Ruler
🔥 Offensive Ops · Go
Ruler is a tool for interacting with Exchange servers through the MAPI/HTTP or RPC/HTTP protocol. It exploits legitimate Exchange and Outlook features (mail rules, forms, and home pages) to achieve remote code execution on target workstations. When a user opens Outlook, malicious rules trigger command execution, or injected forms/home pages render attacker-controlled content with script execution. Ruler can also enumerate valid credentials via brute-force, perform autodiscover probing, and extract the Global Address List. It demonstrates how Exchange features become attack vectors in enterprise environments.
Installation
$ go install github.com/sensepost/ruler@latestUse Cases
- Achieving RCE via malicious Outlook mail rules
- Exploiting Exchange forms for code execution
- Enumerating Exchange credentials and GAL extraction
- Demonstrating email infrastructure attack paths
Tags
Details
- Category
- 🔥 Offensive Ops
- Language
- Go
- Repository
- sensepost/ruler
- Platforms
- 🐧linux🍎macos🪟windows
Links
Community Reviews
Alternatives & Comparisons
Evil-WinRM
RubyUltimate WinRM shell for pentesting. Upload/download, in-memory PowerShell, DLL injection, pass-the-hash.
Compare Ruler vs Evil-WinRMMore in Offensive Ops
Mythic
GoCollaborative, multi-platform C2 framework. Docker-based with web UI, multiple agent types, and plugin architecture.
Havoc
C/C++Modern C2 framework. Qt-based GUI, BOF support, custom agents, and a Cobalt Strike-inspired workflow.
Rubeus
C#C# toolset for raw Kerberos interaction and abuse. AS-REP roasting, Kerberoasting, ticket manipulation, delegation attacks.
Certipy
PythonActive Directory Certificate Services (AD CS) abuse tool. Find and exploit certificate template misconfigurations.
Coercer
PythonAutomatically find and exploit Windows authentication coercion vulnerabilities. PetitPotam, PrinterBug, and more.
SharpHound
C#Official BloodHound data collector. Enumerates Active Directory objects, sessions, ACLs, and trusts for graph analysis.