- Title: sudoSnatch
- Description: sudoSnatch grabs plain text passwords remotely/locally.
- AUTHOR: drapl0n
- Version: 1.0
- Category: Credentials
- Target: Unix-like operating systems with systemd.
- Attackmodes: HID, Storage
sudoSnatch: sudoSnatch is BashBunny's payload which grabs sudo password in plain text and sends it back to attacker remotely/locally.
- Plain text passwords.
- Detailed password logs.
- Persistent
- Autostart payload on boot.
- Injecting payload on target's system.
- Checks whether internet is connected to the target system.
- If internet is connected then it sends clear text passwords to attacker.
- Replace ip(0.0.0.0) and port number(4444) with your servers ip address and port number on line no
10
. - Increase/Decrease time interval to restart service periodically (Default is 15 mins), on line no
14
.
SETUP
: MAGENTAATTACK
: YELLOWFINISH
: GREEN
FileName | Directory |
---|---|
payload.txt | /payloads/switch1/ |
payload.sh | /payloads/ |
shell | /payloads/library/sudoSnatch/ |
systemMgr | /payloads/library/sudoSnatch/ |
- Note: Create directory named
sudoSnatch
in/payloads/library/
- Inject payload into target's system.
- Start netcat listner on attacking system:
nc -l -p <port number>
use this command to fetch passwords.