433 lines
16 KiB
Ruby
433 lines
16 KiB
Ruby
#
|
|
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
|
|
# Browser Exploitation Framework (BeEF) - http://beefproject.com
|
|
# See the file 'doc/COPYING' for copying permission
|
|
#
|
|
module BeEF
|
|
module Extension
|
|
module Console
|
|
class ShellInterface
|
|
BD = BeEF::Core::Models::BrowserDetails
|
|
|
|
def initialize(config)
|
|
self.config = config
|
|
self.cmd = {}
|
|
end
|
|
|
|
def settarget(id)
|
|
self.targetsession = BeEF::Core::Models::HookedBrowser.find(id).session
|
|
self.targetip = BeEF::Core::Models::HookedBrowser.find(id).ip
|
|
self.targetid = id
|
|
rescue StandardError
|
|
nil
|
|
end
|
|
|
|
def setofflinetarget(id)
|
|
self.targetsession = BeEF::Core::Models::HookedBrowser.find(id).session
|
|
self.targetip = '(OFFLINE) ' + BeEF::Core::Models::HookedBrowser.find(id).ip
|
|
self.targetid = id
|
|
rescue StandardError
|
|
nil
|
|
end
|
|
|
|
def cleartarget
|
|
self.targetsession = nil
|
|
self.targetip = nil
|
|
self.targetid = nil
|
|
self.cmd = {}
|
|
end
|
|
|
|
# @note Get commands. This is a *modified* replica of select_command_modules_tree from extensions/admin_ui/controllers/modules/modules.rb
|
|
def getcommands
|
|
return if targetid.nil?
|
|
|
|
tree = []
|
|
BeEF::Modules.get_categories.each do |c|
|
|
c.concat('/') if c[-1, 1] != '/'
|
|
tree.push({
|
|
'text' => c,
|
|
'cls' => 'folder',
|
|
'children' => []
|
|
})
|
|
end
|
|
|
|
BeEF::Modules.get_enabled.each do |k, mod|
|
|
flatcategory = ''
|
|
if mod['category'].is_a?(Array)
|
|
# Therefore this module has nested categories (sub-folders), munge them together into a string with '/' characters, like a folder.
|
|
mod['category'].each do |cat|
|
|
flatcategory << (cat + '/')
|
|
end
|
|
else
|
|
flatcategory = mod['category']
|
|
flatcategory.concat('/') if flatcategory[-1, 1] != '/'
|
|
end
|
|
|
|
update_command_module_tree(tree, flatcategory, get_command_module_status(k), mod['name'], mod['db']['id'])
|
|
end
|
|
|
|
# if dynamic modules are found in the DB, then we don't have yaml config for them
|
|
# and loading must proceed in a different way.
|
|
dynamic_modules = BeEF::Core::Models::CommandModule.where('path LIKE ?', 'Dynamic/')
|
|
|
|
unless dynamic_modules.nil?
|
|
all_modules = BeEF::Core::Models::CommandModule.all.order(:id)
|
|
all_modules.each do |dyn_mod|
|
|
next unless dyn_mod.path.split('/').first.match(/^Dynamic/)
|
|
|
|
dyn_mod_name = dyn_mod.path.split('/').last
|
|
dyn_mod_category = nil
|
|
if dyn_mod_name == 'Msf'
|
|
dyn_mod_category = 'Metasploit'
|
|
else
|
|
# future dynamic modules...
|
|
end
|
|
|
|
# print_debug ("Loading Dynamic command module: category [#{dyn_mod_category}] - name [#{dyn_mod.name.to_s}]")
|
|
command_mod = BeEF::Modules::Commands.const_get(dyn_mod_name.capitalize).new
|
|
command_mod.session_id = hook_session_id
|
|
command_mod.update_info(dyn_mod.id)
|
|
command_mod_name = command_mod.info['Name'].downcase
|
|
|
|
update_command_module_tree(tree, dyn_mod_category, 'Verified Unknown', command_mod_name, dyn_mod.id)
|
|
end
|
|
end
|
|
|
|
# sort the parent array nodes
|
|
tree.sort! { |a, b| a['text'] <=> b['text'] }
|
|
|
|
# sort the children nodes by status
|
|
tree.each do |x|
|
|
x['children'] =
|
|
x['children'].sort_by { |a| a['status'] }
|
|
end
|
|
|
|
# append the number of command modules so the branch name results in: "<category name> (num)"
|
|
# tree.each {|command_module_branch|
|
|
# num_of_command_modules = command_module_branch['children'].length
|
|
# command_module_branch['text'] = command_module_branch['text'] + " (" + num_of_command_modules.to_s() + ")"
|
|
# }
|
|
|
|
# return a JSON array of hashes
|
|
tree
|
|
end
|
|
|
|
def setcommand(id)
|
|
key = BeEF::Module.get_key_by_database_id(id.to_i)
|
|
|
|
cmd['id'] = id
|
|
cmd['Name'] = config.get("beef.module.#{key}.name")
|
|
cmd['Description'] = config.get("beef.module.#{key}.description")
|
|
cmd['Category'] = config.get("beef.module.#{key}.category")
|
|
cmd['Data'] = BeEF::Module.get_options(key)
|
|
end
|
|
|
|
def clearcommand
|
|
self.cmd = {}
|
|
end
|
|
|
|
def setparam(param, value)
|
|
cmd['Data'].each do |data|
|
|
if data['name'] == param
|
|
data['value'] = value
|
|
return
|
|
end
|
|
end
|
|
end
|
|
|
|
def getcommandresponses(cmdid = cmd['id'])
|
|
commands = []
|
|
i = 0
|
|
|
|
BeEF::Core::Models::Command.where(command_module_id: cmdid, hooked_browser_id: targetid).each do |command|
|
|
commands.push({
|
|
'id' => i,
|
|
'object_id' => command.id,
|
|
'creationdate' => Time.at(command.creationdate.to_i).strftime('%Y-%m-%d %H:%M').to_s,
|
|
'label' => command.label
|
|
})
|
|
i += 1
|
|
end
|
|
|
|
commands
|
|
end
|
|
|
|
def getindividualresponse(cmdid)
|
|
results = []
|
|
begin
|
|
BeEF::Core::Models::Result.where(command_id: cmdid).each do |result|
|
|
results.push({ 'date' => result.date, 'data' => JSON.parse(result.data) })
|
|
end
|
|
rescue StandardError
|
|
return nil
|
|
end
|
|
results
|
|
end
|
|
|
|
def executecommand
|
|
definition = {}
|
|
options = {}
|
|
options.store('zombie_session', targetsession.to_s)
|
|
options.store('command_module_id', cmd['id'])
|
|
|
|
unless cmd['Data'].nil?
|
|
cmd['Data'].each do |key|
|
|
options.store('txt_' + key['name'].to_s, key['value'])
|
|
end
|
|
end
|
|
|
|
options.keys.each do |param|
|
|
definition[param[4..-1]] = options[param]
|
|
oc = BeEF::Core::Models::OptionCache.first_or_create(name: param[4..-1])
|
|
oc.value = options[param]
|
|
oc.save
|
|
end
|
|
|
|
mod_key = BeEF::Module.get_key_by_database_id(cmd['id'])
|
|
# Hack to rework the old option system into the new option system
|
|
def2 = []
|
|
definition.each do |k, v|
|
|
def2.push({ 'name' => k, 'value' => v })
|
|
end
|
|
# End hack
|
|
if BeEF::Module.execute(mod_key, targetsession.to_s, def2).nil?
|
|
false
|
|
else
|
|
true
|
|
end
|
|
|
|
# Old method
|
|
# begin
|
|
# BeEF::Core::Models::Command.new( :data => definition.to_json,
|
|
# :hooked_browser_id => self.targetid,
|
|
# :command_module_id => self.cmd['id'],
|
|
# :creationdate => Time.new.to_i
|
|
# ).save
|
|
# rescue
|
|
# return false
|
|
# end
|
|
|
|
# return true
|
|
end
|
|
|
|
def update_command_module_tree(tree, cmd_category, cmd_status, cmd_name, cmd_id)
|
|
# construct leaf node for the command module tree
|
|
leaf_node = {
|
|
'text' => cmd_name,
|
|
'leaf' => true,
|
|
'status' => cmd_status,
|
|
'id' => cmd_id
|
|
}
|
|
|
|
# add the node to the branch in the command module tree
|
|
tree.each do |x|
|
|
if x['text'].eql? cmd_category
|
|
x['children'].push(leaf_node)
|
|
break
|
|
end
|
|
end
|
|
end
|
|
|
|
def get_command_module_status(mod)
|
|
hook_session_id = targetsession
|
|
return 'Verified Unknown' if hook_session_id.nil?
|
|
|
|
case BeEF::Module.support(
|
|
mod,
|
|
{
|
|
'browser' => BD.get(hook_session_id, 'BrowserName'),
|
|
'ver' => BD.get(hook_session_id, 'BrowserVersion'),
|
|
'os' => [BD.get(hook_session_id, 'OsName')]
|
|
}
|
|
)
|
|
|
|
when BeEF::Core::Constants::CommandModule::VERIFIED_NOT_WORKING
|
|
'Verified Not Working'
|
|
when BeEF::Core::Constants::CommandModule::VERIFIED_USER_NOTIFY
|
|
'Verified User Notify'
|
|
when BeEF::Core::Constants::CommandModule::VERIFIED_WORKING
|
|
'Verified Working'
|
|
when BeEF::Core::Constants::CommandModule::VERIFIED_UNKNOWN
|
|
'Verified Unknown'
|
|
else
|
|
'Verified Unknown'
|
|
end
|
|
end
|
|
|
|
# @note Returns a JSON array containing the summary for a selected zombie.
|
|
# Yoinked from the UI panel -
|
|
# we really need to centralise all this stuff and encapsulate it away.
|
|
def select_zombie_summary
|
|
return if targetsession.nil?
|
|
|
|
# init the summary grid
|
|
summary_grid_hash = {
|
|
'success' => 'true',
|
|
'results' => []
|
|
}
|
|
|
|
# zombie properties
|
|
# in the form of: category, UI label, value
|
|
zombie_properties = [
|
|
|
|
# Browser
|
|
['Browser', 'Browser Name', 'BrowserName'],
|
|
['Browser', 'Browser Version', 'BrowserVersion'],
|
|
['Browser', 'Browser UA String', 'BrowserReportedName'],
|
|
['Browser', 'Browser Language', 'BrowserLanguage'],
|
|
['Browser', 'Browser Platform', 'BrowserPlatform'],
|
|
['Browser', 'Browser Plugins', 'BrowserPlugins'],
|
|
['Browser', 'Window Size', 'WindowSize'],
|
|
|
|
# Browser Components
|
|
['Browser Components', 'Flash', 'HasFlash'],
|
|
['Browser Components', 'Java', 'JavaEnabled'],
|
|
['Browser Components', 'VBScript', 'VBScriptEnabled'],
|
|
['Browser Components', 'PhoneGap', 'HasPhonegap'],
|
|
['Browser Components', 'Google Gears', 'HasGoogleGears'],
|
|
['Browser Components', 'Web Sockets', 'HasWebSocket'],
|
|
['Browser Components', 'QuickTime', 'HasQuickTime'],
|
|
['Browser Components', 'RealPlayer', 'HasRealPlayer'],
|
|
['Browser Components', 'Windows Media Player', 'HasWMP'],
|
|
['Browser Components', 'VLC', 'HasVLC'],
|
|
['Browser Components', 'WebRTC', 'HasWebRTC'],
|
|
['Browser Components', 'ActiveX', 'HasActiveX'],
|
|
['Browser Components', 'Session Cookies', 'hasSessionCookies'],
|
|
['Browser Components', 'Persistent Cookies', 'hasPersistentCookies'],
|
|
|
|
# Hooked Page
|
|
['Hooked Page', 'Page Title', 'PageTitle'],
|
|
['Hooked Page', 'Page URI', 'PageURI'],
|
|
['Hooked Page', 'Page Referrer', 'PageReferrer'],
|
|
['Hooked Page', 'Hook Host', 'HostName'],
|
|
['Hooked Page', 'Cookies', 'Cookies'],
|
|
|
|
# Host
|
|
%w[Host Date DateStamp],
|
|
['Host', 'Operating System', 'OsName'],
|
|
%w[Host Hardware Hardware],
|
|
%w[Host CPU CPU],
|
|
['Host', 'Default Browser', 'DefaultBrowser'],
|
|
['Host', 'Screen Size', 'ScreenSize'],
|
|
['Host', 'Touch Screen', 'TouchEnabled']
|
|
]
|
|
|
|
# set and add the return values for each browser property
|
|
# in the form of: category, UI label, value
|
|
zombie_properties.each do |p|
|
|
case p[2]
|
|
when 'BrowserName'
|
|
data = BeEF::Core::Constants::Browsers.friendly_name(BD.get(targetsession.to_s, p[2])).to_s
|
|
|
|
when 'ScreenSize'
|
|
screen_size_hash = JSON.parse(BD.get(targetsession.to_s, p[2]).gsub(/"=>/, '":')) # tidy up the string for JSON
|
|
width = screen_size_hash['width']
|
|
height = screen_size_hash['height']
|
|
cdepth = screen_size_hash['colordepth']
|
|
data = "Width: #{width}, Height: #{height}, Colour Depth: #{cdepth}"
|
|
|
|
when 'WindowSize'
|
|
window_size_hash = JSON.parse(BD.get(targetsession.to_s, p[2]).gsub(/"=>/, '":')) # tidy up the string for JSON
|
|
width = window_size_hash['width']
|
|
height = window_size_hash['height']
|
|
data = "Width: #{width}, Height: #{height}"
|
|
else
|
|
data = BD.get(targetsession, p[2])
|
|
end
|
|
|
|
# add property to summary hash
|
|
next if data.nil?
|
|
|
|
summary_grid_hash['results'].push({
|
|
'category' => p[0],
|
|
'data' => { p[1] => CGI.escapeHTML(data.to_s) },
|
|
'from' => 'Initialization'
|
|
})
|
|
end
|
|
|
|
summary_grid_hash
|
|
end
|
|
|
|
def select_network_hosts
|
|
return if targetsession.nil?
|
|
|
|
configuration = BeEF::Core::Configuration.instance
|
|
unless configuration.get('beef.extension.network.enable')
|
|
print_error('Network extension is disabled')
|
|
return {
|
|
'success' => 'false',
|
|
'results' => []
|
|
}
|
|
end
|
|
|
|
# init the summary grid
|
|
summary_grid_hash = {
|
|
'success' => 'true',
|
|
'results' => []
|
|
}
|
|
@nh = BeEF::Core::Models::NetworkHost
|
|
hosts = @nh.where(hooked_browser_id: targetsession)
|
|
|
|
# add property to summary hash
|
|
unless hosts.empty?
|
|
hosts.each do |x|
|
|
summary_grid_hash['results'].push({
|
|
'ip' => x['ip'].to_s,
|
|
'hostname' => x['hostname'].to_s,
|
|
'type' => x['type'].to_s,
|
|
'os' => x['os'].to_s,
|
|
'mac' => x['mac'].to_s,
|
|
'lastseen' => x['lastseen'].to_s
|
|
})
|
|
end
|
|
end
|
|
|
|
summary_grid_hash
|
|
end
|
|
|
|
def select_network_services
|
|
return if targetsession.nil?
|
|
|
|
configuration = BeEF::Core::Configuration.instance
|
|
unless configuration.get('beef.extension.network.enable')
|
|
print_error('Network extension is disabled')
|
|
return {
|
|
'success' => 'false',
|
|
'results' => []
|
|
}
|
|
end
|
|
|
|
# init the summary grid
|
|
summary_grid_hash = {
|
|
'success' => 'true',
|
|
'results' => []
|
|
}
|
|
@ns = BeEF::Core::Models::NetworkService
|
|
services = @ns.where(hooked_browser_id: targetsession)
|
|
|
|
# add property to summary hash
|
|
unless services.empty?
|
|
services.each do |x|
|
|
summary_grid_hash['results'].push({
|
|
'proto' => x['proto'].to_s,
|
|
'ip' => x['ip'].to_s,
|
|
'port' => x['port'].to_s,
|
|
'type' => x['type'].to_s
|
|
})
|
|
end
|
|
end
|
|
|
|
summary_grid_hash
|
|
end
|
|
|
|
attr_reader :targetsession, :targetid, :targetip, :cmd
|
|
|
|
protected
|
|
|
|
attr_writer :targetsession, :targetid, :targetip, :cmd
|
|
attr_accessor :config
|
|
end
|
|
end
|
|
end
|
|
end
|