WEBVTT 00:00:00.730 --> 00:00:01.900 In this demonstration, 00:00:02.050 --> 00:00:04.970 we will look at how we can create a spearphishing attack 00:00:05.160 --> 00:00:10.030 using the set toolkit. To get started, I'm going to issue 00:00:10.030 --> 00:00:12.560 the command sudo setoolkit, 00:00:12.980 --> 00:00:17.080 and this will start the setoolkit within Kali Linux. In 00:00:17.080 --> 00:00:19.510 the initial menu, we've got six options. 00:00:20.110 --> 00:00:23.910 We will focus now on the social engineering attacks, which is option number one. 00:00:24.640 --> 00:00:26.460 Within the social engineering attacks, 00:00:26.610 --> 00:00:29.210 we have a number of different attacks that we can actually create. 00:00:29.610 --> 00:00:33.490 Let's go ahead and start with the spearphishing attack vector. Now, 00:00:33.490 --> 00:00:37.770 spearphishing attacks gives you the ability to specifically craft an 00:00:37.770 --> 00:00:41.310 attack directed at a organization or an individual. 00:00:41.450 --> 00:00:43.050 And here we have three options. 00:00:43.300 --> 00:00:47.310 I can perform a mass email attack, I can create a file payload, 00:00:47.820 --> 00:00:50.200 or I can create a social engineering template. 00:00:50.390 --> 00:00:53.150 I'm going to go ahead and create a file payload. 00:00:53.720 --> 00:00:53.890 Now, 00:00:53.890 --> 00:00:56.760 there's a number of payloads that I actually built into the 00:00:56.760 --> 00:01:00.300 setoolkit. Over here, you can already see the integration 00:01:00.460 --> 00:01:03.180 between set and the metasploit framework. 00:01:03.380 --> 00:01:06.940 I'm going to use a pretty standard one, which is the PDF embedded EXE. 00:01:07.710 --> 00:01:10.690 Now I have the option to either define my own PDF for an 00:01:10.690 --> 00:01:13.900 attack, or I can use a built‑in blank PDF. 00:01:13.960 --> 00:01:16.930 Let's go ahead and use a blank built‑in PDF. The next 00:01:16.930 --> 00:01:19.770 options that we have is the reverse shells. 00:01:19.780 --> 00:01:22.630 So here we've got 7 different types that we can actually use, 00:01:22.640 --> 00:01:25.860 and I'm going to make use of the Windows Meterpreter Reverse 00:01:25.860 --> 00:01:29.030 TCP based on the 64‑bit operating system. 00:01:29.040 --> 00:01:30.150 I will select option five, 00:01:30.160 --> 00:01:32.730 and now I have the option to define the payload listener. 00:01:32.850 --> 00:01:35.450 If you were hosting your payload listener externally, 00:01:35.660 --> 00:01:39.620 you could go ahead and use a URL or you could use a public IP address. 00:01:39.850 --> 00:01:40.490 In my case, 00:01:40.500 --> 00:01:44.830 I'm doing this in a lab LAN environment, so I'm going to use the default IP, 00:01:44.830 --> 00:01:46.390 which is assigned to this machine. 00:01:46.890 --> 00:01:51.210 And it's the 192.168.32.130 address. 00:01:51.220 --> 00:01:54.070 You'll notice that we have the default by just hitting Enter. 00:01:54.170 --> 00:01:56.240 It will accept that as the IP address. 00:01:56.360 --> 00:01:59.110 I can now define the port that I want to connect back to. 00:01:59.360 --> 00:02:02.500 I'm going to accept the defaults of port 443. Port 443 00:02:02.500 --> 00:02:05.590 is a good option to use because, generally, in organizations, 00:02:05.600 --> 00:02:08.740 internet browsing is allowed by default, and internet browsing 00:02:08.810 --> 00:02:12.810 takes place on port 80, which is HTTP, or port 443, 00:02:12.930 --> 00:02:13.770 which is HTTPS. 00:02:14.310 --> 00:02:18.000 So we'll accept the default, and now set will go ahead and generate the payload. 00:02:18.230 --> 00:02:20.110 Once the payload has been created, 00:02:20.390 --> 00:02:22.790 I have the option to either keep the file name or I 00:02:22.790 --> 00:02:24.250 can rename it to something else. 00:02:24.490 --> 00:02:27.010 I'm going to rename this and we're going to use an attack 00:02:27.010 --> 00:02:29.370 of leveraging an invoice as the PDF. 00:02:29.380 --> 00:02:32.390 So I'm going to call this Invoice.pdf, and now I have the 00:02:32.390 --> 00:02:36.150 ability to email this PDF out. So I can either go and use a 00:02:36.150 --> 00:02:38.480 single address or a mass mail. 00:02:38.560 --> 00:02:40.200 I will use a single email address, 00:02:40.360 --> 00:02:44.560 and now I can either use a pre‑defined template or I can create my own template. 00:02:44.650 --> 00:02:46.580 I will use a standard pre‑defined template. 00:02:46.780 --> 00:02:50.610 And since we're using an invoice, I'm going to use option number nine, 00:02:50.660 --> 00:02:52.570 which is for an order confirmation. 00:02:52.740 --> 00:02:55.620 Now we have the option to define the email address that 00:02:55.630 --> 00:02:57.550 we will send this phishing email to. 00:02:57.620 --> 00:03:00.040 I'm going to use one of my lab accounts, 00:03:00.290 --> 00:03:02.920 then we are presented with the option to use either a Gmail 00:03:02.920 --> 00:03:06.320 account or your own mail server or an open relay. If you 00:03:06.320 --> 00:03:07.790 choose to use a Gmail account, 00:03:07.870 --> 00:03:10.450 the chances of the attack actually working is very slim. 00:03:10.500 --> 00:03:14.950 Google puts in a lot of anti‑phishing capabilities and anti‑relay capabilities 00:03:14.950 --> 00:03:19.290 into the email service, so my recommendation is to rather use your own server or 00:03:19.290 --> 00:03:22.320 an open relay. I will use one of my own servers, 00:03:22.350 --> 00:03:24.980 and next I will define the sender address. 00:03:25.100 --> 00:03:26.860 Since we're using order confirmation, 00:03:26.870 --> 00:03:32.290 I'm going to define this as orders@vendor.com, and now I'll define 00:03:32.290 --> 00:03:35.120 the name from which the email will be sent from. 00:03:35.140 --> 00:03:39.310 And now I have to put in my username for the open relay servers. So I defined 00:03:39.310 --> 00:03:42.310 the username, and now I need to define the password, and then, 00:03:42.310 --> 00:03:45.910 of course, the SMTP server and the port number. 00:03:45.920 --> 00:03:48.650 I have the option to flag this email as high priority. 00:03:48.840 --> 00:03:51.350 In my case, I'm going to flag it as high priority. 00:03:51.340 --> 00:03:55.040 And then, of course, we have the option to define if we will use TLS or not. 00:03:55.210 --> 00:03:58.210 And once we've defined all of the values, set will 00:03:58.210 --> 00:03:59.770 go ahead and deliver the email. 00:04:00.740 --> 00:04:03.670 Finally, we present with the option to set up a listener. 00:04:03.800 --> 00:04:05.540 I'm going to go ahead and say Yes. 00:04:06.140 --> 00:04:10.760 So what set did right now is it started up metasploit and it created the 00:04:10.760 --> 00:04:14.390 Meterpreter listener, and pretty much it's just waiting to get a 00:04:14.390 --> 00:04:17.310 connection back from the phishing email attachment. 00:04:17.510 --> 00:04:19.579 I'm going to switch now to my Windows machine, 00:04:19.970 --> 00:04:23.290 and I'm going to look at my email and see if the mail has been delivered. 00:04:23.640 --> 00:04:26.750 Okay, so within my Windows machine, I have browsed to my email, 00:04:26.940 --> 00:04:30.100 and I can see that my phishing email has been successfully delivered. 00:04:30.360 --> 00:04:33.370 We have the details that we have defined. It's using the Order 00:04:33.370 --> 00:04:37.460 Confirmation template. It is sent from Online Sales Team with an 00:04:37.460 --> 00:04:39.630 email address of orders@vendor.com. 00:04:39.780 --> 00:04:43.880 It's got some text in the body, and, of course, our malicious attachment. 00:04:44.540 --> 00:04:46.750 So I'm going to go ahead and download this attachment. 00:04:47.440 --> 00:04:48.750 I'm going to save it to my disk. 00:04:49.240 --> 00:04:52.150 I'm going to open up this PDF using Adobe Reader, 00:04:52.700 --> 00:04:54.510 and it's going to ask me to save a form. 00:04:54.590 --> 00:04:56.640 Now if you put yourself in the shoes of the user, 00:04:56.830 --> 00:04:59.470 the user is unsuspecting and might click on Save, and the 00:04:59.470 --> 00:05:02.370 next step that the PDF does is it actually tries to look if 00:05:02.370 --> 00:05:04.250 their form exists, and if it does, 00:05:04.490 --> 00:05:08.350 it goes and it starts the form which actually has an embedded macro. 00:05:08.450 --> 00:05:08.660 Now, 00:05:08.660 --> 00:05:12.330 in the real world, these pop‑ups for macro notifications 00:05:12.330 --> 00:05:14.550 might not be enabled in organizations, 00:05:14.540 --> 00:05:16.900 and many organizations don't actually enable it. 00:05:17.080 --> 00:05:20.240 I've enabled this to show you that the PDF is malicious, and 00:05:20.240 --> 00:05:23.110 the various steps it's taken to spawn that reverse session 00:05:23.110 --> 00:05:25.120 back to my Kali Linux machine. 00:05:25.240 --> 00:05:28.070 So the default action would be to open this macro, and I'm going to 00:05:28.070 --> 00:05:31.100 click on Open, and let's jump back to my Kali Linux machine. Now, 00:05:31.280 --> 00:05:34.040 on my Kali Linux machine, I can see that I have a Meterpreter 00:05:34.040 --> 00:05:38.050 session which has been spawned, and now that I have access to the machine, 00:05:38.260 --> 00:05:40.300 I can use it for whatever purpose I want.