Scan your exchange server for proxy logon:.Exchange WebShell Detection (A simple PowerShell that is fast and checks if your IIS or Exchange directory has been exploited).Health Checker (Scans your server for any vulnerabilities and whether you have updated Server CU and installed patches).MSERT (Microsoft Safety Scanner) detects web shells, Download here.Microsoft released couple of tools that could diagnose your servers and check if you already have been infected with a backdoor or any of these nasty malware and also remove those infected files or clean them and ask you for a restart if it’s required. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.ĬVE-2021-27065 is a post-authentication arbitrary file write vulnerability in Exchange. This requires administrator permission or another vulnerability to exploit.ĬVE-2021-26858 is a post-authentication arbitrary file write vulnerability in Exchange. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. Insecure deserialization is where untrusted user-controllable data is deserialized by a program.

Let’s get into details of those exploits one by one:ĬVE-2021-26855 is a server-side request forgery (SSRF) vulnerability in Exchange which allowed the attacker to send arbitrary HTTP requests and authenticate as the Exchange server.ĬVE-2021-26857 is an insecure deserialization vulnerability in the Unified Messaging service. The vulnerabilities recently being exploited were CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 which are part of alleged “State-sponsored Chinese group” according to Microsoft.

Msert tool exchange