Operator
98103466d8
Sanitized version of red team infrastructure automation platform. Operational content (implant pipelines, lures, credential capture) replaced with documented stubs. Architecture and infrastructure automation code intact.
151 lines
3.9 KiB
YAML
151 lines
3.9 KiB
YAML
---
|
|
# Configure MTA Front server for email relay and SMTP smuggling
|
|
|
|
- name: Update system packages
|
|
apt:
|
|
update_cache: yes
|
|
upgrade: dist
|
|
|
|
- name: Install MTA packages
|
|
apt:
|
|
name:
|
|
- postfix
|
|
- postfix-pcre
|
|
- dovecot-core
|
|
- dovecot-imapd
|
|
- opendkim
|
|
- opendkim-tools
|
|
- python3-pip
|
|
- python3-venv
|
|
- nginx
|
|
- certbot
|
|
- python3-certbot-nginx
|
|
- dnsutils
|
|
- swaks
|
|
- telnet
|
|
state: present
|
|
|
|
- name: Configure Postfix for MTA fronting
|
|
template:
|
|
src: "../templates/phishing/postfix-mta-front.j2"
|
|
dest: /etc/postfix/main.cf
|
|
backup: yes
|
|
notify: restart postfix
|
|
|
|
- name: Configure Postfix master.cf for advanced relaying
|
|
blockinfile:
|
|
path: /etc/postfix/master.cf
|
|
block: |
|
|
# SMTP smuggling and advanced relay configurations
|
|
587 inet n - y - - smtpd
|
|
-o syslog_name=postfix/submission
|
|
-o smtpd_tls_security_level=encrypt
|
|
-o smtpd_sasl_auth_enable=yes
|
|
-o smtpd_tls_wrappermode=no
|
|
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
|
|
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
|
|
-o milter_macro_daemon_name=ORIGINATING
|
|
|
|
# SMTP smuggling support
|
|
cleanup unix n - y - 0 cleanup
|
|
-o header_checks=pcre:/etc/postfix/header_checks
|
|
-o nested_header_checks=pcre:/etc/postfix/nested_header_checks
|
|
|
|
- name: Create SMTP smuggling header checks
|
|
copy:
|
|
dest: /etc/postfix/header_checks
|
|
content: |
|
|
# SMTP smuggling techniques
|
|
/^Content-Transfer-Encoding:\s*7bit/i REPLACE Content-Transfer-Encoding: 8bit
|
|
/^Content-Type:\s*text\/plain/i REPLACE Content-Type: text/html
|
|
mode: '0644'
|
|
notify:
|
|
- reload postfix
|
|
- postmap header_checks
|
|
|
|
- name: Create nested header checks for advanced smuggling
|
|
copy:
|
|
dest: /etc/postfix/nested_header_checks
|
|
content: |
|
|
# Advanced SMTP smuggling patterns
|
|
/^\s*<script/i IGNORE
|
|
/^\s*<iframe/i IGNORE
|
|
mode: '0644'
|
|
notify:
|
|
- reload postfix
|
|
- postmap nested_header_checks
|
|
|
|
- name: Configure DKIM for domain reputation
|
|
include_tasks: ../tasks/configure_mail.yml
|
|
|
|
- name: Create relay authentication
|
|
copy:
|
|
dest: /etc/postfix/sasl_passwd
|
|
content: |
|
|
{{ phishing_domain }} {{ smtp_relay_user }}:{{ smtp_relay_pass }}
|
|
mode: '0600'
|
|
owner: root
|
|
group: root
|
|
notify:
|
|
- postmap sasl_passwd
|
|
- restart postfix
|
|
|
|
- name: Configure transport maps for backend routing
|
|
copy:
|
|
dest: /etc/postfix/transport
|
|
content: |
|
|
{{ phishing_domain }} smtp:[{{ gophish_ip }}]:25
|
|
.{{ phishing_domain }} smtp:[{{ gophish_ip }}]:25
|
|
mode: '0644'
|
|
notify:
|
|
- postmap transport
|
|
- restart postfix
|
|
|
|
- name: Install Python SMTP testing tools
|
|
pip:
|
|
name:
|
|
- smtplib-extended
|
|
- email-validator
|
|
- faker
|
|
state: present
|
|
|
|
- name: Create SMTP smuggling test script
|
|
template:
|
|
src: "../templates/phishing/smtp-smuggling-test.py.j2"
|
|
dest: /root/Tools/smtp-smuggling-test.py
|
|
mode: '0755'
|
|
|
|
- name: Create email reputation monitoring script
|
|
template:
|
|
src: "../templates/phishing/reputation-monitor.sh.j2"
|
|
dest: /root/Tools/reputation-monitor.sh
|
|
mode: '0755'
|
|
|
|
- name: Set up log monitoring for deliverability
|
|
cron:
|
|
name: "Monitor email deliverability"
|
|
minute: "*/15"
|
|
job: "/root/Tools/reputation-monitor.sh >> /var/log/reputation.log 2>&1"
|
|
|
|
handlers:
|
|
- name: restart postfix
|
|
service:
|
|
name: postfix
|
|
state: restarted
|
|
|
|
- name: reload postfix
|
|
service:
|
|
name: postfix
|
|
state: reloaded
|
|
|
|
- name: postmap header_checks
|
|
command: postmap /etc/postfix/header_checks
|
|
|
|
- name: postmap nested_header_checks
|
|
command: postmap /etc/postfix/nested_header_checks
|
|
|
|
- name: postmap sasl_passwd
|
|
command: postmap /etc/postfix/sasl_passwd
|
|
|
|
- name: postmap transport
|
|
command: postmap /etc/postfix/transport |