Record · corpus.blog/posts/01a0ca6b-18f1-731a-b54d-b9f50d985133

Abusing Exchange: One API call away from Domain Admin

dirkjanm.io · published 21 January 2019

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at dirkjanm.io Wayback capture

4blogs citing

First cited: 14 May 2020
Most recent: 25 Jun 2026
Rank this month: not ranked
External links: 31
Words captured: 2,241

Cited by

Blog

In the post

Date

t3chnocat.com

HackTheBox Writeup: Forest Read at the source ↗

25 Jun 2026

blog.ikuamike.io

Hack The Box: Forest Read at the source ↗

1 Mar 2022

blog.orange.tw

A New Attack Surface on MS Exchange Part 1 - ProxyLogon! Read at the source ↗

5 Aug 2021

Compass Security

Relaying NTLM authentication over RPC Read at the source ↗

14 May 2020

Links from this post

Link

Host

https://github.com/dirkjanm/privexchange/

github.com

Escalating privileges with ACLs in Active Directory

blog.fox-it.com

https://github.com/SecureAuthCorp/impacket/blob/master/examples/ntlmrelayx.py

github.com

Relaying credentials everywhere with ntlmrelayx

blog.fox-it.com

https://www.thezdi.com/blog/2018/12/19/an-insincere-form-of-flattery-impersonating-users-on-microsoft-exchange

thezdi.com

https://github.com/SecureAuthCorp/impacket/

github.com

https://github.com/leechristensen/SpoolSample/

github.com

https://msdn.microsoft.com/en-us/library/cc236650.aspx

msdn.microsoft.com

https://conference.hitb.org/hitbsecconf2018dxb/materials/D2T2%20-%20NTLM%20Relay%20Is%20Dead%20Long%20Live%20NTLM%20Relay%20-%20Jianing%20Wang%20and%20Junyu%20Zhou.pdf

conference.hitb.org

https://twitter.com/infosec_kb

twitter.com

https://support.microsoft.com/en-us/help/4034879/how-to-add-the-ldapenforcechannelbinding-registry-entry

support.microsoft.com

https://msdn.microsoft.com/en-us/library/dd767318%28v=vs.90%29.aspx

msdn.microsoft.com

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8581

portal.msrc.microsoft.com

https://docs.microsoft.com/en-us/powershell/module/exchange/server-health-and-performance/set-throttlingpolicy?view=exchange-ps

docs.microsoft.com

https://twitter.com/gentilkiwi/status/1088599133986975755

twitter.com

https://twitter.com/gentilkiwi/status/1088581788413374465

twitter.com

https://github.com/gdedrouas/Exchange-AD-Privesc/blob/master/DomainObject/DomainObject.md

github.com

https://twitter.com/lean0x2f/status/1088441988326801408

twitter.com

https://support.microsoft.com/en-us/help/4490059/using-shared-permissions-model-to-run-exchange-server

support.microsoft.com

https://techcommunity.microsoft.com/t5/exchange-team-blog/released-february-2019-quarterly-exchange-updates/ba-p/609061

techcommunity.microsoft.com

https://www.blackhat.com/docs/us-17/wednesday/us-17-Robbins-An-ACE-Up-The-Sleeve-Designing-Active-Directory-DACL-Backdoors-wp.pdf

blackhat.com

https://github.com/SecureAuthCorp/impacket/issues/451

github.com

https://github.com/SecureAuthCorp/impacket/pull/500

github.com

https://www.secureauth.com/blog/playing-relayed-credentials

secureauth.com

https://msdn.microsoft.com/en-us/library/cc236621.aspx

msdn.microsoft.com

https://www.zerodayinitiative.com/blog/2018/12/19/an-insincere-form-of-flattery-impersonating-users-on-microsoft-exchange

zerodayinitiative.com

Remote NTLM relaying through meterpreter on Windows port 445 Read at the source ↗

diablohorn.com

https://www.slideshare.net/DirkjanMollema/aclpwn-active-directory-acl-exploitation-with-bloodhound

slideshare.net

https://github.com/dirkjanm/PrivExchange

github.com

https://github.com/gdedrouas/Exchange-AD-Privesc/blob/master/DomainObject/Fix-DomainObjectDACL.ps1

github.com

https://www.blackhat.com/docs/webcast/04262018-Webcast-Toxic-Waste-Removal-by-Andy-Robbins.pdf

blackhat.com