‫Another way to compromise the target systems is to send the malware as a browser add on, you can use
‫Métis framework to prepare a malicious Firefox add ons and serve them from a server.
‫Select the exploit and the payload, then set the options when you run the exploit.
‫It starts a handler, as well as an application server to release the add on as soon as the victim allows
‫you to install the add on, you'll have a session of his or her system.
‫Let's see how to prepare and use malicious Firefox add ons in Calli, start the Métis Floyd framework
‫using MSF console command in the terminal screen.
‫If you do not necessarily know the exact name of an exploit, you can use search command to find it.
‫Use the exploit with the use command.
‫List the payloads that you can use with this exploit, show payloads.
‫Let's select a shell payload with the reverse TCP connection.
‫Now, look at the options of exploit and payload using the show options command.
‫Server host is the server where an application server will be started to serve the add on in this example,
‫it's our call machine.
‫Server port is the port that the Web applications serve.
‫You can choose 80, which is the default port of the HTTP protocol.
‫Yurie path is the path of the payload.
‫Now set the options of the payload listener host again, our Kelly machine is in this example.
‫Listen, port is 44 44 by default and change it if you want.
‫Now we are ready to run the exploit when you run the exploit.
‫A reverse TCP handler on Port 44 44 and an application server serves on Port 80 80 is started.
‫Let's test if the application is alive.
‫Copy the URL.
‫And pasted in the address bar of the browser.
‫It seems everything is OK.
‫In Windows System, which is the system of the victim, run the Firefox.
‫This is the Firefox version 57.
‫Now we're going to send a phishing email which contains a link to the add on we prepared in this example,
‫I use the Yop mail dot com service to send the phishing emails of the victim.
‫Yop Mail is the disposable email address service, which does not require a sign up and provides access
‫to any email address in the form of any name you want at Hotmail dot com.
‫In the attacker system, Calli, prepare the phishing email and send it to the victim.
‫The victim opens the email in his or her Firefox browser, which is the latest version.
‫When the victim clicks the link, a warning message which says Firefox prevented this site from asking
‫you to install software on your system appears if you click the install link directly in the website,
‫nothing changes.
‫You're not allowed to install the ad on starting from version 41, Mozilla decided to allow plug ins
‫only if they're signed and verified by Mozilla.
‫But don't worry, you'll probably find systems that use Firefox older than Version 41.
‫Let's repeat our test with an older version of Firefox.
‫Download an earlier portable version of Firefox.
‫I chose version 46 for this example, install it and run.
‫You are now using Firefox version 36.
‫Go to the mail service of the victim.
‫When you click the link, Firefox again prevents the site to ask to install software.
‫In this time, though, clicking the allow button brings you to the software installation window, click
‫the install now button.
‫You see the message that the installation is successful.
‫Go to the listener now, which is our Calli machine, looking at the listener terminal windows, you
‫see that a session on the victim's computer is open.
‫Go to the session using session dashi session ID command because we used a shell payload.
‫We have a special session at this time, not an interpreter session, and we can use all the commands
‫of the victim's computer.
‫Since it's a Windows system, we can use Windows Commands right now directory to list the files of the
‫current folder.
‫Who am I to see the active user?
‫IP config to see the IP addresses, et cetera.