n00bz Network

Security for the rest of us...

Top

Search n00bz.net

South Florida Security Resources
- HackMiami.org
  
  HackMiami is made up of information security professionals, hardware engineers, network administrators, students, and those who simply enjoy technology.
- South Florida ISSA
  
  The Information Systems Security Association is, "the pre-eminent trusted global information security community".

PenTest Solutions
- Rapid7 Metasploit Express
  
  Metasploit Express is an affordable, easy-to-use penetration testing solution that provides full network penetration testing capabilities, backed by the world’s largest, fully tested and integrated public database of exploits.
- Core Impact PRO
  
  Core Impact is designed to evaluate the whole of the security in an office ecosystem. It allows the user to probe for and exploit security vulnerabilities in computer networks, endpoints and web applications.

Entries in adobe (2)

Wednesday

Sep152010

Social Engineering using Metasploit Express

Wednesday, September 15, 2010 at 2:37PM

In honor of the release of the findings from Defcon 18 Social Engineering CTF ‐ "How Strong Is Your Schmooze” as well as the weekly update from Metasploit Express I will walk through a Social Engineering attack using Metasploit Express.

Step 1: Under Modules, pick your exploit. I am using the Adobe CoolType SING exploit. (We don't want to leave out Windows Vista and Windows 7.)

Step 2: Leave every option as the default and launch the attack.

Step 3: We could just have our target browse to the web address however we are going to use a different attack vector. Go and Find a USB drive and load up FireFox with NoScript enabled. Browse to the target URL and save the PDF. NoScript will stop it from executing on your machine.

Step 4: Rename the file something sneaky. I chose HR.pdf. Copy this to your thumb drive.

Step 5: Take your USB Drive and drop it off somewhere.

Step 6: Wait for the finder of the USB drive to open and click the evil HR.pdf. Gotcha! Time to give Mr. X a lesson on Social Engineering and how we don't use thumb drives we find in the bathroom.