{"id":701,"date":"2025-12-05T20:35:00","date_gmt":"2025-12-05T20:35:00","guid":{"rendered":"https:\/\/zombierollz.blog\/?p=701"},"modified":"2025-12-05T14:36:19","modified_gmt":"2025-12-05T14:36:19","slug":"aoc2025-room-2-phishing-merry-clickmas","status":"publish","type":"post","link":"https:\/\/zombierollz.blog\/?p=701","title":{"rendered":"AoC2025 Room 2 Phishing Merry Clickmas"},"content":{"rendered":"\n

https:\/\/tryhackme.com\/room\/phishing-aoc2025-h2tkye9fzU
Created by: tryhackme, strategos, Fontaene, Aashir.Masood<\/p>\n\n\n\n

“In light of several recent cyber security threats against The Best Festival Company (TBFC), the local red team has scheduled several penetration tests. The red teamers proceeded to carry out a regular penetration test against their TBFC. Part of this exercise is to ensure that the employees are diligent when clicking links and that the company is well protected against the latest phishing attacks. This type of authorised phishing is a proven way to learn whether the cyber security awareness training has fruited.”<\/p>\n\n\n\n

Day 2 of the AOC event! It looks like we are going to be doing some phishing today as the red team. This task goes over the S.T.O.P method for phishing emails. THM links to the website: https:\/\/www.allthingssecured.com\/tips\/email-phishing-scams-stop-method\/<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

THM has already made us a python script(it ends in .py) to use as the red team.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Our phony login page that we will send to the other elves to test their S.T.O.P mindset.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Next up, we get to use the Social-Engineer Toolkit (SET), a really fun open source tool designed by David Kennedy. Start a new terminal and go to ~ by using cd ~.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

We are doing options 1 > 5 > 1 and then doing as THM instructs.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Once you finish, switch back to the other terminal where you started your listener script. You will notice that our phishing email went through, and someone entered something on our fake site. I ended up having to do the steps 2 times because the first time, I waited 5 minutes, and it never populated the username and password, only GET messages, just FYI.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

With that, we got our first answer!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now we are tasked with going to the address given and logging in as the factory user with our newly obtained password to see how many toys are shipping out.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

We also get to see our constructed emails that we sent out to obtain the username and password.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Overall, a fun room that showcases phishing campaigns, the Social-Engineer Toolkit (SET), and also the power of social engineering. <\/p>\n","protected":false},"excerpt":{"rendered":"

https:\/\/tryhackme.com\/room\/phishing-aoc2025-h2tkye9fzUCreated by: tryhackme, strategos, Fontaene, Aashir.Masood “In light of several recent cyber security threats against The Best Festival Company (TBFC), the local red team has scheduled several penetration tests. The red teamers proceeded to carry out a regular penetration test against their TBFC. Part of this exercise is to ensure that the employees are diligent […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-701","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=701"}],"version-history":[{"count":2,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/701\/revisions"}],"predecessor-version":[{"id":713,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/701\/revisions\/713"}],"wp:attachment":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}