Exercise: Phishing on SneakyMailer
The Hack The Box machine SneakyMailer is running a number of services; FTP (port 21), SSH (port 22), SMTP (port 25), HTTP (port 80), IMAP (port 143), IMAP TLS (port 993), HTTP (port 8080). The main website on port 80 has a team member list from which names and email addresses can be harvested to create a candidate user list. Running Gobuster on the site reveals a PHP file register.php
a machine that simulates responding to a phishing attack to capture a user's credentials. Although we could use Gophish easily to achieve this, we will use another tool to send emails called SWAKS - Swiss Army Knife for SMTP (https://github.com/jetmore/swaks\) and we will host the landing page in code that we will write ourselves.
Running an nmap scan, we find a number of ports open: FTP (21), SSH (22), SMTP (25), HTTP (80), IMAP (143), IMAP TLS (993), HTTP (8080)
It seems the machine is running two websites and an email server supporting SMTP and IMAP. The FTP server does not support anonymous logon and so we can look at the main web server on port 80. Going to http://sneakymailer.htb, it redirects to the URL http://sneakycorp.htb and so we can add that name to the hosts file. Visiting that URL takes us to a landing page for SNEAKY CORP which is a Dashboard showing information about 2 projects, PyPi and POP3/SMTP.
.The Team page gives a list of team members with email addresses.
.We can grab all of the email addresses by using the command
This command fetches the team.php page using curl and then passes the output to the grep command using the pipe operator '|'. grep matches any line in the output that features the @ symbol of the email address. This gives us lines of text with some HTML around the email addresses and so we need to further refine the text using the cut command. Since the output from the grep is lines like
We can use cut to delimit (-d) based on the character of the '>' and select the second field that results, then get rid of the final HTML with a second cut command. The entire output consisting of just the emails can then be saved to a file emails.txt.
Note that you can also simply copy paste the text from the page into a spreadsheet or editor and manually then copy the emails.
We haven't finished our reconnaissance of the web site yet however and we will run gobuster on the site:
We get a number of directories, the most interesting of which is pypi. We can run a further gobuster on this directory:
Going to that page, we get an account registration page
Filling out details and clicking register account does not seem to do anything. No account is added to the emails in the team page and there is nowhere to actually login. Likewise, the Logout function on the home page does not do anything either.
Given we have found email addresses and a registration page and the fact that the machine has a mail server and is called SneakyMailer, we can guess that this may be suggesting that we could exploit a phishing attack.
At this point it would be relatively simple to use Gophish to set up a campaign, clone the registration web page and capture any responses. However, we will use a different tool to clone the web page called HTTrack. HTTrack is capable of copying an entire website, but we will use it to capture the registration page.
Create a directory called www and a subdirectory called templates. cd to the templates directory and run:
This will copy a number of files but we can copy the register.html page created from the path sneakycorp.htb/pypi/register.html to the current directory
We are now going to write a simple application to host this page, capture any data that is sent to it and then redirect to the real registration page. To do this we will use Python and Flask.
This code will start a web server listening on port 80 and any request received with the path /pypi/register.php will be handled by the method register(). If the HTTP request is a GET, then it will use the page we cloned; register.html as a template and return that. If it is a POST request, the application will print out the arguments and form data and then redirect to the real registration page.
To run the application, we just use
You can test the page by visiting http://127.0.0.1/pypi/register.php and submit the form. You should see the data being printed out and the page redirect to the sneakycorp.htb site.
Now that we have the landing page, we need to send the phishing emails using the email list we scraped from the Sneaky Corp site. To do that, we are going to use SWAKS as mentioned before. We can write a script to read through the emails in the emails.txt file and send a message containing the URL for the phishing landing page:
As this script runs, it will print out debugging information
And eventually we will get a hit on the landing page:
The user Paul Byrd with email address [email protected] and password ^(#J@SkFv2[%KhIxKk(Ju`hqcHl<:Ht responded to the phishing email.
These credentials don't work with FTP or SSH but we can use them to connect to the mail server and read emails.
Configure the mail settings as shown here:
You may get an error regarding an error regarding a certificate but you can ignore that. In the Sent Items folder, there are two emails. The first is regards to a password reset request
The second email is about module testing.
From the first email, we have a username and password for developer and logging into FTP, we see that these credentials work. After logging in, we can see that there is a dev folder with the contents of what looks like the website in it.
We can try writing to the directory by using a put command. It turns out that we can upload files to the dev directory but when looking at the website, they are not there. One thing we haven't checked is if there are any virtual hosts. Virtual hosts are ways of creating different websites pointing at different directory paths simply by changing the host name in the HTTP request. We can use gobuster to see if there are any virtual hosts for the domain sneakycorp.htb and indeed we find that there is a virtual host dev.sneakycorp.htb:
We can upload a PHP reverse shell that we copy from /usr/share/webshells/php/php-reverse-shell.php. We can change the IP address and port in the file and start a netcat listener on that port. In ftp we simply cd to the dev directory and do a put of the file.
Calling the file from http://dev.sneakycorp.htb/revshell.php will get a reverse shell on our listener:
We can then upgrade the shell using
Last updated
Was this helpful?