Lots of attacks can be easily performed on Windows XP.
But this operating system is kind of obsolete now.
So I will do this demo on Windows 10.
So let's get into the bread and butter of this and exploit Windows 10.
You can as well practice by downloading and installing the methods palatable form from the rapid 7 website
met as political is an intentionally vulnerable Linux machine that you can use to evaluate and perform
a lot of exploits within methods.
So let's explain this attack first on Windows 10.
It is very simple.
First we will create a malicious executable program the payload for the target the host and then we
will run this file on the target host and it will actually expose it will actually expose its shell
to the attacker which is the killing machine and the killer machine can now remotely control the Windows
10 or the target machine.
So let's start here.
First of all we need to run the metal split form display the framework.
Let's start the service.
You can run it first statically or you can use service was crisp.
Start it one started at the base services.
After that we will run them at this point using MSF console board to note that this attack can be done
on a LAN and over the Internet just change the IP addresses so let's use the command code and S F the
M as a venue is a combination of two commands that are there and methods point which are the MSF payload
and the MSF encode.
So now they are both in a single command would scold MSF.
So earlier the MSF field which was used to generate the payload in a specific form and then the MSF
encode was used to encode the payload using various algorithms so now you can use one command to do
both actions.
Now after that you specify the payload.
Here we will use Windows method of reverse CCP.
So this is the payload that we'll be using as we said that the the the victim will expose its shell
to us and we will be able to control remotely.
Then we will specify local host IP which is my IP just to double check here.
So my AP is 2 1 1 1 30 1 2 1 6 8 2 2 1 1 1 30.
Then I will specify the local port which is you can choose anywhere.
I'll choose 5 5 4 5 and then minus 5 which is the file extension that I will use to generate this payload
which is the XY and then I use minus E which is specifying the encoder I'll select this encoder.
There are lots of quarters so this is my preferred one.
She got a 9 and then you specify how many iterations this encoder will do so this payload select 10
iterations and then create a file called what you want call it.
Let's create a file erosion but actually execute that.
And actually this will create a file the chosen File for us it's open a new terminal here as you can
see that the file has been created with the size of some 382 bytes just to double check just listed
here and you'll be able to see that the chosen of EFC file has been created.
So now we are ready to file to the victim's machine and executed there and are both successful in execution.
The target system will be fully compromised and we will be able to control it remotely and the result
will be a metal printer call for us which is a command line for us to perform any type of command remotely.
So as we did before we mounted this what we want this folder to the Windows 10 machine.
So let's just copy the file that we've just created which is totally that easy.
Let's just move it to Windows machine windows now and let's go to the Windows machine.
So here under Windows machine you're just double click on the Trojan that you see and it will execute.
Now we go to our Kelly machine and we just issued this command.
Use this issue in the methods boy use multi handler then set they load windows to preserve reverse DCP
then set the host to 1 9 2 2 1 1 1 30 then set out boy to the point that we set before 5 5 5 5 to listen
to the incoming connections on this point.
And now we all we need to do is to explain.
So as you can see here that this session has started reversed behind their 1 the IP 2 on 1.0 130 which
is our IP.
So if you go again to the Windows machine and double click on this file and metroplex recession will
be open between the two eyepiece 130 and 120.
And now we have shell here that we can use to do whatever we want.
So let's first use help.
You can see all the commands that you can run here on the on the on the shell that just opened the metal
printer.
This is very important.
Start by typing help and it will guide you through all the commands you can for example use this info
just to see the system and for Windows 10 you can see the computer name the os the architecture the
domain or the one group and they couldn't current logged on users you can use s to list the directory
the current directories you can use as well I can think to see the network configurations of the remote
machine you can as well use the search command search for any file on this remote machine.
So get me all the files that have the DOT extension on this remote machine.
And these are the files you can as well search for files of type T T on the remote machine.
It will get you all the files or this extension you can as well select any file and choose to download
it.
So to download this whole bit file just paste it and make sure to change the backslash to forward slash.
You can go to the terminal and just press list and you'll be able to see the Hobbit file here.
The word file here as well.
So this is some of the commands that you can run on the machine.
And one of the most important command is the upload command so you can upload like anything your Trojan
relation to the E X E.
You can upload it to C Windows system 30 to whatever.
So let's try to upload here wherever you file like
it.
So you're hoping the text
and it's uploaded successfully.
One of the most important commands as well as the shell commands.
Once you press shall you be able to acquire a Windows shell and you can do all the comments from here.