you started out good to go okay guys we're gonna go and get started
uh this is outlook exchange the bad guys
so you're in the wrong room now would be the time a little starter about myself
my name is Nick Landers monarchs gas on twitter my handle
I'm a security consultant security i am with the work in the volume where I'm
from Salt Lake City Utah i actually grew up in Utah still live there today as for
the company's out of I've been hacking for probably about eight years two of
them professionally my love's include writing windows malware I don't know if
any of you guys are familiar with throwback slingshot throwback is
a-actually public on get up the stage one persistent stool and then slingshot
is a counterpart which is an interactive rap i do active development on on tools
that we use internally or four versions of those tools that we use internally so
comparable to something like cobalt strike interpreter but all the all the
code is ours and I love coding with C++ Python and power show i might add .
netted marriage don't get a chance to code and it very often and i love
security research on the red side so I'm definitely ready Murr i love to do you
know the piece of functionality and essentially writing vulnerabilities that
take advantage of Windows environment and I do enjoy long walks on the beach
so you guys want to swim me later you can make that happen
so tonight's agenda going to go over a quick overview of the sort of exchange
the way we access it and what it has to offer us recon for collecting
credentials usernames passwords email things like that credential harvesting
for turning like a list of emails or essentially performing attacks to gain
email password credentials and then i'm going to go over an overview of outlook
rules so inbox rules inside outlook and talk about the exploitation details of
using these rules for and you know remote code execution persistence
lateral movement anything like that you give you guys a demo and then we'll take
questions so first we'll start off is exchanged microsoft email product i
can't imagine anybody in the room stop familiar what exchanges are currently
supported version
Ansar 2007-2010 2013 2016 there's quite a lot of variance between all of these
versions but add typical microsoft fashion they do a pretty good job of
supporting all of them and then office 365 outlook.com those are built on top
of exchange so pretty much any attacking perform against an exchange server you
can perform against officers 65 or an hour . com profile has a few remote
access protocols that we can use one of them is the exchange web services AWS
it's over HTTP probably one of the most prevalent especially for newer versions
of exchange is used in a lot of applications and particularly on phones
but windows mobile things like that we have outlook anywhere which is sort of
the predecessor it's RPC over HTTP or sub protocols underneath RPC over HTTP
so like mapi over RPC over HTTP so leave it to Microsoft to build you a bunch of
abstraction layers and then in 2013 and up they actually did RPC all together
and you have straight direct mapped the over HTTP so office 365 outlook.com and
any 2013 and up exchange servers typically support this protocol they
just pulled our pc right in the middle and you can do mapi directly over HTTP
so that's really neat and then you have exchange activesync bit of an older
protocol uses HTTP and XML and it's typically used for like older mobile
devices
it's a high Latin see low-bandwidth network protocol that is very efficient
over those so it's a little bit slower as far as thinking goes but it's still
useful some functions or terminology just say we have autodiscover which if
anybody is familiar with you know you open up outlook and you type in an email
credential and you hit set up my profile and outlook somehow finds your exchange
server and like build you a male profile out of the blue like all you have to
provide it was your you know email with a domain name and your password so
autodiscover is really the basis of this it's a it's a fast collection of
exchange configuration supported protocols and service URL so any
organization that has an exchange setup you can get you can actually go and type
in autodiscover . or . com for their dns name and it'll oftentimes Matthew to the
server that can give you autodiscover
information so that the sub has actually autodiscover door com flash autodiscover
/ autodiscover to xml a lot of times blocked with ntlm authentication so once
you provide authentication and you essentially request in the right way you
can get back a huge xml file that provide you all the information about
what the exchange server supports so it's really useful and Microsoft doesn't
online test utility for this camera to exchange test connectivity runners I got
all products are old applications like to dominate that that uses autodiscover
you can actually do the output of it we have outlook web app is owa I kind of
removed from the remote access protocols not really protocol we can use interface
with outlook but it's super popular minimal email client available on the
web you go to any mail . or calm / owa and you pretty much get their owa login
page that's really popular like a minimal outlook and then you have a
global address list a gal and that's that's pretty self-explanatory just
means that users that are using exchange from outside the organization who don't
have an interface to active directory are allowed to pull down a list of all
of the emails inside the organization contact info is sort of like a
rudimentary active directory sync so once you can authenticate to exchange
successful you can pull down whatever gal you have access to and store that
offline and use it from further reinforcing I'm gonna go a little bit
into recon this is a topic that's covered all over in in red teaming and
pen testing and network security in general but it's really important this
attack this is a credential attack so we need to have email credentials so a
username and password before we can perform these sort of operations and I
like to talk about boring attacking the external which oftentimes involves recom
so you know the goal is to collect emails usernames and hopefully password
for public resources and sources at the typical ones search engines Google being
company websites use all the popular tools do like dns brute-forcing with a
list to find a bunch of subdomains for an org public website
these ones are two of my favorite linkedin is awesome because in the past
three years you can pretty much fine that every organization out there all of
their employees are tagged to that organization linkedin so you can do a
search for a company and you'll find that all 1,000 employees are like linked
here
and you click on that link and it pulls you up a search of every single person
on linkedin who claimed that they work for that company or have worked for that
company so it's really useful for essentially creating an intelligent list
about username emails that we can never force again
get out that's also super great you guys never searched it have its not indexed
in Google so you know you're going to get help search page and research you
know or dot-com in quotes and then like password and clothes or email or a tour
com you can find all ports are all sorts of sources we find interns post up all
the time the constant will go to organizations like yeah there's a
there's a configuration file for your sequel server sitting out on get out
somewhere so you should probably chat with that we can use database dump those
are really popular right now and then Active Directory this is solely for
internal but you know I talked about this attack in a sense of if you have a
game network access already and you're trying to bad bypass network
segmentation or the fact that the user doesn't have local admin on the remote
box or you want to make sure that you know you gain additional access to the
organization and you're afraid you might lose it
oftentimes the first thing we do is we go to active directory and pole list of
all the active emails from active directory and store them offline that
way later if we need to make more brute forcing attempts we have the most
up-to-date intelligent as possible so it's really simple and easy piece of
information you can call some tooling for this leaf-bare did the discoverer
script or it's like a cali tools so does lots of other things besides recon but
I'm actually pretty partial to his tool his script is super awesome it'll do
active and passive discovery and I don't know if you guys can see that but has a
list of all of the tools that it actually goes against it will just meet
little like local website with HTML files that you can browse around in for
a person just starting off in recon I cannot recommend this you know more it's
that you put in the organization domain name or their name it does also the
company searches in Google searches the harvester pulls out emails files links
everything like that I use it all the time super great for that focus is a
tool he was at DEFCON three or four years ago I can remember how long ago
but I kind of fallen off the map of it's hard to find a good binary to it a
little will schedule when you use it can crash a lot but that was also super
school a guy that works for silent break with me i have metrics actually made a
Python script for doing linkedin scraping Sookie I just put it on github
for me yesterday i'll provide a link to it if you go and download it you can
actually run the script against an organization and it uses millennium
inside of LinkedIn to pull a list of all the users their names and their titles
their job titles and it doesn't actually click into their profile so that the
user doesn't get alerted that you looked at them
I'm and it can go through tons of search pages and essentially the end of the day
you get a CSV file of like the employees names their email and you sort of have
to make a guess on their email structure typically like first name dot last name
first initial last name but it will give you a list of like their job description
their name and their I you know assumed email and we actually use that not only
for this attack but also we do fogo blackbox test so you know we send in
targeted phishing emails like macros only document things like that it's
super awesome for getting targets because you just pull through a huge
excel document go
I think I want to target all of these HR people are all of these people from
another customer service department whatever it may be and then hacker
target that the needs i also really good for beginners they have a lot of the
api's for doing like dns lookups and and sub domain through forcing things like
that it's really cool
I'm so now i'm going to move it a little bit more to active so there's collecting
let's say that you know we use linkedin and this is a common tactic press we
pull list of a bunch of emails that belong to the organization it's a
thousand and their assumed email but we don't password for those emails yet so
what we want to do is we want to collect passwords for those as well and brute
forcing an awesome way to do that the guys were black hole security actually
wrote passwords great are spraying against owa before I even built this
attack and it's super awesome they use Burke with owa and essentially they
iterate through with like a common password like summer 2016 and the brute
force like all of these six character usernames until they find email
credentials ews shell intel has a powerful tool kit called owa toolkit
that i absolutely love it's couple powershell Commandments built for
interfacing with the ws and like you can do brute-forcing again ews HIV
screenshot included they're like what that command that would look like
so just said through ews you supply it ews
service URL like so URL and it will try every single user with like a basic
password you know summer 2016 password one spring 2015 these are also awesome
candidate and you'll find that when you have a thousand emails to try and you
try the really stupid password
all you need is one account so of those thousand emails you might get you know
less than five people that have that dumb password but it gives you an
additional access vectoring the network and then for ntlm HTTP on the run into
some situations where i needed to do just like raw HTML reporting verb does
not do this as far as I'm aware so I just used the request library instead of
Python there's a github page for an ntlm edition plugin for that and I just
scripted out inside a Python to push against that to this come part to
collecting credentials on top of brute forcing i also love to credential
harvesting attack the email so a lot like phishing emails
my favorite is to impersonate the company's login page like officers 55
owa you'll make a fishing site with similar domain name looks the exact same
you send the user an email saying their mailboxes filled up and they did we just
expanded the space they need the login to make sure that they still have access
to their email and you'll be surprised how many people freak out about that and
go get one of the better things about this is there's no payload to burn and
we blend in with spam so when we're doing targeted attacks with like fishing
documents and like office macros we might only send ten to twenty attacks in
an organization or to an organization because if our word document gets caught
we oftentimes have a lot of IP invested in that macro we don't have you know
really bad at macro that can do all sorts of detection and sandbox detection
and bypassing things like that we really don't want that compromise we keep it
small versus a credential harvesting campaign we're trying to get somebody to
click on a website their credentials that so much more common with fam so we
can send 200 emails which gives us a much higher likelihood that at least one
user will open the attack i've also used external site compromises another method
so WordPress live agent you have these companies are outsourcing some other
public-facing web sites to other companies so you go find a bowl in there
wordpress site you pop the box and then you find out that server is actually
inside of your target organizations that work and you go shit I gotta like I
popped a word press box for nothing and you go bail now that's no longer needed
and we can do things like backdooring login pages doing social engineering
from that site
and we can also get password hashes from database and then do credential reuse to
you know their internal email because a lot of times people use the same
password for the wordpress site that they would for their internal email
there like a web admin or something like that
I'm so I'm going to get into the outlook rules a little bit and just kind of go
over an overview
I see Microsoft's official terminology on outlook rule is really what I focus
on the fact that the rule comes in two parts that comes with the trigger an
action and I can be multiple triggers to find multiple actions to find those sort
of the two pieces of analytical you know triggers are pretty common
self-explanatory anything from receiving an email with a specific subject from a
specific person anything along those lines rules can be created with
server-side and client-side microsoft actually added the ability to make
outlook rules on like owa or outlook.com and they can also be built client side
which is kind of the original way they were designed and if the rules aren't
necessarily compatible in fact like if you build a bunch of rules and out the
raw outlook client or the normal our client go into owa and try to add inbox
ruled there it'll actually warned you and it'll say hey like you already have
rules from out look at it if you add the rules on the owa side they're gonna
destroy your outlook calls there they're not quite compatible so just keep that
in mind in your attacks there's two actions there's the actions part of the
rule split into two sides their server side actions and client-side actions so
you know when you define an action like I when I receive a message from this
person I want to market is important or move it to a folder those are all
actions of the exchange server can take so it doesn't bother asking outlook to
do it because that would just be a i'll ask you when you come back to me and
tell me what to do
so the service side will get processed immediately on the server and then for
any rule that is based in the outlook client so playing a sound printing a
message executing an application those are executed client-side and what
happens is there's a hidden folder inside of everybody's male profile
called the deferred action folder and when the server side wants the
client-side to perform the actions associated with the rule it actually
puts a deferred access met or action message in that folder and the clients
think that down outlooks on that hidden folder will look at that message
it has a rule ID associated with it it'll look up that rule locally and
execute the actions associated with it so the server is actually supplying a
message
to let out would know that it needs to execute rules i'd love to look at ways
to forge these rules in the future but i haven't had a chance yet
and then of course rules are stored on the exchange server and there's think
all outlook profile was actually so the bases his attack if I have for outlook
profile setup on portable boxes and I go to rule 11 it'll hit the exchange server
and then get sink down to all of my outlook profile so they can all profits
the rule as well even if that rule was built as a client site only rule so even
if only the only actions associated with that rules are ones i want to apply on
my computer
they'll still get synced other machines when i first started looking at this if
you go into outlook you can actually you know build a rule and when I got any
actions portion there's a lot of interesting stuff in here
most of them are for typical exchange actions like you know forward the
message markets important things like that and you get into some of the
interesting ones printed play a sound start an application run a script and he
seems really interesting to me especially start an application running
script i'll be focusing on start an application because that's where this
exploit comes from but run a script is also really need action
it will if you go into outlook and you develop are you enable the Developer tab
and actually go and you can build BB macros that's it associated with your
outlook profile and in run a script you can have it run local like macros inside
of outlook
the problem is these macros aren't synced through the exchange server like
the rule is so for our purposes of gaming initial access it's not as useful
for persistence it could be and I'd love to see somebody look at that it's like a
tooling mechanism it's super stealthy you put a macro out of their pro outlook
profile and then putting messages received it will trigger that macro
script and run it inside out so i wanted to work in front of the star application
function
besides built a rule here and when you click start an application that has you
supply an application name it opens a file explorer you go and browse to
whatever file on your system that you want to run and you click yes and by
default that limits you to exe file that you can just do that trick where you
change the exe drop down to all files and pick whatever you want i'm so I
built this rule and inside-out look there's a you can go to rule menu go to
options and then hit export and you can export all of your rules to like
individual files so I popped open these files in a in a hex editor I wanted to
see what these files with my credit score and I started looking at I can see
the name of the
all this fun rule and the path down there at the task stop txt I'm so
clearly these offline rule files are supplying this information so they could
be messed up there i also took a deeper look I wanted to know what windows api
outlook with executing when we pull the executor also when I built the rule that
executed cmd.exe what actually happens in the back end when outlook calls
cmd.exe because what I really wanted to do was get argument parameters that
stole my main goal with this is something I really want i'll talk about
the exploitation challenges and you can see there I actually cooked to
outlook.com and I i just took a gas at all the API that would call it actually
ended up calling shellexecute exw the white version shellexecute the extended
wide version of the original function shellexecute and the module that's
calling is actually MSO dl this is a shared library amongst all office
applications
it's in like the program data directory in my career and piles and then you can
see that i looked at the details of this function of the verb is no I'll go into
this in the next slide the file is set to you know cmd.exe and then the
parameters is null so and you can actually go in there and you can look at
the shelter has tons of parameters for setting icons or hiding the window has a
lot of functions like that so you can see exactly what look is doing what it's
calling this this is a quick look at shellexecute TX takes the structure
called the shellexecute info structure this structure has a bunch of different
properties and I've kind of ripped out the ones that I find interesting
LP verb is kind of the most one of the most important and it's essentially
really associated with exploring mouse clicking so when you're kind of browsing
around your file system Explorer and you right-click on the file and it brings up
all of the things you can do with that print open they run out all these things
those are associated with verbs most of the time inside of the registry so
Microsoft has built this us
I call it a platform where applications can associate different actions with
ways to call their program so a text file might be open with notepad or might
be opened with adam or sublime depending on what you use and when you changing
your default program what you're actually doing is changing the open verb
for the text file you're going into the registering the HD classes route and
you're set
it's so txt files are now open with the command string sublime text file name or
Adam txt file name instead notepad texting so this is sort of the core that
windows they'll pop up when you're like interacting with the desktop and
opening-up applications and files so it takes two more parameters one of them as
a file which is pretty self-explanatory and then the parameters that allows you
to provide arguments to the file and like that outlook the MSO dll just set
this property to know I haven't gotten the way to like overflow into this
property love to figure out how that these parameters is always know so
really what you end up with is when you have to tell outlook that you wanted to
act execute an application its you go to explore and double-click on that's the
action you have so your payload has to be able to execute maliciously when you
just double-click on the file I'm going to go into the exploitation challenges
that you know what my mind certain thing about it was like okay let's actually
make an attack out of this now what we have so we require valid account
credentials along with exchange service access so you know we need to have a
valid email and password we can get that through recon brute-forcing like the
slides i mentioned earlier and through many other means it's actually cool
attack if you find yourself in a position where you have somebody's email
password you like how do i get on their box would be a perfect perfect reason to
use that and then we need some sort of service access to exchange so RBC mapi
over HTTP any of those services that we can interface with the exchange server
from the external we don't have command line arguments so we have to make it so
that our file as a package will execute our payload when we double-click on it
or when we call shellexecute with an open bar between people typically do it
and then we need local file we need a local file on the disk for outlook open
so when outlook actually receives this trigger shellexecute is going to try to
go find this file so it can run this verb on it and this is really where unc
comes the rescues like that one of the larger pieces of this attack whenever
you go you know quack
servername back cher Windows support that habit i can go into Duran and type
in a remote file system and when you do that Windows has a fallback mechanism
that goes through for protocols so at the top it will try you know
SMB and will fall through all of these different like RPC file management
call the delegates to the very end and the last thing windows will try is to
try to open a web dab to that address and web dad is a protocol built on top
of the HTTP that microsoft introduced to allow file sharing so essentially you
can access manage ctrl delete files over HTTP calls and by default when you do
this inside of Windows it is proxy aware so actually they have like a system
proxy setup and you go to UNC path will use the property when accessing the HTTP
address which is super useful becoming really popular thing to make property
where tools in this case the great service windows does it for us we need
to try i'm so the two instances i will get building this were a local samba
share so inside of cali you can set up a local file share and hosts files and
that's really where i found a lot of utility and internal panting and
pivoting so you get a row device on the network you're doing responder spoofing
you get hurt somebody's credentials but you then you go try to access their
machine and they're not a local admin so you have domain credentials but you're
still on your own box in the network if you want to pivot somebody machine you
spin up a local samba server on your cali box and perform this attack and
have the user access the file off of your cali p.m. so they don't ever reach
outside of the firewall the next one is a web share and not successfully a UNC
path like that HTTP proxy awareness and the machine will actually reach out to
the internet to get this file so we supply public IP if we apply domain name
that resolved to public IP the windows box actually reach to that public server
over 480 and try to access it over the web protocol we need to file type that
can give us local code execution which alex cute as you know talked about a lot
that exe pit pssht L&K any file where we double click on it we can get some sort
of arbitrary action with it and then the target need to have outlook open that's
probably hopefully one of the simplest requirement for this attack a lot of
people you know business people have outlook open all the time but we have
had instances where we try and attack at eight o'clock in the morning it doesn't
work we come back six hours later and it does because they opened outlook
sometimes between sometime between $TIME in the morning and in the afternoon i
want to talk a little bit about use cases for this attacks on my favorite is
initial access to a target Network it's relatively easy to collect email
credentials and we can use it to convert those credentials and internal network
access so no more payload more office documents and more ole's no more getting
them to click on HTML and click run
we just need them to give us our email credentials you know go to a coffee shop
and speak their box we're sitting there and get their crabs we didn't really
have to worry about what their machines are what the users trained to do in
regards to like opening up a payload we just need their email credentials we can
put into a machine without local admin privileges with my favorite uses for
this we've actually had the situations where I've gotten credit to respond or
broken the hash and I wanted to get on the workstation normally you need
administrative access to access the service control manager wmi do sth task
at whatever it is
PS exact this we don't need it we just get their credentials and we go out
through exchange and make their box reach out and grab our file from us so
we don't have to interact with the windows services locally we can buy have
network segmentation in the same way if you're sitting on an HR box and they're
locked down from accessing ID but you have IT administrator credentials use
those and make the ID workstation reach out and grab your payload for you and
then persistence this is like over as when I haven't done a lot of work with
but i love the thought process of its ridiculously stealthy the very obscure
technique with minimal tooling on both sides for performing attack and
detecting it so no defenders ever going to look for well hopefully you guys will
now you're gonna walk in the room going oh my god i need to go look at my outlet
girls kind of call your call your sock up like Paul open all the rules make
sure there's nothing there that is really long term because the rule is
linked to an Outlook or an email pro profile and not a workstation we can
persist across the 1i are white so i'll talk about a case study at the end where
we had access to a box we built a rule to get access to that box they found out
that we were on the machine they wiped it completely had to use a reset a
password moved into a new machine the user setup as outlook profile again and
guess wat exchange like a by the way you need this rule so let's go ahead and
have that and then we sent him an email the next monday from an external account
and Bumi Papa shell it's super crazy how house Delvian and long-term basis in the
same sense we can drop an executable an internal file share so for really
stealthy persistence you get inside of a network you go find their most common
public file share on the domain controller
drop an executable file on it set up the malicious outlook rule on either one or
many profiles you set up only 20 emails you get out of the network than two
years later you come back you you know send an email externally to any one of
those 20 people and their box will reach inside and grab that exe up a file share
because everybody knows things but that's filthy files from like 98 sitting
on file shares that's crazy nobody nobody ever believed that you name it
something important like you know budget 2016 do not delete and nobody's gonna
have something that so there's sort of a state of things just the start of this
month a couple of really awesome people whose to tools interface with this
project originally I had built this rule . py script which just build malicious
RWC files for importing into outlook so I sort of reverse engineer the file
protocol for those outlook profile or those outlook rule files and both python
script that will generate rules for you so you don't have to really interface
with outlook for the rule generation you build the file offline and it gives you
a file you can tell outlook to import and suddenly have your role of things to
change ruler is a map over easy to use map over HTTP to quickly single files
without building the complete male profiles is something I've been wanting
to build for a while and posted it super awesome it will just interface directly
with map over HTTP to think the rule so all you have to supply it is user
credentials and suddenly that user profile has your rules stink to it
the only downside of this as far as I'm aware right now it only supports map
over HTTP which means that it's only exchange 2013 and out and office 365 and
outlook.com i love to make form someone else to make a port of it does map / RPC
over HTTP that we can support all of exchange but super awesome tool and i
highly recommend looking at if you want to understand how rules are synced over
mapping did a lot of good research on it and then mrw labs built the X rules tool
and that uses local outlook profiles to importantly his rules for persistent so
you get code execution our box you want to persist on that box they built that
USC that you can inject into memory it will go and look on disk all the mapping
profiles off of disc and think the rule that way and I love those two tools and
how they came to like similar tooling from different positions since post was
working from the outside trying to get initial access and exhales a sort of
I already have access to a box but I'm really worried that it's gonna get white
every day and I want to have persistence of another method so I believe they used
in the vdi environment really i'm going to go ahead and actually recorded a demo
for you guys kind of a complicated one can see that already don't like the
resolution alright alright so I'm in this case I have my local workstation
which is like my attack workstation and i have a $TIME p.m. running which is
like my target workstation all the houses outlook open there's no other
programs open it sink to you know a mail account and it would call the darkside
debt which anything he was having a black ops course you'll know that
machine it so I've set up a public boon to server and I'm actually ssh into it
right now so i have web configured on this server so this is good to servers
serving files / web doubt it's really easy to set up web dab in Apache just
like one configuration change actually lists out that the directory and the
webcam just show up empty and then my my custom tool of choice for my rat will be
empire so I'm actually going to use empire on the same server to get a shell
back and that's just so i can actually use Empire to write like a bat launcher
directly to disk so I already have a stage set up under be this is gonna call
back over port 8080 I think ideally you'd probably want to use these on
different servers so you can do true HTTP comfortable place so I set up a bat
launcher and i just set the out file to the Apache directory with the web server
is configured and I just tell it that is that the auto delete false i want this
file to persist when I tell it generate you see down the bottom i refresh and
suddenly windows can see that evil about that sitting in that Webster so it's
actually calling out over HTTP to my web server externally and uploading it up
and file explorer like it's a local file sure it's pretty crazy i pull up in the
bat-file just to show you the power shown minor the Empire puts in there for
the launcher
so now that i have a payload sitting on the web server i need to build the
outlook rule i'm just gonna use my rules tool i'm sure you could have used sense
post tool for this but i kinda wanted to do my homegrown stuff just because i
like it i said the rule name to derby Condit asked me for a subject trigger
word so I just provide shells so you know when the word shells receive it'll
trigger and then the file path I wanted to execute it off of that web share you
know evil about that
so it actually build me an article you see file on disk and this is just the
offline version of that rule file so i'm gonna go ahead and open outlook here so
my attacker machine in this instance I've seen my target outlook profile to
my machine so I've gone into outlook they add a new profile provided their
email and password and it's built me a local outlook instance for my target
user is actually to outlook sessions existing one on my attacker box-and-one
on the target box
I'm just gonna use my local attacker instance actually think the role that
change is where the map over HTTP comes in so I pull up in the rules panel i
have options
import rule and then I'm just going to supply the path of that art of easy file
that i built so at this point outlook is going to read in my malicious rule it's
going to sink it up to exchange it is going to supply it down to my target
outlook instance so that target instance about look stunning in that vm just got
this outlook rule without me ever doing anything to it you just had outlook open
exchange like oh here you go have this malicious file that some attacker can
sink them so there's a couple different ways to trigger there's lots of
different ways to trigger the role my personal favorite is set up a subject
trigger and then send the user an email from themselves
it's hard to track and if the user ever find it in their inbox about Julia dials
they just go always from myself and you just name the subject line like Outlook
updates or like some weird hacks error and i think most users will blow it off
so in this case i'm just setting the to address to that the user themselves and
doing pop shells in the subject and I'm just I'm just telling him don't go to
reconcile the pop shells on your box is from future to him so I go in its end
here and then after the message sends an Outlook I just closed my local instance
that so that my local instance and their local instance don't interfere with each
other like my instant get that the Dom then it might execute the attack instead
of the remote one so after the email times i just closed out of my instance
and wait for the multiple delivered on-target actually I get a little bit
impatient here and I'd like send and receive and i'm about to restart outlook
oh my god email coming faster and then right there and pop so there's ways to
do this without a window popping my favorite that exe with an individual
options which actually this document in the blog you can see right there in
Empire i just got a new agent back on my remote machine and it's on the dark side
of machine i'm going to interact with that number
PS just to prove I'm not going you guys so that was completely external to
remote code execution on a host using only outlook that target only ever had
outlook open and all they have to do is receive an email
um so this is kind of case study number one I want to go over a couple
legitimate use cases that we've done for this attack in the last six months I've
used this on seven different engagement this attack is super useful and it is
legitimate I don't do this out of research for oh hey this is cool you
know give a presentation on it like I built this because i wanted to use it
and engagement and it has worked out beautifully and so many times so the
first one was a black box . black pen tester an org i discovered a zero-day
and the live agent software so that support chat software that was
externally hosted i compromise the sequel database and use tokens plugin
web interface for the application and then I placed custom HTML on the footer
of the login page to steal user credentials when people log into the
slide agent app so the live agent server was externally hosted wasn't in the
network all I wanted was credits so let that running for about a week and over
time I found somebody who had the same password set for both this live agent
program and their internal email use the outlook attack to pop their network and
lateral movement a privilege escalation to domain admin so that was compromised
of a third party application that wasn't even in the network to domain admin
using this attack in the middle
another one was another black box and aspirin or we use credential
brute-forcing to find a week user login so i collected a whole bunch of target
emails brute force against them to find a user who had like summer 2016 of their
password use outlook access to pop their box and then again ladder moving to
privilege escalation to domain admin and in the middle actually put their
security team discovered the compromise they told the user to shut down his box
he came back into the office they reset his password blue and machine actually
moved him to an entirely new computer the next monday i shoot an external
email and pop-up box again we're back to businesses out of the network that was a
good example of how the persistent technique can be used to persist across
ir whites so I like the fishing payloads are dead guys you might as well just
toss all your macro payload salvador vs LA start getting on its outlook train i
need stickers i feel like the HDD guys pick me up with stickers or like 10,000
and then we'll family handling development so i kinda wanna talk a
little bit about what now I mean I explain this attack explain its
different usage future research
i I'm a red team of mindsets like my future my ideas for this to like all
what are all the cool different things that you can do with outlook rolls
one of them is to abuse the MSO dllr outlook to avoid argument limitations
shellexecute so if you actually I I actually threw the MSO dll inside of ida
and like looked at the export function the house executing shall or shall
execute went through a little bit didn't get very far with it but if you can find
some way to like overflow in the rule to get command line arguments or
potentially abuse the verbs in the registry i built a Python script to
enumerate all the verbs out of the H classes HD classes route and look to see
if there was any weird file extension that I could use where it would like to
ask my file name as an argument as well to get my arbitrary command execution
modify the the ruler by supposed to include support for mapping over RPC
over HTTP just so we can get the 2007-2010 support bill passed the House
support in the tooling so until I'm hashes could be used to have internally
i did a proof-of-concept us with python and actually use the Python ntlm request
library and modified it so to do pass the hash so we have an ntlm hash for a
user we can actually pass that to the exchange server get access to their
mailbox and then sink rules to it so another early Christians and have the
idea of doing an SMB relay but to the exchange server so normally do and SMB
relay attack and you have to be local admin on whatever remote box or relating
to not anymore you could relate to the exchange server open up a session and
then single rule for that profile and gate code execution that way you can use
named pipes as a file replacement so you can do in memory pivoting so if you were
on a box and you want to get to another box you like load up the file of the
name tight supply it as an argument for the rule and then get the remote system
to read that file or that named pipe like it was a file and supply like a bad
over at whatever just so that you didn't have to write up disk anywhere i'm a fan
of existing in memory that's what my tools do and then I thought about this
recently you can potentially backdoor patch the MSO do on disk for like
stealthy outlook persistent but didn't include a rule file so if you've got
access to a host you could like patch there ms odl so that any time an email
was received and it like check to see you the actions of a rule you like
injected your code in there and was like hey if it's you know past 1230 on a
wednesday i want you to execute this batch file over here so you know really
really needs help with that as far as defenses for this go we do collaborative
organ arc lab engagement with organization
and our constant recommendation is the disabled webdav outbound on the firewall
so a lot of 4 i'd say a lot of providers support this I know Palo Alto is due by
default but you can just stop your clients from reaching out over HTTP web
protocols that's probably the easiest defense on another hand to the host
based approach where you monitor process creation for outlook and or app
whitelisting so you know you have a pointless and Turner AppLocker I'm not
gonna be able to reach the web sharing just execute a random exe or a bat file
off of that web share so there is host based solutions do this Matt Grevers
gonna be a great resource for that and then we can monitor exchange logs for
rules think events from outside of the network and I put a question mark after
next i haven't had a lot of time to research the defense's on the exchange
server side but i imagine if we had enough auditing enabled we could watch
this rule activity occurring against an account and create alerts on the logs
and or just go out and watch all of the all of your check all of the rules
against all the profiles only sometimes anybody have any questions from this
research about that yeah what's up
ok ok
just so everyone heard and you just asked I've ever encountered legitimate
usage of this feature inside of outlook me myself
probably not but when I talked to Microsoft about this they didn't seem
too keen on the idea of blowing the way the feature I imagine a lot of people
use it for like when they receive an email from their boss they start up read
it or YouTube or so like I don't have considered legitimate but like I don't
know like you know a political and you can actually i should mention you can do
the same thing with HTML files so or websites for that matter so if you
supply a website string to the rule it will pop open your default browser and
go to that website you can get out like pop websites when you receive emails
instead applications economy will be your president
oh oh ok so that definition question and one that I i if I constant ongoing like
I would say within the past month I've had conversations about this i've seen
some organizations walk down to factor on owa so when you go to the outlook web
access you have to supply a token before you can finish logging in that wouldn't
stop a lot of these attacks just because the two-factor off doesn't apply against
ews or the ntlm off on the autodiscover page so a lot of a lot of times like the
two-factor authentication will be applied to the owa pro like the login
page so when you're doing the login with owa you've already accessed the site and
brought it up
whereas if you go to like the autodiscover xml file for an org you
have to supply HTTP and tell em off before you can even view that file which
means that you can do both forcing against the HTTP ntl Emma in the same
way that you would do like basic reporting it's an old firewall and i'm
not sure the specifics of the other protocols are like office 365 if you
have it enabled their I believe you could cut that the two factors only
going to apply after you've got to the successful credentials which means that
you can get to the office 365 login page fine and you can try credential the
minute you see a different response which is probably the next page where
like load that up you know you have battle valid credit and then you could
probably use a different exchange protocol ews our map your HTTP the
access
that directly i haven't verified that so I'd love to do research on it because
they might apply that to factor out the different protocols
yeah yeah sure I'm yeah I'm not sure I'd this is one of those things where I want
more research to be done to it i'd love to factor out the i'm a huge fan of
multi-factor up and I wanted to be a mitigation for this attack which is
knowing the way Microsoft and the protocols work the very fact that you
have like six different ways to interface with an exchange server means
that the two factor of problems and applied to all of them and particularly
not the low level one if you want to know for sure i highly recommend you try
a are not that it's not for sure but if you want to like get a better idea pop
open a brand new outlook instance and try to build somebody's profile remotely
if you get any sort of to factor out there then I would all be a lot more
confident that it's going to stop a sort of attack but if you just have to back
off I'm like oh wao that officers 5 online login pages i'm kinda iffy about
whether that stops so then we have any other questions yeah yeah I haven't
sounds cool and actually thought about that if you could it once you have like
domain admin on the network if you could get into account that had admin overall
the exchange like the exchange admins group then you can like a drool to each
individual person and like trigger them globally and pop shells all over the
place like like mail slot for something like that i haven't like really i really
want to encourage you guys please go research this technique i talked about
it and I have so many things in my mind I'm like wow I want to try that but to
answer your question no I haven't really looked yet
somebody else have a question yet so yeah so there's actually ways to disable
the supported protocols in exchange you can like disabled map over HTTP or RPC
over HTTP and then in the exchange or in the autodiscover file you'll actually
see that reflected so like sense post-election checks with us that it
looks at the autodiscover file check to see whether the mapi over HTTP has a
service URL supply and if it does then it will continue the attack
otherwise it just gives up so it's tough because at some point you a lot of
organizations need to supply a user with like external access to their email via
exchange and so really hard to turn those things off and I think that
functionality geeks even I i say harder to turn off when you get into like
office 365 like what you're going to talk to Microsoft I'm gonna be like I'd
yeah we can't just like the table this one core protocol for all your clients
but i recommend looking into it you let me know
hit me up on Twitter send me an email you know just I'd really love to spread
out this research symbols have any questions
no we're good i'll close it out there you guys have time to get your next talk
come up and talk to me say hi but that's it