The autodiscover service request did not complete about ruler HOT 9 CLOSED

@vysec So I've played with Outlook.com

not sure why it is responding with this message (could be my account, I'm using a @live.co.uk address)

./ruler -user "" -pass XXXXX -email "[email protected]" -display -url https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml 
[*] Retrieving MAPI info
[*] Doing Autodiscover for domain
[+] MAPI URL found:  https://outlook.office365.com/mapi/emsmdb/[email protected]
[+] User DN:  /o=First Organization/ou=Exchange Administrative Group(FYDIBOHF23SPDLT)/cn=Recipients/cn=0003BFFDFEF9FB24
[*] Got Context, Doing ROPLogin
[*] And we are authenticated
[+] Mailbox GUID:  [220 86 29 50 168 9 48 75 141 188 145 204 159 10 225 226]
[*] Openning the Inbox
[+] Retrieving Rules
[+] Found 0 rules
[*] And disconnecting from server

I'll try dig into the documentation when I've got some more time.

Thanks for trying it out! I'll see about adding some more intelligence to try both http and https :)

from ruler.

Thanks for your hard work :) I look forward to further using the tool and will test again this evening.

from ruler.

hi! Can you please give more context? this usually occurs if one of the following conditions exist:
1.) the domain does not have Autodiscover configured
To check for autodiscover domain -- host autodiscover.targetdomain.com
2.) check if the either of the following pages exist:
https://autodiscover.targetdomain.com/autodiscover/autodiscover.xml
https://targetdomain.com/autodiscover/autodiscover.xml
https://mail.targetdomain.com/autodiscover/autodiscover.xml
https://webmail.targetdomain.com/autodiscover/autodiscover.xml
3.) The credentials you are using are not valid. Try using the parameter: -basic to force basic authentication (NTLM might be disabled)

from ruler.

Same issue, I cannot even autodiscover outlook.com to add a rule to my own inbox.

from ruler.

Microsoft Exchange© 2010 Microsoft
Microsoft Outlook 2010
win7 64
Autodiscover/Autodiscover.xml,Need "http_html"Authentication

from ruler.

I've pushed an update to ruler so that there is more verbose output when Autodiscover fails. Can you please try that.
Alternatively use: https://testconnectivity.microsoft.com/ and select "outlook autodiscover".
If you can pass me the results here I can troubleshoot better. However Exchange 2010 doesn't come with MAPI/HTTP support unless SP1 has been applied and the protocol enabled (as far as I know)

from ruler.

@vysec the issue without Outlook.com seems to be that autodiscover.outlook.com is on HTTP only, Ruler tries to do https://autodiscover.outlook.com
Forcing it with either: -url https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml or -url http://autodiscover.outlook.com/autodiscover/autodiscover.xml
works.

Based on what i've seen with live.com/hotmail.com - it uses a slightly different request format for autodiscover.
The XML schema is http://schemas.microsoft.com/exchange/autodiscover/mobilesync/requestschema/2006 instead of the usual http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006

you can try changing

const autodiscoverXML = `<?xml version="1.0" encoding="utf-8"?><Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006">
<Request><EMailAddress>{{.Email}}</EMailAddress>
<AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema>
</Request></Autodiscover>`

To

const autodiscoverXML = `<Request><EMailAddress>{{.Email}}</EMailAddress><AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/mobilesync/responseschema/2006</AcceptableResponseSchema></Request></Autodiscover>`

Let me know how this goes, I've got a feeling there will be another issue that comes up, either no MAPI/HTTP or it is expecting mobisync, which isn't supported (yet)

Please bare in mind this was created to go after Exchange as deployed in corporate environments, rather than outlook.com/hotmail.com/live.com ect which are more geared towards webmail and mobile than Outlook native clients.

from ruler.

When I try your request, I get:

Domain Required...? Exact same request you put.

from ruler.

I think you solved this, based off of the tweet. I updated ruler.go as it was only checking for -domain and not -url

https://github.com/sensepost/ruler/blob/master/ruler.go#L68-L70

So latest version should work for anyone running into the same problem. The dev branch contains a version of autodiscover that will try 3 different ways of finding the autodiscover record, the same way Outlook does it (and it now tries http)

from ruler.