WEBVTT 00:00:01.750 --> 00:00:02.560 In this demo, 00:00:02.560 --> 00:00:06.750 we're going to prepare King Phisher to gain initial access against our victim, 00:00:07.030 --> 00:00:08.490 the Globomantics CEO. 00:00:09.240 --> 00:00:09.660 First, 00:00:09.660 --> 00:00:13.720 we'll configure our campaign in King Phisher to enable our phishing attack. 00:00:13.720 --> 00:00:17.130 This will include techniques to improve the legitimacy of our 00:00:17.130 --> 00:00:20.310 attack in gaining trust in the eyes of our target. 00:00:21.040 --> 00:00:21.760 Once prepped, 00:00:21.760 --> 00:00:24.270 we'll put our work into action by attacking 00:00:24.270 --> 00:00:26.510 Globomantics with a basic phishing attack. 00:00:28.030 --> 00:00:30.050 Starting off on our Kali attack system, 00:00:30.050 --> 00:00:36.110 we will open King Phisher via the terminal by typing sudo space systemctl space 00:00:36.120 --> 00:00:40.160 start space king‑phisher to start the King Phisher server. 00:00:40.160 --> 00:00:50.000 Now we will type /usr/share/king‑phisher/KingPhisher and 00:00:50.000 --> 00:00:52.460 press Enter to open the King Phisher client. 00:00:53.340 --> 00:00:55.780 We enter our Kali credentials to connect the King Phisher 00:00:55.780 --> 00:00:59.700 client to the server by entering a username of kali and a 00:00:59.700 --> 00:01:02.100 password of kali and click Connect. 00:01:02.100 --> 00:01:04.780 Once authenticated to the King Phisher server, 00:01:04.790 --> 00:01:06.850 we are prompted to create a new campaign. 00:01:07.340 --> 00:01:10.280 We click New Campaign and we'll begin filling out the 00:01:10.280 --> 00:01:12.650 information to build our King Phisher campaign. 00:01:13.240 --> 00:01:17.330 We will name our campaign Globomantics Attack and click 00:01:17.330 --> 00:01:19.570 Next through to the company page. 00:01:20.040 --> 00:01:22.950 Creating this information will be important when leveraging the 00:01:22.950 --> 00:01:26.170 email templates which King Phisher can integrate with to build a 00:01:26.170 --> 00:01:30.150 dynamic campaign to help add legitimacy to the messages we send 00:01:30.500 --> 00:01:32.050 in the eyes of the target. 00:01:32.050 --> 00:01:35.290 We will select the new radio button and enter the 00:01:35.290 --> 00:01:37.260 Globomantics name in the Name field. 00:01:37.740 --> 00:01:39.960 Our description will be evil corporation, 00:01:40.440 --> 00:01:42.870 and we will define Industry as Technology. 00:01:43.540 --> 00:01:46.370 We will then enter the Globomantics website of 00:01:46.370 --> 00:01:50.300 globomantics.lan under the Main Site and click Next. 00:01:51.240 --> 00:01:54.960 We will then click Next to cycle through the remaining pages and 00:01:54.960 --> 00:01:57.450 apply our configuration on the confirm page. 00:01:58.140 --> 00:02:00.110 Now that we've configured our campaign, 00:02:00.280 --> 00:02:02.730 since this is the first time we are using King Phisher, 00:02:02.870 --> 00:02:05.710 we will next want to configure our SMTP server, 00:02:05.720 --> 00:02:08.160 which we will be using with our phishing attacks. 00:02:08.840 --> 00:02:14.320 We will select the Edit menu and click on Preferences and the SMTP Server tab. 00:02:14.320 --> 00:02:17.720 Here the SMTP server and the associated credentials to be 00:02:17.720 --> 00:02:19.430 used for your attack should be entered. 00:02:20.340 --> 00:02:24.660 I will use my SMTP server along with port 25 and the email 00:02:24.660 --> 00:02:27.690 address account associated with the SMTP server and click 00:02:27.690 --> 00:02:29.670 Apply to save the information. 00:02:29.670 --> 00:02:30.970 As you can see, 00:02:30.970 --> 00:02:34.640 one of the first benefits of creating a company profile for Globomantics 00:02:34.870 --> 00:02:37.760 is that the company name has been prepopulated for us. 00:02:38.340 --> 00:02:42.570 Let's start by entering a source email address in the globomantics.lan domain. 00:02:43.040 --> 00:02:47.910 We'll enter test@globomantics.lan in the Source Email SMTP field. 00:02:47.910 --> 00:02:52.140 We can then utilize the King Phisher feature to test our source IP 00:02:52.390 --> 00:02:54.970 to see if it will successfully pass an SPF check. 00:02:55.620 --> 00:02:56.260 Unfortunately, 00:02:56.260 --> 00:02:59.900 we are able to identify that since our attack server is not a 00:02:59.900 --> 00:03:02.360 part of the globomantics.lan MX record, 00:03:02.360 --> 00:03:06.280 if we attempt to use the company domain as our source address, 00:03:06.280 --> 00:03:08.730 our attack will fail to reach the target's inbox. 00:03:09.440 --> 00:03:10.120 Instead, 00:03:10.210 --> 00:03:13.540 let's reenter the SMTP source email address to use 00:03:13.540 --> 00:03:15.550 our configured mail server address. 00:03:16.410 --> 00:03:19.080 This will put us at a slight disadvantage in that when the 00:03:19.080 --> 00:03:21.530 source of the email is reviewed by our target, 00:03:21.790 --> 00:03:24.440 it will be a telltale sign that this message did not 00:03:24.450 --> 00:03:26.150 originate from the company domain. 00:03:26.640 --> 00:03:27.260 However, 00:03:27.270 --> 00:03:30.120 we will be able to use the MIME source email field 00:03:30.430 --> 00:03:32.380 to mask our send from address, 00:03:32.840 --> 00:03:36.370 thereby convincing the target that the message has originated from 00:03:36.370 --> 00:03:39.210 the globomantics.lan domain at first glance. 00:03:39.210 --> 00:03:41.490 In the source email MIME field, 00:03:41.540 --> 00:03:43.390 we will create a fake email address of 00:03:43.400 --> 00:03:47.730 helpdesk@globomantics.lan that will represent the address that 00:03:47.730 --> 00:03:50.760 the CEO should see when he receives the phishing attack. 00:03:51.340 --> 00:03:52.050 Additionally, 00:03:52.060 --> 00:03:54.720 we can make our attack appear more convincing by entering 00:03:54.720 --> 00:03:57.350 Helpdesk in the Friendly Alias field. 00:03:57.350 --> 00:04:01.090 Our subject line of our message will be Important: Please Read 00:04:01.400 --> 00:04:03.500 to create a sense of urgency to the message. 00:04:03.940 --> 00:04:08.550 And we will add our source SMTP address as the reply to address so 00:04:08.550 --> 00:04:11.070 that we will receive any replies from our victims. 00:04:12.040 --> 00:04:14.570 We can now move down to the target information. 00:04:14.730 --> 00:04:18.550 And for our attack purpose in which we're spearfishing the Globomantics CEO, 00:04:18.550 --> 00:04:21.630 we will select the Single Target radio button. 00:04:21.630 --> 00:04:26.300 If we were to attempt to target the larger Globomantics company with our attack, 00:04:26.310 --> 00:04:30.860 we can leverage the CSV file radio option and use a CSV file 00:04:30.990 --> 00:04:34.170 containing a precompiled list of attack targets in the 00:04:34.170 --> 00:04:37.970 Globomantics email domain to send a bulk attack rather than 00:04:37.970 --> 00:04:40.360 sending an individual attack to each victim. 00:04:40.360 --> 00:04:44.320 We will next enter the target's name and the target email address we 00:04:44.320 --> 00:04:49.350 enumerated from the social media platform of ceo@globomantics.lan. 00:04:50.320 --> 00:04:53.460 Let's also scroll down towards the bottom and change the Message 00:04:53.460 --> 00:04:57.100 Importance drop‑down menu to high importance and the Message 00:04:57.100 --> 00:05:00.550 Sensitivity to confidential to increase the urgency of the 00:05:00.550 --> 00:05:02.060 message we will use in our attack. 00:05:03.440 --> 00:05:06.870 Additionally, while we won't be using a web page for our attack, 00:05:06.950 --> 00:05:09.890 King Phisher does make the web server field required, 00:05:10.080 --> 00:05:13.330 so we will just use the Globomantics website as a placeholder. 00:05:14.010 --> 00:05:15.260 Under the Edit tab, 00:05:15.270 --> 00:05:19.250 we can begin to compose a freeform message similar to the phishing message 00:05:19.250 --> 00:05:21.950 we sent to the target via the social media platform. 00:05:22.440 --> 00:05:26.010 However, we are going to take advantage of the complementary templates, 00:05:26.020 --> 00:05:30.360 which King Phisher offers on the GitHub repository to improve the realistic 00:05:30.360 --> 00:05:34.470 nature of the message we will send in our attack. From the terminal, we can 00:05:34.470 --> 00:05:36.670 download the templates from the GitHub repo. 00:05:37.340 --> 00:05:40.480 We will type git space clone space 00:05:40.520 --> 00:05:56.430 https://github.com/rsmusllp/king‑phisher‑templates.git space documents 00:05:56.840 --> 00:06:01.440 and press Enter to download the template repo to our Kali user's documents 00:06:01.440 --> 00:06:01.910 folder. 00:06:02.440 --> 00:06:05.550 We can now pivot back to King Phisher and click Select 00:06:05.550 --> 00:06:08.860 File next to the Message HTML File field. 00:06:09.400 --> 00:06:10.790 Let's click on Documents, 00:06:11.340 --> 00:06:16.670 Email Templates, Credentials, Anti‑Virus_Update, and 00:06:16.670 --> 00:06:20.060 select the email.html file and click Open. 00:06:21.350 --> 00:06:22.920 Now when we click on Edit, 00:06:23.140 --> 00:06:25.950 we see the message template has loaded to our campaign. 00:06:27.040 --> 00:06:28.070 As we scroll down, 00:06:28.070 --> 00:06:31.840 we see a number of Jinja code snippets in the template, which King Phisher 00:06:31.840 --> 00:06:34.450 will populate upon sending the message to our target. 00:06:35.640 --> 00:06:39.340 Let's modify the template slightly for our attack by removing the 00:06:39.350 --> 00:06:44.820 url.web server HTML code line and replacing it with text requesting for 00:06:44.820 --> 00:06:48.870 the Globomantics CEO to reply back to the email with his company 00:06:48.870 --> 00:06:51.920 credentials. At the bottom of the template, 00:06:51.920 --> 00:06:54.720 we will also see a tracking_dot_image, 00:06:54.730 --> 00:06:57.940 which will be important in allowing us to track the successful 00:06:57.950 --> 00:07:02.200 opening of our phishing attack by our target. We can now click 00:07:02.200 --> 00:07:05.200 on the Preview tab to get a view of what our attack will look 00:07:05.200 --> 00:07:06.500 like before we send it. 00:07:07.540 --> 00:07:08.940 Moving to the Send tab, 00:07:08.950 --> 00:07:11.800 we are now ready to send our phishing campaign to the 00:07:11.800 --> 00:07:16.240 Globomantics CEO. Click the Start button. King Phisher will 00:07:16.240 --> 00:07:18.690 prompt us for our SMTP server password, 00:07:18.890 --> 00:07:22.910 which I will enter here, and we'll see that King Phisher runs through the send 00:07:22.910 --> 00:07:27.570 process and successfully sends our campaign to the target. Moving over to the 00:07:27.570 --> 00:07:31.850 system of the phishing target, we see when we open the email client that the 00:07:31.850 --> 00:07:34.590 attack has indeed arrived in the CEO inbox. 00:07:35.140 --> 00:07:39.260 The message appears to come from the Globomantics help desk, giving our attack 00:07:39.260 --> 00:07:45.100 validity in the eyes of the CEO as originating from Globomantics. Hopping back 00:07:45.100 --> 00:07:49.420 over to our attack system, we can click on the View Campaign tab and also 00:07:49.420 --> 00:07:53.360 validate that our target has indeed opened the message, which can be helpful in 00:07:53.360 --> 00:07:54.960 planning multilayered attacks. 00:07:55.950 --> 00:07:59.410 This will end our demo where we created and sent our King Phisher 00:07:59.410 --> 00:08:01.780 campaign to attack our Globomantics target, 00:08:02.240 --> 00:08:05.640 leveraging a King Phisher email template and a tracking image 00:08:05.750 --> 00:08:08.060 to help quantify the success of our attack.