Microsoft Exchange 0day exploit code published

[woodyDa Boss]

According to Thomas Claburn at The Reg: Microsoft Exchange appears to be currently vulnerable to a privilege escalation attack that allows any user wi
[See the full post at: Microsoft Exchange 0day exploit code published]

4 users thanked author for this post.

ch100,

rontpxz81,

abbodi86,

PhotM

[anonymous]

Read the Mollema article? There is a lot of info there?

[Mr. NaturalAskWoody Plus]

I wonder if this could be related to the O365 outage in Europe? They were saying domain controllers were causing the outages.

Red Ruffnsore reporting from the front lines.

1 user thanked author for this post.

NetDef

[NetDefAskWoody_MVP]

My first thought as well, although we may never know.

 

Makes me very glad my last self-hosted Exchange server was retired last year.  They were always very high maintenance (I supported pretty much every version from v.4.0 through v.2013 . . . )

Now that they are all on O365 or GMail all I have to worry about is whether/when they get compromised and my users impersonated.

Oh, wait . . .

 

:O

~ Group "Weekend" ~

2 users thanked author for this post.

ch100,

PKCano

[bAskWoody Plus]

Despite Microsoft’s CVE-2018-8581 saying “no mitigations or workarounds”, the FAQ has a single command to delete a registry value on the Exchange Server: “The vulnerability described by CVE-2018-8581 is unexploitable if the DisableLoopbackCheck registry value is removed.“, which is acknowledged by the exploit author in his list of seven alternative mitigations (and appears to be the only forthcoming fix anyway).

So the exploit seems tricky to implement and easy to prevent. Theoretical rather than practical? (Of course, potential escalation to Domain Admin should not be trivialized.)

Cannon fodder Chump Daft glutton Idiot Sucker More intrepid Crazy/ignorant Toxic drinker "Saluted blockhead" (Group ASAP)

2 users thanked author for this post.

ch100,

AlexEiffel

[woodyDa Boss]

That’s what the CVE says… and it’s partially backed up by a phrase in the Mollema article.

I still haven’t figured out, tho, if it requires a MITM attack. Those are relatively hard to come by.

[bAskWoody Plus]

When Microsoft first published the CVE 10 weeks ago, the original proof-of-concept involved a domain user being able to intercept any other user’s email:

Impersonating Users on Microsoft Exchange

This week’s Mollema article and new proof-of-concept extends beyond Exchange to gain Domain Admin rights, but deleting the same registry value is the fix for both aspects.

Cannon fodder Chump Daft glutton Idiot Sucker More intrepid Crazy/ignorant Toxic drinker "Saluted blockhead" (Group ASAP)

2 users thanked author for this post.

woody,

Elly

[anonymous]

This is incorrect. Removing the registry key only prevents attackers from sending authentication back to the Exchange server (reflection attack), it does not prevent sending the authentication that Exchange performs to a Domain Controller (relay attack).

The other mitigations should be applied to prevent the relay attack from working.

A mitm position is not required to perform the attack.

2 users thanked author for this post.

woody,

b

[bAskWoody Plus]

Thanks for the correction. I thought I had understood the tangled web.

I now realize that Microsoft’s CVE-2018-8581 has not been updated since the Domain Controller attack was published.

And the PowerShell script fix to protect Domain Admin rights was confirmed yesterday by DHS/CERT:
VU#465632

Cannon fodder Chump Daft glutton Idiot Sucker More intrepid Crazy/ignorant Toxic drinker "Saluted blockhead" (Group ASAP)

3 users thanked author for this post.

NetDef,

Elly,

woody

[gbornAskWoody_MVP]

Mr. Natural wrote:

I wonder if this could be related to the O365 outage in Europe? They were saying domain controllers were causing the outages.

I don’t think so – the office365.com Exchange Online outage seems to be a broken load balancing issue in Domain Controller (not a hack, see my today article)

The vulnerability CVE-2018-8581 has been known since Nov. 2018 – see my blog post

https://borncity.com/win/2018/11/20/vulnerability-in-exchange-server-2010-2019/

The only thing that’s new is the fact, that a Proof of Concept is now public.

• This reply was modified 3 weeks ago by
  
   gborn.

1 user thanked author for this post.

Mr. Natural

[rontpxz81AskWoody Lounger]

Forgive my ignorance, but does this effect Outllook?

[bAskWoody Plus]

rontpxz81 wrote:

Forgive my ignorance, but does this effect Outlook?

Not really, although Outlook Web Access is used as part of the published mailbox hijacking attack.

If your Outlook connects to a company or school Exchange server, it’s for an Exchange Admin to fix, patch or check registry settings; as in that case your emails could theoretically get diverted to someone else’s mailbox.

Cannon fodder Chump Daft glutton Idiot Sucker More intrepid Crazy/ignorant Toxic drinker "Saluted blockhead" (Group ASAP)

2 users thanked author for this post.

Elly,

columbia2011

[AvielAskWoody Lounger]

If domain admins members have no mailboxes, can the forces of evil still use this to steal their powers?

[Mr. NaturalAskWoody Plus]

Magic 8 ball says yes.

Red Ruffnsore reporting from the front lines.

Attachments:

You must be logged in to view attached files.

[bAskWoody Plus]

U.S. Department of Homeland Security issued a vulnerability notification;
CERT/CC Reports Microsoft Exchange 2013 and Newer are Vulnerable to NTLM Relay Attacks

which links to CERT Coordination Center (CERT/CC) Vulnerability Note VU#465632;
Microsoft Exchange 2013 and newer are vulnerable to NTLM relay attacks

which provides a concise description of the issue and workarounds for Exchange Server or Domain Controller, along with;

Impact

An attacker that has credentials for an Exchange mailbox and also has the ability to communicate with both a Microsoft Exchange server and a Windows domain controller may be able to gain domain administrator privileges. It is also reported that an attacker without knowledge of an Exchange user’s password may be able to perform the same attack by using an SMB to HTTP relay attack as long as they are in the same network segment as the Exchange server.

Cannon fodder Chump Daft glutton Idiot Sucker More intrepid Crazy/ignorant Toxic drinker "Saluted blockhead" (Group ASAP)

1 user thanked author for this post.

columbia2011

[bAskWoody Plus]

New mitigations and workarounds:

ADV190007 | Guidance for “PrivExchange” Elevation of Privilege Vulnerability
Security Advisory
Published: 02/05/2019

A planned update is in development.

Cannon fodder Chump Daft glutton Idiot Sucker More intrepid Crazy/ignorant Toxic drinker "Saluted blockhead" (Group ASAP)

3 users thanked author for this post.

woody,

columbia2011,

Kirsty

[Author]

Posts