We're all set up now, and our attack is fully running. We have Metasploit running BadTunnel NBNS spoofing, EvilGrade running both a DNS server and a web server to hand out the update with a bogus Windows Update site running. We have also set up our handler for the payload to connect to. Now we're just waiting for our unsuspecting victim to update their Windows system.
On the Windows workstation, when the victim uses IE to manually update their system, they are presented with the following page. Looks pretty normal-you can see that the address in the address bar says the site is http://www.microsoft.com. No real warning signs that this isn't Microsoft's site.
So, let's click and update our computer! You know to keep it safe and ...
