How to Build LDAP SAMBA to Primary Domain Controller (PDC)

How to Build LDAP SAMBA to Primary Domain Controller (PDC)

Step 1: DNS Service

A. Install

#cat /etc/hosts

    # Do not remove the following line, or various programs
    # that require network functionality will fail.
    192.168.44.150             server.hbn.local              server
    127.0.0.1           localhost.localdomain                localhost
    ::1                     localhost6.localdomain6             localhost6

#yum install -y bind-chroot
#chmod 755 -R /var/named/
#cp /usr/share/doc/bind-*/sample/var/named/named.local /var/named/chroot/var/named/
#cp /usr/share/doc/bind-*/sample/var/named/named.root /var/named/chroot/var/named/
#cp /usr/share/doc/bind-*/sample/var/named/localhost.zone /var/named/chroot/var/named/
#touch /var/named/chroot/etc/named.conf
#chkconfig --level 35 named on
#service named start

B. Configuration

#vim /var/named/chroot/etc/named.conf

options {
        directory "/var/named";

        forwarders {203.162.0.181; 203.162.0.11; 210.245.0.11; 210.245.0.58; 208.67.222.222; 208.67.220.220; 8.8.8.8; 8.8.4.4;};
};

zone "." IN {
        type hint;
        file "named.root";
};

zone "localhost" IN {
        type master;
        file "localhost.zone";
};

zone "0.0.127.in-addr.arpa" IN {
        type master;
        file "named.local";
};

zone "44.168.192.in-addr.arpa" IN {
        type master;
        file "192.168.44.0.db";
};

zone "hbn.local" {
        type master;
        file "hbn.local";
};

 » save and quit

# cd /var/named/chroot/var/named/
#vim 192.168.44.0.db

$TTL    86400
@       IN      SOA     hbn.local. root.hbn.local.  (
                                      1997022700 ; Serial
                                      28800      ; Refresh
                                      14400      ; Retry
                                      3600000    ; Expire
                                      86400 )    ; Minimum
        IN      NS      ns1.hbn.local.
100           IN      PTR     dns.hbn.local.
250            IN        PTR        winxp.hbn.local.

#vim hbn.local
$TTL 14400
@       IN      SOA     root.hbn.local.      hostmaster.hbn.local. (
                                                2009102800
                                                14400
                                                3600
                                                1209600
                                                86400 )

       IN      NS      hbn.local.
       IN      NS      hbn.local.

ftp             IN      A       192.168.44.150
hbn.local.      IN      A       192.168.44.150
localhost       IN      A       127.0.0.1
mail            IN      A       192.168.44.150
pop             IN      A       192.168.44.150
smtp            IN      A       192.168.44.150
www             IN      A       192.168.44.150
dns             IN      A       192.168.44.150
ldap            IN      A       192.168.44.150
winxp           IN      A       192.168.44.250
hbn.local.      IN      MX      10 mail

hbn.local.    14400   IN      TXT     "v=spf1 a mx ip4:192.168.44.150 ~all"

# vim /etc/resolv.conf

search hbn.local
nameserver 192.168.44.150
nameserver 192.168.44.2

C. Test

# nslookup

> hbn.local
Server:         192.168.44.150
Address:        192.168.44.150#53
Name:   hbn.local
Address: 192.168.44.150

> dns.hbn.local
Server:         192.168.44.150
Address:        192.168.44.150#53
Name:   dns.hbn.local
Address: 192.168.44.150

> winxp.hbn.local
Server:         192.168.44.150
Address:        192.168.44.150#53
Name:   winxp.hbn.local
Address: 192.168.44.250

> ldap.hbn.local
Server:         192.168.44.150
Address:        192.168.44.150#53
Name:   ldap.hbn.local
Address: 192.168.44.150

> exit

Step 2: PDC with LDAP - Samba

A. Install

Add Dag repository

#wget http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt
#rpm --import RPM-GPG-KEY.dag.txt
#rm -f RPM-GPG-KEY.dag.txt
#vim /etc/yum.repos.d/dag.repo

[dag]
name=Dag RPM Repository for Red Hat Enterprise Linux
baseurl=http://apt.sw.be/redhat/el5/en/$basearch/dag/
gpgcheck=1
enabled=0

#yum --enablerepo=dag install -y openldap openldap-clients openldap-devel openldap-servers openldap-clients compat-openldap python-ldap ldapjdk php-ldap nss_ldap samba samba-common samba-client perl-Crypt-SmbHash perl-Digest-SHA1 perl-Jcode perl-Unicode-Map perl-Unicode-Map8 perl-Unicode-MapUTF8 perl-Unicode-String smbldap-tools


#cp /usr/share/doc/samba-3.0.33/LDAP/samba.schema /etc/openldap/schema/
# cd /etc/openldap/
# vim slapd.conf

include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/samba.schema

» Allow LDAPv2 client connections.  This is NOT the default.

allow bind_v2

loglevel -1

pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args

#######################################################################
#                                 ldbm and/or bdb database definitions                             #
#######################################################################

» Indices to maintain for this database

index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
index sambaSID,sambaPrimaryGroupSID,sambaDomainName     eq

database        bdb
suffix          "dc=hbn,dc=local"
rootdn          "cn=Manager,dc=hbn,dc=local"

rootpw          123456

# rootpw  {crypt}ijFYNcSNctBYg

directory       /var/lib/ldap

» Access control List information

access to attrs="userPassword,sambaLMPassword,sambaNTPassword"
        by selfwrite
        by anonymous auth
» users can authenticate and change their password

access to attrs="userPassword,sambaNTPassword,sambaLMPassword,sambaPwdLastSet,
sambaPwdMustChange"
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=nssldap,ou=DSA,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by anonymous auth
        by self write
        by * none

» some attributes need to be readable anonymously so that 'id user' can answer correctly

access to attrs=objectClass,entry,homeDirectory,uid,uidNumber,gidNumber,memberUid
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by * read

» somme attributes can be writable by users themselves

access to attrs=description,telephoneNumber,roomNumber,homePhone,loginShell,gecos,cn,sn,givenname
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by self write
        by * read

» some attributes need to be writable for samba

access to attrs=cn,sambaLMPassword,sambaNTPassword,sambaPwdLastSet,sambaLogonTime,
sambaLogoffTime,sambaKickoffTime,sambaPwdCanChange,sambaPwdMustChange,
sambaAcctFlags,displayName,sambaHomePath,sambaHomeDrive,sambaLogonScript,
sambaProfilePath,description,sambaUserWorkstations,sambaPrimaryGroupSID,sambaDomainName,
sambaMungedDial,sambaBadPasswordCount,sambaBadPasswordTime,sambaPasswordHistory,
sambaLogonHours,sambaSID,sambaSIDList,sambaTrustFlags,sambaGroupType,sambaNextRid,
sambaNextGroupRid,sambaNextUserRid,sambaAlgorithmicRidBase,sambaShareName,
sambaOptionName,sambaBoolOption,sambaIntegerOption,sambaStringOption,sambaStringListoption
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,ou=DSA,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by self read
        by * none

» samba need to be able to create the samba domain account

access to dn.base="dc=hbn,dc=local"
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,ou=DSA,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by * none

» samba need to be able to create new users account

access to dn="ou=Users,dc=hbn,dc=local"
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,ou=DSA,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by * none

» samba need to be able to create new groups account

access to dn="ou=Groups,dc=hbn,dc=local"
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,ou=DSA,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by * none

» samba need to be able to create new computers account

access to dn="ou=Computers,dc=hbn,dc=local"
        by dn="cn=samba,ou=DSA,dc=hbn,dc=local" write
        by dn="cn=smbldap-tools,ou=DSA,dc=hbn,dc=local" write
        by dn="uid=root,ou=People,dc=hbn,dc=local" write
        by * none

access to *
        by self read
        by * none

» save and quit

#chmod 640 slapd.conf
# vim ldap.conf

BASE    dc=hbn, dc=local
URI ldap://127.0.0.1/
TLS_CACERTDIR /etc/openldap/cacerts

#cp DB_CONFIG.example /var/lib/ldap/
#cd /var/lib/ldap/
#mv DB_CONFIG.example DB_CONFIG

# /etc/init.d/ldap start
Checking configuration files for slapd:  config file testing succeeded
[  OK  ]
Starting slapd: [  OK  ]
# /etc/init.d/nscd start
Starting nscd: [  OK  ]
# chkconfig --level 35 nscd on

# setup

» run Authentication Configuration
» select Cache Information

Use LDAP
Use MD5 Passwords
Use Shadow Passwords
Use LDAP Authentication

» Press the Next button

don't select Use TLS option
Server: ldap://127.0.0.1/
Base DN: dc=hbn,dc=local

» Press OK and exit

# vim /etc/ldap.conf

host 127.0.0.1

base dc=hbn,dc=local

rootbinddn cn=manager,dc=hbn,dc=local

timelimit 120

bind_timelimit 120

idle_timelimit 3600

nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm

ssl no
tls_cacertdir /etc/openldap/cacerts
pam_password md5

#net getlocalsid
SID for domain SERVER is: S-1-5-21-3926925045-1584093657-3115473201

# vim /etc/ldap.secret
123456

# chmod 600 /etc/ldap.secret

smbldap-tools configuration

# cd /etc/smbldap-tools/

# vim smbldap_bind.conf

slaveDN="cn=Manager,dc=hbn,dc=local"
slavePw="123456"
masterDN="cn=Manager,dc=hbn,dc=local"
masterPw="123456"

# vim smbldap.conf

######################

# General Configuration   #

######################

SID="S-1-5-21-3926925045-1584093657-3115473201"
sambaDomain="hbn.local"

####################
# LDAP Configuration #
####################

slaveLDAP="127.0.0.1"

# Slave LDAP port
slavePort="389"

# Master LDAP server: needed for write operations
masterLDAP="127.0.0.1"

# Master LDAP port

masterPort="389"
suffix="dc=hbn,dc=local"
usersdn="ou=Users,${suffix}"
computersdn="ou=Computers,${suffix}"
groupsdn="ou=Groups,${suffix}"
idmapdn="ou=Idmap,${suffix}"
sambaUnixIdPooldn="sambaDomainName=hbn.local,${suffix}"
scope="sub"
hash_encrypt="SSHA"
crypt_salt_format="%s"
ldapTLS="0"
and
userSmbHome="\\PDC-SRV\%U"
userProfile="\\PDC-SRV\profiles\%U"

                                                       ####################
                                                       #      Samba config      #
                                                       ####################
#vim /etc/samba/smb.conf

[global]
workgroup = hbn.local
netbios name = HBN
enable privileges = yes
#interfaces = 192.168.1.131
username map = /etc/samba/smbusers

server string = samba-ldap-pdc
security = user
encrypt passwords = Yes
admin users = root
#min passwd length = 3
obey pam restrictions = No

ldap passwd sync = Yes

log level = 0
syslog = 0
log file = /var/log/samba/log.%m
max log size = 100000

#time server = Yes
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
mangling method = hash2
Dos charset = 850
Unix charset = ISO8859-1

#guest account = root

logon script = logon.bat
logon drive =
logon home =
logon path =

domain logons = Yes
os level = 65
preferred master = Yes
domain master = Yes
wins support = Yes

passdb backend = ldapsam:ldap://127.0.0.1

ldap admin dn = cn=Manager,dc=hbn,dc=local

ldap suffix = dc=hbn,dc=local
ldap group suffix = ou=Groups
ldap user suffix = ou=Users
ldap machine suffix = ou=Computers
ldap idmap suffix = ou=Users
idmap backend = ldap://127.0.0.1
idmap uid = 10000-20000
idmap gid = 10000-20000
#ldap ssl = start_tls
add user script = /usr/sbin/smbldap-useradd -a '%u'
delete user script = /usr/sbin/smbldap-userdel '%u'
add group script = /usr/sbin/smbldap-groupadd -p '%g'
delete group script = /usr/sbin/smbldap-groupdel '%g'
add user to group script = /usr/sbin/smbldap-groupmod -m '%u''%g'
delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g'
set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
add machine script = /usr/sbin/smbldap-useradd -w '%u'

#logon script = STARTUP.BAT

[homes]

comment = Home Directories
valid users = %U
read only = No
create mask = 0664
directory mask = 0775
browseable = No

[profiles]

path = /home/samba/profiles
read only = No
create mask = 0600
directory mask = 0700
browseable = No
guest ok = Yes
profile acls = Yes
csc policy = disable
force user = %U
valid users = %U @"Domain Admins"

[netlogon]
path = /home/samba/netlogon/
browseable = No
read only = yes

» save and quit
# mkdir /home/samba
# mkdir /home/samba/netlogon
# mkdir /home/samba/profiles
# chmod 1777 /home/samba/profiles
#smbpasswd -w 123456

» Setting stored password for "cn=Manager,dc=hbn,dc=local" in secrets.tdb

# smbldap-populate

Populating LDAP directory for domain hbn.local (S-1-5-21-3926925045-1584093657-3115473201)
(using builtin directory structure)

adding new entry: dc=hbn,dc=local
adding new entry: ou=Users,dc=hbn,dc=local
adding new entry: ou=Groups,dc=hbn,dc=local
adding new entry: ou=Computers,dc=hbn,dc=local
adding new entry: ou=Idmap,dc=hbn,dc=local
adding new entry: uid=root,ou=Users,dc=hbn,dc=local
adding new entry: uid=nobody,ou=Users,dc=hbn,dc=local
adding new entry: cn=Domain Admins,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Domain Users,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Domain Guests,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Domain Computers,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Administrators,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Account Operators,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Print Operators,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Backup Operators,ou=Groups,dc=hbn,dc=local
adding new entry: cn=Replicators,ou=Groups,dc=hbn,dc=local
adding new entry: sambaDomainName=hbn.local,dc=hbn,dc=local

Please provide a password for the domain root:
Changing UNIX and samba passwords for root
New password:
Retype new password:

# vim dsa.ldif

dn: ou=DSA,dc=hbn,dc=local
objectClass: top
objectClass: organizationalUnit
ou: DSA
description: security accounts for LDAP clients


dn: cn=samba,ou=DSA,dc=hbn,dc=local
objectclass: organizationalRole
objectClass: top
objectClass: simpleSecurityObject
userPassword: sambasecretpwd
cn: samba


dn: cn=nssldap,ou=DSA,dc=hbn,dc=local
objectclass: organizationalRole
objectClass: top
objectClass: simpleSecurityObject
userPassword: nssldapsecretpwd
cn: nssldap


dn: cn=smbtools,ou=DSA,dc=hbn,dc=local
objectclass: organizationalRole
objectClass: top
objectClass: simpleSecurityObject
userPassword: smbtoolssecretpwd
cn: smbtools

# ldapadd -x -h localhost -D "cn=Manager,dc=hbn,dc=local" -f dsa.ldif -W

Enter LDAP Password: 

adding new entry "ou=DSA,dc=hbn,dc=local"

adding new entry "cn=samba,ou=DSA,dc=hbn,dc=local"

adding new entry "cn=nssldap,ou=DSA,dc=hbn,dc=local"

adding new entry "cn=smbtools,ou=DSA,dc=hbn,dc=local"

#ldappasswd -x -h localhost -D "cn=Manager,dc=hbn,dc=local" -s password -W
cn=samba,ou=DSA,dc=hbn,dc=local

# /etc/init.d/smb start
Starting SMB services: [  OK  ]
Starting NMB services: [  OK  ]

Now create a samba user account for UNIX and SAMBA

# smbldap-useradd -a -m namhb
# smbldap-passwd namhb
Changing UNIX and samba passwords for namhb
New password:
Retype new password:

Now create a machine trust account
# smbldap-useradd -w winxp

HACKING VIA CLONING SITE USING KALI LINUX

Hacking via Cloning Site Using Kali Linux

Hacking via Cloning Site Using Kali Linux 

SET Attack Method :

SET stands for Social Engineering Toolkist, primarily written by David Kennedy. The Social-Engineer Toolkit (SET) is specifically designed to perform advanced attacks against the human element. SET was designed to be released with the http://www.social-engineer.org launch and has quickly became a standard tool in a penetration testers arsenal. The attacks built into the toolkit are designed to be targeted and focused attacks against a person or organization used during a penetration test.

Actually this hacking method will works perfectly with DNS spoofing or Man in the Middle Attack method. Here in this tutorial I’m only writing how-to and step-by-step to perform the basic attack, but for the rest you can modified it with your own imagination.

In this tutorial we will see how this attack methods can owned your computer in just a few steps.

1, Click on Applications >> Kali Linux >> Exploitation Tools >> Social Engineering Toolkit >> then Select  "se-toolkit".

 2, Then Select first option Social Engineering Attacks using no. 1, then it will create another window -

3, Then Select option 2 Website Attack Vectors which is the unique way of using multiple web based attacks 

In-order to compromise the Intended victim.

4, After that Select  option 1 which is Java Applet Attack method will spoof a Java Certificate and deliver a metasploit based payload. This Uses a customized java applet created by Thomas Werth to deliver the payload. This will pop a new window like shown below -

5, Then after that Select the Second option which is for Site Cloning that will allow SET to clone the Site that you will define so that it can utilize that within the attack. 

6, After pressing enter on selecting Web Template it will show like to use Port/NAT Forwarding, I am pressing simply 'no' then enter as I am doing this on my Virtual Machine (Kali Linux) where Host Machine is Windows 8. Then provide the IP of your Kali Linux machine, so that it can make reverse connection with your machine when the victim uses the link provided by you. 

7, Then after that provide the URL to be Cloned like Facebook, Gmail, Twitter from where you can Harvest various Information regarding the Victim. I am Cloning the Facebook Site for demo purpose.

8, Then after that provided URL will be started cloning and then once done it will start generating payload and some files like .jar archive, index.html file that you can use to open with the IP (In my case My VM IP).

9, Then select the required payload that you want to generate, As of now I am using the Second option which is Windows Reverse_TCP Meterpreter and it will create a shell access between the attacker and the victim machine that is between my Kali Linux and Windows 8 Machine.

10, Then it will show you a list of Encoding's which will help you to bypass the security in the Victim's machine. 

I am going with no.16 Backdoored Executable which is the best in finding a spamhole in the concerned machine.

11, Then it will start generating various Powershell code based Injection on the common ports like 25, 53, 80, 443, 8080 etc. in your Attacket machine for the victim to use those when the payload is generated totally.

12, After Selecting the 16th option then it will ask for the Port No. just press enter then it will use the default Port No. Then it will Launch the Web SET Attack and will start the number of Vulnerabilities and then finally it will generate a link which you can pass to the Victim and once he uses that link then his machine will create a Reverse TCP Connection with the Attacker's machine on the random port number. 

Refer the Snapshots given for more detail -

13, This will then generate a powershell execution code which will be running in the background and then it will start to load MSF and finally it generates a link which anybody if tries to open will create reverse connection to the Attacker within the network -

14, Then it will provide us a links like this http://192.168.245.135:80 which is my Kali Linux Machine's IP and when the victim tries to open this then all the Information of his system will be back to us (Attacker) via Reverse TCP Connection.

15, Once the client tries to use that link then it will generate the connection in some random port between the Attacker and the Victim that will be TCP Based, Also you can see from the above snapshot that that the payload has been generated and when I used that link in my Windows 8 machine it opened a cloned page which is for facebook on the local IP and also it generated the .jar archive file whose function is to create the connection between the two machines. Once you accept and run the application by clicking on the link then the Information will be forwarded to the Attacker and the connection will be created to which you cannot trace untill you know how to.

Please refer the below snapshot that shows how we can track the Information of the connection in both the machines. 

Here we can see that we have created a Session with the Victim's Machine whose IP is 192.168.245.1

which is my local machine running windows 8 (HOST). Now going to my Local Machine to check whether the connection has been established or not use 'netstat' command with the following arguments -

> netstat -ano | find "57804" 

Where above port which is generated randomly for Victim's Machine by the SET Server Launched.

Hence, Now when we are connected to the Victim's Machine we can try and execute many programs and can edit any files on his machine. 

To be a bit Smart after getting connected to the concerned machine just execute "EventViewer" and then remove all the Notifications so that none can track what is going on with his machine.

However, we can track the connection established using the "sessions -l" command on the Kali Linux machine to create the Command Line Interface to the victims machine.

Now after running the above command it will start sending HTTP Packets to the concerned machine via GET Method. Then after that you can use any commands like "execute notepad.exe" under your console which will open a notepad under the victim's machine.

This Shows that the connection to the victim's machine is established using the above IP Address and the HTTP Method used is GET.

Thus this is how we can connect to the concerned machine and utilizes the resource in his System.

Now you can play with his System whenever you want till the session is Establish.

You can ever Restart, Shutdown his System using the below command from your Console -

1. Restart => execute shutdown -r -f -t 00 -c "Restarting"

This will Forcefully Restart his System using the comment restarting.

2. Shutdown => execute shutdown -s -f -t 00 -c "Shutdown"

This will forcefully shutdown his machine within 00 seconds and comment like shutdown.

Steps To Avoid :
--------------------

1, Don't trust unknown links.

2,  Use Personal Firewall to detect Inbound and Outbound Traffic.

Enjoyyy This Post. Be Calm and Stay Awake there is more to come from the BackTrack 5 R3 and Kali Linux World. 

Introduction To Armitage in Kali : Hack without one line of code

Introduction To Armitage in Kali : Hack without one line of code

Fast and easy hacking, that’s what the official Armitage website is named as. And fast and easy hacking it is. It is not recommended starting your life as a penetration tester with Armitage. But after you know the basics of metasploit (which you do now), you can take a look at this great tool. And I’ve started to assume you have Kali Linux installed.

Installing Metasploit

Now metasploit is not distributed with Kali Linux (it was distributed with backtrack though). However, Kali has it on its repositories, and it can be easily downloaded and installed by executing-

apt-get install armitage

It will check dependencies and download the required file and install Armitage for you.  After its done, you can start armitage by using the following code-

service postgresql start

 service metasploit start

armitage

 You will get a screen like this. Let the settings be as they are, and click connect. You’ll get a prompt like this (most of the time)

Now you’ll see Armitage making some connection for you. For a short while it might show failure messages (Connection Refused), but after some time Armitage will start.

And you’ll end up with a windows somewhat like this

Armitage Basics

Now the tough coding (honestly there wasn’t anything tough about that) that you had to do with Metasploit, becomes as easy as a click on Armitage. Better yet, you can see exactly what line of code is actually executed when you do something with your mouse. As a start, you should do a quick scan with OS detect.

And while it does ask you to enter some stuff now, it is going to be pretty easy, you just have to follow the example given by armitage with some modification.

First do your old ifconfig on a new terminal to find you IP

ifconfig

 Notice that most of the time, the first 6 digits are 192.168. You have to figure out the next 3 digits. After that, you can enter the ip into the armitage window. Look at the sample it had provided, just copy that, and, replacing the 1 with 154 as in my case. You final code should be 192.168.154.0/24. The 0/24 means it’ll look at all the IPs from 192.168.154.1 to 192.168.154.256. Actually it scans IP from 192.168.xxx.0 through 192.168.xxx.255. Most of the time, you’ll find your host in this range, however, to include all IP from 192.168.0.0 to 192.168.255.255, you may use 192.168.0.0/16.

This is the automatically generated code after clicking OK.

Now, after a few seconds, you will see the following message, and it tells you exactly what you’re supposed to do next.

Now a couple of computers with respective OS icons will show up on your screen. As expected, you’ll have to go to Attacks -> Find attacks. There’s no rocket science here, and I’m not putting any more screenshots. After that, right click on the computer you want to hack, and you’ll see an attack option. Select whichever you want to try, enter the requisites (you learnt how to do Information gathering in the previous Metasploit tutorials). Everything will be quite easy, except for the fact that the exploits in attack section will be possible exploits, that might or might not work. If you’re expecting a click to hack you a Windows 7 machine, then that’s just not happening. It might work with an unpatched XP machine, a ms03_026_dcom might do the trick, or the netapi one. Good luck with playing around with this tool. And here’s the official Armitage website (media section link, useful vids and pics there) where you might find some more guidance, though the tool doesn’t need any
.