Fast-Track Metasploit Autopwnage.By VipVince.
I have made several small changes and tweeks to this tutorial.
I was in two minds about sharing this information, cause the reality is, its easily done, works, can cause alot of damage, and in the hands of a script kiddie could lead to comprimised systems.
So to start of, locate Fast-Track..
Backtrack - Penetration - Fast-Track - Fast-Track Web GUI.
This will begin to load the Web App, wait several seconds, dont press anything and it will open an internet browser for you with Fast-Track.
[img]http://i205.photobucket.com/albums/bb181/1-VIP-/snapshot2.png[/img]
Select option from the list, 'Autopwn Automation', then scroll to the bottom of the Web page and you will see exactly what the screen shot below displays.
[img]http://i205.photobucket.com/albums/bb181/1-VIP-/snapshot1.png[/img]
It will then ask you for an IP address, you can put in the IP of a remote host to scan and exploit, or an entire network to scan and exploit eg 192.168.1.0/24
The handy but dangerous thing about this tool, is the fact that it takes next to no user input, once you specify the IP, and payload type online, the scan starts automatically, the Nmap commands are automatically typed out for you, once the Nmap scan finishes, the Metasploit Autopwn commands are also automatically typed out for you. All the attacker has to do is sit back and wait for the terminal to display the results.
For this attack, I am using the IP of a personal friend, he is aware the attack is underway, and in the end even gives me a screenshot of his firewall detecting the intrusion attempt lol.
So I specify the IP, then click the Metasploit Autopwn button, now at this point, no more user input is required, a terminal screen appears, and all the Nmap and Metasploit commands are typed out automatically.
Below shows it creating the database, and executing the commands for the Nmap scan.
[img]http://i205.photobucket.com/albums/bb181/1-VIP-/1-5.png[/img]
We simply have to wait now for the scan to finish and results to be displayed.
[img]http://i205.photobucket.com/albums/bb181/1-VIP-/3-3.png[/img]
The scan results show the victims host has some interesting ports open, I repeat do not press anything, this whole attack requires no user input in the terminal screen, as you can see at the bottom of the screenshot image, it has typed out the autopwn commands for us, lets just wait for it to execute.
[img]http://i205.photobucket.com/albums/bb181/1-VIP-/snapshot7-1.png[/img]
Boom the exploits are running, Metasploit is matching all the exploits in its database against the open ports, if it finds a vulnerable port, it will run a suitable exploit against it, and get for us a Meterpreter session (entry to the computer).
In this case it was just a demonstration, my friends Pc is not vulnerable, I knew this before starting the attack, I was simply using his machine to provide a visual guidance. Hope you enjoyed. Dont abuse this powerful and easy to use feature.🤝
Ps he sent me this after the attack lol.
[img]http://i205.photobucket.com/albums/bb181/1-VIP-/attack-1.jpg[/img]
I have made several small changes and tweeks to this tutorial.
I was in two minds about sharing this information, cause the reality is, its easily done, works, can cause alot of damage, and in the hands of a script kiddie could lead to comprimised systems.
So to start of, locate Fast-Track..
Backtrack - Penetration - Fast-Track - Fast-Track Web GUI.
This will begin to load the Web App, wait several seconds, dont press anything and it will open an internet browser for you with Fast-Track.
[img]http://i205.photobucket.com/albums/bb181/1-VIP-/snapshot2.png[/img]
Select option from the list, 'Autopwn Automation', then scroll to the bottom of the Web page and you will see exactly what the screen shot below displays.
[img]http://i205.photobucket.com/albums/bb181/1-VIP-/snapshot1.png[/img]
It will then ask you for an IP address, you can put in the IP of a remote host to scan and exploit, or an entire network to scan and exploit eg 192.168.1.0/24
The handy but dangerous thing about this tool, is the fact that it takes next to no user input, once you specify the IP, and payload type online, the scan starts automatically, the Nmap commands are automatically typed out for you, once the Nmap scan finishes, the Metasploit Autopwn commands are also automatically typed out for you. All the attacker has to do is sit back and wait for the terminal to display the results.
For this attack, I am using the IP of a personal friend, he is aware the attack is underway, and in the end even gives me a screenshot of his firewall detecting the intrusion attempt lol.
So I specify the IP, then click the Metasploit Autopwn button, now at this point, no more user input is required, a terminal screen appears, and all the Nmap and Metasploit commands are typed out automatically.
Below shows it creating the database, and executing the commands for the Nmap scan.
[img]http://i205.photobucket.com/albums/bb181/1-VIP-/1-5.png[/img]
We simply have to wait now for the scan to finish and results to be displayed.
[img]http://i205.photobucket.com/albums/bb181/1-VIP-/3-3.png[/img]
The scan results show the victims host has some interesting ports open, I repeat do not press anything, this whole attack requires no user input in the terminal screen, as you can see at the bottom of the screenshot image, it has typed out the autopwn commands for us, lets just wait for it to execute.
[img]http://i205.photobucket.com/albums/bb181/1-VIP-/snapshot7-1.png[/img]
Boom the exploits are running, Metasploit is matching all the exploits in its database against the open ports, if it finds a vulnerable port, it will run a suitable exploit against it, and get for us a Meterpreter session (entry to the computer).
In this case it was just a demonstration, my friends Pc is not vulnerable, I knew this before starting the attack, I was simply using his machine to provide a visual guidance. Hope you enjoyed. Dont abuse this powerful and easy to use feature.🤝
Ps he sent me this after the attack lol.
[img]http://i205.photobucket.com/albums/bb181/1-VIP-/attack-1.jpg[/img]
