From 27ad6acfe23f43829458dce23234680ae5fe5b7f Mon Sep 17 00:00:00 2001 From: 0i41E <79219148+0i41E@users.noreply.github.com> Date: Tue, 28 May 2024 19:34:18 +0200 Subject: [PATCH] Username Change --- payloads/library/credentials/FireSnatcher/README.md | 2 +- payloads/library/credentials/FireSnatcher/payload.txt | 2 +- payloads/library/credentials/HashDumpBunny/README.md | 4 ++-- payloads/library/credentials/HashDumpBunny/payload.txt | 2 +- payloads/library/credentials/MiniDumpBunny/README.md | 4 ++-- payloads/library/credentials/MiniDumpBunny/payload.txt | 2 +- payloads/library/credentials/ProcDumpBunny/README.md | 8 ++++---- payloads/library/credentials/ProcDumpBunny/payload.txt | 2 +- payloads/library/credentials/SamDumpBunny/README.md | 4 ++-- payloads/library/credentials/SamDumpBunny/payload.txt | 2 +- payloads/library/credentials/SessionBunny/README.md | 4 ++-- .../library/credentials/SessionBunny/SessionBunny.ps1 | 2 +- payloads/library/credentials/SessionBunny/payload.txt | 2 +- payloads/library/execution/SerialNumBunny/1.PS1 | 2 +- payloads/library/execution/SerialNumBunny/payload.txt | 2 +- payloads/library/execution/SerialNumBunny/readme.md | 4 ++-- payloads/library/exfiltration/WifiSnatch/payload.txt | 2 +- payloads/library/prank/-BB-AcidBurn/README.md | 2 +- payloads/library/prank/-BB-JumpScare/README.md | 2 +- payloads/library/remote_access/PingZhellBunny/Bunny.pl | 2 +- payloads/library/remote_access/PingZhellBunny/README.md | 2 +- payloads/library/remote_access/PingZhellBunny/payload.txt | 2 +- payloads/library/remote_access/ReverseBunny/README.md | 4 ++-- payloads/library/remote_access/ReverseBunny/payload.txt | 2 +- payloads/library/remote_access/ReverseBunnySSL/README.md | 6 +++--- .../library/remote_access/ReverseBunnySSL/payload.txt | 2 +- 26 files changed, 37 insertions(+), 37 deletions(-) diff --git a/payloads/library/credentials/FireSnatcher/README.md b/payloads/library/credentials/FireSnatcher/README.md index 1d3b0dd02..d55eed6ec 100644 --- a/payloads/library/credentials/FireSnatcher/README.md +++ b/payloads/library/credentials/FireSnatcher/README.md @@ -1,7 +1,7 @@ # Title: FireSnatcher # Description: Copies Wifi Keys, and Firefox Password Databases # Author: KarrotKak3 -# Props: saintcrossbow & 0iphor13 +# Props: saintcrossbow & 0i41E # Version: 1.0.2.0 (Work in Progress) # Category: Credentials # Target: Windows (Logged in) diff --git a/payloads/library/credentials/FireSnatcher/payload.txt b/payloads/library/credentials/FireSnatcher/payload.txt index 143efd55a..3c1c4443a 100644 --- a/payloads/library/credentials/FireSnatcher/payload.txt +++ b/payloads/library/credentials/FireSnatcher/payload.txt @@ -1,7 +1,7 @@ # Title: FireSnatcher # Description: Copies Wifi Keys, and Firefox Password Databases # Author: KarrotKak3 -# Props: saintcrossbow & 0iphor13 +# Props: saintcrossbow & 0i41E # Version: 1.0.2.0 (Work in Progress) # Category: Credentials # Target: Windows (Logged in) diff --git a/payloads/library/credentials/HashDumpBunny/README.md b/payloads/library/credentials/HashDumpBunny/README.md index b1460dd57..905c12fbb 100644 --- a/payloads/library/credentials/HashDumpBunny/README.md +++ b/payloads/library/credentials/HashDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: HashDumpBunny** -Author: 0iphor13 +Author: 0i41E Version: 1.0 @@ -17,4 +17,4 @@ Place BunnyDump.bat in the same payload switch-folder as your payload.txt # Plug in BashBunny. Exfiltrate the out.txt file and try to crack the hashes. -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/HashDumpBunny/censoredhash.png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/HashDumpBunny/censoredhash.png) diff --git a/payloads/library/credentials/HashDumpBunny/payload.txt b/payloads/library/credentials/HashDumpBunny/payload.txt index f21e4a367..2e9e68431 100644 --- a/payloads/library/credentials/HashDumpBunny/payload.txt +++ b/payloads/library/credentials/HashDumpBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: HashDumpBunny # Description: Dump user hashes with this script, which was obfuscated with multiple layers. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/credentials/MiniDumpBunny/README.md b/payloads/library/credentials/MiniDumpBunny/README.md index a6fba8e03..c314caf27 100644 --- a/payloads/library/credentials/MiniDumpBunny/README.md +++ b/payloads/library/credentials/MiniDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: MiniDumpBunny** -Author: 0iphor13 +Author: 0i41E Version: 1.0 @@ -14,4 +14,4 @@ What is MiniDumpBunny? Plug in your BashBunny equipped with the obfuscated MiniBunny.bat file, wait a few seconds, go away. # Exfiltrate the .dmp file and read it with Mimikatz. -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/MiniDumpBunny/mimi.png) \ No newline at end of file +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/MiniDumpBunny/mimi.png) \ No newline at end of file diff --git a/payloads/library/credentials/MiniDumpBunny/payload.txt b/payloads/library/credentials/MiniDumpBunny/payload.txt index 2fc58a03f..467e748ac 100644 --- a/payloads/library/credentials/MiniDumpBunny/payload.txt +++ b/payloads/library/credentials/MiniDumpBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: MiniDumpBunny # Description: Dump lsass with this script, which was obfuscated with multiple layers. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/credentials/ProcDumpBunny/README.md b/payloads/library/credentials/ProcDumpBunny/README.md index 31b9ef730..afcf570b1 100644 --- a/payloads/library/credentials/ProcDumpBunny/README.md +++ b/payloads/library/credentials/ProcDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: ProcDumpBunny** -Author: 0iphor13 +Author: 0i41E Version: 1.0 @@ -12,10 +12,10 @@ What is ProcDumpBunny? **Instruction:** Download ProcDump from Microsoft - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump - rename the Executeable to Bunny.exe -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(38).png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(38).png) Place Bunny.exe in the same payload switch as your payload -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(37).png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(37).png) # Plug in BashBunny. Exfiltrate the out.dmp file and read it with Mimikatz. -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(39).png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(39).png) diff --git a/payloads/library/credentials/ProcDumpBunny/payload.txt b/payloads/library/credentials/ProcDumpBunny/payload.txt index b0275b7e0..9480cf779 100644 --- a/payloads/library/credentials/ProcDumpBunny/payload.txt +++ b/payloads/library/credentials/ProcDumpBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: ProcDumpBunny # Description: Dump lsass.exe with a renamed version of procdump -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/credentials/SamDumpBunny/README.md b/payloads/library/credentials/SamDumpBunny/README.md index 683fd00d2..6e64f4fa2 100644 --- a/payloads/library/credentials/SamDumpBunny/README.md +++ b/payloads/library/credentials/SamDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: SamDumpBunny** -

Author: 0iphor13
+

Author: 0i41E
OS: Windows
Version: 1.0
@@ -21,4 +21,4 @@ Afterwards you can use a tool like samdump2 to extract the users hashes.

**!Disclaimer! samdump2 has proven to be unreliable in the recent past.** -![alt text](https://github.com/0iphor13/omg-payloads/blob/master/payloads/library/credentials/SamDumpCable/sam.png) +![alt text](https://github.com/0i41E/omg-payloads/blob/master/payloads/library/credentials/SamDumpCable/sam.png) diff --git a/payloads/library/credentials/SamDumpBunny/payload.txt b/payloads/library/credentials/SamDumpBunny/payload.txt index cc3120e33..a84d08de7 100644 --- a/payloads/library/credentials/SamDumpBunny/payload.txt +++ b/payloads/library/credentials/SamDumpBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: SamDumpBunny # Description: Dump users sam and system hive and exfiltrate them. Afterwards you can use a tool like samdump2, to get the users hashes. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/credentials/SessionBunny/README.md b/payloads/library/credentials/SessionBunny/README.md index ae8d4d7a7..b8d453475 100644 --- a/payloads/library/credentials/SessionBunny/README.md +++ b/payloads/library/credentials/SessionBunny/README.md @@ -1,6 +1,6 @@ **Title: SessionBunny** -Author: 0iphor13 +Author: 0i41E (Credit for SessionGopher: Brandon Arvanaghi) Version: 1.0 @@ -19,4 +19,4 @@ Place SessionBunny.ps1 in the same payload switch-folder as your payload.txt # Plug in BashBunny. Wait for the script to finish and decide what you wanna do with the information gathered -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/SessionBunny/censorepic.png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/SessionBunny/censorepic.png) diff --git a/payloads/library/credentials/SessionBunny/SessionBunny.ps1 b/payloads/library/credentials/SessionBunny/SessionBunny.ps1 index c7bd78185..568b324d6 100644 --- a/payloads/library/credentials/SessionBunny/SessionBunny.ps1 +++ b/payloads/library/credentials/SessionBunny/SessionBunny.ps1 @@ -43,7 +43,7 @@ o o_ / ". SessionGopher - ," _-" Bunny Edition (0iphor13) + ," _-" Bunny Edition (0i41E) ," m m ..+ ) Brandon Arvanaghi `m..m @arvanaghi | arvanaghi.com diff --git a/payloads/library/credentials/SessionBunny/payload.txt b/payloads/library/credentials/SessionBunny/payload.txt index 4531e181f..e07f9cf5b 100644 --- a/payloads/library/credentials/SessionBunny/payload.txt +++ b/payloads/library/credentials/SessionBunny/payload.txt @@ -1,7 +1,7 @@ #!/bin/bash # # Title: SessionBunny -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/execution/SerialNumBunny/1.PS1 b/payloads/library/execution/SerialNumBunny/1.PS1 index 0ed38dc7e..620c62ba8 100644 --- a/payloads/library/execution/SerialNumBunny/1.PS1 +++ b/payloads/library/execution/SerialNumBunny/1.PS1 @@ -12,4 +12,4 @@ $Picture=@" Sleep -s 5 Write-Host -ForegroundColor red "$Picture" Sleep -s 2 -Write-Host -ForegroundColor green "SerialNumBunny by 0iphor13" \ No newline at end of file +Write-Host -ForegroundColor green "SerialNumBunny by 0i41E" \ No newline at end of file diff --git a/payloads/library/execution/SerialNumBunny/payload.txt b/payloads/library/execution/SerialNumBunny/payload.txt index 1f177baff..3869c8d02 100644 --- a/payloads/library/execution/SerialNumBunny/payload.txt +++ b/payloads/library/execution/SerialNumBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: SerialNumBunny # Description: Execute strings placed in the Bunny serial number -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Execution # Attackmodes: HID, RNDIS_ETHERNET diff --git a/payloads/library/execution/SerialNumBunny/readme.md b/payloads/library/execution/SerialNumBunny/readme.md index ac20f5f53..1139e40a5 100644 --- a/payloads/library/execution/SerialNumBunny/readme.md +++ b/payloads/library/execution/SerialNumBunny/readme.md @@ -1,6 +1,6 @@ **Title: SerialNumBunny** -

Author: 0iphor13
+

Author: 0i41E
OS: Windows
Version: 1.0
@@ -14,6 +14,6 @@ You can get pretty creative here, from basically calling basic powershell comman - Upload your script or the example provided onto your Bunnys switch folder. - Plug in the Bunny and let the magic happen. -![SerialNumBunny](https://github.com/0iphor13/bashbunny-payloads/assets/79219148/fa11d9b5-e2f2-45a9-a701-5a25220ca226) +![SerialNumBunny](https://github.com/0i41E/bashbunny-payloads/assets/79219148/fa11d9b5-e2f2-45a9-a701-5a25220ca226) _Note: If you want to adapt your payload nested, in the serial number, you may need to stay in a certain character limit. In my case this was 40 characters. This might be different, depending on your target. Also make sure to replace spaces within the serial number with underscores._ diff --git a/payloads/library/exfiltration/WifiSnatch/payload.txt b/payloads/library/exfiltration/WifiSnatch/payload.txt index 45aa88ce4..42b6c249b 100644 --- a/payloads/library/exfiltration/WifiSnatch/payload.txt +++ b/payloads/library/exfiltration/WifiSnatch/payload.txt @@ -2,7 +2,7 @@ # # Title: WifiSnatch # Description: Extract wifi information, such as passphrases & SSIDs -# Author: 0iphor13 +# Author: 0i41E # Version: 1.1 # Category: Exfiltration # Attackmodes: HID, Storage diff --git a/payloads/library/prank/-BB-AcidBurn/README.md b/payloads/library/prank/-BB-AcidBurn/README.md index 9e799ed11..5b83236a1 100644 --- a/payloads/library/prank/-BB-AcidBurn/README.md +++ b/payloads/library/prank/-BB-AcidBurn/README.md @@ -105,7 +105,7 @@ Arf * [Hak5](https://hak5.org/) * [MG](https://github.com/OMG-MG) -* [0iphor13](https://github.com/0iphor13) +* [0i41E](https://github.com/0i41E) * [PhilSutter](https://github.com/PhilSutter) diff --git a/payloads/library/prank/-BB-JumpScare/README.md b/payloads/library/prank/-BB-JumpScare/README.md index 69ef63f2e..ece60b5da 100644 --- a/payloads/library/prank/-BB-JumpScare/README.md +++ b/payloads/library/prank/-BB-JumpScare/README.md @@ -93,7 +93,7 @@ I am Jakoby * [Hak5](https://hak5.org/) * [MG](https://github.com/OMG-MG) -* [0iphor13](https://github.com/0iphor13) +* [0i41E](https://github.com/0i41E) * [PhilSutter](https://github.com/PhilSutter) diff --git a/payloads/library/remote_access/PingZhellBunny/Bunny.pl b/payloads/library/remote_access/PingZhellBunny/Bunny.pl index 4bac2738e..2a8358948 100644 --- a/payloads/library/remote_access/PingZhellBunny/Bunny.pl +++ b/payloads/library/remote_access/PingZhellBunny/Bunny.pl @@ -15,7 +15,7 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see . # -# Modified by 0iphor13 for PingZhellBunny +# Modified by 0i41E for PingZhellBunny # # # diff --git a/payloads/library/remote_access/PingZhellBunny/README.md b/payloads/library/remote_access/PingZhellBunny/README.md index 6b190001e..93203488e 100644 --- a/payloads/library/remote_access/PingZhellBunny/README.md +++ b/payloads/library/remote_access/PingZhellBunny/README.md @@ -1,6 +1,6 @@ **Title: PingZhellBunny** -

Author: 0iphor13
+

Author: 0i41E
OS: Windows
Version: 1.5
diff --git a/payloads/library/remote_access/PingZhellBunny/payload.txt b/payloads/library/remote_access/PingZhellBunny/payload.txt index 2690061a2..89617aac9 100644 --- a/payloads/library/remote_access/PingZhellBunny/payload.txt +++ b/payloads/library/remote_access/PingZhellBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: PingZhellBunny # Description: Getting remote access via ICMP -# Author: 0iphor13 +# Author: 0i41E # Version: 1.5 # Category: Remote_Access # Attackmodes: HID, RNDIS_ETHERNET diff --git a/payloads/library/remote_access/ReverseBunny/README.md b/payloads/library/remote_access/ReverseBunny/README.md index d3b39a268..fd2a6b3dd 100644 --- a/payloads/library/remote_access/ReverseBunny/README.md +++ b/payloads/library/remote_access/ReverseBunny/README.md @@ -1,6 +1,6 @@ **Title: ReverseBunny** -

Author: 0iphor13
+

Author: 0i41E
OS: Windows
Version: 1.5
@@ -8,7 +8,7 @@ Version: 1.5

!Getting remote access via obfuscated reverse shell!
Upload payload.txt and RevBunny.ps1 onto your Bunny -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/remote_access/ReverseBunny/RevBunny.png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/remote_access/ReverseBunny/RevBunny.png) Change the variables in payload.txt to your attacking machine & start your listener. (for example netcat: nc -lvnp [PORT] )

diff --git a/payloads/library/remote_access/ReverseBunny/payload.txt b/payloads/library/remote_access/ReverseBunny/payload.txt index 75d003cc1..fa5cd1cef 100644 --- a/payloads/library/remote_access/ReverseBunny/payload.txt +++ b/payloads/library/remote_access/ReverseBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: ReverseBunny # Description: Get remote access, using an obfuscated powershell reverse shell. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.5 # Category: Remote_Access # Attackmodes: HID, RNDIS_ETHERNET diff --git a/payloads/library/remote_access/ReverseBunnySSL/README.md b/payloads/library/remote_access/ReverseBunnySSL/README.md index 63182453e..6d07da864 100644 --- a/payloads/library/remote_access/ReverseBunnySSL/README.md +++ b/payloads/library/remote_access/ReverseBunnySSL/README.md @@ -1,6 +1,6 @@ **Title: ReverseBunnySSL** -

Author: 0iphor13
+

Author: 0i41E
OS: Windows
Version: 1.2
For input and inspiration - Thanks to: Cribbit, sebkinne

@@ -26,5 +26,5 @@ I recommend openssl itself or ncat - Example syntax for both:
**Disclaimer: Because of obfuscation, it may take some time until the shell is fully executed by powershell** -![alt text](https://github.com/0iphor13/omg-payloads/blob/master/payloads/library/remote_access/ReverseCableSSL/CreateCert.png) -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/remote_access/ReverseBunnySSL/Startscreen.png) +![alt text](https://github.com/0i41E/omg-payloads/blob/master/payloads/library/remote_access/ReverseCableSSL/CreateCert.png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/remote_access/ReverseBunnySSL/Startscreen.png) diff --git a/payloads/library/remote_access/ReverseBunnySSL/payload.txt b/payloads/library/remote_access/ReverseBunnySSL/payload.txt index 57358c050..c42c20911 100644 --- a/payloads/library/remote_access/ReverseBunnySSL/payload.txt +++ b/payloads/library/remote_access/ReverseBunnySSL/payload.txt @@ -2,7 +2,7 @@ # # Title: ReverseBunnySSL # Description: Get remote access, using an obfuscated powershell reverse shell. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.2 # Category: Remote_Access # Attackmodes: HID, RNDIS_ETHERNET