CVE-2022-41040-POC

CVE-2022-41040-POC CVE-2022-41040 - Microsoft Exchange Server 中的服务器端请求伪造 SSRF 手动利用 1. 将 COLLABHERE 替换为你的 OOB 域名 - sed 's/COLLABHERE//g 2. 在你想要测试的 URL 后面添加 payload - echo http://target.com|unfurl format %s://%d/ 3. 访问构造好的 URL 4. 检查你的 collaborator Payloads:...

CVE-2022-41040

CVE-2022-41040 CVE-2022-41040 nuclei 模板 未经验证！ 用法 git clone https://github.com/numanturle/CVE-2022-41040 cd CVE-2022-41040 nuclei -u https://target -t owa.yaml GET /autodiscover/[email protected]/BACKENDAPI?&Email=autodiscover/autodiscover.json%[email protected] HTTP/1.1 Host: mail.xxx...

o365enum

Office 365 用户枚举 使用 ActiveSync、Autodiscover 或 office.com 登录页面枚举 Office 365 中的有效用户名。 使用方法 o365enum 将从作为第一个参数提供的文件中读取用户名。文件每行应包含一个用户名。输出采用 CSV 格式，便于解析。有效状态可以是 0（无效用户）、1（有效用户）、2（有效用户且密码有效）。 python3.6 o365enum.py -h usage: o365enum.py -h -u USERLIST -p PASSWORD -n NUM -v -m...

o365enum

Office 365 User Enumeration Enumerate valid usernames from Office 365 using ActiveSync, Autodiscover, or office.com login page. Usage o365enum will read usernames from the file provided as first parameter. The file should have one username per line. The output is CSV-based for easier parsing. Val...

CVE-2022-41080

CVE-2022-41080 描述 CrowdStrike最近发现了一种新的利用方法（称为OWASSRF），包含CVE-2022-41080和CVE-2022-41082，通过Outlook Web Access（OWA）实现远程代码执行（RCE）。这种新方法绕过了微软为响应ProxyNotShell而提供的Autodiscover端点的URL重写缓解措施。 这一发现是近期CrowdStrike Services对多起Play勒索软件入侵事件调查的一部分，确认常见入口向量为Microsoft Exchange。...

ruler

Introduction Ruler is a tool that allows you to interact with Exchange servers remotely, through either the MAPI/HTTP or RPC/HTTP protocol. The main aim is abuse the client-side Outlook features and gain a shell remotely. The full low-down on how Ruler was implemented and some background regardin...

UhOh365

UhOh365 一个可以检查电子邮件地址在Office365中是否有效的脚本。此脚本不进行任何登录尝试，未受速率限制，对于社会工程学评估中查找哪些电子邮件存在、哪些不存在非常有用。 微软并不认为“电子邮件枚举”是一个漏洞，因此这利用了“特性”。还有其他几个公开的Office365电子邮件验证脚本，但据我所见，它们每个用户帐户至少需要1次登录尝试。这是可检测的 ，并且可能被视为轻量级暴力破解尝试（对多个帐户使用一个“常见”密码）。 此脚本允许零登录尝试 的电子邮件验证，仅使用微软内置的Autodiscover...

CVE-2022-41040

CVE-2022-41040 Microsoft Exchange 存在服务端请求伪造漏洞 Payload : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHERE...

exchange-scanner

Microsoft Exchange Server 扫描器 描述 该工具扫描目标主机上多个常见的公开服务，以检测 Microsoft Exchange Server，并尽可能对其软件版本进行指纹识别。 为此，它使用以下技术： 通过响应头、登录页面内容和 favicon 哈希，对 Outlook Web Access OWA 进行指纹识别 通过 XML 响应，对 Exchange 控制面板 ECP 导出工具进行指纹识别 通过响应头对 Autodiscover 端点进行指纹识别 通过服务横幅，对常见端口上的 SMTP、IMAP 和 POP3 服务进行服务指纹识别 检测到的内部版本号会与从...

cve-2021-26855

cve-2021-26855 GET /ecp/x.png HTTP/1.1 Host: 192.168.170.134 Cookie: X-BEResource=localhost1942062522 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:109.0 Gecko/20100101 Firefox/110.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8...

"Warning: Exchange account was not found"

Challenge When backing up Exchange Online mailboxes, Veeam Backup for Microsoft 365 intermittently fails to discover and process some mailboxes, reporting the following warning: Warning: Exchange account was not found The affected mailboxes vary between job runs, and in some cases, only a small...

CVE-2026-40872

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value logged as the "user" field without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted...

CVE-2026-40872

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value logged as the "user" field without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted...

CVE-2026-40872 mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value logged as the "user" field without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted...

CVE-2026-40872 mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value logged as the "user" field without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted...

CVE-2026-40872 mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value logged as the "user" field without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted...

CVE-2026-40872

Affected product/variant: mailcow: dockerized (open source groupware/email suite). Issue: Stored XSS in Autodiscover logs via unescaped EMailAddress. Root cause (per description): Admin dashboard Autodiscover logs render the EMailAddress value (logged as the “user” field) without HTML escaping, e...

EUVD-2026-24254

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value logged as the "user" field without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted...

PT-2026-34053

Name of the Vulnerable Software and Affected Versions mailcow: dockerized versions prior to 2026-03b Description The admin dashboard Autodiscover logs fail to perform HTML escaping on the EMailAddress value, which is logged as the user field. An unauthenticated attacker can submit a crafted...

CVE-2026-40872: Improper Neutralization of Input During Web Page Generation

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value logged as the "user" field without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted...