How Hafnium Works?<\/strong><\/h2>Hafnium exploits vulnerabilities on unpatched systems and takes advantage of Exchange authentication architecture to access on-premises Exchange server with administrative privileges and deploy web shells on the victim’s server.<\/p>
These web shells potentially enable threat actors to access the email accounts and facilitate the installation of additional malware or ransomware on the victim’s environment to compromise the system further. The vulnerabilities being exploited are CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065.<\/p>
How to Mitigate the Risks and Recover Exchange Server after Hafnium Attack?<\/strong><\/h2>You can take the following actions to mitigate the risks and recover user mailboxes from the affected Exchange server.<\/p>
1. Run Microsoft On-Premises Mitigation Tool (EOMT)<\/strong><\/h3>Microsoft has released Exchange On-Premises Mitigation Tool (EOMT) that works with MS Exchange 2019, 2016, and 2013. It will also work on Exchange 2010 with PowerShell 3.0 support but has minimum functionality.<\/p>
The tool addresses CVE-2021-26855 vulnerability. The tool helps you check if your Exchange server is vulnerable. To use EOMT, follow these steps:<\/p>
\n- Download the EOMT tool and extract the Security folder at your desired location.<\/li>\n<\/ul>
![\"extract](\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2021\/03\/extract-Exchange-On-Premises-Mitigation-Tool-EOMT.png\")
<\/figure>\n- Open PowerShell as administrator<\/strong> and then navigate to the extracted folder location. In our case, it is:<\/li>\n<\/ul>
cd C:\\Users\\Administrator\\Documents\\Security\\src<\/code><\/pre>![\"Stellar\"](\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2021\/03\/navigate-to-the-extracted-folder.png\")
<\/figure>\n- Now run the EOMT.ps1<\/strong> script to check if your server is vulnerable.<\/li>\n<\/ul>
.\\EOMT.ps1<\/code><\/pre>![\"run](\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2021\/03\/run-EOMT.ps1-script-to-check-Hafnium.png\")
<\/figure>The script checks if the server is vulnerable by downloading and installing the IIS URL rewrite tool<\/strong>. It then downloads and runs Microsoft Safety Scanner<\/strong> or MSERT<\/strong> in quick scan mode. The MSERT scans and removes threats and web shells from the server.<\/p>![\"after](\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2021\/03\/after-scan-the-EOMT-tool-runs-Microsoft-safety-Scanner-1.png\")
<\/figure>If the server isn’t vulnerable, it only runs the MSERT quick scan.<\/p>
You may also run Text-ProxyLogon.ps1<\/strong> (formerly known as Test-Hafnium) to automate the commands. It runs CVE-2021-26855 test much faster and exports the report in CSV files. The CSV file contains list of suspicious zip\/rar\/7x files that script finds in Program Data. Web shells are known to use such file formats for exfiltration.<\/p>![\"Tes-Hafnium](\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2021\/03\/Tes-Hafnium-or-Test-ProxyLogon.ps1-script-for-Hafnium.png\")
<\/figure>Review each file to check if these files are valid.<\/p>
2. Update Affected Exchange Servers<\/strong><\/h3>Exchange 2007 and 2003 are believed to be unaffected from the Hafnium attack. However, you must upgrade the server to a supported version to continue getting updates.<\/p>
Exchange 2010 is impacted by CVE-2021-26857 vulnerability only. Update the server with latest security patches and use EOMT script to investigate the server for possible exploitation.<\/p>
Exchange 2019, 2016, and 2013 are the most impacted Exchange server versions. You must apply mitigation steps discussed above and install March 2021 Exchange Server Security Updates.<\/p>
3. Restore from Backup<\/strong><\/h3>If your Exchange server is compromised and broken or crashed due to the Hafnium attack, you can use Setup \/m:recoverserver <\/a>to recover the server. However, it is critical to keep the Windows Server and Exchange version the same on the new server to avoid issues.<\/p>Then use your backup to restore the database on a new server and shut down or delete the infected one.<\/p>
4. Use Exchange Server Recovery Tool<\/strong><\/h3>Exchange server recovery tool, such as Stellar Repair for Exchange, comes in handy when you do not have a backup. The software helps administrators recover Exchange server<\/a> from malicious attacks. It also helps repair damaged databases due to server crashes, power failure, or hacking and can greatly reduce downtime scenarios.<\/p>The software lets you extract mailboxes from a compromised Exchange server database and saves them into PST. You may also export the mailboxes from the database directly to a live Exchange server or Office 365. It works with MS Exchange 2019 and older versions, including Exchange 5.5.<\/p>
\nNOTE: <\/em><\/strong>Run EOMT script before using Stellar Repair for Exchange software.<\/em><\/p>\n<\/blockquote>
You can take the following actions to mitigate the risks and recover user mailboxes from the affected Exchange server.<\/p>
1. Run Microsoft On-Premises Mitigation Tool (EOMT)<\/strong><\/h3>Microsoft has released Exchange On-Premises Mitigation Tool (EOMT) that works with MS Exchange 2019, 2016, and 2013. It will also work on Exchange 2010 with PowerShell 3.0 support but has minimum functionality.<\/p>
The tool addresses CVE-2021-26855 vulnerability. The tool helps you check if your Exchange server is vulnerable. To use EOMT, follow these steps:<\/p>
\n- Download the EOMT tool and extract the Security folder at your desired location.<\/li>\n<\/ul>
<\/figure>\n- Open PowerShell as administrator<\/strong> and then navigate to the extracted folder location. In our case, it is:<\/li>\n<\/ul>
cd C:\\Users\\Administrator\\Documents\\Security\\src<\/code><\/pre><\/figure>\n- Now run the EOMT.ps1<\/strong> script to check if your server is vulnerable.<\/li>\n<\/ul>
.\\EOMT.ps1<\/code><\/pre><\/figure>The script checks if the server is vulnerable by downloading and installing the IIS URL rewrite tool<\/strong>. It then downloads and runs Microsoft Safety Scanner<\/strong> or MSERT<\/strong> in quick scan mode. The MSERT scans and removes threats and web shells from the server.<\/p><\/figure>If the server isn’t vulnerable, it only runs the MSERT quick scan.<\/p>
You may also run Text-ProxyLogon.ps1<\/strong> (formerly known as Test-Hafnium) to automate the commands. It runs CVE-2021-26855 test much faster and exports the report in CSV files. The CSV file contains list of suspicious zip\/rar\/7x files that script finds in Program Data. Web shells are known to use such file formats for exfiltration.<\/p><\/figure>Review each file to check if these files are valid.<\/p>
2. Update Affected Exchange Servers<\/strong><\/h3>Exchange 2007 and 2003 are believed to be unaffected from the Hafnium attack. However, you must upgrade the server to a supported version to continue getting updates.<\/p>
Exchange 2010 is impacted by CVE-2021-26857 vulnerability only. Update the server with latest security patches and use EOMT script to investigate the server for possible exploitation.<\/p>
Exchange 2019, 2016, and 2013 are the most impacted Exchange server versions. You must apply mitigation steps discussed above and install March 2021 Exchange Server Security Updates.<\/p>
3. Restore from Backup<\/strong><\/h3>If your Exchange server is compromised and broken or crashed due to the Hafnium attack, you can use Setup \/m:recoverserver <\/a>to recover the server. However, it is critical to keep the Windows Server and Exchange version the same on the new server to avoid issues.<\/p>Then use your backup to restore the database on a new server and shut down or delete the infected one.<\/p>
4. Use Exchange Server Recovery Tool<\/strong><\/h3>Exchange server recovery tool, such as Stellar Repair for Exchange, comes in handy when you do not have a backup. The software helps administrators recover Exchange server<\/a> from malicious attacks. It also helps repair damaged databases due to server crashes, power failure, or hacking and can greatly reduce downtime scenarios.<\/p>The software lets you extract mailboxes from a compromised Exchange server database and saves them into PST. You may also export the mailboxes from the database directly to a live Exchange server or Office 365. It works with MS Exchange 2019 and older versions, including Exchange 5.5.<\/p>
\nNOTE: <\/em><\/strong>Run EOMT script before using Stellar Repair for Exchange software.<\/em><\/p>\n<\/blockquote>
<\/figure>- \n
- Open PowerShell as administrator<\/strong> and then navigate to the extracted folder location. In our case, it is:<\/li>\n<\/ul>
cd C:\\Users\\Administrator\\Documents\\Security\\src<\/code><\/pre><\/figure>- \n
- Now run the EOMT.ps1<\/strong> script to check if your server is vulnerable.<\/li>\n<\/ul>
.\\EOMT.ps1<\/code><\/pre><\/figure>The script checks if the server is vulnerable by downloading and installing the IIS URL rewrite tool<\/strong>. It then downloads and runs Microsoft Safety Scanner<\/strong> or MSERT<\/strong> in quick scan mode. The MSERT scans and removes threats and web shells from the server.<\/p>
<\/figure>If the server isn’t vulnerable, it only runs the MSERT quick scan.<\/p>
You may also run Text-ProxyLogon.ps1<\/strong> (formerly known as Test-Hafnium) to automate the commands. It runs CVE-2021-26855 test much faster and exports the report in CSV files. The CSV file contains list of suspicious zip\/rar\/7x files that script finds in Program Data. Web shells are known to use such file formats for exfiltration.<\/p>
<\/figure>Review each file to check if these files are valid.<\/p>
2. Update Affected Exchange Servers<\/strong><\/h3>
Exchange 2007 and 2003 are believed to be unaffected from the Hafnium attack. However, you must upgrade the server to a supported version to continue getting updates.<\/p>
Exchange 2010 is impacted by CVE-2021-26857 vulnerability only. Update the server with latest security patches and use EOMT script to investigate the server for possible exploitation.<\/p>
Exchange 2019, 2016, and 2013 are the most impacted Exchange server versions. You must apply mitigation steps discussed above and install March 2021 Exchange Server Security Updates.<\/p>
3. Restore from Backup<\/strong><\/h3>
If your Exchange server is compromised and broken or crashed due to the Hafnium attack, you can use Setup \/m:recoverserver <\/a>to recover the server. However, it is critical to keep the Windows Server and Exchange version the same on the new server to avoid issues.<\/p>
Then use your backup to restore the database on a new server and shut down or delete the infected one.<\/p>
4. Use Exchange Server Recovery Tool<\/strong><\/h3>
Exchange server recovery tool, such as Stellar Repair for Exchange, comes in handy when you do not have a backup. The software helps administrators recover Exchange server<\/a> from malicious attacks. It also helps repair damaged databases due to server crashes, power failure, or hacking and can greatly reduce downtime scenarios.<\/p>
The software lets you extract mailboxes from a compromised Exchange server database and saves them into PST. You may also export the mailboxes from the database directly to a live Exchange server or Office 365. It works with MS Exchange 2019 and older versions, including Exchange 5.5.<\/p>
\n
NOTE: <\/em><\/strong>Run EOMT script before using Stellar Repair for Exchange software.<\/em><\/p>\n<\/blockquote>
- Now run the EOMT.ps1<\/strong> script to check if your server is vulnerable.<\/li>\n<\/ul>