UPDATE: New Microsoft Exchange Zero-Day Vulnerabilities (CERT-EU Security Advisory 2022-068)

On September 28, 2022, the security researchers at Vietnamese cybersecurity vendor GTSC published a blog post claiming they have discovered an attack campaign which utilised two zero-day bugs in Microsoft Exchange that could allow an attacker a remote code execution. The attackers are chaining the pair of zero-days to deploy web shells, notably China Choppers, on compromised servers for persistence and data theft, as well as move laterally to other systems on the victims' networks.
Microsoft had identified the vulnerabilities as CVE-2022-41040, a Server-Side Request Forgery (SSRF) vulnerability, while the second, identified as CVE-2022-41082, allows remote code execution (RCE) when PowerShell is accessible to the attacker.
CrowdStrike recently discovered a new exploit method (called OWASSRF) consisting of CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution (RCE) through Outlook Web Access (OWA).

https://www.cert.europa.eu/static/SecurityAdvisories/2022/CERT-EU-SA2022-068.pdf

📜 ADCS module for #RustHound 🦀 is out (v1.1.0)

⚙️ Collect CA and Templates for @ly4k BH version
⚙️ Or like Certipy collect CA and Templates for official BH version

https://github.com/OPENCYBER-FR/RustHound#module-adcs-collector

🧵 Example for @ly4k BloodHound version:

https://github.com/ly4k/BloodHound
rusthound.exe -d essos.local -f meereen -o output -z --adcs

🧵 Example for official BloodHoundAD version:

https://github.com/BloodHoundAD/BloodHound
rusthound.exe -d essos.local -f meereen -o output -z --adcs --old-bloodhound

🧵 Examples are done on the GOADv2

Thanks to @Mayfly for the lab!
https://github.com/Orange-Cyberdefense/GOAD

🧵 Special thanks to @ly4k for your work on Certipy!

RT @testanull
You guys must be waiting for this,
So this is the working PoC script of the Exchange 0day exploited ITW

https://github.com/testanull/ProxyNotShell-PoC