Jump to content
Hak5 Forums
SDFUK

Detect when Powershell payload has finished

Recommended Posts

Hi,

I've seen this mentioned a few times, but no solution as of yet. I'm using Powershell as a payload that is saving data into the loot folder.

It's working fine, but I need a way of notifying the Bunny when the script 'has finished', for notification. I tried the 'until' command in a sleep loop in payload.txt watching for creation of a 'finished' file, but like others in that forum that does not seem to work.

Has anyone else found a way of making this work? 

Share this post


Link to post
Share on other sites

If you are using storage, you may have to eject the bunny.  There are some payloads out there that have the method to eject the BB.  For the file you are writing to the BB to show up, sometimes a safe eject is needed for it to dump the buffer.

Share this post


Link to post
Share on other sites

I've had experiences with PSH and Bash not seeing each others' created files - very frustrating. E.g. If PSH creates a file, Bash won't see it, and vice-versa. "Sync" doesn't work, either.

Just tell PSH to eject the BB when complete. Not sure how you could get the BB to recognise that, though.

Share this post


Link to post
Share on other sites

There are numerous payloads with checks built in. My PSH Exec payload for instance, waits for a file to be created on the share for instance.

https://gist.github.com/hink/cc0a0422728d1ee77c89b528d3b62c3a

Share this post


Link to post
Share on other sites

Ejecting the bunny, if you are using the storage payload and wrote a file to it from the victim, should make the file appear.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×