Is it possible to use ruler to extract emails? about ruler HOT 3 CLOSED

Hi!

I think this new release does this really well (and probably better than I could in the current Ruler): https://github.com/QuickBreach/ExchangeRelayX

I'm still going to keep this on the TODO and wish lists. The above is tempting me to revisit the idea of NTLM relay through Ruler... Might just do email dumping before that as it's easier ;)

from ruler.

Hi!

Yes, there is limited support for extracting emails. This is undocumented, which reminds me I should write this info into the wiki.

./ruler <usual options> search --term password

Ruler will search for emails with body contents matching the search term. The second option to search for emails that have the term in the subject.

./ruler <usual options> search --term password --subject

The contents of the emails will be displayed to screen, there is no option to actually download the emails. This is more of a "bonus" feature than the core functionality of Ruler 😄

Hope that helps

from ruler.

Nice thanks! Any chance you would be expanding it to be able to dump all the emails from an account? It would be a pretty neat feature as no other tools seem to be able to do that with a ntlm hash? Would be great for post exploitation!

from ruler.