Getting meterpreter session over MITM Attack [Noob friendly] Pics Included

Hello , i wanna share an interesting technique By which we would get a meterpreter Session Over a MITM in a very easy way.


Tools:
1. Ubuntu [Recommended Kali]
2. Subterfuge [Download Here]
3. Armitage/Metasploit

Now We are familiar with armitage and ubuntu.

What is Subterfuge?

Subterfuge is an automated Man In The Middle Attack Framework. Subterfuge is a web based tools that can run smoothly using ur localhost system without installing webserver (it is included in the installation software). It is a simple but devastatingly effective credential-harvesting program, which exploits vulnerabilities in the inherently trusting Address Resolution Protocol.



Host Machine = windows 7 
Victim Machine = Windows xp 
Exploit Machine = Kali 

Procedure

1 .Start Your VM and Load Kali .

2.Installation of Subterfuge:
Installer Is graphical and you won't have any problem.

PHP Code:

root@digit-laptop:~# tar -zxvf SubterfugePublicBeta5.0.tar.gz

root@digit-laptop:~# cd subterfuge

root@digit-laptop:~# python install.py -i
Running Subterfuge :

root@digit-laptop:~#subterfuge 

If we get Such output after Running subterfuge then it is successfully installed.

Setting The Environment

a) In A real scenario When you are hacking into a network through VM don't forget to replicated the Network to your VM machine

b) In VM Do It iway 



3. Now Start subterfuge On External Ip adderss and on Any port You desire, This will Allow us to control Subterfuge from anywhere Around Netwotk

subterfuge -s IP:port
In This Case

PHP Code:

root@kali:~# subterfuge -s 192.168.72.131:9000

Subterfuge courtesy of r00t0v3rr1d3 & 0sm0s1z
Validating models...

0 errors found
Django version 1.3.1, using settings 'subterfuge.settings'
Development server is running at http://192.168.72.131:9000/
Quit the server with CONTROL-C. 

Now Minimize it.

Now You can Configure It from Anywhere Around Your network
Now Open Up Browser And Put the Address Of subterfuge 

In This Case we Can configure it from exploit machine itself Or from our host Machine i.e Win 7 

Exploit Machine:

Image has been scaled down 21% (870x471). Click this bar to view original image (1095x592). Click image to open in new window.

Host Machine

Image has been scaled down 37% (870x489). Click this bar to view original image (1365x767). Click image to open in new window.

Configuring Suberfuge:
a) Click On settings
b) Select the network interface And Gateway

Image has been scaled down 37% (870x414). Click this bar to view original image (1362x648). Click image to open in new window.

Note: Don't Auto configure as in some cases It results in problem
For VM , Go in Virtual network Editor to know and configure Your Gateway

c) In configuration section , You can Configure Injection rate and page reload rate
Injection rate Is the Timer After Which the Payload is Sent to victim.

Image has been scaled down 37% (870x410). Click this bar to view original image (1365x642). Click image to open in new window.

Click Apply To save settings


4. Go to modules And Select HTTP Code Injection 

Image has been scaled down 32% (870x402). Click this bar to view original image (1262x583). Click image to open in new window.

5. Then Exploit as inject-ext-server and Payload as Iframe Injection 

6. Fill In the IP of Exploit Machine i.e Kali and the port [Through Which Payload is Going to travel] Always 80 or 8080 for Http Injection


7. Click Apply , Go to Homepage and Click Start 
Subterfuge is now Started


8. This Is the output You should Get on exploit machine where started subterfuge


 



Lets Configure the Payload 

9. Start Up Armitage And Search signed Java Applet, Click On it Options are already configured and correct . Just set the URI Path To "/".
Note: Port Should be same as You put in subterfuge for sending Exploit

Image has been scaled down 22% (870x507). Click this bar to view original image (1107x645). Click image to open in new window.

10. Start The exploit Server

Image has been scaled down 10% (870x493). Click this bar to view original image (962x545). Click image to open in new window.

11 . Open Up subterfuge again and Refresh it , Till You See a green Loading Bar

Image has been scaled down 36% (870x448). Click this bar to view original image (1354x696). Click image to open in new window.

Everything Done , Now As soon as your victims in the network Browses anything There Will Be A Hidden Iframe on every page with Java applet.

You Will Started getting meterpreter session in armitage

Victim:



Meterpreter Session:





It took me 3hrs To write this , It take 3 sec To say Thanx 

Categories: BackTrack 5 Tutorial, Hacking tutorials, Kali Linux, Metasploit Exploits