Jump to content
Sign in to follow this  
Nytro

Microsoft Exchange – Privilege Escalation

Recommended Posts

Microsoft Exchange – Privilege Escalation

September 16, 2019

Administrator Red Team CVE-2018-8581, Microsoft Exchange, NTLM Relay, Privilege Escalation, PushSubscription Leave a comment

Harvesting the credentials of a domain user during a red team operation can lead to execution of arbitrary code, persistence and domain escalation. However information that is stored over emails can be highly sensitive for an organisation and therefore threat actors focus can be to exfiltrate data from emails. This can be achieved either by adding a rule to the mailbox of a target user that will forward emails to an inbox that the attacker controls or by delegating access of a mailbox to their Exchange account.

Dustin Childs from Zero Day Initiative discovered a vulnerability in Microsoft Exchange that could allow an attacker to impersonate a target account. This vulnerability exist because by design Microsoft Exchange allows any user to specify a URL for Push Subscription and Exchange will send notifications to this URL. NTLM hashes are also leaked and can be used to authenticate with Exchange Web Services via NTLM relay with the leaked NTLM hash. The technical details of the vulnerability has been covered into the Zero Day Initiative blog.

Email Forwarding

Accessing the compromised account from Outlook Web Access (OWA) portal and selecting the permissions of the inbox folder will open a new window that will contain the permissions of the mailbox.

forwarding-rule-inbox-permissions.png?w= Inbox Permissions

The target account should be added to have permissions over the mailbox. This is required in order to retrieve the SID (Security Identifier) of the account.

forwarding-rule-permissions-inbox-folder Add Permissions for the Target Account

Opening the Network console in the browser and browsing a mailbox folder will generate a request that will be sent to the Microsoft Exchange server.

forwarding-rule-request-to-exchange.png? POST Request to Microsoft Exchange

Examining the HTTP Response of the request will unveil the SID of the Administrator account.

forwarding-rule-administrator-sid.jpg?w= Administrator SID

The implementation of this attack requires two python scripts from the Zero Day Initiative GitHub repository. The serverHTTP_relayNTLM.py script requires the SID of the Administrator that has been retrieved, the IP address of the Exchange with the target port and the email account that has been compromised and is in control of the red team.

forwarding-rule-relay-ntlm-script-config Configuration serverHTTP_relayNTLM script

Once the script has the correct values it can be executed in order to start a relay server.

1
python serverHTTP_relayNTLM.py
forwarding-rule-relay-server.png?w=682 Relay Server

The Exch_EWS_pushSubscribe.py requires the domain credentials and the domain of the compromised account and the IP address of the relay server.

forwarding-rule-push-subscribe.jpg?w=845 Push Subscribe Script Configuration

Executing the python script will attempt to send the pushSubscribe requests to the Exchange via EWS (Exchange Web Services).

1
python Exch_EWS_pushSubscribe.py
forwarding-rule-pushsubscribe.png?w=724 pushSubscribe python script
forwarding-rule-exchange-response.jpg?w= Exchange Response
forwarding-rule-pushsubscription-xml-res XML Reponse

The NTLM hash of the Administrator will be relayed back to the Microsoft Exchange server.

forwarding-rule-relay-administrator-ntlm Relay Administrator NTLM
forwarding-rule-relay-administrator-ntlm Relay Administrator NTLM to Exchange

Emails tha will be sent to the mailbox of the target account (Administrator) will be forwarded automatically to the mailbox that is under the control of the red team.

forwarding-rule-email-to-target-account. Email to target account

The email will be forwarded at the inbox of the account that the Red Team controls.

forwarding-rule-email-forwarded-automati Email forwarded automatically

A rule has been created to the target account by using NTLM relay to authenticate with the Exchange that will forward all the email messages to another inbox. This can be validated by checking the Inbox rules of the target account.

forwarding-rule-rule-to-forward-admin-em Rule – Forward Admin Emails

Delegate Access

Microsoft Exchange users can connect their account (Outlook or OWA) to other mailboxes (delegate access) if they have the necessary permissions assigned. Attempting to open directly a mailbox of another account withouth permissions will produce the following error.

privilege-escalation-open-another-mailbo Open Another Mailbox – No Permissions

There is a python script which is exploiting the same vulnerability but instead of adding a forwarding rule is assigning permissions to the account to access any mailbox in the domain including domain administrator. The script requires valid credentials, the IP address of the Exchange server and the target email account.

privilege-escalation-script-configuratio Script Configuration

Executing the python script will attempt to perform the elevation.

1
python2 CVE-2018-8581.py
microsoft-exchange-privilege-escalation- Privilege Escalation Script

Once the script is finished a message will appear that will inform the user that the mailbox of the target account can be displayed via Outlook or Outlook Web Access portal.

microsoft-exchange-privilege-escalation- Privilege Escalation Script – Delegation Complete

Authentication with Outlook Web Access is needed in order to be able to view the delegated mailbox.

microsoft-exchange-owa-authentication.jp Outlook Web Access Authentication

Outlook Web Access has a functionality which allows an Exchange user to open the mailbox of another account if he has permissions.

microsoft-exchange-open-another-mailbox. Open Another Mailbox

The following Window will appear on the screen.

microsoft-exchange-open-another-mailbox- Open Another Mailbox Window

The mailbox of the Administrator will open in another tab to confirm the elevation of privileges.

microsoft-exchange-administrator-mailbox

References

 

Sursa: https://pentestlab.blog/2019/09/16/microsoft-exchange-privilege-escalation/

  • Thanks 1

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this  

×
×
  • Create New...