n0mad1k
296 lines
7.5 KiB
YAML
296 lines
7.5 KiB
YAML
---
|
|
# Common tasks for configuring advanced phishing server
|
|
# Supports both red team and FedRAMP compliance modes
|
|
|
|
- name: Update system packages
|
|
apt:
|
|
update_cache: yes
|
|
upgrade: dist
|
|
|
|
- name: Install base packages for phishing server
|
|
apt:
|
|
name:
|
|
- nginx
|
|
- certbot
|
|
- python3-certbot-nginx
|
|
- postfix
|
|
- dovecot-core
|
|
- dovecot-imapd
|
|
- opendkim
|
|
- opendkim-tools
|
|
- sqlite3
|
|
- git
|
|
- curl
|
|
- wget
|
|
- jq
|
|
- unzip
|
|
- python3-pip
|
|
- python3-venv
|
|
- nodejs
|
|
- npm
|
|
- php-fpm
|
|
- php-sqlite3
|
|
- php-curl
|
|
- php-json
|
|
- swaks
|
|
- dnsutils
|
|
- net-tools
|
|
- fail2ban
|
|
state: present
|
|
|
|
- name: Create phishing tools directory
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
with_items:
|
|
- /root/Tools/phishing
|
|
- /root/Tools/phishing/templates
|
|
- /root/Tools/phishing/campaigns
|
|
- /root/Tools/phishing/logs
|
|
- /var/www/phishing
|
|
- /var/www/phishing/assets
|
|
- /var/www/phishing/api
|
|
|
|
- name: Set up GoPhish directory
|
|
file:
|
|
path: /root/Tools/gophish
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Download latest GoPhish release
|
|
shell: |
|
|
LATEST_URL=$(curl -s https://api.github.com/repos/gophish/gophish/releases/latest | jq -r '.assets[] | select(.browser_download_url | contains("linux-64bit.zip")) | .browser_download_url')
|
|
curl -L "$LATEST_URL" -o /tmp/gophish.zip
|
|
unzip /tmp/gophish.zip -d /root/Tools/gophish
|
|
chmod +x /root/Tools/gophish/gophish
|
|
rm -f /tmp/gophish.zip
|
|
args:
|
|
creates: /root/Tools/gophish/gophish
|
|
|
|
- name: Create advanced GoPhish configuration
|
|
template:
|
|
src: "../templates/advanced-gophish-config.j2"
|
|
dest: "/root/Tools/gophish/config.json"
|
|
mode: '0600'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Create GoPhish systemd service
|
|
template:
|
|
src: "../templates/gophish.service.j2"
|
|
dest: "/etc/systemd/system/gophish.service"
|
|
mode: '0644'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Configure Postfix for outbound email
|
|
template:
|
|
src: "../templates/postfix-phishing.conf.j2"
|
|
dest: "/etc/postfix/main.cf"
|
|
backup: yes
|
|
notify: restart postfix
|
|
|
|
- name: Configure OpenDKIM for email authentication
|
|
template:
|
|
src: "../templates/opendkim-phishing.conf.j2"
|
|
dest: "/etc/opendkim.conf"
|
|
backup: yes
|
|
notify: restart opendkim
|
|
|
|
- name: Create DKIM keys directory
|
|
file:
|
|
path: "/etc/opendkim/keys/{{ phishing_domain }}"
|
|
state: directory
|
|
owner: opendkim
|
|
group: opendkim
|
|
mode: '0700'
|
|
|
|
- name: Generate DKIM keys
|
|
command: >
|
|
opendkim-genkey -D /etc/opendkim/keys/{{ phishing_domain }}
|
|
-d {{ phishing_domain }} -s phishing
|
|
args:
|
|
creates: "/etc/opendkim/keys/{{ phishing_domain }}/phishing.private"
|
|
|
|
- name: Set DKIM key permissions
|
|
file:
|
|
path: "/etc/opendkim/keys/{{ phishing_domain }}/phishing.private"
|
|
owner: opendkim
|
|
group: opendkim
|
|
mode: '0600'
|
|
|
|
- name: Create phishing landing page templates
|
|
template:
|
|
src: "{{ item.src }}"
|
|
dest: "{{ item.dest }}"
|
|
mode: '0644'
|
|
owner: www-data
|
|
group: www-data
|
|
with_items:
|
|
- { src: "../templates/phishing-landing-office365.html.j2", dest: "/var/www/phishing/office365.html" }
|
|
- { src: "../templates/phishing-landing-gmail.html.j2", dest: "/var/www/phishing/gmail.html" }
|
|
- { src: "../templates/phishing-landing-aws.html.j2", dest: "/var/www/phishing/aws.html" }
|
|
- { src: "../templates/phishing-landing-generic.html.j2", dest: "/var/www/phishing/generic.html" }
|
|
|
|
- name: Create credential capture API
|
|
template:
|
|
src: "../templates/credential-capture-api.php.j2"
|
|
dest: "/var/www/phishing/api/capture.php"
|
|
mode: '0644'
|
|
owner: www-data
|
|
group: www-data
|
|
|
|
- name: Create tracking pixel endpoint
|
|
template:
|
|
src: "../templates/tracking-pixel.php.j2"
|
|
dest: "/var/www/phishing/track.php"
|
|
mode: '0644'
|
|
owner: www-data
|
|
group: www-data
|
|
|
|
- name: Configure Nginx for phishing sites
|
|
template:
|
|
src: "../templates/nginx-phishing.conf.j2"
|
|
dest: "/etc/nginx/sites-available/phishing"
|
|
mode: '0644'
|
|
notify: reload nginx
|
|
|
|
- name: Enable phishing site
|
|
file:
|
|
src: /etc/nginx/sites-available/phishing
|
|
dest: /etc/nginx/sites-enabled/phishing
|
|
state: link
|
|
notify: reload nginx
|
|
|
|
- name: Create phishing campaign management scripts
|
|
template:
|
|
src: "{{ item.src }}"
|
|
dest: "{{ item.dest }}"
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
with_items:
|
|
- { src: "../templates/campaign-launcher.sh.j2", dest: "/root/Tools/phishing/launch-campaign.sh" }
|
|
- { src: "../templates/stats-collector.sh.j2", dest: "/root/Tools/phishing/collect-stats.sh" }
|
|
- { src: "../templates/email-validator.py.j2", dest: "/root/Tools/phishing/validate-emails.py" }
|
|
|
|
- name: Create database for tracking
|
|
shell: |
|
|
sqlite3 /root/Tools/phishing/tracking.db << EOF
|
|
CREATE TABLE IF NOT EXISTS email_opens (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
campaign_id TEXT NOT NULL,
|
|
recipient_email TEXT NOT NULL,
|
|
ip_address TEXT,
|
|
user_agent TEXT,
|
|
opened_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
location TEXT
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS link_clicks (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
campaign_id TEXT NOT NULL,
|
|
recipient_email TEXT NOT NULL,
|
|
link_url TEXT NOT NULL,
|
|
ip_address TEXT,
|
|
user_agent TEXT,
|
|
clicked_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
location TEXT
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS credential_submissions (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
campaign_id TEXT NOT NULL,
|
|
recipient_email TEXT,
|
|
username TEXT,
|
|
password_hash TEXT,
|
|
ip_address TEXT,
|
|
user_agent TEXT,
|
|
submitted_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
location TEXT,
|
|
additional_data TEXT
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS campaigns (
|
|
id TEXT PRIMARY KEY,
|
|
name TEXT NOT NULL,
|
|
template TEXT NOT NULL,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
|
status TEXT DEFAULT 'active',
|
|
target_count INTEGER DEFAULT 0,
|
|
opened_count INTEGER DEFAULT 0,
|
|
clicked_count INTEGER DEFAULT 0,
|
|
submitted_count INTEGER DEFAULT 0
|
|
);
|
|
EOF
|
|
args:
|
|
creates: /root/Tools/phishing/tracking.db
|
|
|
|
- name: Set database permissions
|
|
file:
|
|
path: /root/Tools/phishing/tracking.db
|
|
owner: www-data
|
|
group: www-data
|
|
mode: '0644'
|
|
|
|
- name: Install Python dependencies for advanced features
|
|
pip:
|
|
name:
|
|
- requests
|
|
- beautifulsoup4
|
|
- lxml
|
|
- flask
|
|
- flask-cors
|
|
- dnspython
|
|
- python-whois
|
|
- selenium
|
|
- fake-useragent
|
|
state: present
|
|
|
|
- name: Create SSL certificate setup script
|
|
template:
|
|
src: "../templates/setup-phishing-ssl.sh.j2"
|
|
dest: "/root/Tools/phishing/setup-ssl.sh"
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Create domain reputation checker
|
|
template:
|
|
src: "../templates/domain-reputation.py.j2"
|
|
dest: "/root/Tools/phishing/check-reputation.py"
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Start and enable services
|
|
systemd:
|
|
name: "{{ item }}"
|
|
state: started
|
|
enabled: yes
|
|
daemon_reload: yes
|
|
with_items:
|
|
- postfix
|
|
- opendkim
|
|
- nginx
|
|
- php7.4-fpm
|
|
- gophish
|
|
|
|
handlers:
|
|
- name: restart postfix
|
|
systemd:
|
|
name: postfix
|
|
state: restarted
|
|
|
|
- name: restart opendkim
|
|
systemd:
|
|
name: opendkim
|
|
state: restarted
|
|
|
|
- name: reload nginx
|
|
systemd:
|
|
name: nginx
|
|
state: reloaded |