<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2529 " id="quads-ad2529" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>
<h2>The Story</h2>
<p>After the disastrous exploit that was found in Microsoft Exchange Servers lots of corporations started immediately patching their servers with the latest Cumulative update and Security patches. The question is would those patches be enough if the server is already hacked or have a backdoor installed already?</p>
<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2526 " id="quads-ad2526" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>

<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2522 " id="quads-ad2522" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>

<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2524 " id="quads-ad2524" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>

<p><a href="https://www.moh10ly.com/wp-content/uploads/2021/03/image.png"><img style="margin: 0px; display: inline; background-image: none;" title="image" src="https://www.moh10ly.com/wp-content/uploads/2021/03/image_thumb.png" alt="image" width="1028" height="680" border="0" /></a> 

<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2523 " id="quads-ad2523" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>
 
</p>
<h2>What are those 0-day exploits ?</h2>
<p>The vulnerabilities recently being exploited were CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 which are part of alleged “State-sponsored Chinese group” according to Microsoft.</p>
<p><strong>Let’s get into details of those exploits one by one:</strong></p>
<p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855">CVE-2021-26855</a> is a server-side request forgery (SSRF) vulnerability in Exchange which allowed the attacker to send arbitrary HTTP requests and authenticate as the Exchange server.</p>
<p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857">CVE-2021-26857</a> is an insecure deserialization vulnerability in the Unified Messaging service. Insecure deserialization is where untrusted user-controllable data is deserialized by a program. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit.</p>
<p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858">CVE-2021-26858</a> is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.</p>
<p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065">CVE-2021-27065</a> is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.</p>
<h2>How to proceed ?</h2>
<p>Microsoft released couple of tools that could diagnose your servers and check if you already have been infected with a backdoor or any of these nasty malware and also remove those infected files or clean them and ask you for a restart if it’s required.</p>
<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2525 " id="quads-ad2525" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>

<p>Tools:</p>
<ol>
<li>MSERT (Microsoft Safety Scanner) detects web shells, <a href="https://definitionupdates.microsoft.com/download/DefinitionUpdates/VersionedSignatures/AM/1.333.160.0/amd64/MSERT.exe" target="_blank" rel="noopener">Download here</a> .</li>
<li>Health Checker (Scans your server for any vulnerabilities and whether you have updated Server CU and installed patches). <a href="https://mega.nz/folder/jlUh2CYD#BKUDo2i6Jsbc-XGI0uRwFA" target="_blank" rel="noopener">Download here</a></li>
<li>Exchange WebShell Detection (A simple PowerShell that is fast and checks if your IIS or Exchange directory has been exploited). <a href="https://mega.nz/folder/jlUh2CYD#BKUDo2i6Jsbc-XGI0uRwFA" target="_blank" rel="noopener">Download here</a></li>
<li>Scan your exchange server for proxy logon:<br />
<a href="https://github.com/microsoft/CSS-Exchange/tree/main/Security">https://github.com/microsoft/CSS-Exchange/tree/main/Security</a></li>
<li>Microsoft very recently created a mitigation tool for Exchange on-premises that would rewrite url for the infected servers and recover the files that were changed. You can download the tools from this github link.
<p><a href="_wp_link_placeholder" data-wplink-edit="true">https://github.com/microsoft/CSS-Exchange/tree/main/Security</a></p>
<p>Copy the Test-ProxyLogon code into Notepad<br />
Save As &#8220;Test-ProxyLogon.ps1&#8221; with the quotes in your C:\Temp folder<br />
Run in Exchange Management Shell: .\Test-ProxyLogon.ps1 -OutPath C:\Temp</li>
</ol>
<p><img class="alignnone size-full wp-image-5804" src="https://www.moh10ly.com/wp-content/uploads/2021/03/image2.jpg" alt="" width="668" height="231" /></p>
<h2>Scan Result</h2>
<p>Scan result should show you the following if your servers has been exploited already.</p>
<p>This will remove the infections and asks for a restart.</p>
<p><a href="https://www.moh10ly.com/wp-content/uploads/2021/03/clip_image001.png"><img style="display: inline; background-image: none;" title="clip_image001" src="https://www.moh10ly.com/wp-content/uploads/2021/03/clip_image001_thumb.png" alt="clip_image001" width="472" height="204" border="0" /></a></p>
<h2>References:</h2>
<p><a title="https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/" href="https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/">https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/</a></p>
<p><a title="https://www.bleepingcomputer.com/news/security/microsoft-exchange-updates-can-install-without-fixing-vulnerabilities/" href="https://www.bleepingcomputer.com/news/security/microsoft-exchange-updates-can-install-without-fixing-vulnerabilities/">https://www.bleepingcomputer.com/news/security/microsoft-exchange-updates-can-install-without-fixing-vulnerabilities/</a></p>
<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2528 " id="quads-ad2528" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>

<p><a title="https://github.com/dpaulson45/HealthChecker?mkt_tok=eyJpIjoiTURRMk5HRTFaV1V6TkRrMCIsInQiOiJcL3ZOTkRUVzdXdkJmTm5ibUIzTExKTDVxXC9ObFAxTmZLanFRZ0xpcDkxMW5raVE0dlRwV2FhVFFmWlVUVFZaZUdFM1NlcEFNTEZ6dTh5aWlqcVBpV3J2R2IxbGJxMmNUZ1ppYjJyZklnMjZFZngrM2tBUnNsM1JKcHJsSU1ib3BTIn0%3D#download" href="https://github.com/dpaulson45/HealthChecker?mkt_tok=eyJpIjoiTURRMk5HRTFaV1V6TkRrMCIsInQiOiJcL3ZOTkRUVzdXdkJmTm5ibUIzTExKTDVxXC9ObFAxTmZLanFRZ0xpcDkxMW5raVE0dlRwV2FhVFFmWlVUVFZaZUdFM1NlcEFNTEZ6dTh5aWlqcVBpV3J2R2IxbGJxMmNUZ1ppYjJyZklnMjZFZngrM2tBUnNsM1JKcHJsSU1ib3BTIn0%3D#download">https://github.com/dpaulson45/HealthChecker?mkt_tok=eyJpIjoiTURRMk5HRTFaV1V6TkRrMCIsInQiOiJcL3ZOTkRUVzdXdkJmTm5ibUIzTExKTDVxXC9ObFAxTmZLanFRZ0xpcDkxMW5raVE0dlRwV2FhVFFmWlVUVFZaZUdFM1NlcEFNTEZ6dTh5aWlqcVBpV3J2R2IxbGJxMmNUZ1ppYjJyZklnMjZFZngrM2tBUnNsM1JKcHJsSU1ib3BTIn0%3D#download</a></p>

<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2530 " id="quads-ad2530" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>


Reset and manage your Active Directory users' Passwords Active Directory is one of the most…
Finding Exchange Database hidden mailboxes. Story:Maybe you have been in this situation before, trying to…
If you're using a Proxy server in your firewall or in your network and have…
Story:I got some clients that have reported some of their users being locked out and…
Delegate Permissions This is a code that I have wrote recently to check if an…
Story: I got a request from a client who constantly gets CVs and have to…