In this demo,
we're going to use Gophish to prepare for a phishing
campaign using a malicious attachment that opens a reverse
shell back to our Kali Linux machine.
We'll start by using Gophish to create the phishing email and then
we'll add a malicious executable as an attachment.
These steps are needed to successfully execute a phishing
campaign using a different technique.
If you're ready to get started, let's head over to the Gophish admin page.
Now that our malicious link campaign is done,
let's go ahead and click Complete and complete the campaign.
Although,
we are going to use a simple executable, instead of
exploiting a specific vulnerability,
the purpose of this exercise is on using Gophish with
different phishing techniques and social engineering to
convince a user to execute our payload.
For this demo, we're going to again target Richard Bourne,
the CEO, and send from Boyd Jenius IT support.
We're going to try to trick the CEO into opening an executable attached to the
email hopefully by posing as something that may help him.
We already have the sending profile and recipient groups that we need.
We won't need a landing page,
so all we have to do is create a new email template and generate our executable.
Let's start by creating our payload to attach the email.
Rather than using a more complex exploit,
we're going to keep it simple in this demo and use
MSFVenom to generate a standalone executable.
Under Richard Bourne's login,
the morning catch VM simulates a vulnerable Windows
platform with an x86 architecture.
So within msfvenom, we use the architecture x86 and the platform windows.
We're going to use the windows/shell_reverse_tcp payload, this will generate
a reverse shell that connects back using the localhost,
or LHOST, set to our Kali Linux machine and a port we specify using the LPORT,
and in this case, we'll use Port 4444.
Our output format will be an exe and sent to a file
that we'll call testconnect.exe.
We're calling the file testconnect because we're going to send an email
stating that we have a new program that Richard can run to connect back
through a VPN and allow him to use his desktop from home,
but we want him to test it while he's still at work to
make sure that it operates correctly.
And once we verify that that exe is generated,
we'll see it's saved as testconnect.exe in our home directory.
Now that we have our payload, we're ready to create the email template.
Once again,
we'll be sending as Boyd and try to convince Richard
to execute the attached payload.
So we'll go ahead and create the new email template,
and this time, we'll call it Attachment.
For our subject, we're going to use New streamlined capability for home access.
Okay, and we'll go to HTML, and I'll click Source.
We use the same first name option at the beginning and follow this
with an explanation of what the attached file does.
Then we just need to attach our payload to the email and we
can sign it Morning Catch IT Support.
Now we'll just add the testconnect.exe file,
and once we verify that it uploaded here,
we can save the template.
Now that everything is staged,
we have one more step to complete before we start our campaign and that's to
set up our listener so that if the attachment is opened,
the target workstation will connect back to our attacking machine.
For this simple shell, we'll use Netcat and listen over Port 4444.
Now we're ready to launch our campaign and see if we can get
Richard Bourne to execute our malicious payload.
So we'll go to Campaigns and click New Campaign,
we'll call this one Malicious Attachment,
and for the email template, we'll select Attachment.
The landing page we'll just leave as‑is,
even though it's irrelevant for this campaign,
as is the URL since we don't have a link.
The sending profile is, again,
Morning Catch IT Staff and the groups are Morning Catch Executives.
Let's go ahead and launch it,
and then we see our dashboard again and the email is confirmed as sent.
So let's head back over to the morning catch VM and see what we get.
So now we see our new email is in from Boyd Jenius in IT and
he has some kind of new streamlined capability for home
access along with an attachment.
Let's go ahead and open it up and read it.
Again, most of our stuff worked, it sent from Boyd Jenius in IT,
and our personalization at the beginning worked with our first name,
it was replaced with Richard, and we see our attachment that we want to have run.
So let's just, acting as Richard,
say that this convinced us to go ahead and download this
attachment and we'll download it to our desktop.
And there it is.
So since Boyd Jenius told us to,
we're going to go ahead and run it and it seems to me
like it's configuring something.
So once the attachment is open,
let's head back to our Kali Linux machine and see if we got that shell,
and there it is.
We now have a shell, and again,
our initial access on the morning catch virtual machine.
Let's head over to our dashboard and see what those results look like.
And you'll notice that even if we click Refresh,
all we get is details that the email was sent and nothing about it being opened.
There was no link to click and no data to submit,
so this is one limitation of Gophish, but from a hacker's perspective,
they're not going to care what a dashboard says, they've achieved their
goal once this reverse shell opened. Before we move on, let's do a quick
recap of what we learned so far in this course.
We started the demo by reconfiguring the necessary options to create a
malicious attachment phishing campaign using Gophish. Next, we created a
malicious payload using MSFVenom and attached it to our email template.
We started the campaign and successfully opened a reverse shell on the
target workstation.