In this demo, we're going to pick up where we left off in the last one,
creating our email template to finalize all the steps we
need to start our malicious link campaign.
Let's head over to the Gophish admin page.
The last step we need to take is to create the email template, so for
that we'll go to Email Templates and click New Template.
We'll go ahead and call this Malicious Link.
If we had an example Morning Catch email, we could also import it to make
things look more similar, but since we don't have one of those,
we're going to go ahead and just type this.
So, as we create this email,
we need to remember that we're trying to send it as IT support
and trying to convince our CEO, Richard Bourne, to enter his
credentials on the Webmail page.
We're going to need to create an email that's fairly convincing
to get the CEO to try to log into the site.
Since the CEO is likely to use Webmail from his home this evening,
let's send an email stating that we had issues with the Webmail service
and restored it, and before the CEO leaves the building, we want to
confirm that he can log into the Webmail services.
So for our subject, we'll use Webmail Service Restored.
Now we can use a few template values that keep emails consistent throughout
a campaign and personalize them for each user we target,
starting with addressing them by their name using the
.FirstName in double brackets variable.
We'll put this at the beginning of the email,
and for every user we target, it will insert their first name.
We'll follow this with an explanation of the webmail
service outage and restoration, and that we want to make sure that he can log in.
We'll finish this email with a link to the Webmail login that he can click,
and it will instead navigate to our landing page.
To do that,
we highlight this text and then select the link button and add
the option .URL, also in double brackets.
This will automatically create the link that we assign in the campaign.
We can even add a line explaining that the same update caused
the login page to have issues so that he's expecting them
before he even clicks the link.
Then we can sign the email IT Support Team. And then we'll go ahead
and save the template, and now we have everything we need to launch
our campaign and see if we can gather the CEO's credentials. To
create a campaign, we're going to go ahead and go to Campaigns, and
then click New Campaign.
We'll call this one Malicious Link and use the Malicious
Link template, the Webmail landing page, and our URL will be
set to our Kali Linux machine.
In my case, that's 192.168.178.56.
We'll have the Launch Date being right now, and our Sending
Profile will be the Morning Catch IT Staff, and our Group will be
Morning Catch Executives, and now we can launch our campaign.
We'll go ahead and click Yes,
and we're redirected to the dashboard. So here on this dashboard
we can see that our email has already been sent, and it's been
sent to rbourne@morningcatch.ph.
And we have our status for each of our users, and in this case,
we only have one.
And we can drill down and see our timeline, if we want, for each user.
So now let's go ahead and go over to the Morning Catch VM and log in
as Richard Bourne to see what that looks like.
So on Richard Bourne's Thunderbird Client, we can see that we
have an email from it looks like Boyd Jenius in IT, and it
says Webmail Service Restored.
Let's go ahead and double‑click on that and see what
it looks like in the reading pane.
And when we open it up, the display looks as if it was sent from Boyd Jenius,
and it has the company email address,
and we can also see that our personalization with Richard's name
is now displayed and the link was created.
Acting as Richard, let's pretend this convinced us to select this
convenient link to the login, and we arrive at the landing page.
It looks a little different than the corporate email,
but it does still have the logo, and since the email
told us it might be slightly different,
let's go ahead and pretend that this convinced Richard to enter his user name,
which is rbourne, and the password is password for all of the Morning
Catch accounts. Now we'll go ahead and click Login, and we're
redirected back to the regular Webmail address.
From here,
we can only hope that our social engineering was convincing enough that
Richard Bourne does not report any issues and simply tries to login again
as usual. Let's check back in the Gophish dashboard for the results. And
we now see that the email was sent, opened, the link was clicked, and the
data was submitted, and it was not reported that it was a phishing attempt.
And we have a timeline of when all those actions were
taken, and in the Submitted Data we can even view the
credentials, rbourne and password.
This will allow us to gain our initial access to
Morning Catch through Remote Desktop.
Let's go ahead and try that now. (Typing) And we've gained our
initial access as Richard Bourne using Remote Desktop. Gophish
makes it easy to send these types of social engineering emails to
large batches of users very quickly,
making it a valuable tool for internal phishing awareness campaigns, but also a
useful tool for hackers to easily set up convincing landing pages and
personalize each email. Before we move on to the next demo, let's do a quick
recap of what we learned so far in this course.
We started this demo by configuring the necessary options to
create a phishing campaign using Gophish,
including the sending profile, recipient groups, and email templates.
Next,
we created a landing page by importing the Webmail login
page directly from the Morning Catch VM,
and we set it up to capture the entered credentials.
We then started the campaign and successfully captured the CEO's
username and password. We viewed these results in the Gophish
dashboard, and then we used those credentials to successfully gain
initial access to the CEO's desktop.