Hello again, and welcome to the exploitation section of the course.
It is time we learn how to gain access to our target, what we managed to do for now is with the help
of our Linux machine, we managed to identify our target and find out a lot of information about it.
Remember, once we were starting, we didn't know anything about it.
But after with the help of different tools such as and MAP Nessa's what Web and others, we managed
to gather enough information about our target to be able to exploit it.
We have discovered opened and closed ports.
We also discovered services running on those ports, including their versions.
We found out what operating system was our target running.
And we have also tried finding vulnerabilities to see whether the target has some known issues or bugs.
In other words, we performed information gathering, scanning and vulnerability analysis.
Right now, the next step is to use that information.
We have to gain access to our target.
Here is how the process goes.
Imagine this is our target and these are the information that we gathered for it, it is running Windows
10.
We found out it has an older version of Windows 10 that hasn't been updated lately.
We found three open ports and one filtered port.
And we know for sure that one of those open ports has a vulnerable software running on it since we also
performed vulnerability analysis.
Once we found out this information, the next step is to extract useful information from this.
So in this case, what we would find most interesting would be these two facts and outdated Windows
operating system and a vulnerable software on board one, two, three, four.
This is what we will use to attack the target.
We would then exploit the target's vulnerability and gain access to it.
But wait, wait, wait a second.
What do I mean?
We would exploit the target.
How do we do it exactly?
And what is actually target even mean?
Well, exploiting the target, in other words, is using its vulnerability that we discovered to send
something called payload.
What a payload is, is a program that we deliver to the target after the expert, usually this program
is something that allows us to execute commands on target system and navigate through its files and
folders.
Now I know what you're thinking.
It is still a little unclear to you as to how this works.
Exactly.
Don't worry.
In the next two videos, we will explain in detail what exactly happens once we exploit the vulnerability
and what type of payloads exist and which ones we will use the most.
For now, it is important to remember that payload is a program that we drop after exploiting a target
and in a ninety nine point nine percent of cases, this will be a program that allows us to execute
commands on target system or also known as a shell.
The first step would be us exploiting the target and sending our payload with it.
That payload will then be on Target's machine and it will execute once it executes.
What it essentially does is it tells the target machine, connect to that other machine and allow it
to execute commands on your system.
And that other machine would be our Linux.
And the third step is pretty easy, we just send the commands that we want our target to execute.
We navigate through files, run other programs, and in return, Target sends us an output of the command
that we executed.
Picture it like using Target's terminal from our Cal Linux machine.
However, there is one problem with this imagine we have two different targets.
Target aid and target.
And let's say Target A has unknown vulnerability, it is running some outdated software on board Phi
Phi Phi Phi, for example, and in that case, we would do what we just explained, which is exploit
the target through the vulnerability and deliver the payload that will allow us to control that target
machine.
Well, this scenario would only work if the target has a vulnerability.
But what if it doesn't have a vulnerability?
What if all of its softwares are fully updated and secured, what then?
In that case, we would do something similar.
We would deliver the payload to the target just this time, we cannot do it through an exploit, which
also means we can't make the payload out to execute on the target, since once again, there is no expert
that we can do.
We must deliver the payload to target using a different way and also we must make it execute a different
way.
Well, in this case, social engineering comes in play.
We would try to trick the user to open our payload by themselves, they must run it for us.
How would we do that?
Well, we could use different methods of delivering the payload.
We could, for example, use an email containing our payload that perhaps masked to look like image
or a different file type.
We would also make sure that email looks legit and Target doesn't think twice before trying to open
that image.
We could spoof our email address.
So it looks like someone that our target knows.
So they would never think that the image we sent could contain something malicious.
Once they open that image in the background of our payload executes and it grants us access to their
machine without them even knowing it.
This is just an example, there are multiple ways that we can do this, if you were, for example,
physically close to the target, you could infected over USB drive, plug the USB drive in the target
machine and execute payload manually.
But something like this you will almost never do due to a higher risk, of course.
And if you were even able to come close to the target machine, nonetheless, these are the two different
possibilities.
Either target is vulnerable or it isn't.
However, if it isn't, we don't just quit.
We tried different methods throughout this section.
We will cover another big tool that all hackers use, and that tool is called Metal Framework.
It contains thousands of experts and all of them are already in our clinics machine.
All we need to do is learn how to use them and how to run them.
This is something we will cover shortly in great detail.
Let's start taking.