Scenario: Microsoft recently reported 4 new 0-day exploits that may impact Exchange On-Premises servers.
The vulnerabilities being exploited are CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065
Patch your Exchange On-Premises servers with the latest security patch to protect your environment!!!!
To see if you were impacted or exploited, you can check your log files. Please see the reference article/URL listed at the bottom of this post. My commands used are built off of Microsofts PowerShell commands, except I needed my commands to run on multiple servers, in parallel, and I needed a faster way of evaluating my log files for CVE-2021-26855.
Here are my PowerShell notes that I used:
CVE-2021-26855 – Review the output file for Authenticateduser = $null and AnchorMailbox is like ServerInfo~*/*
$s = “ExOnPremSrv1″,”ExOnPremSrv2”
$S | %{
$Server= $_
$files = get-childitem -recurse -path “\$server\c$\PROGRAM FILES\Microsoft\Exchange Server\V15\Logging\HttpProxy” -Filter ‘*.log’
$FileCount = $Files.Count
$c = 0
$results = @()
$outfile = “\FileServer01\c$\temp\$server.txt”
$files.fullname | %{
$C++
$f = $_
"$c OF $FILECOUNT ::: $F"
$temp = findstr "ServerInfo" "$F"
$temp | out-file $outfile -Append
}
}
CVE-2021-26858
$server = “ExOnPremSrv1″,”ExOnPremSrv2”
$server | %{
$s = $_
“Checking $S”
findstr /snip /c:”Download failed and temporary file” “\$s\c$\PROGRAM FILES\Microsoft\Exchange Server\V15\Logging\OABGeneratorLog*.log”
}
CVE-2021-26857
$server = “ExOnPremSrv1″,”ExOnPremSrv2”
$Server | %{
$s = $_
“Checking $S”
Get-EventLog -ComputerName $S -LogName Application -Source “MSExchange Unified Messaging” -EntryType Error | Where-Object { $_.Message -like “System.InvalidCastException” }
}
CVE-2021-27065
$server = “ExOnPremSrv1″,”ExOnPremSrv2”
$server | %{
$s = $_
“Checking $S”
Select-String -Path “\$s\c$\PROGRAM FILES\Microsoft\Exchange Server\V15\Logging\ECP\Server*.log” -Pattern ‘Set-.+VirtualDirectory’
}
Ref: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/