Dr. Strangelove or: How I Learned to Stop Worrying and Love the BeEF

Dr. Strangelove or:
how I Learned to Stop Worrying
and Love the BeEF

Michele “antisnatchor” Orru’

Confidence 2011 - 25 May 2011
Sunday, May 22, 2011

WHO AMI I?

Penetration Tester @ Royal Bank of Scotland
BeEF developer, lover and eater
Failed business man and “entrepreneur”
Kubrick fan
Deﬁnitely not a fan of our Italian prime minister
Silvio “bunga-bunga” Berlusconi

Confidence 2011 {Dr. Strangelove or: How I Learned to Stop Worrying and Love the BeEF} © antisnatchor # 2

OUTLINE

I cannot Pwn to Own :-(
The new BeEF
Add your own attacks to BeEF
Extend BeEF (next conference...lack of time :-()
Future development and cool ideas


I CANNOT PWN TO OWN :-(

We need to break inside a network and reach the
ApplicationServer

The ApplicationServer is behind an Apache
machine with mod_jk:
OS: OpenBSD
CPU: SPARC64
Open ports: 22 (public-key), 80, 443


CAN I EAT THE BEEF? (sorry vegetarians)

Nope! Even if it’s tasty :-)



BeEF => Browser Exploitation Framework
Pioneered by Wade Alcorn in 2005(public release)
Originally Inspired by Anton Rager research

Powerful platform for Client-side pwnage, XSS post-
exploitation and generally victim browser security-
context abuse


THE OLD BeEF => PHP + static HTML :-(


THE NEW BeEF => RUBY & ExtJS :-)


THE NEW BeEF
Rewritten from scratch in Ruby
ExtJS for a usable and ajax-based GUI
jQuery for DOM manipulation and XHR
SQLite and MySQL support
Modular and extensible architecture
Core much more stable (next releases focused on
attack scenarios - we’re open to any suggestions :-)

A lot of new cool features and attacks...


coolest Features: METASPLOIT integration

Launch MSF browser and client-side exploits
(Flash, Adobe Reader, Java, ...) to the hooked browser
in a point-and-click way :-)

MSF integrated via XML-RPC, with an additional
caching layer on the BeEF side
Browser AutoPWN will be (re)added soon...


coolest Features: METASPLOIT integration

Hidden iFrame injection with src pointing to the
MSF listening callback service


coolest Features: EVENT LOGGER

Log keystrokes, mouse clicks and form submissions
that are executed by the hooked browser.
... Then send them back to BeEF ...

Imagine ﬁnding XSS on the
pre-auth surface of a
website


0day Reﬂected XSS on Plesk Panel 10.2.0 (with SSO) login page



After hooking the victim browser to BeEF, Parallels
Plesk admin/customer credentials can be stolen with
JS keylogging

coolest Features: NETWORK STACK

BeEF base64 encodes the JSON'ed data stream
and then splits the base64 string by the conﬁgured
maximum URL length.
Data is handled in streams of packets that are
reconstructed by BeEF
Once split each segment is sent as a packet and
reconstructed by BeEF.


BeEF: NETWORK STACK
architecture


coolest Features: NETWORK STACK

In future releases the maximum URL will be
automatically detected.

How do you send 165KB of data back to BeEF?
packet queue
165KB -> 165 packets


coolest Features: TUNNELING PROXY

The browser becomes the exit node for the tunnel: it
will perform the HTTP request and receive the response.
Next the response is communicated back to the BeEF
proxy which in turn delivers it to the browser.
Afterwords the request in the context of the user (any
existing cookies will be automatically used)


coolest Features: TUNNELING PROXY

Similar to XSSProxy, but goes a step further:
You can choose to which zombie tunnel requests
Doesn’t need a third app (uses WebRick proxy)


coolest Features: PERSISTENCE

Implemented using Samy’s EverCookie for the
main BEEFHOOK cookie
Various ready-to-use command modules:
iFrame persistence
pop-under window



One of the many reasons to code your exploit to
BeEF is because you have a nice Javascript API that
gives you all you need for...



detect the browser including version, plugins, and
other details
detect the Operating System including iOS, BeOS
and Win3.1 ;-)
manipulate the DOM attaching/detaching applets,
creating invisible iFrames, rewriting links, ...



log keystrokes, mouse clicks and form submissions
do XHRs and retrieve all you need for further
exploitation
geolocate the victim retrieving latitude/longitude
for further targeted attacks


loading sequence
architecture
BeEF:



JBoss 4.x, 5.1.0, 6.0.0.M1 JMX deploy exploit
Exploit is available in MSF, but you need to have
direct access to the target
(or use a host as a pivot)

Then why not use the victim browser as a pivot?


How to port the JBoss exploit to BeEF in 3 steps
(approximately 15/20 mins, testing included :-)



first step: config file



second step: UI exploit setup



third step: javascript (exploit code)



Now lets see it in action...

✤ IT’s DEMO time!


Enhance the Tunneling Proxy features
caching
request queueing
generally: performance

Enhance Yokoso
add more device signatures
add support for HTTPS/IPv6


Implement Rider
Victim x is browsing website example.com while
hooked in BeEF.
Use her browser to proxy attacker requests and
"Ride" her session from the BeEF adminUI

Implement Meterpreter wrapper/shell code that
communicates HTTP
In this way the browser can be a full pivot point :-)

Command module autorun/autoexit
This will add AutoPwn features, while being the
starting point for command chains like:
hasJava() -> loadMaliciousApplet(...)
launchMetasploitAuroraExploit(...) if
beef.browser.isIE7()

Implement obfuscated/polymorphic Javascript hook
Add support for HTTPS


... and many other (nasty) things ...

Follow (and get in touch with) BeEF: @beefproject
Checkout BeEF: http://code.google.com/p/beef/
Eat the BeEF


Thanks to

Wade Alcorn and the other BeEF core developers
(the two Bens, Scotty, Christian, ...)
Michal & Piotr
My employer
Conﬁdence crew and you attendees


QUESTIONS?


Dr. Strangelove or: How I Learned to Stop Worrying and Love the BeEF

Recommended

Recommended

More Related Content

Recently uploaded

Recently uploaded (20)

Featured

Featured (20)

Dr. Strangelove or: How I Learned to Stop Worrying and Love the BeEF