How to hack an unpatched Exchange server with rogue PowerShell code – Naked Security

Slightly below two months in the past, some worrying bug information broke: a pair of zero-day vulnerabilities had been introduced in Microsoft Trade.

As we suggested on the time, these vulnerabilities, formally designated CVE-2022-41040 and CVE-2022-41082:

[were] two zero-days that [could] be chained collectively, with the primary bug used remotely to open sufficient of a gap to set off the second bug, which probably permits distant code execution (RCE) on the Trade server itself.

The primary vulnerability was harking back to the troublesome and widely-abused ProxyShell safety gap from again in August 2021, as a result of it relied on harmful behaviour in Trade’s Autodiscover characteristic, described by Microsoft as a protocol that’s “utilized by Outlook and EAS [Exchange ActiveSync] purchasers to seek out and hook up with mailboxes in Trade”.

Thankfully, the Autodiscover misfeature that may very well be exploited within the ProxyShell assault by any distant person, whether or not logged-in or not, was patched greater than a 12 months in the past.

Sadly, the ProxyShell patches didn’t do sufficient to shut off the exploit to authenticated customers, resulting in the brand new CVE-2022-40140 zero-day, which was quickly laconically, if misleadingly, dubbed ProxyNotShell.

Not as harmful, however harmful nonetheless

Clearly, ProxyNotShell was nowhere close to as harmful as the unique ProxyShell, provided that it required what’s referred to as authenticated entry, so it wasn’t open to abuse by simply anyone from wherever.

Nevertheless it rapidly transpired that on many Trade servers, figuring out any person’s logon identify and password could be sufficient to cross as authenticated and mount this assault, even when that person would themselves want to make use of two-factor authentication (2FA) to logon correctly to entry their electronic mail.

As Sophos knowledgeable Chester Wisniewski put it on the time:

It’s a “mid-authentication vulnerability”, if you wish to name it that. That may be a combined blessing. It does imply that an automatic Python script can’t simply scan the entire web and probably exploit each Trade server on this planet in a matter of minutes or hours, as we noticed occur with ProxyLogon and ProxyShell in 2021. […]

You want a password, however discovering one electronic mail deal with and password mixture legitimate at any given Trade server might be not too troublesome, sadly. And also you may not have gotten exploited thus far, as a result of to efficiently log into Outlook Net Entry [OWA] requires their FIDO token, or their authenticator, or no matter second issue you is perhaps utilizing.

However this assault doesn’t require that second issue. […] Simply buying a username and password mixture is a reasonably low barrier.

As you most likely bear in mind, many people assumed (or at the very least hoped) that Microsoft would rush to get a repair out for the ProxyNotShell holes, given that there have been nonetheless two weeks till October’s Patch Tuesday.

However we had been disillusioned to seek out {that a} dependable repair was apparently extra complicated than anticipated, and October got here and went with ProxyNotShell addressed solely by workarounds, not by correct patches.

Even November’s Patch Tuesday didn’t immediately present the wanted fixes, although the patches nonetheless got here out on the identical day as a part of an Trade-specific safety replace that may very well be fetched and put in individually:

Proof-of-concept revealed

Now that the mud has settled and everybody has had time to patch their Trade servers (those they haven’t forgotten about, at the very least), researchers at Zero Day Initiative (ZDI), to which these vulnerabilities had been initially responsibly disclosed for submission to Microsoft, have defined how the bugs might be exploited.

The unhealthy information, relying in your opinion of overt exploit disclosures, is that the ZDI crew has now successfully supplied a proof-of-concept (PoC) explaning how you can assault Trade servers.

The excellent news, in fact, is that:

• We will now examine and perceive the bugs ourselves. This not solely helps us all to make sure that the general precautions we have now taken (not merely restricted to patching) are possible to supply the safety we anticipate, but in addition informs us of progamming practices that we’ll need to keep away from in future, so we don’t get trapped into opening up bugs of this kind in our personal server-side code.
• We now don’t have any excuses left for not making use of the patches. If we’ve dragged our ft about updating, ZDI’s clarification of why the assault works makes it clear that the treatment is unquestionably preferable to the illness.

The way it works

ZDI’s clarification of this vulnerability makes for an interesting story of how complicated it may be to chain collectively all of the components that you must flip a vulnerability right into a viable exploit.

It’s additionally value studying that can assist you perceive why digging into an present exploit can assist to disclose different ways in which a vulnerability may very well be misused, probably prompting extra patches, urging configuration adjustments, and selling new programming practices which may not have been apparent simply from fixing the unique gap.

The reason is, of necessity, difficult and fairly technical, and leads you forwards by a prolonged collection of steps to realize distant code execution (RCE) on the finish.

Within the hope of serving to you comply with the high-level particulars extra simply in the event you determine to learn the ZDI report, right here’s a hopefully-not-too-simplified abstract with the steps listed in reverse…

…so you’ll know prematurely why the story takes the instructions it does:

• STEP 4. Remotely trick Trade into instantiating a .NET object of your selection, with an initialisation parameter of your selection.

In trendy coding, an instantiated object is the jargon phrase for an allotted chunk of reminiscence, routinely initialised with the info and assets it’ll want whereas it’s in use, and tied to a selected set of capabilities that may function on it. (Instantiate is only a fancy phrase for create.)

Objects could also be managed and managed by the working system itself, to assist keep away from the type of reminiscence mismanagement errors frequent in a language equivalent to C, the place you usually must allocate reminiscence your self, replenish the related knowledge fields by hand, and bear in mind to launch the reminiscence and assets you’re utilizing, equivalent to community sockets or disk information, once you’re finished.

Objects usually have a programmatic operate related to them known as a constructor, which is routinely executed when a brand new object is created so as to allocate the correct quantity of reminiscence and the right set of system assets.

Normally, that you must cross a number of parameters as arguments to the constructor, to indicate the way you need the item to be configured when it begins out.

Merely put, in the event you instantiate, say, a TextString object (we’re making these names up, however you get the thought) utilizing a parameter that’s itself a textual content string equivalent to instance.com:8888…

…you’ll most likely find yourself with a reminiscence buffer allotted to carry your textual content, initialised so it holds the identical worth you handed in, particularly the uncooked textual content instance.com:8888.

In that context, the textual content string handed in as knowledge to the item constructor doesn’t instantly pose any apparent cybersecurity risk once you set off the constructor remotely, apart from a doable denial of service (DoS) by repeatedly asking for greater and greater strings to attempt to exhaust reminiscence.

However in the event you had been to instantiate, say, a ConnectedTCPClient object utilizing the exact same textual content string parameter of instance.com:8888, you may find yourself with a reminiscence buffer prepared to carry short-term knowledge, together with a community socket allotted by the working system that’s able to change knowledge woith the server instance.com over TCP port 8888.

You may see the distant code execution danger there, even in the event you by no means get to ship any knowledge to the open socket, given that you just’ve tricked the server into calling house to a location that you just management.

You may even discover an object known as, say, RunCmdAndReadOutput, the place the textual content string you ship as a parameter is, fairly actually, a command you need to run routinely as quickly the item is created, so you possibly can acquire its output later.

Even in the event you by no means get to get better the output of the command, simply instantiating such an object would nonetheless allow you to select a command to run, thus supplying you with generic distant code execution and presenting a danger restricted solely by the entry rights of the server course of itself.

In fact, the assault is barely this simple when you get to the final stage, which you’re not supposed to have the ability to do, as a result of Trade has a strict allowlist that forestalls you from selecting any outdated object to instantiate.

In principle, solely protected or low-risk objects might be created remotely by way of PowerShell, in order that instantiating our imaginary TextString above, or a SimpleIntegerValue, is perhaps thought of acceptable, whereas a ConnectedTCPClient or a RunCmdAndReadOutput would positively not be.

However the ZDI researchers discover that earlier than triggered the final step, they might do that:

• STEP 3. Remotely trick Trade into pondering {that a} low-risk object that’s handed the security check is, in reality, another object of your selection.

Even so, you may anticipate Trade to stop the distant creation even of low-risk objects, to minimise the risk even additional.

However the researchers discovered that they might:

• STEP 2. Remotely trick Trade into utilizing its PowerShell Remoting characteristic to create an object based mostly on initialisation parameters managed externally.

And that was doable due to the ProxyShell-like gap that was solely semi-patched:

• STEP 1. Remotely trick Trade into accepting and processing an internet request with code in by packing a legitimate username:password discipline into the request as effectively.

Even when the person named within the request wasn’t really logged in, and would want to undergo some type of 2FA course of to entry their very own mailbox, an attacker who knew their username:password mixture would have sufficient authentication info to trick Trade into accepting an internet connection that may very well be used to kick off the assault chain described in steps 2 to 4 above.

Loosely talking, any legitimate username:password mixture would do, provided that the “authentication” was wanted merely to stop Trade from rejecting the HTTP request up entrance.

What to do?

Notice that this assault solely works:

• In case you have on-premises Trade servers. Microsoft claims to have locked down its personal cloud providers rapidly, so Trade On-line just isn’t affected. Be sure you know the place your Trade servers are. Even in the event you now use Trade On-line, you should still have on-premises servers working, maybe left over by mistake out of your migration course of.
• In case your servers are unpatched. Be sure you have utilized the Trade Software program Replace of 2022-11-08 to shut off the vulnerabilities that the exploit requires.
• In case your servers nonetheless settle for Fundamental Authentication, often known as legacy authentication. Be sure you have blocked all features of legacy authentication so your servers gained’t settle for the username:password headers talked about above, and gained’t settle for dangerous Autodiscover protocol requests within the first place. This stops attackers tricking a server into accepting their booby-trapped object instantiation methods, even when that server isn’t patched.

You may keep track of our official prevention, remediation and response recommendation, and Sophos prospects can maintain observe of the risk detection names utilized by our merchandise, by way of the Sophos X-Ops Twitter feed (@SophosXOps).

New info has been printed concerning CVE-2022-41040 and CVE-2022-41082: https://t.co/pHUVBjUeDI 1/3

— Sophos X-Ops (@SophosXOps) November 21, 2022

LEARN MORE ABOUT EXCHANGE AUTHENTICATION AND OAUTH2

With Paul Ducklin and Chester Wisniewski
Intro and outro music by Edith Mudge.