Attacking Self-Hosted Skype for Business/Microsoft Lync Installations

[Nytro]

Attacking Self-Hosted Skype for Business/Microsoft Lync Installations

August 11, 2017

 

TL;DR: How to attack self-hosted Skype for Business (Lync) servers. If you’re using O365 wait for the next post.

Note: For the sake of brevity throughout this post, Skype for Business and Microsoft Lync will both be referred to under the umbrella designation of ‘Skype4B’.

When companies choose to host Skype for Business (previously Microsoft Lync) on-premises, they can inadvertently introduce a large attack surface.

Skype for Business, by design, is meant to encourage communication between individuals and it is often externally-accessible so that employees can stay connected 24×7 without the need for a VPN. This bit of convenience makes Skype4B an attractive target to attackers. In a very real sense, Skype4B provides a bridge from The Internet into a company’s internal network, allowing an attacker to interact with the internal Active Directory environment.

In this blog post, I will walk through information gathering, user-enumeration, and brute-force attacks against an internal network, using only the attack-surface opened by a standard implementation of self-hosted Skype for Business.

 

Article: https://www.trustedsec.com/2017/08/attacking-self-hosted-skype-businessmicrosoft-lync-installations/