Bash Bunny Exploits - Revision history

NKirnbauer: fixed link

2024-10-09T17:39:05Z

fixed link

← Older revision		Revision as of 17:39, 9 October 2024
Line 445:		Line 445:
	== References ==		== References ==

	* https://docs.hak5.org/~~hc/en~~-~~us/categories/360000982534-Bash-Bunny~~		* https://docs.hak5.org/bash-bunny
	* https://github.com/hak5/bashbunny-payloads		* https://github.com/hak5/bashbunny-payloads
	* https://youtu.be/JlGSuQ21Vt8		* https://youtu.be/JlGSuQ21Vt8

NKirnbauer: fixed link

2024-10-09T17:36:51Z

fixed link

← Older revision		Revision as of 17:36, 9 October 2024
Line 7:		Line 7:
	* Hardware: Hak5 Bash Bunny		* Hardware: Hak5 Bash Bunny

	In order to get a general idea about the Bash Bunny, please refer to [[Hak5 Bash Bunny]] or the [https://docs.hak5.org/~~hc/en~~-~~us/categories/360000982534-Bash-Bunny~~ official Hak5 Documentation] and [https://github.com/hak5/bashbunny-payloads Git repository].		In order to get a general idea about the Bash Bunny, please refer to [[Hak5 Bash Bunny]] or the [https://docs.hak5.org/bash-bunny official Hak5 Documentation] and [https://github.com/hak5/bashbunny-payloads Git repository].

	== Exploits ==		== Exploits ==

VHorvathova at 11:54, 9 November 2021

2021-11-09T11:54:26Z

@@ Line 442: / Line 442: @@
 <div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Conclusion: </b>Depending on the amount of files, the payload will take different time to execute. On a test VM with barely and documents or pictures, the execution is no longer than 3 seconds. On a fully functional and regular PC with many documents/files/subdirectories, that same payload can take up to several minutes. The longer the Bash Bunny stays in, the more files it can find. However, the original payload from the Bash Bunny's Git repository does not allow the attacker to really see, when the payload execution is done. It always shows the attack LED. After adding the line of code "LED FINISH", it now shows that the payload's execution is done right after the Powershell script is executed, but that does not equal a finished search after files. Thus, this is something to keep in mind, since it cannot be known when the Bash Bunny is finished (without rewriting the payload in a way that allows the LED to blink once all files have been searched). Overall a very efficient and useful tool, that also works reliably every single time it is executed.</div>
-<br>
 == References ==

VHorvathova at 19:11, 5 November 2021

2021-11-05T19:11:11Z

← Older revision		Revision as of 19:11, 5 November 2021
Line 459:		Line 459:
	\| \|		\| \|
	\| \|- library		\| \|- library
	\| \| \|- ~~Payloads backups.~~		\| \| \|- Collection of payloads
	\| \|		\| \|
	\| \|- switch1		\| \|- switch1

VHorvathova at 19:10, 5 November 2021

2021-11-05T19:10:37Z

@@ Line 442: / Line 442: @@
 <div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Conclusion: </b>Depending on the amount of files, the payload will take different time to execute. On a test VM with barely and documents or pictures, the execution is no longer than 3 seconds. On a fully functional and regular PC with many documents/files/subdirectories, that same payload can take up to several minutes. The longer the Bash Bunny stays in, the more files it can find. However, the original payload from the Bash Bunny's Git repository does not allow the attacker to really see, when the payload execution is done. It always shows the attack LED. After adding the line of code "LED FINISH", it now shows that the payload's execution is done right after the Powershell script is executed, but that does not equal a finished search after files. Thus, this is something to keep in mind, since it cannot be known when the Bash Bunny is finished (without rewriting the payload in a way that allows the LED to blink once all files have been searched). Overall a very efficient and useful tool, that also works reliably every single time it is executed.</div>
+<br>
 == References ==

VHorvathova at 15:47, 19 October 2021

2021-10-19T15:47:00Z

← Older revision		Revision as of 15:47, 19 October 2021
Line 442:		Line 442:

	<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Conclusion: </b>Depending on the amount of files, the payload will take different time to execute. On a test VM with barely and documents or pictures, the execution is no longer than 3 seconds. On a fully functional and regular PC with many documents/files/subdirectories, that same payload can take up to several minutes. The longer the Bash Bunny stays in, the more files it can find. However, the original payload from the Bash Bunny's Git repository does not allow the attacker to really see, when the payload execution is done. It always shows the attack LED. After adding the line of code "LED FINISH", it now shows that the payload's execution is done right after the Powershell script is executed, but that does not equal a finished search after files. Thus, this is something to keep in mind, since it cannot be known when the Bash Bunny is finished (without rewriting the payload in a way that allows the LED to blink once all files have been searched). Overall a very efficient and useful tool, that also works reliably every single time it is executed.</div>		<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Conclusion: </b>Depending on the amount of files, the payload will take different time to execute. On a test VM with barely and documents or pictures, the execution is no longer than 3 seconds. On a fully functional and regular PC with many documents/files/subdirectories, that same payload can take up to several minutes. The longer the Bash Bunny stays in, the more files it can find. However, the original payload from the Bash Bunny's Git repository does not allow the attacker to really see, when the payload execution is done. It always shows the attack LED. After adding the line of code "LED FINISH", it now shows that the payload's execution is done right after the Powershell script is executed, but that does not equal a finished search after files. Thus, this is something to keep in mind, since it cannot be known when the Bash Bunny is finished (without rewriting the payload in a way that allows the LED to blink once all files have been searched). Overall a very efficient and useful tool, that also works reliably every single time it is executed.</div>


	~~=== Password Grabber ===~~

	== References ==		== References ==

VHorvathova at 15:44, 19 October 2021

2021-10-19T15:44:43Z

← Older revision		Revision as of 15:44, 19 October 2021
Line 1:		Line 1:
	== Summary ==		== Summary ==
	~~This is a DRAFT.~~		The [[Hak5 Bash Bunny]] will be used for various exploits which will be explained, documented and evaluated in the following chapters.
	The Hak5 Bash Bunny will be used for various exploits which will be explained, documented and evaluated in the following chapters.

	== Requirements ==		== Requirements ==

VHorvathova at 15:44, 19 October 2021

2021-10-19T15:44:13Z

← Older revision		Revision as of 15:44, 19 October 2021
Line 440:		Line 440:
	$gifheader = "71 73 70"		$gifheader = "71 73 70"
	$tifheader = "73 73 42"		$tifheader = "73 73 42"
	Afterward, the known image file extensions are set, because these files are to be ignored. After all, the search is after images pretending to be something else, and not actual images.		Afterward, the known image file extensions are set, because these files are to be ignored. After all, the search is after images pretending to be something else, and not actual images. Now, all the files of the current user are looked at one by one in a foreach loop to filter out the real image extensions and only keep the files with different extensions. These files that are left then get their header searched (either the first 2/3/8 bytes depending on the file type). If a match is found (i.e. a file with an image header but without an image file extension), this file's path and real file extension is written to the CVS file created in the \loot\Hidden-Image-Files directory. The loop is finished one there are no more files left on the user's profile (it looks at Documents, Downloads, Pictures and everything else together with all subdirectories, considering the search is recursive).

	<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Conclusion: </b>Depending on the amount of files, the payload will take different time to execute. On a test VM with barely and documents or pictures, the execution is no longer than 3 seconds. On a fully functional and regular PC with many documents/files/subdirectories, that same payload can take up to several minutes. The longer the Bash Bunny stays in, the more files it can find. However, the original payload from the Bash Bunny's Git repository does not allow the attacker to really see, when the payload execution is done. It always shows the attack LED. After adding the line of code "LED FINISH", it now shows that the payload's execution is done right after the Powershell script is executed, but that does not equal a finished search after files. Thus, this is something to keep in mind, since it cannot be known when the Bash Bunny is finished (without rewriting the payload in a way that allows the LED to blink once all files have been searched). Overall a very efficient and useful tool, that also works reliably every single time it is executed.</div>		<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Conclusion: </b>Depending on the amount of files, the payload will take different time to execute. On a test VM with barely and documents or pictures, the execution is no longer than 3 seconds. On a fully functional and regular PC with many documents/files/subdirectories, that same payload can take up to several minutes. The longer the Bash Bunny stays in, the more files it can find. However, the original payload from the Bash Bunny's Git repository does not allow the attacker to really see, when the payload execution is done. It always shows the attack LED. After adding the line of code "LED FINISH", it now shows that the payload's execution is done right after the Powershell script is executed, but that does not equal a finished search after files. Thus, this is something to keep in mind, since it cannot be known when the Bash Bunny is finished (without rewriting the payload in a way that allows the LED to blink once all files have been searched). Overall a very efficient and useful tool, that also works reliably every single time it is executed.</div>

VHorvathova at 15:34, 19 October 2021

2021-10-19T15:34:35Z

← Older revision		Revision as of 15:34, 19 October 2021
Line 435:		Line 435:
	<div style="display: inline-block;"> [[File:Hexdump.PNG\|thumb\|none\|500px\|Hexdump of a PNG file]] [[File:Hex to decimal.PNG\|thumb\|none\|500px\|Translation to decimal]]</div>		<div style="display: inline-block;"> [[File:Hexdump.PNG\|thumb\|none\|500px\|Hexdump of a PNG file]] [[File:Hex to decimal.PNG\|thumb\|none\|500px\|Translation to decimal]]</div>
	These headers are hard-coded in the <i>run.ps1</i> as decimal values so that the files can really be examined based on what they are, and not based on the file extension they have.		These headers are hard-coded in the <i>run.ps1</i> as decimal values so that the files can really be examined based on what they are, and not based on the file extension they have.
			$pngheader = "137 80 78 71 13 10 26 10"
			$jpgheader = "255 216 255"
			$bmpheader = "66 77"
			$gifheader = "71 73 70"
			$tifheader = "73 73 42"
			Afterward, the known image file extensions are set, because these files are to be ignored. After all, the search is after images pretending to be something else, and not actual images.

	<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Conclusion: </b>Depending on the amount of files, the payload will take different time to execute. On a test VM with barely and documents or pictures, the execution is no longer than 3 seconds. On a fully functional and regular PC with many documents/files/subdirectories, that same payload can take up to several minutes. The longer the Bash Bunny stays in, the more files it can find. However, the original payload from the Bash Bunny's Git repository does not allow the attacker to really see, when the payload execution is done. It always shows the attack LED. After adding the line of code "LED FINISH", it now shows that the payload's execution is done right after the Powershell script is executed, but that does not equal a finished search after files. Thus, this is something to keep in mind, since it cannot be known when the Bash Bunny is finished (without rewriting the payload in a way that allows the LED to blink once all files have been searched). Overall a very efficient and useful tool, that also works reliably every single time it is executed.</div>		<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Conclusion: </b>Depending on the amount of files, the payload will take different time to execute. On a test VM with barely and documents or pictures, the execution is no longer than 3 seconds. On a fully functional and regular PC with many documents/files/subdirectories, that same payload can take up to several minutes. The longer the Bash Bunny stays in, the more files it can find. However, the original payload from the Bash Bunny's Git repository does not allow the attacker to really see, when the payload execution is done. It always shows the attack LED. After adding the line of code "LED FINISH", it now shows that the payload's execution is done right after the Powershell script is executed, but that does not equal a finished search after files. Thus, this is something to keep in mind, since it cannot be known when the Bash Bunny is finished (without rewriting the payload in a way that allows the LED to blink once all files have been searched). Overall a very efficient and useful tool, that also works reliably every single time it is executed.</div>

VHorvathova at 15:32, 19 October 2021

2021-10-19T15:32:52Z

← Older revision		Revision as of 15:32, 19 October 2021
Line 433:		Line 433:
	The <i>payload.txt</i> simply emulates a Human Interface Device to be able to act as a keyboard and then opens Windows Powershell to run the <i>run.ps1</i> script. The actual functionality of this payload can be found here:<br>		The <i>payload.txt</i> simply emulates a Human Interface Device to be able to act as a keyboard and then opens Windows Powershell to run the <i>run.ps1</i> script. The actual functionality of this payload can be found here:<br>
	At first, the Bash Bunny's path is found and it is checked whether there is a \loot\Hidden-Image-Files directory or otherwise, it is created. A filename is generated with a current timestamp. The known image headers are then defined by their decimal header values (for example every PNG file when looked at in HEX will have the file extension "PNG" encoded). A way to examine this is via hexdump, and a hexdump of an example PNG file can be seen below.		At first, the Bash Bunny's path is found and it is checked whether there is a \loot\Hidden-Image-Files directory or otherwise, it is created. A filename is generated with a current timestamp. The known image headers are then defined by their decimal header values (for example every PNG file when looked at in HEX will have the file extension "PNG" encoded). A way to examine this is via hexdump, and a hexdump of an example PNG file can be seen below.
	<div style="display: inline-block;"> [[File:Hexdump.PNG\|thumb\|none\|500px\|Hexdump of a PNG file]]</div>		<div style="display: inline-block;"> [[File:Hexdump.PNG\|thumb\|none\|500px\|Hexdump of a PNG file]] [[File:Hex to decimal.PNG\|thumb\|none\|500px\|Translation to decimal]]</div>
	These headers are hard-coded in the <i>run.ps1</i> as decimal values so that the files can really be examined based on what they are, and not based on the file extension they have.		These headers are hard-coded in the <i>run.ps1</i> as decimal values so that the files can really be examined based on what they are, and not based on the file extension they have.

← Older revision		Revision as of 19:11, 5 November 2021
Line 459:		Line 459:
	\| \|		\| \|
	\| \|- library		\| \|- library
	\| \| \|- ~~Payloads backups.~~		\| \| \|- Collection of payloads
	\| \|		\| \|
	\| \|- switch1		\| \|- switch1