Add Exfiltration Payload: PwnedBy_AWS

[ech0-c2x]

Educational and penetration testing purposes only. This script is designed to demonstrate that once physical access is gained, a malicious actor can easily enumerate information and credentials, and have that remotely exfiltrated for later review, exploitation, and/or selling. Please use responsibly, and ensure you are only targeting systems that you have explicit permission to test on.

[hak5peaks]

Please fix your directory structure. Your payload content should be inside of a payload.txt file within a directory with your payload name. For example: payloads/library/exfiltration/PwnedBy_AWS/payload.txt

[hak5peaks]

Please include a DEFINE at the top of your payload for any configurable options. This makes the payload easier to use and change for the end user.

For example:

DEFINE #AWS_ACCESS_KEY_ID YOUR-ACCESS-KEY-HERE
STRINGLN $env:AWS_ACCESS_KEY_ID = "#AWS_ACCESS_KEY_ID"

Please implement this where it applies in your payload.

[hak5peaks]

For instances where you are using STRING and then immediately ENTER you can compress it down into a single line by using STRINGLN this cleans up the payload and makes it more readable.

for example: STRINGLN example will inject the same as

STRING example
ENTER