Because the keylogger is mightier than the sword

In this tutorial, we’ll attempt to remotely install a keylogger. This one is actually quite basic, so without further ado, let’s begin.

Fire up Metasploit and let’s get started. Like before, we’re assuming that the system has already been broken into and we have the meterpreter session.

Step 1: Find a program.
The way the keylogger in Meterpreter works is, you have to attach it to a running program. Say for example, we find that the victim’s computer is running an internet browser, a game and MS Word. Clearly there’s two items of interest in there. We can attach the keylogger to the browser or MS Word to get whatever’s being typed in these two applications. So, first we check what all processes are running on the target system using the following command:

meterpreter >ps

Usually you’ll get a very long list of items. The two columns we’re interested in are PID (Process ID) and process name. For this step you may want to google up the names of some processes to see which programs they belong to or if you find the ones you know of, like chrome.exe (Google Chrome) or notepad.exe then you can use these. We need to migrate meterpreter to the corresponding PID. Suppose we found wordpad.exe at PID=1440

meterpreter > migrate 1440

You should see a message “Migration completed successfully”.

Step 2: Start the Keylogger
Now we can embed the keylogger into the program.The Meterpreter keylogger is a built-in feature called keyscan. We can start it up by the following command:

meterpreter> keyscan_start

This should successfully attach the keylogger to our preferred program and the keylogging will start immediately.

Step 3: Dump the logged Keystrokes
So, in the previous step we hooked up a keylogger to the WordPad application running on our victim’s computer. It’ll keep running until we tell it to stop (or the victim shuts down the computer). We can recover whatever the keylogger has logged by the following command. You might want to wait a while, maybe grab a snack while the keylogger is running on the system just to give it enough time to log something. It’s pretty much hit and trial since we don’t know when the victim is going to choose the application we’re keylogging and type something in it. They could be typing in it just as we hooked up the keylogger or they may not use the application for hours.

meterpreter> keyscan_dump

If all went great and the victim actually typed something in our chosen application meterpreter will print out everything in our command shell. You could try using different applications to get different results. Obviously you’ll not get anyone’s passwords by keylogging WordPad whereas chrome.exe and firefox.exe are much more likely to give us something of more interest

Kill it before it lays eggs.

How to remove and avoid computer viruses ?
A computer virus is malicious software (also known as “malware”) that can copy itself and infect other software or files on your computer.
If you suspect your computer has been infected, then several antivirus websites provides step-by-step instructions for removing viruses and other malware.
Fortunately, if you update your computer and use free antivirus software such as AVG, you can help permanently remove unwanted software and prevent installation in the first place.

How do I know if my computer has been infected? After you open and run an infected program or attachment on your computer, you might not realize that you’ve introduced a virus until you notice something isn’t quite right. Here are a few indicators that your computer might be infected:

►Your computer runs more slowly than normal.
►Your computer stops responding or freezes often.
►Your computer crashes and restarts every few minutes.
►Your computer restarts on its own and then fails to run normally.
►Applications on your computer don’t work correctly.
►Disks or disk drives are inaccessible.
►You can’t print correctly.
►You see unusual error messages.
►You see distorted menus and dialog boxes.

These are common signs of infection—but they might also indicate hardware or software problems that have nothing to do with a virus. Unless you run some kind of Malicious Software Removal Tool and install industry-standard, up-to-date antivirus software on your computer, there is no way to be certain if your computer is infected with a virus or not. Beware of messages warning you that you’ve sent email that contained a virus. This can indicate that the virus has listed your email address as the sender of tainted email. This does not necessarily mean you have a virus. Some viruses have the ability to forge email addresses. In addition, there is a category of malware called rogue security software that works by causing fake virus alerts to pop up on your computer.

How do I install updates and antivirus software if I can’t use my computer? It might be difficult to download tools or update your computer if your computer has a virus. In this case, you can try one of the following options:

►Use another computer to download the tools to a disk.
►Get help through your Antivirus’s website support.
►Have your system checked by a Technician

How can I prevent infection by computer viruses?
Nothing can guarantee the security of your computer, but there’s a lot you can do to help lower the chances that you’ll get a virus.
It’s crucial to keep your antivirus software current with the latest updates (usually called definition files) that help the tool identify and remove the latest threats. You can continue to improve your computer’s security and decrease the possibility of infection by using a firewall, keeping your computer up to date, maintaining a current antivirus software subscription, and following a few best practices.
Tip: Because no security method is guaranteed, it’s important to back up critical files on a regular basis

Nothing deters conflict like a bully with big guns, right?

MetaSploit – Metasploit is an framework which is used for the hacking of different kinds of applications,operating systems,web applications etc., Metasploit contains various exploits, payloads,modules etc. Metasploit Framework is especially used by many of the hackers to generate payloads and attack the systems. As Metasploit is an open source where any one can use it. This framework supports different operating systems like winodws, linux ,mac os x etc., Metasploit is preloaded in the Backtrack linux as there is no need for the backtrack users to install the metasploit again and again. IMHO, Metasploit is the single most powerful and useful tool for a wide variety of hacks. Personally, I like it so much I put it before the list of common tools. Remember this name: “Metasploit”. Below are a few more extremely helpfup and common tools, sure to be found in any hacker’s computer.

1. Nmap- Nmap (“Network Mapper”) is a free and open source (license) utility for network discovery and security auditing. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics.

2. Wireshark- Wireshark is a network protocol analyzer. It lets you capture and interactively browse the traffic running on a computer network.

3. Metasploit Community edition- Metasploit Community Edition simplifies network discovery and vulnerability verification for specific exploits, increasing the effectiveness of vulnerability scanners. This helps prioritize remediation and eliminate false positives, providing true security risk intelligence.

4. Nikto2- Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6400 potentially dangerous files/CGIs, checks for outdated versions of over 1200 servers, and version specific problems on over 270 servers. It also checks for server configuration items such as the presence of multiple index files, HTTP server options, and will attempt to identify installed web servers and software.

5. John the Ripper- John the Ripper is a fast password cracker, currently available for many flavors of Unix, Windows, DOS, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix systems, supported out of the box are Windows LM hashes, plus lots of other hashes and ciphers in the community-enhanced version.

6. ettercap- Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis.

7. NexPose Community edition- The Nexpose Community Edition is a free, single-user vulnerability management solution. Nexpose Community Edition is powered by the same scan engine as Nexpose Enterprise and offers many of the same features.

8. Ncat- Ncat is a feature-packed networking utility which reads and writes data across networks from the command line. Ncat was written for the Nmap Project as a much-improved reimplementation of the venerable Netcat. It uses both TCP and UDP for communication and is designed to be a reliable back-end tool to instantly provide network connectivity to other applications and users. Ncat will not only work with IPv4 and IPv6 but provides the user with a virtually limitless number of potential uses.

9. Kismet- Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring (rfmon) mode, and (with appropriate hardware) can sniff 802.11b, 802.11a, 802.11g, and 802.11n traffic. Kismet also supports plugins which allow sniffing other media such as DECT.

10. w3af- w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend.

11. hping- hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn’t only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.

12. burpsuite- Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security vulnerabilities.

13. THC-Hydra- A very fast network logon cracker which support many different services.

14. sqlmap- sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.

15. webscarab- WebScarab has a large amount of functionality, and as such can be quite intimidating to the new user. But, for the simplest case, intercepting and modifying requests and responses between a browser and HTTP/S server, there is not a lot that needs to be learned.