#!/usr/bin/python ######################################### # # The Social-Engineer Toolkit # Written by: David Kennedy (ReL1K) # Email: davek@social-engineer.org # ######################################### import subprocess,os,time,re,sys,socket ######################################### # ROOT CHECK if os.geteuid() != 0: print "\nThe Social-Engineer Toolkit (SET) - by David Kennedy (ReL1K)" print "\nNot running as root. \n\nExiting the Social-Engineer Toolkit (SET).\n" sys.exit(1) # Check for Pexpect try: import pexpect except: print "Error!!! PExpect is required in order to fully run SET" print "Please download and install PExpect: http://sourceforge.net/projects/pexpect/files/pexpect/Release%202.3/pexpect-2.3.tar.gz/download" print "Would you like SET to attempt to install it for you?" answer=raw_input("Yes or no: ") if answer == "yes" or answer == "y": print "[*] Installing Pexpect" subprocess.Popen("wget http://downloads.sourceforge.net/project/pexpect/pexpect/Release%202.3/pexpect-2.3.tar.gz?use_mirror=hivelocity;tar -zxvf pexpect-2.3.tar.gz;cd pexpect-2.3/;python setup.py install", shell=True).wait() print "[*] Finished... Relaunch SET, if it doesn't work you, install manually." sys.exit(1) if answer == "no" or answer == 'n': sys.exit(1) else: print "Invalid response, exiting the Social-Engineer Toolkit.." sys.exit(1) # try import for BeautifulSoup, required for MLITM try: import BeautifulSoup except: print "Error!!! BeautifulSoup is required in order to fully run SET" print "Please download and install BeautifulSoup: http://www.crummy.com/software/BeautifulSoup/download/3.x/BeautifulSoup-3.0.8.1.tar.gz" print "Would you like SET to attempt to install it for you?" answer=raw_input("Yes or no: ") if answer == "yes" or answer == "y": print "[*] Installing BeautifulSoup..." subprocess.Popen("wget http://www.crummy.com/software/BeautifulSoup/download/3.x/BeautifulSoup-3.0.8.1.tar.gz;tar -zxvf BeautifulSoup-3.0.8.1.tar.gz;cd BeautifulSoup-*;python setup.py install", shell=True).wait() print "[*] Finished... Relaunch SET, if it doesn't work for you, install manually." sys.exit(1) if answer == "no" or answer == "n": sys.exit() else: print "Invalid response, exiting the Social-Engineer Toolkit.." sys.exit(1) # Define colors class bcolors: PURPLE = '\033[95m' BLUE = '\033[94m' GREEN = '\033[92m' YELLOW = '\033[93m' RED = '\033[91m' PINK = '\033[95m' ENDC = '\033[0m' def disable(self): self.PURPLE = '' self.BLUE = '' self.GREEN = '' self.YELLOW = '' self.RED = '' self.PINK = '' self.ENDC = '' # Pull version information here define_version=file("src/version", "r").readline() define_version=define_version.rstrip() # Cleanup from prior use subprocess.Popen("rm src/program_junk/interfaces 1> /dev/null 2> /dev/null;rm src/html/*.exe 1> /dev/null 2> /dev/null;rm src/html/msf.exe 1> /dev/null 2> /dev/null;rm src/html/1msf.raw 1> /dev/null 2> /dev/null;rm src/html/2msf.raw 1> /dev/null 2> /dev/null;rm msf.exe 1> /dev/null 2> /dev/null;rm src/program_junk/* 1> /dev/null 2> /dev/null;rm src/html/unsigned/Signed_Update.jar 1> /dev/null 2> /dev/null;rm src/html/unsigned/mykeystore 1> /dev/null 2> /dev/null;rm src/html/index.html 1> /dev/null 2> /dev/null;rm src/html/1msf.exe 1> /dev/null 2> /dev/null;rm src/html/msf.exe 1> /dev/null 2> /dev/null;rm src/html/nix.bin 1> /dev/null 2> /dev/null;rm src/html/mac.bin 1> /dev/null 2> /dev/null;rm -rf src/program_junk/* 1> /dev/null 2> /dev/null;rm -rf src/web_clone/site/* 1> /dev/null 2> /dev/null;rm src/html/1msf.exe 1> /dev/null 2> /dev/null;rm src/html/msf.exe 1> /dev/null 2> /dev/null;rm src/html/index.html 1> /dev/null 2> /dev/null", shell=True).wait() # Restore Original Java Applet subprocess.Popen("cp src/html/Signed_Update.jar.orig src/html/Signed_Update.jar 1> /dev/null 2> /dev/null", shell=True).wait() ####################################### # Initial Menu Loader ####################################### sys.path.append("src/menu") import menu sys.path.append("../") try: while 1: # show welcome banner print bcolors.BLUE + """ [---] The Social-Engineer Toolkit ("""+bcolors.YELLOW+"""SET"""+bcolors.BLUE+""") [---] [---] Written by David Kennedy ("""+bcolors.YELLOW+"""ReL1K"""+bcolors.BLUE+""") [---] [---] Version: """+bcolors.RED+"""%s""" % (define_version) +bcolors.BLUE+""" [---] [---] Codename: '""" + bcolors.YELLOW + """Arnold Palmer""" + bcolors.BLUE + """' [---] [---] Report """ + bcolors.RED +"""bugs""" + bcolors.BLUE + """ to:"""+ bcolors.GREEN + """ davek@social-engineer.org """ + bcolors.BLUE+"""[---] [---] """ + bcolors.BLUE + """ Java Applet Written by: """+bcolors.RED+"""Thomas Werth"""+bcolors.BLUE+""" [---] [---] Homepage: """ + bcolors.YELLOW + """http://www.secmaniac.com"""+bcolors.BLUE+""" [---] [---] Framework: """ + bcolors.YELLOW + """http://www.social-engineer.org"""+bcolors.BLUE+""" [---] [---] """+bcolors.RED+"""Over 1 million downloads and counting."""+bcolors.BLUE+""" [---] """+bcolors.GREEN+""" Welcome to the Social-Engineer Toolkit (SET). Your one stop shop for all of your social-engineering needs.. """ + bcolors.BLUE + """\n Follow me on Twitter: """+bcolors.RED+"""dave_rel1k\n"""+bcolors.ENDC print bcolors.ENDC + """Select from the menu on what you would like to do: 1. Spear-Phishing Attack Vectors 2. Website Attack Vectors 3. Infectious Media Generator 4. Create a Payload and Listener 5. Mass Mailer Attack 6. Teensy USB HID Attack Vector 7 Update the Metasploit Framework 8. Update the Social-Engineer Toolkit 9. Help, Credits, and About 10. Exit the Social-Engineer Toolkit """ choice=raw_input("Enter your choice: ") if choice == '1': while 1: print (""" Welcome to the SET E-Mail attack method. This module allows you to specially craft email messages and send them to a large (or small) number of people with attached fileformat malicious payloads. If you want to spoof your email address, be sure "Sendmail" is installed (it is installed in BT4) and change the config/set_config SENDMAIL=OFF flag to SENDMAIL=ON. There are two options, one is getting your feet wet and letting SET do everything for you (option 1), the second is to create your own FileFormat payload and use it in your own attack. Either way, good luck and enjoy! 1. Perform a Mass Email Attack 2. Create a FileFormat Payload 3. Create a Social-Engineering Template 4. Return to Main Menu """) choice1=raw_input("Enter your choice: ") if choice1 == '1': sys.path.append("src/msf_attacks/") try: reload("create_payload") except: pass import create_payload sys.path.append("src/smtp/client/") try: reload(smtp_client) except: import smtp_client if choice1 == '2': sys.path.append("src/msf_attacks/") try: reload(create_payload) except: import create_payload if choice1 == '3': sys.path.append("src/smtp/client/") try: reload(custom_template) except: import custom_template if choice1 == '4': break ##################### # Start Web Attack ##################### if choice == '2': while 1: print (""" The Social-Engineer Toolkit "Web Attack" vector is a unique way of utilizing multiple web-based attacks in order to compromise the intended victim. """) attack_vector=raw_input(""" Enter what type of attack you would like to utilize. The Java Applet attack will spoof a Java Certificate and deliver a metasploit based payload. Uses a customized java applet created by Thomas Werth to deliver the payload. The Metasploit browser exploit method will utilize select Metasploit browser exploits through an iframe and deliver a Metasploit payload. The Credential Harvester Method will utilize web cloning of a website that has a username and password field and harvest all the information posted to the website. The TabNabbing Method will wait for a user to move to a different tab, then refresh the page to something different. The Man Left in the Middle Attack Method was introduced by Kos and utilizes HTTP REFERER's in order to intercept fields and harvest data from them. You need to have an already vulnerable site and incorporate