Skip to content
This repository was archived by the owner on May 19, 2022. It is now read-only.

Commit c866679

Browse files
author
Ralph
committed
Updates and Fixes
1 parent 12c5e59 commit c866679

File tree

21 files changed

+167
-139
lines changed

21 files changed

+167
-139
lines changed

‎.gitignore

+5
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ builds/**/images/*
4343
*.ogg
4444
*.mp3
4545
*.mp4
46+
*.io
4647
TODO.txt
4748

4849
# security / ssl
@@ -62,3 +63,7 @@ digital_ocean_phish
6263

6364
# keys
6465
keys/*
66+
67+
# vars
68+
vars/all.yml
69+
vars/phish.yml

‎README.md

+29-15
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ Build a Phish consist of a Ansible playbook to deploy a phishing engagement in t
3030
| <img src='https://raw.githubusercontent.com/kgretzky/evilginx2/master/media/img/evilginx2-logo-512.png' width='40'> | Evilginx2 | [warhorse/evilginx2](https://github.com/warhorse/docker-evilginx2)|
3131
| <img src='https://github.com/gophish/gophish/raw/master/static/images/logo_purple.png' width='40'> | Gophish | [gophish/gophish](https://github.com/gophish/gophish)|
3232
| <img src='https://d1q6f0aelx0por.cloudfront.net/product-logos/library-nginx-logo.png' width='40'> | Nginx | [nginx](https://hub.docker.com/_/nginx)|
33+
| <img src='https://avatars.githubusercontent.com/u/4652787?s=280&v=4' width='40'> | Mitmproxy | [mitmproxy](https://hub.docker.com/r/mitmproxy/mitmproxy/)|
3334

3435
## Supported Cloud Providers
3536

@@ -63,31 +64,36 @@ Coming Soon
6364
You will need a managment domain. This domian can be the same domian used for phishing emails. After you buy a domain set the name server records to Digital Ocean.
6465

6566

66-
1. Install Ansible & Terraform
67+
### 1. Install Ansible & Terraform
68+
#### Ansible
69+
- OSX
70+
71+
`brew install ansible`
72+
73+
- Linux
74+
75+
`pip install ansible`
6776

68-
Ansible
69-
- OSX `brew install ansible`
70-
- Linux `pip install ansible`
71-
- Install Ansible General Modules
77+
- Install Ansible General Modules
7278

73-
`ansible-galaxy collection install community.general`
79+
`ansible-galaxy collection install community.general`
7480

75-
Terraform
76-
- OSX `brew install terraform`
77-
- Linux https://learn.hashicorp.com/tutorials/terraform/install-cli
81+
#### Terraform
82+
- OSX `brew install terraform`
83+
- Linux https://learn.hashicorp.com/tutorials/terraform/install-cli
7884

79-
2. Git clone this repo
85+
### 2. Git clone this repo
8086

81-
`git clone https://github.com/ralphte/build_a_phish`
87+
`git clone https://github.com/ralphte/build_a_phish`
8288

83-
3. Customize the variables inside the vars folder.
89+
### 3. Customize the variables inside the vars folder.
8490

8591

86-
4. Create API keys for both Digital Ocean & Azure.
92+
### 4. Create API keys for both Digital Ocean & Azure.
8793

88-
- Digital Ocean API Key https://www.digitalocean.com/docs/apis-clis/api/create-personal-access-token/#:~:text=To%20generate%20a%20personal%20access,the%20Generate%20New%20Token%20button.
94+
- Digital Ocean API Key https://www.digitalocean.com/docs/apis-clis/api/create-personal-access-token/#:~:text=To%20generate%20a%20personal%20access,the%20Generate%20New%20Token%20button.
8995

90-
- Azure CLI https://docs.microsoft.com/en-us/cli/azure/install-azure-cli
96+
- Azure CLI https://docs.microsoft.com/en-us/cli/azure/install-azure-cli
9197

9298
## Usage
9399

@@ -127,6 +133,12 @@ To get the password on first login check the docker logs
127133

128134
`docker logs gophish`
129135

136+
### Mitmproxy
137+
138+
You can access Mitmproxy via the hostname set for "mitmproxy_hostname"
139+
140+
The mitmproxy web interface allows you to see the RAW traffic between evilginx2 and your target server. You can use this to check for problems and remove any IOC's. Mitmproxy is a dignostic tool to inspect https traffic.
141+
130142
## Development
131143

132144
Does none of this work for you? Submit a issue and I will see what the problem is.
@@ -139,6 +151,8 @@ Gophish https://getgophish.com/
139151

140152
Evilginx https://github.com/kgretzky/evilginx2
141153

154+
Mitmproxy https://github.com/mitmproxy/mitmproxy
155+
142156
Ansible roles from https://github.com/geerlingguy
143157

144158

‎playbooks/phish_deploy.yml

+4-3
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,7 @@
8383
- ../vars/phish.yml
8484
roles:
8585
- { role: nginx-docker }
86-
- { role: gophish-docker, gophish }
87-
- { role: evilginx2-docker, evilginx2 }
88-
tags: [ never, phish, gophish, evilginx2 ]
86+
- { role: gophish-docker, tags: gophish }
87+
- { role: evilginx2-docker, tags: evilginx2 }
88+
- { role: mitmproxy-docker, tags: mitmproxy }
89+
tags: [ never, phish ]

‎playbooks/phish_destroy.yml

+17-17
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,4 @@
11
---
2-
- name: Deploy Terraform
3-
hosts: localhost
4-
gather_facts: true
5-
connection: local
6-
vars_files:
7-
- ../vars/all.yml
8-
- ../vars/phish.yml
9-
vars:
10-
- deploy: true
11-
tasks:
12-
- name: Create a keys directory
13-
ansible.builtin.file:
14-
path: ../keys
15-
state: absent
16-
tags: [ never, phish ]
17-
182
- name: Destroy Terraform
193
hosts: localhost
204
gather_facts: true
@@ -34,4 +18,20 @@
3418
# - mailgun
3519
loop_control:
3620
loop_var: roleinputvar
37-
tags: [ never, phish ]
21+
tags: [ never, phish ]
22+
23+
- name: Destroy SSH Key
24+
hosts: localhost
25+
gather_facts: true
26+
connection: local
27+
vars_files:
28+
- ../vars/all.yml
29+
- ../vars/phish.yml
30+
vars:
31+
- deploy: false
32+
tasks:
33+
- name: remove keys directory
34+
ansible.builtin.file:
35+
path: ../keys
36+
state: absent
37+
tags: [ never, phish ]

‎roles/digitalocean/tasks/dns_deploy.yml

+2
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,13 @@
88
- digitalocean_record.gophish_hostname
99
- digitalocean_record.gpadmin_hostname
1010
- digitalocean_record.gpredirect_hostname
11+
- digitalocean_record.mitmproxy_hostname
1112
- digitalocean_domain.domain
1213
variables:
1314
do_token: "{{ digitalocean_token }}"
1415
gophish_hostname: "{{ gophish_site_hostname }}"
1516
gpadmin_hostname: "{{ gophish_admin_hostname }}"
17+
mitmproxy_hostname: "{{ mitmproxy_hostname }}"
1618
tl_domain: "{{ domain_name }}"
1719
do_img: "ubuntu-20-04-x64"
1820
do_name: "{{ user_tag }}-{{ op_number }}-phish"

‎roles/digitalocean/tasks/dns_destroy.yml

+2
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,13 @@
88
- digitalocean_record.gophish_hostname
99
- digitalocean_record.gpadmin_hostname
1010
- digitalocean_record.gpredirect_hostname
11+
- digitalocean_record.mitmproxy_hostname
1112
- digitalocean_domain.domain
1213
variables:
1314
do_token: "{{ digitalocean_token }}"
1415
gophish_hostname: "{{ gophish_site_hostname }}"
1516
gpadmin_hostname: "{{ gophish_admin_hostname }}"
17+
mitmproxy_hostname: "{{ mitmproxy_hostname }}"
1618
tl_domain: "{{ domain_name }}"
1719
do_img: "ubuntu-20-04-x64"
1820
do_name: "{{ user_tag }}-{{ op_number }}-phish"

‎roles/evilginx2-docker/templates/config.yaml.j2

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
ip: 0.0.0.0
2+
proxy_enabled: true
3+
proxy_type: http
4+
proxy_address: mitmproxy
5+
proxy_port: 8080
26
lures:
37
- info: "test"
48
og_desc: ""
@@ -17,4 +21,4 @@ site_domains:
1721
sites_enabled:
1822
- o365
1923
verification_key: cj
20-
verification_token: 3ee7
24+
verification_token: 3ee7

‎roles/mitmproxy-docker/defaults/main.yml

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
mitmproxy_dir: '{{docker_home_dir}}/mitmproxy'
2+
mitmproxy_hostname: 'mitmproxy'

‎roles/mitmproxy-docker/handlers/main.yml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
- name: Restart docker_mitmproxy
3+
docker_container:
4+
name: mitmproxy
5+
hostname: 'mitmproxy'
6+
interactive: yes
7+
image: mitmproxy/mitmproxy:4.0.3
8+
pull: yes
9+
state: started
10+
command: "mitmweb --web-iface 0.0.0.0 --no-web-open-browser --ssl-insecure -v"
11+
restart_policy: always
12+
restart: yes
13+
volumes:
14+
- "{{ mitmproxy_dir }}/config:/home/mitmproxy/.mitmproxy"
15+
networks:
16+
- name: "{{ dockernet }}"

‎roles/mitmproxy-docker/tasks/install.yml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
- name: Setting containers
3+
include_tasks: "{{ item }}.yml"
4+
with_items:
5+
- mitmproxy

‎roles/mitmproxy-docker/tasks/main.yml

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
- include: install.yml

‎roles/mitmproxy-docker/tasks/mitmproxy.yml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
- name: Ensures mitmproxy dir exists
3+
file:
4+
path: '{{ item }}'
5+
state: directory
6+
with_items:
7+
- '{{ mitmproxy_dir }}'
8+
- '{{ mitmproxy_dir }}/config'
9+
10+
- name: Mitmproxy
11+
docker_container:
12+
name: mitmproxy
13+
hostname: 'mitmproxy'
14+
interactive: yes
15+
image: mitmproxy/mitmproxy:4.0.3
16+
pull: yes
17+
state: started
18+
command: "mitmweb --web-iface 0.0.0.0 --no-web-open-browser --ssl-insecure --set block_global=false"
19+
restart_policy: always
20+
volumes:
21+
- "{{ mitmproxy_dir }}/config:/home/mitmproxy/.mitmproxy"
22+
networks:
23+
- name: "{{ dockernet }}"

‎roles/mitmproxy-docker/vars/main.yml

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
---

‎roles/nginx-docker/templates/nginx_phish.conf.j2

+33-3
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,26 @@ server {
5353
}
5454
}
5555

56+
server {
57+
server_name {{ mitmproxy_hostname }}.{{ domain_name }};
58+
listen 443 ssl;
59+
ssl_certificate /etc/letsencrypt/live/{{ domain_name }}/fullchain.pem;
60+
ssl_certificate_key /etc/letsencrypt/live/{{ domain_name }}/privkey.pem;
61+
include /etc/nginx/options-ssl-nginx.conf;
62+
63+
location / {
64+
proxy_set_header Upgrade $http_upgrade;
65+
proxy_set_header Connection "Upgrade";
66+
proxy_set_header X-Real-IP $remote_addr;
67+
proxy_set_header Host $host;
68+
proxy_set_header X-Forwarded-Proto $scheme;
69+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
70+
proxy_pass http://mitmproxy:8081;
71+
allow {{ white_list_ip }};
72+
deny all;
73+
}
74+
}
75+
5676
server {
5777
server_name {{ gophish_site_hostname }}.{{ domain_name }};
5878
listen 443 ssl;
@@ -81,9 +101,19 @@ server {
81101
proxy_ssl_server_name on;
82102
proxy_ssl_name $host;
83103
proxy_set_header Host $host;
84-
proxy_set_header X-Real-IP $remote_addr;
85-
proxy_set_header X-Forwarded-For $remote_addr;
86-
proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
104+
proxy_set_header X-Real-IP "";
105+
proxy_set_header X-Forwarded-For "";
106+
proxy_set_header X-Forwarded-Proto "";
107+
proxy_set_header X-Forwarded-Host "";
108+
proxy_set_header X-Azure-Socketip "";
109+
proxy_set_header X-Azure-Requestchain "";
110+
proxy_set_header X-Azure-Ref "";
111+
proxy_set_header X-Azure-Ipdetection "";
112+
proxy_set_header X-Azure-Fdid "";
113+
proxy_set_header X-Azure-Clientip "";
114+
proxy_set_header Via "";
115+
proxy_set_header X-Msedge-Ignoreratelimits "";
116+
proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
87117
proxy_ssl_verify off;
88118
proxy_pass https://evilginx:443;
89119
}

‎terraform/digitalocean/main.tf

+7
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,13 @@ resource "digitalocean_record" "gpadmin_hostname" {
2424
value = digitalocean_droplet.phish_droplet.ipv4_address
2525
}
2626

27+
resource "digitalocean_record" "mitmproxy_hostname" {
28+
domain = digitalocean_domain.domain.name
29+
type = "A"
30+
name = var.mitmproxy_hostname
31+
value = digitalocean_droplet.phish_droplet.ipv4_address
32+
}
33+
2734
resource "digitalocean_ssh_key" "ansible_ssh_key" {
2835
name = "Ansible SSH Key ${var.op}"
2936
public_key = var.ansible_ssh_key

‎terraform/digitalocean/variables.tf

+1
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,5 @@ variable "ansible_ssh_key" { default = "" }
1010
variable "gophish_hostname" { default = "" }
1111
variable "gpadmin_hostname" { default = "" }
1212
variable "gpredirect_hostname" { default = "" }
13+
variable "mitmproxy_hostname" { default = "" }
1314
variable "ansible_ssh_key_private" { default = "" }

‎terraform/mailgun/mailgun_dns.tmpl

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[phish]
2+
${phish-dns} ansible_host=${phish-ip} # ${phish-id}

0 commit comments

Comments
 (0)