t1193.md

This is a post-exploitation module to send an email. There's a few preparation steps. This assumes you're sending from a gmail account.

Step 1 - Make gmail accounts

https://support.google.com/mail/answer/56256?hl=en

Step 2 - Turn on gmail API and download credentials.json

https://developers.google.com/gmail/api/quickstart/ruby

Put credentials.json in ./data/purple/t1193/credentials.json

Step 3 - Configure module

Set your to, from, payload, subject, etc

Step 4 - Run module

The first time you run it, you'll get a message like

msf5 auxiliary(windows/purple/t1193) > exploit
open the following url in the browser and enter the resulting code after authorization:
https://accounts.google.com/o/oauth2/auth?access_type=offline&approval_prompt=force&client_id=<masked>-<masked>.apps.googleusercontent.com&include_granted_scopes=true&redirect_uri=urn:ietf:wg:oauth:2.0:oob&response_type=code&scope=https://www.googleapis.com/auth/gmail.compose

Click the link and login with the gmail account you set-up in step 1. You'll be presented with a token, which you'll enter and then execution will continue.

The token should persist for a while. In our testing, the default expiration was about 30 minutes after generation.