hak5/bashbunny-payloads

QUACK STRING is executing commands

lordsaibat opened this issue · 1 comments

I have a script that is attempting to type out text.

QUACK STRING "for %%a in (d e f g h i j k l m n o p q r s t u v w x y z) do vol %%a: 2>nul |find "BashBunny" >nul && set drv=%%a:"

instead of typing it out, it attempts to execute the do command instead.

Why not use this?

Q STRING "for /f %D in ('wmic volume get DriveLetter^, Label ^| findstr BashBunny') do set DRIVE=%D"
Q STRING %DRIVE%\\blablabla\\this.exe