diff --git a/payloads/library/credentials/FireSnatcher/README.md b/payloads/library/credentials/FireSnatcher/README.md index 1d3b0dd0..d55eed6e 100644 --- a/payloads/library/credentials/FireSnatcher/README.md +++ b/payloads/library/credentials/FireSnatcher/README.md @@ -1,7 +1,7 @@ # Title: FireSnatcher # Description: Copies Wifi Keys, and Firefox Password Databases # Author: KarrotKak3 -# Props: saintcrossbow & 0iphor13 +# Props: saintcrossbow & 0i41E # Version: 1.0.2.0 (Work in Progress) # Category: Credentials # Target: Windows (Logged in) diff --git a/payloads/library/credentials/FireSnatcher/payload.txt b/payloads/library/credentials/FireSnatcher/payload.txt index 143efd55..3c1c4443 100644 --- a/payloads/library/credentials/FireSnatcher/payload.txt +++ b/payloads/library/credentials/FireSnatcher/payload.txt @@ -1,7 +1,7 @@ # Title: FireSnatcher # Description: Copies Wifi Keys, and Firefox Password Databases # Author: KarrotKak3 -# Props: saintcrossbow & 0iphor13 +# Props: saintcrossbow & 0i41E # Version: 1.0.2.0 (Work in Progress) # Category: Credentials # Target: Windows (Logged in) diff --git a/payloads/library/credentials/HashDumpBunny/README.md b/payloads/library/credentials/HashDumpBunny/README.md index b1460dd5..905c12fb 100644 --- a/payloads/library/credentials/HashDumpBunny/README.md +++ b/payloads/library/credentials/HashDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: HashDumpBunny** -Author: 0iphor13 +Author: 0i41E Version: 1.0 @@ -17,4 +17,4 @@ Place BunnyDump.bat in the same payload switch-folder as your payload.txt # Plug in BashBunny. Exfiltrate the out.txt file and try to crack the hashes. - + diff --git a/payloads/library/credentials/HashDumpBunny/payload.txt b/payloads/library/credentials/HashDumpBunny/payload.txt index f21e4a36..2e9e6843 100644 --- a/payloads/library/credentials/HashDumpBunny/payload.txt +++ b/payloads/library/credentials/HashDumpBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: HashDumpBunny # Description: Dump user hashes with this script, which was obfuscated with multiple layers. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/credentials/MiniDumpBunny/README.md b/payloads/library/credentials/MiniDumpBunny/README.md index a6fba8e0..c314caf2 100644 --- a/payloads/library/credentials/MiniDumpBunny/README.md +++ b/payloads/library/credentials/MiniDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: MiniDumpBunny** -Author: 0iphor13 +Author: 0i41E Version: 1.0 @@ -14,4 +14,4 @@ What is MiniDumpBunny? Plug in your BashBunny equipped with the obfuscated MiniBunny.bat file, wait a few seconds, go away. # Exfiltrate the .dmp file and read it with Mimikatz. - \ No newline at end of file + \ No newline at end of file diff --git a/payloads/library/credentials/MiniDumpBunny/payload.txt b/payloads/library/credentials/MiniDumpBunny/payload.txt index 2fc58a03..467e748a 100644 --- a/payloads/library/credentials/MiniDumpBunny/payload.txt +++ b/payloads/library/credentials/MiniDumpBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: MiniDumpBunny # Description: Dump lsass with this script, which was obfuscated with multiple layers. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/credentials/ProcDumpBunny/README.md b/payloads/library/credentials/ProcDumpBunny/README.md index 31b9ef73..afcf570b 100644 --- a/payloads/library/credentials/ProcDumpBunny/README.md +++ b/payloads/library/credentials/ProcDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: ProcDumpBunny** -Author: 0iphor13 +Author: 0i41E Version: 1.0 @@ -12,10 +12,10 @@ What is ProcDumpBunny? **Instruction:** Download ProcDump from Microsoft - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump - rename the Executeable to Bunny.exe -.png) +.png) Place Bunny.exe in the same payload switch as your payload -.png) +.png) # Plug in BashBunny. Exfiltrate the out.dmp file and read it with Mimikatz. -.png) +.png) diff --git a/payloads/library/credentials/ProcDumpBunny/payload.txt b/payloads/library/credentials/ProcDumpBunny/payload.txt index b0275b7e..9480cf77 100644 --- a/payloads/library/credentials/ProcDumpBunny/payload.txt +++ b/payloads/library/credentials/ProcDumpBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: ProcDumpBunny # Description: Dump lsass.exe with a renamed version of procdump -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/credentials/SamDumpBunny/README.md b/payloads/library/credentials/SamDumpBunny/README.md index 683fd00d..6e64f4fa 100644 --- a/payloads/library/credentials/SamDumpBunny/README.md +++ b/payloads/library/credentials/SamDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: SamDumpBunny** -
Author: 0iphor13
+
Author: 0i41E
OS: Windows
Version: 1.0
@@ -21,4 +21,4 @@ Afterwards you can use a tool like samdump2 to extract the users hashes.
Author: 0i41E
+OS: Windows
+Version: 1.0
+
+**What is SerialNumBunny?**
+
+*It is pretty simple... The BashBunny enables you to set its USB identifiers. You can change VID, PID, Manufacturer and of course, the Serial number. Now we do the little trick here and place our payload within the serial number. Then starting a webserver on the Bunny, where a script is hosted and call the serial number via powershell on the target system. The content of the retrieved script is then executed on the target. Easy as that.*
+
+You can get pretty creative here, from basically calling basic powershell commands, up to this example where you execute remote scripts.
+
+**Instruction:**
+
+- Upload your script or the example provided onto your Bunnys switch folder.
+- Plug in the Bunny and let the magic happen.
+
+
+_Note: If you want to adapt your payload nested, in the serial number, you may need to stay in a certain character limit. In my case this was 40 characters. This might be different, depending on your target. Also make sure to replace spaces within the serial number with underscores._
diff --git a/payloads/library/exfiltration/WifiSnatch/payload.txt b/payloads/library/exfiltration/WifiSnatch/payload.txt
index 45aa88ce..42b6c249 100644
--- a/payloads/library/exfiltration/WifiSnatch/payload.txt
+++ b/payloads/library/exfiltration/WifiSnatch/payload.txt
@@ -2,7 +2,7 @@
#
# Title: WifiSnatch
# Description: Extract wifi information, such as passphrases & SSIDs
-# Author: 0iphor13
+# Author: 0i41E
# Version: 1.1
# Category: Exfiltration
# Attackmodes: HID, Storage
diff --git a/payloads/library/prank/-BB-AcidBurn/README.md b/payloads/library/prank/-BB-AcidBurn/README.md
index 9e799ed1..5b83236a 100644
--- a/payloads/library/prank/-BB-AcidBurn/README.md
+++ b/payloads/library/prank/-BB-AcidBurn/README.md
@@ -105,7 +105,7 @@ Arf
* [Hak5](https://hak5.org/)
* [MG](https://github.com/OMG-MG)
-* [0iphor13](https://github.com/0iphor13)
+* [0i41E](https://github.com/0i41E)
* [PhilSutter](https://github.com/PhilSutter)
diff --git a/payloads/library/prank/-BB-JumpScare/README.md b/payloads/library/prank/-BB-JumpScare/README.md
index 69ef63f2..ece60b5d 100644
--- a/payloads/library/prank/-BB-JumpScare/README.md
+++ b/payloads/library/prank/-BB-JumpScare/README.md
@@ -93,7 +93,7 @@ I am Jakoby
* [Hak5](https://hak5.org/)
* [MG](https://github.com/OMG-MG)
-* [0iphor13](https://github.com/0iphor13)
+* [0i41E](https://github.com/0i41E)
* [PhilSutter](https://github.com/PhilSutter)
diff --git a/payloads/library/remote_access/PingZhellBunny/Bunny.pl b/payloads/library/remote_access/PingZhellBunny/Bunny.pl
index 4bac2738..2a835894 100644
--- a/payloads/library/remote_access/PingZhellBunny/Bunny.pl
+++ b/payloads/library/remote_access/PingZhellBunny/Bunny.pl
@@ -15,7 +15,7 @@
# You should have received a copy of the GNU General Public License
# along with this program. If not, see
Author: 0iphor13
+
Author: 0i41E
OS: Windows
Version: 1.5
diff --git a/payloads/library/remote_access/PingZhellBunny/payload.txt b/payloads/library/remote_access/PingZhellBunny/payload.txt
index 2690061a..89617aac 100644
--- a/payloads/library/remote_access/PingZhellBunny/payload.txt
+++ b/payloads/library/remote_access/PingZhellBunny/payload.txt
@@ -2,7 +2,7 @@
#
# Title: PingZhellBunny
# Description: Getting remote access via ICMP
-# Author: 0iphor13
+# Author: 0i41E
# Version: 1.5
# Category: Remote_Access
# Attackmodes: HID, RNDIS_ETHERNET
diff --git a/payloads/library/remote_access/ReverseBunny/README.md b/payloads/library/remote_access/ReverseBunny/README.md
index d3b39a26..fd2a6b3d 100644
--- a/payloads/library/remote_access/ReverseBunny/README.md
+++ b/payloads/library/remote_access/ReverseBunny/README.md
@@ -1,6 +1,6 @@
**Title: ReverseBunny**
-
Author: 0iphor13
+
Author: 0i41E
OS: Windows
Version: 1.5
@@ -8,7 +8,7 @@ Version: 1.5
!Getting remote access via obfuscated reverse shell!
Upload payload.txt and RevBunny.ps1 onto your Bunny
-
+
Change the variables in payload.txt to your attacking machine & start your listener. (for example netcat: nc -lvnp [PORT] )
Author: 0iphor13
+
Author: 0i41E
OS: Windows
Version: 1.2
For input and inspiration - Thanks to: Cribbit, sebkinne