{"id":3759,"date":"2024-12-25T14:03:49","date_gmt":"2024-12-25T13:03:49","guid":{"rendered":"https:\/\/hardsoftsecurity.es\/?p=3759"},"modified":"2025-01-16T17:50:32","modified_gmt":"2025-01-16T16:50:32","slug":"deploying-secure-red-team-infrastructure","status":"publish","type":"post","link":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/12\/25\/deploying-secure-red-team-infrastructure\/","title":{"rendered":"Deploying Secure Red Team Infrastructure"},"content":{"rendered":"\n

Welcome to a new post, where we are going to see how to deploy a secure Red Team infrastructure. We will se how to deploy legit services to perform phishing and hide our C2 traffic through HTTPS protocol.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Disclaimer<\/strong><\/h3>\n\n\n\n
\n

The information provided in this post is intended for educational purposes only. The techniques, tools, and methodologies discussed are designed to help cybersecurity professionals and enthusiasts understand how to deploy a red team infrastructure in a controlled and lawful environment.<\/p>\n\n\n\n

By accessing this content, you agree to use the information responsibly and only in environments where you have explicit authorization to perform testing or simulations. Unauthorized use of these techniques on systems without proper consent may violate local, national, or international laws, and such actions could lead to severe legal consequences.<\/p>\n\n\n\n

Neither the author nor this post assumes any responsibility or liability for misuse of the information provided. Always prioritize ethical practices, respect for privacy, and compliance with applicable laws and regulations.<\/p>\n<\/blockquote>\n\n\n\n

1. Initial information<\/h2>\n\n\n\n

The creation of this infrastructure has been done with Digital Ocean (the creation of the servers are not covered on this post). I\u2019ve created 4 VPS servers that have different purposes:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

1.1 Summary of the infrastructure<\/h3>\n\n\n\n

Since I want to learn how to deploy a fully operational red team infrastructure, I will deploy the following servers:<\/p>\n\n\n\n

Function<\/strong><\/th>Minimal Setup<\/strong><\/th><\/tr><\/thead>
C2 Server (Havoc)<\/td>1 VPS<\/td><\/tr>
Phishing Server\/payloads<\/td>1 VPS<\/td><\/tr>
Redirector for C2<\/td>1 VPS<\/td><\/tr>
Redirector for Phishing\/payloads<\/td>1 VPS<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The perfect scenario would be 6 even 8. Something like this:<\/p>\n\n\n\n

Function<\/strong><\/th>Minimal Setup<\/strong><\/th><\/tr><\/thead>
C2 Server (Havoc)<\/td>1 VPS<\/td><\/tr>
Phishing Server<\/td>1 VPS<\/td><\/tr>
Payload Server<\/td>1 VPS<\/td><\/tr>
Long term C2 Server<\/td>1 VPS<\/td><\/tr>
Redirector for C2<\/td>1 VPS<\/td><\/tr>
Redirector for Phishing\/payloads<\/td>1 VPS<\/td><\/tr>
Redirector for Payload Server<\/td>1 VPS<\/td><\/tr>
Redirector for long term C2 Server<\/td>1 VPS<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

1.2 Detailed infrastructure information<\/h3>\n\n\n\n

The physical requirements are the following:<\/p>\n\n\n\n

Name<\/strong><\/th>Role<\/strong><\/th>IP<\/th>CPU<\/strong><\/th>RAM<\/strong><\/th>Storage<\/strong><\/th>OS<\/strong><\/th>Notes<\/strong><\/th><\/tr><\/thead>
c2 server<\/td>C2 Server<\/strong><\/td>x<\/td>2 vCPUs<\/td>2 GB<\/td>20-40 GB<\/td>Ubuntu 22.04 LTS<\/td>Upgrade to 4 vCPUs\/4 GB RAM for >50 targets.<\/td><\/tr>
phishing server<\/td>Phishing Server<\/strong><\/td>x<\/td>1 vCPU<\/td>1 GB<\/td>25 GB<\/td>Ubuntu 22.04 LTS<\/td>CDN recommended for large file payloads.<\/td><\/tr>
Redirector for C2<\/td>Redirector for C2<\/strong><\/td>x<\/td>1 vCPU<\/td>1 GB<\/td>25 GB<\/td>Ubuntu 22.04 LTS<\/td>High-speed network connection is critical.<\/td><\/tr>
Redirector for phishing<\/td>Redirector for phishing<\/strong><\/td>x<\/td>1 vCPU<\/td>1 GB<\/td>25 GB<\/td>Ubuntu 22.04 LTS<\/td>High-speed network connection is critical.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

1.3 Selection of domain<\/h3>\n\n\n\n

For this part I will recommend you at least 2 domains one for the phishing phase and the other one for the C2 traffic:<\/p>\n\n\n\n

Domain<\/th>Provider<\/th><\/tr><\/thead>
soft.example.com<\/td>Your preference<\/td><\/tr>
mail.example.com<\/td>Your preference<\/td><\/tr>
health.c2traffic.com<\/td>Your preference<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

1.4 Final red team infrastructure<\/h3>\n\n\n\n

The final diagram about what we are going to have:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

2. Initial set up for the servers<\/h2>\n\n\n\n

2.1 Update the servers<\/h3>\n\n\n\n

Initial update after the installation:<\/p>\n\n\n\n

apt -y install update<\/code><\/pre>\n\n\n\n
apt -y upgrade<\/code><\/pre>\n\n\n\n
2.2 Installation of Havoc into the C2 Server – VPS1<\/h3>\n\n\n\n
For the people that does not know what is Havoc C2, you can find great information on Havoc’s github<\/a> or from the Havoc’s documentation<\/a>.  Also, I recommend the blog of my buddy “P4P1”<\/a>, where he has very good reviews and walk-through posts.<\/p>\n\n\n\n
The first step before installing havoc is establish a good firewall rules.<\/p>\n\n\n\n
2.2.1 Firewall configuration<\/h4>\n\n\n\n
The default policy it will be drop. We will configure our firewall to be sure that we just accept the traffic that we want:<\/p>\n\n\n\n
#!\/bin\/bash\n\n# Flush existing rules\niptables -F\niptables -X\n\n# Default policy: DROP\niptables -P INPUT DROP\niptables -P FORWARD DROP\niptables -P OUTPUT DROP\n\n# Allow loopback traffic\niptables -A INPUT -i lo -j ACCEPT\niptables -A OUTPUT -o lo -j ACCEPT\n\n# Allow outbound DNS (UDP and TCP to port 53)\niptables -A OUTPUT -p udp --dport 53 -j ACCEPT\niptables -A OUTPUT -p tcp --dport 53 -j ACCEPT\niptables -A INPUT -p udp --sport 53 -j ACCEPT\niptables -A INPUT -p tcp --sport 53 -j ACCEPT\n\n# Allow outbound HTTP and HTTPS\niptables -A OUTPUT -p tcp --dport 80 -j ACCEPT\niptables -A OUTPUT -p tcp --dport 443 -j ACCEPT\niptables -A INPUT -p tcp --sport 80 -j ACCEPT\niptables -A INPUT -p tcp --sport 443 -j ACCEPT\n\n# Allow ICMP outbound (ping)\niptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT\niptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT\n\n# Allow SSH\niptables -A INPUT -p tcp --dport 22 -j ACCEPT\niptables -A OUTPUT -p tcp --sport 22 -j ACCEPT\n\n# Incoming\n\n# Allow ICMP incoming (ping)\niptables -A INPUT -p icmp -s <ip-redirector-server> -j ACCEPT\niptables -A OUTPUT -p icmp -d <ip-redirector-server> -j ACCEPT\n\n# Allow incoming HTTPS traffic\niptables -A INPUT -p tcp --dport 443 -s <ip-redirector-server> -j ACCEPT\n\n# Allow related and established connections\niptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\niptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n\n# Save rules\niptables-save > \/etc\/iptables\/rules.v4\niptables-restore < \/etc\/iptables\/rules.v4\nnetfilter-persistent save<\/code><\/pre>\n\n\n\n
2.2.2 Havoc Installation<\/h4>\n\n\n\n
Install requirements:<\/p>\n\n\n\n
sudo apt install -y git build-essential apt-utils cmake libfontconfig1 libglu1-mesa-dev libgtest-dev libspdlog-dev libboost-all-dev libncurses5-dev libgdbm-dev libssl-dev libreadline-dev libffi-dev libsqlite3-dev libbz2-dev mesa-common-dev qtbase5-dev qtchooser qt5-qmake qtbase5-dev-tools libqt5websockets5 libqt5websockets5-dev qtdeclarative5-dev golang-go qtbase5-dev libqt5websockets5-dev python3-dev libboost-all-dev mingw-w64 nasm<\/code><\/pre>\n\n\n\n
Update go:<\/p>\n\n\n\n
apt-get update\nwget <https:\/\/go.dev\/dl\/go1.21.0.linux-amd64.tar.gz>\ntar -xvf go1.21.0.linux-amd64.tar.gz\nmv go \/usr\/local\nexport GOROOT=\/usr\/local\/go\nexport GOPATH=$HOME\/go\nexport PATH=$GOPATH\/bin:$GOROOT\/bin:$PATH\nsource ~\/.profile<\/code><\/pre>\n\n\n\n
Clone the repository:<\/p>\n\n\n\n
git clone https:\/\/github.com\/HavocFramework\/Havoc.git<\/code><\/pre>\n\n\n\n
Install go dependencies:<\/p>\n\n\n\n
cd Havoc\/teamserver\ngo mod download golang.org\/x\/sys\ngo mod download github.com\/ugorji\/go<\/code><\/pre>\n\n\n\n
Fom root directory of havoc compile the server:<\/p>\n\n\n\n
make ts-build<\/code><\/pre>\n\n\n\n
Execute the server:<\/p>\n\n\n\n
.\/havoc server --profile .\/profiles\/havoc.yaotl -v --debug &<\/code><\/pre>\n\n\n\n
Expose Havoc port locally through SSH tunnel:<\/p>\n\n\n\n
ssh -N -L 0.0.0.0:40056:127.0.0.1:40056 root@167.71.14.172<\/code><\/pre>\n\n\n\n
Connect with havoc client:<\/p>\n\n\n\n
.\/havoc client<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
2.3 Installation of GoPhish for phishing – VPS2<\/h3>\n\n\n\n
I decided to install GoPhish because is very simple to use with a friendly user interface. If you want to know more about it, you can check information on GoPhish’s github<\/a> or on GoPhish’s documentation<\/a>.<\/p>\n\n\n\n
2.3.1 Firewall rules<\/h4>\n\n\n\n
As we did with the C2 Server, we will deploy a strict firewall rules:<\/p>\n\n\n\n
#!\/bin\/bash\n\n# Flush existing rules\niptables -F\niptables -X\n\n# Default policy: DROP\niptables -P INPUT DROP\niptables -P FORWARD DROP\niptables -P OUTPUT DROP\n\n# Enable log\n#iptables -A INPUT -j LOG --log-prefix \"IPTables-Dropped: \" --log-level 4\n\n# Allow loopback traffic\niptables -A INPUT -i lo -j ACCEPT\niptables -A OUTPUT -o lo -j ACCEPT\n\n# Allow outbound DNS (UDP and TCP to port 53)\niptables -A OUTPUT -p udp --dport 53 -j ACCEPT\niptables -A OUTPUT -p tcp --dport 53 -j ACCEPT\niptables -A INPUT -p udp --sport 53 -j ACCEPT\niptables -A INPUT -p tcp --sport 53 -j ACCEPT\n\n# Allow outbound HTTP and HTTPS\niptables -A OUTPUT -p tcp --dport 80 -j ACCEPT\niptables -A OUTPUT -p tcp --dport 443 -j ACCEPT\niptables -A INPUT -p tcp --sport 80 -j ACCEPT\niptables -A INPUT -p tcp --sport 443 -j ACCEPT\n\n# Allow ICMP outbound (ping)\niptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT\niptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT\n\n# Allow outbound SMTP on port 465 (SMTP over SSL)\niptables -A OUTPUT -p tcp --dport 465 -j ACCEPT\niptables -A INPUT -p tcp --sport 465 -j ACCEPT\n\n# Allow SSH\niptables -A INPUT -p tcp --dport 22 -j ACCEPT\niptables -A OUTPUT -p tcp --sport 22 -j ACCEPT\n\n# Incoming\n\n# Allow incoming HTTP traffic\niptables -A INPUT -p tcp --dport 80 -s <phishing-redirector-ip> -j ACCEPT\n\n# Allow related and established connections\niptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\niptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n\n# Save rules\niptables-save > \/etc\/iptables\/rules.v4\niptables-restore < \/etc\/iptables\/rules.v4\nnetfilter-persistent save<\/code><\/pre>\n\n\n\n
2.3.2 SMTP Inbox account creation in our provider<\/h4>\n\n\n\n
The first thing we will do is creating some email accounts into the provider where we bought out domains. We are gonna use the provider’s email servers to send the email doing the authentication with that user:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
2.3.3 Installation of GoPhish<\/h4>\n\n\n\n
To be able to install GoPhish we will need to install in the server golang-go:<\/p>\n\n\n\n
apt -y install golang-go<\/code><\/pre>\n\n\n\n
Download GoPhish:<\/p>\n\n\n\n
wget <https:\/\/github.com\/gophish\/gophish\/releases\/download\/v0.12.1\/gophish-v0.12.1-linux-64bit.zip><\/code><\/pre>\n\n\n\n
Create GoPhish directory:<\/p>\n\n\n\n
mkdir GoPish<\/code><\/pre>\n\n\n\n
Unzip GoPhish inside the directory:<\/p>\n\n\n\n
unzip gophish-v0.12.1-linux-64bit.zip<\/code><\/pre>\n\n\n\n
Inside of GoPhish add executable rights to the binary gopish:<\/p>\n\n\n\n
chmod +x gophish<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Since, GoPhish runs as script, we will need to create it as service to be able to run it as a service. First, we will create the following folder:<\/p>\n\n\n\n
mkdir \/var\/log\/gophish<\/code><\/pre>\n\n\n\n
Create the following script inside \/etc\/systemd\/system\/gophish.service:<\/p>\n\n\n\n
[Unit]\nDescription=GoPhish Service\nAfter=network.target\n\n[Service]\nExecStart=\/root\/GoPhish\/gophish\nType=simple\nUser=root\nWorkingDirectory=\/root\/GoPhish\nRestart=always\nPIDFile=\/var\/run\/gophish.pid\n\n[Install]\nWantedBy=multi-user.target<\/code><\/pre>\n\n\n\n
Make it executable:<\/p>\n\n\n\n
chmod +x gophish<\/code><\/pre>\n\n\n\n
Reload systemd:<\/p>\n\n\n\n
sudo systemctl daemon-reload<\/code><\/pre>\n\n\n\n
Add the script in the system:<\/p>\n\n\n\n
sudo systemctl enable gophish<\/code><\/pre>\n\n\n\n
Start the service:<\/p>\n\n\n\n
systemctl start gophish<\/code><\/pre>\n\n\n\n
Create the tunnel to be able to access the platform:<\/p>\n\n\n\n
ssh -N -L 0.0.0.0:3333:127.0.0.1:3333 root@134.122.121.230<\/code><\/pre>\n\n\n\n
Get access with the credentials configured:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Once inside, we will create a profile to be able to send emails pointing to our relay server that we will configure on the next point:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
2.4 C2 redirector deployment – VPS3<\/h3>\n\n\n\n
The functionality of this server will be basically to hide the real C2 server IP. The communications are going to be through this server and always encrypted.<\/p>\n\n\n\n
2.4.1 Firewall rules<\/h4>\n\n\n\n
As we have done with the rest of server, we will set up a strict firewall rules to just accept the traffic between the servers:<\/p>\n\n\n\n
#!\/bin\/bash\n\n# Flush existing rules\niptables -F\niptables -X\n\n# Default policy: DROP\niptables -P INPUT DROP\niptables -P FORWARD DROP\niptables -P OUTPUT DROP\n\n# Allow loopback traffic\niptables -A INPUT -i lo -j ACCEPT\niptables -A OUTPUT -o lo -j ACCEPT\n\n# Allow outbound DNS (UDP and TCP to port 53)\niptables -A OUTPUT -p udp --dport 53 -j ACCEPT\niptables -A OUTPUT -p tcp --dport 53 -j ACCEPT\niptables -A INPUT -p udp --sport 53 -j ACCEPT\niptables -A INPUT -p tcp --sport 53 -j ACCEPT\n\n# Allow outbound HTTP and HTTPS\niptables -A OUTPUT -p tcp --dport 80 -j ACCEPT\niptables -A OUTPUT -p tcp --dport 443 -j ACCEPT\niptables -A INPUT -p tcp --sport 80 -j ACCEPT\niptables -A INPUT -p tcp --sport 443 -j ACCEPT\n\n# Allow SSH\niptables -A INPUT -p tcp --dport 22 -j ACCEPT\niptables -A OUTPUT -p tcp --sport 22 -j ACCEPT\n\n# Allow Incoming traffic\n\n# Allow ICMP incoming (ping)\niptables -A INPUT -p icmp -j ACCEPT\niptables -A OUTPUT -p icmp -j ACCEPT\n\n# Allow incoming HTTPS traffic\niptables -A INPUT -p tcp --dport 443 -j ACCEPT\n\n# Allow incoming HTTP traffic\niptables -A INPUT -p tcp --dport 80 -j ACCEPT\n\n# Allow related and established connections\niptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\niptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n\n# Save rules\niptables-save > \/etc\/iptables\/rules.v4\niptables-restore < \/etc\/iptables\/rules.v4\nnetfilter-persistent save<\/code><\/pre>\n\n\n\n
2.4.2 Creating domains for the C2 traffic<\/h4>\n\n\n\n
In your domain provider you will create one A register and CNAME:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
2.4.3 NGINX as Proxy Server to redirect the HTTP\/S traffic to our C2 Server<\/h4>\n\n\n\n
We will use nginx as proxy server. Installation of nginx:<\/p>\n\n\n\n
apt install nginx<\/code><\/pre>\n\n\n\n
Enable nginx:<\/p>\n\n\n\n
systemctl enable nginx<\/code><\/pre>\n\n\n\n
Start nginx:<\/p>\n\n\n\n
systemctl start nginx<\/code><\/pre>\n\n\n\n
Create file config for the domain:<\/p>\n\n\n\n
nano \/etc\/nginx\/sites-available\/health.c2traffic.es<\/code><\/pre>\n\n\n\n
Configuration:<\/p>\n\n\n\n
server {\n    listen 80;\n    listen [::]:80;\n\n    server_name health.c2traffic.es www.health.c2traffic.es;\n\n    location \/ {\n        proxy_pass https:\/\/c2-server-ip\/;\n        include proxy_params;\n    }\n}<\/code><\/pre>\n\n\n\n
Make available the configuration;<\/p>\n\n\n\n
sudo ln -s \/etc\/nginx\/sites-available\/health.c2traffic.es \/etc\/nginx\/sites-enabled\/<\/code><\/pre>\n\n\n\n
Install certbot:<\/p>\n\n\n\n
snap install --classic certbot<\/code><\/pre>\n\n\n\n
Sync certbot to the system:<\/p>\n\n\n\n
ln -s \/snap\/bin\/certbot \/usr\/bin\/certbot<\/code><\/pre>\n\n\n\n
Generate certificates with let’s encrypt:<\/p>\n\n\n\n
certbot --nginx -d health.c2traffic.es -d www.health.c2traffic.es -v<\/code><\/pre>\n\n\n\n
Final nginx configuration with HTTPS:<\/p>\n\n\n\n
server {\n    # Redirect all HTTP traffic to HTTPS\n    listen 80;\n    listen [::]:80;\n    server_name health.c2traffic.es www.health.c2traffic.es;\n\n    return 301 https:\/\/$host$request_uri;\n}\n\nserver {\n    # Listen for HTTPS traffic\n    listen 443 ssl;\n    listen [::]:443 ssl;\n\n    server_name health.c2traffic.es www.health.c2traffic.es;\n\n    # SSL Certificates (managed by Certbot)\n    ssl_certificate \/etc\/letsencrypt\/live\/health.c2traffic.es\/fullchain.pem;\n    ssl_certificate_key \/etc\/letsencrypt\/live\/health.c2traffic.es\/privkey.pem;\n    include \/etc\/letsencrypt\/options-ssl-nginx.conf;\n    ssl_dhparam \/etc\/letsencrypt\/ssl-dhparams.pem;\n\n    # Proxy settings\n    location \/ {\n        proxy_pass https:\/\/167.71.14.172\/;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n\n        # Optional: Timeouts for the proxied server\n        proxy_read_timeout 90;\n        proxy_connect_timeout 90;\n        proxy_send_timeout 90;\n\n        # Optional: Security headers\n        add_header X-Content-Type-Options nosniff;\n        add_header X-Frame-Options SAMEORIGIN;\n        add_header X-XSS-Protection \"1; mode=block\";\n    }\n\n    # Optional: Custom error pages (e.g., for 404 or 50x errors)\n    error_page 404 \/404.html;\n    location = \/404.html {\n        internal;\n    }\n    error_page 500 502 503 504 \/50x.html;\n    location = \/50x.html {\n        internal;\n    }\n}<\/code><\/pre>\n\n\n\n
Enable auto renew:<\/p>\n\n\n\n
systemctl start snap.certbot.renew.service<\/code><\/pre>\n\n\n\n
2.5 Relay Server with postfix -VPS4<\/h3>\n\n\n\n
This server will be responsible of the emails and responsible of hide the phishing server behind the relay server’s IP.<\/p>\n\n\n\n
2.5.1 Firewall rules<\/h4>\n\n\n\n
As we did before, we are going to implement strict rules:<\/p>\n\n\n\n
#!\/bin\/bash\n\n# Flush existing rules\niptables -F\niptables -X\n\n# Default policy: DROP\niptables -P INPUT DROP\niptables -P FORWARD DROP\niptables -P OUTPUT DROP\n\n# Enable log\n#iptables -A INPUT -j LOG --log-prefix \"IPTables-Dropped: \" --log-level 4\n\n# Allow loopback traffic\niptables -A INPUT -i lo -j ACCEPT\niptables -A OUTPUT -o lo -j ACCEPT\n\n# Outbound\n\n# Allow outbound DNS (UDP and TCP to port 53)\niptables -A OUTPUT -p udp --dport 53 -j ACCEPT\niptables -A OUTPUT -p tcp --dport 53 -j ACCEPT\niptables -A INPUT -p udp --sport 53 -j ACCEPT\niptables -A INPUT -p tcp --sport 53 -j ACCEPT\n\n# Allow outbound HTTP and HTTPS\niptables -A OUTPUT -p tcp --dport 80 -j ACCEPT\niptables -A OUTPUT -p tcp --dport 443 -j ACCEPT\niptables -A INPUT -p tcp --sport 80 -j ACCEPT\niptables -A INPUT -p tcp --sport 443 -j ACCEPT\n\n# Allow outbound SMTP connections to any IP on port 465\niptables -A OUTPUT -p tcp --dport 465 -j ACCEPT\n\n# Allow outbound SMTP on port 587 (modern SMTP submission)\niptables -A OUTPUT -p tcp --dport 587 -j ACCEPT\niptables -A INPUT -p tcp --sport 587 -j ACCEPT\n\n# Allow ICMP outbound (ping)\niptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT\niptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT\n\n# Allow SSH\niptables -A INPUT -p tcp --dport 22 -j ACCEPT\niptables -A OUTPUT -p tcp --sport 22 -j ACCEPT\n\n# Incoming\n\n# Allow incoming SMTP traffic on port 465 from the trusted IP\niptables -A INPUT -p tcp --dport 465 -s <phishing-server-ip> -j ACCEPT\n\n# Allow incoming HTTPS traffic\niptables -A INPUT -p tcp --dport 443 -j ACCEPT\n\n# Allow incoming HTTP traffic\niptables -A INPUT -p tcp --dport 80 -j ACCEPT\n\n# Allow related and established connections\niptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\niptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n\n# Save rules\niptables-save > \/etc\/iptables\/rules.v4\niptables-restore < \/etc\/iptables\/rules.v4\nnetfilter-persistent save<\/code><\/pre>\n\n\n\n
2.5.2 Postfix Relay Configuration<\/h4>\n\n\n\n
Install postfix:<\/p>\n\n\n\n
sudo apt -y install postfix<\/code><\/pre>\n\n\n\n
Choose internet site:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Set up your domain, the one are you going to use for the phishing emails:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Configure the DNS:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Configure SPF, DKIM and DMARC:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Inside \/etc\/postfix\/master.cf we will configure the server to listen on 465,so, we will need to uncomment the following lines because most of the provider don’t allow access throuth the ports 25:<\/p>\n\n\n\n
smtps     inet  n       -       y       -       -       smtpd\n  -o syslog_name=postfix\/smtps\n  -o smtpd_tls_wrappermode=yes\n  -o smtpd_sasl_auth_enable=yes\n#  -o smtpd_reject_unlisted_recipient=no\n#  -o smtpd_client_restrictions=$mua_client_restrictions\n#  -o smtpd_helo_restrictions=$mua_helo_restrictions\n#  -o smtpd_sender_restrictions=$mua_sender_restrictions\n#  -o smtpd_recipient_restrictions=\n  -o smtpd_relay_restrictions=permit_mynetworks,permit_sasl_authenticated,defer_unauth_destination<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Inside \/etc\/postfix\/main.cf we will configure our smtp relay:<\/p>\n\n\n\n
# See \/usr\/share\/postfix\/main.cf.dist for a commented, more complete version\n\n# Debian specific:  Specifying a file name will cause the first\n# line of that file to be used as the name.  The Debian default\n# is \/etc\/mailname.\n#myorigin = \/etc\/mailname\n\nsmtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)\nbiff = no\n\n# Uncomment the next line to generate \"delayed mail\" warnings\n#delay_warning_time = 4h\n\nreadme_directory = no\n\n# See <http:\/\/www.postfix.org\/COMPATIBILITY_README.html> -- default to 3.6 on\n# fresh installs.\ncompatibility_level = 3.6\n\n# TLS parameters\nsmtpd_tls_cert_file=\/etc\/ssl\/certs\/ssl-cert-snakeoil.pem\nsmtpd_tls_key_file=\/etc\/ssl\/private\/ssl-cert-snakeoil.key\nsmtpd_tls_security_level=may\n\nsmtp_tls_CApath=\/etc\/ssl\/certs\nsmtp_tls_session_cache_database = btree:${data_directory}\/smtp_scache\n\nsmtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination\nmyhostname = ubuntu-rd-smtp\nalias_maps = hash:\/etc\/aliases\nalias_database = hash:\/etc\/aliases\nmyorigin = \/etc\/mailname\n\n# Modified to authenticate\nmydestination = $myhostname, mail.phishing.domain, phishing.domain, hostname,<\/strong> localhost.localdomain, localhost\n\n# Relayhost configuration\nrelayhost = [provider.smtp.server<\/strong>]:587\n\n# Enable TLS encryption\nsmtp_tls_security_level = encrypt\nsmtp_tls_protocols = !SSLv2, !SSLv3\nsmtp_tls_mandatory_protocols = !SSLv2, !SSLv3\n\n# Use the CA certificate bundle to verify the relay server's certificate\nsmtp_tls_CAfile = \/etc\/ssl\/certs\/ca-certificates.crt\n\n# Authentication settings (if needed by your relay)\nsmtp_sasl_auth_enable = yes\nsmtp_sasl_password_maps = hash:\/etc\/postfix\/sasl_passwd\nsmtp_sasl_security_options = noanonymous\nsmtp_sasl_mechanism_filter = plain, login\n\n# Remove unwanted headers\nsmtp_header_checks = regexp:\/etc\/postfix\/smtp_header_checks\n\nmasquerade_domains = phishing.domain<\/strong>\nremote_header_rewrite_domain = phishing.domain<\/strong>\nappend_dot_mydomain = yes\n\nmynetworks = 127.0.0.0\/8 [::ffff:127.0.0.0]\/104 [::1]\/128 your-public-ips<\/strong>\nmailbox_size_limit = 0\nrecipient_delimiter = +\ninet_interfaces = all\ninet_protocols = all\ninet_protocols = all<\/code><\/pre>\n\n\n\n
Create file with credentials \/etc\/postfix\/sasl_passwd:<\/p>\n\n\n\n
[smtp-provider-server]:587 support@phishing.domain:password<\/code><\/pre>\n\n\n\n
Change the permissions and create a hash database:<\/p>\n\n\n\n
chmod 600 \/etc\/postfix\/sasl_passwd<\/code><\/pre>\n\n\n\n
postmap \/etc\/postfix\/sasl_passwd<\/code><\/pre>\n\n\n\n
Create file to delete the headers \u201csmtp_header_checks\u201d:<\/p>\n\n\n\n
\/^Received:.*\/              IGNORE\n\/^X-Originating-IP:\/    IGNORE\n\/^X-Mailer:\/            IGNORE\n\/^Mime-Version:\/        IGNORE<\/code><\/pre>\n\n\n\n
Compile the headers rule:<\/p>\n\n\n\n
sudo postmap \/etc\/postfix\/smtp_header_checks<\/code><\/pre>\n\n\n\n
Include the checks into master.cf:<\/p>\n\n\n\n
-o header_checks=regexp:\/etc\/postfix\/smtp_header_checks<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Restart the service:<\/p>\n\n\n\n
systemctl restart postfix<\/code><\/pre>\n\n\n\n
Test send emails:<\/p>\n\n\n\n
echo \"Test email\" | mail -s \"Test Subject\" -r \"support <support@phishing.domain>\" your-email@gmail.com<\/code><\/pre>\n\n\n\n
2.5.3 Nginx Proxy Server to redirect the phishing traffic<\/h4>\n\n\n\n
Install nginx:<\/p>\n\n\n\n
apt install nginx<\/code><\/pre>\n\n\n\n
Enable nginx:<\/p>\n\n\n\n
systemctl enable nginx<\/code><\/pre>\n\n\n\n
Start nginx:<\/p>\n\n\n\n
systemctl start nginx<\/code><\/pre>\n\n\n\n
Create file config for the domain:<\/p>\n\n\n\n
nano \/etc\/nginx\/sites-available\/phishing.domain<\/strong><\/code><\/pre>\n\n\n\n
Configuration:<\/p>\n\n\n\n
server {\n    listen 80;\n    listen [::]:80;\n\n    server_name phishing.domain<\/strong> www.phishing.domain<\/strong>;\n\n    location \/ {\n        proxy_pass http:\/\/ip-phishing-server<\/strong>\/;\n        include proxy_params;\n    }\n}<\/code><\/pre>\n\n\n\n
Make available the configuration;<\/p>\n\n\n\n
sudo ln -s \/etc\/nginx\/sites-available\/phishing.domain<\/strong> \/etc\/nginx\/sites-enabled\/<\/code><\/pre>\n\n\n\n
Install certbot:<\/p>\n\n\n\n
snap install --classic certbot<\/code><\/pre>\n\n\n\n
Sync certbot to the system:<\/p>\n\n\n\n
ln -s \/snap\/bin\/certbot \/usr\/bin\/certbot<\/code><\/pre>\n\n\n\n
Generate certificates:<\/p>\n\n\n\n
certbot --nginx -d phishing.domain<\/strong> -d www.phishing.domain<\/strong><\/code><\/pre>\n\n\n\n
Final nginx configuration:<\/p>\n\n\n\n
server {\n    # Redirect all HTTP traffic to HTTPS\n    listen 80;\n    listen [::]:80;\n    server_name phishing.domain<\/strong> www.phishing.domain<\/strong>;\n\n    return 301 https:\/\/$host$request_uri;\n}\n\nserver {\n    # Listen for HTTPS traffic\n    listen 443 ssl;\n    listen [::]:443 ssl;\n\n    server_name phishing.domain<\/strong> www.phishing.domain<\/strong>;\n\n    # SSL Certificates (managed by Certbot)\n    ssl_certificate \/etc\/letsencrypt\/live\/phishing.domain<\/strong>\/fullchain.pem;\n    ssl_certificate_key \/etc\/letsencrypt\/live\/phishing.domain<\/strong>\/privkey.pem;\n    include \/etc\/letsencrypt\/options-ssl-nginx.conf;\n    ssl_dhparam \/etc\/letsencrypt\/ssl-dhparams.pem;\n\n    # Proxy settings for all other paths\n    location \/ {\n        proxy_pass http:\/\/phishing-server-ip<\/strong>\/;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n\n        # Optional: Timeouts for the proxied server\n        proxy_read_timeout 90;\n        proxy_connect_timeout 90;\n        proxy_send_timeout 90;\n\n        # Optional: Security headers\n        add_header X-Content-Type-Options nosniff;\n        add_header X-Frame-Options SAMEORIGIN;\n        add_header X-XSS-Protection \"1; mode=block\";\n    }\n\n    # Serve local files for \/download\/ to deliver the C2 payloads\n    location \/download\/ {\n        root \/var\/www\/html\/;\n        autoindex on;                       # Optional: Enable directory listing\n        autoindex_exact_size off;           # Optional: Human-readable file sizes\n        autoindex_format html;              # Optional: HTML format for listing\n    }\n\n    # Optional: Custom error pages (e.g., for 404 or 50x errors)\n    error_page 404 \/404.html;\n    location = \/404.html {\n        internal;\n    }\n    error_page 500 502 503 504 \/50x.html;\n    location = \/50x.html {\n        internal;\n    }\n}<\/code><\/pre>\n\n\n\n
Enable auto renew:<\/p>\n\n\n\n
systemctl start snap.certbot.renew.service<\/code><\/pre>\n\n\n\n
3. SSH Fail2Ban for ALL the servers<\/h2>\n\n\n\n
Install Fail2Ban:<\/p>\n\n\n\n
apt -y install fail2ban<\/code><\/pre>\n\n\n\n
Enable the service:<\/p>\n\n\n\n
systemctl enable fail2ban<\/code><\/pre>\n\n\n\n
Start the service:<\/p>\n\n\n\n
systemctl start fail2ban<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Start new configuration copying the conf file:<\/p>\n\n\n\n
cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local<\/code><\/pre>\n\n\n\n
Edit the configuration file:<\/p>\n\n\n\n
nano \/etc\/fail2ban\/jail.local\n<\/code><\/pre>\n\n\n\n
Modify the following values:<\/p>\n\n\n\n
bantime  = 1d\nfindtime  = 10m\nmaxretry = 3<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
In case that your are using IPTABLES as firewall, then, the following configuration should be pointing iptables:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Then, we will enable the protection for the SSH service:<\/p>\n\n\n\n
enabled = true<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Restart the service:<\/p>\n\n\n\n
systemctl restart fail2ban<\/code><\/pre>\n\n\n\n
After sometime check the IPs banned:<\/p>\n\n\n\n
fail2ban-client get sshd ignoreip<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
4. Proof of Concept<\/h2>\n\n\n\n
The proof of concept does not include how to avoid EDR or AV. We will focus on the delivery of the payload through phishing and how the infrastructure has been deployed. Also, we will see how to perform a phishing with GoPhish, where we will simulate two different scenarios where the user receives an email where he should introduce his credentials and other case is, basically, that the user need to download a critical update but in reality the Havoc agent to control the objective.<\/p>\n\n\n\n
During the process of this proof of concept we will check also the headers of the email and the traffic generated by our C2 agent to see that everything is encrypted.<\/p>\n\n\n\n
I hope you enjoy this PoC:<\/p>\n\n\n\n
\n