WEBVTT 00:00:01.740 --> 00:00:02.440 In this demo, 00:00:02.440 --> 00:00:05.270 we're going to leverage King Phisher to craft and host the 00:00:05.270 --> 00:00:08.480 landing page to complement our phishing attack to gain 00:00:08.480 --> 00:00:10.300 initial access against our victim. 00:00:10.920 --> 00:00:14.360 Adding a landing page to our attack will enable us to further add 00:00:14.360 --> 00:00:18.160 legitimacy to our campaign and extend our attack capabilities by 00:00:18.160 --> 00:00:19.900 gathering credentials from our target. 00:00:21.140 --> 00:00:21.930 For this demo, 00:00:21.930 --> 00:00:25.520 we're going to start off in King Phisher on our attack system and 00:00:25.520 --> 00:00:28.000 use our existing Globomantics attack campaign. 00:00:28.810 --> 00:00:30.360 In addition to email templates, 00:00:30.470 --> 00:00:33.690 King Phisher also has a repository of website templates, 00:00:33.700 --> 00:00:35.760 which can be used for landing pages. 00:00:36.410 --> 00:00:40.390 Let's go ahead and download a fresh copy of the templates from GitHub. 00:00:40.390 --> 00:00:41.610 From the terminal, 00:00:41.610 --> 00:00:44.740 we will type git space clone space 00:00:44.750 --> 00:00:57.580 https://github.com/rsmusllp/king‑phisher‑templates.git space Documents 00:00:57.800 --> 00:01:02.450 and press Enter to download the template repo to are Kali users documents folder. 00:01:03.440 --> 00:01:05.870 We will open our document folder and take a look at the 00:01:05.870 --> 00:01:08.170 packages under Website_Templates. 00:01:08.720 --> 00:01:10.950 There are a few template options here to choose from. 00:01:11.510 --> 00:01:16.620 Let's go with the Credentials templates and select the Anti‑Virus_Update folder. 00:01:16.620 --> 00:01:20.000 Here we will see all the files King Phisher has provided for 00:01:20.000 --> 00:01:22.390 us to create a full website landing page, 00:01:22.620 --> 00:01:26.280 including HTML files, sample images, and CSS. 00:01:27.230 --> 00:01:30.660 We will start with the README file to get an understanding of the template 00:01:30.660 --> 00:01:34.730 scenario to make sure this is a good candidate for our landing page and 00:01:34.730 --> 00:01:38.070 review any modifications which need to be made to the template to 00:01:38.070 --> 00:01:40.360 successfully use our King Phisher campaign. 00:01:41.240 --> 00:01:42.940 This scenario looks to be a good choice, 00:01:42.950 --> 00:01:46.290 which complements our existing campaign to extend our solicitation 00:01:46.290 --> 00:01:48.950 for credentials related to an anti‑virus update. 00:01:49.640 --> 00:01:53.060 Let's click on the login.html file to get a sense of what the 00:01:53.060 --> 00:01:54.950 landing page will look like to our target. 00:01:55.840 --> 00:01:59.040 We see that we receive some legitimate‑looking information about 00:01:59.040 --> 00:02:01.320 the actions targets need to take on the page, 00:02:01.550 --> 00:02:03.930 as well as a place to have them enter their credentials, 00:02:04.130 --> 00:02:05.470 which we are looking to harvest. 00:02:06.440 --> 00:02:08.970 Now let's open a new browser tab and go to the 00:02:08.970 --> 00:02:11.260 Globomantics website to gather content, 00:02:11.260 --> 00:02:13.930 which we can add to our template to make our landing page 00:02:13.930 --> 00:02:15.950 appear more legitimate for our target. 00:02:16.840 --> 00:02:20.230 Scrolling to the bottom of the page, let's grab the Globomantics logo, 00:02:20.320 --> 00:02:23.370 which we can use to replace the stock King Phisher logo. 00:02:23.740 --> 00:02:27.420 We will right‑click on the image and save it to the Images folder under the 00:02:27.420 --> 00:02:32.390 template location on our Kali system and name the file logo.spg. 00:02:33.250 --> 00:02:36.100 Let's next right‑click on the web page and click View Source. 00:02:37.040 --> 00:02:39.380 Here we see the source contains an icon file, 00:02:39.390 --> 00:02:43.910 which we will click on and click Save As favicon.ico, 00:02:44.320 --> 00:02:48.740 replacing the existing icon file in the images folder under the template. 00:02:48.740 --> 00:02:50.980 Navigating back to the page source, 00:02:50.980 --> 00:02:55.420 let's also take a look at the style‑home CSS file to identify 00:02:55.420 --> 00:02:58.870 some of the colors the Globomantics website has so we can mimic 00:02:58.870 --> 00:03:00.950 that look and feel on our landing page. 00:03:01.540 --> 00:03:07.570 Scrolling down, I see that the background color is set at a hex value of 212121. 00:03:08.040 --> 00:03:12.070 Let's make note of that for modifying our template CSS later on. 00:03:12.070 --> 00:03:13.320 Closing our browser, 00:03:13.330 --> 00:03:16.120 we are going to start opening our template files from our 00:03:16.120 --> 00:03:18.450 terminal to modify them for our needs. 00:03:19.030 --> 00:03:21.870 Let's start with the template CSS while we have the 00:03:21.870 --> 00:03:24.760 Globomantics web background color fresh in our mind. 00:03:24.760 --> 00:03:28.860 We will enter the command nano space and then the file path 00:03:29.040 --> 00:03:34.440 ending with style‑login‑new.css and press Enter. 00:03:35.030 --> 00:03:36.810 Scrolling down in our text editor, 00:03:36.820 --> 00:03:42.850 we will update the background to 212121 in the footer bottom section. 00:03:43.440 --> 00:03:47.440 We will now press Ctrl+O to save followed by Enter and 00:03:47.440 --> 00:03:49.570 then Ctrl+X to close out of nano. 00:03:50.000 --> 00:03:52.850 Let's now open our HTML files with nano as well. 00:03:53.340 --> 00:03:57.060 We will start with the login file using nano to navigate to the file path. 00:03:57.540 --> 00:04:01.920 Here we will update the extension logo from a PNG file to an SPG 00:04:01.920 --> 00:04:05.070 file and again save our output and close out nano. 00:04:05.740 --> 00:04:09.910 Let's also perform the same action with nano on the scan HTML file, 00:04:09.980 --> 00:04:13.680 changing the logo extension from a PNG to an SPG file. 00:04:14.340 --> 00:04:17.290 Additionally, for the README file we reviewed earlier, 00:04:17.290 --> 00:04:20.209 we will need to scroll down in our text editor to update 00:04:20.209 --> 00:04:21.839 the link to the company home page, 00:04:21.850 --> 00:04:24.660 which is important because once our target finishes 00:04:24.660 --> 00:04:26.210 engaging with our landing page, 00:04:26.220 --> 00:04:30.100 we want to redirect them to the Globomantics website to reduce any 00:04:30.100 --> 00:04:33.450 suspicion regarding the legitimacy of the landing page. 00:04:33.940 --> 00:04:37.320 On line 40, let's remove www from the URL, 00:04:37.630 --> 00:04:42.850 as well as replace .com with .lan and save our output and exit nano once again. 00:04:43.640 --> 00:04:47.530 Now that we have customize our King Phisher landing page template for our needs, 00:04:47.540 --> 00:04:49.400 we can load it into our campaign. 00:04:50.040 --> 00:04:50.430 First, 00:04:50.430 --> 00:04:55.160 we will want to review the server_config.yml file to understand how to 00:04:55.160 --> 00:04:58.050 properly load our customized template into our campaign. 00:04:58.640 --> 00:04:59.590 From the terminal, 00:04:59.600 --> 00:05:10.900 we will run sudo space nano space /usr/share/king‑phiser/server_config.yml. 00:05:11.440 --> 00:05:14.770 Here we can see the full configuration and modify, if needed, 00:05:15.010 --> 00:05:16.960 any of the King Phisher server settings. 00:05:17.640 --> 00:05:22.560 One key field here to highlight is the set require_id field. 00:05:23.740 --> 00:05:25.230 When this is set to true, 00:05:25.620 --> 00:05:29.070 it affords our attack a bit of anonymity in that it will prevent 00:05:29.070 --> 00:05:32.470 anyone from accessing our landing page without the unique ID 00:05:32.470 --> 00:05:34.860 generated when King Phisher sends our attack. 00:05:35.620 --> 00:05:37.290 If you want a more open campaign, 00:05:37.450 --> 00:05:41.110 this field can be updated to false. Scrolling through the 00:05:41.110 --> 00:05:43.050 configuration at the bottom of the file, 00:05:43.220 --> 00:05:46.890 we see the current web root directory. This is the directory 00:05:46.890 --> 00:05:48.870 which hosts our landing page in our attack. 00:05:49.340 --> 00:05:52.820 So we will want to note the directory path so we may transfer our 00:05:52.820 --> 00:05:56.150 template to that location to make our landing page live. 00:05:56.850 --> 00:06:00.330 Let's now close out of nano and transfer our template to the web root 00:06:00.330 --> 00:06:06.400 directory with the command sudo space cp space ‑vr space 00:06:06.400 --> 00:06:20.720 Documents/Website_Templates/Credentials/Anti‑Virus_Update/www space 00:06:20.720 --> 00:06:25.960 /var/lib/king‑phisher/ and press Enter. 00:06:26.940 --> 00:06:28.890 Now that our landing page is live, 00:06:28.900 --> 00:06:32.410 let's move back to King Phisher and review our existing campaign. 00:06:32.690 --> 00:06:38.250 We will update the web server URL to globomatics.lan/login, 00:06:38.640 --> 00:06:42.290 which is a domain I have registered for my attack system hosting the landing 00:06:42.290 --> 00:06:47.290 page, which looks similar to the Globomantics web address and click Verify 00:06:47.380 --> 00:06:51.490 to ensure that the landing page is indeed live. We will head over to the 00:06:51.490 --> 00:06:53.260 Send tab and click the Start button. 00:06:53.840 --> 00:06:58.070 King Phisher will prompt us for our SMTP server password, which I will enter 00:06:58.070 --> 00:07:03.310 here, and success. King Phisher has sent our phishing attack. Moving over to 00:07:03.310 --> 00:07:07.050 the system of the phishing target, we see when we opened the mail client that 00:07:07.050 --> 00:07:09.430 the attack has arrived in the CEO inbox. 00:07:09.940 --> 00:07:13.770 Let's open the message and this time click on the link. Our crafted 00:07:13.770 --> 00:07:17.160 landing page will appear, and we see it now contains our custom 00:07:17.160 --> 00:07:22.240 Globomantics content to add legitimacy to are ask for credentials. As the 00:07:22.240 --> 00:07:26.070 CEO, we'll enter his credentials in the Username and Password fields 00:07:26.640 --> 00:07:32.670 using a username of ceo@globomantics.lan and a password of password and 00:07:32.670 --> 00:07:37.860 click OK. The CEO is then taken to a scanning page where his machine is 00:07:37.860 --> 00:07:41.870 purportedly being scanned. And once complete, he is prompted to continue, 00:07:42.440 --> 00:07:44.690 which, as we know from our template configuration, 00:07:44.840 --> 00:07:48.690 takes him back to the Globomantics website, none the wiser that he has 00:07:48.690 --> 00:07:51.250 just been phished and provided us his credentials. 00:07:51.620 --> 00:07:55.670 If we move back to our attack system and navigate to the View Campaign Tab in 00:07:55.670 --> 00:07:59.530 King Phisher, we can see we have the ability to view the credentials provided 00:07:59.530 --> 00:08:04.270 to us under the Credentials section. Showing secrets will indeed reveal that 00:08:04.270 --> 00:08:08.510 we have successfully gathered the CEO of Globomantics credentials as a part 00:08:08.510 --> 00:08:09.960 of gaining initial access. 00:08:10.440 --> 00:08:13.970 This will end our demo where we built the landing page to go along 00:08:13.970 --> 00:08:15.980 with our phishing attack using King Phisher. 00:08:16.540 --> 00:08:17.200 Additionally, 00:08:17.200 --> 00:08:19.950 we were able to use the landing page to gather our target's 00:08:19.950 --> 00:08:22.360 credentials while gaining initial access.