WEBVTT 00:00:00.510 --> 00:00:04.050 In this demonstration, we will create an infectious media attack, 00:00:04.590 --> 00:00:08.850 and we will look at how we can create a QR Code attack for QRLJacking. 00:00:09.750 --> 00:00:12.780 Another way to perform social engineering is to trick a 00:00:12.780 --> 00:00:15.540 user into running some malicious code. 00:00:15.930 --> 00:00:18.510 On many occasions when I have performed social engineering, 00:00:18.990 --> 00:00:21.550 I've walked into a customer building and asked the 00:00:21.550 --> 00:00:23.930 receptionist to print something off a USB stick. 00:00:23.930 --> 00:00:25.440 Majority of the time, 00:00:25.520 --> 00:00:28.650 they were willing to help without knowing that they were actually 00:00:28.650 --> 00:00:32.000 being social engineered into plugging in a USB stick. 00:00:32.390 --> 00:00:36.900 The Social‑Engineer Toolkit gives you the ability to create infectious media, 00:00:37.420 --> 00:00:39.740 and this is found under the social engineering attack 00:00:39.740 --> 00:00:42.370 vectors and infectious media creator. 00:00:42.370 --> 00:00:42.620 Now, 00:00:42.620 --> 00:00:46.230 the infectious media creator gives you the ability to create a 00:00:46.230 --> 00:00:48.940 malicious file that can be run automatically, 00:00:49.190 --> 00:00:51.700 and you can then, of course, either put this on a USB, 00:00:51.850 --> 00:00:53.460 or a CD, or DVD. 00:00:53.980 --> 00:00:54.930 We have two options. 00:00:54.930 --> 00:00:59.540 We can create a file format exploit or a standard Metasploit executable. 00:00:59.930 --> 00:01:02.800 I'm going to go ahead and select the file format exploit. 00:01:02.930 --> 00:01:05.280 The first option that we have is to provide the IP 00:01:05.280 --> 00:01:07.020 address for the reverse connection. 00:01:07.330 --> 00:01:09.570 Next, we have a list of payloads that we can create. 00:01:09.780 --> 00:01:13.900 One that I have often used is the Adobe PDF Embedded EXE. 00:01:13.980 --> 00:01:16.910 This enables the social engineering attack to work because when 00:01:16.910 --> 00:01:18.890 somebody actually plugs in the USB stick, 00:01:19.040 --> 00:01:21.500 they run the PDF file, and then, of course, 00:01:21.500 --> 00:01:22.830 the PDF file is blank. 00:01:23.070 --> 00:01:26.530 At that point, I simply just ask them for the USB stick back, 00:01:26.900 --> 00:01:28.780 claiming that the file is either corrupt. 00:01:29.040 --> 00:01:31.150 So let's go ahead and use this attack. 00:01:31.840 --> 00:01:35.830 I'll select option number 13, and then I have the option to use a built‑in PDF, 00:01:35.950 --> 00:01:37.640 or I can provide my own PDF. 00:01:37.900 --> 00:01:39.590 So I'm going to use the built‑in PDF, 00:01:39.720 --> 00:01:43.010 and I'm going to select the Meterpreter Reverse_TCP payload. 00:01:43.220 --> 00:01:45.740 I'm going to provide the IP address for the payload listener 00:01:45.800 --> 00:01:47.530 and the port that it will connect back on. 00:01:47.820 --> 00:01:51.990 Once the payload creation is completed, I have the ability to start the listener. 00:01:52.520 --> 00:01:56.180 And you'll notice that it also gives me the location of where the file is 00:01:56.180 --> 00:01:59.730 located so that I can go ahead and copy this to a USB stick. 00:01:59.880 --> 00:02:01.740 I'm not going to start the listener right now, 00:02:01.880 --> 00:02:03.580 and I'm going to cancel this operation. 00:02:03.720 --> 00:02:06.110 We will revisit the same attack, but this time, 00:02:06.150 --> 00:02:08.460 we're going to select the Metasploit executable. 00:02:08.460 --> 00:02:09.060 Now, 00:02:09.090 --> 00:02:12.110 the Metasploit executable gives me the ability to go ahead and 00:02:12.120 --> 00:02:17.070 download and run my own executable, or I can select from the 00:02:17.070 --> 00:02:18.520 various options that's available. 00:02:18.690 --> 00:02:22.260 I'm going to use the Meterpreter Reverse_TCP payload, and then 00:02:22.260 --> 00:02:24.680 I'm going to provide the IP address for the payload listener. 00:02:24.860 --> 00:02:26.320 I'll provide the port as well, 00:02:26.530 --> 00:02:28.550 and then the Social‑Engineer Toolkit will go ahead 00:02:28.550 --> 00:02:30.080 and create the payload for me. 00:02:30.360 --> 00:02:32.110 Once the payload creation is completed, 00:02:32.300 --> 00:02:35.900 I will have the ability to then copy that to a USB stick and use 00:02:35.900 --> 00:02:38.870 it in a social engineer attack. Bear in mind that when you use 00:02:38.930 --> 00:02:43.110 Metasploit payloads, a lot of those payloads are detectable by 00:02:43.110 --> 00:02:44.410 antivirus technologies, 00:02:45.240 --> 00:02:48.750 so it would be a good idea to actually run that payload through 00:02:48.750 --> 00:02:51.850 some further obfuscation to avoid detection. 00:02:52.240 --> 00:02:55.990 Let's take a look now at how we can perform QR code attacks. 00:02:56.230 --> 00:02:59.550 QR codes are often used in QRLJacking. 00:02:59.760 --> 00:03:02.630 QRLacking involves social engineering, 00:03:02.870 --> 00:03:06.620 which is capable of either session hijacking or credential 00:03:06.620 --> 00:03:09.810 harvesting, and you can use it for any type of application 00:03:09.930 --> 00:03:12.090 that relies on a login with QR code. 00:03:12.100 --> 00:03:13.950 QR codes are everywhere. 00:03:13.940 --> 00:03:18.770 You'll notice them on products, concert tickets, advertisements, and much more. 00:03:18.970 --> 00:03:22.490 The purpose of these are really for marketing and for people who are looking 00:03:22.490 --> 00:03:26.350 to obtain some more information about a specific product. Due to the wide use 00:03:26.350 --> 00:03:30.970 of QR codes, attackers and are now using it to social engineer unsuspecting 00:03:30.970 --> 00:03:35.850 users into scanning them and providing sensitive information that can be used 00:03:35.850 --> 00:03:39.400 against them. To create this type of attack using the Social‑Engineer Toolkit 00:03:39.640 --> 00:03:40.590 is really simple. 00:03:41.110 --> 00:03:43.320 Within the social engineering attack vectors, 00:03:43.630 --> 00:03:47.830 we can select the QRCode Generator Attack Vector, and the option that we 00:03:47.830 --> 00:03:51.410 have is to provide the malicious URL. So I'm going to go ahead and provide 00:03:51.420 --> 00:03:56.660 a fake malicious URL. And once I hit Enter, the code will be generated and 00:03:56.660 --> 00:03:58.900 stored in the location provided. 00:04:00.140 --> 00:04:03.190 So I've opened up the QR code, and this is what it looks like. 00:04:03.740 --> 00:04:07.960 And when I view the QR code using Web QR, I can see that this QR 00:04:07.960 --> 00:04:11.750 code redirects me to the URL which I have defined.