From 83e8bf51866a277737f6bb5a2d4bd84e6c96a522 Mon Sep 17 00:00:00 2001
From: Brendan Coles <bcoles@gmail.com>
Date: Tue, 7 Jul 2015 13:20:59 +0000
Subject: [PATCH] Add Detect Airdrone module

---
 modules/host/detect_airdrone/command.js  | 25 ++++++++++++++++
 modules/host/detect_airdrone/config.yaml | 20 +++++++++++++
 modules/host/detect_airdrone/module.rb   | 36 ++++++++++++++++++++++++
 3 files changed, 81 insertions(+)
 create mode 100644 modules/host/detect_airdrone/command.js
 create mode 100644 modules/host/detect_airdrone/config.yaml
 create mode 100644 modules/host/detect_airdrone/module.rb

diff --git a/modules/host/detect_airdrone/command.js b/modules/host/detect_airdrone/command.js
new file mode 100644
index 000000000..bc7401bfd
--- /dev/null
+++ b/modules/host/detect_airdrone/command.js
@@ -0,0 +1,25 @@
+//
+// Copyright (c) 2006-2015 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	var result = "Not Installed";
+	var dom = document.createElement('b');
+	var img = new Image;
+	img.src = "http://<%= @ipHost %>:<%= @port %>/theme/stock/images/ip_auth_refused.png";
+	img.onload = function() {
+		if (this.width == 146 && this.height == 176) result = "Installed";
+		beef.net.send('<%= @command_url %>', <%= @command_id %>,'proto=http&ip=<%= @ipHost %>&port=<%= @port %>&airdrone='+result);
+		dom.removeChild(this);
+	}
+	img.onerror = function() {
+		beef.net.send('<%= @command_url %>', <%= @command_id %>,'proto=http&ip=<%= @ipHost %>&port=<%= @port %>&airdrone='+result);
+		dom.removeChild(this);
+	}
+	dom.appendChild(img);
+
+});
+
diff --git a/modules/host/detect_airdrone/config.yaml b/modules/host/detect_airdrone/config.yaml
new file mode 100644
index 000000000..64f61793c
--- /dev/null
+++ b/modules/host/detect_airdrone/config.yaml
@@ -0,0 +1,20 @@
+#
+# Copyright (c) 2006-2015 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        detect_airdrone:
+            enable: true
+            category: "Host"
+            name: "Detect Airdrone"
+            description: "This module attempts to detect Airdrone on localhost (default port: 8888)"
+            authors: ["bcoles"]
+            target:
+                working:
+                    ALL:
+                        os: ["Android"]
+                not_working:
+                    ALL:
+                        os: ["All"]
diff --git a/modules/host/detect_airdrone/module.rb b/modules/host/detect_airdrone/module.rb
new file mode 100644
index 000000000..de6fb222d
--- /dev/null
+++ b/modules/host/detect_airdrone/module.rb
@@ -0,0 +1,36 @@
+#
+# Copyright (c) 2006-2015 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+
+class Detect_airdrone < BeEF::Core::Command
+
+  def self.options
+    return [
+        {'name' => 'ipHost', 'ui_label' => 'IP or Hostname', 'value' => '127.0.0.1'},
+        {'name' => 'port' , 'ui_label' => 'Port', 'value' => '8888'}
+  ]
+  end
+  
+  def post_execute
+    save({'airdrone' => @datastore['airdrone']})
+
+    configuration = BeEF::Core::Configuration.instance
+    if configuration.get("beef.extension.network.enable") == true
+      if @datastore['results'] =~ /^proto=(https?)&ip=([\d\.]+)&port=([\d]+)&airdrone=Installed$/
+        proto = $1
+        ip = $2
+        port = $3
+        session_id = @datastore['beefhook']
+        type = 'Airdrone'
+        cid = @datastore['cid'].to_i
+        if BeEF::Filters.is_valid_ip?(ip)
+          print_debug("Hooked browser found 'Airdrone' [proto: #{proto}, ip: #{ip}, port: #{port}]")
+          BeEF::Core::Models::NetworkService.add(:hooked_browser_id => session_id, :proto => proto, :ip => ip, :port => port, :type => type, :cid => cid)
+        end
+      end
+    end
+  end
+  
+end