D4Vinci/PasteJacker D4Vinci/PasteJacker

  • Stars
    star
    343
  • Rank 123,371 (Top 3 %)
  • Language
    Python
  • Created about 6 years ago
  • Updated almost 6 years ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
D4Vinci/PasteJacker
github

D4Vinci

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Hacking systems with the automation of PasteJacking attacks.

PasteJacker Python 3.5 Version

The main purpose of the tool is automating (PasteJacking/Clipboard poisoning/whatever you name it) attack with collecting all the known tricks used in this attack in one place and one automated job as after searching I found there's no tool doing this job the right way πŸ˜„

Now because this attack depends on what the user will paste, I implemented the Metasploit web-delivery module's idea into the tool so when the user pastes into the terminal, you gets meterpreter session on his device πŸ˜„

Watch tutorial on youtube

What's PasteJacking ?

In short, Pastejacking is a method that malicious websites employ to take control of your computers’ clipboard and change its content to something harmful without your knowledge. From The Windows club definition

So here what I did is automating the original attack and adding two other tricks to fool the user, using HTML and CSS Will talk about it then added meterpreter sessions as I said before.

A simple scenario to make things clear:

  1. The target opens an HTML page served by the tool and this page has anything that makes the user wants to copy from it and paste into the terminal. Ex: package installation instructions
  2. Target copies anything from the page then in the background it gets replaced quickly with our liner.
  3. The user pastes into the terminal and before he notices that the line he copied has been changed :
    • The line gets executed by itself in the background (Without pressing enter)
    • The terminal gets cleared.
    • The user sees the terminal is usable again.
    • You already got your meterpreter session by this time.
  4. All of that happened in less than second and maybe the user thinks this is a bad program and he won't install it πŸ˜„

This tool uses 3 methods to trick user into copying our payload instead of the command he copies:

  • Using javascript to hook the copy event and replace copied data.

    • Advantages :
      1. Anything the user copies in the page will be replaced with our line.
      2. Command executed by itself once target paste it without pressing enter.
    • Disadvantages :
      1. Requires Javascript to be enabled on the target browser.

  • Using span style attribute to hide our lines by overwriting.

    • Advantages :
      1. Doesn't require javascript to be enabled.
      2. Works on all browsers.
    • Disadvantages :
      1. Target must select all the text in the page or the first two words to ensure that he copies our hidden malicious lines.

  • Using span style again but this time to make our text transparent and non-markable.

    • Advantages :
      1. Doesn't require javascript to be enabled.
    • Disadvantages :
      1. Target must select all the text in the page to ensure that he copies our hidden malicious lines.
      2. Not working on opera and chrome.
What's the payload user copies ?

PasteJacker gives you the option to do one of this things:

  1. Generate a msfvenom backdoor on our machine and the liner target gonna copy will download the backdoor on the its machine, through wget or certutil depends on the OS, then executes it on the background without printing anything to the terminal.
  2. Serve a liner that gets you a reverse netcat connection on the target machine running in the background of course.
  3. Serve your custom liner like Metasploit web-delivery payload with adding some touches to hide any possible output.

Screenshots (Not updated)

Installing and requirements

  • Python 3 and setuptools module.
  • Linux or Unix-based system (Currently tested only on Kali Linux rolling and Ubuntu 16.04).
  • Third-party requirements like msfvenom but only if you are gonna use the msfvenom option, of course.
  • Third-party library ncurses-dev for Ubuntu (Thanks for @mhaskar).
  • Root access.

Installing

  • For Linux :
git clone https://github.com/D4Vinci/PasteJacker.git
sudo python3 -m pip install ./PasteJacker
sudo pastejacker

Updating the framework or the database

  • On Linux while you are outside the directory
cd PasteJacker && git pull && cd ..
sudo python3 -m pip install ./PasteJacker --upgrade

References

Contact

Donation

If this tool has been useful for you, feel free to thank me by buying me a coffee or more ;)

Coffee

Disclaimer

PasteJacker is created to help in penetration testing and it's not responsible for any misuse or illegal purposes.

Copying a code from this tool or using it in another tool is accepted as you mention where you get it from πŸ˜„.

Pull requests are always welcomed :D

More Repositories

1

Cr3dOv3r

Know the dangers of credential reuse attacks.
Python
1,911
star
2

One-Lin3r

Gives you one-liners that aids in penetration testing operations, privilege escalation and more
Python
1,606
star
3

Dr0p1t-Framework

A framework that create an advanced stealthy dropper that bypass most AVs and have a lot of tricks
Python
1,345
star
4

elpscrk

An Intelligent wordlist generator based on user profiling, permutations, and statistics. (Named after the same tool in Mr.Robot series S01E01)
Python
673
star
5

Cuteit

IP obfuscator made to make a malicious ip a bit cuter
Python
530
star
6

PyLoggy

A python keylogger that does more than any other keylogger - Key logger, Clicks logger and Screenshots
Python
402
star
7

PyFlooder

A http flood python script that could stop a normal website in 10s
Python
351
star
8

CWFF

Create your Custom Wordlist For Fuzzing
Python
156
star
9

Clickjacking-Tester

A python script designed to check if the website if vulnerable of clickjacking and create a poc
Python
122
star
10

bugz-tools

A collection of tools I wrote for bug bounty or hacking and don't mind publishing it πŸ˜„
Python
103
star
11

Chrome-Extractor

Python script that will extract all saved passwords from your google chrome database on windows only
Python
61
star
12

AdflyUrlGrabber

A python script designed to grab the original url from an adfly url without opening it :D
Python
57
star
13

Wormy

some python3 functions to add spreading features to any python backdoor
Python
56
star
14

Twitter-Info

A simple python script to grab twitter account info just by username or profile link
Python
47
star
15

Anti_Killer

Kill Any Antivirus Using Python For Windows Users .
Python
44
star
16

Palsy-Virus

Python virus that will make your pc paralyzed once it opened :D
Python
44
star
17

AirCracker

Basic python script for detect airdroid users in lan
Python
43
star
18

ReverseHttp

Python backdoor that uses http post/get requests to communicate
Python
39
star
19

Exif-Grabber

A python tool that will extract exif data from picture with two methods
Python
35
star
20

SSH-Honeypot

Create Basic SSH Honeypot With Python
Python
27
star
21

Paste2Web

A python3 script that uses cl1p website to send and receive secret messages
Python
26
star
22

My-laziness

Random scripts I write to automate non-hacking stuff
Python
21
star
23

Domain-Checker

Python tool to check the HTTP response code for a list of websites
Python
20
star
24

EagleEye

A host-based IDS and network monitoring system (My graduation project)
HTML
19
star
25

WifiPass

Dump the saved wifi passwords for windows using regular expressions and python 3
Python
18
star
26

XOE

Exploit XXE Out-Of-Band Vulnerability Easily
Python
16
star
27

Arr4ng3d_Sh4r3

Share wifi on windows with arranged password like every hour or every day
Python
15
star
28

Humax-CLI

An unofficial Humax IR4000HD terminal client with enhanced features.
Python
10
star
29

Insta-Crawler

A python script designed to generate a random instagram pictures ids and try it
Python
9
star
30

Some-fun-with-CPP

Here you gonna find some of the C++ scripts I created in many fields, someone could benefit from it πŸ˜„
C++
7
star
31

D4Vinci

2
star
32

Scrapling

Lightning-Fast, Adaptive Web Scraping for Python
Python
1
star