Skip to content

Commit 1208cfe

Browse files
author
Etienne Stalmans
committed
update README with new flag and credits to @monoxgas
1 parent 23a6310 commit 1208cfe

1 file changed

Lines changed: 14 additions & 0 deletions

File tree

README.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -348,6 +348,18 @@ Deleting an existing is done in a similar way to deleting rules.
348348
./ruler --email john@msf.com form delete --suffix superduper
349349
```
350350

351+
### Trigger Form with a Rule
352+
353+
Nick Landers ([@monoxgas]) found that a form without event triggers, would call the VBScript payload on delete. This delete can be automated by creating a client-side rule to delete the message as it arrives in the mailbox.
354+
355+
This is a great way to auto-trigger the form, without requiring any user interaction. Ruler can automate this for you if you supply the ```--rule``` flag:
356+
357+
```
358+
./ruler --email john@msf.com form add --suffix superduper --input /tmp/command.txt --rule --send
359+
```
360+
361+
You will need to delete the newly created rule once your payload has triggered. This can be done using the delete command outlined [above].
362+
351363
# Attacking Exchange
352364

353365
The library included with Ruler allows for the creation of custom message using MAPI. This along with the Exchnage documentation is a great starting point for new research. For an example of using this library in another project, see [SensePost Liniaal].
@@ -359,3 +371,5 @@ The library included with Ruler allows for the creation of custom message using
359371
[Ruler on YouTube]:<https://www.youtube.com/watch?v=C07GS4M8BZk>
360372
[Releases]: <https://github.com/sensepost/ruler/releases>
361373
[SensePost Liniaal]:<https://github.com/sensepost/liniaal>
374+
[@monoxgas]:<https://twitter.com/monoxgas>
375+
[above]:<https://github.com/sensepost/ruler#delete-existing-rules-clean-up-after--yourself>

0 commit comments

Comments
 (0)