@haydnjohnson
Phishing
For the shell
@haydnjohnson
Please note
❏This talk goes better with the audio and can be found at
(thank you to Adrian for the recording)
❏http://www.irongeek.com/i.php?page=videos/nolacon201
7/nolacon-2017-gbd07-phishing-for-shellz-setting-up-a-
phishing-campaign-haydn-johnson
@haydnjohnson
WhoAMI
❏Security Consultant
❏KPMG LLP (Canada)
❏Talks: BsidesTO, Circle City Con, HackFest, SecTor
❏OSCP, Offsec, Purple Team, Gym??
❏http://www.slideshare.net/HaydnJohnson
Views are my own :)
@haydnjohnson
@haydnjohnson
Outline
❏What is phishing: Phishing Attacks | Real world
❏Different ‘Phishing’: Clicks | Creds | Shells
❏ Email Minefield
❏To learn phishing - What does that involve | require
❏How I learned to phish - frameworks, Payload, VM
@haydnjohnson
Real attacks - stats
* Why should you care about phishing *
Phishing is now the #1 delivery vehicle
for ransomware and other malware.
https://blog.barkly.com/phishing-statistics-2016
@haydnjohnson
Top 10 Internet Scams
1.Phishing emails and Phony Web pages
2.The Nigerian scam, also known as 419
3.Lottery scams
4.Advanced fees paid for a guaranteed loan or credit card
5.Items for sale overpayment scam
6.Employment search overpayment scam
@haydnjohnson
Phishing Examples
Email
https://www.incapsula.com/web-application-security/phishing-attack-scam.html
@haydnjohnson
Phishing Examples - @johnLaTwc
Excel
@haydnjohnson
Phishing Examples - @johnLaTwc
AV
@haydnjohnson
Phishing Examples
URLs
https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/
@haydnjohnson
Phishing Engagement
Types
Counting Clicks
Gathering Credentials
Gaining Command & Control
@haydnjohnson
Counting Clicks
@haydnjohnson
Counting Clicks
“Click Through Rate”
http://www.dummies.com/web-design-development/site-development/calculating-click-
through-rates-for-e-mail-campaigns/
@haydnjohnson
Counting Clicks
Page Visitors
http://www.counter12.com/
@haydnjohnson
Counting Clicks
PHP code
<?php
if (file_exists('count_file.txt'))
{
$fil = fopen('count_file.txt', r);
$dat = fread($fil, filesize('count_file.txt'));
echo $dat+1;
fclose($fil);
$fil = fopen('count_file.txt', w);
fwrite($fil, $dat+1);
}
else
{
$fil = fopen('count_file.txt', w);
fwrite($fil, 1);
echo '1';
fclose($fil);
}
?>
@haydnjohnson
Gathering Credentials
Intranet
https://twitter.com/dawnstarau/status/
851921378517295104/photo/1
@haydnjohnson
Gathering
Credentials
@haydnjohnson
Getting Credentials
VPN
@haydnjohnson
Getting Credentials
ISSUES:
❏Have to reset passwords
❏Exposing passwords
@haydnjohnson
Command and Control
@haydnjohnson
Command & Control
TYPES OF SHELLS
Synchronous (Reverse, Bind)
Asynchronous (Beacon, Empire Agent)
@haydnjohnson
Command & Control
@haydnjohnson
Command & Control
ISSUES:
❏Hijacking control
❏Unencrypted communications
❏Data out of the network
@haydnjohnson
Command & Control
@haydnjohnson
Command & Control
@haydnjohnson
Email Minefield
@haydnjohnsonhttps://blog.cobaltstrike.com/2012/12/05/offense-in-depth/
@haydnjohnson
NOT SPAM
DNS records | DKIM - email spoof protection
No-deliver notice for recon
https://en.wikipedia.org/wiki/Sender_Policy_Framework
https://en.wikipedia.org/wiki/Bounce_message
https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail
Sender Policy
Framework
@haydnjohnson
Mail Anti-Virus
Sandbox
Attachment Scanning
Sender
Policy
Framework
Mail Anti-
Virus
https://www.sandboxie.com/index.php?DownloadSandboxie
https://www.mail.com/mail/antivirus/
https://www.jvfconsulting.com/blog/trick-gmail-antivirus-scanner-send-any-
file-type-with-gmail-exe-dll-com-bat/
https://medium.com/@networksecurity/oleoutlook-bypass-almost-every-
corporate-security-control-with-a-point-n-click-gui-37f4cbc107d0
@haydnjohnson
Mail Anti-Virus
Sender
Policy
Framework
Mail Anti-
Virus
https://support.google.com/mail/answer/25760?hl=en
@haydnjohnson
Mail Anti-Virus
Sender
Policy
Framework
Mail Anti-
Virus
https://github.com/carnal0wnage/malicious_file_maker
Test with different files:
❏Exe
❏Javascript etc
@haydnjohnson
Mail Delivered!
Sender
Policy
Framework
Mail Anti-
Virus
DELIVERED
@haydnjohnson
Mail Delivered….
Sender
Policy
Framework
Mail Anti-
Virus
DELIVERED
@haydnjohnsonhttps://blog.cobaltstrike.com/2012/12/05/offense-in-depth/
@haydnjohnson
McAfee
Trend
Avast
AVG
Host Anti Virus
Sender
Policy
Framework
Mail Anti-
Virus
DELIVERED
Host Anti-
virus
Norton
Avira
Bullguard
ABC
DEF
GEH
ETC
ETC
All the brands!
@haydnjohnson
Host Anti Virus
Sender
Policy
Framework
Mail Anti-
Virus
DELIVERED
Host Anti-
virus
http://www.blackhillsinfosec.com/?p=5570
http://www.blackhillsinfosec.com/?p=5555
https://null-byte.wonderhowto.com/how-to/bypass-antivirus-using-powershell-and-
metasploit-kali-tutorial-0167601/
https://blog.netspi.com/10-evil-user-tricks-for-bypassing-anti-virus/
Run in memory
PowerShell
DLL
Remove ‘mimikatz’
@haydnjohnson
Code Execution
Sender
Policy
Framework
Mail Anti-
Virus
DELIVERED
Host Anti-
virus
Code
Execution
@haydnjohnson
Even more!
Sender
Policy
Framework
Mail Anti-
Virus
DELIVERED
Host Anti-
virus
Code
Execution
@haydnjohnson
Pentest part
Sender
Policy
Framework
Mail Anti-
Virus
DELIVERED
Host Anti-
virus
❏First Landing
❏AV bypassed
❏Whitelisting
❏Constrained Language mode
https://www.lifewire.com/introduction-to-intrusion-detection-systems-ids-2486799
@haydnjohnsonhttps://blog.cobaltstrike.com/2012/12/05/offense-in-depth/
@haydnjohnson
Intrusion Detection System
& Prevention
Sender
Policy
Framework
Mail Anti-
Virus
DELIVERED
Host Anti-
virus
Code
Execution
IDS
❏NIDS
❏HIDS
❏Signature
❏Anomaly
❏Passive
❏Active
https://www.lifewire.com/introduction-to-intrusion-detection-systems-ids-2486799
@haydnjohnson
Intrusion Detection System
Sender
Policy
Framework
Mail Anti-
Virus
DELIVERED
Host Anti-
virus
Code
Execution
IDS
❏Not easy to bypass
❏Bypass Intranet Proxy | Supply creds
❏Obfuscation
❏False negatives
https://arno0x0x.wordpress.com/2016/04/13/meterpreter-av-ids-evasion-powershell/
https://www.sans.org/reading-room/whitepapers/detection/intrusion-detection-evasion-
attackers-burglar-alarm-1284
“%2e%2e%2f%2e%2e%2fc:winntsystem32netstat.exe”
Instead of
“../../c:winntsystem32netstat.exe”
@haydnjohnson
Firewall
Sender
Policy
Framework
Mail Anti-
Virus
DELIVERED
Host Anti-
virus
Code
Execution
IDS Firewall
@haydnjohnson
Firewall
Sender
Policy
Framework
Mail Anti-
Virus
DELIVERED
Host Anti-
virus
Code
Execution
IDS Firewall
❏Bastion Host
❏DMZ
❏Deep Packet inspection
❏Reassemble packets
❏“NEXTGEN”
https://blog.fortinet.com/2014/10/09/a-few-words-about-evasion-
techniques
@haydnjohnson
Firewall
Sender
Policy
Framework
Mail Anti-
Virus
DELIVERED
Host Anti-
virus
Code
Execution
IDS Firewall
❏Fragmentation
❏Tunnel ICMP | HTTP
❏Encryption
❏Firewalk
http://stephenperciballi.blogspot.ca/
https://www.cybrary.it/video/ids-firewalls-honeypots-whiteboard/
@haydnjohnson
Positive C2
Sender
Policy
Framework
Mail Anti-
Virus
DELIVERED
Host Anti-
virus
Code
Execution
IDS Firewall C2
@haydnjohnson
Positive C2
Sender
Policy
Framework
Mail Anti-
Virus
DELIVERED
Host Anti-
virus
Code
Execution
IDS Firewall
@haydnjohnson
Phishing mechanics
@haydnjohnson
Phishing - what we need to do
❏Domain
❏Send Email
❏Deliver Email
@haydnjohnson
Phishing - what we need to do
❏Social Engineer
❏Click Link
@haydnjohnson
Phishing - what we need to do
❏Interact
❏Download
❏Execute
@haydnjohnson
Phishing - what we need to do
❏Send Email
❏Deliver Email
❏Social Engineer interaction
❏Receive shell
@haydnjohnson
Considerations - what do I need to learn
❏Build a convincing email | pretext
❏Build a website that is convincing (framework / manual)
❏Bypass email minefield
❏Understand payloads and user interaction
@haydnjohnson
How I learned
@haydnjohnson
What I DID!
@haydnjohnson
What I DID!
https://www.trustedsec.com/social-engineer-toolkit/
https://getgophish.com/
https://github.com/Raikia/FiercePhish
@haydnjohnson
What I did
Installed
Played around
Decide on preferred tool
@haydnjohnson
Domain Tool
catphish
❏Phishing urls (DoubleExtensions, dashOmission,
Punycode, etc) and check if they are available.
❏Suggested by @mkr_ultra
https://github.com/ring0lab/catphish
@haydnjohnson
Frameworks
@haydnjohnson
Framework
Criteria
@haydnjohnson
Framework Criteria
❏Send email
❏Track email opening
❏Clone a website & save credentials
❏Ability to edit cloned site (for c2)
❏Graphs / Result recording
@haydnjohnson
Installation
@haydnjohnson
Gophish
Download binary
Chmod
RUN
literally….
https://blog.cobaltstrike.com/2014/08/06/introducing-morning-catch-a-phishing-paradise/
@haydnjohnson
Gophish
@haydnjohnson
Gophish
@haydnjohnson
@haydnjohnson
FiercePhish
@haydnjohnson
FiercePhish
@haydnjohnson
FiercePhish
Ubuntu 16
@haydnjohnson
FiercePhish
Configuration script
@haydnjohnson
FiercePhish
@haydnjohnson
Careful
@haydnjohnson
@haydnjohnson
Social Engineer ToolKit (SET)
@haydnjohnson
SET
Installed in Kali by default!
@haydnjohnson
SET
Installed in Kali by default!
@haydnjohnson
SET
Options!
@haydnjohnson
SET
More Options!
@haydnjohnson
Requirements - Phishing framework
❏Send email
❏Track email opening
❏Clone website & save credentials
❏Graphs / Results
@haydnjohnson
Requirements - Phishing framework
Send Email
FiercePhish YES
GoPhish YES
SET YES
Cobalt Strike YES
@haydnjohnson
GoPhish
@haydnjohnson
FiercePhish
@haydnjohnson
Cobalt Strike
@haydnjohnson
Requirements - Phishing framework
Track Opening email
FiercePhish NO
GoPhish YES
SET YES
Cobalt Strike ????
@haydnjohnson
GoPhish
@haydnjohnson
Fierce Phish
@haydnjohnson
Requirements - Phishing framework
Clone a website & save credentials
FiercePhish NO
GoPhish YES
SET YES
Cobalt Strike YES
@haydnjohnson
GoPhish
@haydnjohnson
SET
@haydnjohnson
Cobalt Strike
@haydnjohnson
Requirements - Phishing framework
Graphs / Result recording
FiercePhish YES
GoPhish YES
SET YES
Cobalt Strike Probs
@haydnjohnson
Practice
@haydnjohnson
Morning Catch
VM
Practice Phishing
No DNS
https://blog.cobaltstrike.com/2014/08/06/introducing-morning-catch-a-phishing-paradise/
@haydnjohnson
Morning Catch
Login Page
https://blog.cobaltstrike.com/2014/08/06/introducing-morning-catch-a-phishing-paradise/
@haydnjohnson
Morning Catch
Email
https://blog.cobaltstrike.com/2014/08/06/introducing-morning-catch-a-phishing-paradise/
@haydnjohnson
Morning Catch
Warning:
@haydnjohnson
Webpages
@haydnjohnson
HTML
Not perfect
@haydnjohnson
HTML
Does the job
@haydnjohnson
Cloud – Digital Ocean
http://withr.me/add-domain-name-for-your-
server-on-digitalocean/
@haydnjohnson
Domain
@haydnjohnson
Domain
@haydnjohnson
All the payloads
@haydnjohnson
Different Payloads
@haydnjohnson
Payloads
❏HTA
❏Click Once
❏DLL
@haydnjohnson
Payloads
HTA (executable)
HTML Applications
https://enigma0x3.net/2016/03/15/phishing-with-empire/
https://en.wikipedia.org/wiki/HTML_Application
https://blog.malwarebytes.com/cybercrime/2016/09/surfacing-hta-infections/
@haydnjohnson
HTA
Empire
https://enigma0x3.net/2016/03/15/phishing-with-empire/
@haydnjohnson
HTA
@haydnjohnson
HTA
Testing
@haydnjohnson
HTA
User Interaction 1
@haydnjohnson
HTA
User Interaction 2
@haydnjohnson
HTA
User Interaction 3
@haydnjohnson
HTA
Receive Shell
@haydnjohnson
DLL
Empire
https://sensepost.com/blog/2016/intercepting-passwords-with-empire-and-winning/
@haydnjohnson
DLL
Creating DLL
@haydnjohnson
DLL
Serving DLL
@haydnjohnson
DLL
Serving DLL
@haydnjohnson
DLL
Rundll32.exe
@haydnjohnson
DLL
MSF Wouldn’t work
https://www.sixdub.net/?p=627
http://www.powershellempire.com/?page_id=135
@haydnjohnson
Click Once
@haydnjohnson
Click Once
Works up to Win 7
Requires Internet Explorer
Win 8 == Smart Screen Filter (Signed Cert)
https://blog.netspi.com/all-you-need-is-one-a-clickonce-love-story/
https://msdn.microsoft.com/en-us/library/t71a733d.aspx
https://msdn.microsoft.com/en-us/library/748fh114.aspx
@haydnjohnson
Click once
Placed in COA/Application Files/
@haydnjohnson
@haydnjohnson
Click Once
Using JavaScript
❏window.open()
@haydnjohnson
Click Once
Using JavaScript
❏IE blocks popup
@haydnjohnson
Click Once
Using JavaScript
❏2nd popup
@haydnjohnson
Click Once
“Click Once”
❏3rd popup
@haydnjohnson
Click Once
JavaScript
❏Too many things to click
❏User will become suscpicious
@haydnjohnson
Click Once - PHP
@haydnjohnson
Click Once
Submit Button
❏action=
@haydnjohnson
PHP page
Click Once
@haydnjohnson
Click Once
PHP to COA folder
❏header()
@haydnjohnson
Click Once
User Interaction #1
@haydnjohnson
Click Once
Calc.exe
@haydnjohnson
Key Take aways
@haydnjohnson
Lessons learned
❏ Consider the user intereaction
❏ Consider the technology to bypass
@haydnjohnson
Lessons learned
❏Things gonna not work
❏Try and test
❏Think outside the square
@haydnjohnson
Questions and
Comments
Thank you
@haydnjohnson
@haydnjohnson
Extra Links added since Talk
❏https://www.blackhat.com/docs/us-16/materials/us-16-Seymour-Tully-Weaponizing-Data-Science-For-Social-Engineering-Automated-E2E-
Spear-Phishing-On-Twitter.pdf
❏https://phishme.com/
❏https://www.trustedsec.com/september-2013/introducing-spearphisher-simple-phishing-email-generation-tool/
❏https://library.educause.edu/~/media/files/library/2016/4/phishingprograms.pdf
❏http://www.media-division.com/the-right-way-to-handle-file-downloads-in-php/
❏https://www.fireeye.com/blog/threat-research/2017/01/credit_card_dataand.html
❏https://github.com/securestate/king-phisher
❏https://developer.mozilla.org/en-US/docs/Web/API/Window/open
❏https://www.tripwire.com/state-of-security/featured/evolution-phishing/

Nolacon phishing 2017_haydn_johnson