Ghost-Sender - Universal Email Spoofing against Exchange Onl...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://labs.infoguard.ch/posts/ghost-sender
• Blog Title: Ghost-Sender - Universal Email Spoofing against Exchange Online
• Suggested Section: Azure Pentesting / Microsoft 365 or Exchange Online Security / Initial Access & Phishing - Direct-to-tenant EOP SMTP spoofing

🎯 Content Summary

Ghost-Sender - Universal Email Spoofing against Exchange Online

Ghost-Sender is a widespread Exchange Online / Exchange hybrid mail-flow weakness affecting organizations that use Exchange Online Protection (EOP) behind an external MX record, such as a third-party mail gateway, spam filter, or on-premises filtering solution. In vulnerable configurations, Exchange Online still accepts SMTP mail sent directly to the tenant endpoint *.mail.protection.outlook.com...

🔧 Technical Details

Direct-to-tenant Exchange Online spoofing: When a Microsoft 365 tenant uses an external MX record but Exchange Online still accepts direct SMTP at *.mail.protection.outlook.com, an attacker can bypass the external mail gateway by sending mail directly to the tenant's EOP hostname. The attacker chooses an arbitrary From: address and sends to a real recipient through the tenant endpoint. In vulnerable configurations, Exchange Online records SPF/DKIM/DMARC failures but still delivers the message. Example PoC: Send-MailMessage -SmtpServer redacted-com.mail.protection.outlook.com -To admin@redacted.com -From noreply@example.com -Subject "Spoofed Ghost-Sender Email" -Body "This email was sent using the Ghost-Sender vulnerability. https://labs.infoguard.ch/posts/ghost-sender/" -BodyAsHTML.

Bypassing third-party email security by ignoring the MX path: If a domain's public MX points to a third-party gateway, for example mxb.eu....

🤖 Agent Actions

Done.

Updated:

• src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/README.md

Added:

• A concise “Exchange Online direct-to-tenant SMTP spoofing” subsection under Phishing
• Recon, minimal PoC, validation signals, mitigation/hunting notes
• References to the InfoGuard post and relevant Microsoft documentation

Validation:

• git diff --check passed
• mdbook build could not be run because mdbook is not installed in this environment

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://labs.infoguard.ch/posts/ghost-sender

Content Categories: Based on the analysis, this content was categorized under "Azure Pentesting / Microsoft 365 or Exchange Online Security / Initial Access & Phishing - Direct-to-tenant EOP SMTP spoofing".

Repository Maintenance:

• MD Files Formatting: 586 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0