Hack Like a Pro: How to Pivot from the Victim System to Own Every Computer on the Network « Null Byte :: WonderHowTo

Welcome back, my hackers apprentices!To own a network and retrieve the key data, we only need to find ONE weak link in the network. It makes little sense to beat our heads against heavily fortified systems like the file and database server when we can take advantage of the biggest weak link of all—humans.Somewhere on the network, some clerk with little work to do and lots of time to play on the Internet can be enticed to visit ourmalicious website, open ourmalicious Word doc, or view ourmalicious PDF.Once we compromise this single target on the network, we can then pivot from that single compromised system to own the network and ultimately grab the goodies on the server or database server.In this tutorial, we will look at how to pivot from a single compromised system on the network to compromise and own the most heavily fortified servers on the network. Once you find that single weak link, then you go after the BIG BOYS!Step 1: Compromise a ClientThe first step, of course, is to compromise a single machine on the network. In the diagram above, let's go after someone in the engineering department. We can do this by sending them amalicious link,PDF, orWord doc, or by going after anunpatched operating system. Any of these andmany otherswill work.In my case here, I'm going to use a malicious link and send it via email to one of the people on the engineering department with a note that says it's a "hilarious video" they need to see. Let's create that link.Step 2: Open MetasploitFire upBackTrackand open the Metasploit console.Step 3: Choose an ExploitIn this case, I am using theie_unsafe_scriptingexploit, but any exploit will work. We simply need to find ONE system on the network that is vulnerable to own the entire network.If you are unsure about how to do this, take a look atthis tutorialor thisthis guide. Either will work, as well as many others.Step 4: Get MeterpreterOnce the victim opens the malicious link, we get a meterpreter prompt like that below. From the meterpreter prompt, we can type:meterpreter > ipconfigThis will reveal to us the network interfaces on our target system and the IP and MAC addresses associated with each of them. As you would expect, Interface 1 is the loopback interface, and in this case, Interface 2 is associated with IP 192.168.1.101.Your results may be different based upon the configuration of the compromised machine.Step 5: Scan the NetworkNow that we are inside the network, we can use an auxiliary module in Metasploit calledarp_scanner, which enables us to use the ARP protocol to discover other internal systems on the network similar tothe Netdiscover tool. Let's type:meterpreter > run arpscanner -hThis gives us a help screen for Metasploit'sarp_scanner.Now to run thearp_scanner, we can type:meterpreter > run arp_scanner -r 192.168.1.0/24Where:runis the command to execute internal meterpreter scripts-rprecedes the target address range or CIDR notation network192.168.1.0/24is the CIDR notation to include this entire internal Class C network with a netmask of 255.255.255.0Running the arp scanner reveals all the systems on the internal network. For our purposes here, the default gateway at 192.168.1.1, is probably the most important.Step 6: Add a RouteIn the final step, we will background our meterpreter session (this simply puts our meterpreter session into thebackgroundmeaning it is still running, but we can go back to the metaspliot console and run other commands). Then we would add a route from the default gateway to our compromised system so that ALL traffic from the default gateway must be routed through the compromised machine.In this way, we will have access to all systems and subnets that access that default gateway, enabling us to compromise them as well.Now that we have successfully added the route between the default gateway and our victim computer, the network is—for all intents and purposes—OURS! We can now use that single compromised machine to attack all the systems on the network both within the engineering subnet and all the subnets that use the default gateway.Of course, to own those machines, we will have to take the final step of running an exploit against each of those machines, but we will no longer have to be concerned about Intrusion Prevention Systems (IPS) and firewalls as we are now attacking from INSIDE the network!Keep coming back for more adventures inHackerland!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseConnected computersimage via ShutterstockRelatedHack Like a Pro:How to Remotely Install a Keylogger onto Your Girlfriend's ComputerHack Like a Pro:Use Your Hacking Skills to Haunt Your Boss with This Halloween PrankHack Like a Pro:How to Spy on Anyone, Part 2 (Finding & Downloading Confidential Documents)News:White House Hacked by Russian Hackers!How to Hack Windows 7:Sending Vulnerable Shortcut FilesHow to Hack Like a Pro:Hacking Windows Vista by Exploiting SMB2 VulnerabilitiesHack Like a Pro:How to Save the World from Nuclear AnnihilationHack Like a Pro:Exploit MS Word to Embed a Listener on Your Roommate's ComputerHack Like a Pro:How to Secretly Hack Into, Switch On, & Watch Anyone's Webcam RemotelyHow To:Use SSH Local Port Forwarding to Pivot into Restricted NetworksHack Like a Pro:The Ultimate Command Cheat Sheet for Metasploit's MeterpreterHack Like a Pro:How to Remotely Install an Auto-Reconnecting Persistent Back Door on Someone's PCHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Execute Remote Commands on a Disconnected VictimHow To:Use Remote Port Forwarding to Slip Past Firewall Restrictions UnnoticedHack Like a Pro:How to Get Facebook Credentials Without Hacking FacebookNews:'Please Like Me' Embraces Awkwardness of Growing Up (Sponsored)Hack Like a Pro:How to Cover Your Tracks So You Aren't DetectedHack Like a Pro:How to Remotely Record & Listen to the Microphone on Anyone's ComputerHack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHack Like a Pro:How to Create a Nearly Undetectable Backdoor with CryptcatHack Like a Pro:How to Create a Nearly Undetectable Covert Channel with TunnelshellHack Like a Pro:How to Remotely Grab Encrypted Passwords from a Compromised ComputerHacker Fundamentals:The Everyman's Guide to How Network Packets Are Routed Across the WebHack Like a Pro:How to Spy on Anyone, Part 1 (Hacking Computers)How To:Bypass a Local Network Proxy for Free InternetHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceHow To:The Official Google+ Insider's Guide IndexNews:What does Pro Tools HD Native mean for you?How To:Use Google Voice to Prank Your Friends on April Fool's DayMake a Physical Computer Virus:Plant a Parasite to Prank Your PeepsHow To:Noob's Introductory Guide to Hacking: Where to Get Started?News:Bugzilla Cross Site Request ForgeryHow To:Spy on the Web Traffic for Any Computers on Your Network: An Intro to ARP Poisoning