In most organisations using Active Directory and Exchange  Exchange servers have such high privileges that being an Administrator on an Exchange server is enough to escalate to Domain Admin Recently I came across a blog from the ZDI  in which they detail a way to let Exchange authenticate to attackers using NTLM over HTTP