Port msmailprobe(Nick Powers) + Cleanup for GO bridge #10964

clee-r7 · 2018-11-14T22:22:52Z

OWA (Outlook Webapp) is vulnerable to time-based user enumeration attacks.
This module leverages all known, and even some lesser-known services exposed by default
Exchange installations to enumerate email.
Error-based user enumeration for Office 365 integrated email addresses

Verification

Start msfconsole
use auxiliary/scanner/msmail/exchange_enum
set (EMAILorEMAIL_FILE)
run
creds
Results should look something like below if valid users were found:

host      origin    service        public  private  realm  private_type
----      ------    -------        ------  -------  -----  ------------
<ip>      <ip>      443/tcp (owa)  chris@somecompany.com

OWA (Outlook Webapp) is vulnerable to time-based user enumeration attacks.
This module leverages all known, and even some lesser-known services exposed by default
Exchange installations to enumerate users. It also targets Office 365 for error-based user enumeration.
Identify Command

Used for gathering information about a host that may be pointed towards an Exchange or o365 tied domain
Queries for specific DNS records related to Office 365 integration
Attempts to extract internal domain name for onprem instance of Exchange
Identifies services vulnerable to time-based user enumeration for onprem Exchange
Lists password-sprayable services exposed for onprem Exchange host
Note: Currently uses RHOSTS which resolves to an IP which is NOT desired, this is currently being fixed

Verification

Start msfconsole
use auxiliary/scanner/msmail/host_id
set RHOSTS <target>
run
Results should look like below:

msf5 > use auxiliary/scanner/msmail/host_id
msf5 auxiliary(scanner/msmail/host_id) > set RHOSTS <host>
RHOSTS => <host>
msf5 auxiliary(scanner/msmail/host_id) > run
[*] Running for <ip>...
[*] Attempting to harvest internal domain:
[*] Internal Domain:
[*] <domain>
[*] [-] Domain is not using o365 resources.
[*] Identifying endpoints vulnerable to time-based enumeration:
[*] [+] https://<host>/Microsoft-Server-ActiveSync
[*] [+] https://<host>/autodiscover/autodiscover.xml
[*] [+] https://<host>/owa
[*] Identifying exposed Exchange endpoints for potential spraying:
[*] [+] https://<host>/oab
[*] [+] https://<host>/ews

OWA (Outlook Webapp) is vulnerable to time-based user enumeration attacks.
This module leverages all known, and even some lesser-known services exposed by default
Exchange installations to enumerate users. It also targets Office 365 for error-based user enumeration.

Error-based user enumeration for on premise Exchange services
Note: Currently uses RHOSTS which resolves to an IP which is NOT desired, this is currently being fixed

Verification

Start msfconsole
use auxiliary/scanner/msmail/onprem_enum
set RHOSTS <target>
set (USERorUSER_FILE`)
run
creds
Results should look something like below if valid users were found:

host      origin    service        public  private  realm  private_type
----      ------    -------        ------  -------  -----  ------------
10.1.1.1  10.1.1.1  443/tcp (owa)
10.1.1.1  10.1.1.1  443/tcp (owa)  chris

lib/msf/core/modules/external/go/src/metasploit/module/core.go

busterb · 2018-11-20T16:42:55Z

The .md file is in a path where not only does it not actually work in Metasploit, but the module actually fails to load. Please move it to the path with all other documentation files are (2 other PRs have landed in the same way; people need to please start using the info -d command to test documentation).

busterb · 2018-11-20T16:44:52Z

The side-effect of putting the .md file where it is is this in the log:

[11/20/2018 10:09:41] [e(0)] core: /Users/bcook/projects/metasploit-framework/modules/auxiliary/scanner/msmail/exchange_enumerator.md failed to load due to the following error:
Errno::ENOENT

modules/auxiliary/scanner/msmail/exchange_enumerator.go

jmartin-tech · 2018-11-21T23:09:06Z

Jenkins test this please.

busterb · 2018-11-30T17:47:40Z

lib/msf/core/modules/external/bridge.rb

@@ -142,7 +142,7 @@ def harvest_process
        elsif Process.kill('TERM', self.wait_thread.pid) && self.wait_thread.join(10)
          self.exit_status = self.wait_thread.value
        else
-          Procoess.kill('KILL', self.wait_thread.pid)
+          Process.kill('KILL', self.wait_thread.pid)


cblack-r7 · 2018-11-30T17:57:17Z

modules/auxiliary/scanner/msmail/shared/src/msmail/msmail.go

+		Transport: tr,
+	}
+	req, err := http.NewRequest("GET", URI, nil)
+	req.Header.Set("User-Agent", "Mozilla/5.0 (iPhone; CPU iPhone OS 11_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1")


This should probably be a MSF configured parameter

That's sorta a WIP thing: #9228

cblack-r7 · 2018-11-30T17:59:00Z

modules/auxiliary/scanner/msmail/shared/src/msmail/msmail.go

+	"time"
+)
+
+func WebRequestCodeResponse(URI string) int {


I'll try and loop back on a patch on this, but realistically this should probably return an http.Response and error instead of an integer.

cblack-r7 · 2018-11-30T18:06:49Z

modules/auxiliary/scanner/msmail/shared/src/msmail/msmail.go

+		Transport: tr,
+	}
+	req, err := http.NewRequest("GET", urlToHarvest, nil)
+	req.Header.Set("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.79 Safari/537.36")


This also seems like it should be MSF defined, but it does switch to a "desktop" UA. I talked to Nick and he says that this was to simulate the "real devices" for the devices that normally hit then endpoints (ie a phone generally only accesses the ActiveSync)

We have an old PR of mine that's supposed to cleanup UA handling and make it work properly for external modules. I should go back and finish it up. Don't think it blocks this though.

busterb · 2018-11-30T18:12:34Z

documentation/modules/auxiliary/scanner/msmail/user_enum.md

+
+**Note:**  Currently uses RHOSTS which resolves to an IP which is NOT desired, this is currently being fixed 
+
+## Verification


replace these with some redacted test runs, so someone looking at the docs later would see what the output of this module should look like

busterb · 2018-11-30T18:14:39Z

modules/auxiliary/scanner/msmail/user_enum.go

+			"protocol":		protocol,
+			"fullname": 	"auxiliary/scanner/msmail/msmail_enum",
+		}
+		module.ReportCredentialLogin(user,"", opts)


shouldn't gofmt pick up spacing things like this?

why yes - I'm not sure why IDE doesn't auto run this

mkienow-r7 · 2018-11-30T18:54:09Z

lib/msf/core/module/external.rb

+  }.merge(service_data)
+
+  if data.has_key?(:password)
+    print_warning "In pass"


Is this a debug statement from development?

bwhaha - thanks

lib/msf/core/modules/external/bridge.rb

mkienow-r7 · 2018-11-30T19:06:08Z

lib/msf/core/modules/external/bridge.rb

-    gopath = ENV['GOPATH'] || ''
-    self.env = self.env.merge({ 'GOPATH' => File.expand_path('../go', __FILE__) + File::PATH_SEPARATOR + gopath})
+    default_go_path = ENV['GOPATH'] || ''
+    shared_module_lib_path = File.dirname(module_path) + "/shared"


Consider using File.join for this:

shared_module_lib_path = File.join(File.dirname(module_path), 'shared')

mkienow-r7 · 2018-11-30T19:10:33Z

lib/msf/core/modules/external/bridge.rb

+      go_path = go_path + File::PATH_SEPARATOR + shared_module_lib_path
+    end
+
+    self.env = self.env.merge({ 'GOPATH' => go_path})


Minor: space after {, however, no space before }.

mkienow-r7 · 2018-11-30T19:11:57Z

modules/auxiliary/scanner/msmail/user_enum.go

+			"service_name": service,
+			"address":         ip,
+			"protocol":		protocol,
+			"fullname": 	"auxiliary/scanner/msmail/msmail_enum",


Is there a way to determine the fullname programmatically?

if you figure it out let me know :)

The report method should not need this. The Msf::Module::External mixin has access to this info and should be the one using it

acammack-r7 · 2018-11-30T22:53:09Z

modules/auxiliary/scanner/msmail/user_enum.go

+			"protocol":		protocol,
+			"fullname": 	"auxiliary/scanner/msmail/msmail_enum",
+		}
+		module.ReportCredentialLogin(user,"", opts)


This type of interface makes it impossible to report just a username vs a valid login with an empty password.

mkienow-r7 · 2018-12-03T17:16:11Z

lib/msf/core/modules/external/go/src/metasploit/module/core.go

+	msfLog(message, "error")
+}
+
+func msfLog(message string, level string) {


This method should behave more like the log method in lib/msf/core/modules/external/python/metasploit/cli.py, otherwise, all callers become responsible for adding the leading log status indicators ([*], [!], [+], etc) to the actual messages themselves. This could result in many inconsistencies in the log.

I think the 'level' string makes metasploit display the correct character at the beginning of the message already. So this should be fine.

cli.py is something that interprets the output of the message that comes from a module like this, so it's a different thing.

I was unsure of that since there are plenty of locations in this PR where module.LogInfo is being called with a leading indicator in the message string.

Yep, you are right.

also, all of the 'mux.Lock/Unlock' code needs to be fixed

busterb · 2018-12-03T20:21:30Z

I think this is good to go, we can continue improving in the tree. Thanks all!

Also, oops, hit the wrong button!

busterb · 2018-12-03T20:29:55Z

Shouldn't auxiliary/scanner/msmail/exchange_enum just have an 'RHOSTS' with a default value of the normal target? Seems silly to force the user to set a value since there actually is one it uses. Also, unregistering or even never registering datastore values is possible. You might just have to declare a new template type though.

busterb · 2018-12-04T16:34:37Z

sorted out above comment offline, going to land and iterate from there

acammack-r7 · 2018-12-04T16:59:13Z

@busterb, there was still a lot that needs to be fixed. Are we keeping track of that anywhere besides this PR?

busterb · 2018-12-04T21:47:37Z

@clee-r7 are you going to do that? @mkienow-r7 has some valid points that I missed in time.
The mux code here should all be moved into the library as well.

busterb · 2018-12-04T22:39:59Z

Chatted with @clee-r7 , he'll take care of the additional issues. Thanks!

busterb · 2018-12-19T16:07:01Z

Release Notes

This adds additional support for modules written in Go, specifically adding auxiliary scanner and reporting functionality. It also adds three modules for enumerating users with Microsoft Exchange and Office 365.

Added msmailprobe to msf

38bea6c

clee-r7 added the external modules PRs dealing with modules run as their own process label Nov 14, 2018

busterb reviewed Nov 16, 2018

View reviewed changes

lib/msf/core/modules/external/go/src/metasploit/module/core.go Show resolved Hide resolved

Added module docs

2deaf19

busterb requested changes Nov 20, 2018

View reviewed changes

busterb reviewed Nov 20, 2018

View reviewed changes

modules/auxiliary/scanner/msmail/exchange_enumerator.go Outdated Show resolved Hide resolved

Address review feedback, fix bugs

6225c04

busterb reviewed Nov 30, 2018

View reviewed changes

cblack-r7 reviewed Nov 30, 2018

View reviewed changes

busterb reviewed Nov 30, 2018

View reviewed changes

mkienow-r7 reviewed Nov 30, 2018

View reviewed changes

lib/msf/core/modules/external/bridge.rb Show resolved Hide resolved

mkienow-r7 reviewed Nov 30, 2018

View reviewed changes

lib/msf/core/modules/external/bridge.rb Show resolved Hide resolved

mkienow-r7 reviewed Nov 30, 2018

View reviewed changes

Addressed feedback

5b926bc

acammack-r7 reviewed Nov 30, 2018

View reviewed changes

Broken into 3 modules, addressed review comments

b11bcd9

mkienow-r7 reviewed Dec 3, 2018

View reviewed changes

busterb closed this Dec 3, 2018

busterb reopened this Dec 3, 2018

clee-r7 added 2 commits December 4, 2018 09:41

Remove defunct comment

60aba5a

Remove unecessary run comment

3d8ec17

busterb approved these changes Dec 4, 2018

View reviewed changes

busterb self-assigned this Dec 4, 2018

busterb merged commit 3d8ec17 into rapid7:master Dec 4, 2018

busterb added a commit that referenced this pull request Dec 4, 2018

Land #10964, add initial golang modules for enumerating owa/o365

55a9a12

msjenkins-r7 pushed a commit that referenced this pull request Dec 4, 2018

Land #10964, add initial golang modules for enumerating owa/o365

0b53683

gdavidson-r7 added the rn-enhancement release notes enhancement label Dec 19, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Port msmailprobe(Nick Powers) + Cleanup for GO bridge #10964

Port msmailprobe(Nick Powers) + Cleanup for GO bridge #10964

clee-r7 commented Nov 14, 2018 •

edited by busterb

busterb commented Nov 20, 2018

busterb commented Nov 20, 2018

jmartin-tech commented Nov 21, 2018

busterb Nov 30, 2018

cblack-r7 Nov 30, 2018

acammack-r7 Nov 30, 2018

busterb Dec 3, 2018

cblack-r7 Nov 30, 2018

cblack-r7 Nov 30, 2018

busterb Dec 3, 2018

busterb Nov 30, 2018

busterb Nov 30, 2018

clee-r7 Nov 30, 2018

mkienow-r7 Nov 30, 2018

clee-r7 Nov 30, 2018

mkienow-r7 Nov 30, 2018 •

edited

mkienow-r7 Nov 30, 2018

mkienow-r7 Nov 30, 2018

clee-r7 Nov 30, 2018

acammack-r7 Nov 30, 2018

acammack-r7 Nov 30, 2018

mkienow-r7 Dec 3, 2018 •

edited

busterb Dec 3, 2018 •

edited

busterb Dec 3, 2018

mkienow-r7 Dec 3, 2018

busterb Dec 4, 2018

busterb Dec 4, 2018

busterb commented Dec 3, 2018 •

edited

busterb commented Dec 3, 2018

busterb commented Dec 4, 2018

acammack-r7 commented Dec 4, 2018

busterb commented Dec 4, 2018

busterb commented Dec 4, 2018

busterb commented Dec 19, 2018


		Note: Currently uses RHOSTS which resolves to an IP which is NOT desired, this is currently being fixed

		## Verification

Port msmailprobe(Nick Powers) + Cleanup for GO bridge #10964

Port msmailprobe(Nick Powers) + Cleanup for GO bridge #10964

Conversation

clee-r7 commented Nov 14, 2018 • edited by busterb

Verification

Verification

Verification

busterb commented Nov 20, 2018

busterb commented Nov 20, 2018

jmartin-tech commented Nov 21, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mkienow-r7 Nov 30, 2018 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mkienow-r7 Dec 3, 2018 • edited

Choose a reason for hiding this comment

busterb Dec 3, 2018 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

busterb commented Dec 3, 2018 • edited

busterb commented Dec 3, 2018

busterb commented Dec 4, 2018

acammack-r7 commented Dec 4, 2018

busterb commented Dec 4, 2018

busterb commented Dec 4, 2018

busterb commented Dec 19, 2018

Release Notes

clee-r7 commented Nov 14, 2018 •

edited by busterb

mkienow-r7 Nov 30, 2018 •

edited

mkienow-r7 Dec 3, 2018 •

edited

busterb Dec 3, 2018 •

edited

busterb commented Dec 3, 2018 •

edited