CSEN3041 Ethical Hacking

Prof. NAGANATHAN E R
Room No.: SB431
nealai@[Link]
9443111370
 Course Syllabus
• Module I: Finding Vulnerabilities (B1 Ch 0,5,6)
 The Stages of the Penetration Test - Chapter 0

 Open-Source Intelligence Gathering - Chapter 5

 Port Scanning

 Finding Vulnerabilities - Chapter 6

 Nessus, The Nmap Scripting Engine, Running a Single NSE Script, Metasploit Scanner
Modules, Metasploit Exploit Check Functions, Web Application Scanning, Manual
Analysis

Password Attack 2
 Course Syllabus

• Module II: (B1 Ch 7, 8)

 Capturing Traffic - Chapter 7
 Networking for Capturing Traffic, Using Wireshark, ARP Cache Poisoning, DNS Cache
Poisoning, SSL Attacks, SSL Stripping

 Exploitation - Chapter 8
 MS08-067, Exploiting WebDAV Default Credentials, Exploiting Open phpMyAdmin,
Downloading Sensitive Files, Exploiting a Buffer Overflow in Third-Party Software,
Exploiting Third-Party Web Applications, Exploiting a Compromised Service, Exploiting
Open NFS Shares

Password Attack 3
 Course Syllabus
• Module III: (B1 Ch 9, 10)
 Password Attacks - Chapter 9
 Password Management, Online Password Attacks, Offline Password Attacks, Dumping
Plaintext Passwords from Memory with Windows Credential Editor

 Client-Side Exploitation - Chapter 10

 Bypassing Filters with Metasploit Payloads, Client-Side Attacks

Password Attack 4
Password Attacks

Password Attack 5
 Attack Vectors

Source: [Link]
Password Attack 6
 Password Attack
• Password
• A string of characters (letters, numbers, and other symbols) used to authenticate
an identity or to verify access authorization.
• Password Attack
• Password attack is a common attack vector used to bypass or exploit
authentication of user accounts. It is one of the most common application
security threats.

Password Attack 7
 Password Attack
• Common Password Attack Methods • Common Password Attack Methods
 Password Guessing Attacks  Hash-based Attacks
 Random Guesses  Pass-the-Hash Attack
 Dictionary Attacks  Pass-the-Ticket Attack
 Brute Force Attacks  Kerberoasting Attack
 Credential Stuffing  Rainbow Table Attacks
 Password Spraying Attacks • Password Cracking Software
 Social Engineering & Human-Based Attacks  Hydra
 Phishing and Vishing Attacks  John the Ripper
 Shoulder Surfing  Cain and Abel
 Eavesdropping  Hashcat
 Forced, Automated Password Changes  Ophcrack
and Resets
 Passwords for Purchase

Password Attack 8
 Password Management
• Companies are waking up to the inherent risks of password-based authentication; brute-force attacks and
educated guesses are both serious risks to weak passwords.
• Many organizations use biometric (fingerprint or retinal scan-based) or two-factor authentication to mitigate
these risks.
• Strong passwords are long, use characters from multiple complexity classes, and are not based on a dictionary
word.
• Organizations can force users to create strong passwords, but as passwords become more complex, they
become harder to remember. Users are likely to leave a password that they can’t remember in a file on their
computer, in their smartphone, or even on a Post-it note, because it’s just easier to keep of track them that way.
• Another cardinal sin of good password management is using the same password on many sites. Password reuse
is something to bear in mind while performing password attacks; you may find the same passwords work on
multiple systems and sites.
• Password management presents a difficult problem for IT staff and will likely continue to be a fruitful avenue for
attackers unless or until password based authentication is phased out entirely in favor of another model.

Password Attack 9
 Online password attack
• Usage of scripts to automatically attempt to log in to services and find valid credentials.
• Usage of tools designed for automating online password attacks or guessing passwords until the server
responds with a successful login.
• These tools use a technique called brute forcing.
• Tools that use brute forcing try every possible username and password combination, and given
enough time, they will find valid credentials.
• The trouble with brute forcing is that as stronger passwords are used, the time it takes to brute-force
them moves from hours to years and even beyond your natural lifetime.
• Finding working credentials more easily by feeding educated guesses about the correct passwords into
an automated login tool.
• Dictionary words are easy to remember, so despite the security warnings, many users incorporate
them into passwords. Slightly more security-conscious users might put some numbers at the end of
their password or maybe even an exclamation point.

Password Attack 10
 Online password attack

Wordlists
• Before usage of tool to guess passwords, need a list of credentials to try. If you don’t know the name
of the user account you want to crack, or you just want to crack as many accounts as possible, you can
provide a username list for the password-guessing tool to iterate through.
User Lists
• When creating a user list, first try to determine the client’s username scheme. For instance, if we’re
trying to break into employee email accounts, figure out the pattern the email addresses follow. Are
they [Link], just a first name, or something else?
• You can look for good username candidates on lists of common first or last names. Of course, the
guesses will be even more likely to succeed if you can find the names of your target’s actual
employees. If a company uses a first initial followed by a last name for the username scheme, and
they have an employee named John Smith, jsmith is likely a valid username.
• Sample user list: (we want a larger list of users to perform online password attacks in “Guessing
Usernames and Passwords with Hydra”..)

Password Attack 11
 Online password attack
Password Lists
• In addition to a list of possible users, we also need a password list, as shown in Listing 9-2.

• There are many good password lists available on the Internet.

• Good places to look for wordlists include
 [Link]
 [Link]
• A few password lists are also built into Kali Linux. For example, the /usr/share/wordlists directory
contains a file called [Link].

Password Attack 12
 Online password attack
• For better results, customize your wordlists for a particular target by including additional words. You
can make educated guesses based on information you gather about employees online. Information
about spouses, children, pets, and hobbies may put you on the right track.
• For example, if your target’s CEO is a huge Taylor Swift fan on social media, consider adding
keywords related to her albums, her music, or her boyfriends. If your target’s password is
TaylorSwift13!, you should be able to confirm it using password guessing long before you have to
run a whole precompiled wordlist or a brute-force attempt.
• In addition to making educated guesses based on information you gather while performing
reconnaissance, a tool like the ceWL custom wordlist generator will search a company website for
words to add to your wordlist.
• The command ceWL --help lists ceWL’s usage instructions. Use the –d (depth) option u to specify
how many links ceWL should follow on the target website. If you think that your target has a
minimum password-size requirement, you might specify a minimum word length to match with the -
m option v. Once you’ve made your choices, output ceWL’s results to a file with the -w option w.

Password Attack 13
 Online password attack
• Another method for creating wordlists is producing a list of every possible combination of a given set of
characters, or a list of every combination of characters for a specified number of characters. The tool
Crunch in Kali will generate these character sets for you.

Password Attack 14
 Online password attack
• Guessing Usernames and Passwords with Hydra
• If you have a set of credentials that you’d like to try against a running service that requires a login,
you can input them manually one by one or use a tool to automate the process. Hydra is an online
password-guessing tool that can be used to test usernames and passwords for running services.

• Listing 9-5 shows how to use Hydra to guess usernames and passwords by running through our
username and password files to search for valid POP3 credentials on our Windows XP target. This
command uses the –L flag to specify the username file, the -P for the password list file, and specifies
the protocol pop3. Hydra finds that user georgia’s password is password at u. (Shame on georgia for
using such an insecure password!)
Password Attack 15
Online password attack

Password Attack 16
 Offline Password Attacks

• Another way to crack passwords (without being discovered) is to get a copy of the password hashes and
attempt to reverse them back to plaintext passwords.
• This is easier said than done because hashes are designed to be the product of a one-way hash function:
Given an input, you can calculate the output using the hash function, but given the output, there is no
way to reliably determine the input. Thus, if a hash is compromised, there should be no way to calculate
the plaintext password. We can, however, guess a password, hash it with the one-way hash function, and
compare the results to the known hash. If the two hashes are the same, we’ve found the correct
password.
• Of course, it’s even better if you can get access to passwords in plaintext and save yourself the trouble of
trying to reverse the cryptography, but often the passwords you encounter will be hashed in some way.

Password Attack 17
 Offline Password Attacks
• we gained access to some password hashes on the Linux and Windows XP targets. Having gained a
Meterpreter session with system privileges on the Windows XP system via the
windows/smb/ms08_067_netapi Metasploit module, we can use the hashdump Meterpreter
command to print the hashed Windows passwords, as shown in Listing 9-8.
• It only takes one exploitable flaw or a user who falls victim to a social-engineering attack to bring down
the whole house of cards. You’ll find plenty of password hashes lying around sites like Pastebin,
remnants from past security breaches.

• Save the output of the hashdump to a file called [Link], which will use in “John the Ripper”

Password Attack 18
 Offline Password Attacks
• Recovering Password Hashes from a Windows SAM File
• Dumping Password Hashes with Physical Access
• LM vs. NTLM Hashing Algorithms
• The Trouble with LM Password Hashes
• Contents in Detail
• John the Ripper
• Cracking Linux Passwords
• Cracking Configuration File Passwords
• Rainbow Tables
• Online Password-Cracking Services

Password Attack 19
 Offline Password Attacks - Recovering Password Hashes from a Windows
SAM File

• Recovering Password Hashes from a Windows SAM File

• The SAM file stores hashed Windows passwords. Though we were able to use Meterpreter to
dump the password hashes from the Windows XP system (as shown previously), sometimes you’ll
be able to get only the SAM file.
• We weren’t able to get access to the primary SAM file through the Zervit 0.4 vulnerability, but we
were able to download a backup copy from the C:\Windows\repair directory using a local file-
inclusion vulnerability. But when we try to read the SAM file (as shown in Listing 9-9), we don’t see
any password hashes.

Password Attack 20
 Offline Password Attacks - Recovering Password Hashes from a Windows
SAM File

• The SAM file is obfuscated because the Windows Syskey utility encrypts the password hashes inside
the SAM file with 128-bit Rivest Cipher 4 (RC4) to provide additional security. Even if an attacker or
pentester can gain access to the SAM file, there’s a bit more work to do before we can recover the
password hashes. Specifically, we need a key to reverse the encrypted hashes.
• The encryption key for the Syskey utility is called the bootkey, and it’s stored in the Windows SYSTEM
file. You’ll find a copy of the SYSTEM file in the C:\Windows\repair directory where we found the
backup SAM file. We can use a tool in Kali called Bkhive to extract the Syskey utility’s bootkey from the
SYSTEM file so we can decrypt the hashes, as shown in Listing 9-10.

Password Attack 21
 Offline Password Attacks - Dumping Password Hashes with
Physical Access
• Dumping Password Hashes with Physical Access
• On some engagements, you’ll actually have physical access to user machines, with so-called
physical attacks in scope. While having physical access may not appear very useful at first, you
may be able to access the password hashes by restarting a system using a Linux Live CD to bypass
security controls. When you boot a machine with a Live CD, you can mount the internal hard disk
and gain access to all files, including the SAM and SYSTEM files.
• Let’s dump its hashes using a physical attack. First, we’ll point our virtual machine’s optical drive
to a Kali ISO file. In Vmware Player, highlight your Windows 7 virtual machine, right-click it and
choose Settings, then choose CD/DVD (SATA) and point to the ISO in the Use ISO Image field on
the right side of the page.

Password Attack 22
Offline Password Attacks - Dumping Password Hashes with
Physical Access
• By default, VMware will boot up the virtual machine so quickly that it will be difficult to change the
BIOS settings to boot from the CD/DVD drive instead of the hard disk. To fix this, we’ll add a line to
the Vmware configuration file (.vmx) to delay the boot process at the BIOS screen for a few seconds.
1. On your host machine, browse to where you saved your virtual machines. Then, in the folder for
the Windows 7 target, find the .vmx configuration file, and open it in a text editor.

2. Add the line [Link] = 3000 anywhere in the file. This tells the virtual machine to delay
booting for 3000 ms, or /three seconds, enough time for us to change the boot options.
3. Save the .vmx file, and restart the Windows 7 target. Once you can access the BIOS, choose to
boot from the CD drive. The virtual machine should start the Kali ISO. Even though we’re booted
into Kali, we can mount the Windows hard disk and access files, bypassing the security features of
the Windows operating system.
Password Attack 23
 Offline Password Attacks - Dumping Password Hashes with
Physical Access
• The following listing shows how to mount the file system and dump the password hashes.

1. Create a directory where we want to mount the Windows filesystem with the mkdir command.
2. Use mount v to mount the Windows filesystem (/dev/sda1) in the newly created directory (/mnt/sda1), which
means that the target’s C drive is effectively at /mnt/sda1.
3. The SAM and SYSTEM files in Windows are in the C:\Windows\System32\config directory, so change directories
to /mnt/sda1/Windows/System32/config to access these files using cd.
Password Attack 24
 Offline Password Attacks - LM vs. NTLM Hashing Algorithms

• LM vs. NTLM Hashing Algorithms

• Listing 9-14 compares the two password hash entries. The first one belongs to the Administrator account
on Windows XP, which we found with hashdump in Meterpreter, and the second is Georgia Weidman’s
account from Windows 7, which we found with physical access in the previous section.

1. username
2. user ID
3. password hash in LAN Manager (LM) format
4. NT LAN Manager (NTLM) hash

Password Attack
25
 Offline Password Attacks - LM vs. NTLM Hashing Algorithms

• LM Hash was the primary way to hash passwords on Microsoft Windows up to Windows NT, but it’s
a cryptographically unsound method that makes it possible to discover the correct plaintext
password for an LM hash, regardless of a password’s length and complexity. Microsoft introduced
NTLM hashing to replace LM hash, but on Windows XP, passwords are stored in both LM and NTLM
formats by default.
• In fact, any LM-hashed password can be brute-forced in minutes to hours. In contrast, our ability to
crack the NTLM hashes will depend on both our ability to guess and the length and complexity of
the password. If the hashing function is cryptographically sound, it could take years, decades, or
more than your lifetime to try every possible password.

Password Attack 26
 Offline Password Attacks - The Trouble with LM Password
Hashes
• When you see LM hashes on a pentest, you can be sure that the plaintext password is recoverable
from the password hash. However, one-way hash functions can’t be reversed. Complex math is used
to develop algorithms that make it impossible to discover the original plaintext password value that
was hashed, given the password hash. But we can run a plaintext password guess through the
cryptographic hashing function and compare the results to the hash we’re trying to crack; if they
are the same, we’ve found the correct password.
• The following issues contribute to the insecurity of LM hashes:
• Passwords are truncated at 14 characters.
• Passwords are converted to all uppercase.
• Passwords of fewer than 14 characters are null-padded to 14 characters.
• The 14-character password is broken into two seven-character passwords that are hashed separately.
• Why are these characteristics so significant?

Password Attack 27
 Offline Password Attacks - The Trouble with LM Password
Hashes
• Say we start with a complex, strong password like this:
T3LF23!+?sRty$J
• This password has 15 characters from four classes, including lowercase letters, uppercase letters,
numbers, and symbols, and it is not based on a dictionary word. However, in the LM hash algorithm,
the password is truncated to 14 characters like this:
T3LF23!+?sRty$
• Then the lowercase letters are changed to uppercase:
T3LF23!+?SRTY$
• Next, the password is split into two seven-character parts. The two parts are then used as keys to
encrypt the static string KGS!@#$% using the Data Encryption Standard (DES) encryption algorithm:
T3LF23! +?SRTY$
• The resulting eight-character ciphertexts from the encryption are then concatenated to make the
LM hash.
• To crack an LM hash, we just need to find seven characters, all uppercase, with perhaps some
numbers and symbols. Modern computing hardware can try every possible one- to seven-character
combination, encrypt the string KGS!@#$%, and compare the resulting hash to a given value in a
matter of minutes to hours.
Password Attack 28
 Offline Password Attacks - John the Ripper
John the Ripper
• One of the more popular tools for cracking passwords is John the Ripper.
• The default mode for John the Ripper is brute forcing.
• Because the set of possible plaintext passwords in LM hash is so limited, brute forcing is a viable method for cracking
any LM hash in a reasonable amount of time, even with our Kali virtual machine, which has limited CPU power and
memory. LM hash can be compromised but not NTLM hash
• For example, if we save the Windows XP hashes, in a file called [Link], then feed them to John the Ripper like
this, we find that John the Ripper can run through the entire set of possible passwords and come up with the correct
answer, as shown in Listing 9-15.

Password Attack 29
 Offline Password Attacks
• Cracking Linux Passwords
• We can also use John the Ripper against the Linux password hashes we dumped after exploiting the
Vsftpd server backdoor, as shown in Listing 9-16.

Password Attack 30
Offline Password Attacks - Cracking Linux Passwords

• Cracking Linux Passwords

• User georgia has an MD5 hash (we can tell from the $1$ at the beginning of the password hash). MD5
can’t be brute-forced in a reasonable amount of time. Instead, we use a wordlist with the --wordlist
option in John the Ripper.
• John the Ripper’s success at cracking the password depends on the inclusion of the correct password in
our wordlist.

Password Attack 31
 Offline Password Attacks
Cracking Configuration File Passwords
• Cracking MD5 hashed passwords in the FileZilla FTP server configuration file downloaded with the Zervit 0.4
file inclusion vulnerability. As you will see, sometimes we do not even need to crack a password hash.
• For example, try entering the hash for the user georgia, 5f4dcc3b5aa765d61d8327deb882cf99, into a
search engine. The first few hits confirm that georgia’s password is password. Additionally, searching tells us
that the account newuser is created when a FileZilla FTP server is installed with the password wampp.
• Rainbow Tables
• A set of precomputed hashes is known as a rainbow table. Rainbow tables typically hold every possible hash
entry for a given algorithm up to a certain length with a limited character set.
• For example, you may have a rainbow table for MD5 hashes that contains all entries that are all lowercase
letters and numbers with lengths between one and nine. This table is about 80 GB—not so bad with today’s
price of storage, but keep in mind this is only a very limited amount of the possible keyspace for MD5.
• You can download pre-generated sets of hashes from [Link] The tool
Rcrack in Kali can be used to sift through the rainbow tables for the correct plaintext.
Password Attack 32
 Offline Password Attacks

Online Password-Cracking Services

• The current hip thing to do in IT is to move things to the cloud, and password cracking is no different.
By leveraging multiple high-spec machines, you can get faster, more comprehensive results than you
could with just a virtual machine on your laptop. You can, of course, set up up your own high-
powered machines in the cloud, create your own wordlists, and so on, but there are also online
services that will take care of this for you for a fee. For example, [Link] can
crack NTLM Windows
• hashes, SHA-512 for Linux, WPA2 handshakes for wireless, and more. You simply upload your
password hash file, and the cracker does the rest.

Password Attack 33
Dumping Plaintext Passwords from Memory with Windows
Credential Editor
• Why bother cracking password hashes if we can get access to plaintext passwords?
• If we have access to a Windows system, in some cases we can pull plaintext passwords directly from
memory.
• One tool with this functionality is the Windows Credential Editor (WCE). We can upload this tool to an
exploited target system, and it will pull plaintext passwords from the Local Security Authority Subsystem
Service (LSASS) process in charge of enforcing the system’s security policy. You can download the latest
version of WCE from [Link]
• An example of running WCE is shown below.

• Here WCE found the plaintext of the user georgia’s password. The downside to this attack
is that it requires a logged-in user for the password to be stored in memory. Even if you
were able to get a plaintext password or two with this method, it is still worth dumping and
attempting to crack any password hashesPassword
you can
Attack access. 34
 Client-Side E xploitation
• Clients who put a lot of time and effort into their security posture may be free from these kinds of
vulnerabilities.
• They may have all security patches in place; they may periodically audit passwords and remove any
that can be easily guessed or cracked.
• They may control user roles: Regular users may not have administrative rights on their workstations, and
any software that is installed is investigated and maintained by the security staff. As a result, there may
not be many services to even try to attack.
• Yet, despite the deployment of the latest and greatest security technologies and the employment of
crack security teams, high-profile companies (with potentially high payoffs for attackers) are still being
breached.
• Because we won’t attack a computer or listening port directly, and because we need to come up with
another way to attack a device inside a corporate perimeter, we need to select our payload accordingly.
• Whereas a normal bind shell might work fine for systems directly exposed to the Internet or listening
on a port on our local network.

Password Attack 35
 Bypassing Filters with Metasploit
Payloads
All Ports
• Our network is set up such that our attack and target virtual machines are on the same network with no
firewalls or other filters blocking communications.
• Nowadays, Clients with all sorts of filtering setups. Even a reverse connection may not be able to get
through the filters and connect back to your attack machine on just any port. For example, a client
network may not allow traffic to leave the network on port 4444, the default for Metasploit
reverse_tcp payloads. It may allow traffic out only on specific ports, such as 80 or 443 for web traffic.
• If we know which ports are allowed through the filter, we can set the LPORT option to the relevant port.
The Metasploit reverse_tcp_allports payloads can help us find a port to connect to. As the name
suggests, this payload communication method will try all ports until it finds a successful connection back
to Metasploit.
• Let’s test this functionality with the windows/shell/reverse_tcp_allports payload, as shown in Listing 10-
1. We are using the MS08-067 exploit against Windows XP.

Password Attack 36
Bypassing Filters with Metasploit
Payloads

Password Attack 37
 Bypassing Filters with Metasploit
Payloads
• Here, the LPORT option specifies the first port to try. If that port doesn’t work, the payload will try
each subsequent port until the connection succeeds.
• If the payload reaches 65535 without success, it starts trying again at port 1 and runs infinitely.
• Because there is no filter blocking our traffic, the first port Metasploit tries, port 1, creates a
successful connection, as shown. Though this payload will work in many cases, some filtering
technologies will be able to stop it regardless of the port it tries to connect to. One downside to
this payload is that it may run for a long time in an attempt to find an unfiltered port. If a user sees
the application hanging, he or she may close it before the payload is successful.

Password Attack 38
 Bypassing Filters with Metasploit Payloads
• HTTP and HTTPS Payloads
• While some filters may allow all traffic out on certain ports, the most advanced filtering systems use
content inspection to screen for legitimate protocol-specific traffic. This can pose a problem for our
payloads. Even though our Meterpreter payload communication is encrypted—the content inspection
won’t be able to say, “That’s Metasploit, go away!”—the filter will be able to tell that the traffic going
out on port 80 doesn’t meet the HTTP specification.
• To address this challenge, the developers of Metasploit created HTTP and HTTPS payloads. These
payloads follow the HTTP and HTTPS specifications so that even content-inspection filters will be
convinced that our traffic is legitimate. Also, these payloads are packet based, rather than stream
based like the TCP payloads. That means they aren’t limited to a specific connection. If you lose
network communication briefly and lose all your Metasploit sessions, HTTP and HTTPS sessions can
recover and reconnect.

Password Attack 39
 Bypassing Filters with Metasploit Payloads
• For example, I tested one client where only the Internet Explorer process, when started by a domain-
authenticated user, could reach the Internet. Employees could browse the Internet to perform their
business, but they were somewhat limited.
• For instance, they couldn’t use an instant messenger client. While this probably annoyed some
employees, it was a good idea for security reasons. Even if we had been able to successfully exploit
something, even HTTP and HTTPS payloads could not get out to the Internet.
• Meterpreter HTTP and Meterpreter HTTPS use the proxy settings of Internet Explorer to navigate any
proxies necessary to call out to the Internet. For this reason, if your target process is running as the
System user, these proxy settings may not be defined, and these payloads may fail.

Password Attack 40
 Client-Side Attacks
• Creating variety of malicious files that, when opened in vulnerable software on the target machine,
will result in a compromise.
• Software like web browsers, document viewers, music players, and so on are subject to the same sort
of issues as web servers, mail servers, and every other network-based program. Exploiting this by
victims will see in this topic.
• Browser Exploitation
• PDF Exploits
• Java Exploits
• Browser_autopwn
• Winamp

Password Attack 41
 Client-Side Attacks
• Browser Exploitation
• Web browsers are made up of code to render web pages. Just as we can send malformed input to
server software, if we open a web page with malicious code to trigger a security issue, we can
potentially hijack execution in the browser and execute a payload.
• All of the most common browsers have been subject to security issues—Internet Explorer, Firefox,
and even Mobile Safari.
• Let’s consider a famous vulnerability in Internet Explorer. The Aurora exploit was used in 2010
against major companies such as Google, Adobe, and Yahoo!. At the time of the Aurora attacks,
Internet Explorer contained a zero-day vulnerability—that is, a vulnerability that had not yet been
patched.
• Microsoft has released patches for Internet Explorer, but as with other security patches, users
sometimes overlook updating their browsers, and the version of Internet Explorer installed on the
Windows XP target doesn’t have the necessary security patch to protect against the Aurora exploit.
• We’ll use Metasploit to take control of a target machine by attacking a vulnerable browser using the
Aurora Metasploit module, exploit/windows/browser/ms10_002_aurora.

Password Attack 42
Client-Side Attacks

Password Attack 43
 Client-Side Attacks
• Exploiting the browser is no different from exploiting any other program on the system, and we can run
the same shellcode. We’ll use the windows/meterpreter/reverse_tcp payload for this example to
illustrate some client-side attack concepts. cal

Exploiting the Aurora vulnerability is not as reliable as exploiting the other vulnerabilities. If Internet
Explorer crashes, but you do not receive a session, try browsing to the exploit page again.
Password Attack 44
 Client-Side Attacks
• Though we have successfully exploited the browser and gained a foothold on the target system, our
challenges are not over. If you look back at the Windows XP machine and try to continue using
Internet Explorer, you’ll find that it’s no longer functioning. The exploitation involved in getting our
session has made the browser unusable. The problem for us is that users who have been tricked into
visiting our malicious site will naturally want to continue using their browsers. They may force-quit the
browser, or the browser may crash on its own due to its unstable state. When the browser closes, we
lose our Meterpreter session.

Password Attack 45
 Client-Side Attacks
• Advanced Parameters
• In addition to the module and payload options, Metasploit modules have advanced
parameters. We can see the available advanced parameters with the command show
advanced, as shown in Listing 10-7.

Password Attack 46
 Client-Side Attacks
PDF Exploits

• Portable Document Format (PDF) software can also be exploited. If a user can be enticed to open a
malicious PDF in a vulnerable viewer, the program can be exploited.
• The most popular PDF viewer for Windows systems is Adobe Reader.
• Like browsers, Adobe Reader has a history littered with security holes. Also like browsers, even
when a patch-management process is in place, regularly updating the underlying operating
system, PDF software is often forgotten, and remains at an older, vulnerable version.

Exploiting a PDF Vulnerability

• Our Windows XP target has an outdated version of Adobe Reader 8.1.2 installed that is subject to
CVE-2008-2992, a stack-based buffer overflow.
• The corresponding Metasploit module is exploit/windows/fileformat/adobe_utilprintf.
• This module simply creates a malicious PDF; hosting it for delivery and setting up a payload handler
is up to us.

Password Attack 47
 Client-Side Attacks
PDF Exploits
• As you can see, the only option for the PDF exploit is the name of the malicious file to be generated 1.
• We can leave the default, [Link]. When we enter exploit, Metasploit generates a PDF that will exploit
this vulnerability in a vulnerable version of Adobe Reader on Windows XP SP3 English v. The malicious
PDF is stored as /root/.msf4/local/[Link]

Password Attack 48
 Client-Side Attacks
PDF Exploits
• As it turns out, an advanced option for the multi/handler module solves this problem. As shown in
Listing 10-12, the advanced option ExitOnSession, which is set to true by default, specifies whether
the listener closes after it receives a session. If we set this option to false, the listener will stay open
and allow us to catch multiple sessions with a single handler.

PDF Embedded Executable

Now for another PDF attack: This time we’ll embed a malicious executable inside a PDF.
msf > use exploit/windows/fileformat/adobe_pdf_embedded_exe
Password Attack 49
 Client-Side Attacks
Java Exploits
• Java vulnerabilities are a prevalent client-side attack vector. One thing that makes Java attacks so
powerful is that one exploit can gain access to multiple platforms.
• Windows, Mac, and even Linux systems running the Java Runtime Environment ( JRE) in a browser can
all be exploited by exactly the same exploit when that browser opens a malicious page. Here are some
sample exploits.
Java Vulnerability
• As exhibit number one, we’ll use the Metasploit module exploit/multi/browser/ java_jre17_jmxbean,
as shown in Listing 10-15. Use of this module is similar to that of the Internet Explorer. Metasploit sets
up a malicious server to exploit this cross-platform vulnerability on any browser that arrives at the
page. Any browser running Java version 7 before update 11 is affected.

Password Attack 50
Client-Side Attacks

Password Attack 51
Client-Side Attacks

Password Attack 52
 Client-Side Attacks
• Signed Java Applet
• Much like the attack against PDF users discussed in “PDF Embedded Executable”, we can bypass the
need for an unpatched Java vulnerability by simply asking users to allow us to run malicious code.
• You’ve probably seen browser warnings like, “This site would like to run this thing in your browser,
how would you like to proceed?” Sometimes even security-savvy users can be convinced to just say
“Yes” and bypass this warning without further investigation if they can be convinced that what’s on
the other side is useful.
• The module we’ll use for this example is exploit/multi/browser/java_signed_applet. As the name
implies, this module will create a malicious Java applet, as shown in Listing 10-18.

Password Attack 53
Client-Side Attacks

Password Attack 54
 Client-Side Attacks
browser_autopwn
• The browser_autopwn module is another client-side exploitation option available in Metasploit.
Although it’s sometimes considered cheating, this module loads all the browser and browser add-
on modules that it knows of (including Java, Flash, and so on) and waits for a browser to connect to
the server. Once the browser connects, the server fingerprints the browser and serves up all the
exploits it thinks are likely to succeed. An example is shown in Listing 10-20.

Password Attack 55
 Client-Side Attacks

• Though browser_autopwn is not nearly as stealthy or elegant as performing reconnaissance and then
choosing a particular exploit likely to work against a target, it can be a real help in a pinch, which is why
it’s worth having in your pentesting arsenal.
Password Attack 56
 Client-Side Attacks
Winamp
• So far our client-side attacks have basically followed the same pattern. We generate a malicious file
that exploits a vulnerability in the client software or prompts the user for permission to run
malicious code. The user opens the file with the relevant program, and we get a session in
Metasploit. Now for something a bit different.
• In this example, we trick the user into replacing a configuration file for the Winamp music player
program. When the user next opens the program, the evil configuration file will be processed
regardless of which music file the user opens. The Metasploit module we’ll use is
exploit/windows/fileformat/winamp_maki_bof, which exploits a buffer overflow issue in Winamp
version 5.55.
• As you can see with show options in Listing 10-22, this module has no options to set; all we need is a
Windows payload. The module generates a malicious Maki file for use with Winamp skins. As with
our PDF examples, it’s up to us to serve the file and set up a handler for the payload.

Password Attack 57
 Client-Side Attacks

• In Windows 7, make a copy of the default Bento Winamp skin folder from C:\ProgramFiles\Winamp\Skins and
copy it to Kali.
• Rename the folder Bento to Rocketship.
• Replace the file Rocketship\scripts\[Link] with the malicious file we just created in Metasploit. Zip the
folder and copy it to the web server.
• Switch to Windows 7, download the zipped skin from the Kali web server, unzip it, and save the folder to C:\
Program Files\Winamp\Skins as shown in Figure 10-3.
Password Attack 58
Client-Side Attacks

Password Attack 59
 Client-Side Attacks
• Now open Winamp, go to Options4Skins, and choose Rocketship, as shown in Figure 10-4.
• Once you select the malicious skin, Winamp will appear to close, and you will receive a session in your
Metasploit handler.

Password Attack 60