hak5/bashbunny-payloads
1
0
Fork 0
mirror of https://github.com/hak5/bashbunny-payloads.git synced 2025-10-29 16:58:25 +00:00
Code Issues Packages Projects Releases Wiki Activity
bashbunny-payloads/payloads/library/credentials/Win_PoSH_FakeLogin/readme.md
cribb-it 8cd8d859cd
New Payload: Win_PoSH_WordReport, Fix typos in Win_PoSH_FakeLoginScreen (#431) 
* Add files via upload

* Update readme.md

* Update payload.txt

* Update readme.md

* Update readme.md

* Update readme.md

* Update readme.md

* Update readme.md

* Add files via upload

* Update readme.md

* Update readme.md

* Add Payload WIN_PoSH_HKU_RegBackUp

* Update readme.md

* Update payload.txt

* Change for admin shell

* Update readme.md

* Update payload.txt

* Update payload.txt

* Update readme.md

* Added payload WIN_PoSH_SaveSecurityHive

Added new payload to exfiltration that saves the HKLM security hive to the bunny

* Morse Code File Exfiltration

A bit pointless with limitation of morse code but I thought it was fun to create.

* Update readme.md

* Update for non-alphanumeric

* Update for timing

* Update readme.md

* Update readme.md

* Update readme.md

* Update readme.md

* Update payload.txt

* New payload - Fake Login

Shows a fake version of the windows 10 login screen

* Update readme.md

* Changes to Fake Login Payload

* Changes to Fake Login

* Win_PoSH_FakeLogin: Changes to payload and readme

* New recon payload: Win_PoSH_WordReport

* Update fixed typo: Win_PoSH_WordReport
2021-04-30 17:02:21 +01:00

2.0 KiB
Raw Blame History

Fake Login

  • Author: Cribbit
  • Version: 1.0
  • Target: Windows 10 (Powershell 5.1+)
  • Category: Credentials
  • Attackmode: HID & Storage
  • Extensions: Run
  • Props: PanicAcid for testing multi-screen desktops, Foxtrot and Other Hak5 Discord members

Change Log

Version Changes
1.0 Initial release

Description

Shows a fake login screen. Saves the entered value to the loots folder on the bunny.

Config

This payload contains 9 base64 encode images. If you do not wish to use them you could have the files on the bunny and do something like this:

$BGImg = [System.Drawing.Image]::FromFile(<PathToBunny>"bg.jpg");

or if you have web hosting or a http server running on the bunny then you can do something like:

$R = Invoke-WebRequest 'https://<MyURL/IPAddress>/bg.jpg'; 
$BGImg = [System.Drawing.Image]::FromStream($R.RawContentStream);

To Do

Adding a To Do section just in case someone (or me if I can be bothered) want to fix some issues:

  • Fade between Time panel 1 and login panel 2
    • The beginnings of the code are there but has too much noticeable flicker.
  • Disable notifications as they display over the form:
    • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer, this Explorer needs to be created, Dword32 “DisableNotificationCenter”, value as 1.
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PushNotifications, "ToastEnabled" DWORD 0 = Turn off
    • HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.AutoPlay, "Enabled" = 0

Colours

Status Colour Description
SETUP Magenta solid Setting attack mode
ATTACK Yellow single blink Injecting Powershell script
FINISH Green blink followed by SOLID Script is finished