Exploitation Tools

Pwnlook – A Deep Dive Into Outlook Email Exploitation

Pwnlook is an offensive postexploitation tool that will give you complete control over the Outlook desktop application and therefore to the emails configured in it. What it does:

  • List mailboxes
  • List folders
  • Gather emails information
  • Read email
  • Search by recipient or subject
  • Download attachments

It’s possible to do almost everything that Outlook can do: send emails, create forward rules, list contacts… But all this is out of the scope of this project. At the end of the this README you will find some detection techniques.

Pwnlook is written in .NET 4.8.1

Compile

To compile it you need first to register both DLLs. This is only for compilation, there is no need to register the DLL where you execute it:

regsvr32.exe .\Redemption.dll
regsvr32.exe .\Redemption64.dll

You can unregister them later:

regsvr32.exe -u .\Redemption.dll
regsvr32.exe -u .\Redemption64.dll

Open the .sln with Visual Studio and compile it.

Then use ILMerge to create a single binary:

.\ILMerge.exe /target:pwnlook481.exe /out:pwnlook.exe pwnlook481.exe Newtonsoft.Json.dll

How It Works

pwnlook communicates with Outlook via COM. By using the Redemption library it can gather all kind of information without triggering any alert to the user, even if you read an unread email the email will keep as unread for the user.

The tool comes with some limitations that are related with the, most likely, possibility of dealing with very big OST files. Thats why, for example, I didn’t implement an option to “list all emails”.

The Redemption64.dll must be in the same path as the pwnlook.exe. There is no need to register the DLL (Registry free COM) so you can run it on behalf of any user, even if it isn’t Local Admin.

.\pwnlook.exe --help


                    .__                 __
________  _  ______ |  |   ____   ____ |  | __
\____ \ \/ \/ /    \|  |  /  _ \ /  _ \|  |/ /
|  |_> >     /   |  \  |_(  <_> |  <_> )    <
|   __/ \/\_/|___|  /____/\____/ \____/|__|_ \
|__|              \/                        \/


Usage: pwnlook.exe [options]

List mailboxes:
  -listmailboxes

List folders:
  -mailbox <mailbox> -listfolders

List emails from date:
  -mailbox <mailbox> -folder <Folder\Path> -date <yyyy-MM-dd>

List latest X emails from folder:
  -mailbox <mailbox> -folder <Folder\Path> -latest <X>

Read email:
  -mailbox <mailbox> -folder <Folder\Path> -id <ID>

Download attachment (base64):
  -mailbox <mailbox> -folder <Folder\Path> -id <ID> -attachment <X>

Search by sender or subject:
  -mailbox <mailbox> -folder <Folder\Path> -search <sender|subject> -value <string>

Result format in JSON
  -json

Examples:
.\pwnlook.exe -mailbox my@mail.com -folder "Inbox" -latest 20 -json        Lists latest 20 emails from Inbox

For more information click here.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

WhatsMyName App – Find Anyone Across 640+ Platforms

Overview WhatsMyName is a free, community-driven OSINT tool designed to identify where a username exists…

4 days ago

Analyzing Directory Size Linux Tools Explained

Managing disk usage is a crucial task for Linux users and administrators alike. Understanding which…

4 days ago

Understanding Disk Usage with du Command

Efficient disk space management is vital in Linux, especially for system administrators who manage servers…

4 days ago

How to Check Directory Size in Linux

Knowing how to check directory sizes in Linux is essential for managing disk space and…

4 days ago

Essential Commands for Linux User Listing

Managing user accounts is a core responsibility for any Linux administrator. Whether you’re securing a…

4 days ago

Command-Line Techniques for Listing Linux Users

Linux offers powerful command-line tools for system administrators to view and manage user accounts. Knowing…

5 days ago