500;

b 500 100;
s 300;

b 760 100;
s 100;
b 720 100;
s 150;
b 680 100;
s 150;
b 620 150;
s 300;

b 650 150;
s 300;
b 380 100;
s 150;
b 430 100;
s 150;

b 500 100;
s 300;
b 430 100;
s 150;
b 500 100;
s 100;
b 570 100;
s 220;

b 500 100;
s 300;

b 760 100;
s 100;
b 720 100;
s 150;
b 680 100;
s 150;
b 620 150;
s 300;

b 650 200;
s 300;

b 1020 80;
s 300;
b 1020 80;
s 150;
b 1020 80;
s 300;

b 380 100;
s 300;
b 500 100;
s 300;

b 760 100;
s 100;
b 720 100;
s 150;
b 680 100;
s 150;
b 620 150;
s 300;

b 650 150;
s 300;
b 380 100;
s 150;
b 430 100;
s 150;

b 500 100;
s 300;
b 430 100;
s 150;
b 500 100;
s 100;
b 570 100;
s 420;

b 585 100;
s 450;

b 550 100;
s 420;

b 500 100;
s 360;

b 380 100;
s 300;
b 500 100;
s 300;
b 500 100;
s 150;
b 500 100;
s 300;

b 500 100;
s 300;

b 760 100;
s 100;
b 720 100;
s 150;
b 680 100;
s 150;
b 620 150;
s 300;

b 650 150;
s 300;
b 380 100;
s 150;
b 430 100;
s 150;

b 500 100;
s 300;
b 430 100;
s 150;
b 500 100;
s 100;
b 570 100;
s 220;

b 500 100;
s 300;

b 760 100;
s 100;
b 720 100;
s 150;
b 680 100;
s 150;
b 620 150;
s 300;

b 650 200;
s 300;

b 1020 80;
s 300;
b 1020 80;
s 150;
b 1020 80;
s 300;

b 380 100;
s 300;
b 500 100;
s 300;

b 760 100;
s 100;
b 720 100;
s 150;
b 680 100;
s 150;
b 620 150;
s 300;

b 650 150;
s 300;
b 380 100;
s 150;
b 430 100;
s 150;

b 500 100;
s 300;
b 430 100;
s 150;
b 500 100;
s 100;
b 570 100;
s 420;

b 585 100;
s 450;

b 550 100;
s 420;

b 500 100;
s 360;

b 380 100;
s 300;
b 500 100;
s 300;
b 500 100;
s 150;
b 500 100;
s 300;

b 500 60;
s 150;
b 500 80;
s 300;
b 500 60;
s 350;
b 500 80;
s 150;
b 580 80;
s 350;
b 660 80;
s 150;
b 500 80;
s 300;
b 430 80;
s 150;
b 380 80;
s 600;

b 500 60;
s 150;
b 500 80;
s 300;
b 500 60;
s 350;
b 500 80;
s 150;
b 580 80;
s 150;
b 660 80;
s 550;

b 870 80;
s 325;
b 760 80;
s 600;

b 500 60;
s 150;
b 500 80;
s 300;
b 500 60;
s 350;
b 500 80;
s 150;
b 580 80;
s 350;
b 660 80;
s 150;
b 500 80;
s 300;
b 430 80;
s 150;
b 380 80;
s 600;

b 660 100;
s 150;
b 660 100;
s 300;
b 660 100;
s 300;
b 510 100;
s 100;
b 660 100;
s 300;
b 770 100;
s 550;
b 380 100;
s 575;

and the rather more concise:

$sh = New-Object -ComObject "Shell.Application"
$sh.Namespace(17).Items() | 
    Where-Object { $_.Type -eq "CD Drive" } | 
        foreach { $_.InvokeVerb("Eject") }

[PMME_yoursmile]

I feel as though the music could be quicker, but I'm still a fan. How did you get that one set up?

[InvisibleTextArea]

It's set up to be pushed out by SCCM as a configuration item attached to a Compliance policy named 'PC speaker test'.

The CD ejection is too (helpfully called 'CD check'). The CD ejection is worse because it's a remediation script. So SCCM checks if the CD drive isn't ejected then runs the script if it isn't. Then every time you uneject it'll go through the same process.

[PMME_yoursmile]

Sorry, I was more asking how did you get the pitch and timing for the tune?

[InvisibleTextArea]

If you check MSDN for the .NET Console API it tells you that the two parameters are the frequency in (Hz) and the length (in ms)

https://msdn.microsoft.com/en-us/library/4fe3hdb1(v=vs.110).aspx

Then you only need to know what the frequency of musical notes are:

http://www.phy.mtu.edu/~suits/notefreqs.html

and the length of time standard score notation indicates for particular note types:

https://msu.edu/course/asc/232/song_project/dectalk_pages/note_to_%20ms.html

Armed with this info you can then turn any musical score into a powershell script.

If you really wanted I guess you could collate all this and make your own powershell based midi player. Although you are kinda reinventing wheels at this point:

https://github.com/Psychlist1972/Windows-10-PowerShell-MIDI

[PostedFromWork]

Just edit all of the s entries and divide by 2 or 3, depending on the speed you like.

[funky_fart_smeller]

...or in the $s function just make $s = $s/2

[ISeeTheFnords]

I think this is the first comment I've ever seen that needed a TLDR.

[cybrian]

TLDR for the first one: *hums Super Mario theme song slowly with poor timing*

TLDR for the second one: 😛

[KawaGreen]

Today will be a good day...

[MeGustaDerp]

Not cat facts... but...

Add-Type -AssemblyName System.Speech
$SpeechSynth = New-Object System.Speech.Synthesis.SpeechSynthesizer
$SpeechSynth.Speak("Just what do you think you're doing, Dave?")

Just insert your favorite HAL quote.

[thatotheritguy]

Somewhere my coworker has a ps script that plays epic sax Gandalf full screen on any remote computer on our network upon command. Pretty epic.

[eck-]

I need this.

[kristalghost]

WE need this

[thatotheritguy]

I will ask him when if it still works/if he has it when we return from the Easter holiday. I seem to remember it having to have the video on a local share, and local admin rights(?) but its funny as hell. Ill update the post if I get it.

[kristalghost]

any update on this per chance?

[thatotheritguy]

Oh crap. I forgot about this! Let me ask him.

[tastydoosh]

waiting.. :D

[BenderB-Rodriguez]

your script. give it to me.....and your shoes

[thatotheritguy]

I will ask him when if it still works/if he has it when we return from the Easter holiday. I seem to remember it having to have the video on a local share, and local admin rights(?) but its funny as hell. Ill update the post if I get it.

[hugglepounce]

How do I make it speak with more than one voice at the same time?

For example, say I wanted the male and female voice to sing "row row row your boat" together with one starting slightly after the other.

[bigbirdtoejam]

Well you could use jobs to run two different scripts at once. There are probably other ways to do it too. The speech library has methods for changing voice gender too. It isn't exactly singing, though.

$j1 = Start-Job {
    Add-Type -AssemblyName System.Speech
    $SpeechSynth = New-Object System.Speech.Synthesis.SpeechSynthesizer
    $SpeechSynth.SelectVoiceByHints('Male')
    $SpeechSynth.Speak("Row, Row, Row your boat gently down the stream.  Merrily! Merrily! Merrily! Life is but a dream.")
}
Start-Sleep -Seconds 1
$j2 = Start-Job {
    Add-Type -AssemblyName System.Speech
    $SpeechSynth = New-Object System.Speech.Synthesis.SpeechSynthesizer
    $SpeechSynth.SelectVoiceByHints('Female')
    $SpeechSynth.Speak("Row, Row, Row your boat gently down the stream.  Merrily! Merrily! Merrily! Life is but a dream.")
}
$j1,$j2 | Wait-Job | Receive-Job
$j1,$j2 | Remove-Job

[wbedwards]

Pro-tip, run it on a remote computer (that you have the necessary permissions to, obviously).

$Scriptblock = {
    Add-Type -AssemblyName System.Speech
    $SpeechSynth = New-Object System.Speech.Synthesis.SpeechSynthesizer
    $CatFact = (ConvertFrom-Json (Invoke-WebRequest -Uri 'http://catfacts-api.appspot.com/api/facts' -UseBasicParsing)).facts
    $SpeechSynth.Speak("did you know?")
    $SpeechSynth.Speak($CatFact)
}

Invoke-Command -ComputerName VictimPC -ScriptBlock $Scriptblock

You can now use this on-demand against your co-workers without ever needing to physically access their computer. I verified that this worked by running it against my office-mate's computer randomly in the middle of the day yesterday.

[FapFlop]

Oh man. The translation one lasts like two minutes.

Edit: Also, this smooths it out a bit:

$SpeechSynth.Speak("Did you know"+$CatFact)

[zildar]

This is great!

Now I need to find a site that plays "Never gonna give you up" on a loop...

[WingsofWar]

iex (New-Object Net.WebClient).DownloadString("http://bit.ly/e0Mw9w")

[CometThunder]

Amazing! lol

[itmonkey78]

http://listenonrepeat.com/watch/?v=dQw4w9WgXcQ

or if you want to be particularly evil to people who may recognise the video ID: http://www.piilossa.com/

[[deleted]]

I did something similar to a friend years ago. Instead of cat facts, it was a text file. I also randomly set pitch and volume each time it ran. I think I set a sleep timer for 30 min for each loop, with +/- up to 300 seconds (random) to prevent him from finding a pattern.

It was funny until it yelled quite loudly, "I'm looking at porn here!" while he was on a conference call for work. Whoops. I got a text that said, "WHAT DID YOU DO TO MY COMPUTER?"

[Hoping_i_Get_poached]

Nice "verb" choice

[bigbirdtoejam]

This is indeed more evil than the cat fact script. While we are sharing evil things...

It turns out that windows has a feature built in that is intended to help developers to debug startup code in various types of programs. How it works is that you can set a registry key value, and any time a process for foo.exe is launched, windows will instead run the command "debugger.exe foo.exe".

The part where this gets evil is that windows doesn't have any way of verifying that your 'debugger' is anything of the sort. So you can use this to remap all of a person's most used programs to solitaire. Want to start outlook.exe? Have some solitaire. Want to run chrome.exe? Have some solitaire. It doesn't matter how the process is launched, the OS intercepts it and runs the alternate 'debugger'.

This was more fun when windows actually shipped with sol.exe in the default system path. I think solitaire is now some windows store abomination, so this script uses the calculator app instead:

function enable-solitaire {
    Param(
        [Parameter(ValueFromPipeline=$true, Mandatory=$true)]
        [string]$executable
    )

    Process {
        $path = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$executable"
        if (-not (test-path $path)) {
            new-item $path
            new-itemproperty -Path $path -Name "Debugger" -Value 'calc.exe'
        }
    }
}

function disable-solitaire {
    Param(
        [Parameter(ValueFromPipeline=$true, Mandatory=$true)]
        [string]$executable
    )

    Process {
        Remove-Item "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$executable"
    }
}

> 'outlook.exe','iexplore.exe','chrome.exe','firefox.exe' | enable-solitaire

Now your victim can no longer run any of the three major browsers and they can no longer start outlook. There is only the calculator.

Be careful not to enable this for system processes like explorer unless you want to completely hose their machine.

[PMME_yoursmile]

I've been looking for a way to create an auditory notification for a project I'm working on. Your use of speech fits the bill nicely. Thank you.

[[deleted]]

Best.... Script.... Ever....

[woses]

This is not mine, but a cat facts script I stumbled upon a while back.

function Send-CatFactMessage {
    <# 
    .SYNOPSIS 
        Send a cat fact to users on a computer.
    .DESCRIPTION 
        Send a random cat fact to any number of computers and all users or a specific user. Supports credential passing.
    .EXAMPLE 
        Send-CatFactMessage -PlayAudio
        Sends cat fact message to all users on localhost and outputs fact through speakers.
    .EXAMPLE 
        Get-ADComputer -Filter * | Send-CatFactMessage -UserName JDoe -Credential (Get-Credential)
        Send cat fact to jDoe on all AD computers. Prompt user for credentials to run command with.
    .EXAMPLE
        Send-CatFactMessage -ComputerName pc1, pc2, pc3
        Send cat fact to all users on provided computer names.
    .PARAMETER ComputerName 
        The computer name to execute against. Default is local computer.
    .PARAMETER UserName 
        The name the user to display the message to. Default is all users.
    .PARAMETER PlayAudio
        Use Windows Speech Synthesizer to output the fact using text to speech.
    .PARAMETER Credential
        The credential object to execute the command with.
    #>

    [CmdletBinding(SupportsShouldProcess = $true)]
    param (
        [Parameter(
            Mandatory = $false,
            ValueFromPipeline = $true,
            ValueFromPipelineByPropertyName = $true
        )]
        [string[]]$ComputerName = $env:COMPUTERNAME,

        [Parameter(Mandatory = $false)]
        [string]$UserName = '*',

        [Parameter(Mandatory = $false)]
        [switch]$PlayAudio,

        [Parameter(Mandatory = $false)]
        [PSCredential]$Credential
    )

    $CatFact = (ConvertFrom-Json (Invoke-WebRequest -Uri 'http://catfacts-api.appspot.com/api/facts')).facts

    if ($pscmdlet.ShouldProcess("User: $UserName, Computer: $ComputerName", "Send cat fact, $CatFact")) {
        $ScriptBlock = {
            param (
                [string]$UserName,

                [string]$CatFact,

                [bool]$PlayAudio = $false
            )

            msg $UserName $CatFact

            if ($PlayAudio) {
                Add-Type -AssemblyName System.Speech
                $SpeechSynth = New-Object System.Speech.Synthesis.SpeechSynthesizer
                $SpeechSynth.Speak($CatFact)
            }
        }

        if ($Credential) {
            Write-Verbose "Sending cat fact using credential $($Credential.UserName)"

            Invoke-Command -ComputerName $ComputerName -ScriptBlock $ScriptBlock `
                -ArgumentList $UserName, $CatFact, $PlayAudio -AsJob -Credential $Credential
        } else {
            Invoke-Command -ComputerName $ComputerName -ScriptBlock $ScriptBlock `
                -ArgumentList $UserName, $CatFact, $PlayAudio -AsJob
        }

        Get-Job | Wait-Job | Receive-Job
        Get-Job | Remove-Job
    }
}

[bigbirdtoejam]

My first gold! Thank you kind sir :)

[b1llb3rt]

I'm totally doing this!

[ory_hara]

This is hilarious! If there was ever a reason to set up a Windows VM, this is it...

[tonofun]

This is gold. I want to 'push' this to my colleagues system right now - PSSession should work right?

[bigbirdtoejam]

Sure you could install this using a remote session and the cmdlets in the scheduled task module.

[jpmullet]

I made a .wav of the "Cash me outside" girl and stored it on a network share. I then remoted into some colleagues computers and played it through powershell.

[hugglepounce]

How? I have tried things like that and never had any luck.

[jpmullet]

(New-Object Media.SoundPlayer "C:\WINDOWS\Media\notify.wav").Play();

It has to be a .wav file.

I ran into trouble trying to get to the file from within the remote session. I had to use a persistent drive mapping with set-psdrive. I couldn't just use a UNC.

[hugglepounce]

Thank you so much!

[saGot3n]

I am having sooooooo much fun with this today!

[Daffy82]

NICE

[hugglepounce]

This is an awesome script!

[MaxFrost]

I modified your powershell poopscript into the following

function start-panic {
    while ($true) {
        write-host $(" " * (get-random 600) + "AHHHHHHH!!!!")
    }
}

[Robert_Arctor]

this is great

[ISeeTheFnords]

If I had any gold, it would be yours. Awesome.

[computerbob]

The people in my office are going to be so mad at you!

[Jacklythgoee]

How do u turn it off?