1
00:00:01,030 --> 00:00:09,010
Now that we created our exploit payload and we've set it up in a shared folder on our Apache server,

2
00:00:09,010 --> 00:00:15,280
our Web server, it's time to switch back over and we're going to run this exploit on our Windows seven

3
00:00:15,280 --> 00:00:15,880
computer.

4
00:00:16,420 --> 00:00:24,280
And now we need to establish a handler so that when that payload file phones home or calls back to our

5
00:00:24,280 --> 00:00:32,650
Tengo three point five Calli Linux computer, it will be able to do something to exploit and to compromise

6
00:00:32,650 --> 00:00:34,590
that Windows seven computer.

7
00:00:35,110 --> 00:00:48,010
So we'll set up a handler by saying use, exploit, slash, multi tab, slash handler, HP Tab and press

8
00:00:48,010 --> 00:00:48,430
enter.

9
00:00:49,090 --> 00:00:50,750
Now we're going to tell it what to handle.

10
00:00:50,770 --> 00:01:06,730
We're going to say set payload windows, slash interpretor, slash reverse underscore Tsipi and press

11
00:01:06,730 --> 00:01:09,880
enter and we should be able to show the options.

12
00:01:12,810 --> 00:01:20,310
You can see that it requires an L host, a local host, and we haven't set one up yet, so let's put

13
00:01:20,310 --> 00:01:24,110
our host address in as Tenggara three point five.

14
00:01:24,480 --> 00:01:35,250
I will say set lightpost and these have to be all uppercase set l host 10 dot oh dot three, dot five

15
00:01:35,250 --> 00:01:38,420
or whatever the IP addresses of your Calli Linux computer.

16
00:01:38,970 --> 00:01:43,890
So our localhost that we will be talking back and forth with from our Windows seven computer is our

17
00:01:43,890 --> 00:01:46,800
Calli Linux Computer Tendo three point five.

18
00:01:47,490 --> 00:01:49,800
We can show the options one more time.

19
00:01:51,390 --> 00:01:57,120
And we can see that we filled everything in now we should be able to run the exploit, so we will say

20
00:01:57,120 --> 00:02:10,170
exploit Dash J, Dash Z and hit enter and we've started the reverse TCP handler on Tenggara three point

21
00:02:10,170 --> 00:02:10,680
five.

22
00:02:10,980 --> 00:02:16,560
And as connections come in on this reverse, TCP handler.

23
00:02:16,560 --> 00:02:22,260
In other words, when that Windows seven computer finds the infected file, downloads it and then runs

24
00:02:22,260 --> 00:02:29,100
it, it's going to call home and we're going to be able to set up that intersection that will control

25
00:02:29,100 --> 00:02:30,480
the Windows seven computers.

26
00:02:30,490 --> 00:02:31,350
Let's see how to do that.

27
00:02:31,350 --> 00:02:37,540
Let's switch back to Windows seven and then your Windows seven computer open Internet Explorer.

28
00:02:37,540 --> 00:02:40,380
Or if you've installed another browser on there, that's fine as well.

29
00:02:40,950 --> 00:02:45,330
And I have turned the safety under Internet options.

30
00:02:46,280 --> 00:02:47,120
Security.

31
00:02:49,240 --> 00:02:55,780
Down to medium high, a disabled protected mode, that just means that I won't and won't stop myself

32
00:02:55,780 --> 00:03:00,160
from downloading this executable file so you can change those options.

33
00:03:00,310 --> 00:03:01,840
It's still medium high.

34
00:03:02,160 --> 00:03:04,030
I've just turned off protected mode.

35
00:03:04,030 --> 00:03:07,360
And you can set a different custom level if you want, but this one should work fine.

36
00:03:07,930 --> 00:03:17,830
When you change those Internet options, click OK and I will surf to Tynda odon three to five share.

37
00:03:18,490 --> 00:03:25,780
And if we're correctly on the same network as our Linux computer, that internal host only network 10

38
00:03:25,780 --> 00:03:32,020
not Odah three, I should be able to surf to that share folder if Apache is running well on the Linux

39
00:03:32,020 --> 00:03:35,260
box and I should find that game Dodik file.

40
00:03:36,820 --> 00:03:39,730
I'm going to click to download it and I'll say save.

41
00:03:43,520 --> 00:03:47,900
And this will saved my downloads folder and now if I run it.

42
00:03:49,120 --> 00:03:50,520
I may have to click through an.

43
00:03:51,490 --> 00:03:55,660
Give it permission, but it looks like gained New York, it sounds fine to download, right?

44
00:03:58,320 --> 00:04:05,660
If we run that and then switch back over to our Cauli Linux box, you will see that our computer odah

45
00:04:05,700 --> 00:04:13,560
three to four, in my case, my Windows seven computer has phoned home and there is now an interpreter

46
00:04:13,560 --> 00:04:21,840
session that is a direct, interactive session that I can use to communicate with that Windows seven

47
00:04:21,840 --> 00:04:22,130
box.

48
00:04:22,140 --> 00:04:25,560
I can list files, I can download files just about anything.

49
00:04:25,560 --> 00:04:26,460
The sky's the limit.

50
00:04:26,790 --> 00:04:32,310
So when we come back in the next lesson, we're going to see how to use an interpreter to compromise

51
00:04:32,310 --> 00:04:33,780
that Windows seven computer.