WEBVTT 00:00:01.130 --> 00:00:01.880 In this demo, 00:00:01.890 --> 00:00:04.059 we're going to use Gophish to prepare for a phishing 00:00:04.059 --> 00:00:07.140 campaign using a malicious attachment that opens a reverse 00:00:07.140 --> 00:00:09.050 shell back to our Kali Linux machine. 00:00:09.640 --> 00:00:13.090 We'll start by using Gophish to create the phishing email and then 00:00:13.090 --> 00:00:15.650 we'll add a malicious executable as an attachment. 00:00:16.140 --> 00:00:18.690 These steps are needed to successfully execute a phishing 00:00:18.690 --> 00:00:20.850 campaign using a different technique. 00:00:21.810 --> 00:00:25.250 If you're ready to get started, let's head over to the Gophish admin page. 00:00:26.240 --> 00:00:28.080 Now that our malicious link campaign is done, 00:00:28.110 --> 00:00:31.610 let's go ahead and click Complete and complete the campaign. 00:00:32.940 --> 00:00:33.340 Although, 00:00:33.340 --> 00:00:35.850 we are going to use a simple executable, instead of 00:00:35.850 --> 00:00:37.750 exploiting a specific vulnerability, 00:00:38.240 --> 00:00:41.480 the purpose of this exercise is on using Gophish with 00:00:41.480 --> 00:00:43.850 different phishing techniques and social engineering to 00:00:43.850 --> 00:00:45.750 convince a user to execute our payload. 00:00:46.310 --> 00:00:48.990 For this demo, we're going to again target Richard Bourne, 00:00:49.060 --> 00:00:52.650 the CEO, and send from Boyd Jenius IT support. 00:00:53.340 --> 00:00:57.140 We're going to try to trick the CEO into opening an executable attached to the 00:00:57.140 --> 00:01:00.350 email hopefully by posing as something that may help him. 00:01:01.340 --> 00:01:04.450 We already have the sending profile and recipient groups that we need. 00:01:05.340 --> 00:01:06.720 We won't need a landing page, 00:01:06.730 --> 00:01:10.950 so all we have to do is create a new email template and generate our executable. 00:01:12.140 --> 00:01:15.050 Let's start by creating our payload to attach the email. 00:01:16.540 --> 00:01:18.690 Rather than using a more complex exploit, 00:01:18.880 --> 00:01:21.240 we're going to keep it simple in this demo and use 00:01:21.240 --> 00:01:24.050 MSFVenom to generate a standalone executable. 00:01:24.880 --> 00:01:26.270 Under Richard Bourne's login, 00:01:26.360 --> 00:01:28.880 the morning catch VM simulates a vulnerable Windows 00:01:28.880 --> 00:01:31.190 platform with an x86 architecture. 00:01:32.080 --> 00:01:37.550 So within msfvenom, we use the architecture x86 and the platform windows. 00:01:38.100 --> 00:01:42.870 We're going to use the windows/shell_reverse_tcp payload, this will generate 00:01:42.870 --> 00:01:46.290 a reverse shell that connects back using the localhost, 00:01:46.360 --> 00:01:52.750 or LHOST, set to our Kali Linux machine and a port we specify using the LPORT, 00:01:53.310 --> 00:01:56.050 and in this case, we'll use Port 4444. 00:01:56.940 --> 00:02:01.240 Our output format will be an exe and sent to a file 00:02:01.250 --> 00:02:03.610 that we'll call testconnect.exe. 00:02:04.440 --> 00:02:08.039 We're calling the file testconnect because we're going to send an email 00:02:08.090 --> 00:02:11.780 stating that we have a new program that Richard can run to connect back 00:02:11.780 --> 00:02:15.010 through a VPN and allow him to use his desktop from home, 00:02:15.010 --> 00:02:18.320 but we want him to test it while he's still at work to 00:02:18.320 --> 00:02:20.050 make sure that it operates correctly. 00:02:22.040 --> 00:02:24.940 And once we verify that that exe is generated, 00:02:24.940 --> 00:02:29.350 we'll see it's saved as testconnect.exe in our home directory. 00:02:31.010 --> 00:02:34.050 Now that we have our payload, we're ready to create the email template. 00:02:35.140 --> 00:02:35.750 Once again, 00:02:35.760 --> 00:02:38.130 we'll be sending as Boyd and try to convince Richard 00:02:38.130 --> 00:02:39.650 to execute the attached payload. 00:02:41.740 --> 00:02:43.650 So we'll go ahead and create the new email template, 00:02:44.410 --> 00:02:46.050 and this time, we'll call it Attachment. 00:02:48.020 --> 00:02:52.500 For our subject, we're going to use New streamlined capability for home access. 00:02:53.540 --> 00:02:56.010 Okay, and we'll go to HTML, and I'll click Source. 00:02:56.940 --> 00:03:00.970 We use the same first name option at the beginning and follow this 00:03:00.970 --> 00:03:03.650 with an explanation of what the attached file does. 00:03:04.640 --> 00:03:07.880 Then we just need to attach our payload to the email and we 00:03:07.880 --> 00:03:09.950 can sign it Morning Catch IT Support. 00:03:12.980 --> 00:03:15.350 Now we'll just add the testconnect.exe file, 00:03:17.640 --> 00:03:19.850 and once we verify that it uploaded here, 00:03:19.860 --> 00:03:21.250 we can save the template. 00:03:22.390 --> 00:03:23.740 Now that everything is staged, 00:03:23.750 --> 00:03:27.900 we have one more step to complete before we start our campaign and that's to 00:03:27.900 --> 00:03:30.530 set up our listener so that if the attachment is opened, 00:03:30.810 --> 00:03:33.750 the target workstation will connect back to our attacking machine. 00:03:34.740 --> 00:03:38.650 For this simple shell, we'll use Netcat and listen over Port 4444. 00:03:40.620 --> 00:03:43.030 Now we're ready to launch our campaign and see if we can get 00:03:43.030 --> 00:03:45.250 Richard Bourne to execute our malicious payload. 00:03:46.140 --> 00:03:49.650 So we'll go to Campaigns and click New Campaign, 00:03:50.640 --> 00:03:52.750 we'll call this one Malicious Attachment, 00:03:53.940 --> 00:03:56.550 and for the email template, we'll select Attachment. 00:03:58.200 --> 00:03:59.990 The landing page we'll just leave as‑is, 00:03:59.990 --> 00:04:01.840 even though it's irrelevant for this campaign, 00:04:02.630 --> 00:04:04.650 as is the URL since we don't have a link. 00:04:05.780 --> 00:04:07.130 The sending profile is, again, 00:04:07.130 --> 00:04:11.850 Morning Catch IT Staff and the groups are Morning Catch Executives. 00:04:12.630 --> 00:04:13.650 Let's go ahead and launch it, 00:04:16.540 --> 00:04:20.980 and then we see our dashboard again and the email is confirmed as sent. 00:04:21.089 --> 00:04:24.950 So let's head back over to the morning catch VM and see what we get. 00:04:26.040 --> 00:04:30.630 So now we see our new email is in from Boyd Jenius in IT and 00:04:30.630 --> 00:04:33.100 he has some kind of new streamlined capability for home 00:04:33.100 --> 00:04:34.950 access along with an attachment. 00:04:35.340 --> 00:04:37.150 Let's go ahead and open it up and read it. 00:04:37.840 --> 00:04:42.050 Again, most of our stuff worked, it sent from Boyd Jenius in IT, 00:04:43.000 --> 00:04:46.060 and our personalization at the beginning worked with our first name, 00:04:46.060 --> 00:04:51.380 it was replaced with Richard, and we see our attachment that we want to have run. 00:04:52.240 --> 00:04:54.100 So let's just, acting as Richard, 00:04:54.110 --> 00:04:56.280 say that this convinced us to go ahead and download this 00:04:56.280 --> 00:04:59.550 attachment and we'll download it to our desktop. 00:05:01.620 --> 00:05:02.650 And there it is. 00:05:03.340 --> 00:05:05.450 So since Boyd Jenius told us to, 00:05:05.450 --> 00:05:09.950 we're going to go ahead and run it and it seems to me 00:05:09.950 --> 00:05:11.400 like it's configuring something. 00:05:12.840 --> 00:05:14.410 So once the attachment is open, 00:05:15.140 --> 00:05:18.450 let's head back to our Kali Linux machine and see if we got that shell, 00:05:19.600 --> 00:05:20.520 and there it is. 00:05:20.520 --> 00:05:22.280 We now have a shell, and again, 00:05:22.290 --> 00:05:25.050 our initial access on the morning catch virtual machine. 00:05:26.930 --> 00:05:29.750 Let's head over to our dashboard and see what those results look like. 00:05:32.540 --> 00:05:34.740 And you'll notice that even if we click Refresh, 00:05:36.440 --> 00:05:41.890 all we get is details that the email was sent and nothing about it being opened. 00:05:42.000 --> 00:05:45.350 There was no link to click and no data to submit, 00:05:46.340 --> 00:05:51.610 so this is one limitation of Gophish, but from a hacker's perspective, 00:05:51.620 --> 00:05:55.120 they're not going to care what a dashboard says, they've achieved their 00:05:55.120 --> 00:05:59.430 goal once this reverse shell opened. Before we move on, let's do a quick 00:05:59.430 --> 00:06:01.650 recap of what we learned so far in this course. 00:06:02.040 --> 00:06:05.710 We started the demo by reconfiguring the necessary options to create a 00:06:05.710 --> 00:06:10.540 malicious attachment phishing campaign using Gophish. Next, we created a 00:06:10.540 --> 00:06:15.150 malicious payload using MSFVenom and attached it to our email template. 00:06:16.190 --> 00:06:19.560 We started the campaign and successfully opened a reverse shell on the 00:06:19.560 --> 00:06:20.550 target workstation.