Need help with Exchange-AD-Privesc?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

527 Stars 91 Forks MIT License 21 Commits 1 Opened issues


Exchange privilege escalations to Active Directory

Services available


Need anything else?

Contributors list

# 306,714
19 commits
# 253,380
1 commit


This repository provides a few techniques and scripts regarding the impact of Microsoft Exchange deployment on Active Directory security. This is a side project of AD-Control-Paths, an AD permissions auditing project to which I recently added some Exchange-related modules.


  1. General considerations
  2. Domain object DACL privilege escalation
  3. DNSAdmins group DACL privilege escalation
  4. Public-Information property set includes SPN, allows kerberoasting
  5. Public-Information property set includes Alt-Security-Identities, allows x509 certificate mapping to privileged users

General considerations

For pentesters looking to take control of an AD domain, Exchange is a valid intermediary target. The servers are much less secured than domain controllers by default and the control groups are distinct in the usual permissions models, which provides numerous alternative targets. They are also more difficult to migrate and business critical, so organizations often adopt a slower migration process for Exchange than for AD and do not specifically harden the servers.

Exchange deployment on an Active Directory domain is an interesting case. Many attributes and classes are added to the schema, security groups are created and DACL on some AD objects are heavily modified.

Basically, you can select among 3 permissions models:

  • RBAC Split (recommended and most commonly deployed)
  • Shared permissions (default)
  • AD Split

Particularly, DACLs for RBAC Split and Shared models are enumerated here: .

High value targets:

  • Exchange Trusted Subsystem and Exchange Windows Permissions groups, which are trustees for many ACE added during deployment on AD objects.
  • Exchange servers: they are members of Exchange Trusted Subsystem and Exchange Windows Permissions groups. They can be compromised using many more techniques than domain controllers: local administrators domain accounts, Kerberos delegation, SMB relay, RODC replication, etc. The usual stuff.
  • Organization admins: they are part of the local administrators group on Exchange servers. They also have full control on the OU containing the Exchange security groups. They can launch service/psexec/runas/... under computer identity/NetworkService/LocalSystem to control Exchange Trusted Subsystem and Exchange Windows Permissions SIDs.

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.