Same RPC issue as #19 despite latest build

[zz124lkjkchvba]

Hey,

I'm currently having the exact same issue that is described in #19

Upon trying to bind it's trying to do:
"mapi: a transport layer error occurred. An error occurred setting up RPC. Time-out reading from RPC"

/ruler-linux64 --domain domain --username "username" --hash hash_here --email "username@domain.com" --verbose --url https://domain.com/autodiscover/autodiscover.xml --insecure --rpc --nocache display

I've tried plenty of different variations while debugging it, due to certain characters in the password despite escaping them it would keep giving me 401, so I had to use a hash instead. Which does successfully obtain Autodiscover.xml, and in turn it tries to connect to:

https://company.com/rpc/rpcproxy.dll?company.com:6001

Manually going to the RPCProxy URL asks you for credentials, upon success it shows a blank page, which according to a couple of forums is the correct response, although I don't know for sure.

Also another thing to note, upon removing the domain parameter I get this error:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x58 pc=0x61ec94]

goroutine 1 [running]:
panic(0x7346a0, 0xc4200120a0)
/usr/lib/golang/src/runtime/panic.go:500 +0x1a1
github.com/sensepost/ruler/rpc-http.RPCOutWrite(0xc420088b00, 0x4d, 0x80)
/home/staaldraad/Go/gopath/src/github.com/sensepost/ruler/rpc-http/rpctransport.go:492 +0x24
github.com/sensepost/ruler/rpc-http.RPCBind(0xc420092cd0, 0xc420148638)
/home/staaldraad/Go/gopath/src/github.com/sensepost/ruler/rpc-http/rpctransport.go:242 +0x109
github.com/sensepost/ruler/mapi.mapiConnectRPC(0x58, 0x58, 0xc4201280c0, 0x58, 0x60, 0x97949f0400000000, 0x4e400000000, 0x40900000409, 0x1ffffffff, 0xc420012194, ...)
/home/staaldraad/Go/gopath/src/github.com/sensepost/ruler/mapi/mapi.go:172 +0x407
github.com/sensepost/ruler/mapi.AuthenticateRPC(0x7, 0xc42005e360, 0xc42005e301)
/home/staaldraad/Go/gopath/src/github.com/sensepost/ruler/mapi/mapi.go:331 +0x2ce
github.com/sensepost/ruler/mapi.Authenticate(0xc420080640, 0x78d31d, 0x7)
/home/staaldraad/Go/gopath/src/github.com/sensepost/ruler/mapi/mapi.go:294 +0x36
main.connect(0xc420080640, 0x78c2c8, 0x4)
/home/staaldraad/Go/gopath/src/github.com/sensepost/ruler/ruler.go:337 +0xdaf
main.main.func4(0xc420080640, 0x0, 0xc420080640)
/home/staaldraad/Go/gopath/src/github.com/sensepost/ruler/ruler.go:660 +0x2f
github.com/urfave/cli.HandleAction(0x723b20, 0x7bc0d8, 0xc420080640, 0xc42005e300, 0x0)
/home/staaldraad/Go/gopath/src/github.com/urfave/cli/app.go:483 +0xb9
github.com/urfave/cli.Command.Run(0x78d298, 0x7, 0x0, 0x0, 0xc4200630d0, 0x1, 0x1, 0x794ced, 0x1a, 0x0, ...)
/home/staaldraad/Go/gopath/src/github.com/urfave/cli/command.go:193 +0xb96
github.com/urfave/cli.(*App).Run(0xc420069380, 0xc420086000, 0xe, 0xe, 0x0, 0x0)
/home/staaldraad/Go/gopath/src/github.com/urfave/cli/app.go:250 +0x812
main.main()
/home/staaldraad/Go/gopath/src/github.com/sensepost/ruler/ruler.go:831 +0x1e25

tl;dr - Same problem as Issue #19 despite having the latest builds as of today.

[zz124lkjkchvba]

Is it possible that the 2nd error might actually be related to Unicode characters?

EDIT: Now it's just behaving pretty weird... wtf? I keep retrying it and it goes through the motions of:

Completely successful rule list
Error
RPC timeout

Might be something on the client's infrastructure end that is messing with it...

[staaldraad]

Hey!

That is pretty interesting. I've got a few ideas what might be causing this.

• If it is the same as what Freeze on RPC Bind #19 had

  • In the autodiscover.xml (it's in logs/email_address.xml) - is there a line: <AuthPackage>Ntlm</AuthPackage> or does it say <AuthPackage>basic</AuthPackage>

• It could be the infrastructure / connection speed. Hence the weird results. I've tried to "fudge" the RPC channel setup a little bit, as the server doesn't always respond straight away if auth failed. So ruler tries to go ahead and execute the MAPI requests. To try and prevent it from freezing, I put in a timeout on the read https://github.com/sensepost/ruler/blob/master/rpc-http/rpctransport.go#L530
  It could be timing out after 10 seconds, so if you are able to build the project, it might be worthit to increase that delay.
  Maybe increase it here as well: https://github.com/sensepost/ruler/blob/master/rpc-http/rpctransport.go#L187

I'll try figure out a better way of doing the channel synchronisation, which should eliminate this issue. Unfortunately there are a ton of different Exchange configurations :(

[staaldraad]

If you are able to build, I've pushed a few changes to the dev branch which could hopefully help with this.

There is an extra flag --noencrypt which changes the way the RPC/HTTP packet is sent. It will hopefully now detect other errors as well, such as 503, 400 and 401 within the created channels.

when using the dev branch, this is probably very useful: #21

[staaldraad]

Hey!

Was wondering if you got this working? Have you tried the latest builds?

A funny thing I've seen is moving networks helps at times, might be a latency thing - which means my code is rubbish.