‫Another way to compromise the target systems is to send the malware as a browser add on, you can use
‫Metasploit Framework to prepare malicious Firefox add ons and serve them from a server.
‫Select the exploit and the payload, then set the options when you run the exploit.
‫It starts a handler as well as an application server to release the add on as soon as the victim allows
‫you to install the add on.
‫You'll have a session of his or her system.
‫Let's see how to prepare and use malicious Firefox add ons in Cali.
‫Start the Metasploit Framework using MSFT Console Command in the terminal screen.
‫If you do not necessarily know the exact name of an exploit, you can use search command to find it.
‫Use the exploit with the use command.
‫List the payloads that you can use with this exploit, show payloads.
‫Let's select a shell payload with the reverse TCP connection.
‫Now, look at the options of exploit and payload using the show options command.
‫Server host is the server where an application server will be started to serve the add on in this example,
‫it's our machine.
‫Server Port is the port that the Web application is served.
‫You can choose 80, which is the default port of the HTTP protocol.
‫Uri path is the path of the payload.
‫Now set the options of the payload listener host again are calling machine is in this example.
‫Listen to Porges, 44, 44 by default.
‫Change it if you want.
‫Now we are ready to run the exploit when you run the exploit, a reverse TCP handler on Port 44 44 and
‫an application server serves on Port 80 80 is started.
‫Let's test if the application is alive.
‫Copy the URL.
‫And pasted in the address bar of the browser.
‫It seems everything is OK.
‫In Windows system, which is the system of the victim run the Firefox.
‫This is the Firefox version 57.
‫Now we're going to send a phishing email, which contains a link to the add on we prepared in this example,
‫I use the Yop Malcolm's servers to send the phishing emails to the victim.
‫Hotmail is the disposable email address service, which does not require a sign up and provides access
‫to any email address in the form of any name you want at your gmail.com.
‫In the attacker system, Cowley, prepare the phishing email and send it to the victim.
‫The victim opens the email in his or her Firefox browser, which is the latest version.
‫When the victim clicks the link, a warning message which says Firefox prevented this site from asking
‫you to install software on your system appears.
‫If you click the install link directly in the website, nothing changes.
‫You're not allowed to install the add on, starting from version 41.
‫Mozilla decided to allow plug ins only if they're signed and verified by Mozilla.
‫But don't worry, you'll probably find systems that use Firefox older than version forty one.
‫Let's repeat our test with an older version of Firefox.
‫Download an earlier portable version of Firefox.
‫I chose version 46 for this example.
‫Install it and run.
‫You are now using Firefox version 36.
‫Go to the mail service of the victim.
‫When you click the link, Firefox again prevents the site to ask to install software.
‫In this time, though, clicking the Allow button brings you to the software installation window, click
‫the Install Now button.
‫You see the message that the installation is successful.
‫Go to the listener now, which is our Kelly machine.
‫Looking at the listener terminal windows, you see that a session on the victim's computer is open.
‫Go to the session using Session Dash Session ID common now because we used a shell payload.
‫We have a shell session at this time, not a mature operator session, and we can use all the commands
‫of the victim's computer since it's a Windows system.
‫We can use Windows commands right now directory to list the files of the current folder.
‫Who am I to see the active user?
‫IPconfig to see the IP addresses, etc..