{"id":8638,"date":"2024-04-04T09:23:03","date_gmt":"2024-04-04T07:23:03","guid":{"rendered":"https:\/\/www.teal-consulting.de\/?p=8638"},"modified":"2024-06-17T10:16:38","modified_gmt":"2024-06-17T08:16:38","slug":"pwned-by-the-mail-carrier","status":"publish","type":"post","link":"https:\/\/www.teal-consulting.de\/en\/2024\/04\/04\/pwned-by-the-mail-carrier\/","title":{"rendered":"Pwned by the Mail Carrier"},"content":{"rendered":"
[vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”30″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text][\/vc_column_text][vc_empty_space height=”20″][vc_column_text]A guest article from our partner: SpecterOps<\/a>
\nAuthor: Jonas B\u00fclow Knudsen (Product Architect)<\/strong>[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_column_text]\n

How MS Exchange on-premises compromises Active Directory and what organizations can do to prevent that.<\/em><\/p>\n

At SpecterOps, we recommend our customers establish a security boundary around their most critical assets (i.e.,\u00a0Tier Zero<\/a>) of Active Directory (AD). We help them find and remediate the attack paths that cross this security boundary with\u00a0BloodHound Enterprise<\/a>. One of the most common challenges we and our customers face is Microsoft Exchange on-premises (Exchange).<\/p>\n

If you compromise Exchange in AD, you are almost guaranteed an attack path to full control over the domain because of the extensive AD permissions Exchange has. It has been like this for many years; Microsoft has reduced many permissions, but the problem remains.<\/p>\n

In this blog post, we will explore what permissions Exchange has in AD that an attacker can abuse to compromise the domain; what effect the different Exchange permission model has in terms of compromising AD permissions; and what organizations can do to reduce the permissions such that the compromise of Exchange does not provide an attack path to full control of the domain.<\/p>\n

 <\/p>\n

Acknowledgments<\/h2>\n

 <\/p>\n

A big thank you to the following people for their work which I have used in this blog post:<\/p>\n