PrivExchange

PrivExchange أدوات POC المصاحبة للمدونة Abusing Exchange: One API call away from Domain Admin. المتطلبات تتطلب هذه الأدوات impacket. يمكنك تثبيته من pip باستخدام pip install impacket، لكن يُنصح باستخدام أحدث إصدار من GitHub. privexchange.py تقوم هذه الأداة ببساطة بتسجيل الدخول إلى خدمات Exchange...

SharpExchangePriv

SharpExchangePriv الوصف تنفيذ بلغة C لأداة PrivExchange بواسطة @dirkjan. الشكر موصول لـ @g0ldenGunSec، حيث اعتمدت على كوده. تم اختباره ضد Exchange 2016. تعليمات التجميع تم بناء SharpExchangePriv باستخدام .NET 3.5 وهو متوافق مع Visual Studio 2017. ما عليك سوى فتح ملف الحل وبناء المشروع. استخدمت...

PrivExchange

This is a proof-of-concept PoC tool for abusing Microsoft Exchange to obtain Domain Admin privileges. The tool, named PrivExchange, requires the Impacket library and can be used to subscribe to push notifications on Exchange Web Services, which will make Exchange connect back to the attacker and...

Microsoft Patches Zero Day Browser Bug Under Active Attack

It’s a busy Patch Tuesday for Microsoft with a total of 20 critical vulnerabilities addressed in this February’s monthly security bulletin. Four bugs, rated important, were previously publicly known. Worse, Microsoft said a zero-day bug tied to its Internet Explorer browser, also rated important,...

Microsoft Confirms Serious 'PrivExchange' Vulnerability

Microsoft acknowledged an elevated privilege flaw in its Exchange Server could allow a remote attacker with a simple mailbox account to gain administrator privileges. Both a Microsoft advisory and a US-CERT alert were issued on Tuesday warning users of the elevation of privilege flaw, dubbed...