Building out Phishing Capability
This commit is contained in:
n0mad1k
@@ -0,0 +1,556 @@
|
||||
# C2ingRed Project Management
|
||||
|
||||
## Project Overview
|
||||
**C2ingRed** - Automated red team infrastructure deployment system supporting AWS, Linode, and FlokiNET with Havoc C2, redirectors, email infrastructure, and advanced OPSEC features.
|
||||
|
||||
---
|
||||
|
||||
## 🎯 Current Focus
|
||||
**Goal:** Stabilize core deployment functionality and test it
|
||||
**Last Updated:** 05-30-2025
|
||||
|
||||
---
|
||||
|
||||
## 📈 CHANGELOG & HISTORY
|
||||
|
||||
### [1.1/05-30-2025]
|
||||
- [Major change 1]
|
||||
- [Major change 2]
|
||||
- [Bug fixes, etc.]
|
||||
|
||||
### [Previous Version/Date]
|
||||
- [Previous changes]
|
||||
|
||||
---
|
||||
|
||||
### 📍 Where I Left Off
|
||||
- Working on: Need to fix issue with AWS deployment security hardening playbook
|
||||
- Next Priority: Test core deployment
|
||||
- Blockers: Sleep
|
||||
|
||||
---
|
||||
|
||||
## 📊 Project Status Dashboard
|
||||
|
||||
### Overall Progress
|
||||
- **Core Infrastructure:** 85% ✅
|
||||
- **Security Features:** 75% ⚠️
|
||||
- **Documentation:** 20% ⚠️
|
||||
- **Testing Coverage:** 40% ❌
|
||||
|
||||
### Quick Stats [Total Features: 150]
|
||||
- ✅ **Working:** 120 features
|
||||
- ❌ **Broken:** 30 features
|
||||
- 🧪 **Needs Testing:** 150 features
|
||||
|
||||
---
|
||||
|
||||
## 💡 IDEAS & FUTURE CONSIDERATIONS
|
||||
|
||||
### Potential Improvements
|
||||
- [Improvement idea 1]
|
||||
- [Improvement idea 2]
|
||||
|
||||
### Architecture Changes
|
||||
- [Architectural consideration 1]
|
||||
- [Architectural consideration 2]
|
||||
|
||||
### Integration Opportunities
|
||||
- [Integration possibility 1]
|
||||
- [Integration possibility 2]
|
||||
|
||||
---
|
||||
|
||||
## 📝 TODO
|
||||
|
||||
- [ ] Fix DMARC automation bug
|
||||
- [ ] Improve split-region cleanup
|
||||
- [ ] Test integrated tracker end-to-end
|
||||
- [ ] Add Tor integration
|
||||
- [ ] Improve payload customization
|
||||
- [ ] Multi-tenancy support
|
||||
|
||||
---
|
||||
|
||||
## 📚 RESEARCH & INVESTIGATION
|
||||
|
||||
### Current Research Topics
|
||||
- [ ] **Advanced EDR Bypass** - Latest techniques and tools
|
||||
- [ ] **Infrastructure Detection** - How to avoid attribution
|
||||
- [ ] **Automation Improvements** - Better deployment patterns
|
||||
|
||||
### Completed Research
|
||||
- [x] **Havoc C2 Dev Branch** - Features and installation
|
||||
- [x] **NGINX IR Evasion** - Security scanner detection
|
||||
- [x] **AWS Security Groups** - Best practices
|
||||
|
||||
---
|
||||
|
||||
## 🎪 Major Features
|
||||
|
||||
### Core Infrastructure Deployment
|
||||
**Status:** 🔄 IN PROGRESS
|
||||
**Priority:** HIGH
|
||||
**Description:** Basic deployment functionality across all providers
|
||||
|
||||
#### Tasks:
|
||||
- [x] ✅ AWS EC2 instance deployment
|
||||
- [x] ✅ Linode instance deployment
|
||||
- [x] ✅ FlokiNET server configuration
|
||||
- [x] ✅ SSH key management
|
||||
- [x] ✅ VPC and security group creation
|
||||
- [ ] 🔄 Cross-region deployment improvements
|
||||
- [ ] 🧪 Split-region deployment testing
|
||||
- [ ] ❌ Deployment rollback functionality
|
||||
|
||||
**Notes:** Basic functionality works well. Cross-region needs refinement.
|
||||
|
||||
---
|
||||
|
||||
### Havoc C2 Framework Integration
|
||||
**Status:** ✅ MOSTLY COMPLETE
|
||||
**Priority:** HIGH
|
||||
**Description:** Havoc C2 installation, configuration, and payload generation
|
||||
|
||||
#### Tasks:
|
||||
- [x] ✅ Havoc installation automation
|
||||
- [x] ✅ Basic payload generation
|
||||
- [x] ✅ EDR evasion techniques
|
||||
- [x] ✅ Payload randomization
|
||||
- [ ] 🧪 Cross-platform payload testing
|
||||
- [ ] 📝 Advanced listener configurations
|
||||
- [ ] 📝 Custom malleable profiles
|
||||
|
||||
**Notes:** Core functionality solid. Need more testing on different OS targets.
|
||||
|
||||
---
|
||||
|
||||
### Redirector Infrastructure
|
||||
**Status:** ✅ COMPLETE
|
||||
**Priority:** HIGH
|
||||
**Description:** NGINX-based traffic redirection with IR evasion
|
||||
|
||||
#### Tasks:
|
||||
- [x] ✅ Basic NGINX redirector setup
|
||||
- [x] ✅ SSL certificate automation
|
||||
- [x] ✅ IR evasion rules (security tool detection)
|
||||
- [x] ✅ Mobile device credential harvesting
|
||||
- [x] ✅ Traffic flow configuration
|
||||
- [x] ✅ Legitimate-looking cover pages
|
||||
|
||||
**Notes:** Working well. Good IR evasion capabilities.
|
||||
|
||||
---
|
||||
|
||||
### Email Infrastructure
|
||||
**Status:** 🔄 IN PROGRESS
|
||||
**Priority:** MEDIUM
|
||||
**Description:** Mail server, DKIM, tracking capabilities
|
||||
|
||||
#### Tasks:
|
||||
- [x] ✅ Postfix mail server setup
|
||||
- [x] ✅ DKIM key generation
|
||||
- [x] ✅ Basic email tracking
|
||||
- [ ] 🧪 Integrated tracker testing
|
||||
- [ ] ❌ DMARC automation (has bugs)
|
||||
- [ ] 📝 GoPhish integration improvements
|
||||
- [ ] 📝 Email template management
|
||||
|
||||
**Notes:** Basic mail works. DMARC setup needs debugging.
|
||||
|
||||
---
|
||||
|
||||
### Security & OPSEC
|
||||
**Status:** 🔄 IN PROGRESS
|
||||
**Priority:** HIGH
|
||||
**Description:** Hardening, evasion, and operational security
|
||||
|
||||
#### Tasks:
|
||||
- [x] ✅ SSH hardening
|
||||
- [x] ✅ Zero-logs configuration
|
||||
- [x] ✅ Firewall automation (UFW/iptables)
|
||||
- [x] ✅ Log cleaning scripts
|
||||
- [x] ✅ Port randomization
|
||||
- [ ] 🔄 AWS security group improvements
|
||||
- [ ] 🧪 Memory protection testing
|
||||
- [ ] 📝 Tor integration
|
||||
- [ ] 📝 Additional EDR bypass techniques
|
||||
|
||||
**Notes:** Good foundation. Need to test memory protection features.
|
||||
|
||||
---
|
||||
|
||||
### Deployment Management
|
||||
**Status:** 🔄 IN PROGRESS
|
||||
**Priority:** MEDIUM
|
||||
**Description:** Deployment tracking, cleanup, and management
|
||||
|
||||
#### Tasks:
|
||||
- [x] ✅ Deployment ID system
|
||||
- [x] ✅ Infrastructure state tracking
|
||||
- [x] ✅ Basic cleanup functionality
|
||||
- [ ] 🔄 Enhanced cleanup (split-region)
|
||||
- [ ] 🧪 Cleanup verification testing
|
||||
- [ ] 📝 Deployment history/logging
|
||||
- [ ] 📝 Resource usage tracking
|
||||
|
||||
**Notes:** Cleanup works but needs refinement for complex deployments.
|
||||
|
||||
---
|
||||
|
||||
### Documentation & Usability
|
||||
**Status:** ❌ NEEDS WORK
|
||||
**Priority:** MEDIUM
|
||||
**Description:** User guides, API docs, and ease of use
|
||||
|
||||
#### Tasks:
|
||||
- [x] ✅ Basic README
|
||||
- [x] ✅ Post-install instructions
|
||||
- [ ] 🔄 Comprehensive user guide
|
||||
- [ ] 📝 Troubleshooting guide
|
||||
- [ ] 📝 Advanced configuration docs
|
||||
- [ ] 📝 Video tutorials/demos
|
||||
- [ ] 📝 Architecture documentation
|
||||
|
||||
**Notes:** Documentation is sparse. Need comprehensive guides.
|
||||
|
||||
---
|
||||
|
||||
## 🐛 KNOWN BUGS & ISSUES
|
||||
|
||||
### High Priority Bugs
|
||||
- [ ] **DMARC Record Setup** - Automation fails on some providers
|
||||
- *Impact:* Email deliverability issues
|
||||
- *Found:* [Date]
|
||||
- *Next Step:* Debug template generation
|
||||
|
||||
- [ ] **Split-Region Cleanup** - VPC deletion fails in cross-region deployments
|
||||
- *Impact:* Resource cleanup incomplete
|
||||
- *Found:* [Date]
|
||||
- *Next Step:* Fix region iteration logic
|
||||
|
||||
### Medium Priority Bugs
|
||||
- [ ] **SSH Key Permissions** - Occasional permission errors on AWS
|
||||
- *Impact:* Deployment failures
|
||||
- *Workaround:* Manual key fixing
|
||||
|
||||
- [ ] **Port Randomization** - Service restart issues
|
||||
- *Impact:* Services may not start with new ports
|
||||
- *Workaround:* Manual service restart
|
||||
|
||||
### Low Priority Issues
|
||||
- [ ] **Log Output** - Too verbose in some areas
|
||||
- [ ] **Error Messages** - Some are unclear
|
||||
- [ ] **Performance** - Slow payload generation
|
||||
|
||||
---
|
||||
|
||||
## 🧪 TESTING BACKLOG
|
||||
|
||||
### Needs Comprehensive Testing
|
||||
- [ ] **Cross-Region Deployments** - AWS multi-region
|
||||
- [ ] **Integrated Tracker** - Full email tracking flow
|
||||
- [ ] **Memory Protection** - Secure memory features
|
||||
- [ ] **Payload Delivery** - End-to-end testing
|
||||
- [ ] **Cleanup Verification** - Ensure all resources removed
|
||||
- [ ] **FlokiNET Provider** - Limited testing done
|
||||
- [ ] **Port Randomization** - All service combinations
|
||||
- [ ] **Security Hardening** - Penetration testing
|
||||
|
||||
### Tested & Working
|
||||
- [x] **Basic AWS Deployment** - Single region, standard config
|
||||
- [x] **Basic Linode Deployment** - Standard configuration
|
||||
- [x] **Havoc Payload Generation** - Windows/Linux payloads
|
||||
- [x] **NGINX Redirector** - Traffic forwarding
|
||||
- [x] **SSH Hardening** - Security configurations
|
||||
- [x] **SSL Certificates** - Let's Encrypt automation
|
||||
|
||||
---
|
||||
|
||||
## 🎯 GOALS & MILESTONES
|
||||
|
||||
### Goals
|
||||
- [ ] Complete Core Infrastructure)
|
||||
- [ ] Fix all high-priority bugs
|
||||
- [ ] Achieve 80% test coverage
|
||||
- [ ] Complete comprehensive documentation
|
||||
|
||||
---
|
||||
|
||||
## 🔗 USEFUL LINKS & REFERENCES
|
||||
|
||||
### Documentation
|
||||
- [Link 1]() - Description
|
||||
- [Link 2]() - Description
|
||||
|
||||
### External Resources
|
||||
- [Resource 1]() - Description
|
||||
- [Resource 2]() - Description
|
||||
|
||||
### Related Projects
|
||||
- [Project 1]() - Relationship
|
||||
- [Project 2]() - Relationship
|
||||
|
||||
---
|
||||
|
||||
## 📝 NOTES & LESSONS LEARNED
|
||||
|
||||
### What's Working Well
|
||||
- [Success 1]
|
||||
- [Success 2]
|
||||
|
||||
### What Needs Improvement
|
||||
- [Area for improvement 1]
|
||||
- [Area for improvement 2]
|
||||
|
||||
### Lessons Learned
|
||||
- [Lesson 1]
|
||||
- [Lesson 2]
|
||||
|
||||
# **C2ingRed Complete Feature List (~150+ Features)**
|
||||
|
||||
## **🏗️ CORE INFRASTRUCTURE MANAGEMENT (25 features)**
|
||||
|
||||
### **Multi-Provider Support**
|
||||
1. AWS EC2 deployment with VPC creation
|
||||
2. Linode infrastructure deployment
|
||||
3. FlokiNET pre-provisioned server configuration
|
||||
4. Cross-provider deployment (redirector on one, C2 on another)
|
||||
5. Multi-region deployment within same provider
|
||||
6. Split-region deployment (C2 and redirector in different regions)
|
||||
|
||||
### **Resource Management**
|
||||
7. Automated VPC/subnet/routing table creation
|
||||
8. Security group configuration with least-privilege access
|
||||
9. Internet gateway and NAT gateway setup
|
||||
10. SSH key pair generation and management
|
||||
11. SSL certificate automation (Let's Encrypt)
|
||||
12. Elastic IP allocation and management
|
||||
13. Resource tagging for organization
|
||||
14. Infrastructure state tracking and persistence
|
||||
15. Comprehensive cleanup and teardown
|
||||
16. Force cleanup with confirmation prompts
|
||||
17. Orphaned resource detection and removal
|
||||
|
||||
### **Instance Management**
|
||||
18. AMI selection and validation
|
||||
19. Instance size/plan selection
|
||||
20. SSH user detection based on AMI type
|
||||
21. Instance health monitoring
|
||||
22. Automatic retry logic for deployments
|
||||
23. Post-deployment validation checks
|
||||
24. Instance metadata collection
|
||||
25. Deployment logging and state tracking
|
||||
|
||||
## **🎯 C2 FRAMEWORK INTEGRATION (20 features)**
|
||||
|
||||
### **Havoc C2 Framework**
|
||||
26. Havoc C2 installation (dev branch)
|
||||
27. Teamserver configuration and management
|
||||
28. Client configuration generation
|
||||
29. Profile-based payload generation
|
||||
30. Custom listener configuration (HTTP/HTTPS)
|
||||
31. Advanced evasion profile templates
|
||||
32. Teamserver service management (systemd)
|
||||
33. Password generation and management
|
||||
34. Multi-operator support configuration
|
||||
|
||||
### **Payload Generation & Mutation**
|
||||
35. Windows EXE payload generation
|
||||
36. Windows DLL payload generation
|
||||
37. Linux ELF binary generation
|
||||
38. Raw shellcode generation
|
||||
39. Binary signature randomization
|
||||
40. PE header timestamp manipulation
|
||||
41. ELF binary modification
|
||||
42. Anti-analysis techniques
|
||||
43. Payload manifest generation
|
||||
44. Backup and versioning system
|
||||
45. Cross-architecture payload support
|
||||
|
||||
## **🛡️ SECURITY & OPSEC (35 features)**
|
||||
|
||||
### **System Hardening**
|
||||
46. SSH configuration hardening
|
||||
47. Root login restrictions
|
||||
48. Key-based authentication enforcement
|
||||
49. Connection timeout configuration
|
||||
50. Fail2Ban integration and configuration
|
||||
51. UFW firewall management (non-AWS)
|
||||
52. Iptables rules configuration
|
||||
53. System resource limits configuration
|
||||
54. Automatic security updates
|
||||
|
||||
### **Anti-Forensics & OPSEC**
|
||||
55. Zero-logging configuration throughout infrastructure
|
||||
56. Log rotation and secure deletion
|
||||
57. Command history suppression
|
||||
58. Memory protection mechanisms
|
||||
59. Swap file encryption/disabling
|
||||
60. Temporary file cleanup
|
||||
61. Secure exit procedures with data wiping
|
||||
62. Process hiding techniques
|
||||
63. Service name obfuscation
|
||||
|
||||
### **Evasion Techniques**
|
||||
64. Port randomization for C2 communications
|
||||
65. User-Agent randomization
|
||||
66. Sleep/jitter timing randomization
|
||||
67. Process injection method randomization
|
||||
68. Communication protocol obfuscation
|
||||
69. Traffic flow randomization
|
||||
70. Decoy traffic generation capabilities
|
||||
|
||||
### **IR & Blue Team Evasion**
|
||||
71. Security tool detection (user-agent based)
|
||||
72. Security vendor IP range blocking
|
||||
73. Automated redirection of analysis tools
|
||||
74. Mobile device detection and targeting
|
||||
75. Suspicious behavior detection and response
|
||||
76. Rate limiting for suspicious connections
|
||||
77. Geographic IP filtering
|
||||
78. Academic research network blocking
|
||||
79. Timing delays for suspicious requests
|
||||
80. Anti-sandbox techniques
|
||||
|
||||
## **📡 COMMUNICATION & REDIRECTORS (18 features)**
|
||||
|
||||
### **NGINX Redirector Configuration**
|
||||
81. Advanced NGINX redirector with SSL
|
||||
82. HTTP to HTTPS redirection
|
||||
83. Legitimate website masquerading
|
||||
84. Intelligent traffic routing
|
||||
85. Proxy configuration for C2 traffic
|
||||
86. TCP stream forwarding
|
||||
87. Load balancing capabilities
|
||||
88. Custom error page handling
|
||||
|
||||
### **Traffic Management**
|
||||
89. Request filtering and validation
|
||||
90. Payload delivery path protection
|
||||
91. Content-Type validation
|
||||
92. Security header implementation
|
||||
93. CORS configuration
|
||||
94. Cache control for operational security
|
||||
95. Compression settings optimization
|
||||
96. Server signature obfuscation (Microsoft-IIS spoofing)
|
||||
|
||||
### **Credential Harvesting**
|
||||
97. Fake login page deployment
|
||||
98. Microsoft-themed credential capture
|
||||
99. Form data encryption and storage
|
||||
100. Credential logging with metadata
|
||||
|
||||
## **📧 EMAIL & PHISHING INFRASTRUCTURE (15 features)**
|
||||
|
||||
### **Mail Server Setup**
|
||||
101. Postfix mail server configuration
|
||||
102. Dovecot IMAP/POP3 configuration
|
||||
103. SMTP authentication setup
|
||||
104. TLS encryption configuration
|
||||
105. Mail queue management
|
||||
|
||||
### **Email Deliverability**
|
||||
106. DKIM key generation and configuration
|
||||
107. DMARC policy implementation
|
||||
108. SPF record guidance
|
||||
109. Mail routing configuration
|
||||
110. Reputation management features
|
||||
|
||||
### **Email Tracking**
|
||||
111. Transparent pixel tracking system
|
||||
112. Email open rate analytics
|
||||
113. Geolocation tracking integration
|
||||
114. User-agent analysis
|
||||
115. Tracking dashboard with statistics
|
||||
|
||||
## **🔧 RECONNAISSANCE & ATTACK TOOLS (25 features)**
|
||||
|
||||
### **Network Reconnaissance**
|
||||
116. Nmap integration
|
||||
117. Masscan deployment
|
||||
118. Gobuster directory enumeration
|
||||
119. DNSEnum subdomain discovery
|
||||
120. Enum4linux SMB enumeration
|
||||
121. Responder LLMNR/NBT-NS poisoning
|
||||
122. Inveigh .NET Responder equivalent
|
||||
|
||||
### **Web Application Testing**
|
||||
123. SQLMap SQL injection testing
|
||||
124. Dirb web path discovery
|
||||
125. Nikto web vulnerability scanning
|
||||
126. Custom wordlist management (SecLists)
|
||||
|
||||
### **Credential Attacks**
|
||||
127. Hydra brute force attacks
|
||||
128. John the Ripper password cracking
|
||||
129. Hashcat GPU-accelerated cracking
|
||||
130. TREVORspray password spraying
|
||||
131. MailSniper Exchange enumeration
|
||||
132. Kerbrute Kerberos enumeration
|
||||
|
||||
### **Post-Exploitation**
|
||||
133. NetExec (CrackMapExec successor)
|
||||
134. Impacket toolkit integration
|
||||
135. SharpCollection .NET tools
|
||||
136. PEASS-ng privilege escalation
|
||||
137. Metasploit Framework integration
|
||||
|
||||
## **🖥️ USER INTERFACE & EXPERIENCE (15 features)**
|
||||
|
||||
### **Interactive Interface**
|
||||
138. Color-coded terminal interface
|
||||
139. Interactive menu system with categories
|
||||
140. Guided deployment wizard
|
||||
141. Progress indicators and status updates
|
||||
142. Error handling with user-friendly messages
|
||||
|
||||
### **Command Line Interface**
|
||||
143. Comprehensive CLI argument parsing
|
||||
144. Provider-specific parameter validation
|
||||
145. Batch deployment capabilities
|
||||
146. Configuration file support
|
||||
147. Debug and verbose modes
|
||||
|
||||
### **Documentation & Guidance**
|
||||
148. Automated post-deployment instructions
|
||||
149. DNS configuration guidance
|
||||
150. SSL certificate setup instructions
|
||||
151. Usage examples and command references
|
||||
152. Troubleshooting guides
|
||||
|
||||
## **⚙️ CONFIGURATION MANAGEMENT (10 features)**
|
||||
|
||||
### **Template System**
|
||||
153. Jinja2 template engine integration
|
||||
154. Dynamic configuration generation
|
||||
155. Environment-specific customization
|
||||
156. Variable interpolation and validation
|
||||
|
||||
### **State Management**
|
||||
157. Deployment state persistence
|
||||
158. Cross-deployment resource tracking
|
||||
159. Configuration backup and restore
|
||||
160. Version control integration support
|
||||
|
||||
## **🧹 CLEANUP & TEARDOWN (8 features)**
|
||||
|
||||
### **Resource Cleanup**
|
||||
161. Comprehensive resource identification
|
||||
162. Force cleanup with confirmation
|
||||
163. Partial cleanup for failed deployments
|
||||
164. SSH key cleanup and rotation
|
||||
165. State file management
|
||||
166. Orphaned resource detection
|
||||
167. Cross-region cleanup support
|
||||
168. Provider-agnostic teardown procedures
|
||||
|
||||
## **📊 MONITORING & ANALYTICS (5 features)**
|
||||
|
||||
169. Deployment logging and metrics
|
||||
170. Health check automation
|
||||
171. Performance monitoring hooks
|
||||
172. Error tracking and reporting
|
||||
173. Usage analytics collection
|
||||
|
||||
## **TOTAL: ~173 DISTINCT FEATURES**
|
||||
@@ -296,6 +296,263 @@ def deploy_tracker():
|
||||
|
||||
execute_deployment(config)
|
||||
|
||||
def phishing_menu():
|
||||
"""Display the phishing submenu and handle user selection"""
|
||||
while True:
|
||||
clear_screen()
|
||||
print_banner()
|
||||
print(f"{COLORS['WHITE']}PHISHING INFRASTRUCTURE MENU{COLORS['RESET']}")
|
||||
print(f"{COLORS['WHITE']}============================{COLORS['RESET']}")
|
||||
print(f"1) Full Red Team Infra (CDN Abuse)")
|
||||
print(f"2) Full Red Team Infra (No CDN)")
|
||||
print(f"3) Phishing Only (CDN)")
|
||||
print(f"4) Phishing Only (No CDN)")
|
||||
print(f"5) FedRAMP Compliant Phishing")
|
||||
print(f"6) MTA Front Server Only")
|
||||
print(f"7) Gophish Server Only")
|
||||
print(f"8) Phishing Redirector Only")
|
||||
print(f"9) Phishing Web Server Only")
|
||||
print(f"99) Return to Main Menu")
|
||||
|
||||
choice = input("\nSelect an option: ")
|
||||
|
||||
if choice == "1":
|
||||
deploy_full_redteam_cdn()
|
||||
elif choice == "2":
|
||||
deploy_full_redteam_noccdn()
|
||||
elif choice == "3":
|
||||
deploy_phishing_only_cdn()
|
||||
elif choice == "4":
|
||||
deploy_phishing_only_noccdn()
|
||||
elif choice == "5":
|
||||
deploy_fedramp_phishing()
|
||||
elif choice == "6":
|
||||
deploy_mta_front_only()
|
||||
elif choice == "7":
|
||||
deploy_gophish_only()
|
||||
elif choice == "8":
|
||||
deploy_phishing_redirector_only()
|
||||
elif choice == "9":
|
||||
deploy_phishing_webserver_only()
|
||||
elif choice == "99":
|
||||
return
|
||||
else:
|
||||
print(f"\n{COLORS['RED']}Invalid option. Please try again.{COLORS['RESET']}")
|
||||
time.sleep(1)
|
||||
|
||||
def deploy_full_redteam_cdn():
|
||||
"""Deploy complete red team infrastructure with CDN abuse"""
|
||||
config = gather_phishing_parameters()
|
||||
if not config:
|
||||
return
|
||||
|
||||
config['deployment_type'] = 'full_redteam_cdn'
|
||||
config['use_cdn'] = True
|
||||
config['deploy_mta_front'] = True
|
||||
config['deploy_gophish'] = True
|
||||
config['deploy_phishing_redirector'] = True
|
||||
config['deploy_phishing_webserver'] = True
|
||||
config['deploy_payload_redirector'] = True
|
||||
config['deploy_payload_server'] = True
|
||||
config['deploy_c2_redirector'] = True
|
||||
config['deploy_c2_backend'] = True
|
||||
config['deploy_tracker'] = True
|
||||
|
||||
execute_phishing_deployment(config)
|
||||
|
||||
def deploy_full_redteam_noccdn():
|
||||
"""Deploy complete red team infrastructure without CDN abuse"""
|
||||
config = gather_phishing_parameters()
|
||||
if not config:
|
||||
return
|
||||
|
||||
config['deployment_type'] = 'full_redteam_noccdn'
|
||||
config['use_cdn'] = False
|
||||
config['deploy_mta_front'] = True
|
||||
config['deploy_gophish'] = True
|
||||
config['deploy_phishing_redirector'] = True
|
||||
config['deploy_phishing_webserver'] = True
|
||||
config['deploy_payload_redirector'] = True
|
||||
config['deploy_payload_server'] = True
|
||||
config['deploy_c2_redirector'] = True
|
||||
config['deploy_c2_backend'] = True
|
||||
config['deploy_tracker'] = True
|
||||
|
||||
execute_phishing_deployment(config)
|
||||
|
||||
def deploy_phishing_only_cdn():
|
||||
"""Deploy phishing infrastructure only with CDN"""
|
||||
config = gather_phishing_parameters()
|
||||
if not config:
|
||||
return
|
||||
|
||||
config['deployment_type'] = 'phishing_only_cdn'
|
||||
config['use_cdn'] = True
|
||||
config['deploy_mta_front'] = True
|
||||
config['deploy_gophish'] = True
|
||||
config['deploy_phishing_redirector'] = True
|
||||
config['deploy_phishing_webserver'] = True
|
||||
config['deploy_tracker'] = True
|
||||
|
||||
execute_phishing_deployment(config)
|
||||
|
||||
def deploy_phishing_only_noccdn():
|
||||
"""Deploy phishing infrastructure only without CDN"""
|
||||
config = gather_phishing_parameters()
|
||||
if not config:
|
||||
return
|
||||
|
||||
config['deployment_type'] = 'phishing_only_noccdn'
|
||||
config['use_cdn'] = False
|
||||
config['deploy_mta_front'] = True
|
||||
config['deploy_gophish'] = True
|
||||
config['deploy_phishing_redirector'] = True
|
||||
config['deploy_phishing_webserver'] = True
|
||||
config['deploy_tracker'] = True
|
||||
|
||||
execute_phishing_deployment(config)
|
||||
|
||||
def deploy_fedramp_phishing():
|
||||
"""Deploy FedRAMP compliant phishing infrastructure"""
|
||||
config = gather_phishing_parameters()
|
||||
if not config:
|
||||
return
|
||||
|
||||
config['deployment_type'] = 'fedramp_compliant'
|
||||
config['fedramp_mode'] = True
|
||||
config['use_cdn'] = False
|
||||
config['deploy_gophish'] = True
|
||||
config['deploy_phishing_webserver'] = True
|
||||
config['deploy_tracker'] = True
|
||||
config['compliance_mode'] = True
|
||||
config['immediate_disclosure'] = True
|
||||
|
||||
execute_phishing_deployment(config)
|
||||
|
||||
def gather_phishing_parameters():
|
||||
"""Collect parameters for phishing deployments"""
|
||||
config = gather_common_parameters()
|
||||
if not config:
|
||||
return None
|
||||
|
||||
# Phishing-specific configuration
|
||||
print(f"\n{COLORS['BLUE']}Phishing Configuration{COLORS['RESET']}")
|
||||
|
||||
# Domain configuration
|
||||
primary_domain = input(f"Primary domain [default: {config.get('domain', 'example.com')}]: ") or config.get('domain', 'example.com')
|
||||
config['primary_domain'] = primary_domain
|
||||
|
||||
aged_domain = input(f"Aged domain for phishing (optional): ")
|
||||
if aged_domain:
|
||||
config['aged_domain'] = aged_domain
|
||||
config['phishing_domain'] = aged_domain
|
||||
else:
|
||||
config['phishing_domain'] = primary_domain
|
||||
|
||||
# Subdomain configuration
|
||||
config['mta_subdomain'] = input("MTA subdomain [default: mail]: ") or "mail"
|
||||
config['phishing_subdomain'] = input("Phishing subdomain [default: portal]: ") or "portal"
|
||||
config['payload_subdomain'] = input("Payload subdomain [default: cdn]: ") or "cdn"
|
||||
|
||||
# Campaign configuration
|
||||
config['campaign_name'] = input("Campaign name [default: test-campaign]: ") or "test-campaign"
|
||||
config['sender_name'] = input("Sender display name [default: IT Support]: ") or "IT Support"
|
||||
config['sender_email'] = f"noreply@{config['phishing_domain']}"
|
||||
|
||||
# Template selection
|
||||
print(f"\nTemplate options:")
|
||||
print(f"1) Office 365 Login")
|
||||
print(f"2) Password Expiration")
|
||||
print(f"3) Security Alert")
|
||||
print(f"4) File Share Notification")
|
||||
print(f"5) Custom Template")
|
||||
|
||||
template_choice = input("Select template [default: 1]: ") or "1"
|
||||
templates = {
|
||||
"1": "office365_login",
|
||||
"2": "password_expiry",
|
||||
"3": "security_alert",
|
||||
"4": "file_share",
|
||||
"5": "custom"
|
||||
}
|
||||
config['email_template'] = templates.get(template_choice, "office365_login")
|
||||
|
||||
return config
|
||||
|
||||
def execute_phishing_deployment(config):
|
||||
"""Execute phishing infrastructure deployment"""
|
||||
clear_screen()
|
||||
print_banner()
|
||||
print(f"\n{COLORS['GREEN']}Starting phishing infrastructure deployment...{COLORS['RESET']}")
|
||||
|
||||
# Generate deployment ID
|
||||
if 'deployment_id' not in config:
|
||||
config['deployment_id'] = generate_random_string(8)
|
||||
|
||||
# Set up logging
|
||||
log_file = setup_logging(config['deployment_id'], "phishing_deployment")
|
||||
|
||||
print(f"Deployment Type: {config['deployment_type']}")
|
||||
print(f"Deployment ID: {config['deployment_id']}")
|
||||
print(f"Provider: {config['provider']}")
|
||||
|
||||
# Confirm deployment
|
||||
confirm = input(f"\n{COLORS['YELLOW']}Proceed with phishing deployment? (y/n): {COLORS['RESET']}").lower()
|
||||
if confirm != 'y':
|
||||
print(f"\n{COLORS['YELLOW']}Deployment cancelled.{COLORS['RESET']}")
|
||||
return
|
||||
|
||||
# Execute deployment based on type
|
||||
success = deploy_phishing_infrastructure(config)
|
||||
|
||||
if success:
|
||||
print(f"\n{COLORS['GREEN']}Phishing infrastructure deployment completed successfully!{COLORS['RESET']}")
|
||||
deployment_info_log = generate_phishing_deployment_info(config, success=True)
|
||||
print(f"\n{COLORS['CYAN']}Deployment information saved to: {deployment_info_log}{COLORS['RESET']}")
|
||||
else:
|
||||
print(f"\n{COLORS['RED']}Phishing infrastructure deployment failed.{COLORS['RESET']}")
|
||||
deployment_info_log = generate_phishing_deployment_info(config, success=False)
|
||||
print(f"\n{COLORS['YELLOW']}Deployment information saved to: {deployment_info_log}{COLORS['RESET']}")
|
||||
|
||||
input("\nPress Enter to return to menu...")
|
||||
|
||||
# Add the component-only deployment functions
|
||||
def deploy_mta_front_only():
|
||||
"""Deploy MTA front server only"""
|
||||
config = gather_common_parameters()
|
||||
if not config:
|
||||
return
|
||||
config['deployment_type'] = 'mta_front_only'
|
||||
config['deploy_mta_front'] = True
|
||||
execute_phishing_deployment(config)
|
||||
|
||||
def deploy_gophish_only():
|
||||
"""Deploy Gophish server only"""
|
||||
config = gather_common_parameters()
|
||||
if not config:
|
||||
return
|
||||
config['deployment_type'] = 'gophish_only'
|
||||
config['deploy_gophish'] = True
|
||||
execute_phishing_deployment(config)
|
||||
|
||||
def deploy_phishing_redirector_only():
|
||||
"""Deploy phishing redirector only"""
|
||||
config = gather_common_parameters()
|
||||
if not config:
|
||||
return
|
||||
config['deployment_type'] = 'phishing_redirector_only'
|
||||
config['deploy_phishing_redirector'] = True
|
||||
execute_phishing_deployment(config)
|
||||
|
||||
def deploy_phishing_webserver_only():
|
||||
"""Deploy phishing web server only"""
|
||||
config = gather_common_parameters()
|
||||
if not config:
|
||||
return
|
||||
config['deployment_type'] = 'phishing_webserver_only'
|
||||
config['deploy_phishing_webserver'] = True
|
||||
execute_phishing_deployment(config)
|
||||
|
||||
def custom_deployment():
|
||||
"""Run the full interactive deployment wizard"""
|
||||
config = interactive_setup()
|
||||
|
||||
@@ -0,0 +1,127 @@
|
||||
phishing/
|
||||
├── deploy_phishing_infrastructure.yml *Created
|
||||
├── mta_front.yml *Created
|
||||
├── gophish_server.yml *Created
|
||||
├── phishing_redirector.yml *Created
|
||||
├── phishing_webserver.yml *Created
|
||||
├── payload_redirector.yml
|
||||
├── payload_server.yml
|
||||
└── cleanup_phishing.yml
|
||||
|
||||
tasks/
|
||||
├── configure_mta_front.yml *Created
|
||||
├── configure_gophish_advanced.yml *Created
|
||||
├── configure_phishing_redirector.yml *Created
|
||||
├── configure_phishing_webserver.yml
|
||||
├── configure_payload_redirector.yml
|
||||
├── configure_payload_server.yml
|
||||
└── setup_phishing_security.yml *Created
|
||||
|
||||
templates/
|
||||
├── phishing/
|
||||
│ ├── gophish-advanced-config.j2
|
||||
│ ├── postfix-mta-front.j2
|
||||
│ ├── nginx-phishing-redirector.j2
|
||||
│ ├── nginx-payload-redirector.j2
|
||||
│ ├── phishing-landing-page.j2
|
||||
│ ├── email-templates/
|
||||
│ │ ├── office365_login.j2 *Created
|
||||
│ │ ├── password_expiry.j2
|
||||
│ │ ├── security_alert.j2
|
||||
│ │ └── file_share.j2
|
||||
│ └── fedramp-compliance.j2
|
||||
└── phishing_deployment_state.j2
|
||||
|
||||
I am looking to beef up my phishing portion of my tooland I want to make a stand alone option as well. I will be preforming both red team phishing engagements and fed ramp engagements. So the red team ones need to be more advanced and sophesticated with advanced evasion techniques etc like
|
||||
SMTP smuggling aged domains MTA fronting Cloud service payload hosting CDN exploitation LOtL techniques SPF bypass methods File format manipulation
|
||||
This will require more than one server
|
||||
For fedramp style engagements I am not testing email security controls but only the users and I need to follow the strict guideline
|
||||
The intent is to test user compliance, not email security. Emails should be allow-listed on all security systems and be presented to the user unflagged, unmodified, and unaltered in any way. 3PAOs will provide or approve email templates and landing pages used in testing. 3PAOs must either perform this attack vector themselves, or independently evaluate the effectiveness of a third party phishing campaign. Landing pages for CSP personnel who are victims of the phishing attack should immediately identify that the email was a phish, and provide supplemental information on how to identify phishing attacks in the future. The email campaign will consist of the following:
|
||||
Email with username in body, Link to landing page, Ability to capture emails opened (hidden pixel), Landing page, Ability to tie landing page visits by user, Username and password capture, Ability to track user submission. FedRAMP requires that the 3PAO report back roles and/or metrics but not specific names. Lets keep with making this CSP agnostic as much as possible so AWS and linode can be used and other CSP as they are added to the framework. I would like everything to be as indepentent as possible so its all not running in one huge file or script and can be easily found and worked on and called to build stand alone servers or add to an existing server etc
|
||||
|
||||
For red team engagements I want to be able to deploy my whole red team infra or exactly what I need like just a c2, redirector, payload server, phishing server, Domain fronting server or just payload server, phishing server, Domain fronting server etc. I want an option for red team phishing which deploys
|
||||
|
||||
Below are deployment profiles
|
||||
|
||||
Profile Name: Full Red Team Infra (All the Things)
|
||||
|
||||
Servers:
|
||||
|
||||
MTA Front | SMTP relay hides email backend
|
||||
|
||||
Gophish Email Server | Phishing campaign controller (hidden)
|
||||
|
||||
Phishing Redirector (CDN) | Hides phishing web server behind CDN
|
||||
|
||||
Phishing Web Server | Credential capture backend
|
||||
|
||||
Payload Redirector (CDN) | Hides malware delivery server behind CDN
|
||||
|
||||
Payload Server | Malware hosting backend
|
||||
|
||||
C2 Redirector (CDN) | Hides Havoc/Cobalt backend behind CDN
|
||||
|
||||
C2 Backend | Command & control server (hidden)
|
||||
|
||||
Profile Name: Full Red Team Infra (No CDN Abuse)
|
||||
|
||||
Servers:
|
||||
|
||||
MTA Front | SMTP relay hides email backend
|
||||
|
||||
Gophish Email Server | Phishing campaign controller (hidden)
|
||||
|
||||
Phishing Redirector (VPS) | Nginx/socat hides phishing web server
|
||||
|
||||
Phishing Web Server | Credential capture backend
|
||||
|
||||
Payload Redirector (VPS) | Nginx/socat hides malware delivery server
|
||||
|
||||
Payload Server | Malware hosting backend
|
||||
|
||||
C2 Redirector (VPS) | Nginx/socat hides C2 backend
|
||||
|
||||
C2 Backend | Command & control server (hidden)
|
||||
|
||||
Profile Name: Phishing Infra (Credential Harvesting Only)
|
||||
|
||||
Servers:
|
||||
|
||||
MTA Front (optional) | SMTP relay hides email backend (optional)
|
||||
|
||||
Gophish Email Server | Phishing campaign controller
|
||||
|
||||
Phishing Redirector (CDN or VPS) | Hides phishing web server
|
||||
|
||||
Phishing Web Server | Credential capture backend
|
||||
|
||||
Profile Name: Phishing Infra (Credential Harvesting Only, No CDN)
|
||||
|
||||
Servers:
|
||||
|
||||
MTA Front (optional) | SMTP relay hides email backend (optional)
|
||||
|
||||
Gophish Email Server | Phishing campaign controller
|
||||
|
||||
Phishing Redirector (VPS) | Nginx/socat hides phishing web server
|
||||
|
||||
Phishing Web Server | Credential capture backend
|
||||
|
||||
Profile Name: Whitelisted Phishing Infra (User Awareness Testing)
|
||||
|
||||
Servers:
|
||||
|
||||
Gophish Email Server | Sends phishing campaigns directly
|
||||
|
||||
Phishing Web Server | Fake login or failure landing page
|
||||
|
||||
this needs to also set up firewall rules or security groups to ensure least privilege. I need only the MTA fronting or redirectors accessible to anyone. The main phishing server should only allow the operator to connect and then the main phishing server should be able to access the MTA, Webserver and payload server etc. We need to ensure that things are fully secure. This should be added to the main menu under the phishing server option 9 with sub menus for the different deployment options. This needs to be deployable in any provider so make as much of it provider agnositic. use existing playbooks if it make sense like security hardening etc. I also want this to have the tracker setup as well on any deployment. Make sure to consider the way the tool is built. I want minimal stuff in the deploy.py. As much as possible should be handled with tasks templates and scripts
|
||||
|
||||
|
||||
NOTES:
|
||||
|
||||
- I think I need to remove all the security group stuff to the security_hardening yaml
|
||||
- I dont think I need a tracker on the webserver yaml
|
||||
- setup_phishing_security.yml seems redundant and AWS only focused
|
||||
-
|
||||
-
|
||||
@@ -0,0 +1,129 @@
|
||||
---
|
||||
# Main phishing infrastructure deployment playbook
|
||||
# Handles all deployment types and orchestrates component deployment
|
||||
|
||||
- name: Deploy phishing infrastructure
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
connection: local
|
||||
vars_files:
|
||||
- vars.yaml
|
||||
vars:
|
||||
deployment_id: "{{ deployment_id | default('') }}"
|
||||
provider: "{{ provider | default('aws') }}"
|
||||
deployment_type: "{{ deployment_type | default('phishing_only_noccdn') }}"
|
||||
|
||||
tasks:
|
||||
- name: Validate deployment configuration
|
||||
assert:
|
||||
that:
|
||||
- deployment_id != ""
|
||||
- provider != ""
|
||||
- deployment_type != ""
|
||||
fail_msg: "Missing required deployment parameters"
|
||||
|
||||
- name: Display deployment information
|
||||
debug:
|
||||
msg:
|
||||
- "Phishing Infrastructure Deployment"
|
||||
- "=================================="
|
||||
- "Deployment ID: {{ deployment_id }}"
|
||||
- "Provider: {{ provider }}"
|
||||
- "Deployment Type: {{ deployment_type }}"
|
||||
- "Primary Domain: {{ primary_domain | default(domain) }}"
|
||||
- "Phishing Domain: {{ phishing_domain | default(primary_domain) }}"
|
||||
|
||||
# Phase 1: Deploy core infrastructure components
|
||||
- name: Deploy MTA Front server
|
||||
include: mta_front.yml
|
||||
when: deploy_mta_front | default(false) | bool
|
||||
vars:
|
||||
server_name: "mta-{{ deployment_id }}"
|
||||
component_type: "mta_front"
|
||||
|
||||
- name: Deploy Gophish server
|
||||
include: gophish_server.yml
|
||||
when: deploy_gophish | default(false) | bool
|
||||
vars:
|
||||
server_name: "gophish-{{ deployment_id }}"
|
||||
component_type: "gophish"
|
||||
|
||||
- name: Deploy phishing redirector
|
||||
include: phishing_redirector.yml
|
||||
when: deploy_phishing_redirector | default(false) | bool
|
||||
vars:
|
||||
server_name: "phish-redir-{{ deployment_id }}"
|
||||
component_type: "phishing_redirector"
|
||||
|
||||
- name: Deploy phishing web server
|
||||
include: phishing_webserver.yml
|
||||
when: deploy_phishing_webserver | default(false) | bool
|
||||
vars:
|
||||
server_name: "phish-web-{{ deployment_id }}"
|
||||
component_type: "phishing_webserver"
|
||||
|
||||
- name: Deploy payload redirector
|
||||
include: payload_redirector.yml
|
||||
when: deploy_payload_redirector | default(false) | bool
|
||||
vars:
|
||||
server_name: "payload-redir-{{ deployment_id }}"
|
||||
component_type: "payload_redirector"
|
||||
|
||||
- name: Deploy payload server
|
||||
include: payload_server.yml
|
||||
when: deploy_payload_server | default(false) | bool
|
||||
vars:
|
||||
server_name: "payload-{{ deployment_id }}"
|
||||
component_type: "payload_server"
|
||||
|
||||
# Phase 2: Deploy C2 infrastructure if requested
|
||||
- name: Deploy C2 redirector
|
||||
include: ../AWS/redirector.yml
|
||||
when: deploy_c2_redirector | default(false) | bool
|
||||
vars:
|
||||
redirector_name: "c2-redir-{{ deployment_id }}"
|
||||
|
||||
- name: Deploy C2 backend
|
||||
include: ../AWS/c2.yml
|
||||
when: deploy_c2_backend | default(false) | bool
|
||||
vars:
|
||||
c2_name: "c2-{{ deployment_id }}"
|
||||
|
||||
# Phase 3: Configure security groups and firewall rules
|
||||
- name: Configure phishing security
|
||||
include_tasks: "../tasks/setup_phishing_security.yml"
|
||||
vars:
|
||||
deployment_components:
|
||||
mta_front: "{{ deploy_mta_front | default(false) }}"
|
||||
gophish: "{{ deploy_gophish | default(false) }}"
|
||||
phishing_redirector: "{{ deploy_phishing_redirector | default(false) }}"
|
||||
phishing_webserver: "{{ deploy_phishing_webserver | default(false) }}"
|
||||
payload_redirector: "{{ deploy_payload_redirector | default(false) }}"
|
||||
payload_server: "{{ deploy_payload_server | default(false) }}"
|
||||
|
||||
# Phase 4: Save deployment state
|
||||
- name: Save phishing deployment state
|
||||
template:
|
||||
src: "../templates/phishing_deployment_state.j2"
|
||||
dest: "phishing_deployment_{{ deployment_id }}.json"
|
||||
mode: '0600'
|
||||
vars:
|
||||
deployment_info:
|
||||
deployment_id: "{{ deployment_id }}"
|
||||
deployment_type: "{{ deployment_type }}"
|
||||
provider: "{{ provider }}"
|
||||
components: "{{ deployment_components }}"
|
||||
domains:
|
||||
primary: "{{ primary_domain | default(domain) }}"
|
||||
phishing: "{{ phishing_domain | default(primary_domain) }}"
|
||||
created: "{{ ansible_date_time.iso8601 }}"
|
||||
|
||||
- name: Display deployment summary
|
||||
debug:
|
||||
msg:
|
||||
- "Phishing Infrastructure Deployment Complete!"
|
||||
- "==========================================="
|
||||
- "Access your Gophish interface at: https://{{ gophish_ip }}:{{ gophish_admin_port | default(3333) }}"
|
||||
- "Phishing domain: {{ phishing_domain }}"
|
||||
- "Campaign ready to launch!"
|
||||
when: not disable_summary | default(false)
|
||||
@@ -0,0 +1,51 @@
|
||||
---
|
||||
# Advanced Gophish server deployment with enhanced features
|
||||
|
||||
- name: Deploy Gophish server
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
connection: local
|
||||
vars_files:
|
||||
- vars.yaml
|
||||
vars:
|
||||
gophish_instance_type: "{{ gophish_instance_type | default('t3.large') }}"
|
||||
gophish_region: "{{ gophish_region | default(aws_region) }}"
|
||||
|
||||
tasks:
|
||||
- name: Create Gophish instance
|
||||
include_tasks: "../tasks/create_instance.yml"
|
||||
vars:
|
||||
instance_name: "{{ server_name }}"
|
||||
instance_type: "{{ gophish_instance_type }}"
|
||||
region: "{{ gophish_region }}"
|
||||
security_group_rules:
|
||||
- { proto: tcp, port: 22, cidr: "{{ operator_ip }}/32", desc: "SSH from operator" }
|
||||
- { proto: tcp, port: 3333, cidr: "{{ operator_ip }}/32", desc: "Gophish admin" }
|
||||
- { proto: tcp, port: 25, cidr: "{{ mta_front_ip | default('10.0.0.0/8') }}/32", desc: "SMTP from MTA" }
|
||||
- { proto: tcp, port: 80, cidr: "{{ phishing_redirector_ip | default('10.0.0.0/8') }}/32", desc: "HTTP from redirector" }
|
||||
|
||||
- name: Add Gophish to inventory
|
||||
add_host:
|
||||
name: "gophish_server"
|
||||
groups: "gophish_servers"
|
||||
ansible_host: "{{ instance_ip }}"
|
||||
ansible_user: "{{ ansible_user | default('ubuntu') }}"
|
||||
ansible_ssh_private_key_file: "{{ ssh_key_path }}"
|
||||
ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
|
||||
|
||||
- name: Configure Gophish server
|
||||
hosts: gophish_servers
|
||||
become: true
|
||||
gather_facts: true
|
||||
vars_files:
|
||||
- vars.yaml
|
||||
tasks:
|
||||
- name: Include advanced Gophish configuration
|
||||
include_tasks: "../tasks/configure_gophish_advanced.yml"
|
||||
|
||||
- name: Include security hardening
|
||||
include_tasks: "../tasks/security_hardening.yml"
|
||||
|
||||
- name: Include tracker setup
|
||||
include_tasks: "../tasks/configure_integrated_tracker.yml"
|
||||
when: deploy_tracker | default(true) | bool
|
||||
@@ -0,0 +1,51 @@
|
||||
---
|
||||
# MTA Front server deployment for email relay and SMTP smuggling
|
||||
|
||||
- name: Deploy MTA Front server
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
connection: local
|
||||
vars_files:
|
||||
- vars.yaml
|
||||
vars:
|
||||
mta_instance_type: "{{ mta_instance_type | default('t3.medium') }}"
|
||||
mta_region: "{{ mta_region | default(aws_region) }}"
|
||||
|
||||
tasks:
|
||||
- name: Create MTA Front instance
|
||||
include_tasks: "../tasks/create_instance.yml"
|
||||
vars:
|
||||
instance_name: "{{ server_name }}"
|
||||
instance_type: "{{ mta_instance_type }}"
|
||||
region: "{{ mta_region }}"
|
||||
security_group_rules:
|
||||
- { proto: tcp, port: 22, cidr: "{{ operator_ip }}/32", desc: "SSH from operator" }
|
||||
- { proto: tcp, port: 25, cidr: "0.0.0.0/0", desc: "SMTP from anywhere" }
|
||||
- { proto: tcp, port: 587, cidr: "0.0.0.0/0", desc: "SMTP submission" }
|
||||
- { proto: tcp, port: 465, cidr: "0.0.0.0/0", desc: "SMTPS" }
|
||||
|
||||
- name: Add MTA Front to inventory
|
||||
add_host:
|
||||
name: "mta_front"
|
||||
groups: "mta_fronts"
|
||||
ansible_host: "{{ instance_ip }}"
|
||||
ansible_user: "{{ ansible_user | default('ubuntu') }}"
|
||||
ansible_ssh_private_key_file: "{{ ssh_key_path }}"
|
||||
ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
|
||||
|
||||
- name: Configure MTA Front server
|
||||
hosts: mta_fronts
|
||||
become: true
|
||||
gather_facts: true
|
||||
vars_files:
|
||||
- vars.yaml
|
||||
tasks:
|
||||
- name: Include MTA Front configuration
|
||||
include_tasks: "../tasks/configure_mta_front.yml"
|
||||
|
||||
- name: Include security hardening
|
||||
include_tasks: "../tasks/security_hardening.yml"
|
||||
|
||||
- name: Include tracker setup
|
||||
include_tasks: "../tasks/configure_integrated_tracker.yml"
|
||||
when: deploy_tracker | default(true) | bool
|
||||
@@ -0,0 +1,46 @@
|
||||
---
|
||||
# Phishing redirector deployment with advanced evasion
|
||||
|
||||
- name: Deploy phishing redirector
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
connection: local
|
||||
vars_files:
|
||||
- vars.yaml
|
||||
vars:
|
||||
redirector_instance_type: "{{ redirector_instance_type | default('t3.small') }}"
|
||||
redirector_region: "{{ redirector_region | default(aws_region) }}"
|
||||
|
||||
tasks:
|
||||
- name: Create phishing redirector instance
|
||||
include_tasks: "../tasks/create_instance.yml"
|
||||
vars:
|
||||
instance_name: "{{ server_name }}"
|
||||
instance_type: "{{ redirector_instance_type }}"
|
||||
region: "{{ redirector_region }}"
|
||||
security_group_rules:
|
||||
- { proto: tcp, port: 22, cidr: "{{ operator_ip }}/32", desc: "SSH from operator" }
|
||||
- { proto: tcp, port: 80, cidr: "0.0.0.0/0", desc: "HTTP from anywhere" }
|
||||
- { proto: tcp, port: 443, cidr: "0.0.0.0/0", desc: "HTTPS from anywhere" }
|
||||
|
||||
- name: Add phishing redirector to inventory
|
||||
add_host:
|
||||
name: "phishing_redirector"
|
||||
groups: "phishing_redirectors"
|
||||
ansible_host: "{{ instance_ip }}"
|
||||
ansible_user: "{{ ansible_user | default('ubuntu') }}"
|
||||
ansible_ssh_private_key_file: "{{ ssh_key_path }}"
|
||||
ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
|
||||
|
||||
- name: Configure phishing redirector
|
||||
hosts: phishing_redirectors
|
||||
become: true
|
||||
gather_facts: true
|
||||
vars_files:
|
||||
- vars.yaml
|
||||
tasks:
|
||||
- name: Include phishing redirector configuration
|
||||
include_tasks: "../tasks/configure_phishing_redirector.yml"
|
||||
|
||||
- name: Include security hardening
|
||||
include_tasks: "../tasks/security_hardening.yml"
|
||||
@@ -0,0 +1,50 @@
|
||||
---
|
||||
# Phishing web server for credential harvesting
|
||||
|
||||
- name: Deploy phishing web server
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
connection: local
|
||||
vars_files:
|
||||
- vars.yaml
|
||||
vars:
|
||||
webserver_instance_type: "{{ webserver_instance_type | default('t3.medium') }}"
|
||||
webserver_region: "{{ webserver_region | default(aws_region) }}"
|
||||
|
||||
tasks:
|
||||
- name: Create phishing web server instance
|
||||
include_tasks: "../tasks/create_instance.yml"
|
||||
vars:
|
||||
instance_name: "{{ server_name }}"
|
||||
instance_type: "{{ webserver_instance_type }}"
|
||||
region: "{{ webserver_region }}"
|
||||
security_group_rules:
|
||||
- { proto: tcp, port: 22, cidr: "{{ operator_ip }}/32", desc: "SSH from operator" }
|
||||
- { proto: tcp, port: 80, cidr: "{{ phishing_redirector_ip | default('10.0.0.0/8') }}/32", desc: "HTTP from redirector" }
|
||||
- { proto: tcp, port: 443, cidr: "{{ phishing_redirector_ip | default('10.0.0.0/8') }}/32", desc: "HTTPS from redirector" }
|
||||
|
||||
- name: Add phishing web server to inventory
|
||||
add_host:
|
||||
name: "phishing_webserver"
|
||||
groups: "phishing_webservers"
|
||||
ansible_host: "{{ instance_ip }}"
|
||||
ansible_user: "{{ ansible_user | default('ubuntu') }}"
|
||||
ansible_ssh_private_key_file: "{{ ssh_key_path }}"
|
||||
ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
|
||||
|
||||
- name: Configure phishing web server
|
||||
hosts: phishing_webservers
|
||||
become: true
|
||||
gather_facts: true
|
||||
vars_files:
|
||||
- vars.yaml
|
||||
tasks:
|
||||
- name: Include phishing web server configuration
|
||||
include_tasks: "../tasks/configure_phishing_webserver.yml"
|
||||
|
||||
- name: Include security hardening
|
||||
include_tasks: "../tasks/security_hardening.yml"
|
||||
|
||||
- name: Include tracker setup
|
||||
include_tasks: "../tasks/configure_integrated_tracker.yml"
|
||||
when: deploy_tracker | default(true) | bool
|
||||
@@ -0,0 +1,137 @@
|
||||
---
|
||||
# Advanced evasion techniques for red team phishing
|
||||
|
||||
- name: Install advanced evasion tools
|
||||
apt:
|
||||
name:
|
||||
- python3-dnspython
|
||||
- python3-requests
|
||||
- python3-selenium
|
||||
- chromium-browser
|
||||
- chromium-chromedriver
|
||||
- tor
|
||||
- proxychains4
|
||||
state: present
|
||||
|
||||
- name: Create SMTP smuggling configuration
|
||||
template:
|
||||
src: "../templates/smtp-smuggling.py.j2"
|
||||
dest: "/root/Tools/phishing/smtp-smuggling.py"
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
when: enable_smtp_smuggling | default(false) | bool
|
||||
|
||||
- name: Configure SPF bypass techniques
|
||||
template:
|
||||
src: "../templates/spf-bypass.sh.j2"
|
||||
dest: "/root/Tools/phishing/spf-bypass.sh"
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
when: enable_spf_bypass | default(false) | bool
|
||||
|
||||
- name: Create domain aging simulation
|
||||
template:
|
||||
src: "../templates/domain-aging.py.j2"
|
||||
dest: "/root/Tools/phishing/domain-aging.py"
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
when: aged_domain_mode | default(false) | bool
|
||||
|
||||
- name: Set up MTA fronting configuration
|
||||
template:
|
||||
src: "../templates/mta-fronting.conf.j2"
|
||||
dest: "/etc/postfix/mta_fronting.cf"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
when: enable_mta_fronting | default(false) | bool
|
||||
notify: restart postfix
|
||||
|
||||
- name: Create file format manipulation tools
|
||||
copy:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
with_items:
|
||||
- { src: "../files/pdf-weaponizer.py", dest: "/root/Tools/phishing/pdf-weaponizer.py" }
|
||||
- { src: "../files/office-macro-generator.py", dest: "/root/Tools/phishing/office-macro-generator.py" }
|
||||
- { src: "../files/lnk-generator.py", dest: "/root/Tools/phishing/lnk-generator.py" }
|
||||
|
||||
- name: Create Living off the Land (LOtL) payload templates
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
with_items:
|
||||
- { src: "../templates/lotl-powershell.ps1.j2", dest: "/root/Tools/phishing/templates/lotl-powershell.ps1" }
|
||||
- { src: "../templates/lotl-wmic.cmd.j2", dest: "/root/Tools/phishing/templates/lotl-wmic.cmd" }
|
||||
- { src: "../templates/lotl-bitsadmin.cmd.j2", dest: "/root/Tools/phishing/templates/lotl-bitsadmin.cmd" }
|
||||
|
||||
- name: Set up CDN abuse configuration
|
||||
template:
|
||||
src: "../templates/cdn-abuse.py.j2"
|
||||
dest: "/root/Tools/phishing/cdn-abuse.py"
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
when: enable_cdn_abuse | default(false) | bool
|
||||
|
||||
- name: Create domain reputation monitoring
|
||||
template:
|
||||
src: "../templates/reputation-monitor.py.j2"
|
||||
dest: "/root/Tools/phishing/reputation-monitor.py"
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Set up cron job for reputation monitoring
|
||||
cron:
|
||||
name: "Domain reputation monitoring"
|
||||
minute: "0"
|
||||
hour: "*/4"
|
||||
job: "/root/Tools/phishing/reputation-monitor.py >> /root/Tools/phishing/logs/reputation.log 2>&1"
|
||||
|
||||
- name: Create email header spoofing tools
|
||||
template:
|
||||
src: "../templates/header-spoofing.py.j2"
|
||||
dest: "/root/Tools/phishing/header-spoofing.py"
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Configure Tor for anonymization
|
||||
template:
|
||||
src: "../templates/torrc-phishing.j2"
|
||||
dest: "/etc/tor/torrc"
|
||||
backup: yes
|
||||
notify: restart tor
|
||||
when: enable_tor_routing | default(false) | bool
|
||||
|
||||
- name: Create user-agent rotation script
|
||||
template:
|
||||
src: "../templates/user-agent-rotation.py.j2"
|
||||
dest: "/root/Tools/phishing/user-agent-rotation.py"
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Set up automated evasion techniques
|
||||
template:
|
||||
src: "../templates/automated-evasion.py.j2"
|
||||
dest: "/root/Tools/phishing/automated-evasion.py"
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
handlers:
|
||||
- name: restart tor
|
||||
systemd:
|
||||
name: tor
|
||||
state: restarted
|
||||
@@ -0,0 +1,111 @@
|
||||
---
|
||||
# FedRAMP compliance configuration for user awareness testing
|
||||
|
||||
- name: Create FedRAMP compliant landing pages
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
mode: '0644'
|
||||
owner: www-data
|
||||
group: www-data
|
||||
with_items:
|
||||
- { src: "../templates/fedramp-success-page.html.j2", dest: "/var/www/phishing/fedramp-success.html" }
|
||||
- { src: "../templates/fedramp-education-page.html.j2", dest: "/var/www/phishing/fedramp-education.html" }
|
||||
- { src: "../templates/fedramp-training-materials.html.j2", dest: "/var/www/phishing/training.html" }
|
||||
|
||||
- name: Create FedRAMP compliant email templates
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
with_items:
|
||||
- { src: "../templates/fedramp-email-template.html.j2", dest: "/root/Tools/phishing/templates/fedramp-email.html" }
|
||||
- { src: "../templates/fedramp-notification-email.html.j2", dest: "/root/Tools/phishing/templates/fedramp-notification.html" }
|
||||
|
||||
- name: Configure anonymized reporting
|
||||
template:
|
||||
src: "../templates/fedramp-reporting.py.j2"
|
||||
dest: "/root/Tools/phishing/fedramp-reporting.py"
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Create role-based tracking system
|
||||
template:
|
||||
src: "../templates/role-tracking.py.j2"
|
||||
dest: "/root/Tools/phishing/role-tracking.py"
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Set up immediate phish identification
|
||||
template:
|
||||
src: "../templates/immediate-identification.js.j2"
|
||||
dest: "/var/www/phishing/assets/immediate-identification.js"
|
||||
mode: '0644'
|
||||
owner: www-data
|
||||
group: www-data
|
||||
|
||||
- name: Create educational content delivery system
|
||||
template:
|
||||
src: "../templates/education-delivery.php.j2"
|
||||
dest: "/var/www/phishing/api/education.php"
|
||||
mode: '0644'
|
||||
owner: www-data
|
||||
group: www-data
|
||||
|
||||
- name: Configure compliance database schema
|
||||
shell: |
|
||||
sqlite3 /root/Tools/phishing/compliance.db << EOF
|
||||
CREATE TABLE IF NOT EXISTS fedramp_campaigns (
|
||||
id TEXT PRIMARY KEY,
|
||||
name TEXT NOT NULL,
|
||||
csp_organization TEXT NOT NULL,
|
||||
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
status TEXT DEFAULT 'active'
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS role_interactions (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
campaign_id TEXT NOT NULL,
|
||||
user_role TEXT NOT NULL,
|
||||
interaction_type TEXT NOT NULL,
|
||||
interaction_time DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
education_completed BOOLEAN DEFAULT FALSE
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS compliance_metrics (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
campaign_id TEXT NOT NULL,
|
||||
metric_type TEXT NOT NULL,
|
||||
metric_value INTEGER NOT NULL,
|
||||
recorded_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
||||
);
|
||||
EOF
|
||||
args:
|
||||
creates: /root/Tools/phishing/compliance.db
|
||||
|
||||
- name: Set database permissions for compliance
|
||||
file:
|
||||
path: /root/Tools/phishing/compliance.db
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: '0644'
|
||||
|
||||
- name: Create compliance report generator
|
||||
template:
|
||||
src: "../templates/compliance-report-generator.py.j2"
|
||||
dest: "/root/Tools/phishing/generate-compliance-report.py"
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Configure email allowlisting instructions
|
||||
template:
|
||||
src: "../templates/allowlist-instructions.md.j2"
|
||||
dest: "/root/Tools/phishing/ALLOWLIST_INSTRUCTIONS.md"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
@@ -0,0 +1,198 @@
|
||||
---
|
||||
# Advanced Gophish configuration with enhanced evasion and features
|
||||
|
||||
- name: Create Gophish user
|
||||
user:
|
||||
name: gophish
|
||||
system: yes
|
||||
shell: /bin/bash
|
||||
home: /opt/gophish
|
||||
create_home: yes
|
||||
|
||||
- name: Download latest Gophish release
|
||||
get_url:
|
||||
url: "https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip"
|
||||
dest: /tmp/gophish.zip
|
||||
mode: '0644'
|
||||
|
||||
- name: Extract Gophish
|
||||
unarchive:
|
||||
src: /tmp/gophish.zip
|
||||
dest: /opt/gophish
|
||||
owner: gophish
|
||||
group: gophish
|
||||
remote_src: yes
|
||||
|
||||
- name: Install additional packages for advanced features
|
||||
apt:
|
||||
name:
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
- sqlite3
|
||||
- jq
|
||||
- curl
|
||||
- wget
|
||||
- php-fpm
|
||||
- php-sqlite3
|
||||
- nodejs
|
||||
- npm
|
||||
state: present
|
||||
|
||||
- name: Configure advanced Gophish settings
|
||||
template:
|
||||
src: "../templates/phishing/gophish-advanced-config.j2"
|
||||
dest: /opt/gophish/config.json
|
||||
owner: gophish
|
||||
group: gophish
|
||||
mode: '0600'
|
||||
|
||||
- name: Create enhanced email templates directory
|
||||
file:
|
||||
path: /opt/gophish/templates/{{ item }}
|
||||
state: directory
|
||||
owner: gophish
|
||||
group: gophish
|
||||
mode: '0755'
|
||||
loop:
|
||||
- email
|
||||
- landing
|
||||
- static
|
||||
|
||||
- name: Deploy email templates
|
||||
template:
|
||||
src: "../templates/phishing/email-templates/{{ item }}.j2"
|
||||
dest: "/opt/gophish/templates/email/{{ item }}.html"
|
||||
owner: gophish
|
||||
group: gophish
|
||||
mode: '0644'
|
||||
loop:
|
||||
- office365_login
|
||||
- password_expiry
|
||||
- security_alert
|
||||
- file_share
|
||||
when: not fedramp_mode | default(false) | bool
|
||||
|
||||
- name: Deploy FedRAMP compliant templates
|
||||
template:
|
||||
src: "../templates/phishing/fedramp-compliance.j2"
|
||||
dest: "/opt/gophish/templates/email/fedramp_template.html"
|
||||
owner: gophish
|
||||
group: gophish
|
||||
mode: '0644'
|
||||
when: fedramp_mode | default(false) | bool
|
||||
|
||||
- name: Create advanced landing pages
|
||||
template:
|
||||
src: "../templates/phishing/phishing-landing-page.j2"
|
||||
dest: "/opt/gophish/templates/landing/{{ item }}_landing.html"
|
||||
owner: gophish
|
||||
group: gophish
|
||||
mode: '0644'
|
||||
loop:
|
||||
- office365
|
||||
- generic
|
||||
- fedramp
|
||||
vars:
|
||||
template_type: "{{ item }}"
|
||||
|
||||
- name: Install enhanced tracking pixel
|
||||
copy:
|
||||
src: "../files/simple_email_tracker.py"
|
||||
dest: /opt/gophish/tracker.py
|
||||
owner: gophish
|
||||
group: gophish
|
||||
mode: '0755'
|
||||
|
||||
- name: Create Gophish database backup script
|
||||
template:
|
||||
src: "../templates/phishing/gophish-backup.sh.j2"
|
||||
dest: /opt/gophish/backup.sh
|
||||
owner: gophish
|
||||
group: gophish
|
||||
mode: '0755'
|
||||
|
||||
- name: Set up database backup cron
|
||||
cron:
|
||||
name: "Backup Gophish database"
|
||||
minute: "0"
|
||||
hour: "*/6"
|
||||
job: "/opt/gophish/backup.sh"
|
||||
user: gophish
|
||||
|
||||
- name: Create Gophish systemd service
|
||||
template:
|
||||
src: "../templates/phishing/gophish.service.j2"
|
||||
dest: /etc/systemd/system/gophish.service
|
||||
mode: '0644'
|
||||
|
||||
- name: Enable and start Gophish service
|
||||
systemd:
|
||||
name: gophish
|
||||
state: started
|
||||
enabled: yes
|
||||
daemon_reload: yes
|
||||
|
||||
- name: Create campaign automation script
|
||||
template:
|
||||
src: "../templates/phishing/campaign-automation.py.j2"
|
||||
dest: /opt/gophish/campaign-automation.py
|
||||
owner: gophish
|
||||
group: gophish
|
||||
mode: '0755'
|
||||
|
||||
- name: Install Python dependencies for automation
|
||||
pip:
|
||||
name:
|
||||
- requests
|
||||
- python-dateutil
|
||||
- jinja2
|
||||
state: present
|
||||
|
||||
- name: Configure SMTP relay to MTA front
|
||||
blockinfile:
|
||||
path: /opt/gophish/config.json
|
||||
marker: "// {mark} ANSIBLE MANAGED SMTP CONFIG"
|
||||
block: |
|
||||
"smtp": {
|
||||
"host": "{{ mta_front_ip }}:587",
|
||||
"username": "{{ smtp_relay_user }}",
|
||||
"password": "{{ smtp_relay_pass }}",
|
||||
"from": "{{ sender_email }}",
|
||||
"ignore_cert_errors": true
|
||||
}
|
||||
|
||||
- name: Create phishing metrics dashboard
|
||||
template:
|
||||
src: "../templates/phishing/metrics-dashboard.html.j2"
|
||||
dest: /opt/gophish/static/metrics.html
|
||||
owner: gophish
|
||||
group: gophish
|
||||
mode: '0644'
|
||||
|
||||
- name: Set up log aggregation
|
||||
lineinfile:
|
||||
path: /etc/rsyslog.conf
|
||||
line: "local0.* /var/log/gophish.log"
|
||||
state: present
|
||||
notify: restart rsyslog
|
||||
|
||||
- name: Configure log rotation for Gophish
|
||||
copy:
|
||||
dest: /etc/logrotate.d/gophish
|
||||
content: |
|
||||
/var/log/gophish.log {
|
||||
daily
|
||||
missingok
|
||||
rotate 30
|
||||
compress
|
||||
delaycompress
|
||||
notifempty
|
||||
create 0644 gophish gophish
|
||||
}
|
||||
|
||||
handlers:
|
||||
- name: restart rsyslog
|
||||
service:
|
||||
name: rsyslog
|
||||
state: restarted
|
||||
@@ -0,0 +1,151 @@
|
||||
---
|
||||
# Configure MTA Front server for email relay and SMTP smuggling
|
||||
|
||||
- name: Update system packages
|
||||
apt:
|
||||
update_cache: yes
|
||||
upgrade: dist
|
||||
|
||||
- name: Install MTA packages
|
||||
apt:
|
||||
name:
|
||||
- postfix
|
||||
- postfix-pcre
|
||||
- dovecot-core
|
||||
- dovecot-imapd
|
||||
- opendkim
|
||||
- opendkim-tools
|
||||
- python3-pip
|
||||
- python3-venv
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
- dnsutils
|
||||
- swaks
|
||||
- telnet
|
||||
state: present
|
||||
|
||||
- name: Configure Postfix for MTA fronting
|
||||
template:
|
||||
src: "../templates/phishing/postfix-mta-front.j2"
|
||||
dest: /etc/postfix/main.cf
|
||||
backup: yes
|
||||
notify: restart postfix
|
||||
|
||||
- name: Configure Postfix master.cf for advanced relaying
|
||||
blockinfile:
|
||||
path: /etc/postfix/master.cf
|
||||
block: |
|
||||
# SMTP smuggling and advanced relay configurations
|
||||
587 inet n - y - - smtpd
|
||||
-o syslog_name=postfix/submission
|
||||
-o smtpd_tls_security_level=encrypt
|
||||
-o smtpd_sasl_auth_enable=yes
|
||||
-o smtpd_tls_wrappermode=no
|
||||
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
|
||||
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
|
||||
-o milter_macro_daemon_name=ORIGINATING
|
||||
|
||||
# SMTP smuggling support
|
||||
cleanup unix n - y - 0 cleanup
|
||||
-o header_checks=pcre:/etc/postfix/header_checks
|
||||
-o nested_header_checks=pcre:/etc/postfix/nested_header_checks
|
||||
|
||||
- name: Create SMTP smuggling header checks
|
||||
copy:
|
||||
dest: /etc/postfix/header_checks
|
||||
content: |
|
||||
# SMTP smuggling techniques
|
||||
/^Content-Transfer-Encoding:\s*7bit/i REPLACE Content-Transfer-Encoding: 8bit
|
||||
/^Content-Type:\s*text\/plain/i REPLACE Content-Type: text/html
|
||||
mode: '0644'
|
||||
notify:
|
||||
- reload postfix
|
||||
- postmap header_checks
|
||||
|
||||
- name: Create nested header checks for advanced smuggling
|
||||
copy:
|
||||
dest: /etc/postfix/nested_header_checks
|
||||
content: |
|
||||
# Advanced SMTP smuggling patterns
|
||||
/^\s*<script/i IGNORE
|
||||
/^\s*<iframe/i IGNORE
|
||||
mode: '0644'
|
||||
notify:
|
||||
- reload postfix
|
||||
- postmap nested_header_checks
|
||||
|
||||
- name: Configure DKIM for domain reputation
|
||||
include_tasks: ../tasks/configure_mail.yml
|
||||
|
||||
- name: Create relay authentication
|
||||
copy:
|
||||
dest: /etc/postfix/sasl_passwd
|
||||
content: |
|
||||
{{ phishing_domain }} {{ smtp_relay_user }}:{{ smtp_relay_pass }}
|
||||
mode: '0600'
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- postmap sasl_passwd
|
||||
- restart postfix
|
||||
|
||||
- name: Configure transport maps for backend routing
|
||||
copy:
|
||||
dest: /etc/postfix/transport
|
||||
content: |
|
||||
{{ phishing_domain }} smtp:[{{ gophish_ip }}]:25
|
||||
.{{ phishing_domain }} smtp:[{{ gophish_ip }}]:25
|
||||
mode: '0644'
|
||||
notify:
|
||||
- postmap transport
|
||||
- restart postfix
|
||||
|
||||
- name: Install Python SMTP testing tools
|
||||
pip:
|
||||
name:
|
||||
- smtplib-extended
|
||||
- email-validator
|
||||
- faker
|
||||
state: present
|
||||
|
||||
- name: Create SMTP smuggling test script
|
||||
template:
|
||||
src: "../templates/phishing/smtp-smuggling-test.py.j2"
|
||||
dest: /root/Tools/smtp-smuggling-test.py
|
||||
mode: '0755'
|
||||
|
||||
- name: Create email reputation monitoring script
|
||||
template:
|
||||
src: "../templates/phishing/reputation-monitor.sh.j2"
|
||||
dest: /root/Tools/reputation-monitor.sh
|
||||
mode: '0755'
|
||||
|
||||
- name: Set up log monitoring for deliverability
|
||||
cron:
|
||||
name: "Monitor email deliverability"
|
||||
minute: "*/15"
|
||||
job: "/root/Tools/reputation-monitor.sh >> /var/log/reputation.log 2>&1"
|
||||
|
||||
handlers:
|
||||
- name: restart postfix
|
||||
service:
|
||||
name: postfix
|
||||
state: restarted
|
||||
|
||||
- name: reload postfix
|
||||
service:
|
||||
name: postfix
|
||||
state: reloaded
|
||||
|
||||
- name: postmap header_checks
|
||||
command: postmap /etc/postfix/header_checks
|
||||
|
||||
- name: postmap nested_header_checks
|
||||
command: postmap /etc/postfix/nested_header_checks
|
||||
|
||||
- name: postmap sasl_passwd
|
||||
command: postmap /etc/postfix/sasl_passwd
|
||||
|
||||
- name: postmap transport
|
||||
command: postmap /etc/postfix/transport
|
||||
@@ -0,0 +1,157 @@
|
||||
---
|
||||
# Configure phishing redirector with advanced evasion techniques
|
||||
|
||||
- name: Install packages for phishing redirector
|
||||
apt:
|
||||
name:
|
||||
- nginx
|
||||
- nginx-extras
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
- socat
|
||||
- netcat-openbsd
|
||||
- jq
|
||||
- curl
|
||||
- geoip-database
|
||||
- libgeoip1
|
||||
- php-fpm
|
||||
- php-geoip
|
||||
state: present
|
||||
|
||||
- name: Configure advanced nginx for phishing redirector
|
||||
template:
|
||||
src: "../templates/phishing/nginx-phishing-redirector.j2"
|
||||
dest: /etc/nginx/sites-available/phishing-redirector
|
||||
mode: '0644'
|
||||
notify: restart nginx
|
||||
|
||||
- name: Enable phishing redirector site
|
||||
file:
|
||||
src: /etc/nginx/sites-available/phishing-redirector
|
||||
dest: /etc/nginx/sites-enabled/phishing-redirector
|
||||
state: link
|
||||
notify: restart nginx
|
||||
|
||||
- name: Remove default nginx site
|
||||
file:
|
||||
path: /etc/nginx/sites-enabled/default
|
||||
state: absent
|
||||
notify: restart nginx
|
||||
|
||||
- name: Create legitimate website content
|
||||
template:
|
||||
src: "../templates/phishing/legitimate-website.html.j2"
|
||||
dest: /var/www/html/index.html
|
||||
mode: '0644'
|
||||
|
||||
- name: Create robots.txt for SEO legitimacy
|
||||
copy:
|
||||
dest: /var/www/html/robots.txt
|
||||
content: |
|
||||
User-agent: *
|
||||
Allow: /
|
||||
Sitemap: https://{{ phishing_subdomain }}.{{ phishing_domain }}/sitemap.xml
|
||||
|
||||
- name: Create sitemap for legitimacy
|
||||
template:
|
||||
src: "../templates/phishing/sitemap.xml.j2"
|
||||
dest: /var/www/html/sitemap.xml
|
||||
mode: '0644'
|
||||
|
||||
- name: Install MaxMind GeoIP for location-based filtering
|
||||
get_url:
|
||||
url: "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-Country&license_key={{ maxmind_license_key | default('') }}&suffix=tar.gz"
|
||||
dest: /tmp/geoip.tar.gz
|
||||
when: maxmind_license_key is defined
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Create security research filtering script
|
||||
template:
|
||||
src: "../templates/phishing/security-filter.lua.j2"
|
||||
dest: /etc/nginx/security-filter.lua
|
||||
mode: '0644'
|
||||
|
||||
- name: Configure nginx stream module for advanced traffic analysis
|
||||
template:
|
||||
src: "../templates/phishing/stream-analysis.conf.j2"
|
||||
dest: /etc/nginx/modules-enabled/stream-analysis.conf
|
||||
mode: '0644'
|
||||
|
||||
- name: Create phishing campaign analytics
|
||||
template:
|
||||
src: "../templates/phishing/analytics.js.j2"
|
||||
dest: /var/www/html/analytics.js
|
||||
mode: '0644'
|
||||
|
||||
- name: Set up legitimate SSL certificate
|
||||
shell: |
|
||||
certbot --nginx -d {{ phishing_subdomain }}.{{ phishing_domain }} \
|
||||
--non-interactive --agree-tos -m {{ letsencrypt_email }}
|
||||
args:
|
||||
creates: /etc/letsencrypt/live/{{ phishing_subdomain }}.{{ phishing_domain }}/fullchain.pem
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Create fail2ban configuration for suspicious activity
|
||||
copy:
|
||||
dest: /etc/fail2ban/jail.d/phishing-protection.conf
|
||||
content: |
|
||||
[phishing-scanner-protection]
|
||||
enabled = true
|
||||
port = 80,443
|
||||
filter = phishing-scanner
|
||||
logpath = /var/log/nginx/access.log
|
||||
maxretry = 3
|
||||
bantime = 3600
|
||||
findtime = 300
|
||||
|
||||
- name: Create fail2ban filter for security tools
|
||||
copy:
|
||||
dest: /etc/fail2ban/filter.d/phishing-scanner.conf
|
||||
content: |
|
||||
[Definition]
|
||||
failregex = ^<HOST>.*"(GET|POST).*(nmap|nikto|sqlmap|burp|w3af|nessus|openvas).*"
|
||||
^<HOST>.*".*User-Agent.*(scanner|bot|crawl|security|test).*"
|
||||
^<HOST>.*"(GET|POST).*\.(php|asp|jsp)\?.*"
|
||||
ignoreregex =
|
||||
|
||||
- name: Start and enable fail2ban
|
||||
systemd:
|
||||
name: fail2ban
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
- name: Create traffic monitoring script
|
||||
template:
|
||||
src: "../templates/phishing/traffic-monitor.sh.j2"
|
||||
dest: /root/Tools/traffic-monitor.sh
|
||||
mode: '0755'
|
||||
|
||||
- name: Set up traffic monitoring cron
|
||||
cron:
|
||||
name: "Monitor phishing traffic"
|
||||
minute: "*/5"
|
||||
job: "/root/Tools/traffic-monitor.sh >> /var/log/phishing-traffic.log 2>&1"
|
||||
|
||||
- name: Configure rate limiting for suspicious patterns
|
||||
blockinfile:
|
||||
path: /etc/nginx/nginx.conf
|
||||
insertbefore: "http {"
|
||||
block: |
|
||||
# Rate limiting zones
|
||||
limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
|
||||
limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
|
||||
|
||||
# GeoIP configuration
|
||||
geoip_country /usr/share/GeoIP/GeoIP.dat;
|
||||
map $geoip_country_code $allowed_country {
|
||||
default 1;
|
||||
CN 0;
|
||||
RU 0;
|
||||
KP 0;
|
||||
}
|
||||
|
||||
handlers:
|
||||
- name: restart nginx
|
||||
service:
|
||||
name: nginx
|
||||
state: restarted
|
||||
@@ -0,0 +1,296 @@
|
||||
---
|
||||
# Common tasks for configuring advanced phishing server
|
||||
# Supports both red team and FedRAMP compliance modes
|
||||
|
||||
- name: Update system packages
|
||||
apt:
|
||||
update_cache: yes
|
||||
upgrade: dist
|
||||
|
||||
- name: Install base packages for phishing server
|
||||
apt:
|
||||
name:
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
- postfix
|
||||
- dovecot-core
|
||||
- dovecot-imapd
|
||||
- opendkim
|
||||
- opendkim-tools
|
||||
- sqlite3
|
||||
- git
|
||||
- curl
|
||||
- wget
|
||||
- jq
|
||||
- unzip
|
||||
- python3-pip
|
||||
- python3-venv
|
||||
- nodejs
|
||||
- npm
|
||||
- php-fpm
|
||||
- php-sqlite3
|
||||
- php-curl
|
||||
- php-json
|
||||
- swaks
|
||||
- dnsutils
|
||||
- net-tools
|
||||
- fail2ban
|
||||
state: present
|
||||
|
||||
- name: Create phishing tools directory
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
with_items:
|
||||
- /root/Tools/phishing
|
||||
- /root/Tools/phishing/templates
|
||||
- /root/Tools/phishing/campaigns
|
||||
- /root/Tools/phishing/logs
|
||||
- /var/www/phishing
|
||||
- /var/www/phishing/assets
|
||||
- /var/www/phishing/api
|
||||
|
||||
- name: Set up GoPhish directory
|
||||
file:
|
||||
path: /root/Tools/gophish
|
||||
state: directory
|
||||
mode: '0755'
|
||||
|
||||
- name: Download latest GoPhish release
|
||||
shell: |
|
||||
LATEST_URL=$(curl -s https://api.github.com/repos/gophish/gophish/releases/latest | jq -r '.assets[] | select(.browser_download_url | contains("linux-64bit.zip")) | .browser_download_url')
|
||||
curl -L "$LATEST_URL" -o /tmp/gophish.zip
|
||||
unzip /tmp/gophish.zip -d /root/Tools/gophish
|
||||
chmod +x /root/Tools/gophish/gophish
|
||||
rm -f /tmp/gophish.zip
|
||||
args:
|
||||
creates: /root/Tools/gophish/gophish
|
||||
|
||||
- name: Create advanced GoPhish configuration
|
||||
template:
|
||||
src: "../templates/advanced-gophish-config.j2"
|
||||
dest: "/root/Tools/gophish/config.json"
|
||||
mode: '0600'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Create GoPhish systemd service
|
||||
template:
|
||||
src: "../templates/gophish.service.j2"
|
||||
dest: "/etc/systemd/system/gophish.service"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Configure Postfix for outbound email
|
||||
template:
|
||||
src: "../templates/postfix-phishing.conf.j2"
|
||||
dest: "/etc/postfix/main.cf"
|
||||
backup: yes
|
||||
notify: restart postfix
|
||||
|
||||
- name: Configure OpenDKIM for email authentication
|
||||
template:
|
||||
src: "../templates/opendkim-phishing.conf.j2"
|
||||
dest: "/etc/opendkim.conf"
|
||||
backup: yes
|
||||
notify: restart opendkim
|
||||
|
||||
- name: Create DKIM keys directory
|
||||
file:
|
||||
path: "/etc/opendkim/keys/{{ phishing_domain }}"
|
||||
state: directory
|
||||
owner: opendkim
|
||||
group: opendkim
|
||||
mode: '0700'
|
||||
|
||||
- name: Generate DKIM keys
|
||||
command: >
|
||||
opendkim-genkey -D /etc/opendkim/keys/{{ phishing_domain }}
|
||||
-d {{ phishing_domain }} -s phishing
|
||||
args:
|
||||
creates: "/etc/opendkim/keys/{{ phishing_domain }}/phishing.private"
|
||||
|
||||
- name: Set DKIM key permissions
|
||||
file:
|
||||
path: "/etc/opendkim/keys/{{ phishing_domain }}/phishing.private"
|
||||
owner: opendkim
|
||||
group: opendkim
|
||||
mode: '0600'
|
||||
|
||||
- name: Create phishing landing page templates
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
mode: '0644'
|
||||
owner: www-data
|
||||
group: www-data
|
||||
with_items:
|
||||
- { src: "../templates/phishing-landing-office365.html.j2", dest: "/var/www/phishing/office365.html" }
|
||||
- { src: "../templates/phishing-landing-gmail.html.j2", dest: "/var/www/phishing/gmail.html" }
|
||||
- { src: "../templates/phishing-landing-aws.html.j2", dest: "/var/www/phishing/aws.html" }
|
||||
- { src: "../templates/phishing-landing-generic.html.j2", dest: "/var/www/phishing/generic.html" }
|
||||
|
||||
- name: Create credential capture API
|
||||
template:
|
||||
src: "../templates/credential-capture-api.php.j2"
|
||||
dest: "/var/www/phishing/api/capture.php"
|
||||
mode: '0644'
|
||||
owner: www-data
|
||||
group: www-data
|
||||
|
||||
- name: Create tracking pixel endpoint
|
||||
template:
|
||||
src: "../templates/tracking-pixel.php.j2"
|
||||
dest: "/var/www/phishing/track.php"
|
||||
mode: '0644'
|
||||
owner: www-data
|
||||
group: www-data
|
||||
|
||||
- name: Configure Nginx for phishing sites
|
||||
template:
|
||||
src: "../templates/nginx-phishing.conf.j2"
|
||||
dest: "/etc/nginx/sites-available/phishing"
|
||||
mode: '0644'
|
||||
notify: reload nginx
|
||||
|
||||
- name: Enable phishing site
|
||||
file:
|
||||
src: /etc/nginx/sites-available/phishing
|
||||
dest: /etc/nginx/sites-enabled/phishing
|
||||
state: link
|
||||
notify: reload nginx
|
||||
|
||||
- name: Create phishing campaign management scripts
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
with_items:
|
||||
- { src: "../templates/campaign-launcher.sh.j2", dest: "/root/Tools/phishing/launch-campaign.sh" }
|
||||
- { src: "../templates/stats-collector.sh.j2", dest: "/root/Tools/phishing/collect-stats.sh" }
|
||||
- { src: "../templates/email-validator.py.j2", dest: "/root/Tools/phishing/validate-emails.py" }
|
||||
|
||||
- name: Create database for tracking
|
||||
shell: |
|
||||
sqlite3 /root/Tools/phishing/tracking.db << EOF
|
||||
CREATE TABLE IF NOT EXISTS email_opens (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
campaign_id TEXT NOT NULL,
|
||||
recipient_email TEXT NOT NULL,
|
||||
ip_address TEXT,
|
||||
user_agent TEXT,
|
||||
opened_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
location TEXT
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS link_clicks (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
campaign_id TEXT NOT NULL,
|
||||
recipient_email TEXT NOT NULL,
|
||||
link_url TEXT NOT NULL,
|
||||
ip_address TEXT,
|
||||
user_agent TEXT,
|
||||
clicked_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
location TEXT
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS credential_submissions (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
campaign_id TEXT NOT NULL,
|
||||
recipient_email TEXT,
|
||||
username TEXT,
|
||||
password_hash TEXT,
|
||||
ip_address TEXT,
|
||||
user_agent TEXT,
|
||||
submitted_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
location TEXT,
|
||||
additional_data TEXT
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS campaigns (
|
||||
id TEXT PRIMARY KEY,
|
||||
name TEXT NOT NULL,
|
||||
template TEXT NOT NULL,
|
||||
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
status TEXT DEFAULT 'active',
|
||||
target_count INTEGER DEFAULT 0,
|
||||
opened_count INTEGER DEFAULT 0,
|
||||
clicked_count INTEGER DEFAULT 0,
|
||||
submitted_count INTEGER DEFAULT 0
|
||||
);
|
||||
EOF
|
||||
args:
|
||||
creates: /root/Tools/phishing/tracking.db
|
||||
|
||||
- name: Set database permissions
|
||||
file:
|
||||
path: /root/Tools/phishing/tracking.db
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: '0644'
|
||||
|
||||
- name: Install Python dependencies for advanced features
|
||||
pip:
|
||||
name:
|
||||
- requests
|
||||
- beautifulsoup4
|
||||
- lxml
|
||||
- flask
|
||||
- flask-cors
|
||||
- dnspython
|
||||
- python-whois
|
||||
- selenium
|
||||
- fake-useragent
|
||||
state: present
|
||||
|
||||
- name: Create SSL certificate setup script
|
||||
template:
|
||||
src: "../templates/setup-phishing-ssl.sh.j2"
|
||||
dest: "/root/Tools/phishing/setup-ssl.sh"
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Create domain reputation checker
|
||||
template:
|
||||
src: "../templates/domain-reputation.py.j2"
|
||||
dest: "/root/Tools/phishing/check-reputation.py"
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Start and enable services
|
||||
systemd:
|
||||
name: "{{ item }}"
|
||||
state: started
|
||||
enabled: yes
|
||||
daemon_reload: yes
|
||||
with_items:
|
||||
- postfix
|
||||
- opendkim
|
||||
- nginx
|
||||
- php7.4-fpm
|
||||
- gophish
|
||||
|
||||
handlers:
|
||||
- name: restart postfix
|
||||
systemd:
|
||||
name: postfix
|
||||
state: restarted
|
||||
|
||||
- name: restart opendkim
|
||||
systemd:
|
||||
name: opendkim
|
||||
state: restarted
|
||||
|
||||
- name: reload nginx
|
||||
systemd:
|
||||
name: nginx
|
||||
state: reloaded
|
||||
@@ -0,0 +1,183 @@
|
||||
---
|
||||
# Configure security groups and firewall rules for phishing infrastructure
|
||||
|
||||
- name: Configure MTA Front security
|
||||
block:
|
||||
- name: Create MTA Front security group
|
||||
amazon.aws.ec2_security_group:
|
||||
name: "mta-front-{{ deployment_id }}"
|
||||
description: "Security group for MTA Front server"
|
||||
vpc_id: "{{ vpc_id }}"
|
||||
region: "{{ aws_region }}"
|
||||
rules:
|
||||
# Management access
|
||||
- proto: tcp
|
||||
ports: 22
|
||||
cidr_ip: "{{ operator_ip }}/32"
|
||||
rule_desc: "SSH from operator"
|
||||
|
||||
# SMTP services - public facing
|
||||
- proto: tcp
|
||||
ports: 25
|
||||
cidr_ip: "0.0.0.0/0"
|
||||
rule_desc: "SMTP from anywhere"
|
||||
|
||||
- proto: tcp
|
||||
ports: 587
|
||||
cidr_ip: "0.0.0.0/0"
|
||||
rule_desc: "SMTP submission"
|
||||
|
||||
- proto: tcp
|
||||
ports: 465
|
||||
cidr_ip: "0.0.0.0/0"
|
||||
rule_desc: "SMTPS"
|
||||
|
||||
rules_egress:
|
||||
- proto: -1
|
||||
cidr_ip: "0.0.0.0/0"
|
||||
state: present
|
||||
when: deployment_components.mta_front | default(false) | bool
|
||||
|
||||
- name: Configure Gophish security (hidden backend)
|
||||
block:
|
||||
- name: Create Gophish security group
|
||||
amazon.aws.ec2_security_group:
|
||||
name: "gophish-{{ deployment_id }}"
|
||||
description: "Security group for Gophish server (hidden)"
|
||||
vpc_id: "{{ vpc_id }}"
|
||||
region: "{{ aws_region }}"
|
||||
rules:
|
||||
# Management access only
|
||||
- proto: tcp
|
||||
ports: 22
|
||||
cidr_ip: "{{ operator_ip }}/32"
|
||||
rule_desc: "SSH from operator"
|
||||
|
||||
- proto: tcp
|
||||
ports: 3333
|
||||
cidr_ip: "{{ operator_ip }}/32"
|
||||
rule_desc: "Gophish admin interface"
|
||||
|
||||
# Internal communication only
|
||||
- proto: tcp
|
||||
ports: 80
|
||||
cidr_ip: "{{ phishing_redirector_ip }}/32"
|
||||
rule_desc: "HTTP from phishing redirector"
|
||||
|
||||
- proto: tcp
|
||||
ports: 25
|
||||
cidr_ip: "{{ mta_front_ip }}/32"
|
||||
rule_desc: "SMTP from MTA front"
|
||||
|
||||
rules_egress:
|
||||
- proto: -1
|
||||
cidr_ip: "0.0.0.0/0"
|
||||
state: present
|
||||
when: deployment_components.gophish | default(false) | bool
|
||||
|
||||
- name: Configure Phishing Redirector security (public facing)
|
||||
block:
|
||||
- name: Create Phishing Redirector security group
|
||||
amazon.aws.ec2_security_group:
|
||||
name: "phish-redirector-{{ deployment_id }}"
|
||||
description: "Security group for Phishing Redirector"
|
||||
vpc_id: "{{ vpc_id }}"
|
||||
region: "{{ aws_region }}"
|
||||
rules:
|
||||
# Management access
|
||||
- proto: tcp
|
||||
ports: 22
|
||||
cidr_ip: "{{ operator_ip }}/32"
|
||||
rule_desc: "SSH from operator"
|
||||
|
||||
# Public web access
|
||||
- proto: tcp
|
||||
ports: 80
|
||||
cidr_ip: "0.0.0.0/0"
|
||||
rule_desc: "HTTP from anywhere"
|
||||
|
||||
- proto: tcp
|
||||
ports: 443
|
||||
cidr_ip: "0.0.0.0/0"
|
||||
rule_desc: "HTTPS from anywhere"
|
||||
|
||||
rules_egress:
|
||||
- proto: -1
|
||||
cidr_ip: "0.0.0.0/0"
|
||||
state: present
|
||||
when: deployment_components.phishing_redirector | default(false) | bool
|
||||
|
||||
- name: Configure Phishing Web Server security (hidden backend)
|
||||
block:
|
||||
- name: Create Phishing Web Server security group
|
||||
amazon.aws.ec2_security_group:
|
||||
name: "phish-webserver-{{ deployment_id }}"
|
||||
description: "Security group for Phishing Web Server (hidden)"
|
||||
vpc_id: "{{ vpc_id }}"
|
||||
region: "{{ aws_region }}"
|
||||
rules:
|
||||
# Management access only
|
||||
- proto: tcp
|
||||
ports: 22
|
||||
cidr_ip: "{{ operator_ip }}/32"
|
||||
rule_desc: "SSH from operator"
|
||||
|
||||
# Internal communication only
|
||||
- proto: tcp
|
||||
ports: 80
|
||||
cidr_ip: "{{ phishing_redirector_ip }}/32"
|
||||
rule_desc: "HTTP from phishing redirector"
|
||||
|
||||
- proto: tcp
|
||||
ports: 443
|
||||
cidr_ip: "{{ phishing_redirector_ip }}/32"
|
||||
rule_desc: "HTTPS from phishing redirector"
|
||||
|
||||
rules_egress:
|
||||
- proto: -1
|
||||
cidr_ip: "0.0.0.0/0"
|
||||
state: present
|
||||
when: deployment_components.phishing_webserver | default(false) | bool
|
||||
|
||||
- name: Configure Payload Server security (hidden backend)
|
||||
block:
|
||||
- name: Create Payload Server security group
|
||||
amazon.aws.ec2_security_group:
|
||||
name: "payload-server-{{ deployment_id }}"
|
||||
description: "Security group for Payload Server (hidden)"
|
||||
vpc_id: "{{ vpc_id }}"
|
||||
region: "{{ aws_region }}"
|
||||
rules:
|
||||
# Management access only
|
||||
- proto: tcp
|
||||
ports: 22
|
||||
cidr_ip: "{{ operator_ip }}/32"
|
||||
rule_desc: "SSH from operator"
|
||||
|
||||
# Internal communication only
|
||||
- proto: tcp
|
||||
ports: 80
|
||||
cidr_ip: "{{ payload_redirector_ip }}/32"
|
||||
rule_desc: "HTTP from payload redirector"
|
||||
|
||||
- proto: tcp
|
||||
ports: 443
|
||||
cidr_ip: "{{ payload_redirector_ip }}/32"
|
||||
rule_desc: "HTTPS from payload redirector"
|
||||
|
||||
rules_egress:
|
||||
- proto: -1
|
||||
cidr_ip: "0.0.0.0/0"
|
||||
state: present
|
||||
when: deployment_components.payload_server | default(false) | bool
|
||||
|
||||
- name: Display security configuration summary
|
||||
debug:
|
||||
msg:
|
||||
- "Phishing Infrastructure Security Configuration"
|
||||
- "============================================="
|
||||
- "✓ Least privilege access implemented"
|
||||
- "✓ Backend servers hidden from public access"
|
||||
- "✓ Only redirectors/MTA fronts are publicly accessible"
|
||||
- "✓ Operator-only SSH access configured"
|
||||
- "✓ Internal communication secured"
|
||||
@@ -0,0 +1,51 @@
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<title>Microsoft Office 365 - Sign-in Required</title>
|
||||
<style>
|
||||
body { font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif; margin: 0; padding: 20px; background-color: #f3f2f1; }
|
||||
.container { max-width: 600px; margin: 0 auto; background: white; border-radius: 2px; overflow: hidden; }
|
||||
.header { background: #0078d4; padding: 20px; color: white; }
|
||||
.content { padding: 30px; line-height: 1.6; }
|
||||
.button { display: inline-block; background: #0078d4; color: white; padding: 12px 24px; text-decoration: none; border-radius: 2px; margin: 20px 0; }
|
||||
.footer { background: #f8f8f8; padding: 20px; font-size: 12px; color: #666; }
|
||||
.urgent { color: #d13438; font-weight: bold; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div class="container">
|
||||
<div class="header">
|
||||
<h2>Microsoft Office 365</h2>
|
||||
</div>
|
||||
<div class="content">
|
||||
<p>Hello {{ first_name | default('User') }},</p>
|
||||
|
||||
<p class="urgent">ACTION REQUIRED: Your Office 365 session has expired</p>
|
||||
|
||||
<p>We've detected that your Office 365 session for <strong>{{ email }}</strong> has expired due to security policy updates. To continue accessing your email and documents, please sign in again within the next 24 hours.</p>
|
||||
|
||||
<p>If you don't verify your account within this timeframe, access to your Office 365 services will be temporarily suspended for security reasons.</p>
|
||||
|
||||
<center>
|
||||
<a href="https://{{ phishing_subdomain }}.{{ phishing_domain }}/login?user={{ email | urlencode }}&ref=email" class="button">Sign In to Office 365</a>
|
||||
</center>
|
||||
|
||||
<p><small>If you're unable to click the button above, copy and paste this link into your browser:<br>
|
||||
https://{{ phishing_subdomain }}.{{ phishing_domain }}/login?user={{ email | urlencode }}&ref=email</small></p>
|
||||
|
||||
<p>Thank you for your cooperation in keeping your account secure.</p>
|
||||
|
||||
<p>Best regards,<br>
|
||||
Microsoft Account Security Team</p>
|
||||
</div>
|
||||
<div class="footer">
|
||||
<p>Microsoft Corporation | One Microsoft Way | Redmond, WA 98052</p>
|
||||
<p>This message was sent to {{ email }}. If you don't want to receive these emails, you can <a href="#">unsubscribe</a>.</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Tracking pixel -->
|
||||
<img src="https://{{ phishing_subdomain }}.{{ phishing_domain }}/px/{{ tracking_id }}.png" width="1" height="1" style="display:none;">
|
||||
</body>
|
||||
</html>
|
||||
Reference in New Issue
Block a user