Some about config.yml about ruler HOT 5 CLOSED

Hi!

That all looks correct, for some reason it seems to be trying to do a GET ?Mailboxid... instead of GET rpcproxy.dll?Mailboxid

And I think the reason for this might be an extremely silly one...
in your config, could you add: ntlm: true before the mapiurl: ""

username: "Administrator"
email: "[email protected]"
password: "password"
domain: "codingkoala"
userdn: "/o=First Organization/ou=Exchange Administrative Group ‎(FYDIBOHF23SPDLT)‎/cn=Recipients/cn=Administrator96b"
mailbox: "[email protected]"
rpcurl: "https://192.168.179.150/rpc/rpcproxy.dll"
rpc: true
rpcencrypt: true
ntlm: true
mapiurl: ""

The yaml parsing I've done isn't great ;)

from ruler.

Thanks for your reply!

I added ntlm:true . It said I have an authentication error. So I changed it to false.

Then another error...

C:\Users\Administrator\Desktop>ruler --config config.yml check
[+] Binding to RPC
ERROR: 20:17:51 rpctransport.go:574: RPC Timeout
ERROR: 20:17:51 ruler.go:29: mapi: a transport layer error occurred. An error oc
curred setting up RPC. Invalid HTTP response:
[!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"
html xmlns="http://www.w3.org/1999/xhtml"
head
title IIS 7.5 Detailed Error -]

(I deleted '<>' because it may be concealed)

It seems that setting owa host as rpcurl rpcurl: "https://192.168.179.150/rpc/rpcproxy.dll" is not right.

from ruler.

finding RPC on the OWA host is a common situation but not guaranteed unfortunately. It looks like you are on an internal network, so it might be that RPC isn't available over HTTP. Internal configs are usually to use RPC/TCP (which ruler doesn't support)

if you check the headers from that response, or you try go to the OWA URL in a browser through a proxy like Burp, you could check if there is an X-FEServer header. that could point you to another host that might have /rpc/rpcproxy.dll available

from ruler.

Hi!
Is my error the same reason(an internal network)?

[+] Binding to RPC
ERROR: 15:23:40 rpctransport.go:574: RPC Timeout
ERROR: 15:24:52 ruler.go:29: mapi: a transport layer error occurred. An error occurred setting up RPC. Invalid HTTP response: [HTTP/1.0 503 RPC Error: 6ba]

Ruler always makes my server crash. But my RPC service seemed work fine before I execute ruler by config.yml.
Do I have to use a proxy?

from ruler.

Hi @Villyli

By "my server crash" do you mean the actual exchange server? The RPC service is returning a 503 error, indicating an internal server error for RPC. You could try changing the
ntlm: true to ntlm: false - which will likely give different behaviour. It could also be that you require a vaild domain: domainhere

from ruler.