Hacker Simulator Walkthrough - Episode 2 - Leveling Up

Key Takeaways

hey guys hackersploit here back again with another video welcome back to hacker simulator um so in the previous episode we essentially got our start and uh you know we were able to uh get our first contract really that was pretty much just a test to see whether we've got you know the skills to pay the bills uh and we left off with our first two contracts so that's what we're going to be exploring and uh depending on the length of this episode i'll probably you know explore one more contract depending on how that works so i'll just continue and we can pick up uh from where we left off so give this a few seconds here by the way i was rank is still rank one all right so there we are objectives uh complete your first two contracts right okay so uh let me just make sure my keyboard is uh working here for some reason that always glitches out okay so that's good so we can get started now okay so complete your first two contracts and yeah so let's open up this chord if i remember correctly there we are and i'll just drag this right over here so you guys can actually see that so let's start off with our first contract which is by skirt so go steal an address for me at the following ip please okay so i guess we can perform an nmap scan on this ip and just you know get an understanding of uh of what's running on it so i'll just copy that there and we'll open up the terminal i'll just um bring that right over here all right so we can say nmap and then paste type in there all right so it looks like the host is up and um so it's running a web server on port 80 so the version of the web server is 1.0.2 so we can open up our browser and take a look at backstore which we did previously and of course we've got all the tools well we can actually explore that we have all the tools we that are required so we can take a look at the kiddies database here and we're looking for next plate for http version 1.0.2 which is this one right over here so http overflow so it looks like they're all overflow exploits which is kind of funny but hey uh downloaded so to use this what we need to do is of course um if i list out my exploits uh or you know just exploit i think is what it's called we used 134 previously and we're using one uh 1.0.2 so uh based on what i remember previously we can say http overflow and one or two and then specify the target ip which we can hit enter there so it's going to start the reverse tcp handler generates the payload which is cool and we get the meterpreter session right so what are we supposed to do we're supposed to steal an address now if i remember correctly uh it actually highlighted this machine under machine searching uh was it machine searching or files yeah so we're looking for an address and the address format is listed right over there all right so i just want to make sure that i have that um okay so i can close up my browser and within the interpreter session if i list all the contents here we have downloads documents pictures music and county okay all right all right so we can say ls downloads adopt award let's try documents we have hang.txt that's interesting um can we cut out the contents of hang dot so you can say documents and then hang dot txt if i remember correctly so travis street vero beach florida okay so that looks like an address to me um before we do anything else let's check out the other directories so pictures although i don't expect anything of use to be stored there so we have tool so can i say cat pictures tool.txt unknown file huh that's weird that's under pictures so cool.txt says unknown file all right so let's uh test out the music folder let's see what's within the music folder we have eliminate and then ls county mean dot txt so cat county mean dot txt that looks like a let me check that again because i've not kept up with this here so files uh that looks like a social security number because that has two digits right in the middle yeah there we are so that's a social security number so we were able to get the address and that is hang.txt right so we can say that's under documents so we can say get documents hang.txt so that's fairly simple looks like the address was stored straight away okay so that's downloading hopefully we'll be this is the address that they were looking for and we'll be able to upload it um [Music] by the way we might want to check that out as well so if i open up another terminal and say ls contract um ls that's weird ls text i believe is where it said it'll store it there we are so address dot txt so it actually saved that great okay so we can upload that address.txt upload and it looks like that's done so reputation is increased we're still uh you know rank one and we got a you know a bit more shell coin um i wonder if there are any other tools that we can buy or i guess this is really just story driven or narrative driven so we'll be introduced to tools as and when we need them um but that's really just the first contract so disconnect all right so we're already disconnected um okay so once a contract is completed it disconnects us that's cool all right so that's good to know our next contract is from azure yo i need you to steal a phone number the ip is so i guess this is just basic infiltration and exploitation or other exploitation and then exfiltration of data so yeah this is fairly simple so we can perform an nmap scan here nmap and paste that in there give this a couple of seconds obviously it's going to take a while this is running smb all right cool so we have an smb port open and that's 1.3.5 so open up kitty's database that always brings a smile to my face man uh so smb uh that is one 1.3.5 uh there we are that's the one there so smb eternal so that's like eternal blue which pretty much means this is a windows system or really it's trying to emulate a windows system so um under under exploits we have smb tunnels so i can say smb eternal um one three five right and we can paste in the ip there starts to reverse tcp handler generates the payload sends the stage and look we're looking for a phone number now so um yeah i think i know what the format of a phone number is so ls downloads advance documents let's try and cut out the content of uh documents uh and uh earn so we'll say documents and not readable all right so ls pictures so we'll say ls pictures uh that's weird record.txt alright so we got a text file there so we can say cat pictures record dot txt a1735 that's not a phone number right i'm pretty sure that isn't one so ls music that's weird i always have to click on the actual terminal in order to type it so depart and claim i guess those are non-readable files and all the loot is in the form of a text file so that's the pattern i'm sort of finding here ls payment we have waken ls drawing hang.txt all right so we can say cat drawing hang.txt and that's the phone number there so we can say uh we can use the previous command this looks like i'm getting more effective at this so by the way does the home button work it does that's awesome man all right so we can say get that's going to download that file remember when we we actually reach rank 2 we'll need to switch our wi-fi network which is something i think will become quite annoying as we move on but uh yeah so that's downloaded and i guess we can just search for wait i didn't say i didn't say give up man hold hold the phone man hold the phone uh phone number there we are so i already know the format so it you have the target ip as the prefix and then of course the suffix is whether or not it's a phone number uh address etc so upload all right so when you complete all your contracts you must wait for your customers to offer new uh to offer you new work for this you can head to the sofa to sleep and skip the day until your next night all right so we have a call from override already that's a good start for a beginner now that you know how to steal things you need to know how to infect computers with malwares go get some rest until you receive new contracts all right so upload malware during this type of contract the client transfers his malware directly to your server remember um i can't remember his name i keep forgetting it uh but he sends us or he actually gave gave us a server that we'll use to store all of our useful files because as he said our current workstation is limited on space so um the client will essentially transfer his malware directly to our server so that we can transfer it to the computer once you're connected to the target network all you have to do is upload uh to use the upload command all right so fairly simple or similar to meterpreter all right so i'm guessing we can leave and get some rest here upload two malwares um we we still don't have the contracts yet so i'm guessing we can just get some rest we don't have a bed that's weird can i nah we can't do much can we actually go out and do something we can actually leave that's interesting i wanted to explore the place a little bit uh because this neighborhood looks um looks uh looks really sketchy to be fair parking okay and for some reason it's always night i'm guessing that's when hackers do all of this stuff at night um okay so last time we saw that there was an atm here i'm guessing i wish there there is a section here that allows us to perform um atm card skimming which i'm guessing there is because it tells us that's unlocked with the risque group um so i'm guessing we'll be able to do some credit card ski uh you know skimming there uh unlocked with riscated group and we can leave our apartment uh that's locked from the inside so uh obvious reasons of course okay so let's get some sleep now um you know we've been hacking quite a bit so let's get some rest i'm guessing it'll just be a couple of hours you know all right it's uh it's still night still night so that's probably like half an hour or something like that uh but anyway let's let's get back to work man back to work so what's our next objective and of course i'm just gonna mind my actual facecam here all right so upload two malwares hint once connected type upload folder file folder where the folder file is the path to your computer file that you want to upload and folder is the network folder that you want to place the file in don't forget to validate those contracts by sending an answer to customers huh okay that's a bit weird i'm not really sure i understand the syntax but all right so it looks like we got another contract for a social security number so what should we do first let's try one of these malware contracts sent by bitched right so bitched wants the help of the hacker man so uh it looks like they send it to our server which we can access with uh with serverzilla so exploit whether it malware i guess is where it's stored so like where's malware there we are so to malware and idomorphic malware i'm guessing that's sent by ida morphic indeed it is the case so to malware all right so if that's stored on our server can we actually save it on our system yes we can all right so if we take a look at malware here there we are pitched malware so that's stored under malware and the name is pitched malware i'm going to remember that okay so let me just take a look at the syntax here we can close that up here i'm not sure we need to exploit to actually perform an exploit um once connected type yeah so i'm guessing we have to uh try and run an nmap scan on this obviously so i'll say we'll say nmap paste that in there we should be quite fast now i gotta tell you this game has some awesome music man some of this synthwave is awesome so smb version 1.3 0.3 but we have that in our exploits folder so ls exploit 1.0.3 no we don't so back to kd's database smb 1.0.3 so that's eternal as well um okay so that's downloaded um can i switch back to my terminal now please um all right so instead of saying nmap we can say um smb eternal one point uh what was running one point zero point three so 103 hit enter that starts the reverse tcp handler sending the stage interpreter okay so once connected type upload the folder and file so we can say upload um do we have any special instructions here just upload the malware okay so we can say upload and then malware and what's the name of the malware here i actually forgot that let's open up a new terminal um so ls ls malware that is bitched malware so let me just drag that here so i can see what i'm doing uh bitched so malware that's um okay so we need to place this in a specific folder so what folders do we have here can i put it in any folder can i put it in downloads maybe all right so there we are uploading bitched malware to do the downloads folder that's uh that's some real hacker stuff man yeah oh we're actually ranked two now that's that's crazy man i didn't even i didn't even realize that that's freaking weird okay so this is our detection level so we need to be very cognizant of that so i think i'll switch to a different wi-fi network when our detection meter is at half and you can see it's actually rising um we're connected to area 51 so i'm guessing we'll be able to switch them so that's done um don't forget to validate those contracts by sending an answer to the customers by clicking clicking on the type box next to the okay so where's this code that's complete all right so we're we're currently ranked two so we need to be cognizant of the actual uh detection level um now idomorphic you i need you to upload malware send it to your server the ip is let's transfer that over where's serverzilla i actually had an instance of that opened i think i'm just going to keep these windows like so we can close that up there and hopefully yeah you guys can't see that so i'm just going to keep this in the middle here my idomorphic malware will transfer that to our system and it looks like once we upload malware uh to a target system it actually gets get rid it actually gets rid of it from our system and also from the server which is kind of sad i would love to have experimented with that malware so what's the ip here mr idomorphic that's the ip there right so this is fairly simple i would like to get you know take a deeper look at some of the advanced stuff so nmap um there yep version one so that's a basic web server i'm guessing uh kid is db http version one yeah that is correct so download that there and we can then close that up there and what i'll do is i'll just put this right over here and i'll keep the discord window open as well so we've performed the scan we can then say http overflow uh 100 and we then specify the target ip and now we know how to upload the malware so we're making you know a lot of ground here sending the stage ls i wonder whether there's any levels that we can actually get detected because that'll be really cool so let's also list the malware here so ls malware uh idomorphic malware let me just copy that name that's i don't want to type that in right now man the other thing is the i wish i could increase the font size on this because even i can see this man and i'm just like 30 centimeters away from my monitor so we'll say upload malware and we'll paste that in there and we can upload this to the downloads folder again there we are and we still have one more contract to actually complete and before we do that i'll actually switch my wi-fi network or we can complete that one in any way um you know before we actually switch our wi-fi network all right we got a call from override everyone calm down calm down luckily for us everyone has a facebook account these days people use it to show off their lives and we're going to use it to infiltrate them that's called fishing i've added a fishing category to backstore for you oh yes now we're talking man fishing all right so sometimes customers won't give you an ipris but a name and to get at them you'll have to use a different method phishing to do this you'll have to follow the following steps run the netcat tool in a terminal find the target profile on the fishbook website read his interest and find his weakness the category in which he has the most buy an account corresponding to his weakness on the backstore website log in with the purchased account directly on facebook send a phishing message and wait for the netcat tool all right so uh what this really entails is uh you know once we get a contract that involves performing a phishing attack on a target we get the name we head over to fishbook which is uh facebook really uh and then we learn about the interests and we you know buy an account that corresponds to his weakness probably like a girl's account or something like that i'm guessing all right all right all right um okay so let's respond to ideomorphic here you think it's getting a bit inpatient so that's done that's done man all right we also have uh go go steal a social security number there let's complete this before we actually move forward i don't leave any contracts the open ah do we need to do that right now uh probably not let's let's take a look at fishbook all right so we have fishbook and also um he said we can find some tools on here but let's take a look at fishbook all right so we can search on facebook so we can search for let's try something like john okay the profile doesn't exist or you've been blocked this is pretty basic but uh i think we get the gist i'm guessing we have to complete our last job here so i'm just going to copy the ip man this i can't see what what the hell i'm typing in so nmap paste that in there we're getting really quick now so we'll be able to find whatever we're looking for this is taking a while all right so http version 1.4.4 i wish the other categories as well as we move along on kd's databases on the kds database so 1.4.4 there we are that's downloaded so and we say http overflow 144 paste that in there and we're looking for an ssn so let me just check the help menu here so files social security number two digits in the middle right we already explored that okay all right we have a lot of files here now so cat cat downloads undergo txt the names of the files really don't give us an indication as to what they contain which is something i would have liked to see but you know i'm guessing that's where we need to perform some manual searches so consider txt that's the social security number i think i think let's check out some of the other folders so documents nothing in there that we can actually access so pictures and i'm guessing nothing in music so that's stored in consider so we can say um again my terminal keeps getting messed up man so we can uh say get and we should be done with the last contract before we can get started with fishing so fall down this these downloads actually take kind of a lot of time and that's weird it's just a social security number man that's like two kilobytes at most anyway let's upload that there uh social security number they should just call it ssn okay all right we need to change our wi-fi net we're currently rank three all right so we're getting where are we actually getting up there um okay so remember we can use aerodump that's weird i'm currently connected to uh airplay aerodump that's weird i'm currently connected to my server those files been transferred back i hope not um malware tools yeah they're all transferred back to my server that's weird man huh i'll just drag that there all right so aerodump we're currently connected to area 51 so let's uh switch to will connect for beer i guess that's as good as any wi-fi network you can connect to so um airplay we'll hit enter sending the deal packets to the actual router or to the gateway and hopefully we'll capture an authentication packet and give that a couple of seconds oh that's really weird i hope we don't get arrested here man because it's taking longer than i expected and handshakes are stored in the handshake folder i also have to remember that so ah come on man my disc is full i knew this was gonna happen i swear man this is just oh man so can i transfer some exploits too yeah let's just transfer all of them until i need them this is this is probably why i had a server so let's let's run that again i should be able to actually get the handshake now man how how small is this guy's hard drive view we definitely need to upgrade our storage here man don't matter whether you have a server man you should be able to save a handshake file or a captured handshake for that matter come on man let's go this this i don't think this this is the web network this shouldn't take that much time at all man all right so it's stored under handshake so i'm guessing we can use aircrack directly all right so yeah our detection level is rising them and that's that's a worrying thing and of course as we get as our rank increases i will then need to you know switch more often so i'll just copy the key there we'll connect for beer and even the dialog looks realistic so connect will connect for beer and there we our detection level is dropped okay so i'm starting to get the hang of things here now what was our next contract because we completed all our contracts um override didn't send us anything new there let me just close serverzilla here because that's really bugging me um so let's take a look at the backstore website where he said we can explore so fishbook accounts alright so i missed that previously um okay so we can essentially buy accounts based on interest pertaining to business and industries shopping in fashion family and relationships uh entertainment uh food and drink so what do we do we need to buy all of them all right so let me just buy all of them actually that's not a bad idea we have enough shell coin to do that okay so tools that's done i've done that now what we haven't got any contract so i'm guessing we have to sleep succeed open the fishing pop-up in the help section of the pause menu to see again how to succeed at a fishing attack yeah but we haven't got a contract let me just save that there i'm guessing we can take a bit of a rest now because we need a contract to actually start performing fishing hmm that doesn't seem to have changed anything out there we are so it looks like we got phishing no that's malware malware still a phone number and this is our first one all right so that's from frottage and i need you to steal a phone number the target is named jody all right so there is our fishing uh contracts that we've obtained the end uh yeah i think that's what i'm gonna end this episode as i said i'll be continuing rapidly with this series because you guys seem to enjoy it and we'll now be moving on to fishing so do stay tuned for that so thank you very much for watching i really really appreciate the feedback you guys have given me if you like this video please leave a like if you don't like it dislike the video and i'll be seeing you in the next video a huge thank you to all of our patreons your support is greatly appreciated and this is a formal thank you so thank you shamir douglas ryan carr sandor michael busby sits up doozy defean barry dustin empress and michael hubbard your support is greatly appreciated and you keep us making even more high quality content for you guys so thank you [Music]