How NTLM Relay Ruins Your Exchange Servers

Explore the critical intersection of NTLM Relay attacks and Exchange Server vulnerabilities in this illuminating conference talk. Delve into a rarely discussed attack surface affecting Exchange cluster environments, impacting approximately 60% of frontend and 70% of backend endpoints. Learn how these architectural design issues can be exploited to compromise user mailboxes, granting attackers the ability to read and send emails, download attachments, and potentially achieve remote code execution on Exchange Servers. Follow along as the speaker uncovers the root causes of these vulnerabilities, demonstrates exploitation techniques, discusses patches and their bypasses, and provides essential guidance on protecting Exchange Servers from these threats. Gain valuable insights from a senior security researcher's expertise in Windows Active Directory Security, Cloud Security, and Web Security.

#HITB2023HKT D1T2 - How NTLM Relay Ruins Your Exchange Servers - Tianze Ding