[The Social-Engineer Toolkit (SET) v4.7
Facunda Ganesh
The Social-Engineer Toolkit (SET) is specifically designed to perform advanced attacks against the human element. SET was designed to be released with the -engineer.org launch and has quickly became a standard tool in a penetration testers arsenal. SET was written by David Kennedy (ReL1K) and with a lot of help from the community it has incorporated attacks never before seen in an exploitation toolset. The attacks built into the toolkit are designed to be targeted and focused attacks against a person or organization used during a penetration test.
The brain behind SET is the configuration file. SET by default works perfect for most people however, advanced customization may be needed in order to ensure that the attack vectors go off without a hitch. First thing to do is ensure that you have updated SET, from the directory:
Looking through the configuration options, you can change specific fields to get a desired result. In the first option, you can change the path of where the location of Metasploit is. Metasploit is used for the payload creations, file format bugs, and for the browser exploit sections.
When setting the WEBATTACK_EMAIL to ON, it will allow you to send mass emails to the victim while utilizing the Web Attack vector. Traditionally the emailing aspect is only available through the spear-phishing menu however when this is enabled it will add additional functionality for you to be able to email victims with links to help better your attacks.
The web server utilized within SET is a custom-coded web server that at times can be somewhat slow based off of the needs. If you find that you need a boost and want to utilize Apache, you can flip this switch to ON and it will use Apache to handle the web requests and speed your attack up. Note that this attack only works with the Java Applet and Metasploit based attacks. Based on the interception of credentials, Apache cannot be used with the web jacking, tabnabbing, or credential harvester attack methods.
The AUTO_MIGRATE feature will automatically migrate to notepad.exe when a meterpreter shell is spawned. This is especially useful when using browser exploits as it will terminate the session if the browser is closed when using an exploit.
The digital signature stealing method requires the python module called PEFILE which uses a technique used in Disitool by Didier Stevens by taking the digital certificate signed by Microsoft and importing it into a malicious executable. A lot of times this will give better anti-virus detection.
In addition to digital signature stealing, you can do additional packing by using UPX. This is installed by default on BackTrack linux, if this is set to ON and it does not find it, it will still continue but disable the UPX packing.
The next options can configure once a meterpreter session has been established, what types of commands to automatically run. This would be useful if your getting multiple shells and want to execute specific commands to extract information on the system.
This will automatically embed a UNC path into the web application, when the victim connects to your site, it will try connecting to the server via a file share. When that occurs a challenge response happens and the challenge/responses can be captured and used for attacking.
There are two options, one is getting your feet wet and letting SET do everything for you (option 1), the second is to create your own FileFormat payload and use it in your own attack. Either way, good luck and enjoy
The spear-phishing attack menu is used for performing targeted email attacks against a victim. You can send multiple emails based on what your harvested or you can send it to individuals. You can also utilize fileformat (for example a PDF bug) and send the malicious attack to the victim in order to hopefully compromise the system.
The web jacking attack method was introduced by white_sheep, Emgent and the BackTrack team. This method utilizes iframe replacements to make the highlighted URL link to appear legitimate however when clicked a window pops up then is replaced with the malicious link. You can edit the link replacement settings in the set_config if its to slow/fast.
The web attack vector is used by performing phishing attacks against the victim in hopes they click the link. There is a wide-variety of attacks that can occur once they click. We will dive into each one of the attacks later on.
The infectious USB/DVD creator will develop a Metasploit based payload for you and craft an autorun.inf file that once burned or placed on a USB will trigger an autorun feature and hopefully compromise the system. This attack vector is relatively simple in nature and relies on deploying the devices to the physical system.
The create payload and listener is an extremely simple wrapper around Metasploit to create a payload, export the exe for you and generate a listener. You would need to transfer the exe onto the victim machine and execute it in order for it to properly work.
The mass mailer attack will allow you to send multiple emails to victims and customize the messages. This option does not allow you to create payloads, so it is generally used to perform a mass phishing attack.
The teensy USB HID attack is a method used by purchasing a hardware based device from prjc.com and programming it in a manner that makes the small USB microcontroller to look and feel exactly like a keyboard. The important part with this is it bypasses autorun capabilities and can drop payloads onto the system through the onboard flash memory. The keyboard simulation allows you to type characters in a manner that can utilize downloaders and exploit the system.
As mentioned previously, the spear phishing attack vector can be used to send targeted emails with malicious attachments. In this example we are going to craft an attack, integrate into GMAIL and send a malicious PDF to the victim. One thing to note is you can create and save your own templates to use for future SE attacks or you can use pre-built ones. When using SET just to note that when hitting enter for defaults, it will always be port 443 as the reverse connection back and a reverse Meterpreter.
The spear-phishing attack can send to multiple people or individuals, it integrates into Google mail and can be completely customized based on your needs for the attack vector. Overall this is very effective for email spear-phishing.
The Multi-Attack method will add a combination of attacks through the web attack menu. For example you can utilize the Java Applet, Metasploit Browser, Credential Harvester/Tabnabbing, and the Man Left in the Middle attack all at once to see which is successful.
Also note that when your finished to hit CONTROL-C, and a report will be generated for you in two formats. The first is an html-based report; the other is xml if you need to parse the information into another tool.
The man left in the middle attack utilizes HTTP REFERERS on an already compromised site or XSS vulnerability to pass the credentials back to the HTTP server. In this instance if you find a XSS vulnerability and send the URL to the victim and they click, the website will operate 100 percent however when they go to log into the system, it will pass the credentials back to the attacker and harvest the credentials.
The web jacking attack method will create a website clone and present the victim with a link stating that the website has moved. This is a new feature to version 0.7.1. When you hover over the link, the URL will be presented with the real URL, not the attackers machine. So for example if your cloning gmail.com, the url when hovered over it would be gmail.com. When the user clicks the moved link, gmail opens and then is quickly replaced with your malicious webserver. Remember you can change the timing of the webjacking attack in the config/set_config flags.
Moving on to the physical attack vectors and a completely different attack method, we will be utilizing the Infectious USB/DVD/CD attack vector. This attack vector will allow you to import your own malicious executable or one of those within Metasploit to create a DVD/CD/USB that incorporates an autorun.inf file. Once this device is inserted it will call autorun and execute the executable. New in the most recent version, you can utilize file-format exploits as well, if your worried that an executable will trigger alerts, you can specify a file format exploit that will trigger an overflow and compromise the system (example an Adobe exploit).
Now that we have everything ready, SET exports a file called teensy.pde to the reports/ folder. Copy that reports folder to wherever you have Arduino installed. With this attack, follow the instructions at PRJC on how to upload your code to the Teensy board, its relatively simple you just need to install the Teensy Loader and the Teensy libraries. Once you do that you will have an IDE interface called Arduino. One of the MOST important aspects of this is to ensure you set your board to a Teensy USB Keyboard/Mouse.
Once you have this selected, drag your pde file into the Arduino interface. Arduino/Teensy supports Linux, OSX, and Windows. Insert your USB device into the computer and upload your code. This will program your device with the SET generated code. Below is uploading and the code.
Little hint here, this module is only the beginning to a whole new mobile attack platform for newer version of SET. The folks at TB-Security.com introduced the SMS spoofing module. This module will allow you to spoof your phone number and send an SMS. This would be beneficial in social-engineering attacks utilizing the Credential Harvester. More attacks to come on this.
SET has an attack vector called the wireless attack vector which will spawn an access point from a wireless interface card on your machine and leverage DNSSpoof to redirect victims browser requests to an attacker vector in SET. You could leverage this attack for example by creating the access point and then leveraging the Java Applet Attack Vector or the Multi-Attack Vector and when the victim was connected to the access point, went to a website, would then be at your attacker machine.
795a8134c1