In this lecture we're going to take a different tree for using Armitage.
Let me give you a small scenario assumes that we have a victim machine.
This is a window server could be on the server an Android device you know as I keep saying the concept
apply to anything but assumes that I have here a server and I did some research but I was not able to
figure out which exploit I can use.
I mean it's different than the previous case where I knew that there is one vulnerability or one exploit
that can be used.
We choose our PCG com but in my case right now I have a victim.
I know that he got Windows Server 2003 except I don't know exactly which version which exploit I can
use to exploit any vulnerability here and get access.
Can I automate it.
Can I make Armitage search for the right Vernon for the vulnerability and the right exploit on the victim
instead of doing that myself.
So I don't have to go exploit TBN search and I don't have to go to security focus on search.
Actually we can.
Let's see how we can do that.
So we have our victim machine here and the victim machine.
I only know the IP which is 1 9 2 1 6 8 2 1 2 1 1 3.
I'm gonna assume that I even don't know the operating system.
Excellent.
So what I'm gonna do I'm gonna go here with me to Armitage and we gonna go to host And I'm gonna click
on Add host and I can add one machine or more I can even add the network to full network and he will
scan all of them and try to compromise them.
So I'm gonna add one machine which is my vector machine I one more time I'm gonna assume that I don't
know even the operating system.
I only know the IP 1 1 3 and you can add more IP if you want or a full network.
But in my case I'm only gonna add one IP and he can add the machine here.
And as you can see it has a black screen that's mean you don't have any information about the computer
on his IP and Armitage cannot discover anything right now.
Then you can go to host one more time and do and map scan.
So instead of scanning your self you can turn and map scan and type intensive scan and click on enter
and he gonna verify the IP.
Yes is the same IP and click on okay.
Now this may take time not too long but as you can see down his scanning the uh he's scanning the victim
trying to discover what operating system what port what services and so on while I'm doing that.
Please check on the right when you right click on the computer only find two option services and scan
and host where you can remove those.
So you only have three options here because this will change within few minutes and I'm gonna wait until
you finish scan how I'll be knowing that he finished scan.
Besides following up down here once the scan is finished you will see that there will be a logo on the
screen instead of having a black screen.
It will be maybe a windows maybe a Linux so you'll find the logo change here indicating what operating
systems a machine have.
So while he's doing scan he will discover the operating system and he will give you a logo on the machine
here.
So let's give him a few seconds or maybe minutes
I know if I should pose because this may take time or let me wait for like 30 second more.
If he's taking longer time I'm gonna pause until he finish but how I'll be knowing that he finished
once the logo of the operating system will show on the screen.
It seems that he finished
but was taking.
Okay let's go to host one more time and let's ski.
Let's see if we need to do any other scanning.
Because the regular scan should get the operating system.
Let me do a quick scan as well.
Yes.
Quick scan with operating system detection.
You don't have to.
And let me writes IP 1 9 2 2 1 6 8 1 0 1 1 3.
Now you don't have to rush the process back.
Be patient because as much information as you can get about the victim molecular you are not the one
who's getting the information you are letting Armitage get things information for you but spending some
good amount of time doing that.
This will help the Armitage to find the right vulnerability and right exploit.
As you can see he finished and the operating system has been showing on the computer.
Its Windows XP.
Sometimes you know it.
He will give you the category could be explorer 2003 or 7 and 2008.
So it doesn't matter.
But since he was able to discover roughly what is the operating system.
Excellent.
Second part.
After discovering getting support and the operating system I would go to attack and I'm going to click
find attack and he will start searching the machines that we edit or the host that we edit what attack
can be implemented.
So he's checking in his library according to his info to the information that he gathered.
What attack can be implemented.
Can we do this attack.
And we do that attack.
So he already have information and he's searching according to that.
If you didn't do the scans the first time he will not be able to search because he has a big library
to search from.
So he said Okay I find somebody nobility and I selected for you some exploit to be used to hex was vulnerable.
If you right click right on the computer you'll find a new menu called attack.
Those are the exploits that he found and you can try.
Not all of them will be working but you can try.
So let's take the first one.
Let me try this one which is still is our P.S. One more time.
Let's see if it's going to work or not because he didn't add Jules Verne ability randomly he adds.
According to the scan that he did and he said most probably this may work those for nobility and expert
let me try this one.
So you click on it.
Now you don't need to change anything because all the information out there and you click on launch
if you get this red frame that's mean it has been compromised.
Excellent.
If not you try another one.
If not to try sorted one.
And so on.
So as you can see the first one was successful.
Now I have a method protestation to this machine where I have a full access and I can you know browse
gets a desktop do whatever I want on this machine.
Let me try to do something desktop fiancee if I need to get the desktop access on the server
if it's going to work or not I dunno why.
Yeah.
Here you go.
It's not talking.
Let me try another one.
Interpreter.
Uh interact.
Let me see.
Let me get the shell where I can types a comment myself.
So it should show down.
But the point.
Here you go.
So you have a shell on the machine.
The point is this is a different way for using Armitage.
It's it's a more smart way a smarter way.
In a way in the sense of I don't have to spend time searching for scanning first and then searching
for vulnerability and searching for exploit.
No no you can uh let this application Armitage two guys are this kind of information to look for the
weakness and inability to suggest what exploit can be used from his library.
And then you just right click on it and get my advice to you.
It's to not count on only one method I explain three different methods etc. meet exploit Armitage and
using Armitage in a different way.
I suggest that you should be familiar with all the method because sometimes this one will not work.
You should try another way but if you limit yourself to only one way.
I don't think this would be that effective.
But after all the objective of this scope is to show you the exploitation framework and how it can be
used.
Next sections will be more into the attacks itself and mainly Android attacks we're going to see how
to hack Android devices smartphone or tablet using different attack.
But the attacks that we going to implement will be based on this section and previous section so the
objective was to learn the tools first and then go through the attack.
So we're going to have a section related to hacking Android device and then another section which is
hacking with Android device.