Now it's time to infect our Windows 10.
P.C. so that we can take remote control and do the command and control section.
That's coming up for our next section.
We have turned off our virus and threat protection settings and our Windows firewall.
We have served up our virus on our Web server and Kalli.
Now we just need to do a couple of things.
The first thing that we want to do every time we are trying to infect a remote machine for security
testing or for testing inside your organization.
We want to listen for those infected pieces on our Caleigh Linux machine in Medda Spoilt.
So come back to your meds, play shell.
And if you've closed that, you can always reopen it just by running MSF console or clicking on exploitation
tools, US play framework because we can start at this stage.
Every time we want to reinfect using this same virus, as long as our IP address stays the same, we're
going to be able to reinfect computers over and over and over again by using this same exploit.
This one Windows virus can infect hundreds of pieces on your local area network or across the Internet.
We're just going to use it in a very safe environment.
But attackers can infect up to 65000 computers at one time from just one of these windows, much pepper
shells.
So we're gonna use the exploit multi handler.
That's can I listen for incoming connections?
We're going to set the payload to listen for those reverse TCAP connections coming in.
I'm going to you show up soon just so you can see what we can set in there will set our local host one
more time so that our Windows Materne operator Shell will have a place to call back to on our Caleigh
computer.
So what I'm going to do is control L to clear the screen and I'm going to say use, exploit, slash,
multi slash handler.
This is a tool inside met a split that allows us to listen for or handle different virus payloads,
calling back into the Kalli computer.
We're going to set the payload to match that windows reverse TCAP.
So we're gonna say set payload and you can actually start typing out payload and use your TABD autocomplete
windows.
I mean, Callies Medha split framework will allow you to use autocomplete so we can say windows slash
interpreter slash reverse underscore TCAP.
And press enter.
And we can show options so we can see what kinds of options we can have here.
We do need there's a required local host function.
So we've got to set the local host.
That's who we want to call back into.
Notice you can also change the port.
So if you wanna make it look like your DNS traffic on poor 53, if you know some of the famous or some
of the more common Internet ports out there, you can actually set a different port instead of four
four four four, which is the fault here.
You could set it to be port four for three so that it looks like secure web traffic or Port 80, so
that it looks like a regular Web server calling backup.
But we're going to set L host L. host to 10 DRDO dot and use the rest of your IP address.
DOT nine seven is the IP address on my machine and you can run IP space A if you don't remember your
IP address on Kelly.
And then all we have to do next.
And there are a couple of things we could do next.
We could say exploit Dash J, Dash Z.
That would listen for multiple connections coming in in the background if we were exploiting a lot of
machines.
But I'm just going to run exploit just e x p l o i t.
And now we are listening for remote TCAP connections coming back in that reverse, TCB handler will
listen for my Windows P.c to phone home after it gets infected.
And so we've got this running on this device.
We want to come back over to Windows and we're going to surf to our CALEIGH address and actually download
and run that virus.
So open up your Web browser and you can install Chrome or Firefox from inside your Windows VM.
So it's a little more realistic.
But a lot of people just use the default edge browser that's built into Windows.
We need to give it the address.
Ten oh dot nine, dot seven.
And remember, slash share is the share folder inside that Caleigh machine.
And look at that hour fortnight all skins.
Daddy XY is right there ready for somebody to serve up.
So the way this would work in a real world attack is somebody would say, hey, download this new Skins
pack, you'll get all of the abilities that you want in 49, all the skins.
Lots of other cool extras built in there.
And they would click on it or somebody says, Oh, I need you to look at this invoice, make sure you
go to download this file.
Or you could just attach it to an email, attach the whole executable, even though a lot of executables
get cut out of emails these days by spam filters.
So you just send them the link and say, hey, go here and download the file and tell me what you think
about this invoice sending what you think about this candidate for us to hire.
What's this funny set of videos, whatever it may be, and executable is not the only format that we
can do in medicine.
What we can actually send a PDAF or a movie file and actually infect someone's computer using some exploits
for a viral vulnerable version of a PDA feature or of a media player as well.
So for not all Skins Daddy XY, we will download that.
And Windows is gonna try to warn us a little bit what you want to do with this.
You don't want to run it because we actually want to be able to run this multiple time, so I'm going
to save it.
Download it and I will open the folder, and because we turned off a virus and threat protection settings,
it should download, OK?
And we don't have to worry about the Windows firewall firing up.
So what I'm going to do is run fortnight, all skins, daddy XY and it's going to say, hey, this is
an unrecognized app.
Don't run it.
But if you click on more info, it'll let you run it anyway.
So if you were sending this to somebody to test their ability to to detect when something's going wrong,
they've got a few hints.
But if you tell them, I'll just click through more info and run anyway.
There's a good chance that they'll run it.
And it's something they're interested in.
There's a much better chance.
Now, if you notice, back in our Caleigh machine, it looks like something started happening.
And in fact, it did.
It says that it opened up a reverse TCAP handler on 10 DRDO dot nine, dot nine that as our Windows
computer.
And so now if we want to run a couple of commands, we can actually take remote control of this Windows
virtual machine.
But it could be a laptop, a desktop or Windows Surface tablet, and we would be able to run commands
remotely on that machine through our Materne operator Shell.
So if you were able to run this file and you see after those four lines that we entered before.
If you can see the exploit, open up a session and Materne printer, you are ready to move on to the
next section.
And we're gonna see how to command and control a Windows machine from Kalli using this Trojan, this
remote virus that we've created.
It's going to be a scary few lessons because you can see that attackers can take control of the webcam,
can take control of the keyboard, can take control of the mouse, just about anything that you can
imagine when you run an infected file.
So be careful when you click these downloaded files.
You can see already why it's dangerous to open something just because a friend or just because an email
said to.
But when we come back in the next section, we're going to see how to take full control of this remote
P.C., grab screenshots, keystrokes, and even turn on the webcam remotely.
So come back for the next section and we'll see you there.