All right, and the previous lesson, we installed the box guest additions, so that would be able to
copy and paste easily, that's going to be pretty important.
It sounds like a small thing, but it'll save a lot of writing things down and retyping them.
When we hack from Alcalay Linux box into a Windows seven, we saw that Windows seven is on almost half
of the desktops worldwide.
Still, even though we're two versions away from that currently and we're going to use Métis spoilt
the framework that comes with Alcalay Linux set up so that we can hack into that Windows seven computer
using one of the most powerful frameworks for system vulnerability testing and penetration testing metastable.
So first of all, we've got both of our machines open.
I'm going to go to full screen for Calli, so that should be able to see this better.
And we're going to start the Métis framework.
You can find that here on the left hand bar or you can come under applications, exploitation tools,
Métis, Boit, either one of those will open it up and I'm going to open a second terminal window.
You notice that this is terminal driven.
I'm going to start the PostgreSQL Oil Rescue El Postgrads or PostgreSQL of databased service so that
we can search things really quickly.
So we'll say service post rescue will start.
We've got our database up and running.
And just as a reality check, I have config.
It tells us that we are on Tenga three to five, your address may be slightly different if you started
your Windows box after your Cauli Linux box on this private network, you may have picked up a different
address.
I am Tenggara three to five.
That's going to be very important for a lot of our exploits here.
So the first thing we've done is run our Medda split console and this is MSF, the meta split framework
console.
And you can see that I have a prompt down here for MSF.
I'm going to start Ms.
Venom, and I'm going to create a payload that's going to be an executable file that I'll be able to
run from my Windows computer.
And I'm going to serve that up on a Web server on this Calli Linux box.
This is this is somewhat similar to whom we use the social engineering tool kit back in Section five
to fool someone into downloading a fool, someone into entering their user credentials into a fake Facebook
page.
We're going to fool someone into downloading something that looks like a game but actually gives us
a back door and to control their computer as an administrator.
So the command that we want to run is MSF Venom.
And you'll see why this is named Venom.
Once we use it next time, I'm going to make that a little bigger and clear the screen.
Now, Ms.
F then.
And we want to specify a payload that we're going to deliver to our Windows seven box, and that payload
is going to be a very powerful tool called letterpress.
Our interpreter comes with a display framework and it allows us to set up an interpreter or a running
shell that lets us communicate to that Windows seven box and we'll be able to eventually take it over
as an administrator.
So our MSF venom gets followed by Kaspi for payload windows, windows slash interpretor.
Reverse underscore TCAP, that's going to establish a reverse TCP connection, in other words, the
Windows seven months is going to call us.
It's going to call the Cauli Linux machine using TCP or the transmission control protocol, just the
regular TCP IP that the worldwide web uses to communicate.
So we're going to establish a connection from that Windows seven bucks back to our Linux box.
Well, we need to tell it the host address of the Calli Linux box.
So we'll say, well, host equals and we need that IP address 10 DataDot three point five so we can
even copy it.
Come up here and paste that way, we make sure we get it exactly right, minus 10, Agota three point
five, make sure you match whatever your I-F config says.
Next, we tell the format that we want to export this payload and that is going to be Dasch F and it's
going to be in the XP file or an executable file for Windows F space.
EXI this is going to wrap a line, but you can see how it works there and now we need to tell it the
name of the file and where we want to store that as an output file.
So this is going to create a payload or an executable file that we're going to run on our Windows seven
computer and I'll put that to slash root slash desktop.
Slash and let's call it game got XY.
So this is going to look like a game that we're tricking someone into downloading and running on their
Windows seven computer, once you run that, if you've put the output location as route desktop gamed
out XY, if we pull this down now, we see game XY is here on the Callisthenics desktop.
So this has created a Windows executable notice and X 86 Windows platform executable.
That's an executable format or XY format called Gained XY.
So we have our payload ready to go in the next lesson.
We're going to see how to put this up on a temporary Web page that we're going to set up on this Calli
Linux box so that we can exploit it and run it on our Windows seven computer.
We'll see how to set up the Exploit Web site in the next lesson.