spid3rnet
mercredi 13 juillet 2011
Microsoft office files : injecting vb scripts
Microsoft Office Files : injection vb scripts
video url : http://blip.tv/jac0bn3t/office-files-injecting-vb-scripts-5370003
download url:http://blip.tv/file/get/Jac0bn3t-officeFilesInjectingVbScripts859.mp4
what i have use :
*samba client
*
metsploite
*OS:
backtrack 5
and
WIN xp SP2 and SP3
*Microsoft office
word 2003
*video recording and editing whit
camtasia studio
steps:
*the backdoor was a '.doc' formate file and not a '.exe' since i now tha the victim
have microsoft office installed and .exe files are alomost all antivirus detect theme
*i have create using metasploite a payload
(windows/meterpreter/reverse_tcp/)
whit a my
--lhost
(0.0.0.0)
--lport
(8080 | you can choose any port you want listen to it )
--encoder was "shakita_ga_nai" to create vbscript to inject the doc file and put on my localweb derectory to be easy to share whit my "helper maching" the i have copy the vb code that metasploit has make it and i have injected into a .doc file that i have put it into shared directory over network 192.168.*.*
(doc directory)
then i have use samba client to connect from my backtrack maching into this shared folder
(doc directory)
*i have copy the *.doc file that i have injecte from the sahred directory to using "cp" my localweb folder
(/var/www)
to be easy for the victim to dowload
*the i have a send i message for my victim whit my server ip that i have startet using
(/etc/init.d/apache2 start)
i have beging listinnig on my lhost and lport and payload that i have use them create the payload
using and exploit multi/handler on metsploit and
*wainting for the victim to connect back
*after the victim read the message and download the .doc file and run then i m gonna access to the system whit meterpreter session open and run a shell
Aucun commentaire:
Enregistrer un commentaire
Article plus récent
Accueil
Inscription à :
Publier les commentaires (Atom)
Aucun commentaire:
Enregistrer un commentaire