We saw in the previous lecture how to use the social engineering toolkit to capture credential from
any Web site.
And we saw how easy it was.
And it's not detectable by any antivirus or any protection.
In this lecture I'm gonna see how to use the same tool but to compromise the full system.
What we'll do what we'll be doing during this lecture is that we will create a fix Web site and we are
going to invent a malicious code inside.
And if anyone opens a specific Web site the malware or the payload or the malicious code will be installed
on his computer giving as giving us full access to the computer.
Now this used to be very complicated to do but using a social engineering tool kit it becomes very easy.
So let's see how to do that and let's see what is the capability of social engineering to get so we
can go here to clinics into exploitation tool and we can choose social engineering to get set.
And let me just increase the screen so go to view zoom in.
OK now one more time I'm going to choose a social engineering attack.
Number one then the Web site attack vector number two on the previous example you took the credential
harvest.
Now we're gonna take the java applet attack and Java applet attack will create a fake Web site with
a payload inside.
So once you click enter he will ask you okay.
You're going to create a fake Web site.
You like to clone a Web site in the sense that.
Would you like to choose which Web site to clone or to copy.
Or would you like to use the Web template so for simplicity we're going to choose what templates and
I'll choose for instance.
Yeah.
The second question is asking about do you provide that.
Now this should be used in case you are doing this attack remotely.
And by the end of the course I will add to lecture showing you how to do the same attacks but remotely
not on the same network.
So if you do the attack remotely I mean you need to provide a link for user outside your network to
access and then you can compromise the system you choose yes.
But since we're going to do that right now in our line we going to type no click onto the second step.
This would be a reverse connection in the sense that once the victim would open this Web site he will
be connected to us.
And it's not that we will be connected to him and this is to bypass the firewall because the firewall
usually are denied or are blocking any traffic coming from outside into inside.
So if we tried to connect to the victim most probably we will not be allowed one if we do a reverse
connection.
I mean the victim is trying to connect it to us.
Most probably he will be allowed.
So this is a good technique for bypassing the firewall.
So what we need to do here is to put or to write down your local IP which is your can in Linux IP.
So let me check my IP here.
Let me open a terminal and type
I f conflict and as you can see is the IP is 1 9 2 1 6 8 1 6 3 3 1 43.
So going back here and let me write so local IP 1 2 1 6 8 2 1 6 3 2 1 4 3 then.
Now this is very important actually that the attack depend on that when the user tried to open a link
at will you would send you that he will receive by email or para initiating application or anything
he will receive a message saying that the Java is not updated.
Good luck to each other.
Now this message.
It can be signed in the sense that it can be trusted.
And those are some free signatures that you can allow or free certificates that you can allow on this
message so it can bypass the protection but you can buy a paid one.
And the message will not even show.
So whatever we're going to use here
it can be done in a better way.
But then you have to spend some money.
So let's do the free one right now and let's seize the capability.
So I'll use the set applet built in certificates one which was number two.
Then what to do like the page to source out of the template Java required Google Facebook Twitter.
Let me let me take Java requests
you can try different one of them gestures.
Then he started building this payload.
Now what would you like this malware or this virus to do what you would like the panel to be inside
you like this payload to create a remote account to select the spirit to give you a buying connection.
The best one to choose is to have a Windows reverse DCP interpreter which will allow the victim to connect
back to your machine.
So in this case I'm gonna ask him that choose the payload that connect back to my computer.
This is a very important step and I think while you are trying this attack you need to try some of those
because this will be a malicious code or a program inside the website that will run.
So most probably if the victim has a antivirus he will detect that some application is trying to run.
So only way to bypass it is to encrypt this malicious code or this malicious executable.
So those are some type of encryption.
Some of them are working with.
I mean can bypass different kinds of antivirus.
We have to test this one can bypass Norton or McAfee or Kaspersky.
This one can type.
Can can can bypass switch on.
So you can try according to the information that you guys have about your victim and which antivirus
he's using.
If he's not using an antivirus to actually you know this will not be a problem at all.
So I'm going to use number one.
And then the listener port since the connection will be a reverse connection in the sense that the victim
will be connected back to me.
So I need to have an IP and port I already roads IP of my vector machine which port should use I'm going
to keep the default she's for 4C and he's going to start building a fake Web site and he can start and
bending this malicious code inside it may take a few seconds or minutes.
Now the thing about this attacks that it may or you may try to use it more than one time.
I mean sometimes it's not working from the first time to try another attack.
So it's an attack that you need to get familiar with and choose different kinds of payload or different
kinds of encryption.
So he's building the payload right now
may take a few minutes.
So let me pause until they finish.