Instructor: Hello again and welcome
to the exploitation section of the course.
It is time we learn how to gain access to our target.
What we managed to do for now is with the help
of our Kali Linux machine,
we managed to identify our target
and find out a lot of information about it.
Remember, once we were starting
we didn't know anything about it,
but after, with the help of different tools such as Nmap,
Nessus, WhatWeb and others,
we managed to gather enough information
about our target to be able to exploit it.
We have discovered open and closed ports.
We also discovered services running on those ports,
including their versions.
We found out what operating system was our target running.
And we have also tried finding vulnerabilities
to see whether the target has some known issues or bugs.
In other words, we performed information gathering,
scanning, and vulnerability analysis.
Right now, the next step is to use that information we have
to gain access to our target.
Here is how the process goes.
Imagine this is our target
and these are the information that we gathered for it.
It is running Windows 10.
We found out it has an older version of Windows 10
that hasn't been updated lately.
We found three open ports and one filtered port,
and we know for sure that one of those open ports
has a vulnerable software running on it
since we also performed vulnerability analysis.
Once we found out this information,
the next step is to extract useful information from this.
So in this case, what we would find most interesting
would be these two facts,
an outdated Windows 10 operating system
and a vulnerable software on port 1234.
This is what we will use to attack the target.
We would then exploit the target's vulnerability
and gain access to it.
But wait, wait, wait a second.
What do I mean we would exploit the target?
How do we do it exactly?
And what does exploit target even mean?
Well, exploiting the target in other words
is using its vulnerability that we discovered
to send something called payload.
What a payload is is a program that we deliver to the target
after the exploit.
Usually this program is something that allows us
to execute commands on target system
and navigate through its files and folders.
Now I know what you're thinking,
it is still a little unclear to you
as to how this works exactly.
Don't worry.
In the next two videos we'll explain in details
what exactly happens once we exploit a vulnerability
and what type of payloads exist,
and which ones we will use the most.
For now it is important to remember
that payload is a program that we drop
after exploiting a target.
And in 99.9% of cases this will be a program
that allows us to execute commands on target system
or also known as a shell.
The first step would be us exporting the target
and sending shell or payload with it.
That payload will then be on target's machine
and it'll execute.
Once it executes what it essentially does
is it tells the target machine,
"Connect to that other machine
and allow it to execute commands on your system."
And that other machine would be our Kali Linux.
And the third step is pretty easy.
We just send the commands
that we want our target to execute.
We navigate through files,
run other programs,
and in return target sends us an output of the command
that we executed.
Picture it like using target's Terminal
from our Kali Linux machine.
However, there is one problem with this.
Imagine we have two different targets.
Target A and target B.
And let's say target A has unknown vulnerability.
It is running some outdated software
on port 5555 for example.
And in that case we would do what we just explained
which is exploit the target through the vulnerability
and deliver the payload that will allow us
to control that target machine.
Well, this scenario would only work
if the target has a vulnerability,
but what if it doesn't have a vulnerability?
What if all of its softwares are fully updated and secured?
What then?
In that case, we would do something similar.
We would deliver the payload to the target,
just this time we cannot do it through an exploit
which also means we can't make the payload
out to execute on the target,
since once again there is no exploit that we can do.
We must deliver the payload to target using different way
and also we must make it execute a different way.
Well, in this case, social engineering comes in play.
We would try to trick the user to open our payload
by themselves.
They must run it for us.
How would we do that?
Well, we could use different methods
of delivering the payload.
We could, for example, use an email containing our payload
that we perhaps masked to look like an image
or a different file type.
We would also make sure that email looks legit
and target doesn't think twice
before trying to open that image.
We could spoof our email address so it looks like someone
that our target knows,
so they would never think that the image we send
could contain something malicious.
Once they open that image
in the background our payload executes,
and it grants us access to their machine
without them even knowing it.
This is just an example.
There are multiple ways that we can do this.
If you were, for example, physically close to the target
you could infect it over USB drive.
Plug the USB drive in the target machine
and execute payload manually.
But something like this you will almost never do
due to a higher risk of course,
and if you were even able to come close
to the target machine.
Nonetheless, these are the two different possibilities.
Either target is vulnerable or it isn't.
However, if it isn't, we don't just quit.
We try different methods.
Throughout this section we will cover another big tool
that all hackers use and that tool
is called Metasploit Framework.
It contains thousands of exploits
and all of them are already in our Kali Linux machine.
All we need to do is learn how to use them
and how to run them.
This is something we'll cover shortly in great details.
Let's start hacking.