Need advise for our company experiment. We are planning to observe the security awareness among our staff. I have an idea but lacking of knowledge on how to do it. I want to create spoofed email and send one .doc file inside the email. That .doc file will return the IP address if our staff click to open the file. From this we can see in our company how many users are not aware with security threat and we will educate them later on. Because we are using firewall, can it be done from external IP as well? Your help and idea are really appreciated.
It sounds like what you're attempting to do is a phishing campaign on your company network. While you have a good idea with the
.doc file, the implementation would be way too messy. You could do this with Macros, but there will be a ton of pop ups asking the user to enable macros and confirm that its dangerous etc. Ultimately, I think most of the employees would get scared off by it. You could dig a little deeper and use msfvenom to embed malware in a file, but now you're physically exploiting the machine of every user in the company who clicks on it which is also a bad idea. If you have any company resources that require login with company credentials, I would recommend sending out a verbatim copy of an email that would be generated by that service requesting action by the user by clicking on a link (make sure the link is not from the company url otherwise they will trust it and defeats the purpose of making them look before clicking). Have the URL redirect to a web server (could probably do this internally with DNS without buying the domain) displaying a copy of a login page they are familiar with, and then redirect to a "You've been caught" page. Based on the login info, you can determine who was caught.
In the interest of security, I recommend NOT logging any of the passwords on the web server and including a snippet in the "You've been caught" page instructing them to change their password immediately. Best practice would be to ensure the web form doesn't even send the password or replaces it with random text before sending over the network.
To address your firewall question, I would advise not doing any part of this outside the company network if at all possible. That would increase the chances of information being intercepted by malicious actors. In the event any of this traffic does go out network, that will depend on the ACLs but most HTTP traffic is not very restricted.
Most importantly, make sure to hold a meeting after the fishing campaign so that you can explain to the employees what happened, how to look out for it, and what to do if it happens again.
If you are concerned about deceiving users that are using their machine out of network, I would recommend using a registered domain name with TLS directed to a webserver owned by your company and hosted on the company domain. By default, the ACLs will probably not allow for HTTP traffic to just any machine from the internet. If the webserver is in a datacenter, it could be more likely. You will have to work with the NetOps, team or whoever is in charge of the network ACLs to confirm this.