Bug: Core - 1785 Fixed public hook url configuration settings

[wheatley]

Category

Bug: Core

Feature/Issue Description

As mentioned in #1785 there is currently a bug that prevents BeEF from hooking browsers when the BeEF hook (public) URL is different from the BeEF host (local) URL ((ie, behind a reverse proxy, or when used via services such as ngrok, or when using port forwarding from a border gateway)

To resolve this issue the PR completely decouples the local host settings from the public settings.
This means that if a user sets anything in the public section within the configuration.

        # If BeEF is running behind a reverse proxy or NAT
        #  set the public hostname and port here & protocol
        public:
            host: "example.com"
            port: "3000"
            https: true/false

It will automatically use these values when referencing the hook (public) URL.
These values can be seen in the Configuration object used through the application.

Beef Host

      #
       # Returns the beef host which is used by external resources
       # e.g. hooked browsers
       def beef_host
         public_host || local_host
       end

Beef Port

      #
       # Returns the beef port which is used by external resource
       # e.g. hooked browsers
       def beef_port
         public_port || local_port
       end

Beef protocol (http/https)

#
       # Returns the beef protocol that is used by external resources
       # e.g. hooked browsers
       def beef_proto
         if public_enabled? && public_https_enabled? then
           return 'https'
         elsif public_enabled? && !public_https_enabled?
           return 'http'
         elsif !public_enabled?
           return local_proto
         end
       end

A contributor can now new some new configuration values that will reference the full hooking url

      # Returns the url to the hook file
       #
       # @return [String] the url string
       def hook_url
         "#{beef_url_str}#{hook_file_path}"
       end

These new configuration getters can be used through the code base reducing the code repetition found through the code base

     @configuration = BeEF::Core::Configuration.instance
     beef_proto = @configuration.get("beef.http.https.enable") == true ? "https" : "http";
     beef_host = @configuration.get("beef.http.public") || @configuration.get("beef.http.host")
     beef_port = @configuration.get("beef.http.public_port") || @configuration.get("beef.http.port")
     beef_hook = @configuration.get("beef.http.hook_file")
     hook_url = "#{beef_proto}://#{beef_host}:#{beef_port}/#{beef_hook}"

Can now simply be the following

    @config.hook_url

The most common issue that would be raised due to this bug was when a users was trying to implement ngrok.
Ngrok would use the https protocol and if the user did not setup the beef local host using https it would cause mixed content errors preventing browser hooking.

With the net configuration items, the user can now have a https proxy that redirects to a http local host please see the new setup instructions for ngrok here

Test Cases

Tests have been developed in the specs area. spec/beef/core/main/configuration_spec.rb
These will need to be improved as they set and retrieve within the scope.
They should in theory only read config files that have been pre-populated with the testing scenarios

Wiki Page

https://github.com/beefproject/beef/wiki/Configuration#web-server-configuration has been updated below
https://github.com/beefproject/beef/wiki/FAQ#how-do-i-configure-beef-with-ngrok

[wheatley]

Will need to update wiki

Web Server Configuration

The web server can be fully configured, this is done in the HTTP subsection of the config.yaml file:

    http:
        debug: false # Will print verbose message in BeEF console
        host: "0.0.0.0" # IP address of the web server
        port: "3000" #Port of the web server

        # If BeEF is running behind a reverse proxy or NAT
        #  set the public hostname and port here & protocol
        public:
            host: "example.com"
            port: "3000"
            https: true/false

        dns: "localhost" # Address of DNS server
        hook_file: "/hook.js" # Path for hooking script
        hook_session_name: "BEEFHOOK" #Name of session
        session_cookie_name: "BEEFSESSION" # Name of BeEF cookie

[wheatley]

#2067

[wheatley]

How do I configure BeEF with ngrok?

Download ngrok, then tunnel your BeEF port (default: 3000):

This can be achieved with the following command, which tells ngrok to open a tunnel from port 80 on the public server to port 3000 on your local host.

$ ngrok http 3000

Specify the public domain name beef.http.public and public port beef.http.public_port in config.yaml:

        debug: false # Will print verbose message in BeEF console
        host: "localhost" # IP address of the web server
        port: "3000" #Port of the web server

        public: 
            host: "<your-id>.ngrok.io"      # public hostname/IP address
            port: "443"
            https: true

        # Reverse Proxy / NAT
        # If you want BeEF to be accessible behind a reverse proxy or NAT,
        #   set both the publicly accessible hostname/IP address and port below:
        # NOTE: Allowing the reverse proxy will enable a vulnerability where the ui/panel can be spoofed
        #   by altering the X-FORWARDED-FOR ip address in the request header.
        allow_reverse_proxy: true

You should then be able to access BeEF using the following URL:

http://<your-id>.ngrok.io/ui/panel

[DeezyE]

Made a few comments

[DeezyE]

it's singular 'enable' in the config.yaml

[wheatley]

updated and resolved