SEToolkit – Hacking Windows Machines Infectious Media Generator
Requirements
- Linux based Operating System (In this tutorial we are using Kali Linux)
- SEToolkit (Comes pre-installed in Kali Linux)
What is SEToolkit ? The Social-Engineer Toolkit (SET) was created and written by the founder of TrustedSec. It is an open-source Python-driven tool aimed at penetration testing around Social-Engineering. SET has been presented at large-scale conferences including Blackhat, DerbyCon, Defcon, and ShmooCon. With over two million downloads, SET is the standard for social-engineering penetration tests and supported heavily within the security community.
If you don’t have a Linux Operating System we recommend taking a look at Kali Linux you can download it from kali.org.
If you don’t already have SEToolkit you can download it from the following link. SEToolkit Download
Or use apt to install SEToolkit using command from a terminal.
# apt-get install setoolkit
Hello, welcome back today we will be talking a little about on some Social Engineering attacks In Computer Science Social Engineering Attacks rely heavily on human interaction, deception, and trickery. It is a specialist way of extracting data from somebody or a third party without the target even knowing they have reveled their Passwords or credentials often by redirecting the target to fake pages and phishing templates that look just like the actual website. Social engineering can also be the use of centralized planning in an attempt to manage social change and regulate the future development and behavior of a society, group or individuals. In this tutorial we will be using a tool called SEToolkit it comes pre-installed within Kali Linux and other Operating Systems designed for pentesting if you don’t have SEToolkit I will list a Download link to SEToolkit official repository below.
In this tutorial we will be using SEToolkit to generate malicious media to a CD/USB once the target inserts malicious CD or USB stick into the target machine an autorun will run the infected media such as a .exe payload this will allow a reverse meterpreter session to be established with the attacking machine.
Lets get started from a new terminal in Kali Linux or a Linux Operating System start SEToolkit you can do this by typing “setoolkit” in terminal and pressing enter once SEToolkit loads you will be presented with a menu that looks like the one in the screen shot below.
# setoolkit
In terminal type “1” (Social-Engineering Attacks) and press enter you will then be taken into a sub-menu that looks like the screen shot below.
From this menu we will then select 3) Infectious Media Generator. SETtoolkit will then ask you weather you would like to use a File format exploit or a Standard Metasploit Payload you can choice either option depending on the type of payloads you will be generating for this tutorial I will keep things simple and use option 2) Standard Metasploit Executable.
SEToolkit will now ask us to specify what type session we will be using in this tutorial I will use 2) Windows Reverse_TCP Meterpreter this will allow a meterpreter shell to be established between the target and the attackers machine. Screen shot below shows a list of various protocols that can be used to establish a shell.
Script will prompt to enter LHOST (Local Host) IP this is the local IP of the attacking machine. if you dont know you LHOST look it up using command ifconfig your local ip will be shown under inet.
# ifconfig
Once you have enter LHOST you will be asked to give a LPORT this can be any port you would like your listener to listen on I will use port 443.
Once LPORT has been entered SEToolkit will generate malicious infectious media to /root/.set/ it will then start Metasploit Framework and start a meterpreter listener. Transfer content within autorun directory created by SEToolkit to a CD or USB stick it does not matter what removal media you use as long as it is remove storage device that is capable of storing infectious autorun files.
Once Metasploit Framework has successfully started you will see handler running in terminal.
Now once target inserts infectious CD/USB an autorun will trigger the malicious metasploit payload and a reverse meterpreter session can be established with the target system. you can list sessions using sessions -i to connect to a new session use command sessions 1 (replace 1 with the id of your session).
To list available options and exploits use command help.
For the purpose of this tutorial I will be using stream web cam module as an example this will also a web cam stream to be sent back to the attacking machine screen shot below shows webcam_stream server started.
meterpreter > webcam_stream
As you can see from the screen shots below we have successfully managed to stream the web cam of the target system.
You may like to try out some of these useful Exploit commands use “help” command to list various exploit options available to you.
– record_mic
– webcam_snap
– webcam_stream
– dump_contacts
– dump_sms
– geolocate
We have now come to an end of this tutorial if you have any questions leave us a comment.
If you enjoyed this article please consider sharing it on social media and with your friends thanks for supporting HackingVision.
[wysija_form id=”1″]
How to Use Metasploit, SEToolkit Without Opening Ports Kali Linux