tatanus / SPF

SpeedPhishing Framework
Other
436 stars 134 forks source link

issue sending emails #23

Open jwd67 opened 6 years ago

jwd67 commented 6 years ago

I am having an issue sending the emails. I am using the default.cfg. Should I change some of the default values for the SMTP server?

tatanus commented 6 years ago

short answer is YES/Maybe.

First, are you specifying the "-s" option when you run SPF? The "-s" option for to tell SPF to send emails. Additionally, have you allowed SPF to start any webservices/websites? In its current configuration, SPF requires there to be a web site started before it will send the emails. This can be accomplished by using the "-w" flag.

Now, if you have done those things and still no luck, try this...

if you take a look at default.cfg, you will see the following section:

[SMTP] DETERMINE_SMTP: 1 USE_SPECIFIC_SMTP: 0 SMTP_SERVER: 1.1.1.1 SMTP_USER: XXXX SMTP_PASS: XXXX SMTP_FROMADDR: support@example.com SMTP_DISPLAYNAME: SUPPORT SMTP_PORT: 25

Now you have to decide how you want SPF to send the emails. It is configured by default to attempt to connect to and send the emails directly to the target's SMTP server. This will usually work, but not in every case. You can specify a SMTP server to use if you wish.. something like "smtp.com". All you have to do is change "DETERMINE_SMTP" to 0 and set "USE_SPECIFIC_SMTP" to 1 then update "SMTP_SERVER", "SMTP_USER", and "SMTP_PASS" as needed.

Let me know if none of this works for you.

jwd67 commented 6 years ago

I ended up having to edit the code in emails.py to get it to work even after trying to set the variables in the default.config.

One more thing that would be a nice enhancement is to further obfuscate the text of the hyperlink that is displayed to the end user in the email message vs what the link is in the a href tag. Is there a way to accomplish that - and if not easy to do what code module should I look to change so I can alter [TARGET]?


From: Adam

short answer is YES/Maybe.

First, are you specifying the "-s" option when you run SPF? The "-s" option for to tell SPF to send emails. Additionally, have you allowed SPF to start any webservices/websites? In its current configuration, SPF requires there to be a web site started before it will send the emails. This can be accomplished by using the "-w" flag.

Now, if you have done those things and still no luck, try this...

if you take a look at default.cfg, you will see the following section:

[SMTP] DETERMINE_SMTP: 1 USE_SPECIFIC_SMTP: 0 SMTP_SERVER: 1.1.1.1 SMTP_USER: XXXX SMTP_PASS: XXXX SMTP_FROMADDR: support@example.commailto:support@example.com SMTP_DISPLAYNAME: SUPPORT SMTP_PORT: 25

Now you have to decide how you want SPF to send the emails. It is configured by default to attempt to connect to and send the emails directly to the target's SMTP server. This will usually work, but not in every case. You can specify a SMTP server to use if you wish.. something like "smtp.com". All you have to do is change "DETERMINE_SMTP" to 0 and set "USE_SPECIFIC_SMTP" to 1 then update "SMTP_SERVER", "SMTP_USER", and "SMTP_PASS" as needed.

Let me know if none of this works for you.

tatanus commented 6 years ago

1) can you tell me what you changed in emails.py to get it to work for you? possibly a PULL REQUEST?

2) I do not think the link can be changed currently via any standard mechanism. If you want to change it in the code, it would be somewhat difficult to do it in a way that is still dynamic and universal. But if you wish to take a look, it would in around line 885 and 893 of spf/core/framework.py

jwd67 commented 6 years ago

Item 1 - I had to delete all of the SMTP checks prior to the section that does the sending of the email.

Item 2 - I will take a look at the code you suggested to see if there's anything that can be done...

Thanks for the quick feedback!!!

tatanus commented 6 years ago

What do you mean, "...had to delete all of the SMTP checks prior...". what checks and and in which section. There are 3 different functions that can send emails. which of the three was this in?

jwd67 commented 6 years ago

I believe in emails.py there appear to be tests near the top of the code that try to detect the remote email server (depending on the settings in the default.config) and then there is code to try to use the email server you specify in the default.config file. For some reason, I was not getting past the remote server test, so I got rid of that code first. Then I also deleted the section that pulls the smtp server settings from default.config. I then hardcoded the smtp settings in the code that remained and then it worked as expected. I'm not sure the reason I had to delete the section that pulls the smtp settings from the default.config file, I am thinking it might had to do with the fact I was using an IP Address for the SMTP server rather than a fully qualified domain name. Again, I'm not sure what the issue was, I just know removing those 2 sections and hardcoding the SMTP settings directly in emails.py allowed the emails to be sent successfully...

I haven't had a chance to look at the [TARGET] code you pointed me to.

Hope this helps.

tatanus commented 6 years ago

thank you for your response. I will look into this and see if I can see a way to accommodate situations like your and see if there is a way to clean it all up.