start	end	text
1160	6180	Today we're taking a look at an offensive security phishing framework I've created called Redler.
6420	11480	We've got a live demo we're going to hop into shortly, but before that I've got a quick three slides I want to cover.
12580	18360	A little bit about me. My name is Matt Carrillo and I'm a Senior Cybersecurity Analyst at Shiner Downs.
18360	23200	We're a firm based out of Pittsburgh and Columbus offering a variety of security consulting services.
23620	28520	I've been with the company since early 2017, and most of my focus during that time has been performing
28520	31600	penetration testing and offensive services for clients.
32060	36140	Within our team, I sort of service the de facto developer when we need something built or edited,
36140	38900	although I don't have a formal software engineering background.
39580	44820	I've also been assigned several incident response cases, so although my focus is on the offensive side of security,
44820	47420	I do have some experience on the other side of the fence.
48460	54240	One of the areas I've spent the most time working in and developing for us is phishing, which we're here to talk about today.
55960	61200	So why Reddler? We've used multiple different phishing tools and platforms since I joined the team,
61200	65380	and with each of them, we felt there was probably something out there that better suited our needs.
65620	71360	Eventually we decided to delve into creating our own, which became Reddler, and these became the goals for the project.
72840	77980	One of our top priorities was the ability to be running and managing several phishing campaigns at once,
77980	84020	whether that be multiple phishing campaigns running off a single server, or campaigns running off of separate servers.
84240	91180	Also high on the list, the ability to chain templated webpages together in a way that mimics the user experience
91180	96860	on popular cloud email services where usernames and passwords are submitted on sequential webpages.
97080	99840	We think this is a must for phishing in today's environment.
100820	105840	We also have a need to be able to quickly add on to existing infrastructure when we need it,
105840	108440	and quickly tear it down when that gets burned.
108440	112620	In the event of one of our phishing servers getting burned and we tear it down,
112620	115320	we don't want to lose all of our phishing templates and data.
115320	119500	We wanted all data stored somewhere centralized that could manage other phishing servers
119500	123720	and perform remote actions for us, such as generating SSL certificates.
125280	130040	Encryption of sensitive data was also important, mostly revolving around phishing data,
130040	134280	such as user submitted form data and SMTP credentials.
135260	140420	On the payload delivery side, we also wanted an integrated way to be able to serve payloads
140420	145400	instead of exposing our C2 infrastructure by hosting our payload from our Cobalt Strike web server
145400	147320	or something similar to that.
147960	152840	And lastly, we also wanted a way to still be able to track information regarding our phishing targets,
152840	157360	such as IP addresses, user agents, but also click counts, opened email accounts,
157360	160300	because a lot of our clients still care about those statistics.
161540	164560	Last bit before we get over to the demonstration.
164880	168860	Redler is broken down into three parts, and this is how our environment is structured.
169140	174000	The Redler console is the main backend, written in Flask and Python,
174000	179340	which stores your templates, tracks your campaigns, and manages your remote phishing servers.
180040	184500	The client is a web interface written in Angular 7 that allows you to interact
184500	187640	with the exposed console endpoints via a GUI.
187640	191320	And I run the client and the console off the same server.
192100	198120	The last component are your Redler workers, which is another Python API that you run on separate servers.
198220	202160	Ideally, you can add as many workers to your phishing infrastructure as you require.
202160	204560	The workers are what actually runs your phishing web servers
204560	207740	and sends statistics and form data back to the console.
208140	211940	So we fire off this whole environment and then just open up the workers' web ports
211940	214420	to the internet for our phishing targets to hit.
216360	219040	Now let's transition over to the demo.
219560	224280	So we're here at the Redler login page, and you can see the web interface that I'm connected to
224280	227440	is running on winterphish.com off port 4200.
227900	233180	Down here in the console bar, you can see the Redler console I've specified we're going to be logging into
233180	237180	and connecting to is the same domain, but off port 5000.
237180	240300	So again, these are running on the same server, just different ports.
240300	245720	So go ahead and log in. We've got a bit of a Game of Thrones theme here, so we log in as Jon Snow.
246620	249740	And when you log in, you're first presented with the workspaces page.
249740	255300	We'll come back to this page in a minute. The first page I actually want to cover is the domains and servers page.
255860	260360	The domains and servers component is where you manage your Redler workers and your phishing domains.
260560	264820	On the server side, you can see I have three Redler workers connected with my console.
265080	269160	And ideally, you can integrate as many of these as you want with a single console.
269160	272180	In our production phishing environment, we're running quite a few of these.
272580	275860	For each worker on the table, there's a couple actions you can take.
275860	281820	You can check its status to make sure that worker to console and console to worker communications are working.
282200	287140	You can upload files to the worker and delete files off the worker.
287140	291980	Anything uploaded here gets copied over to the static folder of your web server.
292100	296540	So you can upload resource files here for your HTML templates or payloads to be served.
297780	302760	We can also check what ports are currently bound to on the worker.
302760	308400	So, if we're running a phishing campaign off of port 443, we'd see that here.
308400	312060	If a port is taken up, we'd want to phish off of something like 80.
312780	317600	You can actually be running campaigns in parallel off these workers.
317600	322500	You can have a campaign running on worker 2 on 443 and on 80.
322500	327160	Or you could have campaigns running on workers 1, 2, and 3 all off port 443.
327160	329820	Those can all be managed from a single interface here.
330740	337380	The API key up here actually has to be entered into a config file on the worker manually.
337520	345580	So, when the console goes to present campaign configs to the worker and gives it the HTML templates to host,
346540	351660	this API key is sent with it, and if it does not match, that kind of communication will fail.
351660	359180	On the reverse side, when the worker is sending data back to the console, statistics updates, clicks, opens, forms data,
359180	361820	the API key is sent from the worker to the console.
361940	366000	And again, if the API key does not match on either end, the communications will fail.
366620	371840	On the domain side, we can see the two domains I've configured for the purposes of the demo.
372240	379000	Domains are only usable if the domain resolves to one of the IP addresses of your Redlet workers over on the server side.
379000	383060	And once added to the table, there's a couple actions we can take again.
383180	388360	The refresh button will resolve the domain to an IP address and update the value shown here in the table,
388360	393040	and the green lock will generate SSL certs using Let's Encrypt for your domain.
393080	395940	We'll go ahead and do that for Bravo's Logistics here.
404580	413120	The certs have been successfully generated, and we can see that the certain key paths have been updated with the default paths of Let's Encrypt certs.
413120	422040	If you're not using Let's Encrypt for SSL certs, you can come in here and also specify the paths to your custom certain key in the interface here.
424360	428160	Next, we'll briefly cover the Users and Roles component.
428460	434600	This page is only accessible to users who have been assigned an administrator-type role.
434780	442180	And from here, you can add and delete users, reset passwords, and also change what roles users are assigned to.
442180	449320	In the Users table here, we can see the admin user and jsnow user have been assigned the Redler Admin role,
449320	453320	and the starly account has been assigned the Night's Watch role.
454000	459780	On the Roles side, you can add and delete roles, but also edit the permissions assigned to each role.
460200	470440	So the Redler Admin role here, which is an administrator role, it has the ability to view all the workspaces accessible via the console.
470440	475100	So you can delegate these just by unchecking and checking the boxes here.
475660	484220	And the Night's Watch role, which is a user-type role, only has access to two of the several workspaces available via the console.
484460	489340	So as an example, I use this feature all the time to delegate access to our interns,
489340	496780	to ensure that they only have access to the current engagements that they're working on, and not all of the projects that we're doing at that time.
498780	505000	Right now, there's only two role types. There's the administrator types and the user types.
505100	512160	And the differences between these are that the administrator roles get added automatically to all newly created workspaces,
512160	518580	and the administrator roles have the ability to access this Users and Roles page to perform administrative functions.
519620	523220	With that, let's move back over to the Workspaces page.
523960	529100	Workspaces are really just buckets that are there to help you organize your phishing engagements or projects.
529100	536320	Phishing templates and results, including statistics and credentials from one workspace, will not be viewable outside of that workspace.
536480	539300	The exception to this is the General workspace.
539440	544420	Any templates you add to the General workspace will be usable in campaigns within other workspaces,
544420	547280	although they will only be editable from the General workspace.
547380	551260	This workspace is really there just to help you declutter the rest of the interface.
551900	555640	So now let's enter our Casterly Rock workspace.
556900	563060	You can see a bunch of new tabs just appeared on the nav bar which contain this workspace's templates and data.
563200	568660	The Results page, which we're on now, shows all the statistics from our current and previous campaigns.
568820	576660	From here we can see all the campaigns in this workspace, filter the results by campaign, and drill down into the results.
580110	587470	Each of these result categories is exclusive, so users who have submitted creds do not also count in the clicked or opened category.
587670	591870	It is assumed that to submit creds the link was clicked and the email was opened.
592130	597630	The Download category tracks users who downloaded a payload or a file from your phishing site.
597810	603570	My team often doesn't send direct attachments, so instead we'll have our file download automatically from a web page.
603810	607070	Clicking on a category we can see targets who belong to it.
607830	614670	And going a little bit further, we can see information about each user, including the timestamps of different actions,
614670	617810	and the associated IPs and user agents.
621620	624980	Submitted form data appears down here in the Credential Vault.
624980	627920	Clicking a row we can see all of the form data submitted.
630340	633800	And there's also a couple graphs available for reporting.
637840	640900	That pretty much wraps up the results component.
640900	644440	Let's move on to our phishing templates and get ready to prep our new campaign.
645320	650180	The Emails component houses our email templates, and I've got a couple already loaded in here.
650180	652400	We'll go ahead and just pick one to edit.
653680	659540	So everything's edited via HTML on the back end, and you can preview it in iFrame here.
659580	666300	You can see we're working with a template that is dealing with email availability issues,
666300	667960	and some security changes have been made.
667960	671260	Just got to go log in and make sure that access has not been affected.
671260	675840	And we're impersonating MaesterPysel here, our maester of network communications.
675880	677500	You can see there's a couple of variables in here.
677500	683400	So we've got the firstName variable there, as well as a URL variable here.
684000	687680	And there's a couple more that are available for use in emails.
687680	692680	So the URL variable will just simply take users to your initial landing page.
692680	697220	The payload URL will take users directly to your hosted payload,
697220	703140	so this link should just simply download a file if you configure the campaign to use a payload when you set it up.
703260	708100	And the rest of the variables here, firstName, lastName, fullName, email, and ID,
708100	712360	are just going to be unique variables based on the recipient.
714540	717840	Email tracking is also on by default, and you can toggle this on and off.
717840	722140	This will simply include the 1x1 pixel image at the bottom of the email,
722140	726700	where if it's rendered, you can deduce that your target has opened the email.
732560	736020	The pages component is very similar to the email component,
736020	740180	and this is where you store your HTML templates for your phishing webpages.
740840	744900	I've got one template preloaded here in the Casterly Rock workspace,
744900	749540	but the login templates we're going to be using with our email availability scenario
749540	752180	are actually kept in the general workspace for now.
752180	754680	So let's backtrack over there so we can edit them.
756080	759460	And again, even though these two templates are only editable
759460	764240	in the pages component of the general workspace,
764240	768940	these will be available for selection with campaigns in any workspace.
769080	771980	So we've got our username and password pages here.
771980	775680	Let's pop these open just for a preview.
776780	781040	And this is actually one of the best features about Reddler,
781040	785840	is that you have the ability to chain up to four of your templated webpages together
785840	787660	during any one campaign.
787660	790280	So this can help you create a dynamic scenario
790280	796780	or accurately mimic the user experience for your particular targeted site.
797800	800480	Let's go in and edit one of these now.
800620	804080	So we can see this is the same HTML editor that the emails component has.
804080	806300	We've got the same iframe preview.
806300	808880	We've also got the ability to clone a site.
808880	817960	And we also can specify the trailing URL path that this specific webpage is going to be hosted on.
818120	821560	Again, we've also got several variables that can be used.
821580	826240	So the next URL variable is the variable you're going to be using the most.
826240	830040	And this is how you tie your templated webpages together.
830040	834180	So down in our form here on the username page,
834180	838300	we can see the action attribute is just set to the next URL variable.
838300	841120	This will get dynamically replaced at runtime
841120	849160	with the trailing URL path of your second page in the sequence.
849160	850940	So that will be replaced with this value here
850940	855020	and bring users over to the password page when they submit their username.
857320	865320	The payload URL variable is the same as the payload URL variable available in the emails.
865320	868800	And again, this will let you use a button or a hyperlink
868800	873640	to directly download the specified payload configured with your campaign.
874180	878700	The serve payload variable is a little bit different from the payload URL variable
878700	884620	in that you can just include this anywhere in your HTML template.
884620	892560	And it will get replaced at runtime with a HTML meta tag, kind of like down here.
892560	896920	And when someone browses to your page,
897100	902500	it should automatically drop your specified payload to their file system
902500	906680	without any type of button or hyperlink click.
907200	911960	And for both of these, when using either of these,
911960	914580	the tracking integrity is maintained.
914580	918780	So the specific user ID of whoever is browsing your site at that moment
918780	922680	will be inserted here in the payload URL so you can continue to track
922680	925320	who exactly is downloading your payloads.
926260	932200	The final three variables down here, login.fmt, username, and email,
932200	937740	are there to help you mimic user experiences and do sort of a variable pass-through.
937740	941800	If we check our password page here,
941800	947880	we can see we've got the login.fmt value specified above our enter password header.
947880	955200	And this will let us grab the value of an input box with the login.fmt name
955200	958940	from the previous page's form submission and display it here.
959040	963820	If we look back at our username page,
963820	970720	the input box we're going to be entering data into has the name attribute set to login.fmt.
970820	975560	Whatever data the user submits on this page here will be displayed on the second page
975560	978220	to help mimic common login experiences.
983060	988080	So we're halfway through the campaign makeup at this point, taking a look at emails and pages.
988080	991400	All we've got left is target lists and profiles before we're ready to send.
991400	996100	We'll go back to our Caskly Rock workspace at this point and get our target list prepped.
996340	1000400	We'll make a new list, and you can either add users one by one here
1000400	1004240	by adding their information in this line and clicking the plus button,
1004240	1008540	or you can upload a CSV file. So I'm just going to do that to save some time.
1008540	1010900	We'll call the list Lannisters.
1013200	1016780	And you can see this was filled out already with first name, last name, and email.
1016780	1020760	Email is the only required value. First and last name are available though
1020760	1026020	if you want to be able to reference the fname and lname type variables in your email template.
1026320	1031300	We'll go ahead and create this, and this is going to be who we're sending to when we kick off our campaign.
1032880	1036100	Profiles are our last required component to start a campaign.
1036100	1041600	Similar to when we took a look at Pages, the profile we want to use is being housed in the General workspace.
1041920	1044940	Instead of navigating back to the General workspace and looking at it there,
1044940	1048840	I'm actually going to import it over to our current Caskly Rock workspace.
1054660	1057480	So now our profile has been imported to our current workspace.
1057480	1059360	We can take a look at it and make some edits.
1062360	1066700	We can also change how it looks like when a user receives it.
1069440	1074000	Down here you can see we've got the SMTP host, port, username, and password.
1074000	1077060	We're also specifying we're going to be using a DLS connection.
1077400	1081760	Save this in the test email to make sure that our profile is working.
1093820	1096800	Great, so now that our profile is successfully working,
1096800	1098820	we're ready to go generate a new campaign.
1101680	1106160	The Campaigns component shows us our three previously run campaigns.
1106160	1109260	All of these are completed, so none of them are active anymore.
1109260	1111460	We'll go ahead and create a new campaign up here.
1111840	1115160	The first set of options we're presented with are our hosting options.
1115160	1119440	We'll select our domain that is going to host our phishing site, westerosport.com.
1119440	1121820	We can see the IP that that domain resolves to.
1122000	1128280	We'll also select our server, which is going to be worker1, also the IP address that our domain resolves to.
1128280	1132180	If we try and select another worker that has a different IP address and continue,
1132180	1134580	we will be forbidden from doing so.
1134580	1136600	We'll go ahead and select worker1.
1136780	1143620	We can also specify the port that we want to host the campaign off of, as well as whether or not we want to use SSL.
1143700	1147660	This will reference the cert path supplied on the domains and servers page
1147660	1149420	for the chosen domain.
1153020	1158400	Moving on to our scenario options, we'll go ahead and specify a campaign name.
1163610	1165850	And select our email template.
1165850	1167510	We'll do our cloud email update.
1167510	1172110	Optionally, you can also attach a file here. I'm not going to do so for this scenario, but it's there.
1172610	1175710	This is what I was mentioning earlier when I said that you can
1175710	1179690	choose to specify up to four pages per campaign
1179690	1184170	to be used in sequence. We'll go ahead here and select our username page.
1184430	1186990	And then sequentially our password page, so that once
1187380	1190610	the user has submitted a username, they are presented with our password page.
1190710	1194110	You can take this a step further and show a success page or something like that.
1194110	1198150	I've never used all four pages here, but the option is there if you have
1198370	1201250	a complicated scenario that requires something like that.
1202550	1206250	Optionally, we can also specify a redirect URL. So after our last form
1206250	1210270	is submitted, we can take them to the actual login page that we've cloned.
1210270	1214670	I'll just go ahead and specify here, schneiderdowns.com.
1220340	1222680	And also optionally, we can select some payload config.
1222680	1226740	So we can pick a payload file that we've uploaded to Worker 1 previously.
1226740	1231180	Also specify the trailing URL path that that payload will be hosted on.
1231180	1234840	I'm not going to do that here. We'll run through another scenario in which we do configure
1234840	1238740	these, but this is what the payload URL variable that you can use
1238740	1242780	in your email templates and your page templates is going to link to eventually.
1245980	1248060	And last, we have our sending options.
1248380	1252280	We'll pick our list that contains our target email addresses, Lannisters.
1252640	1256220	We'll pick our sending profile, so we'll go with the PyCell profile
1256220	1260460	that will be imported into the Casterly Rock workspace. And optionally, we can also specify
1260460	1264040	some batch sending. We can send two emails
1264040	1268240	through at a rate of... on an interval of every 60 minutes
1268240	1272280	here, if we don't want to blast our target with all emails at once. If we leave these configs
1272280	1276180	blank, all emails will just be sent at one time. Also
1276180	1280260	optionally, we can choose to start the campaign in the future. I'm not going to do
1280260	1284280	that here. If you leave this blank, it'll start right now. And with that
1284280	1287220	we'll go ahead and launch our campaign.
1289320	1292260	So we'll give it a couple seconds here. We can see our campaign has been added to the
1292260	1295800	campaigns page. And we'll give it a moment
1295800	1300260	and when we click refresh, we should see that this campaign status changes
1300260	1304360	to active. Okay, there we go. We can see we've also got an option
1304360	1306140	now to kill a campaign and end it.
1308000	1312220	We'll head over to the results component again and just filter down to our
1312220	1316340	newly run campaigns. We can see all four emails have been sent. All four
1316340	1320160	are currently unopened. We'll browse out to one of the inboxes here
1320160	1323280	and log in. Let's simulate someone getting phished.
1331410	1335250	We'll log into Searcy here and we can see we've got
1335250	1339890	an email from MasterPycel. We trust everything from MasterPycel.
1339890	1343210	We'll go ahead and we'll download the external images. We'll click the link
1343870	1347430	and we're presented with our sign-in page here. So we can see we're at
1347430	1351710	westerosupport.com with the trailing URL path we provided and also
1351710	1354830	Searcy's unique ID. We'll go ahead
1355830	1362450	provide our email address. We can see
1362450	1366490	our variable passed through here to the second page. We'll go ahead and enter
1366490	1376040	our password in. And we're hit with our redirect.
1377580	1379540	So let's go back over to
1379540	1383660	the UI here and we can see the statistics
1383660	1387020	are actually already updated. We've got a little information on Searcy.
1387780	1391620	So we can see the time stamps of everything, all the actions she took
1391620	1396020	here, as well as the IP address that's all coming from the user agent.
1396520	1399800	And if we come down here, we can
1399800	1402160	see the username and password submitted.
1408340	1413020	So while our cred harvesting campaign is running, I've got a couple more templates rigged up
1413020	1416880	to do payload phish that should automatically drop a file to the
1416880	1420940	user's file system when they browse out to the page. Let's go ahead and configure that
1420940	1425600	to run real quick. Use brawlsuggestics.com
1425600	1428700	We'll run that off of Red Alert Worker number 2.
1428920	1431160	Again, we'll use 443 and SSL.
1441190	1445850	Go ahead and name our campaign. Select our email. And again, I'm not going to
1445850	1449590	attach the payload directly to the email. I'm going to
1449590	1453970	specify it down here in the optional payload settings.
1467820	1470700	And we'll send it out to the Lannisters. We'll use our
1470700	1474860	Braavos Logistics profile and we'll just leave all this blank to send all the emails out at
1474860	1481140	once. We'll give it a couple seconds here and we should
1481140	1485300	see the campaign flip to active on our DefCon Worker 2.
1487640	1488980	There we go.
1489140	1493980	Come back over here. Filter down our results to just this campaign.
1493980	1496060	We've got one email left to send.
1496880	1499680	All emails have been sent out. Come back to
1499680	1504080	Cersei's inbox. Check her email. She's got an invoice here from Braavos
1504080	1507280	Logistics. Download the external images.
1508460	1512440	So, building department is waiting to process the order before it can be shipped to Casterly Rock.
1512440	1515460	We'll go ahead and download our invoice so we can fill it out.
1516100	1520160	Come out to the page here and our invoice will automatically download.
1521880	1523560	We'll head back to Red Alert.
1523560	1527700	Refresh our stats. We can see we've got the download track on
1527700	1531600	Cersei. And we can see all the information on where that's
1531600	1538630	coming from. With our campaigns having run
1538630	1543190	their course, we can come in here. We'll go ahead and kill both of these campaigns.
1543190	1547070	Take them down. The page should no longer refresh.
1548750	1550410	And if we come back to our domains and
1550410	1554450	service page, we check Worker 1 and Worker 2. We should see that no
1554450	1557370	campaigns are running on ports 443.
1565260	1568960	That wraps up our demo. I'll flip back to the PowerPoint
1568960	1573220	briefly here just to cover a couple potential to-dos.
1573220	1577360	A couple things we're thinking about adding into Red Alert would be the ability to relay
1577360	1581480	emails through a specified Red Alert worker. But the way things are currently set
1581480	1585480	up, your Red Alert console is always going to be
1585480	1589080	the IP address reaching out to the specified
1589080	1593180	SMTP server in your profile configs and sending emails
1593180	1597080	that way. So if something were to happen to the reputation of your console's
1597080	1601120	IP address, it could potentially affect its ability to send emails.
1601240	1605240	Adding in the ability to specify a worker to send the emails for your console
1605240	1608460	would add a little bit more redundancy and
1608900	1611760	work for that burnability of the workers.
1612940	1617200	Another thing would be to potentially add in a mechanism
1617200	1620960	to direct users to different webpages
1620960	1624560	or scenarios based on the visiting user agent. So say you're potentially running
1625260	1628940	a payload phishing campaign and a user
1628940	1632500	visits your site from a mobile device.
1632820	1636560	Detecting that via the user agent and then potentially redirecting
1636560	1640600	these mobile users to a credential phishing attack
1640600	1643680	would be something that we'd like to add in in the future.
1644520	1647580	Also the ability to specify IPs associated with
1647580	1651980	products such as Microsoft, ATP,
1651980	1655820	Proofpoint, Mimecast, anything that may be going out and probing some of your phishing sites
1655820	1659740	to determine if it's got malicious files being served or if
1659740	1663340	it's got credential harvesting forms, anything like that.
1663340	1667740	Putting specified IPs or ranges in and then redirecting these
1667740	1671680	IPs to harmless sites. Kind of along that line
1671680	1675540	also would be delaying the weaponization of your hosted payload.
1675540	1679800	So when you go in and you select the payload you want to host off your worker and the trailing URL path
1679800	1683720	potentially replacing that with a dummy payload that could serve for the
1683720	1687540	first 45 seconds or 5 minutes after runtime.
1687540	1691620	And then after that time has passed, anybody browsing to it
1691620	1695520	and any hits for that link will actually drop your real
1696140	1699800	malicious payload. And lastly would be the
1699800	1703980	bypass that's out there for Office 365 Safe Links. Using relative
1703980	1707520	URL paths and the HTML base tag to specify your
1708240	1712460	domain instead of using absolute URLs all over your email.
1712620	1716460	I'm not sure if this still works. I know this was a thing quite a while ago.
1716580	1719320	Something that would be real easy to add into Redler.
1721280	1724020	And that's the end of the presentation. I've got contact
1724020	1727680	info there. As of the time I'm recording this, the GitHub
1727680	1732260	repositories are not public yet. They will be in the very near future.
1732320	1735760	And this is something that we're definitely open to community support
1735760	1739680	on as well once this is public. So thanks everybody
1739680	1741820	for watching and good luck phishing.