All right, so welcome back, everyone.
This is a nation the session is about relaunching the beat.
Let's get started.
OK, so let's go to our candy machine, because that's where the all the magic happens will have to
launch the dominant first.
Let's get access as a route.
Oh, sorry.
That's bad.
All right, wonderful.
So we got the access and now first thing that you need to do is you need to install the beep on your
system.
And to do that, what you have to do is you can straight away make use of a BP package manager and install
the beef right away.
In my case, it's already installed.
So it should be showing me as beef is already with the newest version and I should be good enough with
it.
Another way is you can clone the package from the GitHub site itself so you can go to the GitHub.
Such for beef, that's where you get the dibs.
I mean, basically the you don't get file, you can make use of get blown and get to command and that
file, that package will be installed.
All right.
So this is pretty quick.
Now let's go.
Once you do this, the package will because we are in route a route directly.
So the package is supposed to be in the room itself.
And this is what the package really looks like, the beef.
Now, we have to get into this.
I'm sorry, we have to get into this, but.
In this victory, and you see, once you get this, you have to install and you have to initiate the
installation of it for four installation, too, you need to be initiated.
We have to make use of a script, which is this one installed script.
You can do this by this.
And the moment you do that will be getting started now, because in my case, it's already done.
It just it's just auto it just get auto completed.
You don't have to do anything with it because in my case I have already completed I can do no.
And Gummow.
Now, once the installation is complete, you have to launch the dashboard.
Right.
But beef won't allow you to access it.
So let me show you.
I have once it is done, I have to be in the same directory.
And if I show you in the same direction, it said we made use of install in order to launch, we have
to made you make use of beef as well.
So I make use of dogs.
Beef that again a script.
Once I hit that hit Enter the beef will be initiated, will be launched as well.
Now if it, if it's the first time you are doing this, you would be getting an error saying that change
the default password.
I mean, if you don't do that, the beef won't be initiated.
How how can you change the password then?
What you can do is you can go to the config script.
This is the file where all the settings are really the sites.
So you can do Nanoha and can fake one script.
And once you go and do it, this is where the credentials are defined.
Usually does bbf.
I have Gene to Roger, Roger, you can come out and that's easy.
That's what it is.
Once you do that then you can again go make use of that dart slash beef and beef will be initiated by
the beef tool, will take some time to load the package and then only it will get started with it.
All right.
Oh, we have some error here.
Look at this.
This might might occur and many of the situation and not just in case of beef, many other cases as
well.
So it seems like there is some process running or I might have tried earlier as well because of that.
There is still some those same same process or some services running on the same border.
So what you can do is you can search for what exactly the process item.
OK, if there is any duplicate process already on the same board, I haven't really done so.
We have to kill the process.
So how how we identify which process already has a trouble.
So to be very honest, you won't find, you know, regularly this problem.
You'll find it when you make use of it very often.
OK, so what you can do is you can simply go to and get the idea about what is the what is the number
to it so you can make Gewgaws of l'Est Hellersdorf and then make use of minus T minus and you can define
which is the process identifier.
In our case we have a trouble with three thousand so we can mention about three thousand board number.
This will give us this will give us the process idea of three thousand four.
Oh we have some chop.
OK, sorry I it has to be minus I to wonderful.
So this is the process.
Once you get the process already we have to tell this process.
OK, so once we cleared Gilda's we can initiate decision.
So in order to do this we can make use of command kill and then the minus nine.
That's the idea for killing the process idea and then define what is the process.
Say no to the string to fight them once you hit, enter.
Now, this process already has been carried.
And now one, you can try making use of the beef command again.
And it worked this time.
Let's beef is loading.
Wait for wait a few seconds.
Lovely.
It worked all right.
Huh.
So now you can see beef is giving some information about it, right.
There are three zero five modules.
April eight Xingjian enable events proxy admin UI.
This is what we are looking for, to control everything from farm control, everything about the user
activity or post exploitation activity and everything.
So we need to have the admin UI.
There are some social engineering packages as well.
Crosseyed scripting RES.
Many of the staff, there's one more thing which is needed, the malicious script.
We need to have the script that we can, you know, that we can make use of it and give it to the victim
machine.
If you remember the example, we made an email right now, phishing e-mail, which was getting the JavaScript
code into it.
Now, this is something that we we will be building, building up beef tool.
And this is what it is.
It is basically the hook you are.
So this is what we'll be hooking to the user.
It will be injecting this JavaScript to the user.
And this is the dashboard we need to get access to.
Right.
So unless you don't change the password, if you remember, you won't be getting the access to the UI
at CDB.
It's not actually as yet.
And then you define, oh, in this is because we are on the local system itself.
You can make yourself one twenty seven zero zero zero one zero zero one and three thousand port.
And then we have UI and UI directly.
And then panel, let's say you can make use of the same password.
Lovely.
You could see, you could see the dashboard is open and it is full of information.
You can see the logs, zombies and everything.
Right.
These are some of the offline devices, devices which are no longer associated.
Once you have the JavaScript code being used, you could see all the devices online, you know, made
use of them.
So this is the malicious script.
If somebody click on this link, they get compromised that I'll show you how exactly.
So even if somebody tried to click on this link directly, I should be getting their access right.
Let me go back and let me open up the machine.
This is not the real attack at this point because we'll have to make it more realistic.
I'm just giving you an example.
So even if somebody tried to, let's say, access the stability of CTP
and because this this is the we have to make use of the network IP address in this case, then the reason
is this has to be network discovery.
If somebody is trying to access the any site being in the global system, the local host are 147 zero
zero one.
That would be helpful if somebody access from this another host the real IP address, the network IP
address is needed and that's the real network IP address you can see over here.
And then we can define hope dog G.S..
Right.
Once you hit enter.
And this would probably be, you know, this would probably be injected into the system.
And this is the way the system, you know, the actors JavaScript get inserted into the platform itself.
And if you could see.
Although it says there's an error and time, error and everything, this is what we'll be inserting
into the real system itself.
OK, so what we made use of is this this who dodgiest file.
And once we tried doing it directly on the browser, it didn't work.
You see this?
Do you want to save this file?
Because this is considering as a file in that case.
So that's why I will be making use of it on a site.
That's why we need a vulnerable site to be accessed.
Because if you see if the user is directly getting the JavaScript file and putting on the URL, it's
not really going to work because this would be taken as a file.
What is really needed, if you remember the example, we need the real well, vulnerable site which
takes the data and give you as it is, throw it as it is, reflected Asmodeus.
That's why I will be making use of DV DPW.
In our case, there will be there will be throwing the same JavaScript code to the Web site, to our
vulnerable site so that it will reflect back to the machine and that's how the system get compromised.
So I hope you got the idea that this is not the way we'll be inserting the code directly into the browser.
You got the idea.
And this is not the way will be directly inserting into the browser, rather, will be inserting on
on to the infected site by the machine directly and will see what the response comes back.
All right.
So let's get started with our lab in the next session and really capture this and think you.