Hacking With Evilgrade

[Kwelwild]

Description: What is Evilgrade?
Evilgrade is a framework written in perl which makes attackers make benefit out of underprivileged upgrades by injecting fake updates in the sense tricking the victim and enticing him to download our malicious payload. For this rationale we can use combinations such as Man-in-the-middle (MITM) attack or DNS Spoofing. (There can be more attacks as well).
In this tutorial I will make the backdoor separately using msfvenom.(You can also make evilgrade to create the metasploit backdoor). Next I will launch evilgrade is located at /pentest/exploits/isr-evilgrade.
As you will see evilgrade got several modules such as winzip, orbit, ccleaner, sunjava, etc. For this demonstration I will Use notepadplus. To load the module type ‘configure notepadplus’. Next we have to set the agent like this.
Set agent ‘[“<%OUT%>/root/backdoor.exe<%OUT%>”]’
In here the <%OUT%> tag points to the location where the output file should be located. Our dynamic fake update binary is in between double brackets ‘[]’. Make sure you entered correctly by typing show options. Once you see the options of this module you should see URL which the software retrieves the update from. Copy that because we are going to spoof it and perform a MITM attack. Well add that URL in the /usr/local/share/ettercap/etter.dns giving A record. So I won’t be explaining about DNS spoofing here, In short I will describe here in few lines. I will use ettercap for this.
Ettercap –T –Q -M arp –P dns_spoof /gatewayip/ /victimip/
-T for text mode, -Q for super quiet mode, -P for plugin, -M for performing a MITM attack.
After successfully running ettercap you can go ahead and use multi/handler exploit for handling the exploits outside the framework and start listening on the given payload with the local host and port. Make sure you enter ‘start’ in evilgrade. Once the user opens notepadplus and updates he should receive our malicious payload and a successful meterpreter should be created.

Disclaimer: We are a infosec video aggregator and this video is linked from an external website. The original author may be different from the user re-posting/linking it here. Please do not assume the authors to be same without verifying.
Original Source:

Sursa: Hacking With Evilgrade