Another way to compromise the target systems is to send the malware as a browser add on, you can use
metastable framework to prepare malicious Firefox add ons and serve them from a server.
Select the exploit and the payload, then set the options when you run the exploit.
It starts a handler, as well as an application server to release the add on as soon as the victim allows
you to install the add on, you'll have a session of his or her system.
Let's see how to prepare and use malicious Firefox add ons in Calli, start the Métis Floyd framework
using MSF console command in the terminal screen.
If you do not necessarily know the exact name of an exploit, you can use search command to find it.
Use the exploit with the use command.
List the payloads that you can use with this exploit, show payloads.
Let's select a shell payload with the reverse TCP connection.
Now, look at the options of exploit and payload using the show options command.
Server host is the server where an application server will be started to serve the add on in this example,
it's our call machine.
Server port is the port that the Web applications serve.
You can choose 80, which is the default port of the HTTP protocol.
Yurie path is the path of the payload.
Now set the options of the payload listener host again, our candy machine is in this example.
Listen, a port is 44 44 by default and change it if you want.
Now we are ready to run the exploit when you run the exploit.
A reverse TCP handler on Port 44 44 and an application server serves on Port 80 80 is started.
Let's test if the application is alive, copy the oral.
And pasted in the address bar of the browser.
It seems everything is OK.
In Windows System, which is the system of the victim, run the Firefox.
This is the Firefox version 57.
Now we're going to send a phishing email which contains a link to the add on we prepared in this example,
I use the Yop mail dot com service to send the phishing email to the victim.
Yop Mail is the disposable email address service, which does not require a sign up and provides access
to any email address in the form of any name you want at your mail dot com.
In the attacker system, Calli, prepare the phishing email and send it to the victim.
The victim opens the email in his or her Firefox browser, which is the latest version.
When the victim clicks the link, a warning message which says Firefox prevented this site from asking
you to install software on your system appears if you click the install link directly in the website,
nothing changes.
You're not allowed to install the ad on starting from version 41, Mozilla decided to allow plug ins
only if they're signed and verified by Mozilla.
But don't worry, you'll probably find systems that use Firefox older than Version 41.
Let's repeat our test with an older version of Firefox.
Download an earlier portable version of Firefox.
I chose version 46 for this example, install it and run.
You are now using Firefox version 36.
Go to the mail service of the victim.
When you click the link, Firefox again prevents the site to ask to install software.
In this time, though, clicking the allow button brings you to the software installation window, click
the install now button.
You see the message that the installation is successful.
Go to the listener now, which is our COWEY machine.
Looking at the listener terminal windows, you see that a session on the victim's computer is open.
Go to the session using session dashi session ID come command because we used a shell payload.
We have a special session at this time, not an interpreter session, and we can use all the commands
of the victim's computer.
Since it's a Windows system, we can use Windows Commands right now directory to list the files of the
current folder.
Who am I to see the active user?
IP config to see the IP addresses, et cetera.