Title: Spring and Autumn Cloud Mirror-[Simulation Scene] Exchange writeup

0x00 Intro

OSCP penetration style, leaving tools like C2 and MSF is not difficult

0x01 Info

Tag: JDBC, Exchange, NTLM, Coerce Authentication, DCSync

0x02 Recon

Target external IP39.98.179.149Nmap results directly follow the 8000 port. I have already missed 80 before, and I have nothing to pass directly. Huaxia ERP, there are many loopholes, the entry point has been stuck for a long time, and I saw JDBC later, and I directly searched for my brother's articles after Google searches.

Fastjson's high-version magic tricks - Bmth (bmth666.cn)(http://www.bmth666.cn/bmth_blog/2022/10/19/Fastjson%E9%AB%98%E7%89%88%E6%9C%AC%E7%9A%84%E5%A5%87%E6%8A%80%E6%B7%AB%E5%B7%A7/#%E8%93%9D%E5%B8%BD%E6%9D%AF2022%E5%86%B3%E8%B5%9B-%E8%B5%8C%E6%80%AA)Construction payload Configure MySQL_Fake_Server Unauthorized + MySQL Connector JDBC deserialization combination punch Direct RCE RCE after direct acquisition Flag01

0x03 Entry point: 172.22.3.12

SMB scans the intranet host, sees the Exchange keyword (EXC01), and tries to access 172.22.3.9. Beat the Exchange Proxylogon directly to obtain system permissions flag02 (short subsequent credential collection)

0x04 Entry point: 172.22.3.9

Fast forward 1: Hash of the exchange machine account has been collected 2: At the same time, a domain account credential was collected: Zhangtong has collected the exchange machine account hash through the above operation. The exchange machine account has writtenacl permissions for the entire domain-object in the domain. Then we directly use dacledit.py to add dcsync permissions to Zhangtong (in fact, you can also add dcsync to yourself) Dcsync to get the hashes of the domain manager and user lumia to enter 172.22.3.2 to get flag04

0x05 Final: 172.22.3.26

There is a secret.zip in the Lumia user folder above 172.22.3.26 Direct PTH Exchange exports all emails and attachments in Lumia mailbox item-0.eml, prompting that the password is mobile phone number There is a csv in the exported attachment, which is full of mobile phone number Regular operation, convert to a hash in pkzip format and runs the dictionary, and runs out the password flag03

0x06 Outro

After Exchange, the author's original intention is to let us use NTLM Relay to complete the DCSync upgrade, obtain Exchange SYSTEM permissions, and trigger the webdav to relay to ldap. If you are interested, you can read my previous article Spoofing 2. Lumia user logs in to exchange. The author also wants you to change the password of Lumia user, but I am lazy. Direct PTH original link: https://www.anquanke.com/post/id/286967