>> Welcome back to the Cyber Kill Chain course.
This is Abdulrahman Alnaim and today,
we will cover exploitation and installation.
Going back to the Cyber Kill Chain,
we started with reconnaissance where we gathered
as much information as we can
about the target of the attack.
Then we decided during reconnaissance that
we will attack a Windows machine.
It seemed like the best way to
deliver this is through social engineering.
We move to Phase two, weaponization.
In weaponization, now that we know
that we are going to attack a Windows machine,
we created the open using MSFvenom.
Then we created another one
to show you how to evade protection
>> tools using Unicorn.
>> Then we move to delivery where we went
through social engineering toolkit and
sending an email using social engineering toolkit.
Now, an exploitation.
The assumption is we're attacking a Windows machine,
the payload that we're going to share or going to
send will be delivered using a human weakness,
human vulnerability, using
a social engineering technique
to exploit that weakness and then
move on to installation.
Today, we're going to cover Phase four and five
because in our example they're kind of integrated.
On exploitation, I like to
call the step that the hacking begun,
a lot of people disagree,
but honestly speaking, when we talk about hacking,
the first thing you think about is exploitation.
It's just something that I like to call,
but it's not really agreed
upon in the cybersecurity industry.
On exploitation, the goal is to exploit
weaknesses and the victim's security.
The idea here or what we're doing here is
we're targeting the weakest link in any security chain,
which is the human weakness.
Human weakness is often triggered,
is often used during attacks.
Social engineering and phishing is one of
the most famous ways to exploit a system.
What we're going to do is we're going to send the link.
Again, we're not going through
the technicality of sending a link that has covered
during delivery and
>> using the social engineering toolkit,
>> one of the documents that are available resources.
However, the assumption as a link is being sent,
an email is being sent,
a link is malicious.
In this link, there's an iframe
that automatically downloads the payload.
That's why I said in our example,
exploitation and installation are working hand in hand.
However, it's not uncommon
>> for hackers to go to Phase five, six,
>> and then go back to Phase five to get some more tools,
>> go back to six, and so on and use
this malware that we installed at
the beginning to install more and more tools.
An example is installing Netcat,
which we're going to do before the end of
the course to extract data out of the victim's machine.
Let's jump right into our example.
As I said, we're going to use
MSF console, which is Metasploit.
Our goal is to utilize the payload
that we did together in
the Phase two video on weaponization.
What going to do is we're going to
create the listener here,
which is exploit multi handler.
Here we're going to create our payload.
We said we're going to use
Windows/interpreter/reverse_tcp or lhost
is 192.168.100.21.
Our port is going to be triple four.
Just to verify, let's show options.
There you go, you have your lhost, your lport,
and our payload and our node.
Let's start the listener.
The listener is now waiting for connectivity.
What we're going to do is we're going
to jump to our Windows machine,
which already has the link,
which is basically hosted on the same machine for
the purpose of the course.
Again, as you saw basically as soon as I hit
"Enter," I got this doing this payload.exe,
obviously, a more successful attack
would be at least not call it payload.
I'm going to run it again for
the purpose to achieve the objective of the example.
Now we go back,
and that's all we want from the victim machine,
the Windows machine, if we go back.
You can see it changed a bit.
Now we have one session open.
Now I successfully exploited and
installed a payload on the victim's side.
Okay, we went through
installation and exploitation in one session,
I know there's a lot of information here.
I tried to make it as simple as possible,
however, to make sure that we covered the whole thing.
What is the difference between
exploitation and installation?
As I said, exploitation,
we're trying to exploit the system to get
beyond the script controls, and installation,
what we're trying to do is to
install malware or a backdoor that would allow us
to communicate with the victim or the machine that
we used during the exploitation
to get inside the victim's network.
Second is true or false an exploitation.
The purpose is to find a vulnerability to exploit.
Actually, this is not really true
because finding the vulnerability and
discovering the vulnerability happens
earlier during reconnaissance,
and in an organization,
we create the tool or the application or
the payload that would exploit that vulnerability.
Finally, why is installation an important step?
As I said from installation,
we'll end the network.
We need to have a successful installation to be able to
move on to the following steps.
In the following two steps,
we're going to use the same tool.
We're going to use the same,
basically the meterpreter session that we have.
Then we're going to run a number of commands on
the victim's machine to make sure
that it is a successful attack.
Today, we covered exploitation and installation.
We run a quote on the victim's machine.
We received a connectivity session
with the attacker's machine.
In the next video,
we will cover command and control. See you then.