Pwnlook – A Deep Dive Into Outlook Email Exploitation

Pwnlook is an offensive postexploitation tool that will give you complete control over the Outlook desktop application and therefore to the emails configured in it. What it does:

• List mailboxes
• List folders
• Gather emails information
• Read email
• Search by recipient or subject
• Download attachments

It’s possible to do almost everything that Outlook can do: send emails, create forward rules, list contacts… But all this is out of the scope of this project. At the end of the this README you will find some detection techniques.

Pwnlook is written in .NET 4.8.1

Compile

To compile it you need first to register both DLLs. This is only for compilation, there is no need to register the DLL where you execute it:

regsvr32.exe .\Redemption.dll
regsvr32.exe .\Redemption64.dll

You can unregister them later:

regsvr32.exe -u .\Redemption.dll
regsvr32.exe -u .\Redemption64.dll

Open the .sln with Visual Studio and compile it.

Then use ILMerge to create a single binary:

.\ILMerge.exe /target:pwnlook481.exe /out:pwnlook.exe pwnlook481.exe Newtonsoft.Json.dll

How It Works

pwnlook communicates with Outlook via COM. By using the Redemption library it can gather all kind of information without triggering any alert to the user, even if you read an unread email the email will keep as unread for the user.

The tool comes with some limitations that are related with the, most likely, possibility of dealing with very big OST files. Thats why, for example, I didn’t implement an option to “list all emails”.

The Redemption64.dll must be in the same path as the pwnlook.exe. There is no need to register the DLL (Registry free COM) so you can run it on behalf of any user, even if it isn’t Local Admin.

.\pwnlook.exe --help


                    .__                 __
________  _  ______ |  |   ____   ____ |  | __
\____ \ \/ \/ /    \|  |  /  _ \ /  _ \|  |/ /
|  |_> >     /   |  \  |_(  <_> |  <_> )    <
|   __/ \/\_/|___|  /____/\____/ \____/|__|_ \
|__|              \/                        \/


Usage: pwnlook.exe [options]

List mailboxes:
  -listmailboxes

List folders:
  -mailbox <mailbox> -listfolders

List emails from date:
  -mailbox <mailbox> -folder <Folder\Path> -date <yyyy-MM-dd>

List latest X emails from folder:
  -mailbox <mailbox> -folder <Folder\Path> -latest <X>

Read email:
  -mailbox <mailbox> -folder <Folder\Path> -id <ID>

Download attachment (base64):
  -mailbox <mailbox> -folder <Folder\Path> -id <ID> -attachment <X>

Search by sender or subject:
  -mailbox <mailbox> -folder <Folder\Path> -search <sender|subject> -value <string>

Result format in JSON
  -json

Examples:
.\pwnlook.exe -mailbox my@mail.com -folder "Inbox" -latest 20 -json        Lists latest 20 emails from Inbox

For more information click here.