Hi, and welcome back to Section 10 social Engineering Attacks.
In this video,
you'll learn how to set up various social engineering attacks using Carli Ox.
I hope you're excited. So let's on in for this exercise,
ensure that your Carly Virtual machine is booted and you open a terminal.
Within Carly, there's a social engineering tool,
which is already preinstalled. To run this tool,
simply type pseudo like so space,
S E T O O L P I T, and it enter,
simply enter your password for Carly Lenox and enter.
Next.
You'll see it is requesting that you agree or disagree to the agreement.
Simply press Y for yes enter shown there
are social enjoying attacks. So let's press one and hit enter.
Currently we have a menu to choose some different types of attacks from
spear phishing attacks to website attack vectors to even creating infectious
media generators, payload generators,
and uneven wireless attacks to,
to create an infectious media.
Let's press one for social engineering attacks and let's choose option three
for infectious media generator.
This will allow us to create a malicious payload that we can place on some type
of removable device.
Let's say ASU drive CD or even a DVD drive or once
malicious code is placed on the media and auto run file will be created.
Therefore, once its inserted,
it will execute automatically on the victim system.
To try this out,
let's type option two for standard meta executable.
And let's use option five for Windows interpreter
TCP X 64. What should be the call back IP address? Well,
this will need to be the IP address of our Carly machine.
So let's get the IP address of my Carly Switch machine
and type IP DDR Anza.
And I'm gonna use the IP address on E,
which is pen.
So that will 1 2 1 41.
What port should a listener be active on?
Let's use port 44 4 and hit enter.
Notice it's generated the, and after a few minutes it'll be completed
as shown.
The load is stored in the route slash directory.
In the folder call run.
So now let's copy the location of the payload.
Now it's asking should we start a listener right now?
Let's type yes so it'll automatically set up the listener for us.
So this will take a few minutes to launch and the entire process will be
automated.
Currently we can see the exploit is run as a job in the background.
That's why we don't have any sessions, but we still have a new terminal.
Let's open a terminal with root privileges.
Simply click this icon and select route terminal.
Enter your password for Carly Lenox like so, and hit authenticates three.
Let's type C and specify the directory of the payload
and it enter. If we type Ls, we should see the payload,
that XC file. Let's transfer this file to our Windows stand virtual machine.
Let's set up an HTTP server in this directory.
Python three
m http, and let's specify port.
Actually, let's specify port 80. Enter.
So now that we have our HTD P server,
let's open our Windows stand machine.
Three on the Windows stand virtual machine.
Let's open the web browser and let's connect to the web server on
ox. We'll enter 1 72 1
and notice we can access the directory. Let's click on,
let's say so as a proof of concept.
Let's the antivirus, let's go in settings.
Let's go and update on security windows security.
Let's click on virus on trust protection.
Let's scroll down and let's click on manage settings and
simply tune realtime protection. Let's try to download one more time.
Let's click on keep,
and now let's open the file and let's run and notice that we
now have a meta shell between our Cali UX switch
machine and the Windows 10 machine. If I press enter,
we can see we have the TER shell one.
If I type sessions and enter,
I can see I have one session,
so let's type session dash I for interact and one
group. Now I have access to the meta shell. If I type,
you can see that we are connected to the Windows stand machine.
If I type IP config,
we can see the IP address on the victim system.
If I type,
I now have a terminal on the Windows stand machine.
So great.
You have learned how to use a social engineering toolkit
to create an infectious media.
The difference is you transfer the actual P load over a network connection,
but in reality,
we'll need to copy the the content of the auto file onto a
flash drive and plug it to the victim system.
Let's take a look at some additional features of the social
engineering toolkit type exit,
and let's type exit one more time, actually exit
and back to the socialing toolkit.
Let's go into to create a website attack vector,
we can simply press two and we have different methods.
We can do Java upload attacks, meta exploit, browser, exploit attacks,
credential harvesting. We have tab nabbing, web jacking,
and even multi attack with each year attacks.
If we want to capture user credentials, we can simply type three, hit enter.
We can even pull site or even use a website template.
Let's say we want to use a website template. We can press one,
and here we can specify the IP address for all post requests to be
captured, which is a IP of Carly.
I'm gonna leave this as default because this is connected to my real network.
I'm gonna hit enter a note, ask which template should we use.
Let's keep it simple.
Let's use Google and enter once and notice
that the social engineering credentials is running on port.
Now I'm open my web browser and IP address of my,
this web browser is running on my hit enter
page. Looks sign page. But is it?
Well, it's a fake page because look at the url.
This is the IP of Carly. I'm not a real URL of Google.
I'm going the fake username like Zoom and let's say fake password.
Please know this is a proof of concept only for demonstration purposes and
educational purposes.
I'm gonna click on sign in and notice what happens on the Carly machine.
It has captured my username,
it has also captured my password, and on the user side,
it has sent me to the Google Home page. This is a trick me to thinking, Hey,
the password didn't work, so let's try to log in on the real page.
As you have seen,
you can use a social ensuring toolkit to create fake websites and even create
infectious media. During the course of this video,
you have learned how to create a fake website and even set up an infectious
media USB drive. In the next video,
we'll be starting section 11. I hope this video has been informative for you,
and thank you for viewing.