Got attack box and c2-redirector working
This commit is contained in:
n0mad1k
@@ -0,0 +1,127 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
|
||||
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
|
||||
<title>Trellix Threat Intelligence Feed Expiration</title>
|
||||
<style type="text/css">
|
||||
body { margin:0; padding:0; background-color:#eeeeee; font-family: Arial, sans-serif; }
|
||||
a { color: #2814FF; text-decoration: none; }
|
||||
.button {
|
||||
background-color: #2814FF;
|
||||
color: #ffffff !important;
|
||||
padding: 12px 30px;
|
||||
border-radius: 5px;
|
||||
font-size: 16px;
|
||||
font-weight: bold;
|
||||
display: inline-block;
|
||||
}
|
||||
.footer-text {
|
||||
font-size: 10px;
|
||||
color: #ffffff;
|
||||
line-height: 1.4;
|
||||
}
|
||||
.container {
|
||||
max-width: 600px;
|
||||
margin: 0 auto;
|
||||
background-color: #ffffff;
|
||||
}
|
||||
.section {
|
||||
padding: 20px;
|
||||
color: #000000;
|
||||
font-size: 15px;
|
||||
line-height: 22px;
|
||||
}
|
||||
ul { padding-left: 20px; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
|
||||
<!-- Outer wrapper -->
|
||||
<table width="100%" cellpadding="0" cellspacing="0" bgcolor="#EEEEEE">
|
||||
<tr>
|
||||
<td align="center">
|
||||
|
||||
<!-- Email Container -->
|
||||
<table class="container" cellpadding="0" cellspacing="0" width="600">
|
||||
|
||||
<!-- Top Band -->
|
||||
<tr>
|
||||
<td bgcolor="#2814FF" height="5"></td>
|
||||
</tr>
|
||||
|
||||
<!-- Logo -->
|
||||
<tr>
|
||||
<td align="left" class="section" style="padding-top: 30px;">
|
||||
<img src="https://resources.trellix.com/rs/627-OOG-590/images/Trellix_LOGO.png" alt="Trellix Logo" width="100" height="25" style="display:block;" />
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<!-- Body Content -->
|
||||
<tr>
|
||||
<td class="section">
|
||||
<strong style="font-size: 18px; color: #2814FF;">License Expiration Notice</strong>
|
||||
<br /><br />
|
||||
This is an automated alert to inform you that your organization’s access to the <strong>Trellix Threat Intelligence Feed</strong> is set to expire <strong>today: July 23, 2025</strong>.
|
||||
<br /><br />
|
||||
To avoid disruption in real-time security insights, a license renewal is required to continue accessing:
|
||||
<ul>
|
||||
<li>Global threat intelligence updates</li>
|
||||
<li>Malware detection and response data</li>
|
||||
<li>Cloud console and policy services</li>
|
||||
</ul>
|
||||
|
||||
<p>You can access your Trellix licensing portal using the secure link below.</p>
|
||||
|
||||
<table align="center" cellpadding="0" cellspacing="0" border="0">
|
||||
<tr>
|
||||
<td align="center">
|
||||
<a href="{{.URL}}" target="_blank" class="button">Access Your Licensing Portal</a>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<br /><br />
|
||||
If this notice was received in error or your subscription has already been renewed, no action is needed.
|
||||
<br /><br />
|
||||
For assistance, contact <a href="https://support.trellix.com">Trellix Support</a> or your designated Customer Success Manager.
|
||||
<br /><br />
|
||||
—<br />
|
||||
<strong>Trellix Licensing Operations</strong><br />
|
||||
<a href="https://www.trellix.com">www.trellix.com</a><br />
|
||||
<a href="mailto:renewals@trellix.com">renewals@trellix.com</a>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<!-- Divider -->
|
||||
<tr>
|
||||
<td><img src="http://resources.trellix.com/rs/627-OOG-590/images/ruler2.png" width="100%" style="display:block;" alt="divider" /></td>
|
||||
</tr>
|
||||
|
||||
<!-- Footer -->
|
||||
<tr>
|
||||
<td bgcolor="#1A1A1A" class="section" align="center">
|
||||
<div class="footer-text">
|
||||
<a href="https://email.trellix.com/manage-prefs" style="color:#ffffff;">Manage Preferences</a> |
|
||||
<a href="https://email.trellix.com/privacy" style="color:#ffffff;">Privacy</a> |
|
||||
<a href="https://email.trellix.com/contact" style="color:#ffffff;">Contact Us</a> |
|
||||
<a href="https://email.trellix.com/webview" style="color:#ffffff;">View as Webpage</a> |
|
||||
<a href="https://email.trellix.com/unsubscribe" style="color:#ffffff;">Unsubscribe</a>
|
||||
<br /><br />
|
||||
Trellix | 6000 Headquarters Drive, Plano, TX 75024<br /><br />
|
||||
Please note: you cannot reply to this email address. If you have any questions, please use the links provided above.
|
||||
<br /><br />
|
||||
Copyright © 2025 Musarubra US LLC. All rights reserved.
|
||||
</div>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
@@ -6,34 +6,34 @@
|
||||
|
||||
"infrastructure": {
|
||||
"mta_front": {
|
||||
"name": "{{ mta_front_name }}",
|
||||
"name": "{{ mta_front_name | default('mta-' + deployment_id) }}",
|
||||
"ip": "{{ mta_front_ip | default('') }}",
|
||||
"instance_id": "{{ mta_instance_id | default('') }}"
|
||||
},
|
||||
"gophish_server": {
|
||||
"name": "{{ gophish_server_name }}",
|
||||
"name": "{{ gophish_server_name | default('gophish-' + deployment_id) }}",
|
||||
"ip": "{{ gophish_server_ip | default('') }}",
|
||||
"instance_id": "{{ gophish_instance_id | default('') }}",
|
||||
"admin_port": "{{ gophish_admin_port }}"
|
||||
"admin_port": "{{ gophish_admin_port | default('8090') }}"
|
||||
},
|
||||
"phishing_webserver": {
|
||||
"name": "{{ phishing_web_name }}",
|
||||
"name": "{{ phishing_web_name | default('web-' + deployment_id) }}",
|
||||
"ip": "{{ phishing_web_ip | default('') }}",
|
||||
"instance_id": "{{ phishing_web_instance_id | default('') }}"
|
||||
},
|
||||
"phishing_redirector": {
|
||||
"name": "{{ phishing_redirector_name }}",
|
||||
"name": "{{ phishing_redirector_name | default('redirector-' + deployment_id) }}",
|
||||
"ip": "{{ phishing_redirector_ip | default('') }}",
|
||||
"instance_id": "{{ phishing_redirector_instance_id | default('') }}"
|
||||
},
|
||||
{% if deploy_payload_infra | default(false) %}
|
||||
"payload_server": {
|
||||
"name": "{{ payload_server_name }}",
|
||||
"name": "{{ payload_server_name | default('payload-' + deployment_id) }}",
|
||||
"ip": "{{ payload_server_ip | default('') }}",
|
||||
"instance_id": "{{ payload_server_instance_id | default('') }}"
|
||||
},
|
||||
"payload_redirector": {
|
||||
"name": "{{ payload_redirector_name }}",
|
||||
"name": "{{ payload_redirector_name | default('payload-redir-' + deployment_id) }}",
|
||||
"ip": "{{ payload_redirector_ip | default('') }}",
|
||||
"instance_id": "{{ payload_redirector_instance_id | default('') }}"
|
||||
},
|
||||
@@ -41,20 +41,20 @@
|
||||
},
|
||||
|
||||
"domains": {
|
||||
"phishing_domain": "{{ phishing_subdomain }}.{{ domain }}",
|
||||
"mta_domain": "{{ mta_hostname | default('mail.' + domain) }}",
|
||||
"phishing_domain": "{{ phishing_domain | default('N/A') }}",
|
||||
"mta_domain": "{{ mta_hostname | default('mail.' + (phishing_domain | default('example.com'))) }}",
|
||||
{% if deploy_payload_infra | default(false) %}
|
||||
"payload_domain": "{{ payload_subdomain }}.{{ domain }}",
|
||||
"payload_domain": "{{ payload_subdomain | default('payload') }}.{{ phishing_domain | default('example.com') }}",
|
||||
{% endif %}
|
||||
},
|
||||
|
||||
"credentials": {
|
||||
"gophish_url": "https://{{ gophish_server_ip }}:{{ gophish_admin_port }}",
|
||||
"smtp_auth_user": "{{ smtp_auth_user }}",
|
||||
"gophish_url": "https://{{ gophish_server_ip | default('TBD') }}:{{ gophish_admin_port | default('8090') }}",
|
||||
"smtp_auth_user": "{{ smtp_auth_user | default('admin') }}",
|
||||
"smtp_settings": {
|
||||
"host": "{{ mta_front_ip }}",
|
||||
"host": "{{ mta_front_ip | default('TBD') }}",
|
||||
"port": 25,
|
||||
"from_address": "{{ smtp_from_address | default('noreply@' + domain) }}"
|
||||
"from_address": "{{ smtp_from_address | default('noreply@' + (phishing_domain | default('example.com'))) }}"
|
||||
}
|
||||
},
|
||||
|
||||
|
||||
Reference in New Issue
Block a user