mercredi 13 juillet 2011

Microsoft office files : injecting vb scripts

Microsoft Office Files : injection vb scripts
video url : http://blip.tv/jac0bn3t/office-files-injecting-vb-scripts-5370003
download url:http://blip.tv/file/get/Jac0bn3t-officeFilesInjectingVbScripts859.mp4


what i have use :
*samba client 
*metsploite
*OS:backtrack 5 and WIN xp SP2 and SP3
*Microsoft office word 2003
*video recording and editing whit camtasia studio 

steps:
*the backdoor was a '.doc' formate file and not a '.exe' since i now tha the victim
have microsoft office installed and .exe files are alomost all antivirus  detect theme

*i have create using metasploite a payload (windows/meterpreter/reverse_tcp/) whit a my
      --lhost  (0.0.0.0)
      --lport (8080 | you can choose any port you want listen to it )
      --encoder was "shakita_ga_nai"   to create  vbscript to inject the doc file and put on my localweb derectory to be easy to share whit my "helper maching" the  i have copy the vb  code that metasploit has make it and i have injected into a .doc file that i have put it into shared directory over network 192.168.*.* (doc directory)  then i have use samba client to connect from my backtrack maching into this shared folder (doc directory)

*i have copy the *.doc file that i have injecte from the sahred directory to using "cp" my localweb folder (/var/www) 
to be easy for the victim to dowload 
*the i have a send i message for my victim whit my server ip that i have startet using (/etc/init.d/apache2 start)
i have beging listinnig on my lhost and lport and payload that i have use them create  the payload
using and exploit multi/handler on metsploit and 

*wainting for the victim to connect back

*after the victim read the message and download the .doc file and run  then i m gonna access to the system whit meterpreter session open   and   run a shell




 
 

Aucun commentaire:

Enregistrer un commentaire