This module exploits a .NET serialization vulnerability in the Exchange Control Panel (ECP) web page. The vulnerability is due to Microsoft Exchange Server not randomizing the keys on a per-installation basis resulting in them using the same validationKey and decryptionKey values. With knowledge of these values, an attacker can craft a special ViewState to cause an OS command to be executed by NT_AUTHORITY\SYSTEM using .NET deserialization.
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/windows/http/exchange/ecp_viewstatemsf undefined(ecp_viewstate) > show actions ...actions...msf undefined(ecp_viewstate) > set ACTION < action-name >msf undefined(ecp_viewstate) > show options ...show and set options...msf undefined(ecp_viewstate) > runWith curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub