nutt318 Posted March 21, 2017 Share Posted March 21, 2017 I liked the USB Exfiltrator so much I wanted to try and make one that was able to grab everything and dump it to a FTP site. This way if there are large/many documents it wouldn't fill up the BashBunny. Script is pretty simple, it executes a PowerShell script that clears the run history and then starts uploading the users documents directory. It will keep PowerShell running in the background so if there are a lot of files or large files go ahead on unplug the BB once the status light is green, it will just keep going. Still new to this and know there will be some bug or errors so welcome any feedback. https://github.com/nutt318/bashbunny-payloads/tree/master/payloads/library/ftp_exfiltrator 2 Quote Link to comment Share on other sites More sharing options...
nutt318 Posted March 23, 2017 Author Share Posted March 23, 2017 Was wondering if anyone has had any issues with this payload and if you had any feedback. I'm still trying to figure a way to detect if the powershell script fails if its unable to connect to the FTP site. Let me know your thoughts. Quote Link to comment Share on other sites More sharing options...
Mr.Pupp3T Posted March 31, 2017 Share Posted March 31, 2017 What would the code be so it will download a file from ftp to the targets computer Quote Link to comment Share on other sites More sharing options...
Dave-ee Jones Posted April 13, 2017 Share Posted April 13, 2017 Couldn't you ping the website? If that fails then you can make a log file that says 'Couldn't ping FTP' and once the script is done the payload continues, which means you can do a file read in the payload that reads the log file and if it gets returned the string 'Couldn't ping FPT' then you can set the LED to red or something. Just an idea. Quote Link to comment Share on other sites More sharing options...
nutt318 Posted April 13, 2017 Author Share Posted April 13, 2017 Yes, good ideas. I need to work on this again. Been busy with work and out of town. Also need to update firmware :) Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.