Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add bypass method when MAQ is 0 in addcomputer.py #1870

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

Ridter
Copy link

@Ridter Ridter commented Jan 8, 2025

Add bypass method when MAQ is 0 in addcomputer.py

Details can be seen: Issue 2186: Exchange: AD Schema Misconfiguration Elevation of Privilege - James Forshaw

@anadrianmanrique
Copy link
Contributor

This is a quite old CVE. Patch has been available since 2021. I wonder whether this still relevant ?

@SAERXCIT
Copy link
Contributor

SAERXCIT commented Feb 6, 2025

Hi @anadrianmanrique, this is indeed an old CVE, but one thing to know is that the KB patching it is only available to orgs running Exchange. So what can happen is an org having installed and then removed Exchange from their infra years ago still has the vulnerable LDAP schema in their domain. Microsoft does provide a script fixing this issue for orgs having removed Exchange, but you'd still have to know about it and run it proactively.

If you're thinking about merging this PR, could you also please take a look at my 3 years old PR #1288, from which this PR's code is copy-pasted without any attribution ? Thanks

@anadrianmanrique
Copy link
Contributor

@SAERXCIT great feedback! thank you. I'll try to review this PR and also yours to see the best way to integrate them.
Also, kind of related with this, I want to mention that we are thinking of expanding the attack concept, today implemented in the context of ntlmrelayx, to make it available for the whole project. The idea is to implement in one place a certain attack, and then be able to use it in the context of either a standalone example, ntlmrelayx or an interactive shell or all of them. That would avoid the problem of having up to 3 times written or, as you said, copy/pasted, the same functionality across the project. Let me know your thoughts
thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants