PrivExchange

PrivExchange is a Python proof of concept that authenticates to Exchange Web Services with a mailbox user's credentials and requests a push subscription whose HTTP callback can cause Exchange to initiate NTLM authentication. The script triggers that authentication; it does not perform the NTLM relay or DCSync itself. Privilege escalation depends on a separate relay path and vulnerable Exchange/Active Directory permissions. Microsoft's 2019 Exchange updates changed push-notification authentication and reduced default Exchange permissions.