+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Network Hacking (https://sinister.li/Forum-Network-Hacking)
+--- Thread: [Query] Pentesting (/Thread-Query-Pentesting)
[Query] Pentesting - swatterhat - 10-30-2016
I just want to pick your brains on something.
I want to remotely access a client that's not on my network. I may not be authorized to do pentesting here but I wanted to have a real-life setup where I don't have anything but a couple of details about the user and the client PC instead of setting up my own network infrastructure for testing. This is to beef up my skills too I guess.
Any session would be okay
File Access would be good
Remote Desktop (if possible)
Passwords would be fantastic
The client PC is quite far from my lab (few blocks away) but I connected to their connection (Wifi using android) in the past so when I walk by, I get connected automatically.
I used Zanti on my phone and can see the whole network map (all devices connected to the wifi including the router). I was thinking to leave my phone there for a day and control it using Airdroid from my lab.
Sitting by close by the house with my laptop would look suspicious. In short, I can be on their network anytime but only through Android.
Zanti has a lot of options available which is great but some of which are not applicable for me.
Scan open port and connect to it
SSH is not an option as most Windows PCs are not shipped with it enabled
Telnet may also not be enabled on the machine
Sniff packets
Redirect traffic
Capture download (Doesn't download on the internet that much)
Replace download (Doesn't download on the internet that much
SSL strip (SSL strip may not work on most websites with HTTPS as default. This only works for HTTP sites that get REDIRECTED to HTTPS)
RAT is not the go-to since I want to exhaust all my resources before taking this path.
Code:
More details:
PC
OS: Windows 10
Security: No user account password afaik but has UAC enabled
Antivirus: Possibly AVG/Avast cracked
Firewall: Possibly disabled
User:
Casual user of the PC, Possibly 4-5 hours a day from usually after work
Habit (that requires internet):
Spotify
uTorrent (download movies)
Chrome (stream movies)
Habit (that doesn't require the internet):
MS Office
PDF Viewer
VLCI guess, my question is, how do I create a session for myself to take control of the system without the user doing anything i.e executing a suspicious looking payload.
RE: [Query] Pentesting - whatarethechances - 11-02-2016
I think you need an exploit. Preferably one for PDF/TTF rendering.
RE: [Query] Pentesting - Bish0pQ - 11-03-2016
In a real-life situation, I would follow the person (I assume he/she has a smartphone). If you learn his routine, you can go to a place where he would go, than set up a Twin Evil Access Point, make sure he connects to it. Than infect his phone through there, but first sniff his data (everything can help). Just do some basic information gathering.
A few blocks would be do-able though. You could amplify the signal and receive the WIFI from a few blocks, it will cost you though. Maybe position a car close to his house and try to infect a IoT device, than use that IoT device to capture traffic from the signal.
RE: [Query] Pentesting - swatterhat - 11-03-2016
(11-02-2016, 10:52 PM)whatarethechances Wrote: I think you need an exploit. Preferably one for PDF/TTF rendering.
Yep. I'll keep that in mind. I've been browsing some CVEs in the last days that are still unpatched.
(11-03-2016, 11:37 AM)Bish0pQ Wrote: In a real-life situation, I would follow the person (I assume he/she has a smartphone). If you learn his routine, you can go to a place where he would go, than set up a Twin Evil Access Point, make sure he connects to it. Than infect his phone through there, but first sniff his data (everything can help). Just do some basic information gathering.
A few blocks would be do-able though. You could amplify the signal and receive the WIFI from a few blocks, it will cost you though. Maybe position a car close to his house and try to infect a IoT device, than use that IoT device to capture traffic from the signal.
This may also be a good option. Been preparing. I'm just getting ready.
RE: [Query] Pentesting - Bish0pQ - 11-03-2016
You can also depend on a how a person thinks. For example, if you know when he comes home, just before that you can drop an USB stick in front of is house. With a picture on it (JPEG-2000 format), the exploit that became known lately, he would probably click on the photo, just see it and don't know that he's infected.
He won't think that it was a virus because he didn't use a browser and shit and just yeah, it would be less suspiscious. Just drop a few .mp3, .docx files in and you're good.
RE: [Query] Pentesting - swatterhat - 11-03-2016
(11-03-2016, 12:47 PM)Bish0pQ Wrote: You can also depend on a how a person thinks. For example, if you know when he comes home, just before that you can drop an USB stick in front of is house. With a picture on it (JPEG-2000 format), the exploit that became known lately, he would probably click on the photo, just see it and don't know that he's infected.
He won't think that it was a virus because he didn't use a browser and shit and just yeah, it would be less suspiscious. Just drop a few .mp3, .docx files in and you're good.
Wow. yeah! Why didn't I think of that. I'll put that here.