Hey, Lou, everybody, welcome to my advanced ethical hacking, networking, penetration testing calls.
You in this, we do, we are going to show you how you can take control of a user's computer while he
of the basic of the security is security.
Is that never click on something that you do just in?
If you click, it's for your problem.
Don't times something might be obfuscated.
I mean, you can hide the takes of a link or something like that so that your victim doesn't have any
clues about your fight or about your link.
OK.
So in this video, we are going to use me desperate, desperate.
Is a very well known framework built in Connealy news.
So that we make the penetration pack so that we can get control or get control of some user's computer
alone or allow us in or vicinities.
OK.
So first thing first, as desperate is already built in culinary news, if you want, you can ablated
it.
It would be better, better, better to try to update your witness framework, because when it is updated,
it would have much more options so that you crack much more teams.
Much more on new stuff.
More and more new.
We know what we need is OK.
Well, key d.c.'s, my Lenovo computer.
So I have a virtual box installed in need.
And then I start my Windows operating system so that I can make the hack.
OK, Nick, take note of the IP address.
It's one nine two dot one six eight dot one one four six.
So I have highlighted for you guys so that we can continue.
And incidentally, you know exactly how it works.
And then when you will get the access, I will again show you the screen, how it looks like and what
we all go doing inside of it.
And we will monitor toid on meter Prader of me desperate.
All right.
So thank you.
So now let's stop.
So to lunch when we just.
OK, we just went to Domino's on calorie news.
OK, we'll use the first one.
We are going to type the console.
The console for me.
This one is me, MSF and I said console and then it was INGROSSO that you launch it if you are going
to use it.
We just bought for the first time.
You have to set up the database on which it will be connected and then you have to start your post quest
cruel by typing service.
Post grade school start.
And then so that you make it work.
But assuming that you already have it on your system so you can if you have it already, you just squeeze
in there and everything will be all right.
So let's wait.
It is started.
Okay.
As you can detect, we have Division five or six, seven as a Cali machine without updating probably
yours or might be version four.
So that's why we will require you to have it in version four.
You will not have these evasion options.
So that's why it's very, very, very, very helpful to update you on with us.
Broadfoot.
All right.
So what we are going to do the Windows machine inside or Linux machine that we have showed you earlier.
We are going to send.
Victim, I mean, the Windows user.
We're going to send him fired or Elaine or whatever.
And then it inside him by clicking on it.
Whether we can type question or no door or no loose movement or shadow or no loose, durable or messy
dribble or macie Gore, or if it's if we know that there are easy, good, we can tie, for example,
for hours and anything so that you can inside the victim of creaking or disease your your job that no
one will tell you.
You have to know the way to first try to use or creaking on your file.
All right.
So now we are here.
So we are going to type through comments, by the way.
We will need the IP address of the victim machine and then we will need the IP address of the attacker
matching deputies of the attacker.
Matching is the IP address of all.
These one and how we can get that.
It's just by typing you've convened and then you present her.
OK.
So now we are here.
So we got already the IP address of the victim.
So now let's start doing the more desperate game of turning this passport is launching.
So what you're going to do.
First thing first, if you will start your own witness group for the first time, you'll have to confront,
as I said earlier, you have to configure PostgreSQL fuel and stuff like that.
All right.
Assuming that you don't have it, I will show the comment.
You should be taking first.
You start immersive consoles before doing and you will have.
You would have to start Postgres career by typing service, post grad school plus grade school, and
then you'd start and then the ingénue was in there.
So I lied.
And then the second comment you have to start the service made us both service.
It does road start and then you press enter again.
Okay.
So now so far, so good.
If you've possible me, sometimes you might get into trouble by having some Iwork.
Okay, so what do do if the if the you said something like failed to start with broad thought sarees
you need me to spell civil service not phone.
If so, do this you ATC slash.
ATCC slash.
You need God D and then slash balls and then you both stab grad school and you click start it and then
you press Indore.
All right.
Very good.
Now see this.
It is the first time you have to set up your Meet Aspro database.
I mean, you have initiated.
Oh, right.
So by doing so, you will have to type MSF database DBI and then you type meet and then you press into.
Wow.
Okay.
The next step is you have to find the IP address of your colleague.
So you type if config just in order to know Deadhorse.
OK, you will need it on it will go to the city as bridge.
This is it.
You will find it here and you click which.
Net, net.
Net.
It will not anything as because you have to connect exactly with your computer because we are working
interview troubles mushi.
All right.
So we can minimize it.
Okay.
So the next step, what we have to do, we have to open a new terminal in time to come in form from
the first one.
So the first comment, the first Kuhlmann, what was the first woman was MSF console.
OK.
Now, if you would, again, the status to see the mood is to see if the middle explode is connected
with product we put at risk.
So what do you have?
What will you have to type?
Then you have to take the baby and underscore status.
And then you press into.
Wow!
Again and again.
Now we can go back to only sprawled shell.
All right.
Here.
Here we are.
Let's go.
Now we are going to to start the dark.
We have to set up a clock.
So you type used with a session.
We have x broad Hoopeston.
So that we get the full name.
And then we need to mutai hinder it.
We take Malti and then enter.
OK, so what you have to do with it.
OK.
Now we are in.
So this doing I can.
We might see it so that we can see clearly very well.
OK.
After every comment, it's not a problem if you type.
Show options, show options.
New York.
Sure, ocean.
OK.
Everything is empty.
So let's continue.
All right, let's do that.
Since we know David victim use the windows.
A Windows operating system.
This is fantastic.
How would you know that, David, you use a windows using Zen lap.
You will get when you Skynet.
You will get the IP address long.
We do a version of the opening system sometimes, but it's not always OK.
Wait.
Sometimes it my true if Windows XP, it's not Windows XP it when it's a Windows seven or Vista.
All right.
But OK.
So for just a preview, you can show you can go back to my previous videos and then you will see how
I end up or how I is in some kind of IP address.
You have to type in lab and then so they come in minus B, minus A or you can type.
Is stuff like that D anything.
Just go back to that.
You can get exactly that or just go to send my lunch is end.
Like that Zen and the new presenter.
So that yesterday it's kind of OK.
So as now it's not all text because we already know that the victim use Windows seven.
Let's start.
Okay.
We have to send the people we type said a payload you can get in.
Okay.
Payload.
We need to sady as a windows fire.
So when Windows Windows Media player Toub.
We do, we do it.
We need it, we reverse discipline, we reverse this, if we will, it will be used in this attack so
that we can send the file to the user.
Oh, we can inside him so that we reach the fire to his system.
This is exactly what we want to do.
OK.
And then reverse, which then we can choose these if you want.
HTP is link.
We can type age HD.
DGP is ok.
OK, htp individually but in alkies we will use VCP.
All right.
And then it was Endor.
OK.
If you want again, you can type.
Sure.
Options.
It's the matter.
Now we have to settle the look.
Also, the attacker muchI how to say did you type said in us?
And Ross, and you type the IP address or feel kindly matching IP address of your Yukari machine.
Do what?
What?
What was it for?
It was one.
One five nine, okay.
We were going to achieve.
Oh, just Scooby and Buzz, just like eat and in bars.
Okay.
So you might see it again.
And John.
You'd be there again?
No, it was no.
We have to send report now.
So we used again this in common in order to get aid, in order to make it alright, said Ford.
Let's make it light.
Well, bye bye.
Quits and do mine.
Now we can show options.
Now we have a.
Don, before typing one oh, you end up, quote, typing, exploit what we have to do.
In sport, there is a very well known tool which comes here.
It is the MSM venom.
We can use it so that we build or fight different.
That file will be a virus that will be sent to the user or to the victim.
And then why clicking on it so that we get the full con trolled, the full access of his system.
All right.
So now, since we know it's already a window species, what are you gonna do?
And I wonder, do we all know it's you?
Basically, first, we'll keep you will die.
You have to type MSF in.
If you type in here, sometimes it's not a problem.
If if your Middlesboro doesn't have it in this system, but here, it will be better ocean.
If we type it, it's eight.
Inside the MSF channel, it's already in in a desperate framework.
All right.
Let's start.
MSF said the known misery minus P C windows, windows.
When those walking in first, if you want to find out which one you want to execute.
You can just type.
Minus minus each.
And then he was under.
Here you have a load of coal mine.
A lot of comments.
We will pick exactly what you want.
Minus B is payload, minus F is for mod, minus E and quarter and minus B, minus B minus.
Better characters.
OK.
So now you type.
MSF admits they've been on minus B when those windows.
Lucky turn.
Of course we, we use the same as we did when we set up all our system inside.
Demi desperate.
Okay.
And then work in progress.
DCP Bursty C B QI localhost.
What was it.
We will just was control shift.
This is the IP of our attacking machine and then we type deport.
Okay.
Nine.
Okay.
And in the 40s what was it.
Four.
Five for me.
Oh fine.
For a kid with minus F, minus F was for.
Which form what we want.
We want X four month.
OK.
Oh bad.
If one body in this case or we choose minus F with X, e, x, e format.
OK, and in my in.
So you know exactly what will be the minus E.
Again guys, don't worry, you just use the same thing in.
You just use the information that you get when you type the head.
It's the encoder phrase minus E.
Minus E 64, x 64.
She cut debt is each.
I gave a way to get the underscore AGP on this score minus minus.
And then.
And you tie.
Do the path.
Well, you want your child to be.
So we would put it on the desktop.
So Dad would do this, though.
We'd open a store and then we take the name of it.
We can make blah, blah, blah, but it's OK.
Not if you choose for Linux.
Bekerman will be MSA Venona minus B Linux slash X 64.
Of course, the mere operator reverse DCB and stuffing stuff in software that when you get into the
minus F in the format, you can choose to fight and fight all.
You can choose a job.
Fine.
And so yeah, I just want you to understand this.
OK, let's see.
So nothing is here and blah blah that x, that X.
So we take this into.
It's already there are guys already there.
So let's wait till the building is proceeding.
You be meeting with it.
We have to start on a budget server so that the Windows user can get it in due system.
We start.
A series of bombs to support.
I'll get started to see if it really started.
You can try to see the status.
It was out of control.
It was a war and knew just a status.
And he was into it.
Should be active.
So under.
All right.
It's a..
So now you can post controversy and stop it.
So now.
What we going to do?
Well, it's me again.
All right.
So we have mistype made the comment we couldn't put Ekwall here and then we take one major player.
OK.
So after typing this comment.
So this is exactly the comment that we have to type.
OK.
And then I request Inter and then you got to get a new a new file.
If you want me to test it for you, I can just go here and get that one.
Oh, blah, blah, blah.
I want.
And then it was under.
So he would get here.
So let's wait for the result.
OK.
Very good.
So define our size it is.
Seventy twe eight or two.
Right.
All right.
So we don't need this.
We can just.
OK.
Oh, you don't need this.
It doesn't matter.
Go.
Wolf.
George.
So we give this one.
OK, now we are going to send this to all the local folks over, and so we will be helping you to know.
Not that you do not see this stop and then move it.
I would love
to go to Beijing.
OK, Sunday.
So we can try to find the city
center this this number one day or so.
Is it isn't there?
OK, good.
Now, d.c.'s, all Windows Machine.
What we're gonna do?
We're going to try to type the IP of the attacker machine slash with the file that we have created,
blah, blah, blah.
We usually have to know the way to make it, which the victim.
So this is your job.
OK.
So now what I'm gonna do, I'm gonna type the IP of the victim.
OK.
It's a really do in type blah.
And then I press enter.
So that I downloaded.
It's used to be.
I will try to.
Control.
Until a.
Would it back in control, see, and blah?
Blah, blah, blah, blah.
Hope you see that X.
X.
And then I was wondering how area then.
Since Eve, when I really click one automatically, only desperate.
We'll get control of it.
Okay, so let's cleek boom.
And then we will see the wave action of omae desperate again.
So let's click it.
Here we are.
Hey, yo, yo, yo, yo, yo, yo.
Now we get in this made a greater share.
We can try by now to to do anything with him.
We can try to lock him off, to shut him down, to change his file, to upload files, to download files
from his system.
Anything you can do here.
Because the one thing is that he's a little bit stupid because he should not click on that link.
It would not want it on his system.
So, yeah, this is exactly what we have said earlier that we are going to show you.
OK.
So in not end, this video yet, we'll, of course, show you what we can do now.
Now, you can try to to view the information of his system by typing some simple he was.
Do you see?
The computer name is he was easy peasy, Windows seven.
She took two.
It's 64.
Interesting.
And it's two guys.
It's really two.
It's due in one week.
What?
We can type more.
We can take much one function.
It can take, for example.
Sure.
Amount.
Could we see how much the gigabyte A.
S on his system was in the.
Look, everything is too you see, everything is too.
I'm telling you.
OK.
So we can even try to enter his territory, right?
Right.
B, C, D, c.
And the newquist it.
It's a shell.
No.
Exactly.
On which there were two, we we are so.
Yeah, but no we can wave listening for is we can try to stay download.
It's this slowing down.
Download.
INTUITY, it's Monday.
OK.
We don't download actually D on ancient war, OK?
This is only oceans that we have so that we can try to download things from this system.
You can even try upload to so that you upload things to a system.
Now we're going to share so that we are surely know on which directory we are in.
And then we can, Daibes c.D, move all of of of where we are in the sea.
It's Charlie Sheen.
All right, we.
All rights reserved.
We are here, guys.
We are you on his desktop computer.
That's amazing.
We can try to find if he has something on his computer.
Okay.
In your.
Viewfinders again.
Nothing is there.
We can try.
He is to go for.
We are going to use Izzy.
Let's go to prison, where we have some fines and download folder.
See
what is a download or downloads.
It's shaky, though not.
Orchids.
You can do at least define.
Uh, Mudo is on its way.
I.
Yes.
OK.
Let's go to up.
You can go to the Dunes Realm's.
Goes on its I'm.
One on them to me was similar to yours.
Let's see.
Well, we can try to make to copy this, to copy a file, and we need them exactly to be acquired.
And then we really it.
Deal.
Do these here.
You fly here or key.
All right.
So we can try to try to try to go back to the sea.
Oh, wait.
Oh, look.
No Yanes in the sea.
We can try.
Do you know what kind of name he's asked you?
Oh my.
And my name is Linda.
Yeah, I chose B.C. to use.
That's nice.
You can check whether that user is in admin.
So if you want to do so, you you type the end user newquist under.
So can something more, for example, change is possible without needing the old bus.
No matter what he's in that mean, even if if he's an administrator or not, you might take the net
user space of need space, a space, of course.
T was easy.
They knew there was a name.
And then you type in anything, relate.
Blah, blah, blah.
As the new password and then press enter ended just to confirm and it will be solved.
Let's, let's make it for you guys.
I can try to do that user
with.
Key exposure plus plus would expose neighbor switch in issue you it would change it this time.
Okay, so now if you want if you want to change it.
If you want to change it, you have to tell the password again, you type Naturalizer.
User, easy to use, easy, easy, easy.
And then password, password.
Anything like me.
The Post and automatically each system has a new password.
Without his knowledge.
That's creative work.
Well, that's me.
Uncredible get.
Now.
Or the victim will not even realize if his password gets changed so we can get a new route by locking
his account so that he could not into his speci.
By doing so.
So you have to go to the system 32 folder.
And then by typing this comment, I'm I'm going to provide.
I'm going to be ready to design out.
OK.
So I don't want to change my password now.
You by accident.
I would forget in the near future.
All right.
So why do you want to do it?
You have to go through that system to hold.
So to do so, you type c.D.
And then windows, the large system, 32.
An inquest into.
OK.
We are there since we are there, but we can take we can type deal to release all of its content.
It's weird, it's weird.
That's a lot.
Come on, sir.
Yes, I look into it.
OK.
It's ending.
We need some files there.
We need a file, which should be what one?
The end of 32 that X.
And then it notified which name is user 32.
Dot the L.
L.
So let's see if we will get them here.
One.
Let's go open it.
OK, let's go.
OK.
We need to fight, okay?
OK, let's let's make it simple for you so that you can remember everything guys will be provided the
resources we need these phyla one one that we do X and then you n you.
This one is one.
If I leave Nev's zone, the user to dot.
BLM does two fives unit guys.
Okay, it's.
Oh.
OK.
Let's check if this one was one oh oh.
Is is.
All.
You can see while.
You.
Oh, you okay?
This one.
This one is still really in the order, one that we need is use it in the US, the you.
It's after 13.
You u.
U.
S.
Use this one.
All right.
So we need those two Fridays.
OK.
So as you can see.
You see the screen.
This is before we press enter.
And now let's go back to all Kylie Mushkin.
We will press enter and then you will see.
You will take this comment.
OK, now, that was under.
Do you design thinking, okay.
I wish you would is screen.
Who is the.
Here is the screen, guys.
Here is the screen.
See automatically.
It gets like it.
That's fantastic.
The same way I could change his password.
And then you could try to into his previous password or his no more password.
According to him, you will never get into his system because his password got changed by me.
Okay, so that's how it works, guys.
Well, so our task is over.
Game over.
But we can try to do some stuff.
Some advice that you can just try to do anything you can view screen or what he's typing, what he's
doing and anything.
It's just it's just a matter of you have to type ahead or to search for some comments so that you do
a task.
It's according to you to or or what we had to show you was about how to get into his system and how
to get access to a system so that we can control everything.
Everything.
Everything okay.
Okay, guys.
So that's it for this video.
We really hope that this video was very informative for you all that we have shown you how to take control
of someone's P.C. according to if they neglect the very basic of the security.
So if they ignore it, you can take advantage of them.
OK.
So that's it.
And that's all for this video, guys.
So we are looking forward to seeing you in the next video.
Thank you for watching.
It wasn't.
Reseat.
It's.