In this demonstration,
we will look at how we can create a spearphishing attack
using the set toolkit. To get started, I'm going to issue
the command sudo setoolkit,
and this will start the setoolkit within Kali Linux. In
the initial menu, we've got six options.
We will focus now on the social engineering attacks, which is option number one.
Within the social engineering attacks,
we have a number of different attacks that we can actually create.
Let's go ahead and start with the spearphishing attack vector. Now,
spearphishing attacks gives you the ability to specifically craft an
attack directed at a organization or an individual.
And here we have three options.
I can perform a mass email attack, I can create a file payload,
or I can create a social engineering template.
I'm going to go ahead and create a file payload.
Now,
there's a number of payloads that I actually built into the
setoolkit. Over here, you can already see the integration
between set and the metasploit framework.
I'm going to use a pretty standard one, which is the PDF embedded EXE.
Now I have the option to either define my own PDF for an
attack, or I can use a built‑in blank PDF.
Let's go ahead and use a blank built‑in PDF. The next
options that we have is the reverse shells.
So here we've got 7 different types that we can actually use,
and I'm going to make use of the Windows Meterpreter Reverse
TCP based on the 64‑bit operating system.
I will select option five,
and now I have the option to define the payload listener.
If you were hosting your payload listener externally,
you could go ahead and use a URL or you could use a public IP address.
In my case,
I'm doing this in a lab LAN environment, so I'm going to use the default IP,
which is assigned to this machine.
And it's the 192.168.32.130 address.
You'll notice that we have the default by just hitting Enter.
It will accept that as the IP address.
I can now define the port that I want to connect back to.
I'm going to accept the defaults of port 443. Port 443
is a good option to use because, generally, in organizations,
internet browsing is allowed by default, and internet browsing
takes place on port 80, which is HTTP, or port 443,
which is HTTPS.
So we'll accept the default, and now set will go ahead and generate the payload.
Once the payload has been created,
I have the option to either keep the file name or I
can rename it to something else.
I'm going to rename this and we're going to use an attack
of leveraging an invoice as the PDF.
So I'm going to call this Invoice.pdf, and now I have the
ability to email this PDF out. So I can either go and use a
single address or a mass mail.
I will use a single email address,
and now I can either use a pre‑defined template or I can create my own template.
I will use a standard pre‑defined template.
And since we're using an invoice, I'm going to use option number nine,
which is for an order confirmation.
Now we have the option to define the email address that
we will send this phishing email to.
I'm going to use one of my lab accounts,
then we are presented with the option to use either a Gmail
account or your own mail server or an open relay. If you
choose to use a Gmail account,
the chances of the attack actually working is very slim.
Google puts in a lot of anti‑phishing capabilities and anti‑relay capabilities
into the email service, so my recommendation is to rather use your own server or
an open relay. I will use one of my own servers,
and next I will define the sender address.
Since we're using order confirmation,
I'm going to define this as orders@vendor.com, and now I'll define
the name from which the email will be sent from.
And now I have to put in my username for the open relay servers. So I defined
the username, and now I need to define the password, and then,
of course, the SMTP server and the port number.
I have the option to flag this email as high priority.
In my case, I'm going to flag it as high priority.
And then, of course, we have the option to define if we will use TLS or not.
And once we've defined all of the values, set will
go ahead and deliver the email.
Finally, we present with the option to set up a listener.
I'm going to go ahead and say Yes.
So what set did right now is it started up metasploit and it created the
Meterpreter listener, and pretty much it's just waiting to get a
connection back from the phishing email attachment.
I'm going to switch now to my Windows machine,
and I'm going to look at my email and see if the mail has been delivered.
Okay, so within my Windows machine, I have browsed to my email,
and I can see that my phishing email has been successfully delivered.
We have the details that we have defined. It's using the Order
Confirmation template. It is sent from Online Sales Team with an
email address of orders@vendor.com.
It's got some text in the body, and, of course, our malicious attachment.
So I'm going to go ahead and download this attachment.
I'm going to save it to my disk.
I'm going to open up this PDF using Adobe Reader,
and it's going to ask me to save a form.
Now if you put yourself in the shoes of the user,
the user is unsuspecting and might click on Save, and the
next step that the PDF does is it actually tries to look if
their form exists, and if it does,
it goes and it starts the form which actually has an embedded macro.
Now,
in the real world, these pop‑ups for macro notifications
might not be enabled in organizations,
and many organizations don't actually enable it.
I've enabled this to show you that the PDF is malicious, and
the various steps it's taken to spawn that reverse session
back to my Kali Linux machine.
So the default action would be to open this macro, and I'm going to
click on Open, and let's jump back to my Kali Linux machine. Now,
on my Kali Linux machine, I can see that I have a Meterpreter
session which has been spawned, and now that I have access to the machine,
I can use it for whatever purpose I want.