Well I often.
Welcome to the show.
Or interesting life hacking demo in this case.
I'm just going to show you my setup so this is quite unusual for me to record like this with a camera
but just to prove that this is sort of like live and I'm not admitting or faking any of it.
I've got a calling machine here which is running on a virtual machine the host machine is down here
which runs Windows 10.
And I've also got a wireless USP adapter connected.
I'll explain why later on on the right hand screen here I be asked which will we use.
I'm not going to be recording the video.
The whole video anyway like this.
And on the left here we have a laptop without an internet connection and this PEASANTS TRYING TO BROWSE
Reddit.
So let's add some context.
Well first let me say that this video is for ethical and educational purposes only.
I'm not responsible for any damages you cause with the information in this video.
This video is very brief so I don't go into great detail if you want to know more than please visit
my playlist on my YouTube channel called Land ethical hacking I go into greater detail.
So this person that's called Hair carbon in Starbucks is trying to connect to the Wi-Fi so we go and
sit down with our laptop and plug in our wireless USP adapter.
Now we've generated a fake or we create in this case a fake access point So Dan how got Bash report
will create our fake access point using money toolkit.
This bash script will start to freak access point in the conflict config file or configuration file.
I've called it Free Wi-Fi so people are going to see this in public.
Now this could work for people who are close to you.
It could work in your house.
It could work for a neighbor.
People who are in the general vicinity of where you are or your wireless card is a maid.
This could be called SSA I.D..
Free Wi-Fi.
The access idea is just the name of the router.
So here it's created and we're starting to get direct probe requests.
Now the reason I called it Free Wi-Fi makes sense because in public people want free Wi-Fi.
And in a way they are getting free Wi-Fi.
So now if we go to our target machine on this computer it's going to be the one that we're going to
hack into.
So we open the Wi-Fi and as you can see now there's a one called free Wi-Fi.
So this person Karen in this case thinks oh free Wi-Fi clicks connect to the cell connecting to this
free Wi-Fi.
And as you can see now we know that someone's tried to connect to it.
So we've got an authentication from this MAC address here.
So we've got the MAC address of a device AC and not MAC address corresponds to our laptop so that's
basically the set up.
So I'm going to jump on the coffee machine and get everything else settled now so I'll see you back
on that.
So now that we're on the clear Linux machine we've still got our terminal running with our fake access
point the fake access point basically locks or creates a method of listening into the pockets because
now we're sort of like man in the middle.
So every request they send we see a face.
Then it goes to our router and then back towards back to them.
So it's very useful because the same ways and methods of attack that we can do we can inject things
which we're going to do in this video but the downside is that we are offering them free Wi-Fi.
And if we have loads of different connections in public then that could take a toll on performance.
You could.
But then again in the benefit of the is we got all this information.
So the next thing to do is I'm going to open a new terminal.
I'm going to use Terminator for the app and I'm going to start an AARP spoof.
But the first thing we need is be folk so be folk will give us a malicious J.S. file this beef hook
once injected into a Web site will allow us to basically execute basic commands on this computer such
as the left boxes and fake updates and we can still credentials and take screenshots so we'll open beef
here.
So when I log into beef just beef and beef the user name and password we've got beef open now.
And like I said at the start of this video if you don't know everything or what I'm doing here go and
watch my line ethical hacking cause that go into much more detail Scott beef open so I can just I can
minimize that I don't really need to open and we can start an AARP spoof.
So I'm going to use mine in the middle F A R P spoof.
I'm going to use w lands a rule which is my wireless card.
Then we've got to talk IP address and the Gateway which is the reaches IP then we've got a malicious
J.
Hooked J.S. file which is shown in the all the terminal windows I just minimized.
So I'll show you again if we open up this one you can see here that it's hooked up J.S. and that's what
we want to inject into their browser and I didn't mean to close before then.
So we'll just have to reopen it to give it a second while it just closes and reopen beef.
So when you closed the terminal you've got to remember to keep the terminal open while you keep beef
open.
So we'll wait for B to open and while that's doing it we can open a new terminal.
I'll open a new window and we'll split this horizontally because now we want to generate our payload
to beef up hooks going to open.
There we go.
It locks is in straight away anyway split it horizontally and I'm going to use Hercules to generate
a payload.
So generally payload and when to use reverse hitch TTP which is number two the Al host is the IP address
of my server.
Now Kelly links screen installed with a local server and an Apache to server that's 1 9 2.
Now this wouldn't be the same for you.
The port will use ATC you can use any common ports.
The most common ones or the ones are less suspicious are like 80 81 88.
For 444 et cetera.
So we don't want to add any of that and we'll call this payload update.
So it's more believable you'll see why I've called it update and why it's quite clever.
So we don't a.
So there we go.
There just to make sure everything's correct.
We can have a look at these settings once we start listening for it.
Let's make this terminal window a little bit larger.
Maybe go.
And if we go to our redirect we will have updates.
Yes.
So I'm going to copy this now and upload it to the service directory which is right here.
I'm going to paste it so we've got a direct download link now for our payload.
The main objective is to get the payload executed on the computer so got beef hoping here we can start
an AP poisoning attack.
So what we'll do is I'll open a new terminal and we'll use our IP poisoning.
Click enter so just start at the man in the middle and attack.
So while it's loading we'll wait for it in fact.
So there we go because it doesn't take too long.
So the servers are online and now it's waiting for a request to a Web site.
It's going to try and inject the whole dot J.S..
So we go to our top computer and we offer internet connection.
If we go to let's say this Karen is sick of Reddit and decides to go to BBC doc you can click enter.
You can see it takes a little while longer to load.
But now if you go back to our Kelly machine we've got BBC doco the UK request and it starts to inject.
So we go to our B hook and wait a few seconds as you can see it's still loading and still trying to
inject.
There we go.
We've got an online browser.
So now we can execute a few commands so let's look at some of the commands we can execute.
There's an alert box so we type less we can create the left dialog and there's a dialog can say anything
we wish.
So let's say we want to say hi.
It's very simple just a simple hi Ben down here.
If you look right down here there's a little botnet is executed.
It.
We can lock on our target machine and there's a little message that says Hi from the Web sites and actually
noticed the website.
You are I was a little bit different and that's the M S I think it's emptier MF or something like that.
It's a spoof to get round pitch to cheap gas.
So we get messages.
So that's a simple alleged box.
So now what we can do is we can add a fake notification bar to make them download our payload.
And that was the reason I called to update because if we type in fake sorry it's spelled properly.
There we go we can get a fake notification bar so our fake notification bar if we get that backup and
we'll use the chrome fake notification bar here we can add IP address for the server.
So 1 9 2 sorry 1 9 2 0 1 6 8.
Make sure do in the correct format.
Now as you can see the browser just gone off line for second.
But if you don't do anything on the top computer and you just leave it then be folk don't lose connection
a little bit.
So we just need to refresh the page or just wait a few more seconds.
There we go it's going to just re hook the browser.
There we go.
As you can see it's come back online so this fake notification bar will add fake keeps them fake will
add all Halo 2.
So you are L 1 9 2 1 6 8 dot 1 10 1 2 8 and the direct download link for update dot the vaccine.
So the download updates straight away so we'll add a custom message.
Plus a critical update required maybe go and click execute so click execute.
As you can see there's a come on now.
And if we go back to our target machine as you can see up here it's as critical update required if we
click on install missing plugins and we'll wait for it to download to wait a few seconds for that to
download and while we're waiting we'll go back to our culling machine and actually listen for a connection.
So to listen for a connection we can type MSF console.
This will start the meters really framework.
We need to wait for this before we actually won the payload because we need to be listening for connection
as they run and execute our payload.
So just wait a few seconds for the meters blue frame where console to run we can monitor the or the
terminals to see if our servers are OK which they are.
Now meet this place to start so we can use exploit and multi handler.
Then we'll set the payload to the corresponding one that we use for update dot actually which was Windows
interpreter reverse underscore each TTP.
So we set the payload then we'll set the Al host to the servers and then we'll set the Al port to 80
80.
Then we type exploit we'll listen for a connection
sorry I typed that wrong so we'll start that again.
We need to set the Al host.
I made a mistake when typing the Al host I was 1 6 8 1 10 not 1 2 8.
Yeah that's fine.
So I'll host 1 6 8 9 0 1 2 8.
Then we'll show options to make sure everything set correctly maybe go will listen on on the correct
IP address now on the crack port so we can type exploit again listen for connection maybe go does a
reverse handler started so now that all rebase handler has actually started we go to our target machine
and as you can see the downloads and started uncompleted and we've got update.
Now it says 1 in brackets because there's already an application called update.
But if you just click on it so we can actually prove that we're running update.
Now if you noticed there's a message here.
This is not an antivirus message.
This is just a Windows Defender smart screen.
This is for applications with known.
I believe publishers.
There we go.
So we'll run it anyway because most common applications that you download will get that message.
So we click on have noticed no antivirus messages just have shown up.
We get a well-known publisher would like to make changes.
So this person current in this case clicks.
Yes.
So we click.
Yes.
Then we go back to our cutting machine.
And as you can see we've got a tape it's a section.
So now we can do pretty much anything we want to the computer.
So now that we've got separate secession Let's type some commands.
So sis info will get some system information so we know the computer's name's Karen.
We've got an operating system Windows 10.
We know its architecture and that's a mouthful.
Just about said that right there we go anyway.
It's a 64 bit.
So we've got a system in here it's not really fun that's just just basic stuff.
Let's start something the interest in so we'll start key scan underscore start and then we'll type.
Well actually and I will wait and we'll go over to the target machine and what we'll do is we'll type
some information in so we'll type anything in the search bar on BBC dot com.
Okay so we'll just type something in.
And now if we wait a few seconds and then type dump instead of start then we capture the keystrokes
and as you can see DG or DTV or whatever.
They we go.
We've just done some key scans and this is like a key logo.
So imagine if they looked into Facebook with their e-mail and password you would see that then we can
just need to stop it so we don't get too many.
So we can stop.
What else can we do.
Let's take a screenshot.
So we'll take a screenshot of the desktop so I'll save a screenshot.
And as you can see there is the name of the screenshot.
So if we go to our root directory
so we're on our root directory and it's called Z A V M beauty.
So we click on this well and as you can see we got a full screenshot of the desktop.
So they're on Reddit they're on this dodgy BBC Dr do care website.
This doesn't affect BBC web site by the way there are people using just the laptop connected because
we specifically told it to target the IP.
So now we can do pretty much anything.
Let's look for some secret files.
So like I said this was a dummy account created so let's see deep into users.
In fact we'll type p p WD and will notice that we're in users current downloads.
So now we know that the users current so we can just type D forward slash uses for Slash current.
Now we're in the users current directory.
Now we can type C D desktop to get to the desktop and see what kind of files she has on the desktop
now spelt that wrong so that's going to give me an error.
So it's desktop.
There we go.
And we type Alex to see what's on the desktop.
So there we go there's a few files but look these passwords dot your XY so if you type can't passwords
dot e x t t click enter it will spam them and it will dump them.
So there we go.
Password 1 2 3 my password Facebook password.
Mr. Robot.
So we got their passwords now obviously most people wouldn't store their passwords in the tax documents
but some do believe me I've seen it.
So the last thing is we'll take a snapshot of the web cam or first let me put something on my head so
I can't be seen so I've got something on my head now might sound a little bit strange but what I'm going
to do is I'm going to start a I've got you'll see and it's quite funny in a second book for Type help
click enter and we can see a few commands so I'll show you a few we can record the mike and we can take
a webcam snap.
So that's what I'm going to do.
So I'm going to take webcam underscores that first before I put the mask on webcam from the school snap.
I'll put the mask on and click enter and then show you the screenshot.
So there we go.
We got a screenshot of the camera.
There's my setup and yes that's the horse mask but you got the idea we took a screenshot of the webcam.
That's quite scary to be honest because it could be doing absolutely anything.
But in this case Karen is a male for some reason I'm wearing a horse mask but there we go.
So that was just a short hacking demonstration.
If this video was interesting then please even like comments if you want to know anything else subscribe
for future content and I will see you in the next video.