pwnlook: an offensive post exploitation tool
pwnlook
Pwnlook is an offensive post exploitation tool that will give you complete control over the Outlook desktop application and therefore to the emails configured in it. What it does:
- List mailboxes
- List folders
- Gather emails information
- Read email
- Search by recipient or subject
- Download attachments
It’s possible to do almost everything that Outlook can do: send emails, create forward rules, list contacts… But all this is out of the scope of this project. At the end of the this README you will find some detection techniques.
Pwnlook is written in .NET 4.8.1
How it works
pwnlook communicates with Outlook via COM. By using the Redemption library it can gather all kind of information without triggering any alert to the user, even if you read an unread email the email will keep as unread for the user.
The tool comes with some limitations that are related with the, most likely, possibility of dealing with very big OST files. Thats why, for example, I didn’t implement an option to “list all emails”.
The Redemption64.dll must be in the same path as the pwnlook.exe. There is no need to register the DLL (Registry free COM) so you can run it on behalf of any user, even if it isn’t Local Admin.
