Etienne Stalmans - Ruler - From Exchange to DA

## Overview Etienne Stalmans presents Ruler, a tool that demonstrates how attackers can escalate from limited Exchange mailbox access to domain admin. The talk covers reconnaissance of exposed Exchange services, three exploitation techniques, and defensive countermeasures. The work inspired significant Microsoft security patches and demonstrates the risks of internet-exposed Exchange deployments.

## Reconnaissance The speaker discusses how Outlook's Auto-Discover mechanism can be leveraged to identify Exchange instances. By scanning 260,000 domains against the auto-discover endpoint and checking for authentication-required responses (401/403 HTTP codes) and headers like the FE Server header, Stalmans identified approximately 26,000 companies running exposed Exchange. Additionally, Office 365 deployments expose mail.onmicrosoft.com subdomains, which can be passively footprinted via SSL certificate databases like Censys and VirusTotal without alerting defenders.

## Credential Access Three primary methods are discussed: brute force attacks against auto-discover endpoints (yielding credentials like "summer2017"), phishing using cloned mailbox login screens, and credential reuse from breaches. Analysis of the LinkedIn 2012 breach revealed that 18,287 of the 26,000 exposed companies had at least one employee with credentials still valid for corporate accounts years later.

## Exploitation: Three Techniques

**1. Outlook Rules Attack** (Nick Landers, Silent Break Security, November 2015): Client-side rules can execute applications on receipt of certain emails. By modifying rule files to point to UNC paths instead of local applications, attackers can fetch and execute remote shells. Ruler reduces attack time from hours (requiring mailbox synchronization) to under two minutes.

**2. Outlook Forms Attack** (Stalmans discovery): Custom forms with VBScript are published to the hidden associate table in a user's mailbox. The VBScript engine operates independently from the VBA security model, bypassing organizational macro restrictions. When published, forms synchronize across all Outlook instances via MAPI. An auto-delete rule triggers the form execution automatically, and the triggering message is permanently deleted, leaving no forensic evidence.

**3. Outlook Home Page Attack** (Zero-day, disclosed with Microsoft coordination for October patch): Administrators and users can set a URL as a folder home page. Outlook fetches and renders the HTML in an IE frame. Although sandboxed, the sandbox can be escaped by grabbing a handle to the view controller object, which references the parent Outlook application. From there, the createObject method can instantiate normally-blocked objects like WScript.Shell. The home page is cached locally, providing persistent code execution triggered whenever the user accesses the folder. A double bar in Outlook may hint at compromise but is easily missed.

## Technical Details The attacks rely on MAPI (Message Application Programming Interface) and ROP (Remote Operation) buffers to perform actions on Exchange. Communication occurs via RPC over HTTP (Outlook Anywhere) or MAPI over HTTP (default in Exchange 2016 and Office 365). Both protocols employ double NTLM authentication—at the HTTP level (typically over HTTPS) and within the encrypted RPC payload—making traffic inspection nearly impossible for defenders. The speaker notes this creates a stealthy C2 channel usable even in restrictive network environments.

## Ruler Tool Features Ruler automates these attacks, offering commands to: - Verify credentials and check if a user is active in Outlook - Create malicious forms or home pages - Perform server-side email searches - Download the Global Address Book (120,000+ valid emails in some cases) - Clean up artifacts (delete forms, rules, associated metadata) The tool sets a user agent "ruler" for detection purposes. A complementary tool, "not ruler," enables Exchange administrators to audit mailboxes for malicious rules, forms, and home pages without administrative access to individual workstations.

## Defenses and Microsoft Response Microsoft patched rules (December 2016) by disabling application-type rules in Outlook 2003 and 2006, though attackers can re-enable via registry. Forms were patched in September patch Tuesday, requiring multiple registry keys to enable custom VBScript forms. However, end-user patching rates remain low. The most effective defense is multi-factor authentication (MFA), which Microsoft introduced for Exchange 2016, Office 365, and recently extended to third-party integrators like Duo. Detection strategies include monitoring Exchange logs for the "ruler" user agent and domain controller event logs for "ruler" workstation names in NTLM authentication attempts. The "not ruler" tool provides an efficient audit capability for large organizations.