Thread by @_wald0

1/n - Here's how #BloodHound can help you determine whether you are vulnerable to PrivExchange by @_dirkjan:

Find the domain head object in the BloodHound GUI, click the number next to "First Degree Controllers". See whether an Exchange security group is present:

2/n - Unroll this view by clicking the number next to "Unrolled Controllers" to see the real number of users and computers with control of the domain head

3/n - "WriteDacl" on the domain head is extremely dangerous, as @_dirkjan outlined in his blog, but Exchange servers often have way, WAY more privileges than this. Click an Exchange server and see the real count of domain objects it has control of

4/n Don't forget you can also relay NTLM authentication to SMB on systems the Exchange Server has admin rights on. This is typically every other Exchange server, but we have seen Exchange Servers with WAY more local admin privilege than that, too.

5/5 - #BloodHound is FREE and open source:

Get BloodHound: github.com/BloodHoundAD/B…
Join the BloodHound Slack: bloodhoundgang.herokuapp.com