⬇ Download holy card: ·
Saint ProxyShell, Who Entered Through Exchange
Patron of Microsoft Exchange admins, exposed mail servers, and everyone who reads advisories a month late.
Life
On 18 August 2021, at Black Hat, Orange Tsai presented ProxyShell: a chain of three Exchange flaws that, linked together, led from anonymity to unauthenticated remote code execution. Within days of public exposure, thousands of servers were scanned and hit, with web shells and ransomware in tow. It was the second leg of Orange Tsai's Proxy saga, after ProxyLogon.
Prayer
O Saint ProxyShell, who crosses the autodiscover and arrives at PowerShell, keep our Exchange servers patched before you knock. Amen.
How to celebrate
Celebrated by installing Exchange cumulative updates and hunting for web shells in folders that should have none.
Three flaws in a row make one key.