-: Now before we dive into the course content, 2 2
I'd like to give you a teaser or a taste 3 3
of what you'll be able to do by the end of the course. 4 4
So this is going to be one example, 5 5
that's based on one topic 6 6
that's covered in one subsection of the course. 7 7
Now, because this is a teaser lecture, 8 8
I'm not gonna explain the technical aspect 9 9
of how am I doing this, 10 10
because I'm gonna teach you how to do this 11 11
as you go through the course. 12 12
For now just sit back and enjoy this lecture. 13 13
And after this lecture, 14 14
we're gonna dive into the course content, 15 15
where you'll learn how to do things like this, 16 16
and much, much more. 17 17
So in this video, I'm gonna give you an example 18 18
of hacking this Windows computer 19 19
from this Linux machine. 20 20
So in this example, I'm gonna use a program called , 21 21
which is a Browser Exploitation Framework. 22 22
I'm gonna launch it from here. 23 23
And the way this works is it uses a JavaScript code 24 24
to hook a target computer, 25 25
and then once a computer is hooked 26 26
we'll be able to run a number of commands. 27 27
Now to do that, I'm gonna use a man-in-the-middle attack 28 28
to automatically inject the hook code for . 29 29
So I'm gonna use a tool called man-in-the-middle F. 30 30
And I'm gonna do an ARP spoofing attack. 31 31
And I'm gonna give him my network interface, 32 32
and I'm gonna give it the gateway. 33 33
And I'm gonna give it the target IP address, 34 34
which is the address of the Windows machine. 35 35
Then I'm gonna tell it that, 36 36
I want you to inject a JavaScript URL, 37 37
and I'm gonna give it the location 38 38
where the hook code is stored. 39 39
I'm gonna hit Enter, and that's it running. 40 40
Now, I know this looks very complicated, 41 41
you don't know where I got the options from. 42 42
All this looks confusing, but again, 43 43
don't worry about that, we're gonna talk about this, 44 44
and go through this step-by-step, 45 45
so it will be very easy for you. 46 46
Right now all you need to understand is 47 47
this program is going to inject the hook code, 48 48
so the code that allows BeEF to hack into that computer 49 49
into the browser of the target person. 50 50
So that the code will run without the person even knowing. 51 51
So I'm gonna go to my Windows machine, 52 52
I'm gonna run the web browser. 53 53
And I'm just gonna go to any website, 54 54
so I'm just gonna go to bing.com. 55 55
Now, if we go back to the Kali machine, 56 56
you'll see that we have the IP address 57 57
of the target person under the hook browsers. 58 58
And if we click on the commands tab, 59 59
you'll see a large number of categories with commands 60 60
that you can run on the target computer. 61 61
Again, we'll talk about that later in future videos, 62 62
what I'm interested in is a plugin, 63 63
which allow us to show a notification bar 64 64
on the target computer. 65 65
And what I'm gonna say in that notification bar, 66 66
is I'm gonna say that there is a new update, 67 67
click here to install it. 68 68
So what this is gonna do is, 69 69
it's gonna show the target person 70 70
that there is a new update, 71 71
and once they install that new update, 72 72
I'll hack into their computer, 73 73
to do that, I'm gonna have to use a backdoor. 74 74
Now, I've already made a backdoor 75 75
that's not detectable by antivirus programs. 76 76
I'm not gonna show you how to do that now, 77 77
but in the course, you'll learn how to do that. 78 78
So right now, I'm just gonna say 79 79
where I stored the backdoor, and I call it update.exe. 80 80
So that's it, that's all done. 81 81
I'm gonna click on Execute, and that will execute it for me. 82 82
Now, before I go and run the Update, 83 83
I'm going to listen for incoming connections, 84 84
so that I can connect to the target computer 85 85
once they try to update their computer. 86 86
So again, I'm gonna explain why you need to do this, 87 87
and how to do this in future lecture, 88 88
right now I'm just gonna do it very quickly. 89 89
And once we do that, if we go on the target machine, 90 90
you'll see that their Firefox is telling them that 91 91
"There is a critical update, 92 92
"and you need to click here to install that update." 93 93
I'm gonna click it, 94 94
and you can see that it's downloading 95 95
an update file for me, I'm gonna save it. 96 96
Now, that's downloaded for me. 97 97
So if I go to my downloads, 98 98
just to show you what the file look like, 99 99
you can see that it looks like a normal file, 100 100
it has a nice icon, if we run it 101 101
we'll actually get an installer 102 102
that will update flash for us. 103 103
But at the same time, 104 104
this is going to execute my backdoor at the background. 105 105
Don't worry about this, 106 106
I'm gonna teach you how to make your Trojans, 107 107
or your evil files look and function 108 108
just like any other file. 109 109
So you can have a picture, a PDF, 110 110
or an installer like I have in here 111 111
that works like a normal file, 112 112
but at the same time when it gets executed 113 113
it'll execute your evil code in the background. 114 114
So now even though that the target person is happy, 115 115
they think they're installing 116 116
an update for their Flash Player. 117 117
If we go back to the Kali machine, 118 118
you'll see that we managed to get a reverse session 119 119
from the Windows machine. 120 120
So I'm gonna interact with that computer. 121 121
And now I'm inside it. 122 122
So I can do so many things with the target computer, 123 123
I basically have full control over that computer. 124 124
And we're gonna talk about all the things that you can do 125 125
in the post connection section of this course. 126 126
What I wanna do now is, I wanna show you 127 127
how to access the webcam of the target computer. 128 128
So we're gonna use a plugin that comes with meterpreter. 129 129
So I'm just gonna do webcam_stream, I'm gonna hit Enter. 130 130
And as you can see, I managed to turn on the webcam 131 131
of the target computer. 132 132
So this is actually a webcam 133 133
that's attached to the Windows machine, 134 134
and right there, you can see me, 135 135
and I basically hacked into the Windows machine. 136 136
I can do anything I want on the new Windows machine. 137 137
And I can also turn on the webcam, 138 138
I can inject a key logger, 139 139
I basically have full control over that machine. 140 140
Now again, this is just an example of one attack 141 141
that we're going to use. 142 142
We're gonna do so many more attacks like this, 143 143
and all of them are gonna allow us to gain full control 144 144
over the target system. 145 145
So don't worry about how to do this attack, 146 146
don't worry about the commands, 147 147
don't worry about all of that. 148 148
This is just a teaser, a simple taste 149 149
of the things that you'll be able to do 150 150
by the end of the course.