Hello everyone and welcome back to pause.
Eighteen of my land ethical hacking course is probably going to actually combine our payload and b fork
together.
So we're going to gain full access over someone's computer using beef and our payload together.
This is very effective.
And it's also very useful because this beef hook is like an access point and then our payload or our
rootkit will be offloaded to the server or the victim's computer in this case which will give us full
access because that will have persistence etc.
Plus there are more commands that you can do with a payload than you count and you can't.
With beef so I'm going to keep this terminal window open because this is the beef terminal window open
Terminator and I'm gonna start Hercules because we need to create undetectable payload similar type
Hercules this will start the Hercules framework will generate a payload will generate we base each TTP
some really matter which one as long as the one that you use works for you.
So 1 and 2 don't 1 6 8 this is my server's IP address one tender 1 2 8.
We're going to use 80 80 for the port.
We're going to we're not going to add persistence in this case and just for demonstration purposes we're
not going to add migration and this can be called update.
So it's going to just compile it.
We're not going to compress it.
They would go.
It's been created was compiled into data access so this is our payload.
This payload has been generated to our root directory which is right here.
Here's the file.
So when I open a new window I'm going to go to our service directory which is in route var and then
w w w h demo then I'm gonna upload our payload to this server.
They would go so we've uploaded our payload we've got a client or zombie hooked because this big machine
is still on our blog so it's on our blog which is on the server and it has sorry has the script already
on this website so we can let's use a fake notification bar so we'll go to social engineering not persistence
and we'll use fake notification by Firefox instead the plugin you are L we need to have the direct download
link for our payload which was called update don't axes so we need to type each TTP 1 9 2 to 1 6 8 again
this will be different for you obviously and then at the end of the last IP or the last digits of the
IP address you need to type for such updates WFC this depends on what you called a.
So I called it data axes so I'm going to type of data are you actually here yours might be called New
it could be called new update in fact anything you wish as long as you got a direct download for free.
So essentially the issue RL is going to our server but then it's trying to access this standalone file
when I change the notification text to critical critical of day required Quiet
please.
I'll take please update to continue
using this browser safely
then I'll click execute we go to our victim's computer we'll say critical update required so they panic
and then they end up clicking on install plugin it's gonna install update Don't you see we'll go back
to our Kelly machine and we'll open a new well we'll split this horizontally and I'll start MSF console
0 console.
Make sure you spell it right this will stop the MSF console.
In fact I can close out that now because we've already increased our payload with Hercules don't need
this window open.
Make it less complicated.
Closed this terminal window.
There we go it's not in the meat display frame where console because we don't want to run this just
yet because we're not listening for a connection on the same port on the same host.
So we'll just wait for me to split to actually start.
Meantime you can send something else so you could listen to today web come and see what they're doing.
See there's different camera exploits this we could redirect them to different Web site.
Now as long as they install this update so let's incorporate them pretty theft and we'll get the Facebook
just to show you how you would sort of use this.
So we'll just execute this go back to our prison and they have username at Facebook dot com and then
they enter their password which is password and click logging go back and we should have used our Facebook
dot com as the username and password as password.
So we got their Facebook and they're about to run our payload but we need to listen to it you need to
use the exploit.
So it's exploit Malte and then handler use the multi handler module then we need to set the payload.
We'll set this payload to windows.
Let's say it puts a reverse underscore TTP because that's the one we used for the payload when we generated
it.
We need to set the Al host to the IP address of the server the local server Apache to server 1 9 2 0
1 6 8 1 10 to 1 2 8 will set the output 80 80.
I believe it was that we just Oh I think I've closed it but I think I used ATC click enter if I haven't
I will change it and then we'll show options to make sure everything's updated there we go now we can
just type exploit click on we'll listen for a connection on the reverse HDTV handler so we you started
the hate TTP handler.
Now if they run this file it's fully undetectable by antivirus is by the way.
So no antivirus will actually pick those up windows protected U.P.S..
Now this is not an antivirus message.
Windows Defender will automatically remove and delete a virus.
So this is not an anti virus message and this is just a man.
It's just a notification to the use of this application as an unknown publisher.
It's not very commonly downloaded now.
It's the reason they're getting this message but it's not an antivirus message.
That's important to understand.
So we're just gonna click Run anyway and if we go back to our color machine we can see that we've actually
got a meteor puts a session opened.
So now if we type this info we've got full access their computer now beef is pretty much done its job.
You can actually just close out of beef now as they could end up going off beef so they could go to
Google they go to Google and beef is no longer usable.
But now we've got a payload or rocket installed to the computer or a server so we can take a screenshot
see where it is or see what they're actually doing search say to our route which will be in here and
what's it safe under wide D.
There we go it's this one here.
So I've got a screenshot of their desktop and see what they're doing.
Now this attack and all these videos are on the same network.
So these computers connect is the same Wi-Fi spot on a conscious web because they don't have one connected
but we can type I believe it's held.
I think it might.
There we go.
Password database commands we can hash stomp dumps the contents of the some database.
Let's have a look what we can actually do.
Yeah there's a record microphone with the webcam list webcam chats.
I don't know what that those we can play video stream will go up.
We can start a key scan so we can start captions screeched a screen.
Oh no sorry.
CAPTION keystrokes.
Is a key logger basically.
We can also kill sea and processes.
So this loads f things now we've got basically our rape uploaded.
So let's start a key scan key scan on this score starts.
So if you go down to the bottom of this terminal we'll type key scan undisclosed start starting this
keystroke sniffer so it the day and then if we go to let's go to Facebook we click enter we'll go to
Facebook we log in.
Not gonna log actually a log in but we'll type test against or test one two three at g g mailbox com
and the password will be one two three four five six o'clock and that's obviously not going to work
Facebook is going to say hey that's not an account
Okay that was an actual account.
Page provide your date of birth.
Oh.
Oh okay.
I did not actually know that this was a real account.
Okay.
That was quite strange.
So test at gmail dot com.
One two three four five six is actually a Facebook account.
Well there we go.
We'll just keep logs anyway so we'll better stop because we'll have too many.
Now let's have a look what it was to stop its its key scan when the schools stop.
Which makes sense because we started it would start they would go was stopped and we'll just dump it
now.
So we've done everything we know it's dumped it.
Oh.
Incorrect function as a key scandal in school.
Dorm should have actually saved
him to show why that hasn't saved a key.
Undisclosed dump.
Left to find out why.
That's no way I can but you can get the idea.
Let's try again that's failed.
Okay.
I'll have a look at this.
I'm not sure what the problem is but I think he's got the idea.
We do have full control over the computer.
We can kill processes.
We can do many different things.
If you type kill let's see what happens.
So kill and then.
Yeah.
The PD PD I'm sorry.
Basically that's like using the.
What's it called Task Manager so you can just kill certain applications.
I think it's to be stopped the case if I'm just wondering why it hasn't actually dumped them.
I will find out the reason for that though.
You'll find the explanation in the description but that's it for the video.
So we've got full access over this computer.
If it did help please leave a light comments if you stuck with anything I'll be happy to help.
Subscribe for future content and I will see you in the next video.