Welcome to Part 10 of this module the subject for this video is going to be client side exploitation
using the beef framework.
Beef is short for the Browser Exploitation framework.
Simply put it is a penetration testing tool that focuses on the web browser.
At this point you may be wondering what this tool is doing in the module covering met a split.
Well to begin with I had to put it somewhere and it is often used in conjunction with met a split as
we'll see a bit later.
So what does client side exploitation actually mean.
Simply put it is the process of attacking a client more specifically the operating system and the programs
that are installed on the target computer.
The main objective is to find exploits that run on the client's operating system and exploit them.
So in that way it's very much like met exploited and we're going to start off by looking at how to use
beef to exploit browser based vulnerabilities.
And once we have a firm grasp of what beef is and the basics of how it works then we're going to transition
and look into how it is used in conjunction with the menace plate framework.
So beef is a tool that is like I said very similar to met a split right off the bat in that we use it
to find vulnerabilities in browsers.
Our goal is to hook these browsers using exploits much in the same way that we use MSF console to attack
the operating system and its apps directly.
It allows for the performance of phishing attacks and it runs on a web interface.
This means that to make it work against a target during a penetration test some degree of social engineering
on your part is going to be needed even if it is only to entice the target to click a malicious link.
Before we begin it is important to go over a couple of basic prerequisites.
I realize this will seem repetitive to those of you who have been following along with these videos
in order but it is important.
So I'll try to get through this quickly okay.
First of all we're going to be running this on a client.
There will be no met a split able to this time.
Instead our target is going to be a Windows 7 Service Pack 1 virtual machine which you may remember
from the prior video was Bob's computer.
Bob being our our fictional target that we're going to be using these exploits against as we walk through
the social engineering aspect of beef.
If you want to follow along with this video a virgin installation of Windows 7 without any updates running
in a second virtual box instance should work just fine.
The browser that we will be attempting to hook and then exploit is going to be a Mozilla Firefox and
I should hasten to add that you can use beef against pretty much any operating system that runs a modern
browser.
Windows 7 is just for the purposes of easy demonstration.
Now obviously the more updated an operating system is the fewer exploits will be available for it but
just like met a spoilt new exploits are being found and added almost daily.
Last but not least it is important to remember that we will be performing these steps against a computer
that is on our own local area network.
If you want to use beef against a target over the Internet that you have written permission to penetration
test please see the prior video on port forwarding.
Once you've set that up you just need to use your public IP address in place of your network IP.
All right so let's get started now there are multiple ways that we can load the beef framework.
If you're still using the defaults that came with your Cali Linux installation you'll probably see beef
right here on the dock in the form of this cow icon beef cross site scripting framework which is what
ex SS denotes.
Now we could just click on that or we could go up to applications exploitation tools and we'll find
beef right under Armitage.
So we're gonna go ahead and launch beef and it's going to take a few seconds to load and as part of
the process.
It's going to open up the browser window which in this case is going to be Firefox.
Unless you've specifically changed your default browser for Calleigh I have to point out that sometimes
particularly on older machines you may get a tab saying that you were unable to connect as I think we'll
see here in just a moment.
Yeah.
Here we go.
If this happens just click the Refresh button and try again.
And after one or two tries you should see the beef log in screen.
Now I'm sorry to say that I don't quite know why this is an issue on some systems but it seems like
in some cases the framework is slower to load than the browser that is trying to connect to the framework
prior to it loading.
Now faster computers shouldn't encounter this issue but in virtual box it tends to be more likely incidentally
the user name and password combination for the authentication screen is going to be beef for both fields.
But don't worry about that just yet before we actually dive in I want to take a moment to show you how
to load beef from the terminal because it's a little different than other Kali tools.
And if you're running beef on a virtual private server or something of that nature this information
is going to be important.
So to do this we just type City Forward slash user flow forward slash share forward slash beef dash
ex SS then list the files and then we can see that there is the beef executable listed in green.
It's actually a script so we would do period forward slash beef and that would launch it from the terminal
window.
Now this is going to be important later on.
So there there is a reason why I'm showing this now but we've already got it loaded so let's go ahead
and get started.
Now it's going to display some information here that is very important.
As mentioned at the start of this video beef is used to hook a browser but what does that mean exactly.
The hooking process is essentially getting the target to click a link containing the hook JavaScript
file.
The path to which you can see in the highlighted text this file can be edited as we'll see in a moment.
Once the target does click this link it will tie their browser back to the beef server.
In other words the target clicks a bad link containing the Java hook at which point their browser is
hooked and tied back to the beef server which is going to be running on our Cowling installation for
this demonstration.
The first piece of information presented to us is the UI panel U.R.L..
This is what opens up the browser.
When we initially launched beef this is going to be the the local IP and it's going to be 127 0 0 0
0 1 and port 3000.
So if we go back to our browser we can see that the U.R.L. for the authentication Page is the same.
Next I want to call your attention to the hook line for the hook.
We have a U.R.L. leading to a javascript file.
This is the important part.
It is a java file that you would include in a web page.
The target clicks the link visits the page triggers the script and then they're hooked.
It is at this point that you have to decide how you want to run this.
Now for this tutorial we will be using an Apache server from within Cali Linux to host the files for
our fishing link in the real world.
This is probably a very bad idea for quite a few reasons.
Now you could for instance setup a virtual private server anonymously as has been spoken off before
and will go over that again in more detail later in this class.
A free and disposable service might even work for something this simple or possibly a small Raspberry
Pi or something of that sort out in the world that is setup to act as a server.
There are a lot of possibilities and I leave it to you to decide how you want to actually implement
this for your own penetration tests but again for demonstration purposes and to keep things as simple
as possible we'll be doing all of this from within Cali so just keep in mind that if you decide this
method is the one you prefer it won't be very anonymous and you will need to set up port forwarding
for any non-local clients.
So now we're going to go ahead and copy this hook line.
Actually we don't need hook.
We just need the line itself.
So we'll highlight it.
Copy and now we'll need to grab our local IP address with IMF config.
Mine is going to be tender 0 0 about 7 and yours will almost certainly vary and then we need to start
the Apache service.
This is very important.
If you don't do this.
Nothing else shown in this tutorial is going to work.
So don't forget we're going to do service.
Apache to start simple as that.
Now with the web server started we need to edit the web page file that is stored on our web server and
that can be found by going to your file explorer.
Clicking other locations
computer
for
WW W and then we open up the HD Hamel folder.
Now here is the default web page that is used with Apache.
Now you could use this but it's really not suitable for our purposes because it gives the game away
of what we're trying to do.
So if you want to keep these go ahead and backup these two files somewhere else if you don't care or
once that's done we're gonna go ahead and we're going to delete this second one.
We're going to keep index HMO and we're going to go ahead we're going to right click on index HCM mountain
we're going to select open with other application and we're going to be selecting leaf pad.
And if you don't see leaf pad here is an option just click view all applications and it should come
up in the list of available programs.
Now as I said this web page that comes as a default is really not particularly good for what we're trying
to do.
So we're gonna go ahead and we're going to delete all of this and then I'm gonna say brackets
Doc type each team now close bracket.
You can follow along if you wish.
Or you can create your own small website.
I'll try to do this quickly.
You'll say the title for a for her.
This is again just for demonstration purposes
and we'll give it a body and we're gonna say the server you are trying to reach is currently down for
maintenance.
And then
pardon all these keystrokes and then please try again later.
And also please excuse my typing.
All right so this is an extremely simple Web page and really all it is is we're gonna click file save.
And now when someone navigates to this page they're going to be presented with what looks like a forum
for error telling them that the server they're trying to reach is currently down for maintenance and
we'll ask them to please try again later.
Now the idea here is that we're going to send Bob an email telling him that his great uncles cousins
six times removed has just died and Bob is now the heir to a sizable fortune despite having just fallen
for this trick in the prior video.
Bob is very gullible.
So he's going to click this link and this is essentially the web page that he's going to be presented
with.
He's going to assume that it's down for maintenance and that he needs to check back later so he'll go
about his business and he'll never realize that he's been hooked.
And that's the idea anyway.
But if we want this to be successful we need to include our javascript which is to be placed between
the opening and closing tags so we're just going to click on this empty line here and we're going to
paste
and it's nicer when it lines up with the title.
OK.
Now this is very important.
Don't make the mistake I did.
I had a heck of a time with this.
It's easy to miss.
Notice that the line it gives you presents the IP address between these two brackets and these two brackets
are not supposed to be there.
It's easy to miss.
So we're just going to delete those two brackets and we're going to supply our network IP which in my
case is that yours will vary.
Now if you were doing this over the Internet with port forwarding enabled you would supply your public
IP here and it's going to be port 3000 unless you specify otherwise.
You may also want to specify a particular web U.R.L. but that would be more advanced.
So once this is done we're going to click save.
And now we're going to go over to beef and we're going to log in.
Remember that the user name is beef all lowercase and the password is the same once inside you'll be
presented with this default interface hooked browsers will appear on the left hand panel in either an
online or offline state.
There is a getting started guide of course and a tab for all logs.
Now I might be getting a little ahead of myself here but before we go any further I want to quickly
explain this traffic light system.
Basically once we've hooked a browser and start looking over the exploits that can be used against it
you'll notice that they all have colored circles next to them yellow circles mean that the exploit or
module as it were will function against the target in a way that is theoretically invisible to the target
user.
In other words Bob won't know anything is happening when we launch the exploit against him.
He won't see anything on his screen that is out of the ordinary or that might give the game away.
Now orange on the other hand means that the exploit is available against that particular target.
But some things that you do may end up being visible on the user's screen or might otherwise tip off
the user.
The only thing I can really say here is that I recommend you practice on your own with these sorts of
exploits so that you know what you're doing and you know what they do.
And that way you won't make little mistakes that will tip off the target user.
You need to be cautious when using them but they can't get the job done.
Now Gray at least I think that color is gray.
Maybe it's more white.
In any case means that the module is yet to be verified against the target.
It might work it might not.
You should always treat any gray module as also being orange.
Your actions while using it may or may not be visible to the target user assuming that it works at all.
And of course red means that the module isn't going to work against the target depending on how up to
date your target is.
You may see a lot of potential exploits coming up in red.
So here we are in a Windows 7 virtual environment like I said this is just standard windows professional
service pack 1 installed with the latest version of Firefox no updates no bells and whistles nothing
fancy.
And we're going to go ahead and we're going to load up Firefox and this would work with pretty much
any browser.
By the way.
So it's time to hook our first browser.
Let's pretend that this Windows 7 computer belongs to Bob.
We just sent Bob a link that he's going to click on.
Now maybe we did this by email once again pretending that he just inherited millions of dollars.
Or maybe we tricked him in some other kind of a way.
The point is this link is going to open up the web browser and cause the browser to connect to our bogus
Web site which we're running on Apache to back on our Kelly Linux machine.
When that happens beef is going to hook the browser and then we can go ahead and exploit it.
So to simulate this we're just going to go ahead and we're going to type in the U.R.L. so in this fictional
scenario Bob just clicked on the link and reached this page telling him that the Web site is currently
down.
Bob is disappointed but will go about his business and try again later.
Now we could have been more complex here if we wanted to be.
For example we could code up an entire functional Web site including the javascript hook code and then
host it somewhere out there on the Internet.
Unethical black hat types may even download an existing web site just lock stock and barrel and then
host the copy including the bad JavaScript file the hook to fool people who visit it like Bob and hook
their browsers particularly unethical black hat types might even hack into an existing web site and
add the hook and then just otherwise leave it untouched.
Turning the Web site into a trap for browsers that come to visit it.
The point is this demonstration just has our victim looking at a forum for error.
But you can get as creative as your skills and resources allow.
Just remember to be ethical and lawful.
Let's go ahead and flip back over to Kelly.
Here we can see that we've successfully hooked Bob's browser.
We click on it.
We can get all sorts of useful information all of which is visible under the details tab browser version
browser to language browser platform the window size the browser components for example is it running
Adobe Flash.
No which means that Adobe Flash exploits aren't going to work against it.
We keep going down the second category tells us about the web page we used as a hook.
And finally some other useful details such as screen size and whether or not the device is a touch screen
which will affect some of our exploits.
Now it's time to look at the exploitation side of things.
Keep in mind that every browser whether it be Firefox or Internet Explorer or Google Chrome is going
to have different vulnerabilities depending on its version.
Some exploits will have been patched.
Others may come to exist in the future.
Beef can be very powerful if you find a vulnerability that works.
It's just not a guarantee.
So we click commands because that is where all the modules are stored.
And just like met a split.
It's all nicely organized for us into folders.
Let's look at a couple of things under browser.
Now remember the traffic light symbol that I explained before and keep it in mind because some of the
actions that you perform may be visible toward target user Bob.
Notice that some of these have the green light whereas others have the gray or white depending on your
interpretation.
And if we scroll down we should see orange and red.
There are a lot of things that we could do here.
For example we could play a sound on the target computer but we would need to specify a file path for
it.
Remember this one for when you're done with your penetration test.
We could activate the target's webcam although this does not happen automatically now because this exploit
uses Adobe Flash and we know that Bob doesn't have it installed.
This isn't really going to work but I'm going to execute it anyway to give you an idea of what this
looks like from Bob's end.
So if we click execute we can see that the command was sent and now we're going to bounce over to the
windows 7 machine and we can see that Bob has received this message.
This Web site is using Adobe Flash in order to work with the programming framework.
This Web site is using you need to allow the Flash player settings if you are new to Ajax and each email
5 features in conjunction with Adobe Flash Player.
It will increase your user experience.
Basically this is trying to trick bob into enabling flash.
He doesn't have it installed so it's not really going to work but with some users this might work and
we could change this text here.
For example we come over here we could change the title to please install Adobe Flash and we could change
the text to anything we want
this Web site requires the latest version of Adobe
Flash Player.
Please download from this completely evil link to our Trojan horse and then we execute it.
Command sent and we can see that the new message has been displayed for Bob.
So now hopefully Bob falls for this and then we provided a link we didn't really but we could have two
a web page with a version of Adobe Flash that is Trojan sized by us.
So this is an example of one way you can socially engineer a target.
Okay so that was one example.
Now let's try one of these gray ones detective DLC we'll see if Bob's computer is running VRC that will
tell us if we can use relevant exploits.
It's gray so we don't know if Bob will see anything or not for sure we execute bounce back over to Windows.
Bob saw nothing click on command to and we can see that we'll see equals no.
So the ELC player is not currently installed.
Now let's go ahead and detect Windows Media Player.
This one is green so we know it should be invisible command sent clip command Windows Media Player was
not detected which is unusual because this is a new version of Windows so it should be there.
But maybe it's just because it's not been setup yet.
And once again Bob saw nothing.
Now let's try get visited you are ls.
This can be a useful one.
Here we just type in a particular U.R.L. for example WW w DOD Facebook dot com and execute.
This might be very useful if your goal was to obtain Bob's Facebook credentials and then attempt to
take over his browser to sidestep two factor authentication.
We can see that the answer has come back false.
Again this is a newly installed version of Windows so perhaps I should visit Facebook but you get the
idea.
But the last thing to say about this first category under browser it's worth using a few of these modules
first such as detect toolbars detect a media player and so on to gather information about the target
before we attempt to use any exploits detect pop up blocker is a particularly good one because pop up
blockers will screw up quite a few of the social engineering exploits that rely you to supply some sort
of flavor text to trick the target into doing something similar to what we just saw with the Adobe Flash
Player.
So now we're going to go into hooked domain.
And here we can see even more exploits.
Most of them with the green traffic light.
We can try to get a session cookie grab a page and an eye frame redirect to the browser replace videos
that last one will do what is called a Rick Roll by default.
If you aren't old enough to know what that is.
By all means Google it and scroll down a bit.
Session stores and cookies are useful for obvious reasons of course and they may contain log in information.
Let's now turn our attention to exploits exploits are mostly concerned with taking over systems home
routers and the like active x.
So if the user has active X installed we can attempt to exploit that cameras on the local network rather
than the webcam on the computer.
In other words for example CCTV cameras and that sort of thing hosts again has more intelligence gathering
trying to grab a physical location or a geo location trying to get the Internet IP of the computer and
what IP ranges to potentially attack for other computers on its network.
OK you get the idea now.
One thing that needs to be pointed out is that if the user who is still Bob in this case browses away
from the hooking web page like so and then we refresh.
Notice that Bob's browser has gone from online to offline.
This means that it is no longer hooked so if we go back we can see that we have re hooked the browser
once again.
So the point here is you need to keep your target on the web page for a while.
And this really is the fundamental art and Achilles heel of beef.
That is why to get the most out of this framework you were really going to have to present some kind
of a fake page that holds the user's attention long enough for you to do whatever it is you plan to
do.
There is an alternative to that however we can attempt to redirect the target browser somewhere else
while keeping it hooked into beef.
That will eliminate the problem of pub browsing away but it's not necessarily easy to pull off.
So once again we're going to go into Command's browser hooked domain and we're going to go down to redirect
browser parentheses ie frame now to do this.
We're going to need to give the module our IP address where you are L whichever one we are using.
So in my case it's 10 0 0 0 at 7 port three thousand and we're gonna need to give it a web page to redirect
to.
Now I recommend that you test this in advance.
Some pages will detect ie frames and block the redirect which is really a pain.
I noticed that CNN dot com does that but BBC does not.
So I'm going to use BBC for this example
and now we'll click execute.
And as you can see we're now at BBC dot com.
Although the U.R.L. remains the same in this case we're using something called an eye frame to show
BBC dot com while still giving the attacker access to the system.
Now the victim can click any of the links presented on the site.
However the U.R.L. is going to remain the same and the browser will remain hooked.
This affords a penetration tester a little extra time to quickly use whatever information gathering
modules are necessary and then perform the attacks typically.
All of this is scripted though hackers who use beef generally as I said buy a virtual private server
or something of that nature anonymously set up a bad Web page hook browsers and then visit them with
the hooks go to the server and an automated script plays out for each one.
That is why a lot of these bad redirect sites on the Internet exist.
There isn't necessarily a hacker sitting behind a desk personally redirecting the traffic although sometimes
there is.
You have to be careful.
The rest of the time it just has to do with advertising.
In any case as an attacker you can still run any of the modules against the target so long as the browser
remains hooked.
It's also not a bad idea to see if the target is running on a virtual machine or not.
So will click execute and we can see that it is one reason we might want to do that first is that if
an antivirus company were visiting our Web site to test for malicious code we might want to make sure
beef does not run any attacks against virtual machines.
We can see that it is one reason this would be important.
Is that a malicious Web site owner might wish to script beef to check for a virtual environment as the
very first thing it does out of the gate and then not execute any sort of exploits or script against
a target that is operating in a virtual environment.
The reason is that antivirus companies typically test Web sites that they suspect from within the safety
of a virtual box.
We can also get things like geo location and physical location as well as wireless keys but these will
not work against virtualize environment.
In fact a lot of these won't work against a VM anyway.
So checking to see if you're up against one is generally a good first step.
Now there are a couple of other things that we can do so far.
We've taken over the browser and redirected the user to what looks like a normal web page so they can
threaten the user can browse around.
Now imagine that we sent Bob a link to Facebook and he clicked it leaving his mail up the whole time.
We could be attacking the system for the duration under the social engineering category we have another
good example fake flash update is going to try to trick the user into downloading a file that we want
the user to install.
We have to give it our IP and then specify the U.R.L. for the file.
For this example I'm going to leave it alone.
Then we click execute send the command.
Now if we bounce over to Windows 7 we can see that we're being presented or rather Bob is being presented
with the beef master zip which is really not a file you should download.
Of course this is just a demonstration we would replace this with whatever our Trojan horse was.
So if we presented Bob with one of the previous exploits and indicated that he needs to update his flash
media player and then immediately present him with a fake flash update he's quite likely to save the
file and open it.
And of course it probably will be a real flash update but it will contain malicious code which will
further infect the system et cetera et cetera.
So that's another approach that you can take.
Let's take a look at another one Google phishing.
Once again we just give it the attackers IP which is to say our IP address.
Port three thousand execute.
Lo and behold Bob got seamlessly redirected to what appears to be a Google email log in.
This is of course fake but if we put in the user name we don't know let's say test and the password
test.
ABC and then click sign in now it tells us to enter our email or phone.
But notice that we are now at the real Google dot com.
Now if we switch back and check.
Notice that the username and password are displayed test and test.
ABC in clear text and the same technique works against any Web site.
So Facebook other emails banks whatever the target in this case it's still Bob enters his credentials
into a fake site and is then redirected to the real one.
Will you as the attacker get to see that information in plain text.
The only downside of this is that you will lose your hook as the victim is ultimately redirected to
a real web page and the eye frame is lost.
And remember that all this can be scripted which can allow hackers to gather a lot of credentials just
through one Web site.
So I've gone ahead and re hooked our target and now let's take a look at pretty theft.
We can see that we have options for a fake Facebook Linked In windows YouTube Yammer ie OS or just a
generic page that we could customize.
If we do Facebook for example and supply our IP or U.R.L. and we click execute we can see that Bob is
now being presented with a Facebook session timeout.
And this is something that can actually happen on certain sites that connect to Facebook such as for
example a news site.
So depending on where you redirected Bob this might actually have some degree of credibility.
So let's go ahead and enter email at email dot com.
And for the password we will do test.
ABC
and now if we come back over to Kelly
we can see that that information was harvested in plain text.
But so what if we try to log in Facebook will notice that this isn't the computer that Bob usually logs
in from.
And it's going to demand that we get a text message on Bob's phone with a verification code or whatever
other method.
And of course we can't really do that.
And then Bob is going to get prompted by the service and it's going to say hey someone unknown just
tried to log into your account was this you and you should really change your password by the way.
So then our goal would be to take over bomb's browser remotely.
So if we right click
we can see a use as proxy option so that anything we do on our own browser will be routed through his
as a middleman.
In other words it will appear to Facebook as though our target is accessing the service from their own
computer even though it's really us going through that machine using our own browser.
And this technique if successfully achieved will sidestep most forms of two factor authentication because
the social media or the banking side or whatever isn't going to notice that anything is amiss.
So no alarms will be set off at least in theory.
This doesn't always work.
So your mileage may vary.
All right.
So in case it's not abundantly clear yet don't go clicking on any strange links that you get from sketchy
sources.
Notice also that many of the exploits listed have to do with taking over devices such as wireless gateways
and the like.
If your goal is persistent access or to hack other machines on the target's network this would be your
focus right here.
There are a lot of different attacks that can be performed.
A normal user would just browse the Web site like normal and would never really know.
Okay that was all a lot to take in.
And we've really only just scratched the surface.
Hopefully you have enough information now that you can experiment with the various modules and see what
they do against a virtual box.
However I bet you're still wondering what beef is doing in a module dedicated to metal spoil.
After all there really only appears to be a grand total of one Metis Floyd exploit.
Which doesn't work very well by the way.
So now we're going to see how to integrate Mideast Floyd into beef before we begin.
It's going to be necessary to completely reboot.
We want everything fresh before we do this.
So I'm going to pause the recording and resume as soon as that is done.
Once the reboot is complete the first thing we're going to need to do is open up a terminal window and
from within this window we're going to navigate over the CB forward slash user forward slash share floor
slash beef dash X SS and we'll list files you can see that we have a file called config dot y AML we're
going to need to edit this with a text editor in this case leaf pad as the first step to getting met
a split it to interact with beef so we're gonna do leaf pad config dot why am AML once open we're gonna
do a search with control F to find the entry for metal split here we can see it and we're going to change
underneath met a split where it says enable false we're going to change false to true once done we'll
go to file and we'll save it then we can close out of this.
Now we need to go in to see these extensions will list files we can see a folder called a split so we'll
see into it list files once again and here we can see a second configuration file.
And we're also going to need to edit this one in the same way.
So leaf pad config dot.
Why now.
And we're going to want to keep the user name and password the same unless you changed these defaults
within medicine Floyd.
We also want to make sure that this says enable true under host.
We need to change to our local IP or public IP if we're doing this online noting the port number.
If port forwarding is necessary we'll also need to change the callback host to the same IP that we just
used
this being done save the file and close it.
And remember if you need your network IP just use I.F. config.
Now we go back three times into user share so CDE two periods and a forward slash three times puts us
in two user share.
And from here we're going to do CDE met a spoilt dashed framework
and we wanted to see these config
and the final file that we need to edit is going to be database y m l so.
Leaf pad database stored.
Y am l in here.
You want to make absolutely sure that the database and the user name both say MSF again.
If you changed the defaults you'll need to change these values.
Otherwise everything is fine.
Save if necessary and then close.
Now I know that this is a pain but we have to restart Cally one more time.
So again I'm going to pause the recording and resume it as soon as the restart is complete.
All right.
And once the second restart is complete we're gonna go ahead and open up a second terminal window and
we're going to type M S F D.B. space i n i t and this may take some time.
We're going to re initialize the Mets plate framework database.
This done.
We're gonna go ahead and we're gonna load up MSF console
notice that we didn't actually need to start post rescue cell service for this but you can if you want
to.
It's not really necessary in this case.
This done will once again run an IFR config to make sure that our network address is not changed and
it has not.
So we're going to do load space M S G bar P C space capital S server capital H Host All one word equals
and we're going to give it our network IP
and then we're going to do another space capital P pass equals all lowercase ABC 1 2 3 which was our
default met a split password and do be aware that this is case sensitive once you hit enter the plugin
will be successfully loaded.
Last but not least we need to load a beef once again.
Now it is very important that this time we load it from the terminal and not the shortcut.
Remember we are integrating it with MSF console and transferring exploits into beef and I've noticed
that trying to do this any other way such as through the shortcut leads to at the very best failure
and often a very big mess.
So we're gonna open up a second terminal window now in the new terminal window.
We're going to go to city for its last user flip forward slash share forward slash beef dash X SS files
and you may remember from the start of the video that I emphasized the importance of running beef this
way and this is why we do it.
So we're gonna do.
Period forward slash beef
successfully connected with metal split loading modules from metal split reloading exploits rather.
And now it's going to add in all of the exploits that came with metal splits so this may take some time
depending on the speed of your system.
And the beef server has successfully loaded but notice that the browser did not automatically open when
we loaded beef this way.
So we're going to need to navigate to the user panel UI by hand.
This means that we'll open up our browser of choice and we'll go ahead and navigate to the beef UI.
Now we type beef and beef for the password and remember that when we last logged in we only had that
one exploit under the Met a split folder and that was browser auto pone.
Now we'll click on an offline browsers that we can access the commands tab.
And now as you can see we now have over six hundred exploits in the Met a split folder and just like
in met a split.
A lot of these that you would click on you would set the SRB host the SRB port the type of payload the
L port the R port etc etc to make a long story short with just one single U.R.L. link you can hook a
browser and then the next thing you know you have the ability to attack that computer directly with
men exploited and depending on your target it could actually be this easy to gain direct maturity or
access all from one you RL link beef is an incredibly powerful tool.
It is even more powerful when it is used in conjunction with metal split.
Hopefully it is now clear why this tool was included in this module.
Practice with this tool and employ the proper techniques while using it and you should find it tremendously
helpful for all of your penetration tests before I close out this video.
I once again have to say never use this tool or any other tool or technique demonstrated in these videos
against any target that you do not have written permission from the owner to penetration test.
Although many of these examples given in this video take the perspective of a hacker attempting to unlawfully
break into a system.
This is because we as system administrators need to understand how the bad guys operate so that we can
defend against them and employ the right tools at the right times.
So be ethical and lawful at all times.
Thank you.