Operator
0799bfbae8
Sanitized version of red team infrastructure automation platform. Operational content (implant pipelines, lures, credential capture) replaced with documented stubs. Architecture and infrastructure automation code intact.
296 lines
7.5 KiB
YAML
296 lines
7.5 KiB
YAML
---
|
|
# Common tasks for configuring advanced phishing server
|
|
# Supports both red team and FedRAMP compliance modes
|
|
|
|
- name: Update system packages
|
|
apt:
|
|
update_cache: yes
|
|
upgrade: dist
|
|
|
|
- name: Install base packages for phishing server
|
|
apt:
|
|
name:
|
|
- nginx
|
|
- certbot
|
|
- python3-certbot-nginx
|
|
- postfix
|
|
- dovecot-core
|
|
- dovecot-imapd
|
|
- opendkim
|
|
- opendkim-tools
|
|
- sqlite3
|
|
- git
|
|
- curl
|
|
- wget
|
|
- jq
|
|
- unzip
|
|
- python3-pip
|
|
- python3-venv
|
|
- nodejs
|
|
- npm
|
|
- php-fpm
|
|
- php-sqlite3
|
|
- php-curl
|
|
- php-json
|
|
- swaks
|
|
- dnsutils
|
|
- net-tools
|
|
- fail2ban
|
|
state: present
|
|
|
|
- name: Create phishing tools directory
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
with_items:
|
|
- /root/Tools/phishing
|
|
- /root/Tools/phishing/templates
|
|
- /root/Tools/phishing/campaigns
|
|
- /root/Tools/phishing/logs
|
|
- /var/www/phishing
|
|
- /var/www/phishing/assets
|
|
- /var/www/phishing/api
|
|
|
|
- name: Set up GoPhish directory
|
|
file:
|
|
path: /root/Tools/gophish
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Download latest GoPhish release
|
|
shell: |
|
|
LATEST_URL=$(curl -s https://api.github.com/repos/gophish/gophish/releases/latest | jq -r '.assets[] | select(.browser_download_url | contains("linux-64bit.zip")) | .browser_download_url')
|
|
curl -L "$LATEST_URL" -o /tmp/gophish.zip
|
|
unzip /tmp/gophish.zip -d /root/Tools/gophish
|
|
chmod +x /root/Tools/gophish/gophish
|
|
rm -f /tmp/gophish.zip
|
|
args:
|
|
creates: /root/Tools/gophish/gophish
|
|
|
|
- name: Create advanced GoPhish configuration
|
|
template:
|
|
src: "../templates/advanced-gophish-config.j2"
|
|
dest: "/root/Tools/gophish/config.json"
|
|
mode: '0600'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Create GoPhish systemd service
|
|
template:
|
|
src: "../templates/gophish.service.j2"
|
|
dest: "/etc/systemd/system/gophish.service"
|
|
mode: '0644'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Configure Postfix for outbound email
|
|
template:
|
|
src: "../templates/postfix-phishing.conf.j2"
|
|
dest: "/etc/postfix/main.cf"
|
|
backup: yes
|
|
notify: restart postfix
|
|
|
|
- name: Configure OpenDKIM for email authentication
|
|
template:
|
|
src: "../templates/opendkim-phishing.conf.j2"
|
|
dest: "/etc/opendkim.conf"
|
|
backup: yes
|
|
notify: restart opendkim
|
|
|
|
- name: Create DKIM keys directory
|
|
file:
|
|
path: "/etc/opendkim/keys/{{ phishing_domain }}"
|
|
state: directory
|
|
owner: opendkim
|
|
group: opendkim
|
|
mode: '0700'
|
|
|
|
- name: Generate DKIM keys
|
|
command: >
|
|
opendkim-genkey -D /etc/opendkim/keys/{{ phishing_domain }}
|
|
-d {{ phishing_domain }} -s phishing
|
|
args:
|
|
creates: "/etc/opendkim/keys/{{ phishing_domain }}/phishing.private"
|
|
|
|
- name: Set DKIM key permissions
|
|
file:
|
|
path: "/etc/opendkim/keys/{{ phishing_domain }}/phishing.private"
|
|
owner: opendkim
|
|
group: opendkim
|
|
mode: '0600'
|
|
|
|
- name: Create phishing landing page templates
|
|
template:
|
|
src: "{{ item.src }}"
|
|
dest: "{{ item.dest }}"
|
|
mode: '0644'
|
|
owner: www-data
|
|
group: www-data
|
|
with_items:
|
|
- { src: "../templates/phishing-landing-office365.html.j2", dest: "/var/www/phishing/office365.html" }
|
|
- { src: "../templates/phishing-landing-gmail.html.j2", dest: "/var/www/phishing/gmail.html" }
|
|
- { src: "../templates/phishing-landing-aws.html.j2", dest: "/var/www/phishing/aws.html" }
|
|
- { src: "../templates/phishing-landing-generic.html.j2", dest: "/var/www/phishing/generic.html" }
|
|
|
|
- name: Create credential capture API
|
|
template:
|
|
src: "../templates/credential-capture-api.php.j2"
|
|
dest: "/var/www/phishing/api/capture.php"
|
|
mode: '0644'
|
|
owner: www-data
|
|
group: www-data
|
|
|
|
- name: Create tracking pixel endpoint
|
|
template:
|
|
src: "../templates/tracking-pixel.php.j2"
|
|
dest: "/var/www/phishing/track.php"
|
|
mode: '0644'
|
|
owner: www-data
|
|
group: www-data
|
|
|
|
- name: Configure Nginx for phishing sites
|
|
template:
|
|
src: "../templates/nginx-phishing.conf.j2"
|
|
dest: "/etc/nginx/sites-available/phishing"
|
|
mode: '0644'
|
|
notify: reload nginx
|
|
|
|
- name: Enable phishing site
|
|
file:
|
|
src: /etc/nginx/sites-available/phishing
|
|
dest: /etc/nginx/sites-enabled/phishing
|
|
state: link
|
|
notify: reload nginx
|
|
|
|
- name: Create phishing campaign management scripts
|
|
template:
|
|
src: "{{ item.src }}"
|
|
dest: "{{ item.dest }}"
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
with_items:
|
|
- { src: "../templates/campaign-launcher.sh.j2", dest: "/root/Tools/phishing/launch-campaign.sh" }
|
|
- { src: "../templates/stats-collector.sh.j2", dest: "/root/Tools/phishing/collect-stats.sh" }
|
|
- { src: "../templates/email-validator.py.j2", dest: "/root/Tools/phishing/validate-emails.py" }
|
|
|
|
- name: Create database for tracking
|
|
shell: |
|
|
sqlite3 /root/Tools/phishing/tracking.db << EOF
|
|
CREATE TABLE IF NOT EXISTS email_opens (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
campaign_id TEXT NOT NULL,
|
|
recipient_email TEXT NOT NULL,
|
|
ip_address TEXT,
|
|
user_agent TEXT,
|
|
opened_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
location TEXT
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS link_clicks (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
campaign_id TEXT NOT NULL,
|
|
recipient_email TEXT NOT NULL,
|
|
link_url TEXT NOT NULL,
|
|
ip_address TEXT,
|
|
user_agent TEXT,
|
|
clicked_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
location TEXT
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS credential_submissions (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
campaign_id TEXT NOT NULL,
|
|
recipient_email TEXT,
|
|
username TEXT,
|
|
password_hash TEXT,
|
|
ip_address TEXT,
|
|
user_agent TEXT,
|
|
submitted_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
location TEXT,
|
|
additional_data TEXT
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS campaigns (
|
|
id TEXT PRIMARY KEY,
|
|
name TEXT NOT NULL,
|
|
template TEXT NOT NULL,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
status TEXT DEFAULT 'active',
|
|
target_count INTEGER DEFAULT 0,
|
|
opened_count INTEGER DEFAULT 0,
|
|
clicked_count INTEGER DEFAULT 0,
|
|
submitted_count INTEGER DEFAULT 0
|
|
);
|
|
EOF
|
|
args:
|
|
creates: /root/Tools/phishing/tracking.db
|
|
|
|
- name: Set database permissions
|
|
file:
|
|
path: /root/Tools/phishing/tracking.db
|
|
owner: www-data
|
|
group: www-data
|
|
mode: '0644'
|
|
|
|
- name: Install Python dependencies for advanced features
|
|
pip:
|
|
name:
|
|
- requests
|
|
- beautifulsoup4
|
|
- lxml
|
|
- flask
|
|
- flask-cors
|
|
- dnspython
|
|
- python-whois
|
|
- selenium
|
|
- fake-useragent
|
|
state: present
|
|
|
|
- name: Create SSL certificate setup script
|
|
template:
|
|
src: "../templates/setup-phishing-ssl.sh.j2"
|
|
dest: "/root/Tools/phishing/setup-ssl.sh"
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Create domain reputation checker
|
|
template:
|
|
src: "../templates/domain-reputation.py.j2"
|
|
dest: "/root/Tools/phishing/check-reputation.py"
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Start and enable services
|
|
systemd:
|
|
name: "{{ item }}"
|
|
state: started
|
|
enabled: yes
|
|
daemon_reload: yes
|
|
with_items:
|
|
- postfix
|
|
- opendkim
|
|
- nginx
|
|
- php7.4-fpm
|
|
- gophish
|
|
|
|
handlers:
|
|
- name: restart postfix
|
|
systemd:
|
|
name: postfix
|
|
state: restarted
|
|
|
|
- name: restart opendkim
|
|
systemd:
|
|
name: opendkim
|
|
state: restarted
|
|
|
|
- name: reload nginx
|
|
systemd:
|
|
name: nginx
|
|
state: reloaded |