1. Microsoft script Test-ProxyLogon.ps1
Microsoft Test-ProxyLogon.ps1 is a comprehensive script to check for signs of exploit from CVE-2021-26855, 26858, 26857, and 27065.
To use this script, your account has to be local admin of the Exchange Server and be the member of AD Group "Microsoft Exchange Security Groups" > "Organization Management".
1) Download the script from https://github.com/microsoft/CSS-Exchange/releases/latest/download/Test-ProxyLogon.ps1
2) Run “exchange Management Shell” as administrator.
3) To check all Exchange servers and save the output, run command: Get-ExchangeServer | .\Test-ProxyLogon.ps1 -OutPath $home\desktop\logs
4) To check the local server only, run the script: .\Test-ProxyLogon.ps1 -OutPath $home\desktop\logs
5) Review the logs.
2. Microsoft Nmap script http-vuln-cve2021-26855.nse
This file is for use with nmap. It detects whether the specified URL is vulnerable to the Exchange Server SSRF Vulnerability (CVE-2021-26855).
1) Download the script https://github.com/microsoft/CSS-Exchange/releases/latest/download/http-vuln-cve2021-26855.nse
2) Copy the file to the nmap script folder. For Windows, the default location is C:\Program Files (x86)\Nmap\scripts. For MAC, the default location is /usr/local/share/nmap/scripts.
3) Run command nmap -p <port> --script http-vuln-cve2021-26855 <target>.
3. Microsoft Support Emergency Response Tool (MSERT)
To use the Microsoft Support Emergency Response Tool (MSERT) to scan the Microsoft Exchange Server locations for known indicators from adversaries:
1) Download MSERT from Microsoft Safety Scanner Download – https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download.
2) Read and accept the End user license agreement, then click Next.
3) Read the Microsoft Safety Scanner Privacy Statement, then click Next.
4) Select full scan.
4. Nmap script http-vuln-exchange.nse
http-vuln-exchange.nse is a quick and dirty nmap script which can be used to find potentially vulnerable servers in your environments. (https://twitter.com/GossiTheDog/status/1366863377344126976)
1) Download the http-vuln-exchange.nse script from https://github.com/GossiTheDog/scanning.
2) Copy the file to the nmap script folder. For Windows, the default location is C:\Program Files (x86)\Nmap\scripts. For MAC, the default location is /usr/local/share/nmap/scripts.
3) Run command nmap -p <port> --script http-vuln-exchange.nse <target>.
5. Check if patch KB5000871 is installed on Exchange Server
1) For Exchange 2010, the patch is KB5000978. Open Control panel > Add or Remove Programs, check if update KB5000978 is on the program list.
2) For Exchange 2013 CU23, the version should be 15.00.1497.012 (or greater)
3) For Exchange 2016 CU18, the version should be 15.01.2106.013 (or greater)
4) For Exchange 2016 CU19, the version should be 15.01.2176.009 (or greater)
5) For Exchange 2019 CU7, the version should be 15.02.0721.013 (or greater)
6) For Exchange 2019 CU8, the version should be 15.02.0792.010 (or greater)
7) Run PowerShell command: Get-Command Exsetup.exe | ForEach {$_.FileVersionInfo}
6. Check suspicious hashes
(Up to March 13, 2021) Web shell hashes:
1) Hashes from Microsoft (sha256): https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
- b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0
- 097549cf7d0f76f0d99edf8b2d91c60977fd6a96e4b8c3c94b0b1733dc026d3e
- 2b6f1ebb2208e93ade4a6424555d6a8341fd6d9f60c25e44afe11008f5c1aad1
- 65149e036fff06026d80ac9ad4d156332822dc93142cf1a122b1841ec8de34b5
- 511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1
- 4edc7770464a14f54d17f36dc9d0fe854f68b346b27b35a6f5839adf1f13f8ea
- 811157f9c7003ba8d17b45eb3cf09bef2cecd2701cedb675274949296a6a183d
- 1631a90eb5395c4e19c7dbcbf611bbe6444ff312eb7937e286e4637cb9e72944
2) Hashes from FireEyd (MD5): https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html
- 4b3039cf227c611c45d2242d1228a121
- 0fd9bffa49c76ee12e51e3b8ae0609ac
- 79eb217578bed4c250803bd573b10151
3) Hashes from Volexity (sha256): https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
- 893cd3583b49cb706b3e55ecb2ed0757b977a21f5c72e041392d1256f31166e2
- 406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928
- 2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a
4) Hashes from CISA (sha256): https://us-cert.cisa.gov/ncas/alerts/aa21-062a
- 71ff78f43c60a61566dac1a923557670e5e832c4adfe5efb91cac7d8386b70e0 (zXkZu6bn.aspx)
- ee883200fb1c58d22e6c642808d651103ae09c1cea270ab0dc4ed7761cb87368 (shell.aspx)
- 1e0803ffc283dd04279bf3351b92614325e643564ed5b4004985eb0486bf44ee (discover.aspx)
- c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5 (RedirSuiteServerProxy.aspx)
- be17c38d0231ad593662f3b2c664b203e5de9446e858b7374864430e15fbf22d (Fc1b3WDP.aspx)
- c0caa9be0c1d825a8af029cc07207f2e2887fce4637a3d8498692d37a52b4014 (discover.aspx)
- d9c75da893975415663c4f334d2ad292e6001116d829863ab572c311e7edea77 (F48zhi6U.aspx)
- 31a750f8dbdd5bd608cfec4218ccb5a3842821f7d03d0cff9128ad00a691f4bd (2XJHwN19.aspx)
- d637b9a4477778a2e32a22027a86d783e1511e999993aad7dca9b7b1b62250b8 (UwSPMsFi.aspx)
- bda1b5b349bfc15b20c3c9cbfabd7ae8473cee8d000045f78ca379a629d97a61 (E3MsTjP8.aspx)
- 5ac7dec465b3a532d401afe83f40d336ffc599643501a40d95aa886c436bfc0f (web.config.aspx)
- 5e09ea8b70a386f0812a8cafb94e2d2365849ce67fda42377389f18e56d860d0 (supp0rt.aspx)
- c7e1b386b472a26a36632f4ccc25e37458546b9c864b7ef0ec5ebece5e8cc704 (uHSPTWMG.aspx)
- 0c5fd2b5d1bfe5ffca2784541c9ce2ad3d22a9cb64d941a8439ec1b2a411f7f8 (McYhCzdb.aspx)
- 138f0a63c9a69b35195c49189837e899433b451f98ff72c515133d396d515659 (0q1iS7mn.aspx)
- 36149efb63a0100f4fb042ad179945aab1939bcbf8b337ab08b62083c38642ac (8aUco9ZK.aspx)
- 508ac97ea751daebe8a99fa915144036369fc9e831697731bf57c07f32db01e8 (ogu7zFil.aspx)
Download PowerShell script ProxyLogonHashes.ps1 from https://github.com/andyinmatrix/PowerShell, modify the path of the IIS and Exchange Server and run it.
Check CVE-2021-24085
CVE-2021-24085 is Microsoft Exchange Server msExchEcpCanary Cross Site Request Forgery Elevation of Privilege Vulnerability
1) Copy IIS log to other location.
2) Use grep command to search below strings and check the outputs
|
grep -nr "/ecp/y.js" *.log grep -nr "/ecp/DDI/DDIService.svc/GetList" *.log grep -nr "/ecp/DDI/DDIService.svc/SetObject” |
3) If using windows:
|
findstr "\/ecp\/y.js" *.log findstr "\/ecp\/DDI\/DDIService.svc\/GetList" *.log findstr "\/ecp\/DDI\/DDIService.svc\/SetObject” *.log |
Check CVE-2021-26855
CVE-2021-26855 is a server-side request forgery (SSRF) vulnerability in Exchange which allowed the attacker to send arbitrary HTTP requests and authenticate as the Exchange server.
1) Check the Exchange HttpProxy log: %PROGRAMFILES%\Microsoft\ExchangeServer\V15\Logging\HttpProxy
2) Run PowerShell Script to check if there were any attack attempts:
|
Import-Csv -Path (Get-ChildItem -Recurse -Path "$env:C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy" -Filter '*.log').FullName | Where-Object { $_.AuthenticatedUser -eq '' -and $_.AnchorMailbox -like 'ServerInfo~*/*' } | select DateTime, AnchorMailbox |
3) If attack attempts were detected, check the details on logs: %PROGRAMFILES%\Microsoft\ExchangeServer\V15\Logging
Check CVE-2021-26857
CVE-2021-26857 is an insecure deserialization vulnerability in the Unified Messaging service. Insecure deserialization is where untrusted user-controllable data is deserialized by a program. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit.
1) Run below command to check if there were any attack attempts:
|
Get-EventLog-LogName Application -Source “MSExchangeUnified Messaging” -EntryType Error | Where-Object {$_.Message -like “*System.InvalidCastException*” } |
2) Exploitation of this deserialization bug will create Application events with the following properties:
· Source: MSExchange Unified Messaging
· EntryType: Error
· Event Message Contains: System.InvalidCastException
Check CVE-2021-26858
CVE-2021-26858 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.
1) Log location: C:\Program Files\Microsoft\ExchangeServer\V15\Logging\OABGeneratorLog. Files should only be downloaded to the %PROGRAMFILES%\Microsoft\Exchange Server\V15\ClientAccess\OAB\Temp directory. In case of exploitation, files are downloaded to other directories (UNC or local paths).
2) Open command line window and run below command to check if there were any attack attempts:
|
findstr /snip /c:”Download failed and temporaryfile” “%PROGRAMFILES%\Microsoft\ExchangeServer\V15\Logging\OABGeneratorLog\*.log” |
Check CVE-2021-27065
CVE-2021-27065 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.
1) Exchange Log: C:\Program Files\Microsoft\Exchange Server\V15\Logging\ECP\Server
All Set-<AppName>VirtualDirectory properties should never contain script. InternalUrl and ExternalUrl should only be valid Uris.
2) Run below command to check if there were any attack attempts:
|
Select-String -Path “$env:PROGRAMFILES\Microsoft\ExchangeServer\V15\Logging\ECP\Server\*.log” -Pattern ‘Set-.+VirtualDirectory’ |
Last Activity View
According to Microsoft:
Following web shell deployment, HAFNIUM operators performed the following post-exploitation activity:
1) Using Procdump to dump the LSASS process memory
2) Using 7-Zip to compress stolen data into ZIP files for exfiltration
3) Adding and using Exchange PowerShell snap-ins to export mailbox data
4) Using the Nishang Invoke-PowerShellTcpOneLine reverse shell
5) Downloading PowerCat from GitHub, then using it to open a connection to a remote server.
To check if there were any similar activities on the system:
1) Download LastActivityView tool from https://www.nirsoft.net/utils/computer_activity_view.html
2) Run it as administrator and check if there were “Procdump” and “7z” activities.
Web Shell Search
According to Microsoft: The web shells were detected had the following file names:
· web.aspx
· help.aspx
· document.aspx
· errorEE.aspx
· errorEEE.aspx
· errorEW.aspx
· errorFF.aspx
· healthcheck.aspx
· aspnet_www.aspx
· aspnet_client.aspx
· xx.aspx
· shell.aspx
· aspnet_iisstart.aspx
· one.aspx
Create a batch file and run it as administrator to search these files
|
dir web.aspx /s dir help.aspx /s dir document.aspx /s dir errorEE.aspx /s dir errorEEE.aspx /s dir errorEW.aspx /s dir errorFF.aspx /s dir healthcheck.aspx /s dir aspnet_www.aspx /s dir aspnet_client.aspx /s dir xx.aspx /s dir shell.aspx /s dir aspnet_iisstart.aspx /s dir one.aspx /s |
Compressed file Search
Check for suspicious .zip, .rar, and .7z files in C:\ProgramData\, which may indicate possible data exfiltration.
Create a batch file and run it as administrator to search these files
|
dir C:\ProgramData\*.zip /s dir C:\ProgramData\*.rar /s dir C:\ProgramData\*.7z /s |
LSASS dumps Search
Check LSASS dumps on below folder:
· C:\windows\temp\
· C:\root\
[Edit on Nov 10, 2021]
CVE-2021-42321
CVE-2021-42321 only affects on-premises Microsoft Exchange servers, including those used by customers in Exchange Hybrid mode (Exchange Online customers are protected against exploitation attempts and don't need to take any further action).
If you want to check and see if any of your Exchange servers were hit by CVE-2021-42321 exploitation attempts, run the following PowerShell query on each Exchange server to check for specific events in the Event Log:
Get-EventLog -LogName Application -Source "MSExchange Common" -EntryType Error | Where-Object { $_.Message -like "*BinaryFormatter.Deserialize*" }Exchange Server Health Checker
The Exchange Server Health Checker script helps detect common configuration issues that are known to cause performance issues and other long running issues that are caused by a simple configuration change within an Exchange Environment. It also helps collect useful information of your server to help speed up the process of common information gathering of your server.
It could be download from https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/
Reference:
1) https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
3) https://us-cert.cisa.gov/ncas/alerts/aa21-062a
4) https://github.com/microsoft/CSS-Exchange/tree/main/Security
7) https://github.com/GossiTheDog/scanning
https://www.bleepingcomputer.com/news/microsoft/microsoft-urges-exchange-admins-to-patch-bug-exploited-in-the-wild/amp
https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/
