As an exercise will we use the meadow split platform or more precisely one of its components called
Set choose exploration tools.
Then in the section social engineering tools you'll find the app
set facilitates social engineering attacks.
When you convince the user to start a program they get from you.
You then have to send them the program since to be the hardest part to set.
This can be largely automatic.
You have to make just a few clicks.
By pressing one you choose social engineering attacks.
So it will help us create a malicious payload.
We'll use it to then send very personalized emails to specific people.
Social engineering toolkit creates programs that establish a callback connection with a specific computer
when the addressee of the automatically generated e-mail opens the message.
It will start a program that will establish a connection with your computer this in turn will give us
remote access to the victim's computer with the same user privileges as the victim has
choosing the third option from the list will generate a program that can be saved to a memory stick.
The program has two obstacles to overcome.
The first is an end of virus scanner running on a targeted computer.
The firewall is the second
the network firewall is usually set to issue a warning in the case of any outgoing connection such warning
messages are meaningless for the average user.
It's as if they were saying something's trying to interrupt you.
Would you like to continue trying.
It's obvious that the user will choose an option that will ensure no more interruptions.
Just in case to conduct the attack we'll choose the first option provided by set.
That is file format exploits.
This will utilize a program already installed on the victim's computer.
The program will establish a callback connection with us
after choosing an appropriate option.
We have to type the public IP address of the computer which will be used to conduct the attack this
of course will not be the address of our computer but have some public server which we've already gained
control over.
It must be a public IP address otherwise the attack will be unsuccessful.
We typed one hundred one hundred one hundred one hundred.
This is of course a non-existent address.
The next step is to select one of the payloads which is a functionality allowing us to establish a remote
callback connection.
You can choose from a list of errors pertaining to well-known programs such as the Adobe suite and mess
office suite.
Or you can choose a solution created by the offers of the set framework
let's choose option number one
all of this will result in the remote callback connection.
It can be a TCAP connection.
That is a Windows command line or met a split console or other solutions presented in the picture.
Option number 2 is usually preferred but we will choose option number one.
Most likely we managed to get past the firewall.
We still need to be at the antivirus having convinced the victim to take our memory stick and take a
look at our exquisitely interesting pictures.
We don't want an end or virus message to run our efforts.
This could make the victims suspicious.
We have to encrypt the payload so that the virus won't detect it.
We can choose out of 16 encryption mechanisms.
Let's choose number 16.
Then we have to choose the part of the listener.
The files are being generated.
We will now start a program that will enable us to check the results of our work.
Let's open the exploit directory in the Penn test folder
in the Sent folder a new directory order run was created
our payload is almost generated
we still have to choose the attack method we will choose option one that is Windows Address Book we
will choose the default name.
Open this and we will compress the file into a rar archive
jotter one folder now has all the files we need to copy on the memory stick.
Now you just have to give the memory stick to the victim.
If you find a memory stick near a school university or a company connecting it to your personal computer
is not the best idea.
It takes about five minutes to generate a malicious payload and copy it on a memory stick.
In the middle of 2010 such files were found on brand new memory sticks manufactured in China.
If you plugged one into a computer it started an auto run IMT file containing a malicious payload.
It was a wide scale issue.
The memory sticks couldn't have been infected with malicious files generated by the crew of the cargo
ship by means we've just presented
it must have been done either at the factory where the memory sticks were manufactured or by one of
the distributors.
This shows that not every opportunity is as favorable as it may seem.