SecurityTube

Description: This is Part 19 of the Security Metasploit Framework Expert (SMFE) course material. You can begin by watching Part 1 here: http://www.securitytube.net/video/2556 . Enjoy! Certifications page: http://www.securitytube.net/cert-list

This is the final video on Railgun in which we learn how to add new custom DLL support either on the fly or create a new DLL definition file for it. This technique allows us to leverage existing DLLs on the remote system and also upload and run code from out custom DLLs. This gives us a lot of power!

Please leave your comments behind!

Tags: smfe , metasploit , dll , railgun , custom , api ,

Comments:

• Ignatius on Mon 23 Jan 2012
  
  Brilliant - as usual! It was a little longer than usual but that doesn't matter in the least. I could listen to your pearls of wisdom for hours!
  
  I was very interested at the end (24:20 onwards) to hear some of the possible techniques of uploading the DLL to the remote system, including as a payload. This is something that I'd like to research and hope to find some explicit tutorials or video demonstrations.
• hacknix on Thu 26 Jan 2012
  
  I need someone who is capable of hacking* websites & accessing their email database
  
  
  I don't need scraping,web crawling or extractors
  
  
  I need this sites HACKED so I gain access to their email DB
  
  
  I will need to test the result u give me,if it checks out,I am willing to pay up to 3000$
  
  per website and 10-20 websites monthly,which will increase upon delivery of faster & quality
  
  service
  
  
  Pls note,CONTINUITY is what I am after...I NEED A GOOD PARTNER I CAN WORK WITH FOR A VERY
  
  LONG TIME!. I HAVE AT LEAST 500 WEBSITES ON MY LIST AND IM WILLING TO PAY 3000$ PER WEBSITE
  
  PLEASE SEND ME A MAIL IF U CAN DO THIS ASAP ; omorye007 (at) yahoo (dot) com
  
  
  Cheers
• no_name on Mon 07 May 2012
  
  just read an article about somebody hacking a russian compagny (and stole a lot of money) by injecting the tv.dll, this dll is used by teamviewer, a program that is used in support for remote desktop.
  
  that way he was able to pivot to other machines, completely bypassing all security.
  
  just wondering if they used railgun :)
• Aldo on Fri 28 Sep 2012
  
  Really fantastic videos. Many, many thanks for your work
• Zitafin on Mon 22 Oct 2012
  
  Thanks for your video's Vivek
  I have a question.Can you make a video of msfvenom this looks like a great tool and i 'm new in the ms framework so i could use some help.
  also you explain how the windows/dllinject/reverse_tcp works it this a better option meterpreter/reverse_tcp?
  Thanks for your time!
  And have a nice day
  bye
  peter
• st00rm on Sat 24 Nov 2012
  
  please help me, after do what you say and add function on the fly or on def folder it give me "return=1351"
  i reboot the BT & Win xp and update metasploit to latest version but i can't see what is is wrong with me ??
• st00rm on Sat 24 Nov 2012
  
  the error " RuntimeError: param lpnlength: string expected "
  i try to change argument 100/500 but same result :(
• st00rm on Sun 16 Dec 2012
  
  any help mr.Vivek ?!!

Login to post a comment