Monday, December 31, 2012

BeEF Shank - BeEF MitM for Pentests

Happy New Year, everyone!

This guest post is brought to you by Ryan Linn.

At BlackHat Briefings this past summer, Steve Ocepek and I released Ruby code that would assist folks who want to use BeEF on internal penetration tests. Some may wonder, why would you want to do that? More and more internal resources are moving to Sharepoint, tools moving to web based intranet sites, and personal information moving away from mainframes and thick clients into web clients with database back-ends. Being able to attack the browser effectively on internal tests is going to become more crucial in giving realistic feedback on potential impact of an intrusion.

So our goal at BlackHat this year was to demonstrate how to effectively utilize the browser among local machines on the network. We created two tools to help utilize BeEF effectively on internal tests. The first was a tool called shank. Shank is an ARP Spoofing tool used to execute smarter Man-In-The-Middle (MITM) attacks injecting the BeEF hook into browsers surfing on the network.


Shank has two distinct parts. The first part is the MITM engine that begins by ARP spoofing the local network. Once the network has been successfully poisoned, shank begins polling the local BeEF instance to determine which browsers are already hooked. If shank sees a web response destined for a poisoned client that hasn’t already been hooked by BeEF, shank will insert the BeEF hook into the response. Once the browser is hooked, shank won’t inject another response until the BeEF hook is lost.  This ensures that while the browser is actively browsing the web, it will stay hooked by shank.

So where do we go from here? Once we have a browser hooked, we want to get as much information as we can from each browser.  BeEF lets us auto-run one module for each browser, but what if we wanted to do a large amount of fingerprinting for each browser we hook. This is where the autorun.rb comes into place.  For each browser we hook, we check in autorun.rb to detect if this is a new hook. If it is a new hook, we have an array of modules that we want to run against the hooked browser.

These modules can do anything from figure out what version of Java and Flash is running, to determining all the interfaces on a machine to determine if a VPN session is active or if a host is multi-homed. Based on that logic, and since this is all in Ruby, additional logic can be added for reactions based on the fingerprints such as auto-launching MSF modules, or other types of attacks based on versions of Flash or the presence of VPN interfaces. This increases the functionality of BeEF through external triggers thanks to Michele’s REST API interface.

Leveraging these tools can greatly enhance your internal penetration tests, and this is a proof of concept to help with internal tests. If you want to try any of this out for yourself, you can get the code at github. I also encourage you to checkout the whitepaper.

If you have any suggestions for other things to add to BeEF, feel free to add them to our feature tracker, and we’ll take a shot. If you’d like to help out with BeEF let us know!

67 comments:

  1. Hi great stuff!

    I was thinking that if you this type of attack could be integrated in BeeF?
    http://resources.infosecinstitute.com/slaac-attack/

    thk

    ReplyDelete
  2. Thankful such an awesome sum for sharing this glorious information! I am envisioning see more posts by you. I like visiting you site since I always come across interesting articles like this one. Great Job, I greatly appreciate that. Do keep sharing! Your information is good and friendly this article very helpful for me. Thanks for the post. After seeing the following post, I totally inspire from you and your blogs also respectively. It was nice articles and I also very enjoyed after read this. Thanks a lot sir. Visit: Best essay writing service

    ReplyDelete
  3. * Jual Obat Aborsi,,
    * Obat Aborsi,,
    * Obat Penggugur Kandungan,,
    * what I have read on this page is enough to make me satisfied can menik die this article thanks greetings *

    ReplyDelete
  4. Writing an essay? Start with a good hook. Looking for some good hooks for essays? Click on a link!

    ReplyDelete
  5. how to enable hey cortana in windows 10 hello cortana' is a feature on Windows 10 that lets your personal assistan

    ReplyDelete
  6. I have read very important topics write my essay about the client resources. They are issued many updates on your work place for innovations. so we are given this article to reviews in online and thankful to have the great services.

    ReplyDelete

  7. افضل شركات الاثاث المستعمل
    قد يحتاج البعض إلى شراء بعض قطع الأثاث اللازمة في المنزل لكن عند البحث في المحال التجارية يجدون أن الأسعار باهظة بشكل غير معقول لذلك قد يفكر الكثير من الأشخاص اللجوء إلى شراء الأثاث المستخدم والذي يكون في حالة جيدة لكن قد تنتابهم الحيرة في معرفة الشركة التي لا بد من التوجه إليها للبحث عن قطع الأثاث المناسبة ولماذا كل ذلك فكل ما عليك هو التواصل مع شركة شراء اثاث مستعمل والتي عادة ما توفر جميع قطع الأثاث التي يرغب في اقتنائها جميع العملاء مهما اختلفت طبقاتهم المجتمعية فجرب ذلك الأمر بنفسك ونعدك بأنك لن تندم أبداً على ذلك الاختيار.
    شراء الاثاث المستعمل بالدمام
    شراء اثاث مستعمل
    ارقام الاثاث المستعمل
    اتخاذ القرار الحاسم بالتوجه إلى جهة معينة لشراء الأثاث المستعمل منها أمر ليس سهل إطلاقاً لكن عندما يكون لديك خلفية معرفية عن كل شركة فهذا بالطبع سيساعدك على اختيار ما هو أفضل لك ولكل أفراد أسرتك لذلك فسنطلعك في النقاط التالية على أهم المميزات التي تمتلكها شركة شراء اثاث مستعمل وذلك لكي تطمئن في حالة التعامل معها:
    • توفير جميع أنواع الأثاث اللازم لكل منزل مثل غرف النوم وأطقم الصالونات والأنتريهات هذا بالإضافة إلى المجالس وغرف النوم الخاصة بالأطفال.
    • يوجد بشركتنا المتميزة العديد من أجهزة الحاسب الآلي وتتميز باختلاف أحجامها وأنواعها وأسعارها وهذا لكي تناسب جميع عملائنا الكرام.
    • إذا كنت تبحث عن شراء الأجهزة الكهربائية المنزلية مثل الثلاجات وأجهزة التكييف ففي شركتنا ستجد أنواع متميزة لا حصر لها يمكنك اختيار ما يحلو لك منها.
    • يمكنك من خلال شركتنا المتميزة شراء جميع أدوات المطبخ مثل غسالات الأطباق وأفران الميكروويف والأفران العادية.
    • لا تخشى عملية نقل الأثاث إلى منزلك حيث أن شركة شراء اثاث مستعمل توفر العديد من الشاحنات ذات الأحجام المختلفة لمساعدتك في نقل جميع الأثاث الذي قمت باختياره وشرائه إلى منزلك بشكل آمن.
    • خدمة العملاء التابعة لنا تعمل على مدار 24 ساعة وهذا لاستقبال جميع اتصالاتكم الهاتفية وكافة استفساراتكم.
    • يتم عرض جميع الأثاث المتوفر لدينا بشكل مرتب ومنظم هذا بالإضافة إلى أن أسعارنا لا يوجد لها منافس.

    شراء الاثاث المستعمل
    شراء اثاث
    حقين الاثاث المستعمل

    ReplyDelete
  8. Students could often find it tough to write their academic tasks. It could lead to they not getting desired grades in the academics. Opting for our Assignment help could be ideal for such students and they can get a complete assignment solution from us.

    ReplyDelete
  9. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.

    Selenium with python Training in Electronic City

    ReplyDelete
  10. All Assignment Help is a web portal where students get help in making assignments for all the subjects, with the help of our experts. You will get 100% plagiarism free assignment. Expertes consultation is also available for students. If they have any query they can contact with our experts anytime.

    ReplyDelete
  11. Those who are searching over internet matlab assignment help can contact with us now. We are the best assignment writing service provider in melbourne, Australia. Our Academic assignment writers available 24*7 hours for the students, if you really want to need IT assignment help, java assignment help, programming assignment help, r programming assignment help, case study assignment help online at cheapest price and get high distinction grades.

    ReplyDelete
  12. Searching out a penetration trying out a framework to offer protection awareness? Strive for the browser exploitation framework. The ability to modify content transferred between two hosts the usage of the guy inside the center (mitm) assaults is a network attack vector. Info Knowledge Shared by Do My Dissertation Help Cheap | All Assignment Help Australia

    ReplyDelete
  13. Thank you for your post, I look for such article along time. And do you want to leave the virtual worth yourself? If you want, let go to the game sims 4 cheats. Click link to participate game.

    ReplyDelete
  14. Nice article this post is very useful to every people
    Thank You
    You Check Also Read This Post :- best anime streaming sites

    ReplyDelete
  15. very nice post and detail work done by the article and it shows how good you are in writing good stuff please check buyfbpagelikes.com and check my work

    ReplyDelete
  16. very nice post and detail work done by the article and it shows how good you are in writing good stuff please check unblockedgames.life and play any game

    ReplyDelete
  17. very nice post and detail work done by the article and it shows how good you are in writing good stuff please kisscartoon and watch any cartoon you want

    ReplyDelete
  18. very nice post and detail work done by the article and it shows how good you are in writing good stuff please check kik usernames and find all kik users

    ReplyDelete
  19. This article is really fantastic and thanks for sharing the valuable post.
    red ball 4

    ReplyDelete
  20. Why we rank the best in offering professional custom writing services is the quality services that are offered to the thousands of clients that contract our organization for the provision of quality custom dissertation writing service.

    ReplyDelete
  21. I think you had put 1000% in this post that's why this post is something different and knowledgeable for all of us. Thanks for this.
    Attitude Status
    Instagram Bios for Girls

    ReplyDelete
  22. That's An Amazing post where you share Awesome knowledge. So thank you.
    ViralVilla

    ReplyDelete
  23. Our Custom Essay Services is the best and highly ranked by students because of our dedication to keeping the promise. Whatever you read from the website about us is true,and we are committed to delivering well prepared papers to meet your entire write my Top Essay Writing Service academic needs.

    ReplyDelete
  24. Keep writing such kind of info on your blog. Im really impressed by your blog.
    driving games

    ReplyDelete


  25. the article and it shows how good you are in writing good stuff please check buyfbpagelikes.com and c
    http://www.robbiramdhani.web.id/

    ReplyDelete
  26. 4 As well as the transport company in Najran has cars and trucks capable of transporting luggage easily, and for all these advantages you must deal with furniture transport company in Najran as the best transport company in Najran.
    شركة نقل عفش
    شركة نقل اثاث من الرياض الى قطر
    شركة نقل عفش من الرياض الى قطر
    شركة نقل عفش بالخبر

    ReplyDelete
  27. A well-written Literature Review for Dissertation contains a title, abstract, introduction, literature review, methods, results, discussion and references. The company offers Research Paper Writers for Hire to the Customers.

    ReplyDelete
  28. It is a great article. You will surely like this also because it is a great stuff
    http://bit.ly/31MuA4O

    ReplyDelete
  29. I really like touring your site due to the fact i continually come across thrilling articles like this one. the incredible task, I greatly respect that. do maintain sharing! your statistics is right and pleasant this text very useful for me. they are issued many updates to your painting's vicinity for improvements. so we are given this Cheap Essay Writing text to critiques in online and grateful to have the great offerings.

    ReplyDelete
  30. Recall whilst meeting people to pentest web www.6DollarEssay.com apps and log-ins you needed to fire penetration testing and protection discussion. Intercepting passwords and forwarding statistics.

    ReplyDelete
  31. Thanks for sharing this information Upsers

    ReplyDelete
  32. We provide AllAssignmentHelp to students of any college in their United States. Our all students are also given 2-4 * 7 support and service. Best Biology Dissertation Help Online

    ReplyDelete
  33. Accept the quick help you require from our skillful economics Don’t accentuate about thinking nominal GDP on your private—our expert economics homework help online can help you answer the difficulties you are working with on your time. economics homework help online

    ReplyDelete
  34. The content of this article page, I find the content quite interesting and useful to me, thank you for sharing http://drawmything.games/dupligon

    ReplyDelete
  35. In my opinion, the issues you raise are still some unclear. I hope in the near future to read more articles from you apkxyz

    ReplyDelete
  36. AllHomeworkHelp gives an online service of 24 hours of receptiveness to understudies. Through this, the understudies can at whatever point look for help from online associations.
    chemistry homework

    ReplyDelete
  37. We created two tools to help utilize BeEF effectively on internal tests.

    this article

    ReplyDelete
  38. ساندویچ پانل، یا ساندویچ پنل و یا همینطور پنل ساندویچی سازه ای پیش ساخت و مدرنی است که به دلیل ویژگی های بیشمارش در حال جایگزین شدن به جای مصالح سنتی و قدیمی در علم ساختمان سازی امروزه است. البته کاربرد ساندویچ پانل به ساختمان سازی محدود نمی شود.

    پانل ها دارای سه لایه هستند، دو لایهء اطراف ساندویچ پانل را ورق ها تشکیل می دهند و هسته و مرکز ساندویچ پانل را در بر می گیرند. هسته این سازه پیش ساخته نیز از فوم ساخته شده است. از ویژگی های ساندویچ پانل می توان به: سهولت در نصب و در نتیجه پایین آورنده زمان پرژوه، عایق صدا، عایق حرارت، عایق سرما، عایق در برابر رطوبت، مقاومت بالا در برابر خوردگی و زدگی، انعطاف پذیری بالا، مقاومت در برابر کپک زدگی و نفوذ حشرات و ایجاد محیطی بهداشتی، مقاوم در برابر زمین لرزه، تحمل بار بالا، خاصیت رنگ پذیری، قابلیت شستشو، قیمت بسیار مناسب و مقرون به صرفه بودن آن نسبت به محصولات سنتی، عدم نیاز به زیر سازی، بوجود آورنده ی نما و ظاهری زیبا و.. اشاره کرد.

    ReplyDelete
  39. It's very good post which I really enjoyed reading. It is not everyday that I have the possibility to see something like this.
    apk here

    ReplyDelete
  40. Thank you for sharing this wonderful article, And it is very useful information norton.com/setup
    www.norton.com/setup

    ReplyDelete
  41. Really great article, Glad to read the article. It is very informative for us. Thanks for posting www.norton.com/setup
    norton.com/setup

    ReplyDelete
  42. My silver Service deserves a little Silver Service occasionally, travel in a luxurious, wheelbase sedan with an experienced driver who’ll get you there in style.
    silver top silver service

    ReplyDelete
  43. BeEF is pioneering techniques that provide practical client side attack vectors.

    1playergames66

    ReplyDelete
  44. Various sorts of assignments making endeavors to ensure the broad headway of data and fitness of the understudies.
    Assignment Help Online
    Write My Assignment
    business essay

    ReplyDelete
  45. I really happy found this website eventually. Really informative and inoperative, Thanks for the post and effort! Please keep sharing more such blog.
    norton online help

    spectrum email login

    kaspersky activation

    ReplyDelete
  46. Very helpful advice in this particular post! It’s the little changes that make the largest changes. Thanks for sharing!
    mobile link

    ReplyDelete
  47. Dear admin thank you so much for sharing this informative information with us, it's really useful for me. your blog is amazing. I wish you all the best for future comments. I have read it and I have also something here to share with you. norton.com/setup
    www.norton.com/setup, Norton product key

    ReplyDelete
  48. Just speaking, I am a narrator a craftsman who paints pictures with words cleared into creation by the intensity of a pen.

    whiteboard animation video

    ReplyDelete
  49. My silver Service understands the importance of educating our drivers on transporting passengers with assistance animals. Assistance animals are welcome in all Silver Service taxis and count as 1 passenger.
    taxi silver service Melbourne

    ReplyDelete
  50. We take your order with your complete instruction to write an essay just the way you need it.
    Writing Service

    ReplyDelete
  51. Thanks for sharing this post.It is very informative and helpful.
    I like this blog very much, Its a very nice billet to read and incur Info.

    office.com/setup
    office.com/setup

    ReplyDelete