• https://www.messageware.com/microsoft-exchange-server-build-numbers-and-release-dates/

• https://mayfly277.github.io/posts/Exchange-part1/

• ProxyLogon:

  • https://testbnull.medium.com/ph%C3%A2n-t%C3%ADch-l%E1%BB%97-h%E1%BB%95ng-proxylogon-mail-exchange-rce-s%E1%BB%B1-k%E1%BA%BFt-h%E1%BB%A3p-ho%C3%A0n-h%E1%BA%A3o-cve-2021-26855-37f4b6e06265

  • https://antoanthongtin.gov.vn/tin/phan-tich-lo-hong-proxylogon-mail-exchange-rce-phan-1

  • https://antoanthongtin.gov.vn/tin/phan-tich-lo-hong-proxylogon-mail-exchange-rce-phan-2

  • https://www.praetorian.com/blog/reproducing-proxylogon-exploit/

  • https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxylogon_rce.rb

  • https://devco.re/blog/2021/08/06/a-new-attack-surface-on-MS-exchange-part-1-ProxyLogon/

  • https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server.pdf

• ProxyShell:

  • https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1

  • https://daniel-schwarzentraub.medium.com/tryhackme-boot-to-root-room-lookback-6e6d6c89c9e9

  • https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/

  • https://www.horizon3.ai/attack-research/attack-blogs/proxyshell-more-ways-for-more-shells/

• ProxyNotShell:

  • https://www.zerodayinitiative.com/blog/2022/11/14/control-your-types-or-get-pwned-remote-code-execution-in-exchange-powershell-backend

• CVE-2021–28482:

  • https://testbnull.medium.com/microsoft-exchange-from-deserialization-to-post-auth-rce-cve-2021-28482-e713001d915f

  • https://gist.github.com/testanull/9ebbd6830f7a501e35e67f2fcaa57bda

• CVE-2021–42321:

  • https://testbnull.medium.com/some-notes-of-microsoft-exchange-deserialization-rce-cve-2021-42321-f6750243cdcd

  • https://peterjson.medium.com/some-notes-about-microsoft-exchange-deserialization-rce-cve-2021-42321-110d04e8852

• CVE-2023–21707 (Biến thể của ProxyNotShell):

  • https://testbnull.medium.com/microsoft-exchange-powershell-remoting-deserialization-lead-to-rce-cve-2023-21707-4d0e6d282f02

I. ProxyLogon  Mail Exchange RCE

• 4 CVE:

  • CVE-2021-26855 (Mail Exchange Pre-Auth SSRF)

  • CVE-2021-26857 (Post-Auth Deserialization)

  • CVE-2021-26858 (Post-Auth arbitrary file write)

  • CVE-2021-27065 (Post-Auth arbitrary file write)

• CVE-2021-26855 Pre-Auth SSRF. Để khai thác cần chỉnh sửa cookie thành dạng:

    X-BEResource=EXCHANGE2016/owa/auth/logon.aspx?a=~1942062522;
  

• URL cuối cùng được forward tới Backend có dạng như sau:

  

• CVE-2021-27065 sử dụng tính năng ResetOAB trong Exchange admin center để ghi file. Để khai thác lỗ hổng này, đầu tiên tin tặc sẽ cần một tài khoản Admin mail exchange, sau đó sửa param External URL trong Exchange admin > Servers > Virtual Directories.