{"uuid": "e8b03495-f3a9-477c-b783-fe00c011fa80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-41082", "type": "seen", "source": "https://t.me/hacking_Attack/81456", "content": "Black Hat Ethical Hacking\nRansomware gang uses new Microsoft Exchange exploit to breach servers\n\nRansomware gang uses new Microsoft Exchange exploit to breach serversPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Play ransomware threat actors are using a new exploit chain that bypasses\u00a0ProxyNotShell URL rewrite mitigations\u00a0to gain remote code execution (RCE) on vulnerable servers through Outlook Web Access (OWA).Cybersecurity firm CrowdStrike spotted the exploit (dubbed OWASSRF) while investigating Play ransomware attacks where compromised Microsoft Exchange servers were used to infiltrate the victims\u2019 networks.\n\nTo execute arbitrary commands on compromised servers, the ransomware operators leveraged Remote PowerShell to abuse the CVE-2022-41082, the same bug exploited by ProxyNotShell.\n\n\u201cIn each case, CrowdStrike reviewed the relevant logs and determined there was no evidence of exploitation of CVE-2022-41040 for initial access,\u201d the researchers said.\n\n\u201cInstead, it appeared that corresponding requests were made directly through the Outlook Web Application (OWA) endpoint, indicating a previously undisclosed exploit method for Exchange.\u201d\n\nWhile ProxyNotShell exploits target CVE-2022-41040, CrowdStrike found that the flaw abused by the newly discovered exploit is likely CVE-2022-41080, a security flaw Microsoft tagged as critical and not exploited in the wild that allows remote privilege escalation on Exchange servers.\nhttps://www.bleepstatic.com/images/news/u/1109292/2022/OWASSRF%20PoC%20exploit.png \n<figcaptionOWASSRF PoC exploit (BleepingComputer) \nCVE-2022-41080 was discovered and reported by zcgonvh with 360 noah lab and rskvp93, Q5Ca, and nxhoang99 with VcsLab of Viettel Cyber Security.\n\nOne of the researchers who found the bug said\u00a0that it can be exploited as part of a \u201cchain to RCE Exchange on-premises, Exchange Online, Skype for Business Server (maybe SFB Online+Teams too but can\u2019t find its powershell remote endpoint).\u201d\n\nAt this time it is unclear whether the threat actors were abusing this Microsoft Exchange attack chain as a zero-day exploit before fixes were released.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course OWASSRF PoC exploit leaked onlineWhile CrowdStrike security researchers were working on developing their own proof-of-concept (PoC) code to match the log info found while investigating these recent Play ransomware attacks, Huntress Labs threat researcher Dray Agha found and leaked\u00a0a threat actor\u2019s tooling\u00a0online, on December 14th.\n\nThe leaked tooling contained a PoC for Play\u2019s Exchange exploit, which allowed CrowdStrike to replicate the malicious activity logged in Play ransomware\u2019s attacks.\n\nCrowdStrike believes that the proof-of-concept exploit was used to drop remote access tools such as Plink and AnyDesk on compromised servers.\n\nBleepingComputer also found that the tooling leaked by Agha contained the ConnectWise remote administration software, which was likely deployed in attacks as well.\n\nOrganizations with on-premises Microsoft Exchange servers on their network are advised to apply the latest Exchange security updates (with November 2022 being the minimum patch level)\u00a0or disable OWA until the CVE-2022-41080 patch can be applied. The Play ransomware operation\u00a0launched in June 2022, when the first victims began reaching out for help to deal with the attacks\u2019 fallout in the BleepingComputer forums.\n\nSince its launch in June, dozens of Play ransomware victims have uploaded samples or ransom notes to the ID Ransomware platform to identify what ransomware was used to encrypt their[...]", "creation_timestamp": "2026-09-02T01:01:29.478350Z"}