If you're suffering with Marcus boy commands Armitage is your tool.
Armitage is a good way for me to exploit it visualize his targets and recommend exploits.
In addition to exposing a lot of post exploitation features mythos point allows more than one person
to carry out an attack by sharing the meta spoils session so a teamwork here is allowed.
Armitage automates lots of the tasks that are somehow difficult to do and might exploit it can't import
canned data from other applications and it can as well scan the data and scan ranges itself.
On top of that Armitage allows you to take advantage of a compromise target to launch an attack from
this compromised target to the land.
So let's get to the bread and butter that lets open a terminal here and run the Bose rescue service.
So it's important to run the service that every service in order to make Armitage fast.
You can invoke Armitage from the command line here as well as you can just invoke it from the menu under
the exploitation tools just best connect and press yes and the gooey interface will display the interface
is really easy.
You have three panes.
The first pane is the target pane and the second thing is the module pane that we already discovered
in the previous videos and the below pane here is the console.
Think you can start by scanning hosts let's do this quick OS scan it will prompt you to enter a range
I will enter the range of my lamb in this way so it will scan the full subnet of class C of 2 1 1.
I just wait for a while.
It will scan all the subnet and it will display the available operating systems on the network.
It's important to know that if you don't have Armitage installed just install it from the terminal by
issuing the command AAPT hash or dash get space install space Armitage.
So in all this Khan is kind of over and it's complete.
And as you can see it returned to me.
5 machines two of them are Linux and two of them are windows.
As you can see the icon of the operating system is displayed for ease accuse.
If you have a lot of machines here that are returned you can simply go to Armitage and set targets you
to table view.
You will see them and this this form so from here you can select this machine or any machine.
And for example list the services it has.
You can as well go to the menu of attacks and press on the sub menu fine at that so no Armitage is searching
and the attacks database for the relevant exploits pertaining to this machine under this operating system.
So as you can see it's a very powerful tool that can save you lots of time.
The outside over and if you're right click on this machine again and you menu will appear which is the
attack menu you have various lists of attacks here that you can try.
It's important to note that attacking a computer is not that easy actually especially with the modern
event of these security layers.
We have firewalls intrusion detection systems and even you have antivirus that may stop you from lying
lots of payloads.
But it's important to know that these features exist.
Same thing here for Linux.
You can use any of these attacks one of the important features of little of Armitage is the Hail Mary.
Hail Mary actually is the brute force kind of attack for Armitage.
It will try all of the 11th attacks but this will actually consume the network a lot so it's not recommended
to try it it's recommended to try attacks one by one.
So on this left thing here which is the module pain you can simply click on the module itself it's so
file structure and it's easy to navigate.
The bottom line here as you said is the command line pane or the console pane where you will see in
the background the commands that are being invoked by Armitage.
So let's go to the bread and butter and create payload from Armitage.
Let's go to so now create the payload.
Move it to the Windows machine and run the payload from the windows machine and have a metal session
from Armitage.
So I'll go to Metacritic here.
Select reverse DCP and make sure to select a port that is easy to remember do 1990 from the output here.
Select x file.
So now we would create an ESB file which is our payload.
Open the desktop here.
Go to the remote month one month actually it is my folder that is mounted the Windows machine.
So I'll do this.
Virus 1 0 1 dot the XY.
So now the payload has been created and it has been moved to the Windows machine.
Moving the malicious file to under the machine can be done through lots of techniques used by social
engineering which we'll discover later on.
So the file has been moved to the Windows machine.
If you go here to the Windows machine what's that thing.
OK.
And you go to the mound.
So here you go.
This is the virus 1 0 1.
OK.
So now we have to go again to the Cally machine and click a handler which will handle that incoming
connection from the compromised target.
Again you double click on this reverse DCP here.
Make sure to select multi hand and make sure you use the same port that we use earlier now recession
has been created and listening to incoming connections.
Now you go through the windows machine and just double click on this virus one.
One thing if you go dark again to the Linux machine you will see that a metal purchase session has been
open and it's important to note here that the icon for the compromise target will change to red.
It means that this target has been compromised.
So what can we do now.
Previously using the metal split we used to end commands in order to manipulate the target system.
But now here it's easy.
If you go to the metal operator session here you can see the list of attacks or actions that you can
perform on this compromised machine for example.
You can browse the files you can list the drives here.
So now you have remote access to the file system of this machine.
You can't as well you can as well of course have the command show.
Let's discover more you can have a screenshot of the current desktop of the compromised machine.
So here you go.
This is a screenshot if the compromised machine has web cam you can stream live data from this webcam
but my current machine doesn't have a webcam.
Another important feature is that you can log keystrokes from that machine.
So the keystrokes listener hasn't been initiated.
If you go here to the Windows machine and type anything Hey hey so does keystrokes has been captured
and displayed here as you can see.
Armitage is a really powerful tool and I just have given you the basics for you to explore more and
learn more.