In this demo,
we're going to leverage King Phisher to craft and host the
landing page to complement our phishing attack to gain
initial access against our victim.
Adding a landing page to our attack will enable us to further add
legitimacy to our campaign and extend our attack capabilities by
gathering credentials from our target.
For this demo,
we're going to start off in King Phisher on our attack system and
use our existing Globomantics attack campaign.
In addition to email templates,
King Phisher also has a repository of website templates,
which can be used for landing pages.
Let's go ahead and download a fresh copy of the templates from GitHub.
From the terminal,
we will type git space clone space
https://github.com/rsmusllp/king‑phisher‑templates.git space Documents
and press Enter to download the template repo to are Kali users documents folder.
We will open our document folder and take a look at the
packages under Website_Templates.
There are a few template options here to choose from.
Let's go with the Credentials templates and select the Anti‑Virus_Update folder.
Here we will see all the files King Phisher has provided for
us to create a full website landing page,
including HTML files, sample images, and CSS.
We will start with the README file to get an understanding of the template
scenario to make sure this is a good candidate for our landing page and
review any modifications which need to be made to the template to
successfully use our King Phisher campaign.
This scenario looks to be a good choice,
which complements our existing campaign to extend our solicitation
for credentials related to an anti‑virus update.
Let's click on the login.html file to get a sense of what the
landing page will look like to our target.
We see that we receive some legitimate‑looking information about
the actions targets need to take on the page,
as well as a place to have them enter their credentials,
which we are looking to harvest.
Now let's open a new browser tab and go to the
Globomantics website to gather content,
which we can add to our template to make our landing page
appear more legitimate for our target.
Scrolling to the bottom of the page, let's grab the Globomantics logo,
which we can use to replace the stock King Phisher logo.
We will right‑click on the image and save it to the Images folder under the
template location on our Kali system and name the file logo.spg.
Let's next right‑click on the web page and click View Source.
Here we see the source contains an icon file,
which we will click on and click Save As favicon.ico,
replacing the existing icon file in the images folder under the template.
Navigating back to the page source,
let's also take a look at the style‑home CSS file to identify
some of the colors the Globomantics website has so we can mimic
that look and feel on our landing page.
Scrolling down, I see that the background color is set at a hex value of 212121.
Let's make note of that for modifying our template CSS later on.
Closing our browser,
we are going to start opening our template files from our
terminal to modify them for our needs.
Let's start with the template CSS while we have the
Globomantics web background color fresh in our mind.
We will enter the command nano space and then the file path
ending with style‑login‑new.css and press Enter.
Scrolling down in our text editor,
we will update the background to 212121 in the footer bottom section.
We will now press Ctrl+O to save followed by Enter and
then Ctrl+X to close out of nano.
Let's now open our HTML files with nano as well.
We will start with the login file using nano to navigate to the file path.
Here we will update the extension logo from a PNG file to an SPG
file and again save our output and close out nano.
Let's also perform the same action with nano on the scan HTML file,
changing the logo extension from a PNG to an SPG file.
Additionally, for the README file we reviewed earlier,
we will need to scroll down in our text editor to update
the link to the company home page,
which is important because once our target finishes
engaging with our landing page,
we want to redirect them to the Globomantics website to reduce any
suspicion regarding the legitimacy of the landing page.
On line 40, let's remove www from the URL,
as well as replace .com with .lan and save our output and exit nano once again.
Now that we have customize our King Phisher landing page template for our needs,
we can load it into our campaign.
First,
we will want to review the server_config.yml file to understand how to
properly load our customized template into our campaign.
From the terminal,
we will run sudo space nano space /usr/share/king‑phiser/server_config.yml.
Here we can see the full configuration and modify, if needed,
any of the King Phisher server settings.
One key field here to highlight is the set require_id field.
When this is set to true,
it affords our attack a bit of anonymity in that it will prevent
anyone from accessing our landing page without the unique ID
generated when King Phisher sends our attack.
If you want a more open campaign,
this field can be updated to false. Scrolling through the
configuration at the bottom of the file,
we see the current web root directory. This is the directory
which hosts our landing page in our attack.
So we will want to note the directory path so we may transfer our
template to that location to make our landing page live.
Let's now close out of nano and transfer our template to the web root
directory with the command sudo space cp space ‑vr space
Documents/Website_Templates/Credentials/Anti‑Virus_Update/www space
/var/lib/king‑phisher/ and press Enter.
Now that our landing page is live,
let's move back to King Phisher and review our existing campaign.
We will update the web server URL to globomatics.lan/login,
which is a domain I have registered for my attack system hosting the landing
page, which looks similar to the Globomantics web address and click Verify
to ensure that the landing page is indeed live. We will head over to the
Send tab and click the Start button.
King Phisher will prompt us for our SMTP server password, which I will enter
here, and success. King Phisher has sent our phishing attack. Moving over to
the system of the phishing target, we see when we opened the mail client that
the attack has arrived in the CEO inbox.
Let's open the message and this time click on the link. Our crafted
landing page will appear, and we see it now contains our custom
Globomantics content to add legitimacy to are ask for credentials. As the
CEO, we'll enter his credentials in the Username and Password fields
using a username of ceo@globomantics.lan and a password of password and
click OK. The CEO is then taken to a scanning page where his machine is
purportedly being scanned. And once complete, he is prompted to continue,
which, as we know from our template configuration,
takes him back to the Globomantics website, none the wiser that he has
just been phished and provided us his credentials.
If we move back to our attack system and navigate to the View Campaign Tab in
King Phisher, we can see we have the ability to view the credentials provided
to us under the Credentials section. Showing secrets will indeed reveal that
we have successfully gathered the CEO of Globomantics credentials as a part
of gaining initial access.
This will end our demo where we built the landing page to go along
with our phishing attack using King Phisher.
Additionally,
we were able to use the landing page to gather our target's
credentials while gaining initial access.