On-premises Microsoft Exchange sits on the seam between the perimeter and Active Directory. The Client Access (front-end) services are internet-exposed over HTTPS (/owa, /ecp, /ews, /Microsoft-Server-ActiveSync, /autodiscover, /mapi, /rpc, /powershell), every one of them authenticates against the domain, and the Exchange servers and their security groups hold high privilege in AD by design, historically write access over the domain object itself. That combination is why Exchange is one of the most productive targets in a Windows estate: the front end reaches a privileged back end, a foothold on the box runs as SYSTEM, and even with no code execution the server can be coerced into authenticating to you. The mailboxes are a trove on their own.
Everything on this surface keys off one fact you establish first: the exact build number. The pre-auth and single-credential RCE chains are tightly version bound, and firing the wrong one against a patched build only burns the engagement.
Triage: read the build, then pick the chain#
The build number is leaked unauthenticated in several places. OWA serves its static assets from a versioned path, and the front-end server stamps its version in response headers:
# Header stamp (X-OWA-Version on newer CUs, X-FEServer names the front-end host)
curl -sk -I 'https://mail.example.com/owa/auth/logon.aspx' | grep -iE 'X-OWA-Version|X-FEServer'
# Versioned static path in the logon HTML: /owa/auth/15.2.1544.4/... IS the build
curl -sk 'https://mail.example.com/owa/auth/logon.aspx' | grep -oE '/owa/auth/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/' | head -1
# ECP login page carries the same versioned path and confirms /ecp is reachable
curl -sk 'https://mail.example.com/ecp/' | grep -oE '/ecp/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/' | head -1
The leading numbers name the product family, and the full build decides which chain is in range:
- 15.0.x = Exchange 2013, 15.1.x = Exchange 2016, 15.2.x = Exchange 2019. A bare
15.0/15.1/15.2without the full dotted build usually means a very old CU that never stripped the path. - A build at or below the early-2021 security rollup is in range for ProxyLogon (pre-auth SSRF to web shell,
SYSTEM, no credential). - A build below the mid-2021 rollup is in range for ProxyShell (pre-auth Autodiscover path confusion to the PowerShell back end, no credential).
- A build below the late-2022 rollup is in range for ProxyNotShell (needs one valid mailbox credential); if the URL-rewrite mitigation was applied but the box was never fully patched, the OWASSRF variant in the same page still lands.
- A reachable
/ecpwith a known or leakedmachineKeyis in range for ViewState deserialization regardless of family, once you hold a valid ECP session or the static keys.
Match the build first, then read the chain pages below. Where no chain fits, the surface is still fully attackable from the perimeter through enumeration, spraying, and coercion.
The attack arc#
- Enumerate the build, valid users, and the address book from outside.
- Spray the web endpoints to turn a user list into a domain credential.
- Execute a build-matched RCE chain for
SYSTEM, or coerce the server with PrivExchange and relay it into AD when no chain fits. - Read mail at scale through impersonation, and abuse Outlook clients when you hold a mailbox but not the server.
- Persist in mail flow with transport and forwarding rules that survive password resets.
Pages and subtopics#
- Enumeration: Autodiscover domain and user discovery, OWA/EWS timing-based username validation, the GAL/OAB dump, the ECP version leak, and the NTLM type-2 internal-name leak from
/rpcand/ews. - Password spraying: OWA, EWS, Autodiscover, and ActiveSync spraying, lockout-aware cadence, and the endpoints that often skip lockout tracking.
- RCE chains: the front-end proxy to privileged back-end pattern, with ProxyLogon, ProxyShell, ProxyNotShell/OWASSRF, and ViewState deserialization.
- PrivExchange: coercing the Exchange machine account to authenticate and relaying it to LDAP for DCSync.
- Mailbox access: EWS impersonation, Exchange Management Shell mailbox export, and org-wide mail search after a credential or the server.
- Outlook client abuse: rules, forms, and folder home pages that run code on the victim workstation over MAPI/EWS, no server RCE needed.
- Mail flow persistence: transport rules, journaling, and forwarding that silently copy org mail to an external address.