[Mr.Zzz]

In this brief tutorial we will take a look at some of the tools included with Social Engineering Toolkit (SET), mainly we will focus on an easy PowerShell based attack. We will create a PowerShell shellcode file and sending it to a target. If we can trick the target into running the shellcode we will get a remote connection to the victim’s PC.
To start SET from Kali Linux main menu:
Applications>Exploitation Tools > Social Engineering Toolkit
Or just type “setoolkit” in a terminal prompt.
1. Once SET is up select “Social-Engineering Attacks”
2. Select “Powershell Attack Vectors”
3. Next choose “Powershell Alphanumeric Shellcode Injector”
4. Now just enter the IP address of the Kali system and what port you want to use for the Windows machine to connect in on. Usually the default port is 443.
5. Finally SET asks if you want to start the listener now. Type “yes” at the prompt.
It will start Metasploit framework console and SET now creates the exploit code. Then we just need to get the exploit code to the victim system. SET will place the exploit code into the “/root/.set/reports/powershell/” directory. Leave the SET window open and navigate to the powershell directory since you will see the powershell injection code in a text file, called “x86_powershell_injection.txt”. Rename and change the extension from “.txt” to “.bat”. When and whether a Windows PC runs the code, a remote session will open up to your Kali terminal. Then you hit enter, type “sessions –i” and the ‘number Id’ of the open session and you will start the interaction with the victim’s machine. Once a “meterpreter” session is open we can use any Meterpreter command, or just type “shell” to get a remote command prompt.

[05317832892]

So this is just a .bat script that launches a powershell script which injects some meterpreter shellcode?

My preferred way is a powershell stager for empire. A lot more powerful and easier bc no av mess.

[Mr.Zzz]

[quote='ʀᴏᴏᴛᴇᴅ' pid='55719763' dateline='1503822033']
So this is just a .bat script that launches a powershell script which injects some meterpreter shellcode?

Yes, it is!

---

Mr. Rooted,

Can you please show to all of us your preffered way...................you are talking about in my article?
I'd be always very grateful to you.
We are newbies here and we want to learn, thank in advance for your reply

[oscpharder]

Yes it will work on both [Outside the LAN and inside the LAN] Depend on target ip.

But the only problem is here is that nowdays AV becomes smart so attack like this might be fail

As hacker also smart then use smarter way as the above user stated already and try to find that techniques which AV can't detect and nowdays metasploit have those things too

[Mr.Zzz]

oscpharder
thank you very much for your usefull answers.
You're very right about av mess.
I see, you too you are "peasant" even thought willing to help people to improuve their knowledge.
About av mess there should not be problem since Rooted will teach us his preferred way.......

My preferred way is a powershell stager for empire. A lot more powerful and easier bc no av mess.

.........no AV message.

[Faith Connors]

oscpharder
thank you very much for your usefull answers.
You're very right about av mess.
I see, you too you are "peasant" even thought willing to help people to improuve their knowledge.
About av mess there should not be problem since Rooted will teach us his preferred way.......


.........no AV message.

just a reminder, peasant just means you have under 50 posts, nothing more.
i've seen some pretty dumb people hit really high "ranks" in a sense who don't contribute shit, and i've seen people with under 50 completely rewrite older scripts for optimization.

---

as for whatever concerns you mentioned earlier, i don't see anything that is blatantly wrong by any chance. i would like you to go a little more in-depth on things, though. there's no point in making a tutorial if you don't actually explain how things work. think about things like:

>why is 443 the "preferred" or default port?
>why do we change txt to bat?
>show some code snippets from the bat/txt to show what the script is doing
>using external vs internal/private IPs
>how could you now send the file to someone?
>why is the file named "_x86" at the end?

if you don't want to type out super long answers for these questions, it's always okay to reference other tutorials, just throw in a link and say "if you're curious, read here for more."

[Mr.Zzz]

>how could you now send the file to someone?

Faith, my dear,
thank you very much for your time.
Questions you are asking me are good. And when I say that questions are good usually I do not the answers.
But the one I quote it is the very good one. I was thinking too....... and I come out to send it through email. And I want to say more to you.......mail's attachement......and.....hidden behind an image.

What do you think???

Please, let me know your idea.
Many thanks in advance!

[Faith Connors]

Faith, my dear,
thank you very much for your time.
Questions you are asking me are good. And when I say that questions are good usually I do not the answers.
But the one I quote it is the very good one. I was thinking too....... and I come out to send it through email. And I want to say more to you.......mail's attachement......and.....hidden behind an image.

What do you think???

Please, let me know your idea.
Many thanks in advance!

i think that an image does not run as an executable, so you can't hide code behind an image, er, well technically you can, but it won't do anything.

there are of course exceptions to this rule like if you find a vulnerability in the codec, like the old jpg vulnerability that causes a segfault by trying to read/write memory outside of its allocated buffer caused by incomplete headers, but not only do you need to know some extremely low-level code and build your exploit on a case-by-case system, it's incredibly hard to find vulnerabilities like this as well, especially in closed-source software like the jpg2000 codec was (became open sourced shortly after)

[Mr.Zzz]

i think that an image does not run as an executable, so you can't hide code behind an image, er, well technically you can, but it won't do anything.

there are of course exceptions to this rule like if you find a vulnerability in the codec, like the old jpg vulnerability that causes a segfault by trying to read/write memory outside of its allocated buffer caused by incomplete headers, but not only do you need to know some extremely low-level code and build your exploit on a case-by-case system, it's incredibly hard to find vulnerabilities like this as well, especially in closed-source software like the jpg2000 codec was (became open sourced shortly after)

And what about to compress it in a RAR archive?

[Faith Connors]

And what about to compress it in a RAR archive?

you need to make it a sfx archive (self extracting) which still makes it an exe, thus not being able to send/receive by most major email providers.

[Mr.Zzz]

you need to make it a sfx archive (self extracting) which still makes it an exe, thus not being able to send/receive by most major email providers.

If you embedded it in a new folder then you compress, change extension in .a instead of .rar (it is still able to be opened) and finally you compress all for the last time......Bhe....sometimes it is not detected by ISP.


You are very right because it is not self-extracting. How can I manage it?

cheers!!!

[Faith Connors]

If you embedded it in a new folder then you compress, change extension in .a instead of .rar (it is still able to be opened) and finally you compress all for the last time......Bhe....sometimes it is not detected by ISP.


You are very right because it is not self-extracting. How can I manage it?

cheers!!!

by isp? i think you mean by av because your isp won't give a fuck if you get hacked lol

and yeah, but the point of doing anything like that is to have a one-click way of infecting someone, just by them opening a file, not opening a file in a file in a file which in turn they have to execute. looks too fishy on its own. that's why pdf/xls/doc exploit builders exist, so you have one file which can infect a computer after opening once.

[Mr.Zzz]

Ciao Faith

I mean gmail, yahoo etc...etc


I can always say that it's a compromising video, very long and heavy 🤭🤭🤭

[Faith Connors]

Ciao Faith

I mean gmail, yahoo etc...etc


I can always say that it's a compromising video, very long and heavy 🤭🤭🤭

people won't look at an exe file and say "wowo cool video"
at least if they're not over the age of 80 or under 6.
also should be mentioned .rar files won't open natively on windows.

[Mr.Zzz]

people won't look at an exe file and say "wowo cool video"
at least if they're not over the age of 80 or under 6.
also should be mentioned .rar files won't open natively on windows.

YOU'RE GOOD!, YOU'RE VERY GOOD!!, YOU'RE VERY VERY GOOD!!!

Thank you 😉😉😉