Hack Remote pc using java applet EXPLOIT

Hello guys today in this tutorial we will see how to hack remote pc using JAVA Applet exploit with social Engineering Toolkit. This attack is also similar the Tabnabbing Attack and Credential Harvesting Attack . Before going to this tutorial let me explain little bit about java applet, this exploit is discovered by James Forshaw. This exploit creates .jar file in the remote system, Then in victim browser the pop-up asked for the java applet and it practically seems that more then 95% user click to trust the signed applet. Once the user clicks “run”, the java applet run automatically in remote system. Let me show you how it’s done…..

Note :- This exploit is only work when the victim system having JAVA software installed.

Step 1 :- First of all we run our backtrack then open the “Social Engineering Toolkit”  and choose “Website Attack Vectors” option.

Backtrack – Exploitation Tools – Social Engineering tools – Social Engineering Toolkit – set.

Step 2 :- Then choose option 1 i.e Social Engineering Attack

Step 3 :- Then choose option  2  i.e Website Attack Vectors

Now here I am using a java applet attack so I will choose option 1.

Step 4 :- Now here I going to clone a site which is the option 2

               And set net forwarding : no

               Then enter your ip address i.e attacker machine ip address 192.168.124.130, you can use ifconfig command to see your ip address.

          Then enter url of the site which you want to clone : www.google.com

Step 5 :- Then choose option 2, this option used to open the meterpreter sessions of the victim machine.

Friends let me explain a little bit about meterpreter. A meterpreter is a Payload which is avoid creation of new process, it shoud not created a new file on disk, it creates a platform  which allows import more functionality on remote system. you can done a toughs of thing using meterpreter, I will explain more about meterpreter uses in my next tutorial.

Step 6 :- Then choose option 16 to encode the exploit

          And then set port :443

Then it will take a little bit time to load their exploit and code..

After loading process is over then now we request to the client to open their server… or you can send the url to victim through any source.

Here we can see the java applet is open to install their plugin.. as I already said the 95% user click on java applet.

Once the user clicks “run”, the applet executes with full user permissions.

Here we successfully migrate to the meterpreter session of the victim machine and the sessions 1 is open.  Then the metaspoit is automatically migrate to a new process… after success fully migrate then hit enter and write the command

Sessions  -i 1

Now we migrated to the meterpreter session then we go to CMD of victim system. Using shell command…

If you have a good knowledge about a dos then you will done a lot of things.. in victim machine..