[Bone85]

Hello,

is it possible to hack a Windows computer over LAN. There are no shared files. And I can't find the computer under net view. SSL Strip + arpspoof doesn't works with Kali 2.0 x64. Because the computer uses Firefox (newest version).

Is it possible get ivisible remote access to the computer. I've full admin access to the router.

Best regards

Bone85

[Ninja_Coder_In_Hell]

You're doing something wrong if you cant find it on the network, especially if you actually have admin access to the router. Basically short of physical access or tricking a user to run something you're going to have to find/use an exploit in windows 10. I don't know of an existing script, and writing one is going to be way beyond your skill level.

Port scanning or knowing some programs he has on his computer could open up access if there is an exploit. For example a exploitable database server has potential. Scan, gather intel and then search for exploits for those ports/services.

Metasploit would probably be a good beginning for you. Speaking of metasploit its pretty trivial to make an infected file (ie pdf or image) but without some coding skills you won't get said file past any good antivirus.

[⒤⒞⒰⒭⒰⒪⒦]

Hello,

is it possible to hack a Windows computer over LAN. There are no shared files. And I can't find the computer under net view. SSL Strip + arpspoof doesn't works with Kali 2.0 x64. Because the computer uses Firefox (newest version).

Is it possible get ivisible remote access to the computer. I've full admin access to the router.

Best regards

Bone85

Code

SSL Strip + arpspoof doesn't works with Kali 2.0 x64. Because the computer uses Firefox (newest version).

That is not true.


Infact you can do a ssltrip and arp spoof attack from any computer/OS.

Be it windows xp-windows 10 or mac/linux it doesnt matter what OS/Bit you are running.


Also it doesnt matter if your target is using firefox newest version. A sslstrip/arp attack will still work on target device no mater what browser they use.

sslstrip/arp spoofing works by running a ssh server on your local system, When doing the arp attack you trick all network systems into thinking you are now the router. By doing so all system and devices will be using your ssh server rather than the defualt one. Because they are using your ssh server to handle the login the data is sent to you in raw form, At which point you forward the data to the real ssh server and get recieved packets so the user can login and make the https/ssl connection.



Anyways long story short sslstrip/arp spoofing will work if target is in the same LAN.

You could also do a dns spoof attack to allow you to force install files on the windows system.


Infact with a dns spoof attack you can trick the windows system into downloading your file over LAN via the windows update service.

[Bone85]

The windows release isn't activated on his computer.

\\192.168.X.X\c$ doesn't work.

[⒤⒞⒰⒭⒰⒪⒦]

The windows release isn't activated on his computer.

\\192.168.X.X\c$ doesn't work.

your telling me target has no set LAN IP from the router/modem ??

If target is conected to the router/modem, And has a IP assigned to the system from the router/modem.


Then you can hack there system if you are connected to this same router/modem.



Just do what is known as a dns spoof attack along with a arp spoof attack.


This will allow it so you can make ANY website the target users views another website.


For example the users opens browser and types google.com
or facebook.com

You can have it so there system browser will load facebook/google as your own custom website or file, While still showing it as the real and correct domain name in the users browser.

Fact is the target user can be on ANY type of OS and if they are on windows it doesnt matter if they have widows activiated yet or not none of this matters.


If target is connected to the same router/modem as you and has a assigned LAN IP you can hack them.


Not by exploiting the built-in windows net tools or network viewers but by exploiting the network itself not the user on the network.

[Bone85]

It has a lan ip. But i can only ping it.

DNS spoof works.

SSL Strip works not.

URL snarf works not.

I used this tut:

"How To: Use SSLstrip On Kali Linux"

on YT.

Maybe there is the failure. I used it same way as discribed. With other IP addresses for sure.

[⒤⒞⒰⒭⒰⒪⒦]

It has a lan ip. But i can only ping it.

ok thats fine

And dont bother with a port scan on target system all ports will be closed thats like a good 80% chance.


Just arp spoof the network and then dns spoof the network, Lookup dns spoofing tutorials there are some here on HF.


if target is connected to router/modem and has a LAN IP which it does as you said you were able to ping it.

Then a arp spoof attack and dns spoof attack will infact work, Why you think it wont work is beyond me.

[Bone85]

DNS spoof works. But I wont read only the web domains, which are requested by the "victim" computer. I want remote access to the computer.

Which exploit of metasploit is for windows 10?

[⒤⒞⒰⒭⒰⒪⒦]

DNS spoof works. But I wont read only the web domains, which are requested by the "victim" computer. I want remote access to the computer.

DNS spoof method.



Trick dns on network so when target goes to say google.com or facebook.com it redirects to your website. Have a website that looks like its a windows update or a browser update that must be installed to keep using and viewing websites.

But really just have this file be a RAT.

NOTE while they are on your fake update website it will still show as google.com or facebook.com in there browser.

DNS spoofing just lets us tell there system what name server belongs to what IP.


Now once user downloads and installs the RAT return the dns back to normal and they can browse those websites agian, And now you also have full remote control of there computer.

---

Which exploit of metasploit is for windows 10?

Dont use a exploit kit or metasploit at all your just gonna be wasting time im tellin ya, Just do a sslstrip or dns spoof attack.

No need to try and find and hope the system has a exploitable service running.

[Bone85]

I have to bypass avira antivir free edition.

The av should not detect the rat. And what's about the certificates. Firefox maybe notice a fake site without legit certificate.

SSLstrip doesn't works, with the tut on yt. The tut is always the same, if you search SSL strip on YT or on google.

There are only failures in the ssl strip log file. There is a theory on web, which says: "If the site is already cached, there is no way that the browser uses the unsecure http protocol."

nmap result on vic computer:

"To many fingerprints match this hosts..."

[⒤⒞⒰⒭⒰⒪⒦]

I have to bypass avira antivir free edition.

The av should not detect the rat. And what's about the certificates. Firefox maybe notice a fake site without legit certificate.

you will be fine give the dns settings are setup right.


I would also look into intercepter-ng

As this program can do everything you want but with a very easy and nice GUI.
And can be run on any OS.

The intercepter-ng app for android is really amazing. For example there browser cookie stealer and cookie injector.


This allows you to log directly into a account the target is logged into without knowing the username/password.

[Bone85]

Why cain and able doesn't works?

There are full and half routes. But no result.

No website (http/https/etc.) logged.

There are only packets from the victem. Nothing more.

[⒤⒞⒰⒭⒰⒪⒦]

Why cain and able doesn't works?

There are full and half routes. But no result.

Cain and able does work,
But it doesnt have a sslstrip tool, Meaning the https/ssl data packets you capture on the network will be encrypted data. So you will have to decrypt the https/ssl packets to get the login data. And this isnt easy as sometimes servers use a custom salt/certificate when hashing the https/ssl data packet, Thus making decrypting it very hard.


sslstrip makes it so the network users use our system to get there data and then we send it to the real ssh server so they can handle it.

---

Why cain and able doesn't works?

There are full and half routes. But no result.

No website (http/https/etc.) logged.

There are only packets from the victem. Nothing more.

is target attempting to view or go to a website while you are running the arp spoof attack doesnt seem like it.

[Bone85]

arp spoof, ssl strip, dns spoof is "working". Where is the result of ssl strip?

There must be preview log under the command line :

ssl strip running....

I dont mean cat sslstrip.log

But there is nothing. And url snarf shows nothing. Only dns spoof shows acitvity.

[⒤⒞⒰⒭⒰⒪⒦]

arp spoof, ssl strip, dns spoof is working. Where is the result of ssl strip?

It writes the data into a file named sslstrip.log

you can view it by typing such in terminal

tail -f sslstrip.log

of course the user has to login to a https website before log will have data.