[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foi1UlFN7GiSVFFxGDYbXU5p_Vj7vG0lxVbwN_G5jBAs":3},{"id":4,"question":5,"answer":6,"answerHtml":7,"slug":8,"keywords":9,"article":10,"status":34,"aiModel":39,"aiConfidence":39,"updatedAt":51,"createdAt":51,"_status":50},816,"How can an attacker enumerate all mailbox users in an Exchange organization using this vulnerability?","Once the attacker has impersonated a valid mailbox user via the SSRF and SID technique, they can use the FindPeople operation in EWS to enumerate the GlobalAddressList. This list contains the email addresses of all mailbox users in the Exchange organization. The attacker simply needs to traverse and deduplicate results. The article references open-sourced scripts for implementation, and notes that default system mailboxes (e.g., `SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}`) can be used as the impersonated user since they exist in every Exchange environment.","\u003Cp>Once the attacker has impersonated a valid mailbox user via the SSRF and SID technique, they can use the FindPeople operation in EWS to enumerate the GlobalAddressList. This list contains the email addresses of all mailbox users in the Exchange organization. The attacker simply needs to traverse and deduplicate results. The article references open-sourced scripts for implementation, and notes that default system mailboxes (e.g., `SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}`) can be used as the impersonated user since they exist in every Exchange environment.\u003C\u002Fp>\u003Cp>\u003Ca href=\"\u002Fnews\u002Fproxyshell-exploitation-analysis-1-cve-2021-34473\">Read the related One Day Sec article\u003C\u002Fa>\u003C\u002Fp>","how-can-an-attacker-enumerate-all-mailbox-users-in-an-exchange-organization-usin-1777481767511","GlobalAddressList, FindPeople, enumeration, mailbox users, default system mailboxes",{"id":11,"title":12,"slug":13,"description":14,"content":15,"contentHtml":30,"cover":31,"author":32,"views":19,"readingTime":33,"status":34,"publishedAt":35,"seo":36,"tags":41,"qaPairs":42,"meta":47,"updatedAt":48,"createdAt":49,"_status":50},200,"ProxyShell Exploitation Analysis 1 - CVE-2021-34473","proxyshell-exploitation-analysis-1-cve-2021-34473","Technical analysis of ProxyShell CVE-2021-34473 exploitation: SSRF vulnerability debugging, EWS impersonation via SID, and complete exploit chain for Exchange Server attacks.",{"root":16},{"type":17,"format":18,"indent":19,"version":20,"children":21,"direction":29},"root","",0,1,[22],{"type":23,"format":18,"indent":19,"version":20,"children":24,"direction":29},"paragraph",[25],{"mode":26,"text":27,"type":28,"style":18,"detail":19,"format":19,"version":20},"normal","\u003Chtml>\u003Chead>\u003C\u002Fhead>\u003Cbody>\u003Ch2>0x00 Preface\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>Orange introduced the Microsoft Exchange attack chain used in Pwn2Own 2021 during this year's BlackHat presentation. His content provided me with great inspiration.\u003C\u002Fp>\u003Cp>This article only records the details of my research on ProxyShell and analyzes exploitation ideas from a technical research perspective.\u003C\u002Fp>\u003Ch2>0x01 Introduction\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article will cover the following:\u003C\u002Fp>\u003Cul>\u003Cli>Setting up the debugging environment\u003C\u002Fli>\u003Cli>Vulnerability analysis\u003C\u002Fli>\u003Cli>Exploitation ideas\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x02 Setting up the debugging environment\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Disable debugging optimization in Visual Studio\u003C\u002Fh3>\u003Cp>Set the environment variable COMPLUS_ZapDisable=1\u003C\u002Fp>\u003Cp>Restart the system\u003C\u002Fp>\u003Ch3>2. View the corresponding processes in Exchange\u003C\u002Fh3>\u003Cp>Execute the command:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>C:\\Windows\\System32\\inetsrv\\appcmd list wp\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>All Exchange processes and their corresponding PIDs can be obtained, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770017255072_0_59708678a5.jpeg\">\u003C\u002Fp>\u003Ch3>3. Debug using dnSpy\u003C\u002Fh3>\u003Cp>Open the relevant DLL file, set breakpoints at the desired debugging locations, and select Attach Process to begin debugging\u003C\u002Fp>\u003Cp>If unsure about the Exchange process to debug, select all w3wp.exe\u003C\u002Fp>\u003Ch2>0x03 Vulnerability Debugging\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>Open the file C:\\Program Files\\Microsoft\\Exchange Server\\V15\\FrontEnd\\HttpProxy\\bin\\Microsoft.Exchange.FrontEndHttpProxy.dll using dnSpy\u003C\u002Fp>\u003Cp>Navigate sequentially to Microsoft.Exchange.Clients.Owa.Core -> Microsoft.Exchange.HttpProxy\u003C\u002Fp>\u003Cp>For the vulnerability principle of the SSRF vulnerability (CVE-2021-34473), refer to the following article:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fpeterjson.medium.com\u002Freproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1\u003C\u002Fp>\u003Ch2>0x04 Vulnerability Analysis\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Determine if the vulnerability exists\u003C\u002Fh3>\u003Cp>Using the method provided in Orange's original text:\u003C\u002Fp>\u003Cp>Access: https:\u002F\u002F\u003Cexchange url=\"\">\u002Fautodiscover\u002Fautodiscover.json?@foo.com\u002Fmapi\u002Fnspi\u002F?&Email=autodiscover\u002Fautodiscover.json%3f@foo.com\u003C\u002Fexchange>\u003C\u002Fp>\u003Cp>If the vulnerability exists, the following result is returned:\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770017279882_1_d55f150765.jpeg\">\u003C\u002Fp>\u003Cp>Privileges are System\u003C\u002Fp>\u003Cp>The \"\u002Fmapi\u002Fnspi\" in the URL is the final address accessed by the Exchange server\u003C\u002Fp>\u003Cp>The \"?&Email=autodiscover\u002Fautodiscover.json%3f@foo.com\" in the URL serves as a parameter to meet the vulnerability trigger conditions. The same effect can also be achieved by setting the Cookie content to \"Email=Autodiscover\u002Fautodiscover.json%3f@foo.com\", as shown in the source code below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770017308878_2_a3f360c789.jpeg\">\u003C\u002Fp>\u003Ch3>2. Invoke Exchange Web Service (EWS) via SSRF vulnerability\u003C\u002Fh3>\u003Cp>Exchange Web Service (EWS) corresponds to the email content of mailbox users. For usage of EWS, refer to the previous article \"Exchange Web Service (EWS) Development Guide 2 – SOAP XML message\". By sending XML requests, the email content of corresponding users can be obtained\u003C\u002Fp>\u003Cp>Since the default privilege of SSRF is System, we need to find a method to impersonate any mailbox user in order to read the email content of corresponding users\u003C\u002Fp>\u003Cp>After a period of debugging, I did not find a method to specify the EWS authentication user via parameters. However, here we can use a technique from the Exchange privilege escalation vulnerability (CVE-2018-8581). By utilizing SerializedSecurityContext in the Header and specifying the SID, identity impersonation can be achieved, allowing EWS calls to be made as the specified user.\u003C\u002Fp>\u003Cp>Code location:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002Fthezdi\u002FPoC\u002Fblob\u002Fmaster\u002FCVE-2018-8581\u002FserverHTTP_relayNTLM.py#L48-L64\u003C\u002Fp>\u003Cp>Header format is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>    \u003Csoap:header>\u003Cbr>     \u003Ct:requestserverversion version=\"Exchange2016\">\u003Cbr>     \u003Cbr>\u003Cm:serializedsecuritycontext>\u003Cbr>\u003Cm:usersid>'''+VICTIM_SID+'''\u003C\u002Fm:usersid>\u003Cbr>\u003Cm:groupsids>\u003Cbr>   \u003Cm:groupidentifier>\u003Cbr>     \u003Ct:securityidentifier>'''+VICTIM_SID+'''\u003C\u002Ft:securityidentifier>\u003Cbr>   \u003C\u002Fm:groupidentifier>\u003Cbr>\u003C\u002Fm:groupsids>\u003Cbr>   \u003Cbr>\u003Crestrictedgroupsids>\u003Cbr>\u003Crestrictedgroupidentifier> \u003C\u002Frestrictedgroupidentifier>\u003Cbr>\u003C\u002Frestrictedgroupsids>\u003Cbr>\u003C\u002Fm:serializedsecuritycontext>\u003Cbr> \u003Cbr>\u003C\u002Ft:requestserverversion>\u003C\u002Fsoap:header> \u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>To obtain the user's SID, we can use the technique from the Exchange SSRF vulnerability (CVE-2021-26855). By accessing \u002Fautodiscover\u002Fautodiscover.xml to get the legacyDn, and then using it as a parameter to access \u002Fmapi\u002Femsmdb, we can obtain the corresponding SID for the user.\u003C\u002Fp>\u003Cp>At this point, the entire exploitation chain is complete, with the process as follows:\u003C\u002Fp>\u003Cp>1. Access \u002Fautodiscover\u002Fautodiscover.xml to obtain the legacyDn.\u003C\u002Fp>\u003Cp>2. Access \u002Fmapi\u002Femsmdb to obtain the corresponding SID for the user.\u003C\u002Fp>\u003Cp>3. Use SerializedSecurityContext in the Header to specify the user identity for EWS call operations.\u003C\u002Fp>\u003Ch3>3. Enumerate the mailbox user list.\u003C\u002Fh3>\u003Cp>As mentioned in my previous article 'Penetration Techniques - Methods to Obtain Exchange GlobalAddressList': 'The Exchange GlobalAddressList contains the email addresses of all mailbox users in the Exchange organization. By obtaining the credentials of any mailbox user within the Exchange organization, you can export the email addresses of other mailbox users through the GlobalAddressList.'\u003C\u002Fp>\u003Cp>This can also be exploited here. We only need to use the FindPeople operation, perform a traversal, and deduplicate the results.\u003C\u002Fp>\u003Cp>For implementation details, refer to the previously open-sourced script: a certain open-source project.\u003C\u002Fp>\u003Ch3>4. Default mailbox users.\u003C\u002Fh3>\u003Cp>To read the Exchange GlobalAddressList, we need to obtain the credentials of any mailbox user within the Exchange organization. In the context of this vulnerability, we only need the mailbox user name.\u003C\u002Fp>\u003Cp>The following four default users exist in Exchange and can be used:\u003C\u002Fp>\u003Cul>\u003Cli>SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}\u003C\u002Fli>\u003Cli>SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}\u003C\u002Fli>\u003Cli>SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}(Exchange 2016 CU8 and later)\u003C\u002Fli>\u003Cli>SystemMailbox{2CE34405-31BE-455D-89D7-A7C7DA7A0DAA}(Exchange 2016 CU8 and later)\u003C\u002Fli>\u003C\u002Ful>\u003Cp>Reference:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fexchange\u002Farchitecture\u002Fmailbox-servers\u002Frecreate-arbitration-mailboxes?view=exchserver-2019\u003C\u002Fp>\u003Ch2>0x05 Summary\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>CVE-2021-34473, as the foundation of the ProxyShell attack chain, is easy to verify and poses significant risks. From a defensive perspective, it is recommended that users apply patches as soon as possible.\u003C\u002Fp>\u003C\u002Fbody>\u003C\u002Fhtml>","text","ltr","\u003Chtml>\u003Chead>\u003C\u002Fhead>\u003Cbody>\u003Ch2>0x00 Preface\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>Orange introduced the Microsoft Exchange attack chain used in Pwn2Own 2021 during this year's BlackHat presentation. His content provided me with great inspiration.\u003C\u002Fp>\u003Cp>This article only records the details of my research on ProxyShell and analyzes exploitation ideas from a technical research perspective.\u003C\u002Fp>\u003Ch2>0x01 Introduction\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article will cover the following:\u003C\u002Fp>\u003Cul>\u003Cli>Setting up the debugging environment\u003C\u002Fli>\u003Cli>Vulnerability analysis\u003C\u002Fli>\u003Cli>Exploitation ideas\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x02 Setting up the debugging environment\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Disable debugging optimization in Visual Studio\u003C\u002Fh3>\u003Cp>Set the environment variable COMPLUS_ZapDisable=1\u003C\u002Fp>\u003Cp>Restart the system\u003C\u002Fp>\u003Ch3>2. View the corresponding processes in Exchange\u003C\u002Fh3>\u003Cp>Execute the command:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>C:\\Windows\\System32\\inetsrv\\appcmd list wp\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>All Exchange processes and their corresponding PIDs can be obtained, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770017255072_0_59708678a5-1.jpeg\">\u003C\u002Fp>\u003Ch3>3. Debug using dnSpy\u003C\u002Fh3>\u003Cp>Open the relevant DLL file, set breakpoints at the desired debugging locations, and select Attach Process to begin debugging\u003C\u002Fp>\u003Cp>If unsure about the Exchange process to debug, select all w3wp.exe\u003C\u002Fp>\u003Ch2>0x03 Vulnerability Debugging\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>Open the file C:\\Program Files\\Microsoft\\Exchange Server\\V15\\FrontEnd\\HttpProxy\\bin\\Microsoft.Exchange.FrontEndHttpProxy.dll using dnSpy\u003C\u002Fp>\u003Cp>Navigate sequentially to Microsoft.Exchange.Clients.Owa.Core -> Microsoft.Exchange.HttpProxy\u003C\u002Fp>\u003Cp>For the vulnerability principle of the SSRF vulnerability (CVE-2021-34473), refer to the following article:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fpeterjson.medium.com\u002Freproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1\u003C\u002Fp>\u003Ch2>0x04 Vulnerability Analysis\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Determine if the vulnerability exists\u003C\u002Fh3>\u003Cp>Using the method provided in Orange's original text:\u003C\u002Fp>\u003Cp>Access: https:\u002F\u002F\u003Cexchange url=\"\">\u002Fautodiscover\u002Fautodiscover.json?@foo.com\u002Fmapi\u002Fnspi\u002F?&Email=autodiscover\u002Fautodiscover.json%3f@foo.com\u003C\u002Fexchange>\u003C\u002Fp>\u003Cp>If the vulnerability exists, the following result is returned:\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770017279882_1_d55f150765-1.jpeg\">\u003C\u002Fp>\u003Cp>Privileges are System\u003C\u002Fp>\u003Cp>The \"\u002Fmapi\u002Fnspi\" in the URL is the final address accessed by the Exchange server\u003C\u002Fp>\u003Cp>The \"?&Email=autodiscover\u002Fautodiscover.json%3f@foo.com\" in the URL serves as a parameter to meet the vulnerability trigger conditions. The same effect can also be achieved by setting the Cookie content to \"Email=Autodiscover\u002Fautodiscover.json%3f@foo.com\", as shown in the source code below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770017308878_2_a3f360c789-1.jpeg\">\u003C\u002Fp>\u003Ch3>2. Invoke Exchange Web Service (EWS) via SSRF vulnerability\u003C\u002Fh3>\u003Cp>Exchange Web Service (EWS) corresponds to the email content of mailbox users. For usage of EWS, refer to the previous article \"Exchange Web Service (EWS) Development Guide 2 – SOAP XML message\". By sending XML requests, the email content of corresponding users can be obtained\u003C\u002Fp>\u003Cp>Since the default privilege of SSRF is System, we need to find a method to impersonate any mailbox user in order to read the email content of corresponding users\u003C\u002Fp>\u003Cp>After a period of debugging, I did not find a method to specify the EWS authentication user via parameters. However, here we can use a technique from the Exchange privilege escalation vulnerability (CVE-2018-8581). By utilizing SerializedSecurityContext in the Header and specifying the SID, identity impersonation can be achieved, allowing EWS calls to be made as the specified user.\u003C\u002Fp>\u003Cp>Code location:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002Fthezdi\u002FPoC\u002Fblob\u002Fmaster\u002FCVE-2018-8581\u002FserverHTTP_relayNTLM.py#L48-L64\u003C\u002Fp>\u003Cp>Header format is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>    \u003Csoap:header>\u003Cbr>     \u003Ct:requestserverversion version=\"Exchange2016\">\u003Cbr>     \u003Cbr>\u003Cm:serializedsecuritycontext>\u003Cbr>\u003Cm:usersid>'''+VICTIM_SID+'''\u003C\u002Fm:usersid>\u003Cbr>\u003Cm:groupsids>\u003Cbr>   \u003Cm:groupidentifier>\u003Cbr>     \u003Ct:securityidentifier>'''+VICTIM_SID+'''\u003C\u002Ft:securityidentifier>\u003Cbr>   \u003C\u002Fm:groupidentifier>\u003Cbr>\u003C\u002Fm:groupsids>\u003Cbr>   \u003Cbr>\u003Crestrictedgroupsids>\u003Cbr>\u003Crestrictedgroupidentifier> \u003C\u002Frestrictedgroupidentifier>\u003Cbr>\u003C\u002Frestrictedgroupsids>\u003Cbr>\u003C\u002Fm:serializedsecuritycontext>\u003Cbr> \u003Cbr>\u003C\u002Ft:requestserverversion>\u003C\u002Fsoap:header> \u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>To obtain the user's SID, we can use the technique from the Exchange SSRF vulnerability (CVE-2021-26855). By accessing \u002Fautodiscover\u002Fautodiscover.xml to get the legacyDn, and then using it as a parameter to access \u002Fmapi\u002Femsmdb, we can obtain the corresponding SID for the user.\u003C\u002Fp>\u003Cp>At this point, the entire exploitation chain is complete, with the process as follows:\u003C\u002Fp>\u003Cp>1. Access \u002Fautodiscover\u002Fautodiscover.xml to obtain the legacyDn.\u003C\u002Fp>\u003Cp>2. Access \u002Fmapi\u002Femsmdb to obtain the corresponding SID for the user.\u003C\u002Fp>\u003Cp>3. Use SerializedSecurityContext in the Header to specify the user identity for EWS call operations.\u003C\u002Fp>\u003Ch3>3. Enumerate the mailbox user list.\u003C\u002Fh3>\u003Cp>As mentioned in my previous article 'Penetration Techniques - Methods to Obtain Exchange GlobalAddressList': 'The Exchange GlobalAddressList contains the email addresses of all mailbox users in the Exchange organization. By obtaining the credentials of any mailbox user within the Exchange organization, you can export the email addresses of other mailbox users through the GlobalAddressList.'\u003C\u002Fp>\u003Cp>This can also be exploited here. We only need to use the FindPeople operation, perform a traversal, and deduplicate the results.\u003C\u002Fp>\u003Cp>For implementation details, refer to the previously open-sourced script: a certain open-source project.\u003C\u002Fp>\u003Ch3>4. Default mailbox users.\u003C\u002Fh3>\u003Cp>To read the Exchange GlobalAddressList, we need to obtain the credentials of any mailbox user within the Exchange organization. In the context of this vulnerability, we only need the mailbox user name.\u003C\u002Fp>\u003Cp>The following four default users exist in Exchange and can be used:\u003C\u002Fp>\u003Cul>\u003Cli>SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}\u003C\u002Fli>\u003Cli>SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}\u003C\u002Fli>\u003Cli>SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}(Exchange 2016 CU8 and later)\u003C\u002Fli>\u003Cli>SystemMailbox{2CE34405-31BE-455D-89D7-A7C7DA7A0DAA}(Exchange 2016 CU8 and later)\u003C\u002Fli>\u003C\u002Ful>\u003Cp>Reference:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fexchange\u002Farchitecture\u002Fmailbox-servers\u002Frecreate-arbitration-mailboxes?view=exchserver-2019\u003C\u002Fp>\u003Ch2>0x05 Summary\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>CVE-2021-34473, as the foundation of the ProxyShell attack chain, is easy to verify and poses significant risks. From a defensive perspective, it is recommended that users apply patches as soon as possible.\u003C\u002Fp>\u003C\u002Fbody>\u003C\u002Fhtml>",754,"Onedaysec",4,"published","2026-02-02T07:38:21.198Z",{"title":37,"description":14,"keywords":38,"ogImage":39,"canonicalUrl":39,"noIndex":40},"ProxyShell Exploitation Analysis: CVE-2021-34473 Debugging & Exploit Chain","ProxyShell, CVE-2021-34473, Microsoft Exchange exploit, SSRF vulnerability, EWS, Exchange Web Services, debugging dnSpy, exploitation chain, privilege escalation, SID impersonation",null,false,[],{"docs":43,"hasNextPage":40},[44,4,45,46],817,815,814,{"title":39,"description":39,"image":39},"2026-07-24T15:37:11.398Z","2026-07-23T16:02:08.300Z","draft","2026-07-23T16:14:55.536Z"]