* Uploaded ReverseBunny
Obfuscated reverse shell via powershell
* Uploaded WifiSnatch
Get your targets stored wifi information and credentials, store them on your Bashbunny and hop away 🐇
* Update ReverseBunny.txt
Changed payload to evade Windows Defender
* Update payload.txt
Added new "Eject Method" - props to Night(9o3)
* Update README.md
* Deleted ReverseBunny.txt
Deleted because of higher risk to get caught by AV
* Updated ReverseBunny to version 1.2
Updated ReverseBunny to version 1.2.
- Deleted payload on disk because of AV
- Added custom shell design
* Updated ReverseBunny to version 1.2
Updated README for ReverseBunny update
* Updated payload
fixed some stupid left overs <3
* Uploaded ReverseBunny
Obfuscated reverse shell via powershell
* Uploaded WifiSnatch
Get your targets stored wifi information and credentials, store them on your Bashbunny and hop away 🐇
* Update ReverseBunny.txt
Changed payload to evade Windows Defender
* Update payload.txt
Added new "Eject Method" - props to Night(9o3)
* Update README.md
* USB Exfiltration Payload with Win10 Fake Update
This Payload exfiltrates defined files to the Bunny. While copying is in progress, it shows a Fake Win10 Update Screen and removes traces. When it's ready, the target machine is forced to reboot.
* Correction for the Key injection F11
* Create test
* Delete payloads/library/USB_Exfil_with_Fake_Update _and_force-reboot directory
* Create tst
* Add files via upload
* Delete tst
* Delete payloads/library/exfiltration/USB Exfil with Fake Update and force reboot directory
* Uploaded ReverseBunny
Obfuscated reverse shell via powershell
* Uploaded WifiSnatch
Get your targets stored wifi information and credentials, store them on your Bashbunny and hop away 🐇
* New Payload
Added new PrintNightmare Payload (Quick and dirty)
* Fixed my potty mouth
I'm a child sometimes
* Renamed Payload
* PrintNightmare: Use SWITCH_POSITION in payload path
* Fixing a typo
* Added Delays
Added some delays due to the fact that it was inconsistently reliable, occasionally it'd half type out the command. The delays have resolved the consistency issue on my end. Feel free to tweak as required.
* Amending Version Number
I'm a fool
* Updated Readme with proper credit
* Housekeeping
Moved some of the QUACK Powershell commands into the juicybit.txt file for speed and ease of use.
* Update README.md
* More improvement
Added exit to the juicybits rather than using alt and /noprofile to the run as
* Update README.md
* Pineapple-Connect-Windows New Payload For Connecting Client To Pineapple AP / Any AP
Pineapple-Connect-Windows new Bashbunny payload for connecting target machine quickly and efficiently to your Pineapple AP or an AP of your choosing (and control!)
* Changed from RUN WIN to QUACK STRING
Changed from RUN WIN to QUACK STRING as I was having issues with the formatting, presume it needs wrapping in quotes or something but it just kept breaking. QUACK STRING works fine so meh
* Added command to cover traks at the end of the script
added a line of powershell to clean out the run registry key to hide any evidence of the script running
Co-authored-by: Marc <foxtrot@malloc.me>
Co-authored-by: Marc <foxtrot@realloc.me>
Exploit Razer USA HID driver installation to System authority PowerShell.
This is heavily based on Tweet by @_MG_ on 22nd Aug 2021 but modified to work with BashBunny
* Delete stage3.ps1
* Update ATNT to work as intended.
Update ATNT to work as intended. Requires reboot or logoff to fully register AT.
* Remove DONE file in cleanup.
Forgot to remove DONE file. Now also makes sure this file does not exist before running.
Disable "PowerShell" logging
Check if current process have "Administrator" privilege
Check "SeDebugPrivilege" policy
Retrieves the processes belonging to the "SYSTEM" account
For each system PID, test to obtain the "SYSTEM" account via the parent process
* Housekeeping
Moved some of the QUACK Powershell commands into the juicybit.txt file for speed and ease of use.
* Update README.md
* More improvement
Added exit to the juicybits rather than using alt and /noprofile to the run as
* Update README.md
Co-authored-by: Marc <foxtrot@realloc.me>
* New Payload
Added new PrintNightmare Payload (Quick and dirty)
* Fixed my potty mouth
I'm a child sometimes
* Renamed Payload
* PrintNightmare: Use SWITCH_POSITION in payload path
* Fixing a typo
* Added Delays
Added some delays due to the fact that it was inconsistently reliable, occasionally it'd half type out the command. The delays have resolved the consistency issue on my end. Feel free to tweak as required.
* Amending Version Number
I'm a fool
* Updated Readme with proper credit
Co-authored-by: Marc <foxtrot@malloc.me>
* New Payload
Added new PrintNightmare Payload (Quick and dirty)
* Fixed my potty mouth
I'm a child sometimes
* Renamed Payload
* PrintNightmare: Use SWITCH_POSITION in payload path
* Fixing a typo
Co-authored-by: Marc <foxtrot@malloc.me>
