Huntress Reports Active ProxyShell Attacks and Hidden Webshells on Exchange Servers
Summary
Huntress reported active ProxyShell exploitation of unpatched Exchange servers, 164 compromised hosts in four days, and more than 200 hidden webshells across monitored systems. It urged patching and checks for webshells in unusual locations.
Key points
- Huntress reported active exploitation of the ProxyShell chain of three Microsoft Exchange vulnerabilities: CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.
- Huntress observed 164 compromised Exchange servers within four days and reported 1,764 monitored servers remained unpatched as of August 22, 2021.
- The investigation found webshells hidden in uncommon directories through virtual-directory entries added to Exchange’s IIS configuration.
- Huntress reported finding more than 200 hidden webshells across the 4,000-plus Exchange servers it could monitor; some configuration files and webshells had modification times predating the ProxyShell activity.
- The article recommends installing the latest Exchange security updates, checking specified configuration files and referenced paths for webshells, and removing malicious entries and files.
- Huntress said some earlier-dated webshells could be remnants of ProxyLogon, but noted it could not establish that definitively.
Article Details
- Attack Vectors
- Attackers exploited three chained Microsoft Exchange vulnerabilities to achieve unauthenticated remote code execution on vulnerable on-premises servers.
- Attackers installed webshells for later access, including in uncommon filesystem locations and paths exposed through modified Exchange configuration virtual directories.
- Reported post-exploitation activity included coinminers and LockFile ransomware.
- Defensive Notes
- Update Exchange servers to the latest security patches; the article recommends installing at least the July 2021 updates.
- Inspect applicationHost.config and the specified Exchange configuration file for unexpected virtual directories and physical paths; hunt for webshells in the referenced locations, including under C:\Users\All Users and C:\ProgramData.
- Remove discovered webshells, remove unauthorized virtual-directory entries from applicationHost.config, and restart the IIS service.
- Block the five reported IP addresses on host, on-premises, and web application firewalls, and monitor network activity for them.
- Verify installed Exchange hotfixes and compare the MSExchangeRPC binary hash against the article's version-specific July 2021 patch references.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 116[.]203[.]201[.]159 | Observed in Exchange logs interacting with webshells; Huntress recommended blocking it. |
| IPV4 | 203[.]184[.]132[.]186 | Observed in Exchange logs interacting with webshells; Huntress recommended blocking it. |
| IPV4 | 37[.]221[.]115[.]68 | Observed in Exchange logs interacting with webshells; Huntress recommended blocking it. |
| IPV4 | 45[.]144[.]30[.]18 | Observed in Exchange logs interacting with webshells; Huntress recommended blocking it. |
| IPV4 | 84[.]17[.]46[.]174 | Observed in Exchange logs interacting with webshells; Huntress recommended blocking it. |
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationAttackers exploited vulnerabilities in internet-facing on-premises Microsoft Exchange servers to gain remote code execution.T1505.003 · Web ShellAttackers installed webshells on compromised Exchange servers for later access, sometimes hiding them in nonstandard locations.
CVE
CVE-2021-31207Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23; Microsoft · Microsoft Exchange Server 2016 Cumulative Update 19; +3 moreCVE-2021-31207 enables post-authentication malicious actors to execute arbitrary code in the context of system and write arbitrary files.CVE-2021-34473Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23; Microsoft · Microsoft Exchange Server 2016 Cumulative Update 19; +3 moreCVE-2021-34473 provides a mechanism for pre-authentication remote code execution, enabling malicious actors to remotely execute code on an affected system.CVE-2021-34523Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23; Microsoft · Microsoft Exchange Server 2016 Cumulative Update 19; +3 moreCVE-2021-34523 enables malicious actors to execute arbitrary code post-authentication on Microsoft Exchange servers due to a flaw in the PowerShell service not properly validating access tokens.
People
Florian RothSecurity researcher whose assistance contributed to Huntress's findings about hidden webshells with modification times before August 2021.Kevin BeaumontSecurity researcher whose collaboration helped corroborate possible links between webshell and LockFile ransomware incidents.Orange TsaiPresented the ProxyShell attack chain at Black Hat USA '21 and provided a writeup following the Pwn2Own contest.Rich WarrenSecurity researcher whose collaboration helped corroborate possible links between webshell and LockFile ransomware incidents.