n0mad1k/CoM-c2itall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Building out Phishing Capability

Browse Source
This commit is contained in:
n0mad1k
2025-07-04 17:07:51 -04:00
parent 41f7d0b46c
commit 8743a4cfdf
16 changed files with 2551 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
phishing/Plan.md
+127
View File
@@ -0,0 +1,127 @@
phishing/
├── deploy_phishing_infrastructure.yml *Created
├── mta_front.yml *Created
├── gophish_server.yml *Created
├── phishing_redirector.yml *Created
├── phishing_webserver.yml *Created
├── payload_redirector.yml
├── payload_server.yml
└── cleanup_phishing.yml
tasks/
├── configure_mta_front.yml *Created
├── configure_gophish_advanced.yml *Created
├── configure_phishing_redirector.yml *Created
├── configure_phishing_webserver.yml
├── configure_payload_redirector.yml
├── configure_payload_server.yml
└── setup_phishing_security.yml *Created
templates/
├── phishing/
│ ├── gophish-advanced-config.j2
│ ├── postfix-mta-front.j2
│ ├── nginx-phishing-redirector.j2
│ ├── nginx-payload-redirector.j2
│ ├── phishing-landing-page.j2
│ ├── email-templates/
│ │ ├── office365_login.j2 *Created
│ │ ├── password_expiry.j2
│ │ ├── security_alert.j2
│ │ └── file_share.j2
│ └── fedramp-compliance.j2
└── phishing_deployment_state.j2
I am looking to beef up my phishing portion of my tooland I want to make a stand alone option as well. I will be preforming both red team phishing engagements and fed ramp engagements. So the red team ones need to be more advanced and sophesticated with advanced evasion techniques etc like
SMTP smuggling aged domains MTA fronting Cloud service payload hosting CDN exploitation LOtL techniques SPF bypass methods File format manipulation
This will require more than one server
For fedramp style engagements I am not testing email security controls but only the users and I need to follow the strict guideline
The intent is to test user compliance, not email security. Emails should be allow-listed on all security systems and be presented to the user unflagged, unmodified, and unaltered in any way. 3PAOs will provide or approve email templates and landing pages used in testing. 3PAOs must either perform this attack vector themselves, or independently evaluate the effectiveness of a third party phishing campaign. Landing pages for CSP personnel who are victims of the phishing attack should immediately identify that the email was a phish, and provide supplemental information on how to identify phishing attacks in the future. The email campaign will consist of the following:
Email with username in body, Link to landing page, Ability to capture emails opened (hidden pixel), Landing page, Ability to tie landing page visits by user, Username and password capture, Ability to track user submission. FedRAMP requires that the 3PAO report back roles and/or metrics but not specific names. Lets keep with making this CSP agnostic as much as possible so AWS and linode can be used and other CSP as they are added to the framework. I would like everything to be as indepentent as possible so its all not running in one huge file or script and can be easily found and worked on and called to build stand alone servers or add to an existing server etc
For red team engagements I want to be able to deploy my whole red team infra or exactly what I need like just a c2, redirector, payload server, phishing server, Domain fronting server or just payload server, phishing server, Domain fronting server etc. I want an option for red team phishing which deploys
Below are deployment profiles
Profile Name: Full Red Team Infra (All the Things)
Servers:
MTA Front | SMTP relay hides email backend
Gophish Email Server | Phishing campaign controller (hidden)
Phishing Redirector (CDN) | Hides phishing web server behind CDN
Phishing Web Server | Credential capture backend
Payload Redirector (CDN) | Hides malware delivery server behind CDN
Payload Server | Malware hosting backend
C2 Redirector (CDN) | Hides Havoc/Cobalt backend behind CDN
C2 Backend | Command & control server (hidden)
Profile Name: Full Red Team Infra (No CDN Abuse)
Servers:
MTA Front | SMTP relay hides email backend
Gophish Email Server | Phishing campaign controller (hidden)
Phishing Redirector (VPS) | Nginx/socat hides phishing web server
Phishing Web Server | Credential capture backend
Payload Redirector (VPS) | Nginx/socat hides malware delivery server
Payload Server | Malware hosting backend
C2 Redirector (VPS) | Nginx/socat hides C2 backend
C2 Backend | Command & control server (hidden)
Profile Name: Phishing Infra (Credential Harvesting Only)
Servers:
MTA Front (optional) | SMTP relay hides email backend (optional)
Gophish Email Server | Phishing campaign controller
Phishing Redirector (CDN or VPS) | Hides phishing web server
Phishing Web Server | Credential capture backend
Profile Name: Phishing Infra (Credential Harvesting Only, No CDN)
Servers:
MTA Front (optional) | SMTP relay hides email backend (optional)
Gophish Email Server | Phishing campaign controller
Phishing Redirector (VPS) | Nginx/socat hides phishing web server
Phishing Web Server | Credential capture backend
Profile Name: Whitelisted Phishing Infra (User Awareness Testing)
Servers:
Gophish Email Server | Sends phishing campaigns directly
Phishing Web Server | Fake login or failure landing page
this needs to also set up firewall rules or security groups to ensure least privilege. I need only the MTA fronting or redirectors accessible to anyone. The main phishing server should only allow the operator to connect and then the main phishing server should be able to access the MTA, Webserver and payload server etc. We need to ensure that things are fully secure. This should be added to the main menu under the phishing server option 9 with sub menus for the different deployment options. This needs to be deployable in any provider so make as much of it provider agnositic. use existing playbooks if it make sense like security hardening etc. I also want this to have the tracker setup as well on any deployment. Make sure to consider the way the tool is built. I want minimal stuff in the deploy.py. As much as possible should be handled with tasks templates and scripts
NOTES:
- I think I need to remove all the security group stuff to the security_hardening yaml
- I dont think I need a tracker on the webserver yaml
- setup_phishing_security.yml seems redundant and AWS only focused
-
-
phishing/deploy_phishing_infrastructure.yml
+129
View File
@@ -0,0 +1,129 @@
---
# Main phishing infrastructure deployment playbook
# Handles all deployment types and orchestrates component deployment
- name: Deploy phishing infrastructure
hosts: localhost
gather_facts: false
connection: local
vars_files:
- vars.yaml
vars:
deployment_id: "{{ deployment_id | default('') }}"
provider: "{{ provider | default('aws') }}"
deployment_type: "{{ deployment_type | default('phishing_only_noccdn') }}"
tasks:
- name: Validate deployment configuration
assert:
that:
- deployment_id != ""
- provider != ""
- deployment_type != ""
fail_msg: "Missing required deployment parameters"
- name: Display deployment information
debug:
msg:
- "Phishing Infrastructure Deployment"
- "=================================="
- "Deployment ID: {{ deployment_id }}"
- "Provider: {{ provider }}"
- "Deployment Type: {{ deployment_type }}"
- "Primary Domain: {{ primary_domain | default(domain) }}"
- "Phishing Domain: {{ phishing_domain | default(primary_domain) }}"
# Phase 1: Deploy core infrastructure components
- name: Deploy MTA Front server
include: mta_front.yml
when: deploy_mta_front | default(false) | bool
vars:
server_name: "mta-{{ deployment_id }}"
component_type: "mta_front"
- name: Deploy Gophish server
include: gophish_server.yml
when: deploy_gophish | default(false) | bool
vars:
server_name: "gophish-{{ deployment_id }}"
component_type: "gophish"
- name: Deploy phishing redirector
include: phishing_redirector.yml
when: deploy_phishing_redirector | default(false) | bool
vars:
server_name: "phish-redir-{{ deployment_id }}"
component_type: "phishing_redirector"
- name: Deploy phishing web server
include: phishing_webserver.yml
when: deploy_phishing_webserver | default(false) | bool
vars:
server_name: "phish-web-{{ deployment_id }}"
component_type: "phishing_webserver"
- name: Deploy payload redirector
include: payload_redirector.yml
when: deploy_payload_redirector | default(false) | bool
vars:
server_name: "payload-redir-{{ deployment_id }}"
component_type: "payload_redirector"
- name: Deploy payload server
include: payload_server.yml
when: deploy_payload_server | default(false) | bool
vars:
server_name: "payload-{{ deployment_id }}"
component_type: "payload_server"
# Phase 2: Deploy C2 infrastructure if requested
- name: Deploy C2 redirector
include: ../AWS/redirector.yml
when: deploy_c2_redirector | default(false) | bool
vars:
redirector_name: "c2-redir-{{ deployment_id }}"
- name: Deploy C2 backend
include: ../AWS/c2.yml
when: deploy_c2_backend | default(false) | bool
vars:
c2_name: "c2-{{ deployment_id }}"
# Phase 3: Configure security groups and firewall rules
- name: Configure phishing security
include_tasks: "../tasks/setup_phishing_security.yml"
vars:
deployment_components:
mta_front: "{{ deploy_mta_front | default(false) }}"
gophish: "{{ deploy_gophish | default(false) }}"
phishing_redirector: "{{ deploy_phishing_redirector | default(false) }}"
phishing_webserver: "{{ deploy_phishing_webserver | default(false) }}"
payload_redirector: "{{ deploy_payload_redirector | default(false) }}"
payload_server: "{{ deploy_payload_server | default(false) }}"
# Phase 4: Save deployment state
- name: Save phishing deployment state
template:
src: "../templates/phishing_deployment_state.j2"
dest: "phishing_deployment_{{ deployment_id }}.json"
mode: '0600'
vars:
deployment_info:
deployment_id: "{{ deployment_id }}"
deployment_type: "{{ deployment_type }}"
provider: "{{ provider }}"
components: "{{ deployment_components }}"
domains:
primary: "{{ primary_domain | default(domain) }}"
phishing: "{{ phishing_domain | default(primary_domain) }}"
created: "{{ ansible_date_time.iso8601 }}"
- name: Display deployment summary
debug:
msg:
- "Phishing Infrastructure Deployment Complete!"
- "==========================================="
- "Access your Gophish interface at: https://{{ gophish_ip }}:{{ gophish_admin_port | default(3333) }}"
- "Phishing domain: {{ phishing_domain }}"
- "Campaign ready to launch!"
when: not disable_summary | default(false)
phishing/gophish_server.yml
+51
View File
@@ -0,0 +1,51 @@
---
# Advanced Gophish server deployment with enhanced features
- name: Deploy Gophish server
hosts: localhost
gather_facts: false
connection: local
vars_files:
- vars.yaml
vars:
gophish_instance_type: "{{ gophish_instance_type | default('t3.large') }}"
gophish_region: "{{ gophish_region | default(aws_region) }}"
tasks:
- name: Create Gophish instance
include_tasks: "../tasks/create_instance.yml"
vars:
instance_name: "{{ server_name }}"
instance_type: "{{ gophish_instance_type }}"
region: "{{ gophish_region }}"
security_group_rules:
- { proto: tcp, port: 22, cidr: "{{ operator_ip }}/32", desc: "SSH from operator" }
- { proto: tcp, port: 3333, cidr: "{{ operator_ip }}/32", desc: "Gophish admin" }
- { proto: tcp, port: 25, cidr: "{{ mta_front_ip | default('10.0.0.0/8') }}/32", desc: "SMTP from MTA" }
- { proto: tcp, port: 80, cidr: "{{ phishing_redirector_ip | default('10.0.0.0/8') }}/32", desc: "HTTP from redirector" }
- name: Add Gophish to inventory
add_host:
name: "gophish_server"
groups: "gophish_servers"
ansible_host: "{{ instance_ip }}"
ansible_user: "{{ ansible_user | default('ubuntu') }}"
ansible_ssh_private_key_file: "{{ ssh_key_path }}"
ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
- name: Configure Gophish server
hosts: gophish_servers
become: true
gather_facts: true
vars_files:
- vars.yaml
tasks:
- name: Include advanced Gophish configuration
include_tasks: "../tasks/configure_gophish_advanced.yml"
- name: Include security hardening
include_tasks: "../tasks/security_hardening.yml"
- name: Include tracker setup
include_tasks: "../tasks/configure_integrated_tracker.yml"
when: deploy_tracker | default(true) | bool
phishing/mta_front.yml
+51
View File
@@ -0,0 +1,51 @@
---
# MTA Front server deployment for email relay and SMTP smuggling
- name: Deploy MTA Front server
hosts: localhost
gather_facts: false
connection: local
vars_files:
- vars.yaml
vars:
mta_instance_type: "{{ mta_instance_type | default('t3.medium') }}"
mta_region: "{{ mta_region | default(aws_region) }}"
tasks:
- name: Create MTA Front instance
include_tasks: "../tasks/create_instance.yml"
vars:
instance_name: "{{ server_name }}"
instance_type: "{{ mta_instance_type }}"
region: "{{ mta_region }}"
security_group_rules:
- { proto: tcp, port: 22, cidr: "{{ operator_ip }}/32", desc: "SSH from operator" }
- { proto: tcp, port: 25, cidr: "0.0.0.0/0", desc: "SMTP from anywhere" }
- { proto: tcp, port: 587, cidr: "0.0.0.0/0", desc: "SMTP submission" }
- { proto: tcp, port: 465, cidr: "0.0.0.0/0", desc: "SMTPS" }
- name: Add MTA Front to inventory
add_host:
name: "mta_front"
groups: "mta_fronts"
ansible_host: "{{ instance_ip }}"
ansible_user: "{{ ansible_user | default('ubuntu') }}"
ansible_ssh_private_key_file: "{{ ssh_key_path }}"
ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
- name: Configure MTA Front server
hosts: mta_fronts
become: true
gather_facts: true
vars_files:
- vars.yaml
tasks:
- name: Include MTA Front configuration
include_tasks: "../tasks/configure_mta_front.yml"
- name: Include security hardening
include_tasks: "../tasks/security_hardening.yml"
- name: Include tracker setup
include_tasks: "../tasks/configure_integrated_tracker.yml"
when: deploy_tracker | default(true) | bool
phishing/phishing_redirector.yml
+46
View File
@@ -0,0 +1,46 @@
---
# Phishing redirector deployment with advanced evasion
- name: Deploy phishing redirector
hosts: localhost
gather_facts: false
connection: local
vars_files:
- vars.yaml
vars:
redirector_instance_type: "{{ redirector_instance_type | default('t3.small') }}"
redirector_region: "{{ redirector_region | default(aws_region) }}"
tasks:
- name: Create phishing redirector instance
include_tasks: "../tasks/create_instance.yml"
vars:
instance_name: "{{ server_name }}"
instance_type: "{{ redirector_instance_type }}"
region: "{{ redirector_region }}"
security_group_rules:
- { proto: tcp, port: 22, cidr: "{{ operator_ip }}/32", desc: "SSH from operator" }
- { proto: tcp, port: 80, cidr: "0.0.0.0/0", desc: "HTTP from anywhere" }
- { proto: tcp, port: 443, cidr: "0.0.0.0/0", desc: "HTTPS from anywhere" }
- name: Add phishing redirector to inventory
add_host:
name: "phishing_redirector"
groups: "phishing_redirectors"
ansible_host: "{{ instance_ip }}"
ansible_user: "{{ ansible_user | default('ubuntu') }}"
ansible_ssh_private_key_file: "{{ ssh_key_path }}"
ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
- name: Configure phishing redirector
hosts: phishing_redirectors
become: true
gather_facts: true
vars_files:
- vars.yaml
tasks:
- name: Include phishing redirector configuration
include_tasks: "../tasks/configure_phishing_redirector.yml"
- name: Include security hardening
include_tasks: "../tasks/security_hardening.yml"
phishing/phishing_webserver.yml
+50
View File
@@ -0,0 +1,50 @@
---
# Phishing web server for credential harvesting
- name: Deploy phishing web server
hosts: localhost
gather_facts: false
connection: local
vars_files:
- vars.yaml
vars:
webserver_instance_type: "{{ webserver_instance_type | default('t3.medium') }}"
webserver_region: "{{ webserver_region | default(aws_region) }}"
tasks:
- name: Create phishing web server instance
include_tasks: "../tasks/create_instance.yml"
vars:
instance_name: "{{ server_name }}"
instance_type: "{{ webserver_instance_type }}"
region: "{{ webserver_region }}"
security_group_rules:
- { proto: tcp, port: 22, cidr: "{{ operator_ip }}/32", desc: "SSH from operator" }
- { proto: tcp, port: 80, cidr: "{{ phishing_redirector_ip | default('10.0.0.0/8') }}/32", desc: "HTTP from redirector" }
- { proto: tcp, port: 443, cidr: "{{ phishing_redirector_ip | default('10.0.0.0/8') }}/32", desc: "HTTPS from redirector" }
- name: Add phishing web server to inventory
add_host:
name: "phishing_webserver"
groups: "phishing_webservers"
ansible_host: "{{ instance_ip }}"
ansible_user: "{{ ansible_user | default('ubuntu') }}"
ansible_ssh_private_key_file: "{{ ssh_key_path }}"
ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
- name: Configure phishing web server
hosts: phishing_webservers
become: true
gather_facts: true
vars_files:
- vars.yaml
tasks:
- name: Include phishing web server configuration
include_tasks: "../tasks/configure_phishing_webserver.yml"
- name: Include security hardening
include_tasks: "../tasks/security_hardening.yml"
- name: Include tracker setup
include_tasks: "../tasks/configure_integrated_tracker.yml"
when: deploy_tracker | default(true) | bool