Jump to content
Hak5 Forums

qdba

Active Members
  • Content count

    87
  • Joined

  • Last visited

  • Days Won

    2

About qdba

  • Rank
    Hak5 Fan ++

Profile Information

  • Gender
    Male
  • Location
    Stuttgart
  • Interests
    IT-Security, Linux, Programming Languages
  1. [RELEASE] Bash Bunny Firmware v1.5

    installed.... Worked...
  2. PasswordGrabber by LazaGne Not Working

    Maybe an VirusScanner lazagne.exe was mostly catched by AV.
  3. New Version added You can set UAC_MODE=0 in payload.txt
  4. [PAYLOAD] New DumpCreds 2.3.3 [11/19/2017]

    Add multiple UAC Modes set variable UAC_MODE in payload.txt UAC_MODE=1 # Fodhelper UAC UAC_MODE=0 # Standard UAC Mode Just Beta ( Works on my Windows 10 - Not tested on 7 yet)
  5. [PAYLOAD] New DumpCreds 2.3.3 [11/19/2017]

    OK.... Some new changes (Beta State) Better Cleanup - remove all changes in Powershell History - remove all changes in Run MRU (not only delete te files) https://github.com/qdba/bashbunny-payloads/tree/master/payloads/library/credentials/DumpCreds
  6. [PAYLOAD] New DumpCreds 2.3.3 [11/19/2017]

    I must check, if the command for switching of the history is still in the history file after execution. Can't do it now. Have no powershell here. The result give me the route foe the rest.
  7. [PAYLOAD] New DumpCreds 2.3.3 [11/19/2017]

    It cannot be done in the line with the main.ps1 call because...... ....... A 1 first Powershell task will be started fo the input of the registry command for UAC Baypass. Than the fodhelper opens a second Powershell task in Admin mode. The first Powershell task can be closed after the fodhelper thing The string Q STRING "powershell -exec bypass -W HIDDEN \"while (1) { If (Test-Connection 172........ will be "quacked" in the second PS Task. A third PS Task ist opening, waiting for HTTP Server is coming up and downloads the main.ps1. The second task is closed with the "exit" at the end of the main.ps1 line. If you remove the history between the main.ps1 call and the exit command it's to fast. the main.ps1 is still running and create new history events. The main.ps1 is ready if the EOF File was created in the loot dir. ( payload.txt: line 95 ) The computer can be cleand after this event. so... 1. The history must switched of at the very first beginning befor the Regiytry Command of UAC Bypass. Considerations: does the Set-PSReadlineOption –HistorySaveStyle SaveNothing comman switch of the history global ? If so ... good... if not set a Marker in History file 2. Do all the stuff..... 3. Problem.... Switch history on after the EOF will be written. Maybe can be done with switch ATTACKMODE to HID and do all the things in a GUI (r ?) or start a dos comandline at the end of main.ps1 wo do all the cleanup (Switch on commandline kill powershell, copy back a saved history file, delete all lines from marker to end or.... / and... other things. Will sleep after that..
  8. [PAYLOAD] New DumpCreds 2.3.3 [11/19/2017]

    Got it ... With Set-PSReadlineOption –HistorySaveStyle SaveNothing the History saving in Powershell will be switched off. So I set it at the beginning of the Script and delete the History File at the end
  9. [PAYLOAD] New DumpCreds 2.3.3 [11/19/2017]

    Q GUI didn't work for me. Q GUI r does. Now we have only the taskkill powershell command in the powershell history.
  10. [PAYLOAD] New DumpCreds 2.3.3 [11/19/2017]

    Code for clearing "Run" history was already in main.ps1 ......... # Epmty Run Input Field Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name '*' -ErrorAction SilentContinue ........ Added the code to clear Powwershell history to main.ps1 We should avoid too much "Q GUI r" commands. because it's visible.
  11. Which Version of DumpCreds do you use? The newest ist 2.3. You can download it here https://github.com/qdba/bashbunny-payloads/tree/master/payloads/library/credentials/DumpCreds
  12. [PAYLOAD] New DumpCreds 2.3.3 [11/19/2017]

    Updated the repo so hak5 could merge it to the master branch Changed Version to 2.3 Add taskill /F /IM powershell.exe at the end of main.ps1
  13. [PAYLOAD] New DumpCreds 2.3.3 [11/19/2017]

    I merged your path to the master branch. Did some patches so fodhelper starts hidden. https://github.com/qdba/bashbunny-payloads/blob/master/payloads/library/credentials/DumpCreds/payload.txt
×