Skip to content

busterb/msmailprobe

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
 
 
 
 
 
 

Repository files navigation

msmailprobe

Office 365 and Exchange Enumeration

It is widely known that OWA (Outlook Webapp) is vulnerable to time-based user enumeration attacks. This tool leverages all known, and even some lesser-known services exposed by default Exchange installations to enumerate users. It also targets Office 365 for error-based user enumeration.

Getting Started

If you want to download and compile the simple, non-dependant code, you must first install GoLang! I will let the incredible documentation, and other online resources help you with this task.

https://golang.org/doc/install

You may also download the compiled release here.

Syntax

List examples of commands for this applications, but simply running the binary with the examples command:

./msmailprobe examples

You can also get more specific help by running the binary with the arguments you are interested in:

./msmailprobe identify
./msmailprobe userenum
./msmailprobe userenum --onprem
./msmailprobe userenum --o365

Usage

Identify Command

  • Used for gathering information about a host that may be pointed towards an Exchange or o365 tied domain
  • Queries for specific DNS records related to Office 365 integration
  • Attempts to extract internal domain name for onprem instance of Exchange
  • Identifies services vulnerable to time-based user enumeration for onprem Exchange
  • Lists password-sprayable services exposed for onprem Exchange host
Flag to use:
	-t to specify target host

Example:
	./msmailprobe identify -t mail.target.com

Userenum (o365) Command

  • Error-based user enumeration for Office 365 integrated email addresses
Flags to use:
	-E for email list OR -e for single email address
	-o [optional]to specify an out file for valid emails identified
	--threads [optional] for setting amount of requests to be made concurrently

Examples:
	./msmailprobe userenum --o365 -E emailList.txt -o validemails.txt --threads 25
	./msmailprobe userenum --o365 -e [email protected]

Userenum (onprem) Command

  • Time-based user enumeration against multiple onprem Exchange services
Flags to use:
	-t to specify target host
	-U for user list OR -u for single username
	-o [optional]to specify an out file for valid users identified
	--threads [optional] for setting amount of requests to be made concurrently

Examples:
	./msmailprobe userenum --onprem -t mail.target.com -U userList.txt -o validusers.txt --threads 25
	./msmailprobe userenum --onprem -t mail.target.com -u admin

Acknowledgments

  • poptart - For a truck load of golang assistance, poking of Exchange services, and help testing timing of responses
  • jlarose - Parsing decimal data within NTLMSSP authentication reponse for internal domain name
  • Vincent Yui - Office 365 check python script
  • grimhacker - Discovery/disclosure of error-based user enumeration within Office 365 blog post
  • Nate Power - Discovery and disclosure of OWA time-based user enumeration

License

This project is licensed under the MIT License - see the LICENSE.md file for details

About

Office 365 and Exchange Enumeration

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages