{"id":6547,"date":"2024-04-06T09:49:31","date_gmt":"2024-04-06T07:49:31","guid":{"rendered":"https:\/\/www.sigalou-domotique.fr\/?p=6547"},"modified":"2026-01-02T16:56:27","modified_gmt":"2026-01-02T14:56:27","slug":"lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish","status":"publish","type":"post","link":"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish","title":{"rendered":"Launch a pedagogical phishing simulation on a Microsoft 365 Tenant with Gophish"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-light-blue ez-toc-container-direction\">\n<label for=\"ez-toc-cssicon-toggle-item-6ae455647b398\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewbox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewbox=\"0 0 24 24\" version=\"1.2\" baseprofile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6ae455647b398\"  aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Mon_objectif\" >My goal<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Disclaimer\" >Disclaimer<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Outils_utilises\" >Tools used<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Je_cree_un_compte_Amazon_AWS\" >I create an Amazon AWS account\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Je_cree_une_instance_sur_EC2\" >I create an instance on EC2<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Je_configure_le_groupe_de_securite_de_mon_instance\" >I configure the security group of my instance<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Jutilise_une_Adresse_IP_Elastic_facultatif\" >I use an Elastic IP address (optional)<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Jinstalle_Putty\" >I install Putty\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Jinstalle_GoPhish\" >I install GoPhish<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Je_souhaite_utiliser_Gophish_sans_garder_ma_fenetre_SSH_ouverte_facultatif\" >I want to use Gophish without keeping my SSH window open (optional)<\/a><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Jautorise_le_lancement_de_Gophish_sans_etre_root_sudo\" >I authorise the launch of Gophish without being root (sudo)<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Message_derreur_open_gophish_adminkey_permission_denied\" >Open gophish_admin.key error message:\u00a0permission denied<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Je_declare_gophish_comme_un_service\" >I declare gophish as a service<\/a><\/li><\/ul><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Je_lance_GoPhish\" >I'm launching GoPhish.<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Jajoute_un_utilisateur_%C2%AB_piegeur_%C2%BB_sur_le_Tenant_365\" >I am adding a \u2018trapper\u2019 user to the Tenant 365<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Je_configure_Microsoft_Defender_pour_autoriser_GoPhish\" >I configure Microsoft Defender to allow GoPhish<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Je_configure_le_SMTP_de_GoPhish\" >I configure GoPhish SMTP<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Je_vais_recuperer_tous_les_utilisateurs_du_Tenant_Microsoft_365\" >I will recover all users of the Tenant Microsoft 365<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Jinjecte_les_utilisateurs_dans_un_groupe_GoPhish\" >I inject users into a GoPhish group<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Je_configure_le_mail_de_phishing\" >I configure the phishing mail<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Je_configure_la_page_de_hameconnage\" >I configure the phishing page<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Je_lance_la_campagne_dhameconnage\" >I launch the phishing campaign<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/lancer-une-simulation-dhameconnage-a-visee-pedagogique-sur-un-tenant-microsoft-365-avec-gophish\/#Bibliographie\" >Bibliography<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"Mon_objectif\"><\/span>My goal<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>In order to raise awareness among users of the Microsoft 365 tenant I use, I looked at how to create a phishing campaign to \u2018trap\u2019 them and trigger training on this topic.<\/p>\r\n<p>Prevention messages and digital hygiene campaigns are not enough, it takes a concrete fact to try to trigger awareness.<!--more--><\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Disclaimer\"><\/span>Disclaimer<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>At the risk of repeating myself, my objective is not to launch a direct mail campaign or phishing, it is a pedagogical one.<\/p>\r\n<p>Note that the elements explained below will not work if you are not an administrator of the Tenant to attack since you must authorise the GoPhish IP, without this authorisation, the phishing campaign is blocked by Microsoft\u2019s security systems (Thank you!!)<\/p>\r\n<hr \/>\r\n<h2><span class=\"ez-toc-section\" id=\"Outils_utilises\"><\/span>Tools used<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<ul>\r\n<li>Obviously, I use the Microsoft 365 Tenant to which I will ask to authorise the sending IP of my campaign as well as the famous 5321.MailFrom (or envelope sender).<\/li>\r\n<\/ul>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ITFR-Blog-Microsoft-365-Cloud-01.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter  wp-image-6551\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ITFR-Blog-Microsoft-365-Cloud-01.jpg\" alt=\"\" width=\"269\" height=\"169\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ITFR-Blog-Microsoft-365-Cloud-01.jpg 800w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ITFR-Blog-Microsoft-365-Cloud-01-600x377.jpg 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ITFR-Blog-Microsoft-365-Cloud-01-300x189.jpg 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ITFR-Blog-Microsoft-365-Cloud-01-768x483.jpg 768w\" sizes=\"auto, (max-width: 269px) 100vw, 269px\" \/><\/a><\/p>\r\n<ul>\r\n<li>GoPhish in version 0.12.1 on the day of writing of this RetEx<\/li>\r\n<\/ul>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/maxresdefault.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter  wp-image-6549\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/maxresdefault.jpg\" alt=\"\" width=\"319\" height=\"157\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/maxresdefault.jpg 1134w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/maxresdefault-600x295.jpg 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/maxresdefault-300x147.jpg 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/maxresdefault-1024x503.jpg 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/maxresdefault-768x377.jpg 768w\" sizes=\"auto, (max-width: 319px) 100vw, 319px\" \/><\/a><\/p>\r\n<ul>\r\n<li>Amazon\u2019s AWS platform and more specifically EC2 instances<\/li>\r\n<\/ul>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/90905203-ebe5-4958-b728-4dd9a64c6d03.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter  wp-image-6550\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/90905203-ebe5-4958-b728-4dd9a64c6d03.png\" alt=\"\" width=\"400\" height=\"173\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/90905203-ebe5-4958-b728-4dd9a64c6d03.png 740w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/90905203-ebe5-4958-b728-4dd9a64c6d03-600x259.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/90905203-ebe5-4958-b728-4dd9a64c6d03-300x130.png 300w\" sizes=\"auto, (max-width: 400px) 100vw, 400px\" \/><\/a><\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Je_cree_un_compte_Amazon_AWS\"><\/span>I create an Amazon AWS account\u00a0<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<ul>\r\n<li><a href=\"https:\/\/portal.aws.amazon.com\/billing\/signup#\/start\/email\" target=\"_blank\" rel=\"noopener\">https:\/\/portal.aws.amazon.com\/billing\/signup#\/start\/email<\/a><\/li>\r\n<\/ul>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6576\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws1.png\" alt=\"\" width=\"335\" height=\"337\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws1.png 335w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws1-100x100.png 100w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws1-298x300.png 298w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws1-150x150.png 150w\" sizes=\"auto, (max-width: 335px) 100vw, 335px\" \/><\/a><\/p>\r\n<p>Go through the 5 steps and then:<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter  wp-image-6577\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws2.png\" alt=\"\" width=\"323\" height=\"403\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws2.png 653w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws2-600x749.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws2-240x300.png 240w\" sizes=\"auto, (max-width: 323px) 100vw, 323px\" \/><\/a><\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws3.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter  wp-image-6578\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws3.png\" alt=\"\" width=\"335\" height=\"325\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws3.png 421w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws3-300x291.png 300w\" sizes=\"auto, (max-width: 335px) 100vw, 335px\" \/><\/a><\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Je_cree_une_instance_sur_EC2\"><\/span>I create an instance on EC2<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>Everything I explain about this part is completely free, we can benefit <a href=\"https:\/\/aws.amazon.com\/fr\/ec2\/pricing\/\" target=\"_blank\" rel=\"noopener\">of the 1-year tender<\/a>, that is enough for my need.<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2gratuite.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6553\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2gratuite.png\" alt=\"\" width=\"941\" height=\"377\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2gratuite.png 941w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2gratuite-600x240.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2gratuite-300x120.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2gratuite-768x308.png 768w\" sizes=\"auto, (max-width: 941px) 100vw, 941px\" \/><\/a><br \/>You must have created an account on AWS and then go to <a href=\"https:\/\/console.aws.amazon.com\/ec2\/v2\/home\" target=\"_blank\" rel=\"noopener\">Amazon EC2<\/a><\/p>\r\n<p><a href=\"https:\/\/console.aws.amazon.com\/ec2\/v2\/home\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-6554 size-full\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/demarrerec2.png\" alt=\"\" width=\"368\" height=\"58\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/demarrerec2.png 368w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/demarrerec2-300x47.png 300w\" sizes=\"auto, (max-width: 368px) 100vw, 368px\" \/><\/a><\/p>\r\n<p>At the top right, check that you are in the Europe\/Paris Region<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/awsparis.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-7670\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/awsparis.png\" alt=\"\" width=\"351\" height=\"102\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/awsparis.png 351w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/awsparis-300x87.png 300w\" sizes=\"auto, (max-width: 351px) 100vw, 351px\" \/><\/a><\/p>\r\n<p>then<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6557\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2.png\" alt=\"\" width=\"394\" height=\"159\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2.png 394w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-300x121.png 300w\" sizes=\"auto, (max-width: 394px) 100vw, 394px\" \/><\/a><\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-3.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6558\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-3.png\" alt=\"\" width=\"858\" height=\"386\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-3.png 858w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-3-600x270.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-3-300x135.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-3-768x346.png 768w\" sizes=\"auto, (max-width: 858px) 100vw, 858px\" \/><\/a><\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-4.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6559\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-4.png\" alt=\"\" width=\"797\" height=\"753\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-4.png 797w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-4-600x567.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-4-300x283.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-4-768x726.png 768w\" sizes=\"auto, (max-width: 797px) 100vw, 797px\" \/><\/a><\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-5.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6560\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-5.png\" alt=\"\" width=\"787\" height=\"280\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-5.png 787w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-5-600x213.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-5-300x107.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-5-768x273.png 768w\" sizes=\"auto, (max-width: 787px) 100vw, 787px\" \/><\/a><\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-6.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6561\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-6.png\" alt=\"\" width=\"790\" height=\"248\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-6.png 790w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-6-600x188.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-6-300x94.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-6-768x241.png 768w\" sizes=\"auto, (max-width: 790px) 100vw, 790px\" \/><\/a><\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/cles2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6572\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/cles2.png\" alt=\"\" width=\"613\" height=\"657\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/cles2.png 613w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/cles2-600x643.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/cles2-280x300.png 280w\" sizes=\"auto, (max-width: 613px) 100vw, 613px\" \/><br \/><\/a>I download the key file, be careful to take a ppk file and not pem.<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-22.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6573\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-22.png\" alt=\"\" width=\"791\" height=\"788\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-22.png 791w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-22-300x300.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-22-100x100.png 100w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-22-600x598.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-22-150x150.png 150w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-22-768x765.png 768w\" sizes=\"auto, (max-width: 791px) 100vw, 791px\" \/><\/a><\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-89png.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6565\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-89png.png\" alt=\"\" width=\"789\" height=\"492\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-89png.png 789w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-89png-600x374.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-89png-300x187.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-89png-768x479.png 768w\" sizes=\"auto, (max-width: 789px) 100vw, 789px\" \/><\/a><\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-10png.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6566\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-10png.png\" alt=\"\" width=\"585\" height=\"115\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-10png.png 585w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/ec2-10png-300x59.png 300w\" sizes=\"auto, (max-width: 585px) 100vw, 585px\" \/><\/a><\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws4.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6579\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws4.png\" alt=\"\" width=\"318\" height=\"149\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws4.png 318w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws4-300x141.png 300w\" sizes=\"auto, (max-width: 318px) 100vw, 318px\" \/><\/a><\/p>\r\n<p>Once everything is installed and launched, I have everything green:<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/instance.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6569\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/instance.png\" alt=\"\" width=\"962\" height=\"85\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/instance.png 962w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/instance-600x53.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/instance-300x27.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/instance-768x68.png 768w\" sizes=\"auto, (max-width: 962px) 100vw, 962px\" \/><\/a><\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Je_configure_le_groupe_de_securite_de_mon_instance\"><\/span>I configure the security group of my instance<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>As a security measure, I have already reserved SSH access to my only IP address via the instance creation wizard, now I need to configure the ports to be used by GoPhish.<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws5.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6580\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws5.png\" alt=\"\" width=\"203\" height=\"203\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws5.png 203w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws5-100x100.png 100w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws5-150x150.png 150w\" sizes=\"auto, (max-width: 203px) 100vw, 203px\" \/><\/a><\/p>\r\n<p>I go to Network and Security then Security Groups, I select the launch-wizard group, incoming rules, modify incoming rules<\/p>\r\n<p>I add a custom TCP entry with a port number other than 3333 which will be the port number I will use for GoPhish, I put 8531 for example.<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws6.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6581\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws6.png\" alt=\"\" width=\"1198\" height=\"286\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws6.png 1198w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws6-600x143.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws6-300x72.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws6-1024x244.png 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws6-768x183.png 768w\" sizes=\"auto, (max-width: 1198px) 100vw, 1198px\" \/><\/a><\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Jutilise_une_Adresse_IP_Elastic_facultatif\"><\/span>I use an Elastic IP address (optional)<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>To always have the same IP address, I use this feature.<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws7.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6582\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws7.png\" alt=\"\" width=\"376\" height=\"225\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws7.png 376w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws7-300x180.png 300w\" sizes=\"auto, (max-width: 376px) 100vw, 376px\" \/><\/a><\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws8-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6584\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws8-1.png\" alt=\"\" width=\"747\" height=\"683\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws8-1.png 747w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws8-1-600x549.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws8-1-300x274.png 300w\" sizes=\"auto, (max-width: 747px) 100vw, 747px\" \/><\/a><\/p>\r\n<p><em>Please note that elastic IP addresses pay when they are not associated with a running instance. This means that if you book an elastic IP address but do not use it, you will be charged. However, once an elastic IP address is associated with a running instance, you will not be charged as long as the instance is running and the IP address is associated with that instance. If the instance is stopped or terminated, you can still be charged for using the elastic IP address, unless you disassociate it from the instance or release it.<\/em><\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Jinstalle_Putty\"><\/span>I install Putty\u00a0<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>Putty will allow me to connect in SSH to my EC2 instance, this in a secure way with a key set (private \/ public).<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/putty1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6570\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/putty1.png\" alt=\"\" width=\"495\" height=\"387\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/putty1.png 495w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/putty1-300x235.png 300w\" sizes=\"auto, (max-width: 495px) 100vw, 495px\" \/><\/a><\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/putty2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6571\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/putty2.png\" alt=\"\" width=\"200\" height=\"92\" \/><\/a><\/p>\r\n<p>I need to retrieve the connection settings on the instance.<\/p>\r\n<p>To do so, I right-click on the instance and then \u2018log in\u2019 \/ SSH Client.<\/p>\r\n<p>I note the public DNS that is given to me, it will serve me for Putty\u2019s host<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws10.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6585\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws10.png\" alt=\"\" width=\"411\" height=\"48\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws10.png 411w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws10-300x35.png 300w\" sizes=\"auto, (max-width: 411px) 100vw, 411px\" \/><\/a><\/p>\r\n<p>I launch Putty, I add the Host:<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws11.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6586\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws11.png\" alt=\"\" width=\"454\" height=\"444\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws11.png 454w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws11-300x293.png 300w\" sizes=\"auto, (max-width: 454px) 100vw, 454px\" \/><\/a><\/p>\r\n<p>then I specify the private key file created above:<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws12.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6587\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws12.png\" alt=\"\" width=\"457\" height=\"445\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws12.png 457w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws12-300x292.png 300w\" sizes=\"auto, (max-width: 457px) 100vw, 457px\" \/><\/a><\/p>\r\n<p>To make it simpler, I add user ubuntu as Auto-login in Connection\/Data<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws13.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6588\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws13.png\" alt=\"\" width=\"457\" height=\"449\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws13.png 457w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/aws13-300x295.png 300w\" sizes=\"auto, (max-width: 457px) 100vw, 457px\" \/><\/a><\/p>\r\n<p>I start the connection, it's okay, I have the Ubuntu command line.<\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Jinstalle_GoPhish\"><\/span>I install GoPhish<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>I will look for the latest version that needs to be downloaded on the <a href=\"https:\/\/github.com\/gophish\/gophish\/releases\">Official Github Depository<\/a>.<\/p>\r\n<p>On the day this RetEx was created, the latest version is here:<br \/>https:\/\/github.com\/gophish\/gophish\/releases\/download\/v0.12.1\/gophish-v0.12.1-linux-64bit.zip<\/p>\r\n<p>On the Ubuntu command line, I load the zip file and unpack it in opt\/:<\/p>\r\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">wget https:\/\/github.com\/gophish\/gophish\/releases\/download\/v0.12.1\/gophish-v0.12.1-linux-64bit.zip sudo apt install unzip unzip gophish-v0.12.1-linux-64bit.zip -d .\/gophish rm gophish-v0.12.1-linux-64bit.zip sudo chmod +x .\/gophish\/gophish<\/pre>\r\n<p data-enlighter-language=\"powershell\"><br \/>I will have to configure the gophish IP and its port.<br \/>To do this, I modify the config.json file<br \/><br \/><\/p>\r\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">cd gophish vim config.json<\/pre>\r\n<p>I replace 127.0.0.1:3333 with 0.0.0.0:8531 on the listen_url line<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/gophis1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6594\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/gophis1.png\" alt=\"\" width=\"400\" height=\"100\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/gophis1.png 400w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/gophis1-300x75.png 300w\" sizes=\"auto, (max-width: 400px) 100vw, 400px\" \/><\/a><\/p>\r\n<p>I throw gophish<\/p>\r\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"powershell\">.\/gophish<\/pre>\r\n<p>I get an error message, probably security on listening to port 80 by a non-root user, I quickly tried to fix this with ipfw but it is not on my machine and with iptables, I had nothing more satisfactory. It is rather ugly and unadvised, but as my Ec2 instance will not remain in production, I launch a:<\/p>\r\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">sudo .\/gophish<\/pre>\r\n<p>All right, my GoPhish is launched\u00a0<\/p>\r\n<p>in the text of the command line, I retrieve the password given to me on the line<\/p>\r\n<pre>Please login with the username admin and the password xxx<\/pre>\r\n<h2><span class=\"ez-toc-section\" id=\"Je_souhaite_utiliser_Gophish_sans_garder_ma_fenetre_SSH_ouverte_facultatif\"><\/span>I want to use Gophish without keeping my SSH window open (optional)<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>I add this paragraph here for more consistency but it can be run later when Gophish will work manually.<\/p>\r\n<h4><span class=\"ez-toc-section\" id=\"Jautorise_le_lancement_de_Gophish_sans_etre_root_sudo\"><\/span>I authorise the launch of Gophish without being root (sudo)<span class=\"ez-toc-section-end\"><\/span><\/h4>\r\n<p>To avoid having to use a command <strong>sudo<\/strong> to launch Gophish, I will authorise the user <strong>ubuntu<\/strong> to interact on port 80 which is a privileged port. Indeed the order <strong>cap_net _bind _service<\/strong> allows this executable (gophish) to link network sockets to ports with a number less than or equal to 1024, even if it is not run as a root user.<\/p>\r\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">sudo setcap 'cap_net _bind _service=+ep' \/home\/ubuntu\/gophish\/gophish<\/pre>\r\n<p>Thus, from now on, no need to type sudo to launch gophish, the command can be:<\/p>\r\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">.\/gophish<\/pre>\r\n<h4 class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\"><span class=\"ez-toc-section\" id=\"Message_derreur_open_gophish_adminkey_permission_denied\"><\/span><br \/>Open gophish_admin.key error message:\u00a0permission denied<span class=\"ez-toc-section-end\"><\/span><\/h4>\r\n<p>If this error message appears, you must change the permissions of the gophish_admin.key file<\/p>\r\n<p>Here are the orders:<\/p>\r\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">cd ~\/gophish ls -l gophish_admin.key sudo chmod 644 gophish_admin.key sudo chown ubuntu:ubuntu gophish_admin.key ls -l gophish_admin.key .\/gophish\r\n<\/pre>\r\n<p>\u00a0<\/p>\r\n<h4><span class=\"ez-toc-section\" id=\"Je_declare_gophish_comme_un_service\"><\/span>I declare gophish as a service<span class=\"ez-toc-section-end\"><\/span><\/h4>\r\n<p>I'll add a file <strong>gophish.service<\/strong> in \/etc\/systemd\/system\/gophish.service<\/p>\r\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">[Unit] Description=GoPhish Service After=network.target [Service] ExecStart=\/home\/ubuntu\/gophish\/gophish Type=simple PIDFile=\/var\/run\/gophish User=ubuntu WorkingDirectory=\/home\/ubuntu\/gophish [Install] WantedBy=default.target<\/pre>\r\n<p>In order not to have to type everything, I put this on a gist, to retrieve it directly:<\/p>\r\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">sudo wget https:\/\/gist.githubusercontent.com\/sigalou\/267349eada979e07c99dc5944253169c\/raw\/e5d8769bb86b40e15ad0c4631629d575e440199a\/gophish.service -O \/etc\/systemd\/system\/gophish.service<\/pre>\r\n<p>This can be tested by:<\/p>\r\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\">sudo systemctl daemon-reload sudo systemctl enable gophish sudo systemctl start gophish sudo systemctl status gophish<\/pre>\r\n<p>I relaunch my body, it\u2019s okay, Gophish starts automatically.<\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Je_lance_GoPhish\"><\/span>I'm launching GoPhish.<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>Back in my browser, I note the elastic ip or public ip of the instance, I paste this address followed by:8531 which is the port defined above<\/p>\r\n<p>So I go for example to https:\/\/13.36.81.72:8531<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter  wp-image-6603\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go1.png\" alt=\"\" width=\"243\" height=\"253\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go1.png 456w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go1-289x300.png 289w\" sizes=\"auto, (max-width: 243px) 100vw, 243px\" \/><\/a><\/p>\r\n<p>Here we use \"admin\" and the password recorded on the command line at the time of launch. Immediately GoPhish asks to change the password and we are connected to GoPhish.<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter  wp-image-6604\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go2.png\" alt=\"\" width=\"582\" height=\"268\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go2.png 1395w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go2-600x277.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go2-300x138.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go2-1024x472.png 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go2-768x354.png 768w\" sizes=\"auto, (max-width: 582px) 100vw, 582px\" \/><\/a><\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Jajoute_un_utilisateur_%C2%AB_piegeur_%C2%BB_sur_le_Tenant_365\"><\/span>I am adding a \u2018trapper\u2019 user to the Tenant 365<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>By logging in as an administrator with the right to manage users, I add a new user.<\/p>\r\n<p>I chose to use a user I make up as if it were an official account of Microsoft Account Management.<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6607\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-1.png\" alt=\"\" width=\"742\" height=\"288\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-1.png 742w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-1-600x233.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-1-300x116.png 300w\" sizes=\"auto, (max-width: 742px) 100vw, 742px\" \/><\/a><\/p>\r\n<p>I even put a nice logo on him that's serious.<\/p>\r\n<p>Of course, I assign him a licence that allows him to have an email account and then I go to the <strong>Mail<\/strong> of this user then<strong> Mail Software<\/strong> and I will check at least the box <strong>Authenticated SMTP<\/strong>.<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter  wp-image-6608\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-2.png\" alt=\"\" width=\"462\" height=\"284\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-2.png 711w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-2-600x369.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-2-300x184.png 300w\" sizes=\"auto, (max-width: 462px) 100vw, 462px\" \/><\/a><\/p>\r\n<p>(Optional) To make my life easier and not have to add this box to the letter, I put a transfer of all the emails received on this box to my email address in Mail\/Transfer mail.<\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Je_configure_Microsoft_Defender_pour_autoriser_GoPhish\"><\/span>I configure Microsoft Defender to allow GoPhish<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>Microsoft has planned everything. They thought of offering an educational phishing campaign (Defender Plan 2 license) on a paid license, but they also thought of moneyless hackers by allowing them to manually authorize this.<\/p>\r\n<p>I'm throwing <a href=\"https:\/\/security.microsoft.com\/\" target=\"_blank\" rel=\"noopener\">Microsoft Defender<\/a>.<\/p>\r\n<p>Then <strong>Strategies and rules<\/strong><\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-3.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6609\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-3.png\" alt=\"\" width=\"295\" height=\"127\" \/><\/a><\/p>\r\n<p>Then <strong>Threat Strategies\/Advanced Discount<\/strong><\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-4.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter  wp-image-6610\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-4.png\" alt=\"\" width=\"486\" height=\"345\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-4.png 1008w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-4-600x426.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-4-300x213.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-4-768x545.png 768w\" sizes=\"auto, (max-width: 486px) 100vw, 486px\" \/><\/a><\/p>\r\n<p>And finally Tab <strong>Phishing simulation<\/strong><\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-5.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6611\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-5.png\" alt=\"\" width=\"520\" height=\"228\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-5.png 520w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-5-300x132.png 300w\" sizes=\"auto, (max-width: 520px) 100vw, 520px\" \/><\/a><\/p>\r\n<p>Thank you Sigalou!!! We had to find this tab\u00a0<\/p>\r\n<p>Then you have to configure the <strong>field<\/strong> and <strong>the PI<\/strong>.<\/p>\r\n<p>The domain is the address of the domain that will send the email, this corresponds to the domain of SMTP From that I will specify in GoPhish.<\/p>\r\n<p>The IP is the elastic or public IP of the instance.<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-6.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6612\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-6.png\" alt=\"\" width=\"547\" height=\"372\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-6.png 547w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/365-6-300x204.png 300w\" sizes=\"auto, (max-width: 547px) 100vw, 547px\" \/><\/a><\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Je_configure_le_SMTP_de_GoPhish\"><\/span>I configure GoPhish SMTP<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6613\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-1.png\" alt=\"\" width=\"787\" height=\"396\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-1.png 787w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-1-600x302.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-1-300x151.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-1-768x386.png 768w\" sizes=\"auto, (max-width: 787px) 100vw, 787px\" \/><\/a><\/p>\r\n<p>Back in GoPhish, I'm going to <strong>Sending Profiles<\/strong> and I will create a profile for sending messages:<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6614\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-2.png\" alt=\"\" width=\"704\" height=\"647\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-2.png 704w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-2-600x551.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-2-300x276.png 300w\" sizes=\"auto, (max-width: 704px) 100vw, 704px\" \/><\/a><\/p>\r\n<p>Thanks to the button <strong>Send Test Email<\/strong>, I can check that everything works perfectly, I get a message<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-3.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6615\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-3.png\" alt=\"\" width=\"683\" height=\"90\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-3.png 683w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-3-600x79.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-3-300x40.png 300w\" sizes=\"auto, (max-width: 683px) 100vw, 683px\" \/><\/a><\/p>\r\n<p>At this stage, it is already a very good personal victory, I have been able to configure a virtual machine, install GoPhish, configure it, find out how not to get stuck by Microsoft\u2019s security by allowing this manipulation and win \u2026 the test email arrives!!! For those who are discovering my RetEx, don\u2019t imagine that it took time to write this page, it\u2019s hours of manip (and learning).<\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Je_vais_recuperer_tous_les_utilisateurs_du_Tenant_Microsoft_365\"><\/span>I will recover all users of the Tenant Microsoft 365<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>Two ways to recover users, the simplest with the graphical interface of the M365 administration center, otherwise this can be done with a powershell command.<\/p>\r\n<p>I'm not going to explain this second way of doing things, <a href=\"https:\/\/www.it-connect.fr\/author\/florian\/\" target=\"_blank\" rel=\"noopener\">Florian<\/a> explained it on its <a href=\"https:\/\/www.it-connect.fr\/comment-creer-une-campagne-de-phishing-avec-gophish\/#A_Creation_des_utilisateurs_et_des_groupes\" target=\"_blank\" rel=\"noopener\">excellent tutorial<\/a>.<\/p>\r\n<p>I take the simplest formula, go to the administration panel and then <strong>Active users<\/strong> then <strong>Export users<\/strong>.<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-10.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6627\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-10.png\" alt=\"\" width=\"1382\" height=\"234\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-10.png 1382w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-10-600x102.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-10-300x51.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-10-1024x173.png 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-10-768x130.png 768w\" sizes=\"auto, (max-width: 1382px) 100vw, 1382px\" \/><\/a><\/p>\r\n<p>The export is going well, I work a bit on the file in Excel to remove unnecessary columns and rows that are not users. So I have a perfect Excel file with 4 columns, I start a CSV record with a comma in separator to be able to import into GoPhish.<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-11-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6629\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-11-1.png\" alt=\"\" width=\"686\" height=\"127\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-11-1.png 686w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-11-1-600x111.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-11-1-300x56.png 300w\" sizes=\"auto, (max-width: 686px) 100vw, 686px\" \/><\/a><\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Jinjecte_les_utilisateurs_dans_un_groupe_GoPhish\"><\/span>I inject users into a GoPhish group<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-4.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter  wp-image-6618\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-4.png\" alt=\"\" width=\"513\" height=\"243\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-4.png 756w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-4-600x284.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-4-300x142.png 300w\" sizes=\"auto, (max-width: 513px) 100vw, 513px\" \/><\/a><\/p>\r\n<p>I add a new group, I start importing my CSV file.<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-12.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6631\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-12.png\" alt=\"\" width=\"650\" height=\"93\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-12.png 650w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-12-600x86.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-12-300x43.png 300w\" sizes=\"auto, (max-width: 650px) 100vw, 650px\" \/><\/a><\/p>\r\n<p>I now have a new group ready!<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-13.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6632\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-13.png\" alt=\"\" width=\"597\" height=\"213\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-13.png 597w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-13-300x107.png 300w\" sizes=\"auto, (max-width: 597px) 100vw, 597px\" \/><\/a><\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Je_configure_le_mail_de_phishing\"><\/span>I configure the phishing mail<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-5.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter  wp-image-6622\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-5.png\" alt=\"\" width=\"527\" height=\"229\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-5.png 920w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-5-600x261.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-5-300x130.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-5-768x334.png 768w\" sizes=\"auto, (max-width: 527px) 100vw, 527px\" \/><\/a><\/p>\r\n<p>This is the email that the recipients of the campaign will receive.<\/p>\r\n<p>To do this, I asked Microsoft to send me a message, so I kept the message format. In the end, this gives:<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-6.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6623\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-6.png\" alt=\"\" width=\"1187\" height=\"646\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-6.png 1187w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-6-600x327.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-6-300x163.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-6-1024x557.png 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-6-768x418.png 768w\" sizes=\"auto, (max-width: 1187px) 100vw, 1187px\" \/><\/a><\/p>\r\n<p>I would point out that it is pedagogical, do not ask me the HTML code of the page, I consider that it is up to everyone to do the work.<\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Je_configure_la_page_de_hameconnage\"><\/span>I configure the phishing page<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-7.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter  wp-image-6624\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-7.png\" alt=\"\" width=\"506\" height=\"215\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-7.png 933w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-7-600x255.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-7-300x128.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-7-768x327.png 768w\" sizes=\"auto, (max-width: 506px) 100vw, 506px\" \/><\/a><\/p>\r\n<p>Called Landing page, this phishing page is the page on which the user you want to trap will land when they click on the link offered to them in the email they received.<\/p>\r\n<p>I went looking for models not to reinvent hot water (thanks souleiman)<\/p>\r\n<p>Here is the best link I could use to make the M365 login page as realistic as possible.<\/p>\r\n<ul>\r\n<li><a href=\"https:\/\/github.com\/brunobotelhobr\/My-Gophish-Templates\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/brunobotelhobr\/My-Gophish-Templates<\/a><\/li>\r\n<\/ul>\r\n<p>I am thinking of the end of the configuration of the landing page to check the recovery of the email and password. I have the idea of being able to display the first two characters, for example, and the last of the \u2018stolen\u2019 passwords during user training\/awareness-raising. Note that the recovered passwords are given in clear, so I will trigger a change of all passwords of all users a few days after the educational phishing campaign.<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-9.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6626\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-9.png\" alt=\"\" width=\"700\" height=\"337\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-9.png 700w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-9-600x289.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-9-300x144.png 300w\" sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/a><\/p>\r\n<p>When the user clicks on the link <span style=\"text-decoration: underline;\">reconnect<\/span> or on the blue button Reconnect, it lands on:<\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-8.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6625\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-8.png\" alt=\"\" width=\"1374\" height=\"690\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-8.png 1374w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-8-600x301.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-8-300x151.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-8-1024x514.png 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-8-768x386.png 768w\" sizes=\"auto, (max-width: 1374px) 100vw, 1374px\" \/><\/a><\/p>\r\n<p>Do not ask me for the HTML code of this page.<\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Je_lance_la_campagne_dhameconnage\"><\/span>I launch the phishing campaign<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>To sum up, I have created a user group, an email template, a phishing page, so I can go to Campaigns to launch the campaign.<br \/><br \/><\/p>\r\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-14.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6636\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-14.png\" alt=\"\" width=\"705\" height=\"777\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-14.png 705w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-14-600x661.png 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/go-14-272x300.png 272w\" sizes=\"auto, (max-width: 705px) 100vw, 705px\" \/><\/a><\/p>\r\n<p>When I press Launch Campaign, emails leave \u2026<\/p>\r\n<p><a style=\"display: inline !important;\" href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/61464919-mise-en-page-de-conception-de-vecteur-creatif-abstrait-avec-texte-attendre-et-voir-arriere-plan.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-6637\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/61464919-mise-en-page-de-conception-de-vecteur-creatif-abstrait-avec-texte-attendre-et-voir-arriere-plan.jpg\" alt=\"\" width=\"191\" height=\"191\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/61464919-mise-en-page-de-conception-de-vecteur-creatif-abstrait-avec-texte-attendre-et-voir-arriere-plan.jpg 1300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/61464919-mise-en-page-de-conception-de-vecteur-creatif-abstrait-avec-texte-attendre-et-voir-arriere-plan-300x300.jpg 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/61464919-mise-en-page-de-conception-de-vecteur-creatif-abstrait-avec-texte-attendre-et-voir-arriere-plan-100x100.jpg 100w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/61464919-mise-en-page-de-conception-de-vecteur-creatif-abstrait-avec-texte-attendre-et-voir-arriere-plan-600x600.jpg 600w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/61464919-mise-en-page-de-conception-de-vecteur-creatif-abstrait-avec-texte-attendre-et-voir-arriere-plan-1024x1024.jpg 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/61464919-mise-en-page-de-conception-de-vecteur-creatif-abstrait-avec-texte-attendre-et-voir-arriere-plan-150x150.jpg 150w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2024\/04\/61464919-mise-en-page-de-conception-de-vecteur-creatif-abstrait-avec-texte-attendre-et-voir-arriere-plan-768x768.jpg 768w\" sizes=\"auto, (max-width: 191px) 100vw, 191px\" \/><\/a><\/p>\r\n<div class=\"mceTemp\">\u00a0<\/div>\r\n<p>I'll be back in a while to give news of the campaign here \u2026<\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Bibliographie\"><\/span>Bibliography<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<ul>\r\n<li><a href=\"https:\/\/www.it-connect.fr\/comment-creer-une-campagne-de-phishing-avec-gophish\" target=\"_blank\" rel=\"noopener\">https:\/\/www.it-connect.fr\/comment-creer-une-campagne-de-phishing-avec-gophish<\/a><\/li>\r\n<li><a href=\"https:\/\/dazzyddos.github.io\/posts\/Automating-Phishing-Infrastructure-with-terraform-on-AWS\/\" target=\"_blank\" rel=\"noopener\">https:\/\/dazzyddos.github.io\/posts\/Automating-Phishing-Infrastructure-with-terraform-on-AWS\/<\/a><\/li>\r\n<li><a href=\"https:\/\/clement-bouder.fr\/Creer-une-infrastructure-de-phishing\/\" target=\"_blank\" rel=\"noopener\">https:\/\/clement-bouder.fr\/Creer-une-infrastructure-de-phishing\/<\/a><\/li>\r\n<li><a href=\"https:\/\/www.youtube.com\/watch?v=Tdpzi8M3Vtw\" target=\"_blank\" rel=\"noopener\">https:\/\/www.youtube.com\/watch?v=Tdpzi8M3Vtw<\/a><\/li>\r\n<li><a href=\"https:\/\/medium.com\/@immure\/setting-up-gophish-on-aws-c2f2fd78b7e9\" target=\"_blank\" rel=\"noopener\">https:\/\/medium.com\/@immure\/setting-up-gophish-on-aws-c2f2fd78b7e9<\/a><\/li>\r\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>My goal In order to raise awareness among users of the Microsoft 365 tenant I use, I looked at how to create a phishing campaign to \u2018trap\u2019 them and trigger training on this topic. Prevention messages and digital hygiene campaigns are not enough, it takes a concrete fact to try to trigger a catch [\u2026]<\/p>","protected":false},"author":1,"featured_media":6746,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[70,166],"tags":[50,73],"class_list":["post-6547","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurite","category-retex","tag-50","tag-gophish"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts\/6547","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/comments?post=6547"}],"version-history":[{"count":0,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts\/6547\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/media\/6746"}],"wp:attachment":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/media?parent=6547"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/categories?post=6547"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/tags?post=6547"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}