Скачать или смотреть ProxyShell Poc - A New Vulnerability on Microsoft Exchange Server!

ProxyLogon: The most well-known and impactful Exchange exploit chain

An unauthenticated attacker can execute arbitrary commands on Microsoft Exchange Server through an exposed 443 port

What can a hacker accomplish after exploiting ProxyLogon vulnerabilities?

ProxyLogon vulnerability allows a hacker to impersonate an authorized administrator and bypass the usual authentication process.

The cybercriminal could then execute arbitrary server commands on Microsoft Exchange via an open 443 port.

How Businesses Can Protect Against ProxyLogon
A successful response to mitigate Microsoft Exchange vulnerabilities should consist of the following steps:

Deploy updates to affected Exchange Servers: https://techcommunity.microsoft.com/t...
Investigate for exploitation or indicators of persistence.
Remediate any identified exploitation or persistence and investigate your environment for indicators of lateral movement or further compromise.
Microsoft released an automated, one-click fix for ProxyLogon vulnerabilities in March 2021: https://msrc-blog.microsoft.com/2021/...

“Note that the mitigations suggested are not substitutes for installing the updates.”

Deploy Updates
The high-level summary of Microsoft’s guidance is:

Exchange Online is not affected.
Exchange 2003 and 2007 are no longer supported but are not believed to be affected by the March 2021 vulnerabilities. You must upgrade to a supported version of Exchange to ensure that you are able to secure your deployment against vulnerabilities fixed in current versions of Microsoft Exchange and future fixes for security issues.
Exchange 2010 is only impacted by CVE-2021-26857, which is not the first step in the attack chain. Organizations should apply the update and then follow the guidance below to investigate for potential exploitation and persistence.
Exchange 2013, 2016, and 2019 are impacted. Immediately deploy the updates and apply mitigations described below. For help identifying which updates you need to get, follow the guidance available here: https://techcommunity.microsoft.com/t....
To help identify which CUs are needed for your deployment, you can use the linked Health Checker script available here: https://github.com/dpaulson45/HealthC....

Updates are available here: https://techcommunity.microsoft.com/t...

If for whatever reason you cannot immediately update your server, please see the temporary mitigation strategies suggested by Microsoft here: https://msrc-blog.microsoft.com/2021/...

Investigate
Scan the affected Microsoft Exchange Server’s logs for Indicators of Compromise using Microsoft’s tool available here: https://github.com/microsoft/CSS-Exch... https://github.com/microsoft/CSS-Exch....

For Reference and more details: https://blog.orange.tw/2021/08/proxyl...