WEBVTT 00:00:01.100 --> 00:00:04.110 In this demo, we're going to pick up where we left off in the last one, 00:00:04.840 --> 00:00:08.039 creating our email template to finalize all the steps we 00:00:08.039 --> 00:00:10.250 need to start our malicious link campaign. 00:00:11.240 --> 00:00:13.050 Let's head over to the Gophish admin page. 00:00:13.930 --> 00:00:18.370 The last step we need to take is to create the email template, so for 00:00:18.370 --> 00:00:21.650 that we'll go to Email Templates and click New Template. 00:00:22.390 --> 00:00:24.250 We'll go ahead and call this Malicious Link. 00:00:25.240 --> 00:00:28.950 If we had an example Morning Catch email, we could also import it to make 00:00:28.950 --> 00:00:32.220 things look more similar, but since we don't have one of those, 00:00:32.229 --> 00:00:33.850 we're going to go ahead and just type this. 00:00:34.480 --> 00:00:36.100 So, as we create this email, 00:00:36.110 --> 00:00:39.150 we need to remember that we're trying to send it as IT support 00:00:39.410 --> 00:00:43.370 and trying to convince our CEO, Richard Bourne, to enter his 00:00:43.370 --> 00:00:45.050 credentials on the Webmail page. 00:00:45.640 --> 00:00:48.210 We're going to need to create an email that's fairly convincing 00:00:48.220 --> 00:00:50.750 to get the CEO to try to log into the site. 00:00:51.460 --> 00:00:54.950 Since the CEO is likely to use Webmail from his home this evening, 00:00:55.440 --> 00:00:58.690 let's send an email stating that we had issues with the Webmail service 00:00:58.700 --> 00:01:02.530 and restored it, and before the CEO leaves the building, we want to 00:01:02.530 --> 00:01:05.050 confirm that he can log into the Webmail services. 00:01:05.840 --> 00:01:09.150 So for our subject, we'll use Webmail Service Restored. 00:01:10.490 --> 00:01:14.640 Now we can use a few template values that keep emails consistent throughout 00:01:14.640 --> 00:01:17.950 a campaign and personalize them for each user we target, 00:01:18.640 --> 00:01:21.920 starting with addressing them by their name using the 00:01:21.920 --> 00:01:24.470 .FirstName in double brackets variable. 00:01:26.140 --> 00:01:27.950 We'll put this at the beginning of the email, 00:01:28.190 --> 00:01:31.250 and for every user we target, it will insert their first name. 00:01:31.840 --> 00:01:34.390 We'll follow this with an explanation of the webmail 00:01:34.390 --> 00:01:38.750 service outage and restoration, and that we want to make sure that he can log in. 00:01:39.620 --> 00:01:43.610 We'll finish this email with a link to the Webmail login that he can click, 00:01:43.940 --> 00:01:46.650 and it will instead navigate to our landing page. 00:01:47.430 --> 00:01:48.040 To do that, 00:01:48.050 --> 00:01:51.800 we highlight this text and then select the link button and add 00:01:51.800 --> 00:01:55.880 the option .URL, also in double brackets. 00:01:56.940 --> 00:02:00.360 This will automatically create the link that we assign in the campaign. 00:02:01.240 --> 00:02:04.510 We can even add a line explaining that the same update caused 00:02:04.510 --> 00:02:07.900 the login page to have issues so that he's expecting them 00:02:07.900 --> 00:02:09.400 before he even clicks the link. 00:02:10.620 --> 00:02:16.890 Then we can sign the email IT Support Team. And then we'll go ahead 00:02:16.890 --> 00:02:20.590 and save the template, and now we have everything we need to launch 00:02:20.590 --> 00:02:24.650 our campaign and see if we can gather the CEO's credentials. To 00:02:24.650 --> 00:02:28.450 create a campaign, we're going to go ahead and go to Campaigns, and 00:02:28.450 --> 00:02:29.650 then click New Campaign. 00:02:30.340 --> 00:02:33.670 We'll call this one Malicious Link and use the Malicious 00:02:33.670 --> 00:02:38.270 Link template, the Webmail landing page, and our URL will be 00:02:38.270 --> 00:02:39.850 set to our Kali Linux machine. 00:02:40.520 --> 00:02:45.350 In my case, that's 192.168.178.56. 00:02:46.940 --> 00:02:50.190 We'll have the Launch Date being right now, and our Sending 00:02:50.190 --> 00:02:54.610 Profile will be the Morning Catch IT Staff, and our Group will be 00:02:54.610 --> 00:02:59.480 Morning Catch Executives, and now we can launch our campaign. 00:02:59.480 --> 00:03:01.650 We'll go ahead and click Yes, 00:03:02.940 --> 00:03:06.540 and we're redirected to the dashboard. So here on this dashboard 00:03:06.540 --> 00:03:10.160 we can see that our email has already been sent, and it's been 00:03:10.160 --> 00:03:13.150 sent to rbourne@morningcatch.ph. 00:03:14.660 --> 00:03:17.100 And we have our status for each of our users, and in this case, 00:03:17.100 --> 00:03:17.890 we only have one. 00:03:18.950 --> 00:03:22.950 And we can drill down and see our timeline, if we want, for each user. 00:03:23.830 --> 00:03:27.930 So now let's go ahead and go over to the Morning Catch VM and log in 00:03:27.930 --> 00:03:30.370 as Richard Bourne to see what that looks like. 00:03:31.540 --> 00:03:35.320 So on Richard Bourne's Thunderbird Client, we can see that we 00:03:35.320 --> 00:03:39.500 have an email from it looks like Boyd Jenius in IT, and it 00:03:39.500 --> 00:03:41.500 says Webmail Service Restored. 00:03:42.020 --> 00:03:43.710 Let's go ahead and double‑click on that and see what 00:03:43.710 --> 00:03:44.950 it looks like in the reading pane. 00:03:45.880 --> 00:03:49.640 And when we open it up, the display looks as if it was sent from Boyd Jenius, 00:03:49.890 --> 00:03:51.850 and it has the company email address, 00:03:52.440 --> 00:03:55.390 and we can also see that our personalization with Richard's name 00:03:55.400 --> 00:03:57.990 is now displayed and the link was created. 00:03:59.220 --> 00:04:02.720 Acting as Richard, let's pretend this convinced us to select this 00:04:02.720 --> 00:04:09.450 convenient link to the login, and we arrive at the landing page. 00:04:10.140 --> 00:04:12.080 It looks a little different than the corporate email, 00:04:12.200 --> 00:04:15.110 but it does still have the logo, and since the email 00:04:15.110 --> 00:04:16.790 told us it might be slightly different, 00:04:17.130 --> 00:04:21.060 let's go ahead and pretend that this convinced Richard to enter his user name, 00:04:21.230 --> 00:04:25.530 which is rbourne, and the password is password for all of the Morning 00:04:25.530 --> 00:04:30.120 Catch accounts. Now we'll go ahead and click Login, and we're 00:04:30.120 --> 00:04:32.850 redirected back to the regular Webmail address. 00:04:33.480 --> 00:04:34.030 From here, 00:04:34.040 --> 00:04:37.410 we can only hope that our social engineering was convincing enough that 00:04:37.410 --> 00:04:40.680 Richard Bourne does not report any issues and simply tries to login again 00:04:40.680 --> 00:04:46.190 as usual. Let's check back in the Gophish dashboard for the results. And 00:04:46.190 --> 00:04:51.590 we now see that the email was sent, opened, the link was clicked, and the 00:04:51.590 --> 00:04:55.750 data was submitted, and it was not reported that it was a phishing attempt. 00:04:57.640 --> 00:04:59.840 And we have a timeline of when all those actions were 00:04:59.840 --> 00:05:05.290 taken, and in the Submitted Data we can even view the 00:05:05.290 --> 00:05:07.900 credentials, rbourne and password. 00:05:09.280 --> 00:05:11.420 This will allow us to gain our initial access to 00:05:11.420 --> 00:05:13.650 Morning Catch through Remote Desktop. 00:05:14.940 --> 00:05:27.400 Let's go ahead and try that now. (Typing) And we've gained our 00:05:27.400 --> 00:05:31.480 initial access as Richard Bourne using Remote Desktop. Gophish 00:05:31.480 --> 00:05:34.500 makes it easy to send these types of social engineering emails to 00:05:34.500 --> 00:05:36.750 large batches of users very quickly, 00:05:37.120 --> 00:05:41.310 making it a valuable tool for internal phishing awareness campaigns, but also a 00:05:41.310 --> 00:05:45.100 useful tool for hackers to easily set up convincing landing pages and 00:05:45.100 --> 00:05:50.240 personalize each email. Before we move on to the next demo, let's do a quick 00:05:50.240 --> 00:05:52.350 recap of what we learned so far in this course. 00:05:53.100 --> 00:05:56.120 We started this demo by configuring the necessary options to 00:05:56.120 --> 00:05:58.360 create a phishing campaign using Gophish, 00:05:58.570 --> 00:06:02.950 including the sending profile, recipient groups, and email templates. 00:06:03.720 --> 00:06:04.190 Next, 00:06:04.200 --> 00:06:07.180 we created a landing page by importing the Webmail login 00:06:07.180 --> 00:06:09.450 page directly from the Morning Catch VM, 00:06:09.980 --> 00:06:12.350 and we set it up to capture the entered credentials. 00:06:12.940 --> 00:06:16.350 We then started the campaign and successfully captured the CEO's 00:06:16.350 --> 00:06:20.200 username and password. We viewed these results in the Gophish 00:06:20.200 --> 00:06:23.880 dashboard, and then we used those credentials to successfully gain 00:06:23.880 --> 00:06:26.650 initial access to the CEO's desktop.