OK, it is time we see how we can gain access to the secured systems.
In the previous few videos we talked about and we attacked machines that had some vulnerability inside
of them, whether it was the operating system vulnerability and outdated software or weak credentials,
we managed to exploit then through those vulnerabilities and gain access to them.
But now let's see what happens if our target does not have any known vulnerability.
What now?
Well, remember I told you that the process of attacking is rather the same in this case.
We want to deliver the payload to the target and execute it just while the target had a vulnerability.
We did this through an exploit and through that vulnerability.
We managed to execute the payload ourselves.
Now it becomes harder.
We must deliver the payload to the target using some other method, and the target has to execute the
payload themselves.
That is the hard part.
The way you deliver the payload is completely up to you, whether it is over an email or over some HTTP
page over a USB drive.
It doesn't matter.
What matters is that the payload ends up on their machine and they double click and run it.
For now, let us focus on just creating the payload and running it to see if it works for this hobbyist
clinic's machine to create the payload, and I will execute it on my main Winterstein machine.
You can run our payloads on the Windows 10 machine that we installed in the previous section, or you
can use any other Windows machine whatsoever.
It doesn't even have to be Windows 10.
It is completely up to you.
Just one thing that we must make sure is that Windows defender and antivirus software are turned off.
Why?
Well, we're going to be creating a payload using MSF when I'm told from the mental framework, and
since many people use the exact same tool to create the exact same payload as we will right now, those
payloads are well known to every antivirus software and they will get detected quickly.
However, for now, our goal is not to bypass antivirus, but to just create a payload and get it to
work.
So turn off your Windows defender and I will do it right here as well.
You can go to this through the Windows Defender, and the one thing that you want to turn off is under
this virus and threat protection.
We want to go to the magnet settings and thurn of the real time protection.
It will ask you for the administrator password and once you type it in, it will turn off the real time
protection, as it says right here.
So I will close this and now let's create our very first Trojan, as I said, for this will be using
a tool called MSF.
So I'll open a terminal right here.
Why we are using MSF?
Well, it is a known tool and it is used to generate payloads really fast in just one command.
We will be able to generate a program that will gain us and access to the target system.
So let us see how we can create a simple one first if I type the command MSF when I'm their age.
Right here, we are going to see our available options with the MSF, Wynnum and up here, we also get
examples of usage, which tells us how we can generate a simple payload right here.
Let's follow the example and try it out now.
It tells us right here that to run the MSF one, we need to specify the entire path right here, but
instead we can just specify MSF when it will still recognize it as the tool that we need.
And we can write our options right after it, let and clear the screen so we can see the command better.
And if I go and type MSF when we want to use the dash P option and this option stands for payload.
So here we specify which type of payload are we creating.
In my case, since I'm going to be attacking this 10 64 bit machine I want to generate of windows.
Sixty four interpretor
reverse DCPI payload, I'm using a 64 bit because my machine is a 64 bit machine and I'm using a reverse
shell connection.
Another option that we must specify is the outpost and the host is the IP address of your machine.
So we can add to that 168, that one that well, in my case I will just double check it to 2.5 config
test.
One, two, three, four is my password.
And here it is.
The IP address is correct.
Great, another option to specify is the local port and by the way, this whole stands for localhost,
not sure if I mentioned it.
And the local port is the port that the target will connect to.
In our case, we can set that to be any port.
That one, for example, let's use the five five five five.
After that, we can use the dash F option to specify the type that we want to create.
So since we are attacking a Windows machine in this video, I'm going to be creating an XY file.
So I just type Dash F and then XY.
And the last option that I want to specify is Dash O and this dash O stands for output here.
We specified the name of the file.
I'll just call it Shell Dot.
This is all we will specify for now.
So once again, we are creating a 64 bit payload for the Windows target.
We said the localhost, which will be written inside the payload so the target can connect to our killing
machine.
And we also specify local port to which the target will connect to.
After that, we mentioned that the file type will be DOT XY, which is an executable for windows, and
at the end we output all of this with a name or shall dot the let's press enter.
And here it is, our payload is right here on our clinic's desktop.
Here we can sit shell that EXI.
This program, once executed on the target machine, will grant us an access and give us the interpreter
shell on that machine.
Let's move it real quick to the target machine, and this is something that you can do however you want.
You can plug in the USB device by going in clinics, then on the devices, then USB and select the USB
device right here, then you will transfer it to the USB device and from the USB device, you will transfer
it to your target Windows machine.
Or you can also go to the devices.
Click on drag and drop and set to be directional, this simply means that you can just copy the fall
from the Linux desktop and paste it or just drag it to the Windows 10 desktop.
In my case, in case you're using another virtual machine that you're attacking.
You can just keep first to remain machine desktop and then from the main machine desktop Cupitt to the
desktop of your virtual machine.
Just make sure it's in the target virtual machine.
You also set the drag and drop to bidirectional.
Great, now we got our shelter or our payload on the target machine.
Great, but we are not done yet.
Remember that this shell will attempt to connect to our killing machine once executed, since it is
a reversal and it will connect on the Port five five five five in order for connection to be established,
we must be listening on the court and have it open in order for Target to even be able to connect back
to us.
This is something that the framework manually configured for us once we performed our exploitation of
a vulnerability.
But right now we must do it manually and we can do it with the help of MSF counsel as well.
So what I'm going to do is I'm going to start the MSF council.
And once it opens up, I want to type, use, exploit multi and then Kendler.
And this is not an actual expert, you can imagine this as something that will listen for the incoming
connection from our payload.
It is also called a listener.
So let's set it up.
If I clear the screen to see it better and type show options.
There is only one thing that we need to set, and that is the payload.
So the payload in this bracket must match the payload that the target will execute.
So let's change set payload to Windows X 64 interpretor and then reverse DCP show options once again
and we must set the host and outport to match from the NSF one command.
So set elbows to be the IP address of my care Linux machine, which is not one that 12 and set the airport
to be five five five five once we set up all of these settings if we can run it.
So I just type front.
We can see it is now listening for the connections and nothing else is really happening right here.
Why?
Well, because the shell on the target system hasn't been run yet.
So let's run it on Windows machine.
And you will see nothing is opening, but if I go back to my Linux machine, here it is, here is our
interpreter.
Session opened and it is identical to the ones that we had during our vulnerability exploitation section.
Just this time, we created and delivered it manually and we also manually set up our listener.
Keep in mind that this didn't explode and vulnerability, we are just relying on the mistake from the
other person that is using target machine to execute our fault.
Otherwise, if the file doesn't get executed, we don't get access to their machine.
And another thing to keep in mind is that Lisner, or in our case, this multi handler that we have
must be ran before the payload or before this shelter, which is kind of logical sense.
If the target runs our file and we weren't listening for the connection, then they won't be able to
connect to our machine.
You can also notice on Target's desktop, once again, nothing is really happening.
So they might think that the program they executed didn't work and they won't question it that much.
But of course, we got the connection right here and we can use all of the comments that the interpreter
gives us, if we can, as usual, enter a shell type, who am I?
Typically config and all the other commands that we can execute.
Type there to check out all of the available files on the desktop.
And if I exit this exit out of the shell since we successfully gained access to it once again.
But keep in mind that, of course, this was just the basic example.
And we will see in the next few videos how to create a little bit more complex payloads see in the next
video.