qsecure-labs / overlord

Overlord - Red Teaming Infrastructure Automation
https://blog.qsecure.com.cy/posts/overlord/
MIT License
608 stars 74 forks source link

gophish deploy #6

Closed mkannan22 closed 3 years ago

mkannan22 commented 3 years ago

Ran overlord.py set aws access and secret keys set provider aws set region used gophish module everything seem to deploy correctly in aws (can see ec2 instance and security rules). However, when loading the IP address of the gophish server it just times out. Tried port 3333, http https, but nothing loads. Do I have to deploy something else first?

V4K11 commented 3 years ago

Hello @mkannan22, no you don't need to deploy anything else. Gophish can be deployed as a standalone module. We have just tried one with default config and it works. By default the FW rules which are created by Overlord will allow the access to 3333 only to the public IP address where the infrastructure was deployed from. From there and by using HTTPS you should be able to see the Gophish web application.

mkannan22 commented 3 years ago

usemodule gophish set provider aws set region us-east-1 set redirectors 0 add create deploy I see instance running in AWS, but when opening in browser it doesn't load. I noticed a new external IP address created for the gophish EC2 instance with rules allowing 3333 on the external IP i initially ran overlord on. I then went ahead and applied the same rules to the new external IP on the gophish AWS EC2 instance without success.

mkannan22 commented 3 years ago

Getting closer. I deleted everything in AWS and deployed from local machine. However, the password for gophish message after deploying says, you can find the auto-generated Gophish admin password at /opt/goapps/src/github.com/gophish/password.txt, but that file does not exist.

V4K11 commented 3 years ago

Yes, you are right the location has been changed to /opt/gophish/password.txt. To see this file you have to connect via ssh to the newly deployed system (not on the local machine).

mkannan22 commented 3 years ago

Got it. Working now. Thank you for clarification.