“The best feeling is to win by knockout.” – Nonito Donaire
Overview
KnockOutlook is a C# project that interacts with Outlook’s COM object in order to perform a number of operations useful in red team engagements.
Command Line Usage
<div class="snippet-clipboard-content position-relative" data-snippet-clipboard-copy-content=" __ __ __ ____ __ __ __ / //_/____ ____ _____/ /__/ __ \__ __/ /_/ /___ ____ / /__ / ,< / __ \/ __ \/ ___/ //_/ / / / / / / __/ / __ \/ __ \/ //_/ / /| |/ / / / /_/ / /__/ ,< / /_/ / /_/ / /_/ / /_/ / /_/ / ,< /_/ |_/_/ /_/\____/\___/_/\_\\____/\__,_/\__/_/\____/\____/_/\_\ Parameters: –operation : specify the operation to run –keyword : specify a keyword for the 'search' operation –id : specify an EntryID for the 'save' operation –bypass : bypass the Programmatic Access Security settings (requires admin) Operations: check : perform a number of checks to ensure operational security contacts : extract all contacts of every account mails : extract mailbox metadata of every account search : search for the provided keyword in every mailbox save : save a specified mail by its EntryID Examples: KnockOutlook.exe –operation check KnockOutlook.exe –operation contacts KnockOutlook.exe –operation mails –bypass KnockOutlook.exe –operation search –keyword password KnockOutlook.exe –operation save –id {EntryID} –bypass “>
__ __ __ ____ __ __ __
/ //_/____ ____ _____/ /__/ __ \__ __/ /_/ /___ ____ / /__
/ ,< / __ \/ __ \/ ___/ //_/ / / / / / / __/ / __ \/ __ \/ //_/
/ /| |/ / / / /_/ / /__/ ,< / /_/ / /_/ / /_/ / /_/ / /_/ / ,<
/_/ |_/_/ /_/\____/\___/_/\_\\____/\__,_/\__/_/\____/\____/_/\_\Parameters:
--operation : specify the operation to run
--keyword : specify a keyword for the 'search' operation
--id : specify an EntryID for the 'save' operation
--bypass : bypass the Programmatic Access Security settings (requires admin)
Operations:
check : perform a number of checks to ensure operational security
contacts : extract all contacts of every account
mails : extract mailbox metadata of every account
search : search for the provided keyword in every mailbox
save : save a specified mail by its EntryID
Examples:
KnockOutlook.exe --operation check
KnockOutlook.exe --operation contacts
KnockOutlook.exe --operation mails --bypass
KnockOutlook.exe --operation search --keyword password
KnockOutlook.exe --operation save --id {EntryID} --bypass