Individual skill

exchange-attack

Microsoft Exchange 邮件服务器攻击方法论。当发现 OWA(Outlook Web App) 登录页面、Exchange 管理面板、443 端口运行 Exchange、或内网中发现 Exchange 服务器时使用。当端口扫描发现 25/443/587/993/995 且指纹为 Exchange 时使用。覆盖 OWA 密码喷洒、ProxyLogon(CVE-2021-26855)、ProxyShell(CVE-2021-34473)、ProxyNotShell(CVE-2022-41040)、邮箱搜索导出、GAL 全局地址簿提取、NTLM 中继到 Exchange。Exchange 是域渗透中最高价值的目标之一——可获取域管邮箱、提取全员通讯录、获取 SYSTEM 权限。发现任何 /owa /ecp /autodiscover /mapi 路径时都应使用此 skill

skills/lateral/exchange-attack/SKILL.md

Source commit c0d3a4645f26be5b94f64344b501db4191dc9788

What was checked

Matches the observed repository HEAD

Yes

Scanner rules are current

Yes

Repository scan complete

No

Skill scan complete

No

Observed behavior

Network or broad shell

Last checked

Nov 3, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.