RE: DECODING EMAILS BETWEEN MS EXCHANGE AND A CLIENT

• Previous message: Jordan Del-Grande: "RE: verify HTTPS 'vulnerabilities'"
• In reply to: Dan Berberich: "re: DECODING EMAILS BETWEEN MS EXCHANGE AND A CLIENT"
• Next in thread: Dan Berberich: "RE: DECODING EMAILS BETWEEN MS EXCHANGE AND A CLIENT"
• Maybe reply: Dan Berberich: "RE: DECODING EMAILS BETWEEN MS EXCHANGE AND A CLIENT"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: "'Dan Berberich'" <dan.berberich@gmail.com>
Date: Thu, 21 Jul 2005 22:50:27 +0100

Dan

I am not aware there is one, also I have discovered that if the client is
configured to use exchange (as opposed to smtp, pop or imapi) then the comms
is done via DCE RPC (or so ethereal decodes it) - if you sniff the traffic
you will find only this traffic.

Some of the research I have done indicates that this RPC may be RC4
encrypted. This was sort of borne out by our sending of large files of
known text (all 111's) but the result was not like cypher text - more of a
double encoded type as there were noticable patterns in the cypher text.

Steve A

-----Original Message-----
From: Dan Berberich [mailto:dan.berberich@gmail.com]
Sent: 21 July 2005 13:51
To: pen-test@securityfocus.com
Subject: re: DECODING EMAILS BETWEEN MS EXCHANGE AND A CLIENT

Steve - funny, I'm currently working on the same problem. So far all I've
got is doing a session capture and packed decode with ethereal. I have also
exhaustively searched for a X.400 tool, but have so far found none. In my
free time I might be planning to write a parser to extract just the packet
payload, but I'm a little out of free time at the moment.

-dan

 
Steve said:
We currently have a task that requires us to perform a capture of emails
between an MS Exchange server and a MS Office Outlook (x400) client. I
recognise a dirth of SMTP and POP sniffing programs out there but nothing
seems to be able to decode the DCE RPC encoding/encryption of the exchange
client communications.

Is there anyone out there with knowledge of a product that will allow these
emails to to captured and monitored. Oh before anyone suggests any exchange
resident software, that option is out, we need to be external of the server
and not a member of the domain - just sniffing the stuff as it goes by.

Alternatively, does anyone know of a tool that will allow me to crack the
RPC encryption/encoding to see the email in clear before I replay it to a
server for keyword monitoring purposes?

Oh the architecture is a 200 server with exch 2003 and a XP client with
Office 2002 (incase that matters/helps)

All tips gratefully received.

Steve A

steve<at>logicallysecure.org

• Previous message: Jordan Del-Grande: "RE: verify HTTPS 'vulnerabilities'"
• In reply to: Dan Berberich: "re: DECODING EMAILS BETWEEN MS EXCHANGE AND A CLIENT"
• Next in thread: Dan Berberich: "RE: DECODING EMAILS BETWEEN MS EXCHANGE AND A CLIENT"
• Maybe reply: Dan Berberich: "RE: DECODING EMAILS BETWEEN MS EXCHANGE AND A CLIENT"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]