In this demo,
we're going to prepare King Phisher to gain initial access against our victim,
the Globomantics CEO.
First,
we'll configure our campaign in King Phisher to enable our phishing attack.
This will include techniques to improve the legitimacy of our
attack in gaining trust in the eyes of our target.
Once prepped,
we'll put our work into action by attacking
Globomantics with a basic phishing attack.
Starting off on our Kali attack system,
we will open King Phisher via the terminal by typing sudo space systemctl space
start space king‑phisher to start the King Phisher server.
Now we will type /usr/share/king‑phisher/KingPhisher and
press Enter to open the King Phisher client.
We enter our Kali credentials to connect the King Phisher
client to the server by entering a username of kali and a
password of kali and click Connect.
Once authenticated to the King Phisher server,
we are prompted to create a new campaign.
We click New Campaign and we'll begin filling out the
information to build our King Phisher campaign.
We will name our campaign Globomantics Attack and click
Next through to the company page.
Creating this information will be important when leveraging the
email templates which King Phisher can integrate with to build a
dynamic campaign to help add legitimacy to the messages we send
in the eyes of the target.
We will select the new radio button and enter the
Globomantics name in the Name field.
Our description will be evil corporation,
and we will define Industry as Technology.
We will then enter the Globomantics website of
globomantics.lan under the Main Site and click Next.
We will then click Next to cycle through the remaining pages and
apply our configuration on the confirm page.
Now that we've configured our campaign,
since this is the first time we are using King Phisher,
we will next want to configure our SMTP server,
which we will be using with our phishing attacks.
We will select the Edit menu and click on Preferences and the SMTP Server tab.
Here the SMTP server and the associated credentials to be
used for your attack should be entered.
I will use my SMTP server along with port 25 and the email
address account associated with the SMTP server and click
Apply to save the information.
As you can see,
one of the first benefits of creating a company profile for Globomantics
is that the company name has been prepopulated for us.
Let's start by entering a source email address in the globomantics.lan domain.
We'll enter test@globomantics.lan in the Source Email SMTP field.
We can then utilize the King Phisher feature to test our source IP
to see if it will successfully pass an SPF check.
Unfortunately,
we are able to identify that since our attack server is not a
part of the globomantics.lan MX record,
if we attempt to use the company domain as our source address,
our attack will fail to reach the target's inbox.
Instead,
let's reenter the SMTP source email address to use
our configured mail server address.
This will put us at a slight disadvantage in that when the
source of the email is reviewed by our target,
it will be a telltale sign that this message did not
originate from the company domain.
However,
we will be able to use the MIME source email field
to mask our send from address,
thereby convincing the target that the message has originated from
the globomantics.lan domain at first glance.
In the source email MIME field,
we will create a fake email address of
helpdesk@globomantics.lan that will represent the address that
the CEO should see when he receives the phishing attack.
Additionally,
we can make our attack appear more convincing by entering
Helpdesk in the Friendly Alias field.
Our subject line of our message will be Important: Please Read
to create a sense of urgency to the message.
And we will add our source SMTP address as the reply to address so
that we will receive any replies from our victims.
We can now move down to the target information.
And for our attack purpose in which we're spearfishing the Globomantics CEO,
we will select the Single Target radio button.
If we were to attempt to target the larger Globomantics company with our attack,
we can leverage the CSV file radio option and use a CSV file
containing a precompiled list of attack targets in the
Globomantics email domain to send a bulk attack rather than
sending an individual attack to each victim.
We will next enter the target's name and the target email address we
enumerated from the social media platform of ceo@globomantics.lan.
Let's also scroll down towards the bottom and change the Message
Importance drop‑down menu to high importance and the Message
Sensitivity to confidential to increase the urgency of the
message we will use in our attack.
Additionally, while we won't be using a web page for our attack,
King Phisher does make the web server field required,
so we will just use the Globomantics website as a placeholder.
Under the Edit tab,
we can begin to compose a freeform message similar to the phishing message
we sent to the target via the social media platform.
However, we are going to take advantage of the complementary templates,
which King Phisher offers on the GitHub repository to improve the realistic
nature of the message we will send in our attack. From the terminal, we can
download the templates from the GitHub repo.
We will type git space clone space
https://github.com/rsmusllp/king‑phisher‑templates.git space documents
and press Enter to download the template repo to our Kali user's documents
folder.
We can now pivot back to King Phisher and click Select
File next to the Message HTML File field.
Let's click on Documents,
Email Templates, Credentials, Anti‑Virus_Update, and
select the email.html file and click Open.
Now when we click on Edit,
we see the message template has loaded to our campaign.
As we scroll down,
we see a number of Jinja code snippets in the template, which King Phisher
will populate upon sending the message to our target.
Let's modify the template slightly for our attack by removing the
url.web server HTML code line and replacing it with text requesting for
the Globomantics CEO to reply back to the email with his company
credentials. At the bottom of the template,
we will also see a tracking_dot_image,
which will be important in allowing us to track the successful
opening of our phishing attack by our target. We can now click
on the Preview tab to get a view of what our attack will look
like before we send it.
Moving to the Send tab,
we are now ready to send our phishing campaign to the
Globomantics CEO. Click the Start button. King Phisher will
prompt us for our SMTP server password,
which I will enter here, and we'll see that King Phisher runs through the send
process and successfully sends our campaign to the target. Moving over to the
system of the phishing target, we see when we open the email client that the
attack has indeed arrived in the CEO inbox.
The message appears to come from the Globomantics help desk, giving our attack
validity in the eyes of the CEO as originating from Globomantics. Hopping back
over to our attack system, we can click on the View Campaign tab and also
validate that our target has indeed opened the message, which can be helpful in
planning multilayered attacks.
This will end our demo where we created and sent our King Phisher
campaign to attack our Globomantics target,
leveraging a King Phisher email template and a tracking image
to help quantify the success of our attack.