A tool to abuse Exchange services
Ruler is a tool that allows you to interact with Exchange servers remotely, through either the MAPI/HTTP or RPC/HTTP protocol. The main aim is abuse the client-side Outlook features and gain a shell remotely.
The full low-down on how Ruler was implemented and some background regarding MAPI can be found in our blog posts: * Ruler release * Pass the Hash with Ruler * Outlook forms and shells * Outlook Home Page – Another Ruler Vector
For a demo of it in action: Ruler on YouTube
Ruler has multiple functions and more are planned. These include
Ruler attempts to be semi-smart when it comes to interacting with Exchange and uses the Autodiscover service (just as your Outlook client would) to discover the relevant information.
Ruler has multiple functions, these have their own documentation that can be found in the wiki:
The library included with Ruler allows for the creation of custom message using MAPI. This along with the Exchange documentation is a great starting point for new research. For an example of using this library in another project, see SensePost Liniaal.
Ruler is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License (http://creativecommons.org/licenses/by-nc-sa/4.0/) Permissions beyond the scope of this license may be available at http://sensepost.com/contact/.