ExchangeRelayX is a PoC tools to demonstrate the ability of an attacker to perform an SMB or HTTP based NTLM relay attack to the EWS endpoint on an on-premise Microsoft Exchange server to compromise the mailbox of the victim.
This tool provides the attacker with an OWA looking interface, with access to the user’s mailbox and contacts.
Features
- Raw XML Access to the EWS server, so you can send requests to functions and features that were not pre-programmed in exchangeRelayx
- Add redirecting rules to the victim’s email for backdooring
- Download all attachments of the user, inbox and sent
- Search the global address book tied to Active Directory
- Send emails, with attachments, as the victim – the emails will not be stored in the user’s sent folder
Program Structure
The application breaks apart into the owaServer, the relay servers, and the HTTPAttack client (exchangePlugin) that is created for each new relayed connection.
owaServer
The owaServer is a flask based webserver that listens on http://127.0.0.1:8000 by default. This web server serves up static HTML files of index.html, OWA.html, and ComposeEmail.html – and everything else is loaded from JSON requests (from EWS.js) to the owaServer endpoints. When a request is made to the owaServer, the owaServer will generate the appropriate EWS call and input it to the shared-memory dictionary that is used by both the owaServer and the exchangePlugin. Once the exchangePlugin recieves the request, it will send it off to Exchange and then load the response into the same shared-memory dictionary. Finally, when the owaServer gets the response from the dict, it parses the data and returns the results. You will notice that the file-download functionality is not that of a standard website, and that’s due to the asynchronous nature of the app.
relay servers
The relay servers are standard impacket HTTP and SMB based NTLM relay servers, and they will create a new exchangePlugin instance for each newly relayed connection
exchangePlugin
The exchangePlugin is, in a nutshell, the actual HTTPClient making and recieving the requests from the EWS server. All exchangePlugin’s are passed the same shared-memory dictionary upon initialization, and they use this dictionary for interprocess communication. This allows the requests from the owaServer to be passed back to the appropriate user’s relayed connection – which gives more flexibility for for multi-victim managing.