Phishing dc618 haydnjohnson
•
1 like•719 views
Phishing for the shell. A little customization for DC618, last minute invite. Links updated. Learn some phishing frameworks and payload interactions.
Recommended
Recommended
More Related Content
Similar to Phishing dc618 haydnjohnson
Similar to Phishing dc618 haydnjohnson (20)
More from Haydn Johnson
More from Haydn Johnson (11)
Recently uploaded
Recently uploaded (20)
Phishing dc618 haydnjohnson
- 1. @haydnjohnson Phishing For the shell DC618 -> Thank you for having me
- 2. @haydnjohnson WhoAMI ❏ Security Analyst | Manager | Purple Teamer ❏ Points (points.com) ❏ Talks: BsidesTO, Circle City Con, HackFest, SecTor ❏ OSCP, Offsec, Purple Team, Gym?? ❏ http://www.slideshare.net/HaydnJohnson Views are my own :) @haydnjohnson
- 3. @haydnjohnson Outline ❏ What is phishing: Phishing Attacks | Real world ❏ Different ‘Phishing’: Clicks | Creds | Shells ❏ Email Minefield ❏ To learn phishing - What does that involve | require ❏ How I learned to phish - frameworks, Payload, VM
- 4. @haydnjohnson Real attacks - stats * Why should you care about phishing * Phishing is now the #1 delivery vehicle for ransomware and other malware. https://blog.barkly.com/phishing-statistics-2016
- 5. @haydnjohnson Top 10 Internet Scams 1. Phishing emails and Phony Web pages 2. The Nigerian scam, also known as 419 3. Lottery scams 4. Advanced fees paid for a guaranteed loan or credit card 5. Items for sale overpayment scam 6. Employment search overpayment scam 7. Disaster relief scams 8. Travel scams
- 7. @haydnjohnson Phishing Examples - @johnLaTwc Excel
- 8. @haydnjohnson Phishing Examples - @johnLaTwc AV
- 10. @haydnjohnson ❏ Many emails ❏ High amount of emails hoping for high amount of victims ❏ “Spray and pray” ❏ Not specific to one person or company Spam Campaign
- 12. @haydnjohnson ❏ Few emails ❏ Research ❏ High value target ❏ Like marketing, entices you to open Spear Phishing Campaign
- 14. @haydnjohnson Phishing Types Counting Clicks Gathering Credentials Gaining Command & Control
- 16. @haydnjohnson Counting Clicks “Click Through Rate” http://www.dummies.com/web-design-development/site-development/calculating-click-through -rates-for-e-mail-campaigns/
- 18. @haydnjohnson Counting Clicks PHP code <?php if (file_exists('count_file.txt')) { $fil = fopen('count_file.txt', r); $dat = fread($fil, filesize('count_file.txt')); echo $dat+1; fclose($fil); $fil = fopen('count_file.txt', w); fwrite($fil, $dat+1); } else { $fil = fopen('count_file.txt', w); fwrite($fil, 1); echo '1'; fclose($fil);
- 20. @haydnjohnson Counting Clicks Click Link Count ClicksReceive Mail Open Mail
- 23. @haydnjohnson Getting Credentials Click Link Enter CredentialsReceive Mail Open Mail Attacker receives credentials Credentials sent to attacker
- 24. @haydnjohnson Getting Credentials ISSUES: ❏ Have to reset passwords ❏ Exposing passwords
- 26. @haydnjohnson Command & Control TYPES OF SHELLS Synchronous (Reverse, Bind) Asynchronous (Beacon, Empire Agent)
- 27. @haydnjohnson Command & Control Click Link Download / executeReceive Mail Open Mail
- 29. @haydnjohnson Command & Control ISSUES: ❏ Hijacking control ❏ Unencrypted communications ❏ Data out of the network
- 34. @haydnjohnson NOT SPAM DNS records | DKIM - email spoof protection No-deliver notice for recon https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Bounce_message https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail Sender Policy Framework
- 37. @haydnjohnson Mail Anti-Virus Sender Policy Framework Mail Anti-Virus https://github.com/carnal0wnage/malicious_file_maker Test with different files: ❏ Exe ❏ Javascript etc
- 42. @haydnjohnson Host Anti Virus Sender Policy Framework Mail Anti-Virus DELIVERED Host Anti-virus http://www.blackhillsinfosec.com/?p=5570 http://www.blackhillsinfosec.com/?p=5555 https://null-byte.wonderhowto.com/how-to/bypass-antivirus-using-powershell-and-metas ploit-kali-tutorial-0167601/ https://blog.netspi.com/10-evil-user-tricks-for-bypassing-anti-virus/ Run in memory PowerShell DLL Remove ‘mimikatz’
- 45. @haydnjohnson Pentest part Sender Policy Framework Mail Anti-Virus DELIVERED Host Anti-virus ❏ First Landing ❏ AV bypassed ❏ Whitelisting ❏ Constrained Language mode https://www.lifewire.com/introduction-to-intrusion-detection-systems-ids-2486799
- 47. @haydnjohnson Intrusion Detection System & Prevention Sender Policy Framework Mail Anti-Virus DELIVERED Host Anti-virus Code Execution IDS ❏ NIDS ❏ HIDS ❏ Signature ❏ Anomaly ❏ Passive ❏ Active https://www.lifewire.com/introduction-to-intrusion-detection-systems-ids-2486799
- 48. @haydnjohnson Intrusion Detection System Sender Policy Framework Mail Anti-Virus DELIVERED Host Anti-virus Code Execution IDS ❏ Not easy to bypass ❏ Bypass Intranet Proxy | Supply creds ❏ Obfuscation ❏ False negatives https://arno0x0x.wordpress.com/2016/04/13/meterpreter-av-ids-evasion-powershell/ https://www.sans.org/reading-room/whitepapers/detection/intrusion-detection-evasion-attackers-burglar-alarm-1284 “%2e%2e%2f%2e%2e%2fc:winntsystem32netstat.exe” Instead of “../../c:winntsystem32netstat.exe”
- 50. @haydnjohnson Firewall Sender Policy Framework Mail Anti-Virus DELIVERED Host Anti-virus Code Execution IDS Firewall ❏ Bastion Host ❏ DMZ ❏ Deep Packet inspection ❏ Reassemble packets ❏ “NEXTGEN” https://blog.fortinet.com/2014/10/09/a-few-words-about-evasion-techniq ues
- 51. @haydnjohnson Firewall Sender Policy Framework Mail Anti-Virus DELIVERED Host Anti-virus Code Execution IDS Firewall ❏ Fragmentation ❏ Tunnel ICMP | HTTP ❏ Encryption ❏ Firewalk http://stephenperciballi.blogspot.ca/ https://www.cybrary.it/video/ids-firewalls-honeypots-whiteboard/
- 55. @haydnjohnson Phishing - what we need to do ❏ Domain ❏ Send Email ❏ Deliver Email
- 56. @haydnjohnson Phishing - what we need to do ❏ Social Engineer ❏ Click Link
- 57. @haydnjohnson Phishing - what we need to do ❏ Interact ❏ Download ❏ Execute
- 58. @haydnjohnson Phishing - what we need to do ❏ Send Email ❏ Deliver Email ❏ Social Engineer interaction ❏ Receive shell
- 59. @haydnjohnson Considerations - what do I need to learn ❏ Build a convincing email | pretext ❏ Build a website that is convincing (framework / manual) ❏ Bypass email minefield ❏ Understand payloads and user interaction References: https://arstechnica.com/information-technology/2014/02/how-to-run-your-own-e-mail-server-with-yourown-domain-part-1/2/ https://arstechnica.com/information-technology/2014/03/taking-e-mail-back-part-2-arming-your-serverwith-postfix-dovecot/ https://arstechnica.com/business/2014/03/taking-e-mail-back-part-3-fortifying-your-box-againstspammers/
- 60. @haydnjohnson Sending an Email ❏ MTA (Mail Transfer Agent), sending and receiving e-mail MDA MUA ❏ MDA (Mail Delivery Agent) POP / IMAP email into inbox MTA ❏ MUA Mail User Agent – email client
- 61. @haydnjohnson Sending an Email ❏ Must have a valid SSL/TLS certificate for your mail server – not self signed ❏ /etc/ssl/private ❏ Virtual or Real accounts I trust ya
- 62. @haydnjohnson Sending an Email - Fighting Spam ❏ Probably not an issue ❏ Others can validate we are real ❏ Spam filtering
- 67. @haydnjohnson What I did ❏ Installed ❏ Played around ❏ Decide on preferred tool
- 70. @haydnjohnson Framework Criteria ❏ Send email ❏ Track email opening ❏ Clone a website & save credentials ❏ Ability to edit cloned site (for c2) ❏ Graphs / Result recording
- 72. @haydnjohnson Gophish ❏ Download binary ❏ Chmod ❏ RUN ❏ literally…. https://getgophish.com/
- 75. @haydnjohnson
- 82. @haydnjohnson
- 83. @haydnjohnson Social Engineer ToolKit (SET)
- 84. @haydnjohnson SET Installed in Kali by default!
- 85. @haydnjohnson SET Installed in Kali by default!
- 88. @haydnjohnson Requirements - Phishing framework ❏ Send email ❏ Track email opening ❏ Clone website & save credentials ❏ Graphs / Results
- 89. @haydnjohnson Requirements - Phishing framework Send Email FiercePhish YES GoPhish YES SET YES Cobalt Strike YES
- 93. @haydnjohnson Requirements - Phishing framework Track Opening email FiercePhish NO GoPhish YES SET YES Cobalt Strike YES
- 96. @haydnjohnson Requirements - Phishing framework Clone a website & save credentials FiercePhish NO GoPhish YES SET YES Cobalt Strike YES
- 100. @haydnjohnson Requirements - Phishing framework Graphs / Result recording FiercePhish YES GoPhish YES SET YES Cobalt Strike YES & YES
- 102. @haydnjohnson Morning Catch VM Practice Phishing No DNS https://blog.cobaltstrike.com/2014/08/06/introducing-morning-catch-a-phishing-paradise/
- 107. @haydnjohnson Cloud - DropBox http://withr.me/add-domain-name-for-your-ser ver-on-digitalocean/
- 108. @haydnjohnson Domain
- 109. @haydnjohnson Domain
- 113. @haydnjohnson Website - SSL ❏ It's just too easy ❏ Seems more legit Sources: https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-onubuntu-14-04 http://www.irongeek.com/i.php?page=videos/bsidesphilly2016/cj00-attackers-perspective-a-technicaldemonstrat ion-of-an-email-phishing-attack-zac-davist
- 114. @haydnjohnson Website - SSL ❏ Create demo user ❏ Download letsencrypt + install (python) ❏ Run – add domain + allow 443 ❏ SSL encrypted Sources: https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-14-04
- 115. @haydnjohnson Website - SSL ❏ Started with no SSL
- 116. @haydnjohnson Website - SSL ❏ sudo add-apt-repository ppa:certbot/certbot ❏ sudo apt-get install python-certbot-apache ❏ sudo certbot --apache -d example.com
- 117. @haydnjohnson Website - SSL ❏ allow port 443 through firewall!
- 118. @haydnjohnson Website - SSL ❏ It is secure!
- 120. @haydnjohnson Payloads ❏ HTA ❏ Click Once ❏ DLL
- 123. @haydnjohnson HTA
- 136. @haydnjohnson Click Once Idea from: http://www.irongeek.com/i.php?page=videos/bsidesphilly2 016/cj00-attackers-perspective-a-technical-demonstration-o f-an-email-phishing-attack-zac-davis Great amazing video - phishing & post-exploitation
- 137. @haydnjohnson Click Once Works up to Win 7 Requires Internet Explorer Win 8 == Smart Screen Filter (Signed Cert) https://blog.netspi.com/all-you-need-is-one-a-clickonce-love-story/ https://msdn.microsoft.com/en-us/library/t71a733d.aspx https://msdn.microsoft.com/en-us/library/748fh114.aspx
- 138. @haydnjohnson Click once Placed in COA/Application Files/
- 139. @haydnjohnson
- 140. @haydnjohnson Click Once Using JavaScript ❏ window.open() ❏ IE blocks popup
- 141. @haydnjohnson Click Once Using JavaScript ❏ window.open()
- 142. @haydnjohnson Click Once Using JavaScript ❏ window.open() ❏ IE blocks popup
- 143. @haydnjohnson Click Once Using JavaScript ❏ 2nd popup
- 144. @haydnjohnson Click Once “Click Once” ❏ 3rd popup
- 145. @haydnjohnson Click Once Submit Button ❏ action=
- 146. @haydnjohnson To PHP page Click Once
- 147. @haydnjohnson Click Once PHP to COA folder ❏ header()
- 151. @haydnjohnson Lesson Learned ❏ Consider the user interaction ❏ Consider the technology to bypass
- 152. @haydnjohnson Lesson Learned ❏ Things gonna not work ❏ Try and test ❏ Think outside the square