Exchange Push Notification Privilege Escalation

PrivExchange abuses an Exchange Web Services (EWS) push-subscription callback to make an Exchange server initiate outbound NTLM authentication. An attacker with a mailbox-enabled domain account can relay that authentication to a domain controller's LDAP service; where the Exchange computer account has effective domain-object WriteDACL rights and relay protections do not block the path, Impacket can grant DCSync replication rights to a controlled account. Those rights enable directory credential replication but do not, by themselves, make that account a Domain Admin. Exchange updates, Extended Protection, LDAP signing or channel binding, and the relevant Active Directory permissions determine whether the chain works.