majajobee Posted June 23, 2015 Share Posted June 23, 2015 I was hoping someone would take a shot at breaking down the attack he does at 41mins with a mark 5. Quote Link to comment Share on other sites More sharing options...
ZaraByte Posted June 23, 2015 Share Posted June 23, 2015 Basically what he did was use metasploit to embed shell code into any executable that downloads online so he basically used metasploit and when the target downloads a file like a .exe or in his case a .dmg for mac metasploit intercepts the download and injects shell code into the download i really should do a video on this myself its better then the clippy method. Quote Link to comment Share on other sites More sharing options...
majajobee Posted June 24, 2015 Author Share Posted June 24, 2015 Basically what he did was use metasploit to embed shell code into any executable that downloads online so he basically used metasploit and when the target downloads a file like a .exe or in his case a .dmg for mac metasploit intercepts the download and injects shell code into the download i really should do a video on this myself its better then the clippy method. I would like to see you make that video for sure, but are you sure that is what he is doing? It looks to me like the the adobe site is fake, and the .dmg was premade. Quote Link to comment Share on other sites More sharing options...
ZaraByte Posted June 24, 2015 Share Posted June 24, 2015 I would like to see you make that video for sure, but are you sure that is what he is doing? It looks to me like the the adobe site is fake, and the .dmg was premade. It's possible but from what he says and i seen and what it appears he did is that he used metasploit or maybe the SET to intercept the download and inject a reverse_tcp into the download i heard of this before but i don't remember where i heard of it at off hand i don't remember the extact tools you need to do this i did search online but didn't find what i was looking for fast enough when ever get around to feeling like looking more into i try to reply back but im pretty sure all he did was intercept the download as the file was being downloaded a metasploit payload was injected into the download. It works for any website download i think just executable files like .exe and dmg maybe a few other file formats. Quote Link to comment Share on other sites More sharing options...
DataHead Posted June 24, 2015 Share Posted June 24, 2015 Projects like this come to mind http://www.infobyte.com.ar/down/isr-evilgrade-Readme.txt Didnt watch the video, but maybe something along those lines? Quote Link to comment Share on other sites More sharing options...
majajobee Posted June 24, 2015 Author Share Posted June 24, 2015 The beef framework has a fake flash update but it serves the payload straight to the victim without sending them to to an adobe site. He is talking about using the pineapple and doesn't mention beef in the talk. I think he likely took the same functionality of the beef injection and ported it to the pineapple then set up the the fake site on the pineapple to make it look legit. Quote Link to comment Share on other sites More sharing options...
ZaraByte Posted June 24, 2015 Share Posted June 24, 2015 I'm pretty sure he really did use a tool i don't remember if it was metasploit or SET that does it maybe it was a tool like https://github.com/secretsquirrel/the-backdoor-factory but not sure i remember someone showing how if you were connected to a network or access point that the target was on you could inject shellcode into the download but he did say something about java script in the video so maybe he did setup a face website however the url must have been dns spoofed i guess so the website looked real. Quote Link to comment Share on other sites More sharing options...
Sebkinne Posted June 24, 2015 Share Posted June 24, 2015 He uses some custom scripts to achieve this. I don't think they are publicly available. You can however do most of this using metasploit / beef / etc. Best Regards, Sebkinne Quote Link to comment Share on other sites More sharing options...
dustbyter Posted June 25, 2015 Share Posted June 25, 2015 I agree with Seb. The files used by Kevin are probably private that he has written or modified. The first one appears to me to be just a DNS spoofing script. This would then route users to the custom site that is cloned and running on the pineapple. SET was probably used for the cloning. For the injection of the files, can't that just be done with a proxy? Ettercap can probably even do this, but since you already have control of the victim's traffic, then all that is required is that you modify your cloned page to serve the required update. Quote Link to comment Share on other sites More sharing options...
ZaraByte Posted June 26, 2015 Share Posted June 26, 2015 I don't mean to bash Kevin but from what i know about him from people who met him he isn't one to make his own stuff this guy pays people for 0day exploits i got a friend on skype who has personally sold Kevin 2 0 day exploits what he does with them im not sure but he has a website dedicated to buying 0 day exploits so i highly doubt he made them scripts possibly some public stuff he renamed to keep people from using it. I swear the flash update page in his video is not a fake url i swear it was the legit website for flash he showed i really do believe if used that shell code injection method i really wish i could remember where i seen that demo at but i remember they showed how you can inject code into a live download i really believe that's another reason why most websites offer you a compare hash to make sure the file hasn't been tampered with. But their really is a way to inject shellcode into a file someone is trying to download over a network. Quote Link to comment Share on other sites More sharing options...
i8igmac Posted June 26, 2015 Share Posted June 26, 2015 (edited) I have posted example code about this kind of attack, i never spent the time to build a metasploit module... a forum post i made, just to see if people are interested. http://www.backtrack-linux.org/forums/showthread.php?t=53855 here was the working example code i posted in 2012, whipped up in a few hours... http://pastebin.com/n7AHi5Ny some basic if expressions, if the binary data found on the wire is a 'exe', 'rar', 'msi', etc... replace the data with a meterpreter and change the content length... header tampering... and a video remake... Edited June 26, 2015 by i8igmac Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.