In this demo,
we'll be reviewing our PoshC2 server configuration to ensure our
infrastructure is properly prepared for our attack.
We will then enumerate our target company to
identify potential assets to exploit,
and then leverage a spear phishing attacked again initial access against our
victim to place our PoshC2 implant onto a vulnerable system.
We will start on our Kali attack system,
which is a pre‑built VM provided by Offensive Security
available on their virtual image download page.
I have already installed PoshC2 onto the system using the installation
script and instructions available on the PoshC2 GitHub repo.
With our attack system ready,
let's go ahead and review our PoshC2 server configuration to ensure
we are properly prepped for our attack engagement.
From the termina,l we can run the built‑in Posh command posh‑config
‑‑nano to open our server config YAML file in nano.
Here we have a variety of options available to us in configuring PoshC2,
which can allow us to limit the ability of an adversary to detect our attack.
In order to ensure we have a working PoshC2 environment,
we'll need to configure a PayloadCommsHost address,
which will be the IP address of our attack system.
Configuring this field will enable both the Posh implant handler and the
implants residing on vulnerable systems to communicate.
Scrolling down,
one great feature you may want to consider tweaking is the Jitter rate.
PoshC2 leverages a beacon on the implant to enable
communication for our command and control activity.
This helps the activity remain stealth by leveraging the Jitter rate to
randomize the communication timing to a few seconds range rather than a
fixed timing to throw off potential networker host detection solutions
that might key off of a fixed pattern.
Another feature of the beacon,
which needs to be properly configured in order to run
a successful attack engagement, is the KillDate.
This must be set to a future day in time; otherwise,
the implants will not phone home to the PoshC2 server.
Now that we have our PoshC2 environment properly set up,
let's find a victim to use our C2 framework against.
We are going to be targeting the Globomantics corporation.
Let's first open up our web browser from the terminal by typing
firefox and navigate to the Globomantics website,
which is flobomantics.lan.
This will serve as a starting point to use publicly‑available
information provide on the Globomantics website to help us enumerate
our target and identify potential victims to attack.
To help identify a victim to target,
let's navigate to the Our story section of the website.
Scrolling down the page,
we see that Globomantics has provided information about their CEO.
This will make a great target for our attack.
Now let's navigate to our social media platform of choice to
gather further information on our victim.
Here we will see on the social media platform that the CEO is providing some of
his personal data related to his position at Globomantics.
We see that we're able to collect his Globomantics email address,
which we can use to target him with a spear phishing attack as a
vehicle for placing a PoshC2 implant on his system.
Now let's close our browser and prepare our spear phishing attack
with the information we have gathered from the company website and
the victim's public social media profile.
To craft and send our spear phishing attack,
we will use King Phisher, which comes preinstalled on Kali Linux.
From the terminal, we can type /usr/share/king‑phisher/KingPhisher,
and press Enter.
As the King Phisher client opens,
we'll be prompted to enter credentials to access the
database of the King Phisher server.
Both client and server are residing on our Kali Linux system,
so we can keep the server connection set to localhost.
We enter our Kali user credentials with a username
of kali and a password of kali, and click Connect.
I have already configured a King Phisher campaign and an SMTP
server for us to use in our initial access attack.
However,
let's scroll down to the target information and add the email address
of ceo@globomantics.lan for the Globomantics CEO,
which we found during our enumeration of Globomantics.
Now we can scroll up to the Attachment field and load our PoshC2 payload,
which we will transmit to our victim by the spear phishing attack.
PoshC2 comes with a number of payloads to load the
implant on to a target system.
These payloads are built during the PoshC2 server installation the
first time the server is running configured.
We will switch from King Phisher over to the terminal and
review the directory containing the payloads to identify
which we want to use for our attack.
These payloads are going to reside under the PoshC2 project folder I
created called global‑attack when I configured my server.
We type ls space /var/poshec2/global‑attack/payloads, and press Enter.
Scrolling up,
we see a number of different payloads to use depending on the system.
Let's use the launcher.hda payload for our purposes.
In the terminal,
we will copy the payload to our local documents directory so we
may modify it using the command cp
/var/poshc2/global‑attack/payloads/launcher.hta documents.
We can verify the transfer using the ls command on the directory.
Now let's rename the file to something that will fit
with our phishing attack on our victim.
Run nv documents/launcher.hta documents/virus‑check.hta, and press Enter.
We see now listing the directory again, that we have changed our
file name to be more convincing to our target that this is something
that should be loaded onto their system.
Now let's start our PoshC2 server with the command posh‑server o
prepare for our attack. Moving back to King Phisher,
we will click to select our file and click on the
virus‑check.hta file to load it into King Phisher.
We will now navigate to the Send tab, and we're ready to send our phishing
campaign to the Globomantics CEO. Click the Start button.
King Phisher will prompt us for our SMTP server password, which I will enter
here, and we will see that King Phisher runs through the send process and
successfully sends our campaign to our target.
Now let's start the Posh implant handler from the terminal by running Posh
and press Ente. We can verify that the implant handler is running by
checking the PoshC2 server terminal window, and we see our user of Kali is
signed in. Now moving over to the system of the phishing target, we can
see when we opened the email client that the attack has indeed arrived in
the CEO inbox.
The message appears to come from the Globomantics help
desk, giving our attack validity in the eyes of the CEO, as
originating from Globomantics.
We see that unfortunately Globomantics has recently had a virus
attack, so the CEO should download the attached file and run it on his
system to ensure it has not been compromised.
We will save the file to the desktop and run it as the CEO.
Good.
The CEO should be all safe from any potential virus now that he has done
that, wink wink. Hopping back over to our attack system, we can refresh the
implant handler terminal by pressing Enter. Success.
We now see that the GLOBO‑PC‑01 system is in
communication with the PoshC2 server.
This will end our demo where we enumerated our victim through
public‑available resources and crafted a spear phishing attack to
carry our PoshC2 implant to our target system to establish initial
access for our attack and a successful connection of our command and
control infrastructure.