In this final demonstration,
we will look at the loop that we gathered from our attack
on the laptop in the previous demo.
We should also look at how easy it is to modify default payloads to perform
other attacks. With the Bash Bunny switched back to position three, turning
it back into a mass storage device, otherwise we would attack ourselves, we
can navigate into the loot folder on the Bash Bunny. For every successful
attack we performed, the Bash Bunny created a folder.
Within this folder, we see this cookies SQLite database stolen from the laptop.
In the previous demonstration, we stole a chromecookies.db file,
which we can then interact with and potentially recover session cookies.
We can run the file command on the cookies.db file and discover that it's a
SQLite database. Loading it into SQLite, we can then run the .show command to
get some basic information about the database,
including its fill delimiter and its row separator.
If we now run the .tables command, we can also list the tables contained in it.
Obviously,
the cookies table is what we're after here, and we can run a select
count from cookies table to find out how many cookies we've
exfiltrated. We can see the domains that the cookies relate to by
running the command select host_key from cookies. I can't show you
the cookie data itself,
as they are currently encrypted, and decrypting Chrome's cookie
database is not within the scope of this course.
However,
I hope you can see the power and ease at which the Bash
Bunny can exfiltrate important data.
Let's now look at another script that we could have used to exfiltrate data.
Here you can see the payload MacPDFExfil, which searches specifically for
PDFs. We can easily change this to look for Word documents,
JPEGs, or any other file extension we choose.
We mentioned earlier that the RGB LED can be used to
give visual indicators to the user.
These are easily set up and changed within the Bash Bunny payload script.
Here we can add the visual indicator of a green LED
status to show the script has completed.
I want to finish this demonstration with an overview of some of what I
think of as valuable, important payloads that come with the Bash Bunny.
The Bash Bunny is an advanced attack platform,
and I think the most impressive payload is Quick Creds.
It's a payload created by Hak5Daren, based on the amazing work by Mubix.
Using this payload,
it is possible to steal password hashes even from a locked Windows machine.
It does this by pretending to be a virtual Ethernet driver.
And whilst it does take some effort to get this payload up and
running with the additional tools that it requires,
the results are outstanding.
I wish the Bash Bunny came with this pre‑set up,
as I believe this is one of the most powerful attacks
that the Bash Bunny can perform.
Obviously, with any red team engagement,
the goal is often to gain and maintain persistence.
Bash Bunny comes with a variety of payloads to help you gain reverse shells
for multiple operating systems, and the Windows meterpreter staged payload is
one of my particular favorites for doing this.
One of the most interesting uses of the Bash Bunny payload system is the
ability to exfiltrate data using free space optics.
Selected files are converted into QR codes that are displayed on the screen.
No local record of showing these files are being moved or extracted are made.
QR codes can then be recorded using a video camera for later decoding.
The final payload I want to mention is WifiPass by TheRoninRunner.
This steals Wi‑Fi credentials stored on Windows targets and
works on Windows 7, 8, and even Windows 10.
It's a very valuable payload to help you gain that initial
access into a target environments network.
The Bash Bunny has many more capabilities than we
have shown in this short course.
I hope, however,
this encourages you to look at all the default payloads that come with the
Bash Bunny and look at how you can modify them to your needs.
If you create a payload that you believe will be worthwhile to others,
then please do consider sharing it with the Bash Bunny community.