So let's see how we can gain full control and get an interpreter session from the target's computer.
So again we're going to go on the commands and we're going to go into social engineering.
There's actually a number of ways that you can use in here to get a reverse shell now.
It all depends on how you want to make your social engineering attack.
But we're going to use We're going to use an notification bar effect notification bar and we're using
Firefox because our target is runs on Firefox or are using Firefox.
So what this will do it'll basically tell the user it will display a notification bar tell the user
that there is a new update or there is a plugin that you need to install once they install the plug
in.
Then they'll actually install a backdoor and he'll give you full access to their computer.
So the way we're going to do this is we're going to use the same back door that we always created and
we've been using.
Now I actually have it stored in my web server so I have it stored and wired with the e-mail.
And I have it's called update ATX but it's the same by doing the same reverse interpreter that we used
before.
So I'm going to give the full address with here.
So it started in
10 20 worth in 0 7 that's my actual IP and the name of the file is of the ATX the.
And then the notification and investigation is just saying there is an additional plugin that needs
to be installed to display some elements on this page.
Now you can change this and just say am critical update for Firefox.
Click here to install.
So I'm going to hit execute
and if we go into Target you can see that they're getting a message telling them that there is a new
update for Firefox and click here to download and install so that the average person will be like oh
you need to install this.
So they download it and now basically they have a backdoor downloaded on their machine.
Once they try to run this backdoor to install the update they think it's an update but they'll actually
run a backdoor which will give us full access to their computer before we run them back to where I need
to listen on the port exactly like we did before.
So I'm just going to do show options here to show you I'm not going to go through all the steps.
It's use my test right Monte had there.
Same way we did it in the video of listening for portes.
So we're using arbitrary versus ETP.
I have my IP and the port.
So I'm just going to exploit and I'm listening for the connections now.
Now let's run the update that we just downloaded.
And if we go on the target you can see that we got full control over it.
Use an amateur Peter session.
Now again this is just an example of one way of gaining full control over the third computer.
There's a number of ways that you can do use and be.
And there is a number of social engineering attacks that you can do to gain full access on the target
computer.
So again I highly recommend you go over to the plugins and experiment with them and see what attacks
you can come up with.