Original subtitles

In this lecture we're going to take a different twe for using Armytage.

Let me give you a small scenario assumes that we have a victim machine.

This is a Windows server could be Windows Server an Android device you know as I keep saying the concept

upload anything but assumes that I have here a server.

And I did some research but I was not able to figure out which exploit I can use.

I mean it's different than the previous case where I news that there is one vulnerability or one exploits

that can be used to choose our PC Diccon.

But in my case right now I have a victim I know that he got when the server 2003 except I don't know

exactly which version of which exploit I can use to exploit any vulnerability here and get access.

Can I automate it.

Can I make Armytage search for the right version for the vulnerability and the right exploit on the

victim instead of doing that myself.

So I don't have to go exploit D.B and search and I don't have all the security focus and search.

Actually you can let's see how we can do that.

So we have our victim machine here and the victim machine only knows the IP which is 1 and 2 and 6 it

to 201.

Honestly I'm going to assume that I even don't.

Most operating system isn't.

So what I'm going to do I'm going to go here with me to Armytage and we're going to go to host and I'm

going to click on host and I can add one machine or more.

I can even add the network a full network and he will scan all of them and try to compromise them.

So I'm going to add one machine which is my victim machine.

One more time I'm going to assume that I don't know even the operating system I only knows the IP on

one story and you can add more IP if you want.

Or a full letter but in my case I'm only going to add one IP and he can add the machine here.

And as you can see it has a black screen.

I mean you don't have any information about the computer on his IP and aromatase cannot discover anything

right now.

Then you can go to host one more time and do.

And maps can show instead of scanning yourself you can tune in maps scan and type intensive scan and

click on enter and he can verify his IP.

Yes it's the same IP.

And click on target.

Now this may take time not too long but as you can see down his scanning the

scanning the victim trying to discover what operating system what port what services and so on while

I'm doing that please check on the right when you right click on the computer only find two options

services and scan and post where you can move those.

So you only have the option here because this will change within a few minutes and I'm going to wait

until the Finnish scan how I'll be knowing that he finished scan beside following up down here once

the scan is finished you will see that there will be a logo on the screen instead of having a black

screen.

It would be maybe windows maybe Linux so you'll find the logo change here indicating what operating

systems or machine have.

So while he's doing scan he will discover his operating system and he will give you a no go on the machine

here.

So let's give him a few seconds or maybe minutes.

I don't know if I should post because this may take time or let me wait for like 30 seconds more.

If he's taking longer time I'm going to pause until we finish but how I'll be knowing that he finished

once the logo of the operating system will show on the screen.

It seems that he finished

but was taking.

OK.

Let's go to host one more time Lecky.

Let's see if we need to do any other scanning because the rigorous scan should get the operating system

let me do a quick scan as well.

Yes.

Quick scan with operating system detection.

You don't have to let me writes IP 1 9 2 2 1 6 8 200 on Wednesday.

Now you don't have to rush the process.

But be patient because as much information as you can get about the victim and you are not the one who

is getting the information you are letting Armytage getting the information for you but spending some

good amount of time doing that this will help the Armytage to find the right vulnerability and the right

expert as you can see finished and the operating system has been showing on the computer.

It's Windows XP.

Sometimes you know it will give you like a tiger it could be pure 2003 or 7 2008.

So it doesn't matter.

But since he was able to discover roughly what is the operating system excellent second part after discovery

and getting support on the operating system I would go to attack.

And I'm going to click Find attack and he will start searching the machines that we edit or host that

we added.

What attack can be implemented.

So he's checking in his library according to his input to the information that he gathered.

What attack can be implemented.

Can we do this.

Can we do that attack.

So he already have information and is searching according to that.

If he didn't do the scans the first time he will not be able to search because he has a big library

to search from.

So he said OK I find some vulnerability and I selected for you some exploit to be used to hackers was

vulnerable.

If you right click right now on your computer you'll find a new menu called ETEC Zeus Arza exploits

that he found.

And you can try.

Not all of them will be working but you can try.

So let's take the first one.

Let me try this one which is still our PC one more time.

Let's see if it can or cannot because he didn't use the vulnerability randomly he adds them according

to the scans that he did and he said most probably this may work.

Those two winnability an expert let me try this one.

So you click on it now you don't need to change anything because all the information out there and you

click on launch.

If you got this red frame that's mean it has been compromised.

Excellent.

If not you try another one.

If not you try one.

And so on.

So as you can see the first one was successful.

Now I have a metal preparation to this machine where I have a full access and I can you know browse

get the desktop do whatever I want on this machine.

Let me try to do something desktop and see if I need to get that desktop access on the server.

It's going to work or not I don't know why.

Yeah you go on talking.

Let me try and answer one better better

interact.

Let me see

let me get a shell.

What I can type so calm and my son.

So it should show down.

But the point is to go so we have a shell on the machine.

The point is this is a different way for using Armytage.

It's a more smart way smarter way in you know in the sense of I don't have to spend time searching for

scanning first and then searching for vulnerability and searching for exploit.

No no.

You can let this application Armitage to Gisors this kind of information to look for is a weakness and

vulnerability to suggest what exploit can be used from his library.

And then you just right click on it and get my advice to you it's to not count on only one method.

I explained three different missions the section Meta's plate Armytage and using Armytage in a different

way.

I suggest that you should be familiar with all the metal because sometimes this one will not work.

You should try another way.

But if you limit yourself to only one way I don't think this would be that effective.

But after all is the object of this scope is to show you the exploitation framework and how it can be

used next sections will be more into the attacks itself and many Android that actually going to see

how to hack Android devices smartphone or tablet using different attack.

But the attacks that we can implement will be based on this section and previous section.

So the objective was to learn the tools first and then go through the attic.

So we're going to have a section related to hacking Android device.

And then another section which is hacking with Android device.