Jump to content

[PAYLOAD] Network Recon Payload with email exfiltration


Topknot
 Share

Recommended Posts

This is a based on MonsieurMarc's Sample Nmap Payload with Patebin exfiltration script, which was based on the original HAK5 sample payload.

This payload:

  • Performs an nmap ping scan of the local subnet and logs it to a text file
  • Pulls LLDP neighbor and switch information and logs it to a text file
  • Performs an IFconfig and ip addr show and logs it to a text file
  • Performs a traceroute to 8.8.8.8 and logs it to a text file
  • Performs a public IP address lookup via curl and icanhazip.com and logs it to a text file
  • Sends all of the created text files via email to the address set with MAIL_RCPT


This payload requires you to have curl, lldpd, and msmtp mutt already installed and configured via opkg

https://github.com/Topknot-AR/Network-Recon-with-email-exfil/blob/master/payload.sh

Link to comment
Share on other sites

19 hours ago, Darren Kitchen said:

Awesome! Would like to host this on the Hak5 repo if you'd like to submit a pull request 🙂

Just attempted to submit it. This is my first time using github so I might have done it wrong. Let me know if anything needs to be done differently. Thanks! Happy to have it hosted on the Hak5 Repo!!

 

Link to comment
Share on other sites

Thanks! PR accepted 🙂

I will note that this payload overwrites the nameserver in the /etc/resolv.conf file to 1.1.1.1. If I were to recommend any change - it would be to make that configurable in the variables at the top of the payload. 

Otherwise, fantastic work - and I'll see if we can't get some of those dependencies baked into the next official release so it's even easier to use out of the box.

  • Upvote 1
Link to comment
Share on other sites

  • 4 weeks later...
  • 5 months later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...