Rapid7

module

Microsoft Exchange Privilege Escalation Exploit

Disclosed
Jan 21, 2019

Description

This module exploits a privilege escalation vulnerability found in Microsoft Exchange - CVE-2019-0724
Execution of the module will force Exchange to authenticate to an arbitrary URL over HTTP via the Exchange PushSubscription feature.
This allows us to relay the NTLM authentication to a Domain Controller and authenticate with the privileges that Exchange is configured.
The module is based on the work by @_dirkjan,
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.