gdedrouas / exchange-ad-privesc

Exchange privilege escalations to Active Directory

Exchange-AD-Privesc

This repository provides a few techniques and scripts regarding the impact of Microsoft Exchange deployment on Active Directory security. This is a side project of AD-Control-Paths, an AD permissions auditing project to which I recently added some Exchange-related modules.

TABLE OF CONTENT

0. General considerations
1. Domain object DACL privilege escalation
2. DNSAdmins group DACL privilege escalation
3. Public-Information property set includes SPN, allows kerberoasting
4. Public-Information property set includes Alt-Security-Identities, allows x509 certificate mapping to privileged users

General considerations

For pentesters looking to take control of an AD domain, Exchange is a valid intermediary target. The servers are much less secured than domain controllers by default and the control groups are distinct in the usual permissions models, which provides numerous alternative targets. They are also more difficult to migrate and business critical, so organizations often adopt a slower migration process for Exchange than for AD and do not specifically harden the servers.

Exchange deployment on an Active Directory domain is an interesting case. Many attributes and classes are added to the schema, security groups are created and DACL on some AD objects are heavily modified.

Basically, you can select among 3 permissions models:

• RBAC Split (recommended and most commonly deployed)
• Shared permissions (default)
• AD Split

Particularly, DACLs for RBAC Split and Shared models are enumerated here: https://technet.microsoft.com/en-us/library/ee681663(v=exchg.150).aspx .

High value targets:

• Exchange Trusted Subsystem and Exchange Windows Permissions groups, which are trustees for many ACE added during deployment on AD objects.
• Exchange servers: they are members of Exchange Trusted Subsystem and Exchange Windows Permissions groups. They can be compromised using many more techniques than domain controllers: local administrators domain accounts, Kerberos delegation, SMB relay, RODC replication, etc. The usual stuff.
• Organization admins: they are part of the local administrators group on Exchange servers. They also have full control on the OU containing the Exchange security groups. They can launch service/psexec/runas/... under computer identity/NetworkService/LocalSystem to control Exchange Trusted Subsystem and Exchange Windows Permissions SIDs.

exchange-ad-privesc's Issues

Alt-Security-Identities patched

Hey,

I noticed that this ACE here in my lab environment:

ObjectDN              : CN=AdminSDHolder,CN=System,DC=external,DC=local
InheritedObject       : Computer
Object                : Alt-Security-Identities
ActiveDirectoryRights : WriteProperty
InheritanceType       : All
ObjectType            : 00fbf30c-91fe-11d1-aebc-0000f80367c1
InheritedObjectType   : bf967a86-0de6-11d0-a285-00aa003049e2
ObjectFlags           : ObjectAceTypePresent, InheritedObjectAceTypePresent
AccessControlType     : Deny
IdentityReference     : EXTERNAL\Exchange Trusted Subsystem
IsInherited           : False
InheritanceFlags      : ContainerInherit
PropagationFlags      : None

There is an identical ACE on the domain head object. So the attack is now limited to users which are not protected by AdminSDHolder.

I can't find any information from Microsoft regarding when/how they added that. The only thing I could find was this comment on reddit: https://www.reddit.com/r/exchangeserver/comments/m0bafh/exchange_2016_cu19_ad_permission_change/