Huntress Analyzes OWASSRF Microsoft Exchange Exploit Chain and Its Post-Exploitation Activity
Summary
Huntress analyzed OWASSRF, a Microsoft Exchange exploit chain involving CVE-2022-41080 and CVE-2022-41082. It demonstrated SYSTEM-level code execution using unprivileged OWA credentials and reported observed post-exploitation activity and detections.
Key points
- The OWASSRF chain combines CVE-2022-41080 and CVE-2022-41082 and bypasses Microsoft’s earlier mitigation guidance for ProxyNotShell, according to Huntress.
- In a test environment, the proof of concept used valid, non-administrative OWA credentials and PowerShell Remoting to execute arbitrary PowerShell as NT AUTHORITY\SYSTEM.
- Huntress observed increased exploitation attempts on customer systems on December 22, alongside rogue ScreenConnect installations and other post-exploitation activity.
- Reported post-exploitation methods included bitsadmin downloads and PowerShell commands launched by the IIS worker process; observed tools included ScreenConnect and Mimikatz.
- Huntress said Windows Defender detected and quarantined multiple attempts on one system where it was enabled and updated; several other affected systems had Defender disabled.
- Huntress described Sigma rules for detecting PowerShell spawned by w3wp.exe and PowerShell reverse-shell behavior, and advised patching on-premises Exchange servers.
Article Details
- Attack Vectors
- OWASSRF exploits the CVE-2022-41080 and CVE-2022-41082 chain against unpatched Microsoft Exchange servers. The demonstrated proof of concept authenticates to Outlook Web Access with valid, non-administrative user credentials, then uses the PowerShell Remoting endpoint through an authenticated HTTP session to achieve arbitrary PowerShell execution as NT AUTHORITY\SYSTEM.
- Huntress observed exploitation delivering malicious PowerShell and rogue ConnectWise Control (ScreenConnect) installations. Reported post-exploitation activity included downloading a payload with bitsadmin.exe and using PowerShell to download an MSI file.
- Huntress also observed use of rundll32.exe and msiexec.exe in attempts to install a rogue ScreenConnect instance.
- Defensive Notes
- Patch on-premises Exchange servers; the article advises patching if the host was not patched on or after November 8.
- Huntress recommends monitoring for PowerShell processes spawned by the IIS web server process w3wp.exe, including encoded command lines, and for raw TCP socket use in PowerShell that may indicate reverse-shell activity.
- Review System Event Log event ID 7045 for ScreenConnect service installation and investigate the reported post-exploitation indicators.
- The article reports Windows Defender detections and quarantine of some exploit attempts; Huntress also found Windows Defender disabled on several systems with post-exploitation activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | autodiscover[.]hofduncan[.]org | Domain used in a PowerShell command to download a post-exploitation file associated with rogue ScreenConnect activity. |
| DOMAIN | mail[.]stannparish[.]org | Domain Huntress listed for post-exploitation ScreenConnect download activity. |
| HOSTNAME | instance-cmjrni-relay[.]screenconnect[.]com | ScreenConnect relay hostname reported in connection with a rogue installed instance. |
| IPV4 | 155[.]138[.]240[.]251 | IP address Huntress identified as post-exploitation ScreenConnect C2. |
| IPV4 | 179[.]60[.]149[.]28 | IP address Huntress identified as the source for a bitsadmin post-exploitation payload download. |
| IPV4 | 66[.]42[.]116[.]130 | IP address Huntress identified as post-exploitation ScreenConnect C2. |
| URL | hxxp[:]//179[.]60[.]149[.]28:4427/22.exe | Payload download URL in a bitsadmin command used to install a rogue ScreenConnect instance. |
| URL | hxxps[:]//autodiscover[.]hofduncan[.]org/owa/auth/Current/themes/6.css | Specific URL used by a PowerShell download command to retrieve a file saved locally as c.msi during post-exploitation. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe article reports Palo Alto Unit42's account that attackers commonly used the SilverArrow PowerShell reverse-shell payload; Huntress describes detecting raw TCP socket use in PowerShell as potentially malicious.T1059.001 · PowerShellThe exploit enabled arbitrary PowerShell execution; observed post-exploitation commands also used PowerShell to download a file.T1105 · Ingress Tool TransferAttackers used bitsadmin.exe to download a payload and PowerShell to retrieve an MSI file.T1190 · Exploit Public-Facing ApplicationOWASSRF was used to exploit unpatched, internet-facing Exchange servers for initial access.T1219 · Remote Access ToolsAttackers installed rogue ConnectWise Control (ScreenConnect) remote access instances.
CVE
CVE-2022-41080Control (ScreenConnect) payload on unpatched Exchange hosts using the exploit chain consisting of CVE-2022-41080 and CVE-2022-41082. This exploit chain was coined “OWASSRF” by Crowdstrike, as it involves an OutlookCVE-2022-41082payload on unpatched Exchange hosts using the exploit chain consisting of CVE-2022-41080 and CVE-2022-41082. This exploit chain was coined “OWASSRF” by Crowdstrike, as it involves an Outlook Web Access
People
Malware
Play ransomwaredetecting, obviating and investigating these attacks, other more successful attacks were leading to Play ransomware being deployed. This demonstrates the incredible value of having a dedicated team of detectionSilverArrowthat attackers using the OWASSRF vulnerability commonly use the PowerShell reverse shell payload named SilverArrow for post-exploitation as seen in Figure 4.
Vendors
ConnectWiseDecember 22, Huntress observed a significant increase in malicious PowerShell executions delivering a ConnectWise Control (ScreenConnect) payload on unpatched Exchange hosts using the exploit chain consisting ofMicrosoftHomeBlogOWASSRF Explained: Analyzing the Microsoft Exchange RCE Vulnerability
Products
ConnectWise ScreenConnect22, Huntress observed a significant increase in malicious PowerShell executions delivering a ConnectWise Control (ScreenConnect) payload on unpatched Exchange hosts using the exploit chain consisting ofMicrosoft ExchangeHomeBlogOWASSRF Explained: Analyzing the Microsoft Exchange RCE VulnerabilityOutlook on the weband CVE-2022-41082. This exploit chain was coined “OWASSRF” by Crowdstrike, as it involves an Outlook Web Access server-side request forgery. The exploit chain relates to ProxyNotShell, but it bypasses theWindows Defenderaddress the issue. The following day, our analysts leveraged alerts from Managed Antivirus (i.e., Windows Defender) to identify neutralized attempts to deploy the ProxyNotShell variant.Windows ServerSecurity Researchers started by setting up a fresh Active Directory domain and Exchange server using Windows Server 2019 Evaluation Edition. We created an unprivileged user account residing only in the Domain Users
Tools
bitsadminan intrusion that used ProxyNotShell for initial access, and then used the native Windows utility bitsadmin.exe to download and install a rogue ScreenConnect instance, as illustrated in a tweet from HuntressMetasploit FrameworkThe video below demonstrates using the leaked proof-of-concept (POC) code obtained by Huntress analysts, along with Metasploit, to gain code execution as NT AUTHORITY\SYSTEM on the unpatched Exchange server.Mimikatz- Deployed Mimikatzpypsrpendpoint via the PowerShell Remoting protocol implemented by the pypsrp Python package. The script sets up a local proxy, which forwards WSMan connections on localhost to theSigmaFor example, the Sigma rule in Figure 2 locates any PowerShell process running as a child process of the IIS web server process (w3wp.exe), regardless of the PowerShell command line.