‫Now, in this lecture, I want to show you a social engineering command that we can use with Beith to
‫display the Microsoft Clippy icon, and then we're going to tell the target person that their browser
‫is out of date and they can download the new version.
‫When they download the new version, they'll, of course, download the Trojan that'll show them a Firefox
‫installer.
‫But at the same time, it will execute my backdoor in the background.
‫Now, like I said, this lecture is actually taken from my social engineering course, and I only added
‫it here to show you some of the stuff that you can do with beef.
‫So right now, I'm going to use a Trojan that I show how to create in the social engineering course.
‫And I will actually cover creating Trojans using a script later on in this course.
‫But the Trojan used here is a little bit advanced, but I cover how to create that in the social engineering
‫course.
‫Now, we covered how to do this, how to change it to TV and how to add an icon to it.
‫So I'm not going to cover all of that.
‫I actually have this already and done in a file called Firefox.
‫And here and this is the file that I'm going to try to deliver to the target person.
‫Now, the beef command that I'm going to use in this lecture works against all operating systems, like
‫we said, because it uses JavaScript, so you just want to make sure that you select a backdoor that'll
‫work on your target operating system.
‫My target is Windows.
‫That's why I'm using the Windows XP and that's why I'm actually using the Clippy plug in here and the
‫social engineering, because Microsoft people are kind of used to see this icon.
‫Now, configuring the plug in is very, very simple.
‫First of all, it's asking you for the location where the Clippy image is stored.
‫Now, we've already has that image, so you don't really need to download anything.
‫You just want to put your IP address in here.
‫So minus 10, 2014 to 13.
‫Then you can send the text that's going to appear to the target person, so the text is already kind
‫of said to a nice text, which is going to say your Firefox's is out of date.
‫Do you want to update it?
‫Then once they say yes, they're going to download an executable and you want to put the link to your
‫executable here.
‫So my executable is at 10, 2014 213.
‫And it's an evil philes.
‫And I named it Firefox's.
‫This is a delay until Clippy shows up and this is the message that the target person is going to see
‫after they download, and it's just going to say thank you for updating your browser.
‫So the flogging is very simple, it's in social engineering, Clippy, we configured our configuration
‫here, we set the IPS correctly and we set the location where our evil file is stored.
‫I'm going to click on Execute.
‫And go to the target machine.
‫Now, as you can see, we see clips showing up in here and it's saying that my brother is out of date,
‫do I want to update it?
‫I'm going to say yes, please update it for me.
‫We're going to get an installer for Firefox.
‫We're going to save it.
‫We're going to go to our downloads and we can see a file that looks exactly like Firefox.
‫It has a Firefox icon if we double click the file.
‫Will actually get an installer for Firefox, so you can actually use this to install it and if the browser
‫is out of date, it'll actually update it for them.
‫So you'll actually be doing the target person a favor.
‫But at the same time, our back door is going to run in the background.
‫As you can see, we get a connection back in Empire and now we can interact with this.
‫And we can do this info to confirm and as you can see now, we managed to get full control over the
‫target computer.
‫Now, we did this using a file that looks exactly like Firefox and we covered how to make your backdoor,
‫how to combine it with any other file type and change the icon and all of that.
‫And we also managed to do this through a convincing way because the system itself told the person that
‫there is a new update.
‫And when they installed the new update, this worked for them.
‫It installed Firefox plus our back door at the same time.