CVEs - Vulnerable Microsoft Exchange Server Report

Description

The Microsoft Exchange Server is an email, calendaring, contact, scheduling and collaboration platform that runs exclusively on the Microsoft Windows server operating system. The Microsoft Exchange server primarily uses a proprietary protocol called Messaging Application Programming Interface (MAPI) to talk to email clients. Support for Post Office Protocol version 3 (POP3), Internet Message Access Protocol (IMAP) and Exchange ActiveSync (EAS) protocols was subsequently added. The Simple Mail Transfer Protocol (SMTP) is used to communicate to other internet mail servers.

Problem

In January 2021, the US based security firm Volexity, which assists organisations with incident response, digital forensics and threat intelligence services detected anomalous activity from two (2) of its customers' Microsoft Exchange Servers through its network security monitoring service. A large amount of data was identified being sent to IP addresses not tied to the legitimate users. Inspection of the internet information services (IIS) logs from the Microsoft Exchange Servers, revealed inbound POST requests to valid files associated with images, JavaScript, cascading style sheets, and fonts used by the browser-based application, Outlook Web Access (OWA).  OWA allows a user to access email, calendars, tasks and contacts from an on-premise Microsoft Exchange Server.  Volexity reported they had first observed the exploit on the 03rd Jan 2021.

On the 2nd March 2021, the Microsoft Security Response Center (MSRC) issued a communication in which they stated they had detected multiple 0-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks.  The Microsoft Corporation publicly disclosed the following Common Vulnerability and Exposures (CVEs) associated with the Microsoft Exchange Server:-

The Microsoft Corporation attributed the action to the Advanced Persistent Threat (APT) Group 'HAFNIUM'.

Common Vulnerabilities & Exposures (CVEs).

Systems used for reporting and assessing the severity of security vulnerabilities.

CVSSv3.0 Metrics.

Microsoft Exchange Server - Publicly Disclosed CVEs w.e.f. 11 Feb 2020.

Tactics, Techniques and Procedures

The following Tactics, Techniques and Procedures were employed by the APT Group 'HAFNIUM' responsible for the exploitation of the four (4) CVE's discovered in the Microsoft Exchange server and subsequently publicly disclosed on the 02nd Mar 2021.

Reconnaissance

All systems targeted and compromised in the attack were on-premise Microsoft Exchange servers. Prior to the initial access, active or passive scanning would have been conducted on targeted networks seeking to identify on-premise Microsoft Exchange servers with web services accessible to the public internet. The fully qualified domain name (FQDN) of an on-premise Microsoft Exchange server had to be identified as a prerequisite to an attack. This information could be extracted from knowledge of the external IP address or domain name of the publicly accessible Microsoft Exchange Server. Lists of e-mail addresses of intended targets were also collected.

Resource Development

The operation and attack on the Microsoft Exchange servers were primarily conducted from leased virtual private servers (VPS) in the United States.  A range of free and commercial exploit tools were used to compromise the Microsoft Exchange servers and to perform unauthorised activities.

List of IP addresses used in the attack on Microsoft Exchange Servers.

These IP addresses are tied to the virtual private (VPS) servers and virtual private networks (VPNs) from which the operation was conducted.

Indicators of Compromise (IoC).

List of software tools used in the exploitation of Microsoft Exchange Server.

Initial Access

Initial access was through the server-side request forgery (SSRF) vulnerability in the on-premise Exchange server.   Specially crafted HTTP POST requests were sent to the Exchange server with an Extensible Markup Language (XML) Simple Object Access Protocol (SOAP) payload to the Exchange Web Services (EWS) Application Programming Interface (API) endpoint. The SOAP request, using specially crafted cookies, bypassed authentication and the underlying request specified in the XML was ultimately executed, allowing any operation to be perform on the users' mailbox. The HTTP POST requests targeted files found in the folder:-

/owa/auth/Current/themes/resources

Contained in this folder are image, font and cascading stype sheet files.  Use of any of these files for the HTTP POST request appear to allow the exploit to proceed.

Files that were targets of HTTP POST requests.

Execution

Access to the Exchange server was through the server-side request forgery (SSRF) vulnerability (CVE 2021-26855).   The NT AUTHORITY\SYSTEM account was used to create files on the Exchange server (CVE 2021-26857).  (CVE 2021-26858) and (CVE 2021-27065) were exploited for post-authentication arbitrary file write operations.  The compromise of the on-premise Exchange server, enabled access to the e-mail accounts from which data was stolen and the installation of additional malware.

Web Shells.

Web shells (ASPX files) were installed on the Exchange server and used to execute malicious code via the Command Prompt (CMD.exe) and Microsoft Windows Command Shell.

Purposes for which Web shells were used in the attack on Exchange servers.

SHA256 Hashes of Web shells used in the attack on Exchange servers.

Persistence

To establish and to maintain a persistence presence or foothold on the Microsoft Exchange servers, web shells (ASPX files), malware and backdoors were used.

Web shells deployed to maintain a persistence presence on a Microsoft Exchange Server.

Defence Evasion

Web shells deployed on the Microsoft Exchange servers had names that were identical to, or similar to legitimate files.

Names of web shells detected.

Credential Access

The command line utility ProcDump was used to dump the process memory of the Local Security Authority Subsystem Service (LSASS), from which credentials were acquired.  Web shells were used to create copies of the NTDS.dit (NT Directory Services) file that were then exfiltrated from the Microsoft servers.

Operating System Credential Dumping

Following the deployment of web shell scripts, the threat actors took a dump of the LSASS process memory.

Microsoft advised customers to monitor the following folders for LSASS dumps.

LSASS dumps

Microsoft advised customers to monitor the following folder for suspicious .zip .rar and .7z files which may indicate possible data exfilitration.

ZIP files

Exfiltration.

The collected and compresses data was exfiltrated to Cloud service providers that provided secure, user-controlled end-to-end encrypted cloud storage and communications services such as the New Zealand based company MEGA Limited.

Solution.

Shadowserver Foundation - Vulnerable Exchange Server Report - Tag Index.

Note:  The Shadowserver Foundation has included in the 'Tag' column of their report, a list of terms, which indicate the type of vulnerability associated with the specific host identified in the report.

Recommendations.

Microsoft Exchange Server Versions - End of Life (EOF) or End of Support.

The Microsoft Corporation have announced End of Life (EOF) or End of Support for the following versions of Microsoft Exchange Server on the undermentioned dates:-

Additional Information.