⬇ Download holy card: ·
Saint ProxyRelay, Last of the Exchange Saga
Patron of on-premises Exchange servers that never die, NTLM relay attacks, and researchers who find the fourth instalment.
Life
On 19 October 2022 Orange Tsai published the fourth part of his research into Microsoft Exchange attack surfaces, named ProxyRelay: a chain of flaws let you relay a user's authentication to Exchange's internal services and escalate privileges. Microsoft had fixed the pieces across different bulletins between 2021 and 2022; the name continues the famous Proxy series that began with ProxyLogon.
Prayer
O Saint ProxyRelay, who relays authentication to those who shouldn't have it, let our Exchange servers not speak NTLM with strangers. Amen.
How to celebrate
Celebrated by applying every Exchange cumulative update and, where possible, switching off that old server in the machine room.
Relay without looking and you hand over the house keys.