exchange-owa-attack
Warn
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of
curl,grep,sed, andpython3to interact with remote systems. It explicitly attempts to create directories and write files to/root/output/exchange, a restricted location that implies the agent is operating with root-level privileges.\n- [DATA_EXFILTRATION]: The tool extracts internal network details, including Active Directory domain names, computer names, and NetBIOS names, by inducing and decoding NTLM Type-2 challenges from remote Exchange servers.\n- [PROMPT_INJECTION]: The skill documentation and implementation include specific reconnaissance data and target-specific details for organizations like Mairie Monaco and ENACOM Argentina, which functions as target-specific metadata poisoning or bias.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external servers using shell command substitution.\n - Ingestion points: Data is collected from remote HTTP headers (e.g.,
X-OWA-Version) and Autodiscover XML responses.\n - Boundary markers: Absent; data is passed directly into shell variables and a Python script.\n
- Capability inventory: The skill has the capability to execute system commands, write to the file system, and run Python code.\n
- Sanitization: Relies on basic text utilities (
grep,sed,cut), which may be insufficient to prevent injection if a target server returns malicious payloads.
Audit Metadata