/Evilginx-Phishing-Infra-Setup

Evilginx Phishing Engagement Infrastructure Setup Guide

Phishing Engagement Infrastructure Setup Guide

Note: These notes are copy of my personal notes which i updates frequetly, For more updated content you can check my notes here.

Blogs/Talks

Red Team/Phishing Infra Automation

Domain Purchase and Categorization Techniques

Delivering Emails in Inbox

  • Method -1
    • Use SendGrid
  • Method - 2 (By Andre Rosario - From BreakDev Red Discord)

    • If you are having issues with delivering emails due to email filtering, consider using Microsoft 365 and Azure IPP to send encrypted emails to your targets!

      • Emails originate from legit Microsoft SMTP servers so they can't block it.
      • Targets who get the encrypted email are the only ones who can open it, if they forward it to their DFIR, they will have to login as that user to even see your message.
      • Easy orchestration in the Microsoft Admin portal of custom domains, create a ton of fake accounts.
      • M365 allows you to set arbitrary display names. So in a targets outlook the email can look like its from admin@domain.com but it's really from admin@maliciousdomain.com (Technical people can easily figure this out though)
      • Emails come from legit Microsoft IPs and domains, so you don't have to worry about domain categorization or lifespan since it's Microsoft.

    • Steps

      1. Make an account with a Microsoft 365 Business Standard (or higher) license. (https://www.microsoft.com/en-us/microsoft-365/enterprise/office365-plans-and-pricing)
      2. Create a generic company name.
      3. Get a Azure Information Protection Premium P1 license to be able to use encryption. (https://support.microsoft.com/en-us/office/encrypt-email-messages-373339cb-bf1a-4509-b296-802a39d801dc)
      4. Import your domain.
      5. Create a user with an email to your custom domain to send the phish and give it the M365 Business and Azure IPP P1 license.
      6. Draft your phishing message in Outlook online and press the encrypt button
      7. ????
      8. Profit

    • Screenshot

      Untitled

Phishing Engagements With Evilginx

Securing GoPhish Infra

These modifications will also work in the latest evilginx + gophish version i.e evilginx3.3

  • Modifications in gophish source code and file structure to Secure the GoPhish Infra

    • Remove X-Gophish instances ( X-Gophish-Contact , X-Gophish-Signature)

    • Remove const ServerName= "gophish" and change it to const ServerName= "IGNORE" in file config/config.go

    • Change the default Admin server port in config.json file.

    • Modify Test Email Message Signatures, To avoid detection during SMTP Testing. Controllers > api > util.go

      Controllers > api > util.go
models > testdata > email_request.go
models > testdata > email_request_test.go
models > testdata > maillog.go
models > testdata > maillog_test.go
models > testdata > smtp_test.go

    • Change 404 response

      • Add below custom function in controllers/phish.go file

        func customNotFound(w http.ResponseWriter, r *http.Request) {
	http.Error(w, "Try again!", http.StatusNotFound)
}

      • Now replace all instances of http.NotFound(w, r) to customNotFound(w, r)

    • Remove robots.txt hardcoded response and modify it in file controllers/phish.go

      • Modify the respective code in phish.go file to below one.

        //Modified Response
// RobotsHandler prevents search engines, etc. from indexing phishing materials
func (ps *PhishingServer) RobotsHandler(w http.ResponseWriter, r *http.Request) {
	fmt.Fprintln(w, "User-agent: *\nDisallow: /*/*\nDisallow: /.git/*")
}

    • Modify the “rid” GET Parameter in requests

      • Make sure to modify all the instances of "rid" to something else.
      • These are also present in evilginx3.3 source code , So make sure to modify there as well.

    • For advance preventions, You can modify the static folder as well and rename it to something else, also rename the files inside it to avoid path based detection. Just do not forget to modify the relevance source code as well.

      • Like images name , example : pixel.png , modify it to something else.

    • Change the Certificate Properties in util/util.go file

      	template := x509.Certificate{
		SerialNumber: serialNumber,
		Subject: pkix.Name{
			//Organization: []string{"Gophish"},
			Organization: []string{"Microsoft Corporation"},
		},

    • Use Nginx to proxy traffic through it to avoid any Golang Server Fingerprint

      • service nginx start

      • You need to change the gophish config.json to change the ports for http from 80 to 8080 and https from default to 60002, as shown below

        {
	"admin_server": {
		"listen_url": "127.0.0.1:60002",
		"use_tls": true,
		"cert_path": "gophish_admin.crt",
		"key_path": "gophish_admin.key",
		"trusted_origins": []
	},
	"phish_server": {
		"listen_url": "127.0.0.1:8080",
		"use_tls": false,
		"cert_path": "example.crt",
		"key_path": "example.key"
	},
	"db_name": "sqlite3",
	"db_path": "gophish.db",
	"migrations_prefix": "db/db_",
	"contact_address": "",
	"logging": {
		"filename": "",
		"level": ""
	}
}

      • Below configuration will block all requests with user agent containing “Bot” or “bot”

        # /etc/nginx/nginx.conf

events {
    # Define event processing parameters here
    worker_connections 1024; # Adjust according to your requirements
}

http {

    upstream backend {
        server localhost:8080;
    }
    # HTTP server
    server {
        listen 80 default_server;
        

        # Reject requests with "bot" or "Bot" in User-Agent
        if ($http_user_agent ~* (bot|Bot)) {
            return 403;
        }

        location / {
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

    upstream backend_https {
        server localhost:60002;
    }
    # HTTPS server
    server {
        listen 60001 ssl default_server;

        ssl_certificate /root/Phishing/gophish-mod/gophish_admin.crt;
        ssl_certificate_key /root/Phishing/gophish-mod/gophish_admin.key;

        # Reject requests with "bot" or "Bot" in User-Agent
        if ($http_user_agent ~* (bot|Bot)) {
            return 403;
        }

        location / {
            proxy_pass https://backend_https;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}

      • To allow specific user agent only, use below config. This will block all requests and only allow requests which has user agent “iamdevil”.

        # /etc/nginx/nginx.conf

events {
    # Define event processing parameters here
    worker_connections 1024; # Adjust according to your requirements
}

http {

    upstream backend {
        server localhost:8080;
    }

    # HTTP server
    server {
        listen 80 default_server;

        # Reject requests with user agent other than "iamdevil"
        if ($http_user_agent != "iamdevil") {
            return 403;
        }

        location / {
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

    upstream backend_https {
        server localhost:60002;
    }

    # HTTPS server
    server {
        listen 60001 ssl default_server;

        ssl_certificate /root/Phishing/gophish-mod/gophish_admin.crt;
        ssl_certificate_key /root/Phishing/gophish-mod/gophish_admin.key;

        # Reject requests with user agent other than "iamdevil"
        if ($http_user_agent != "iamdevil") {
            return 403;
        }

        location / {
            proxy_pass https://backend_https;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}

  • https://edermi.github.io/post/2021/modding_gophish/

  • https://www.sprocketsecurity.com/resources/never-had-a-bad-day-phishing-how-to-set-up-gophish-to-evade-security-controls

  • https://cyberwarfare.live/wp-content/uploads/2023/08/OPSEC-on-the-High-Seas_-A-Gophish-Adventure.pdf

  • https://www.sprocketsecurity.com/resources/never-had-a-bad-day-phishing-how-to-set-up-gophish-to-evade-security-controls

  • https://github.com/puzzlepeaches/sneaky_gophish

  • https://cybercx.co.nz/blog/identifying-gophish-servers/

  • gophish/gophish#1553 (comment)

Evilginx Installation Script

Defense Tactics Against Evilginx

Tools

Other Techniques