Original subtitles

1 1

Now before we dive into the course content, 2

2

I'd like to give you a teaser or a taste 3

3

of what you'll be able to do by the end of the course. 4

4

So this is going to be one example, 5

5

that's based on one topic 6

6

that's covered in one subsection of the course. 7

7

Now, because this is a teaser lecture, 8

8

I'm not gonna explain the technical aspect 9

9

of how am I doing this, 10

10

because I'm gonna teach you how to do this 11

11

as you go through the course. 12

12

For now just sit back and enjoy this lecture. 13

13

And after this lecture, 14

14

we're gonna dive into the course content, 15

15

where you'll learn how to do things like this, 16

16

and much, much more. 17

17

So in this video, I'm gonna give you an example 18

18

of hacking this Windows computer 19

19

from this Linux machine. 20

20

So in this example, I'm gonna use a program called , 21

21

which is a Browser Exploitation Framework. 22

22

I'm gonna launch it from here. 23

23

And the way this works is it uses a JavaScript code 24

24

to hook a target computer, 25

25

and then once a computer is hooked 26

26

we'll be able to run a number of commands. 27

27

Now to do that, I'm gonna use a man-in-the-middle attack 28

28

to automatically inject the hook code for . 29

29

So I'm gonna use a tool called man-in-the-middle F. 30

30

And I'm gonna do an ARP spoofing attack. 31

31

And I'm gonna give him my network interface, 32

32

and I'm gonna give it the gateway. 33

33

And I'm gonna give it the target IP address, 34

34

which is the address of the Windows machine. 35

35

Then I'm gonna tell it that, 36

36

I want you to inject a JavaScript URL, 37

37

and I'm gonna give it the location 38

38

where the hook code is stored. 39

39

I'm gonna hit Enter, and that's it running. 40

40

Now, I know this looks very complicated, 41

41

you don't know where I got the options from. 42

42

All this looks confusing, but again, 43

43

don't worry about that, we're gonna talk about this, 44

44

and go through this step-by-step, 45

45

so it will be very easy for you. 46

46

Right now all you need to understand is 47

47

this program is going to inject the hook code, 48

48

so the code that allows BeEF to hack into that computer 49

49

into the browser of the target person. 50

50

So that the code will run without the person even knowing. 51

51

So I'm gonna go to my Windows machine, 52

52

I'm gonna run the web browser. 53

53

And I'm just gonna go to any website, 54

54

so I'm just gonna go to bing.com. 55

55

Now, if we go back to the Kali machine, 56

56

you'll see that we have the IP address 57

57

of the target person under the hook browsers. 58

58

And if we click on the commands tab, 59

59

you'll see a large number of categories with commands 60

60

that you can run on the target computer. 61

61

Again, we'll talk about that later in future videos, 62

62

what I'm interested in is a plugin, 63

63

which allow us to show a notification bar 64

64

on the target computer. 65

65

And what I'm gonna say in that notification bar, 66

66

is I'm gonna say that there is a new update, 67

67

click here to install it. 68

68

So what this is gonna do is, 69

69

it's gonna show the target person 70

70

that there is a new update, 71

71

and once they install that new update, 72

72

I'll hack into their computer, 73

73

to do that, I'm gonna have to use a backdoor. 74

74

Now, I've already made a backdoor 75

75

that's not detectable by antivirus programs. 76

76

I'm not gonna show you how to do that now, 77

77

but in the course, you'll learn how to do that. 78

78

So right now, I'm just gonna say 79

79

where I stored the backdoor, and I call it update.exe. 80

80

So that's it, that's all done. 81

81

I'm gonna click on Execute, and that will execute it for me. 82

82

Now, before I go and run the Update, 83

83

I'm going to listen for incoming connections, 84

84

so that I can connect to the target computer 85

85

once they try to update their computer. 86

86

So again, I'm gonna explain why you need to do this, 87

87

and how to do this in future lecture, 88

88

right now I'm just gonna do it very quickly. 89

89

And once we do that, if we go on the target machine, 90

90

you'll see that their Firefox is telling them that 91

91

"There is a critical update, 92

92

"and you need to click here to install that update." 93

93

I'm gonna click it, 94

94

and you can see that it's downloading 95

95

an update file for me, I'm gonna save it. 96

96

Now, that's downloaded for me. 97

97

So if I go to my downloads, 98

98

just to show you what the file look like, 99

99

you can see that it looks like a normal file, 100

100

it has a nice icon, if we run it 101

101

we'll actually get an installer 102

102

that will update flash for us. 103

103

But at the same time, 104

104

this is going to execute my backdoor at the background. 105

105

Don't worry about this, 106

106

I'm gonna teach you how to make your Trojans, 107

107

or your evil files look and function 108

108

just like any other file. 109

109

So you can have a picture, a PDF, 110

110

or an installer like I have in here 111

111

that works like a normal file, 112

112

but at the same time when it gets executed 113

113

it'll execute your evil code in the background. 114

114

So now even though that the target person is happy, 115

115

they think they're installing 116

116

an update for their Flash Player. 117

117

If we go back to the Kali machine, 118

118

you'll see that we managed to get a reverse session 119

119

from the Windows machine. 120

120

So I'm gonna interact with that computer. 121

121

And now I'm inside it. 122

122

So I can do so many things with the target computer, 123

123

I basically have full control over that computer. 124

124

And we're gonna talk about all the things that you can do 125

125

in the post connection section of this course. 126

126

What I wanna do now is, I wanna show you 127

127

how to access the webcam of the target computer. 128

128

So we're gonna use a plugin that comes with meterpreter. 129

129

So I'm just gonna do webcam_stream, I'm gonna hit Enter. 130

130

And as you can see, I managed to turn on the webcam 131

131

of the target computer. 132

132

So this is actually a webcam 133

133

that's attached to the Windows machine, 134

134

and right there, you can see me, 135

135

and I basically hacked into the Windows machine. 136

136

I can do anything I want on the new Windows machine. 137

137

And I can also turn on the webcam, 138

138

I can inject a key logger, 139

139

I basically have full control over that machine. 140

140

Now again, this is just an example of one attack 141

141

that we're going to use. 142

142

We're gonna do so many more attacks like this, 143

143

and all of them are gonna allow us to gain full control 144

144

over the target system. 145

145

So don't worry about how to do this attack, 146

146

don't worry about the commands, 147

147

don't worry about all of that. 148

148

This is just a teaser, a simple taste 149

149

of the things that you'll be able to do 150

150

by the end of the course.