Full transcript
0:00Hello everybody and welcome back to
0:02Advent of Cyber. Welcome back to Advent
0:04of Cyber 2025 and this is day two and I
0:08am honored, super excited to help
0:11kickstart the party with today's
0:13challenge. So I am online at the try
0:15hackme advent of cyber and there's a
0:17link below in the video description if
0:19you'd like to play along. But for
0:20today's task, we'll be doing some
0:22fishing. Title here is Mary Clickmus and
0:25we get to learn how to use the social
0:27engineering toolkit to send fishing
0:30emails. So, you know the drill here. You
0:32know the order of operations. I'm going
0:34to go ahead and click on this task one
0:36to take a look at the introduction.
0:38Here's the story. In light of several
0:40recent cyber security threats against
0:43the best festival company acronym TBFC,
0:46the local red team has scheduled several
0:48penetration tests. The red teamers
0:50proceeded to carry out these pen tests
0:52against TBFC. And what they're doing as
0:55part of that is sending some fishing
0:57emails. This is super common, by the
1:00way, in real cyber security. When you
1:02have an authorized penetration test and
1:04authorized fishing, you get to prove or
1:06validate the cyber security awareness
1:09training that you or your organization
1:10is doing is actually working. So we get
1:13to be part of the best festival company
1:16red team with the elves recon mc red
1:18exploit mc red and pivot mc red. We get
1:21to go ahead and execute the fishing
1:23campaign. That means we'll learn and
1:25understand what social engineering is,
1:27the different types of fishing, how we
1:29could create fake login pages and use
1:31the social engineering toolkit to send a
1:34fishing email. Now to dive in here, we
1:36will need to spin up some of the
1:37infrastructure. But tryhackme makes this
1:40extremely easy because we get to use
1:42their attack box. All part of the
1:44platform, all available in your browser.
1:46And we could just click a button to
1:48start that whole machine alongside
1:50another target VM. So I'm going to click
1:53start attack box. And while that is
1:55spinning up on the side, I also want to
1:57start the target machine here. There we
1:59go. Now while these are cooking, we can
2:01keep on reading. Oh, but let's go ahead
2:03and answer the question here. I have
2:04successfully started the attack box and
2:06the target machine. Check. That's done.
2:09Now, let's get to the fishing exercise
2:11and read a little bit about social
2:13engineering. Social engineering refers
2:15to manipulating people, the users, and
2:18having a user make a mistake. Maybe
2:20they're tricked or fooled or deceived
2:23into sharing their passwords, their
2:25credentials, or running a malicious
2:27program like a virus or malware, or
2:29approving a payment, like literally
2:31sending money over the wire. And the key
2:33word there is social because it means
2:35it's attacking or hacking humans,
2:37people, not just computers. But we've
2:40got our attack box just about ready for
2:42us. So, I'm going to close out of the
2:44terminal that starts there. And let me
2:45finish setting the story here. What we
2:47get to do is send a fishing email. And
2:50fishing is a part of social engineering.
2:53And there are a lot of new fangled new
2:54words to send things over a different
2:56kind of format, like not strictly an
2:58email address, but maybe text messages
3:01like SMS. So they call that smishing or
3:04voice phone calls, vishing, maybe using
3:07a QR code for quishing. Uh, you call it
3:10what you want. Okay. Personally, I think
3:12we can pretty safely just call it all
3:14fishing and know that that is social
3:16engineering. The thing is, you don't
3:18want to fall for that. you, mom, dad,
3:20grandma, grandpa, sons and daughters,
3:22everyone in the family here at Christmas
3:23time doesn't want to fall for fishing
3:25emails. So, the advice is to stop. S t o
3:30p. Stop, pause, and take a second to ask
3:32yourself, look, is this email
3:34suspicious? Is this message or whatever
3:36you received telling you to do something
3:38like click on something? Is there some
3:41unbelievable deal? Is there something
3:43beyond your wildest hopes and dreams? Is
3:45it unrealistic? And maybe is it pushing
3:47you to do something right now with
3:49urgency? So when you stop to think about
3:51that, you can then stop even more and
3:54slow down. Scammers, hackers, all these
3:57threat actors and cyber criminals are
3:59trying to take advantage of your
4:01urgency, of your adrenaline. And don't
4:04blindly trust whatever they include in
4:06the email address. Maybe if it's a
4:08website, you type the address or the URL
4:11to the site on your own. Don't click or
4:13copy whatever is included in the message
4:15and try to verify. Make sure this is
4:17from a real person. Check the from
4:19address, the number, not just looking at
4:22what's displayed. So, those are some of
4:24the things you can do to stay vigilant.
4:26But if we put our hacker hat on, if we
4:28try to act like the adversary, we want
4:30to understand what does this really look
4:32like? That's where the real education
4:34comes from here. So, let's try and do
4:36it. Let's see what it looks like, just
4:38how easy it is to send a fishing email.
4:41So in this scenario for Advent of Cyber
4:43Day 2, we want to acquire a target
4:46user's login credentials. We want their
4:49username and password. So we want to try
4:51and fake or masquerade and impersonate
4:53what looks like another best festival
4:56company login page. We'll include that
4:58in a fishing email and send it to the
5:01victim. But it's not just a matter of
5:02putting up a login page. we still need
5:05to actually have the logic to collect
5:07the credentials to really see and
5:09receive what they typed in for their
5:11username and password. And this is
5:13another piece as to why Advent of Cyber
5:15and Try Hackme's work here is awesome
5:17because they have already set this up
5:19for us. They've got a script prepared so
5:21that we could really fish someone, fool
5:24and social engineer them. So, I'm going
5:26to open up this attack box in full
5:28screen so that way we can see this a
5:29little bit better. And I'm going to open
5:30up a terminal over here. And I can see
5:32my IP address 10.65.118.60.
5:37Now, if I make the font size a little
5:39bit bigger, I want to make sure you can
5:40see this, but I'm going to see what
5:42directories do we have using the ls
5:44command just to list stuff in my current
5:46directory. And there is a rooms folder
5:49that I could cd or change directory
5:51into. Now, they told us we could go find
5:53an advent of cyber 2025 subdirectory.
5:57And within there a day02 folder which
6:01then should have a server.py script.
6:04This little program this what we run as
6:07the attacker on the attack box is
6:09standing up or serving that fake login
6:12portal. That will be the website that
6:15the victim falls victim to and enters
6:18their password so that we get to see it.
6:20Let's do it. Let me go ahead and dot
6:22slash to run our server.py script. And
6:25then it says starting the server on http
6:29colonz.0.0.0
6:33or all interfaces on port 8000. Now we
6:37know our IP address is 10.65.118.60.
6:41So when we craft our fishing email, we
6:43want to include a link to this page. But
6:46let me show you what this page looks
6:47like super quick. I'm opening up
6:49Firefox, just my web browser, so that I
6:51can go in the URL 10.65 65.118.60.
6:58There we go. Took a second. And we want
7:00ports. So, a colon there to note that
7:028,000. And once I hit enter, we'll go
7:05see what the victim will end up falling
7:08for. Remember, we wanted to replicate
7:10like a best festival company login page.
7:13So, they think they're logging in to the
7:15real actual system, but we're laying the
7:18trap. It took just a second to load, but
7:20you can see the best festival company
7:22staff portal with our Smiss Operations
7:25reauthentication. They would enter their
7:28username and their password. And then
7:30once they click sign in, we get to see
7:32what they submitted. Now that we have
7:34the server set up, we can go ahead and
7:37use the Social Engineer Toolkit. This is
7:40super cool. This is where we're doing
7:42some of the lead hacks. This is the
7:44Social Engineering Toolkit utility from
7:47Dave Kennedy. Big shout out, kudos.
7:49Credit where credit is due. You all know
7:50Dave Kennedy is incredible, awesome over
7:52at Trusted Sec, Binary Defense, Wehack
7:54Health, doing super cool stuff. Way back
7:56when Dave wrote the Social Engineer
7:58Toolkit, and I think it's been showcased
8:00in the television show Mr. Robot and
8:03Dave helped consult on that, but this
8:05has been around for a while. I think
8:07even the copyright here is 2020, but you
8:09could see some commits in the GitHub
8:10repository that are from like 8 years
8:12ago. And again, this is all for
8:14penetration testing. is all for learning
8:16a little bit of this environment, but we
8:19already have it set up and available for
8:20us inside of the attack box. They use
8:23the acronym set for the social
8:25engineering toolkit. And try hackme
8:27keeps this easy and awesome. You know,
8:29it's all guided. They've got a sweet
8:30walkthrough here that literally brings
8:32you through each individual step as to
8:35what to enter, what to type in, what to
8:37look for, what to do so that we could
8:40send this fishing email. But the social
8:42engineering toolkit has so much other
8:44capabilities and sweet features. So
8:46another link in the video description if
8:48you're interested, want to learn a
8:50little bit more about that. And if you
8:51get to anything that you're just not as
8:53familiar with, Try Hackme has a lot of
8:55these awesome little dashed or dotted
8:57underlines that clue you in as to what
9:00the SMTP protocol is or anything that
9:02you're interested in. Anywhere you see
9:04those dashed or dotted lines, they can
9:06clue you in. And they even tell you some
9:08of the other rooms or activities in Tri
9:10Hackme you can use to learn. And you
9:12might have seen Ekko, our little AI
9:13friend here. That could help us out. I
9:15think we can walk through this A-OK on
9:18our own though. They do give us some
9:20insight as to what we should send and
9:22how it should look because in all
9:24reality, we're crafting a fishing email.
9:26But you can use all the guided content
9:28here to help you learn and walk through
9:30these on your own. So, back over on my
9:32attack box, I actually just want to open
9:34up another tab inside of my terminal
9:36because I do want to be able to run SE
9:39toolkit. I'll hit enter on that and we
9:41can see this thing get started. Oh, and
9:43they've always got this like super cool
9:45ASI art little banner to get the tool
9:47going here. I dig it. But set or the
9:50social engineering toolkit gives us this
9:51sort of like menubased interface. We
9:54could just enter in or type in whatever
9:56option we want to choose. So, if we're
9:58doing a social engineering attack, we'll
10:01enter one. I'll hit enter on there. And
10:03now we have a new menu. Do we want to do
10:05some spear fishing attack vectors,
10:07website attack vectors, infectious media
10:09generator, etc., etc. Honestly, we're
10:12going to do number five here. A mass
10:15mailer attack. Let me enter five. And
10:18this gives us a little bit more insight.
10:20There are two options when you use this
10:22mass emailer functionality. Maybe you
10:24just send one to an individual person.
10:26Just send a single email. Or you could
10:28import a whole list and email as many
10:30individuals as you want, like a real big
10:32fishing campaign. In this scenario,
10:35we'll just email one individual, a
10:38single email address. So, I'll enter one
10:40there. Now, back on the try hackme
10:42instructions, they say we'll send an
10:44email to factorywareville.thm.
10:48They give us some other insight. We'll
10:50use our own server or relay and that's
10:52actually going to be the other IP
10:54address or the second virtual machine
10:56that we spun up. And for the ploy here,
10:59the scheme or the lure of our social
11:01engineering fish, we know that the guys
11:04at the toy factory communicate regularly
11:07with Flying Deer, a shipping company.
11:09So, we'll use that as our pretense.
11:11We'll say that we're coming from updates
11:14at flying deer.thm thm as our source or
11:18sending email address. We'll say it's
11:20from Flying Deer. And then we won't use
11:23a specific username or password for the
11:25relay server. We just need to provide
11:27its IP address and the default port of
11:3025 so it knows how to send that email
11:32address. So back to it. We're sending to
11:35factory atville.thm.
11:38We will use our own server. We'll
11:41provide the IP address just a bit later,
11:43but for now we need to enter the number
11:44two. And our from address should be
11:47remember like updates flying deer.thm.
11:52Enter on that. And then the name can be
11:55simply flying deer. Name of the shipping
11:58company. Username. Remember we didn't
12:00need to provide anything there. So we
12:01can hit enter just to leave the default.
12:03Leaving it blank for the password. And
12:05then the email server IP address.
12:08Remember that's the second virtual
12:09machine that we spun up as part of this
12:12tryhackme advent of cyber day2
12:14challenge. So that's not our attackbox
12:17IP address. It is the target machine
12:19that we know is running round cube, this
12:22software and server for an email or SMTP
12:25server. We can copy this IP and we will
12:28paste that in 10.65.187.207.
12:33Remember, your IP addresses will be
12:35different, but the port default 25 is
12:38totally okay. And do we want to flag
12:40this message as high priority? No,
12:43honestly, we don't need to. And should
12:45we attach a file? N. No, that's fine.
12:47Don't need to attach a file. Don't need
12:49to attach an inline file. But again,
12:51think of the fishing or social
12:53engineering context here. If you wanted
12:56initial access, like control over their
12:59computer, like a reverse shell or oh,
13:01actually compromising their device,
13:04well, you may very well send malware or
13:07some sort of payload to get onto their
13:09computer. In this case, we just want
13:11their credentials. So, we have this sort
13:13of fake website watering hole attack you
13:16might hear as a credential harvester.
13:18So, the email subject, well, we want it
13:20to look important, right? We need to get
13:22their attention. Let's say shipping
13:25schedule change like uh oh we're not
13:27going to be able to get stuff out on
13:29time for Christmas. Do we want to send
13:30the message as HTML hypertext markup
13:33language or just a plain regular plain
13:36text email? We can leave it plain
13:38default. You can see that's in braces
13:40there. Now we need to enter the body of
13:42the message. Okay, so this is what is
13:44really supposed to convince them and we
13:46know needs to link or point to our
13:48fishing page. So let me write. Dear
13:52elves, unfortunately
13:55due to unforeseen
13:58circumstances,
13:59we will be unable to maintain our
14:03original schedule of shipment and
14:07delivery as planned. Please review and
14:11approve the new proposed shipping
14:15schedule at And now we include our link,
14:18the bait set in the trap or the lure. We
14:22know that's an HTTP IP address we'll
14:24type in to go to ours. While we could
14:27host a whole website with a fancy domain
14:29and make this super real, let's just use
14:32this little scenario. 10.65.118.60.
14:37That was our IP address. And then port
14:408000 is where we're serving that fake
14:43login page. With the holiday season
14:46rapidly approaching, please approve this
14:50new timeline no later than the end of
14:55the day. Today, December 2nd, 2025. And
15:00once we're done, it does say you'll need
15:02to type the word end in all caps on a
15:05new line. So, end. And there we go. Set
15:08has finished sending the emails. We can
15:11press return or enter to exit. And then
15:13we can hit 99 to return back to the main
15:16menu and close this thing out. Exit the
15:19tool. Nice. Okay. So, now let's keep an
15:22eye on our server and let's see if they
15:25reach our page. I'm crossing my fingers.
15:28Hopefully, I didn't mess anything up.
15:30Hopefully, I got the IP address right.
15:31They do say, "Hey, it might take a
15:33minute or two for this email to come
15:34through and for the poor elf victim to
15:37click the link, follow along, enter
15:39their credentials." Oh. Oh, it came
15:41through. It came through. Look at this.
15:43There's the IP address of the visitor.
15:46We can see a couple like get requests as
15:48they come through. And then it captured
15:50username with a password of unranked
15:54wisdom anthem. Okay. They post that to
15:58the submit endpoint and they get back to
16:01the page. So there we go. We have the
16:03username and password for this victim.
16:06We did it. We social engineered them
16:09with our fishing email. Now we get to
16:11enter these to make sure we got all this
16:12right. What is the password used to
16:15access the best festival company portal?
16:17Oh, what did they say here? Unranked
16:19wisdom anthem. Let me try and copy that
16:22value. And then I can paste this here.
16:25Let's click check. Yes, we got that one
16:28done, too. All right. Now, we get to go
16:30to the website like the target IP
16:34address, the virtual machine that was
16:35spun up alongside the attack box. We'll
16:38access it from our attack box and now
16:41try to access the mailbox of that
16:43factory user. Like, could we log in with
16:46their credentials? So, back over on my
16:49attack box, let me go ahead and get
16:51Firefox back open. This was the fish
16:53that they fell for, but let me try to
16:56get to that other IP address and log in
16:59to this RoundCube instance with that
17:01info. We know it was factory as the
17:04user. And then we can look back at our
17:06terminal in case we forgot. We'll grab
17:09that unranked Wisdom Anthem password.
17:12And let's go ahead and paste that in and
17:15then log in. [laughter]
17:18All right, we did it. Look, we can see
17:20our own email in here. blind ear
17:22shipping schedule change and that is
17:24exactly what we sent. [laughter] What's
17:26this other email that's in their inbox
17:28though? Ooh, urgent production and
17:31shipping request
17:33198400
17:35a million984,000
17:38units. Uh, okay. So, I think that's how
17:42many toys or how many shipments should
17:43be going out the door. This is a long
17:45email. I think that's the secret sauce,
17:48though. That looks like what we're
17:49looking for. repeat confirmation. The
17:51total requested to be manufactured and
17:53shipped is a,984,000
17:56units. So that is the number that we
17:58want to be able to submit. And that is
18:00the secret. Back over on the try hackme
18:03interface. Let me go ahead and submit.
18:05Paste that and check. Got that done. And
18:08that's it. We can now, if we wanted to
18:10maybe explore and further our learning
18:12if we enjoyed this, we can go take a
18:14look at the fishing prevention room. But
18:17I think we're done for today's day two
18:20task from try hackme advent of cyber. We
18:23did it. Look, that was some super sweet
18:26exposure and awareness education on the
18:29social engineering toolkit as one
18:31utility, one tool in your toolbox and a
18:34little bit of social engineering, a
18:35little bit of fishing. being able to
18:37understand just how easy it is to lay a
18:39trap, lay a lie out for someone to
18:42unknowingly enter their password and
18:45give away their credentials for a bad
18:47actor, for a hacker, cyber criminal or
18:49in a penetration test for some ethical
18:52hacking. Doing this stuff for all the
18:54right reasons. And that is, I think,
18:55what we're celebrating this month for
18:57the advent of cyber 2025. Big thanks to
19:00try hackme for letting me join the party
19:02this year. Big thanks to everyone that's
19:04been able to do some awesome stuff with
19:06this event and I'm looking forward to
19:07all the rest of the writeups, all the
19:09rest of the videos, everyone flexing,
19:11showing off, doing what they can do for
19:13this game on Try HackMe. Thank you again
19:15and again. I'm done rambling. Let's get
19:17to the next day, the next day task, the
19:19next day challenges, and I'll see you
19:21then. Happy holidays everybody.