Transport Layer Error MAPI about ruler HOT 6 CLOSED

Hi!

First thoughts, with o365, typically they username isn't necessary (even with ADFS, in my experience). Since you've already discovered the autodiscover record, this should work:

go run ruler.go --o365 --debug --verbose  --email first.last@<domain>.com -p <redacted> check

I think with the --username there, ruler tries to do some NTLM against outlook.office365.com, where all that is required is basicAuth.

from ruler.

I get the same error when removing the --username

from ruler.

hmm, seems I'm wrong.. Just tried against my o365 domain, no ADFS though. and **--username ** didn't impact it.

from ruler.

could you try with --rpc ? Doubt it is going to work, but might be worth a shot

from ruler.

YOU ARE MY HERO. I swear I tried this before, but now I get a "good to go" response.

from ruler.

Woot! happy pwnage 👍

hahaha.. this must be my week.. yet another one to my "I do not understand computers" list. Brilliant!

p.s
I know this is asking a LOT but if at all possible, with heavy redaction, could you share the autodiscover record that got written to logs/email_domain.cache ?

My email is etienne [at] sensepost.com

• PGP key here: https://keys.sensepost.com/pks/lookup?op=get&search=etienne%40sensepost.com

from ruler.