feat: 3 NullSec BadUSB Payloads — CloudHarvester, LinuxRecon, PersistPlant

[bad-antics]

3 New NullSec BadUSB Payloads

1. NullSec-CloudHarvester

Extracts saved cloud CLI credentials and configurations from Windows:

• AWS CLI credentials & config
• Azure CLI tokens & profiles
• Google Cloud SDK configs
• Docker registry auth
• Kubernetes configs
• SSH key inventory
• Git credentials
• Terraform state
• npm/pip tokens

2. NullSec-LinuxRecon

Comprehensive Linux system reconnaissance:

• System info (kernel, distro, arch, resources)
• Network config (interfaces, routes, DNS, ARP)
• User enumeration (sudo privs, SSH keys)
• Running services & open ports
• Cron jobs
• SUID binary enumeration
• Docker/container detection
• Firewall rules (iptables/ufw/SELinux/AppArmor)

3. NullSec-PersistPlant

Multi-method Windows persistence installer:

• Scheduled Task (logon + 4-hour interval)
• Registry Run key (HKCU)
• Startup folder VBS wrapper
• All methods use non-admin HKCU (no UAC required)
• Reports back which methods were successfully installed
• Includes cleanup/removal instructions

All payloads include detailed README documentation, configurable webhook exfiltration, and OPSEC considerations.