ProxyLogon

ProxyLogon ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability,...

CVE-2021-26855

CVE-2021-26855-PoC PoC exploit code for CVE-2021-26855. Original code was developed by https://github.com/GreyOrder. The original repo was deleted shortly after additional features user enumeration etc. were added. Please post a pull request, if you have the latest version. CVE-2021-26855 ssrf...

Proxyshell-Scanner

Proxyshell-Scanner nuclei scanner for Proxyshell RCE CVE-2021-34423,CVE-2021-34473,CVE-2021-31207 discovered by orange tsai in Pwn2Own, which affect microsoft exchange server. POC Resource https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html...

ruler

Introduction Ruler is a tool that allows you to interact with Exchange servers remotely, through either the MAPI/HTTP or RPC/HTTP protocol. The main aim is abuse the client-side Outlook features and gain a shell remotely. The full low-down on how Ruler was implemented and some background regardin...

ProxyLogon

ProxyLogon ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability,...

NtlmRelayToEWS

ntlmRelayToEWS Author: Arno0x0x - @Arno0x0x ntlmRelayToEWS is a tool for performing ntlm relay attacks on Exchange Web Services EWS. It spawns an SMBListener on port 445 and an HTTPListener on port 80, waiting for incoming connection from the victim. Once the victim connects to one of the...

ProxyShell

ProxyShell Install root@kitploit: git clone https://github.com/ktecv2000/ProxyShell cd ProxyShell virtualenv -p $which python3 venv source venv/bin/activate pip3 install pypsrp cp wsman.py venv/lib//site-packages/pypsrp/wsman.py Usage root@kitploit: python3 exploit.py...

CVE-2020-0688-Scanner

CVE-2020-0688-Scanner This script scans an IP/range/CIDR and outputs the Microsoft Exchange Servers and Versions discovered. The specified IP/range/CIDR will be scanned with masscan on port tcp/443. After a successful scan it tries to HTTP GET "/owa/auth/logon.aspx" with curl to grab the Outlook...

CVE-2018-8581

CVE-2018-8581 This is a lateral movement and privilege escalation vulnerability at the mailbox level. It can be used to delegate and take over the inbox of other users including domain administrators after obtaining the credentials of a regular mailbox account. This EXP script is an enhanced...

PSForgot2kEyXCHANGE

PSForgot2kEyXCHANGE Forgot2kEyXCHANGE CVE-2020-0688 の PoC（概念実証）を PowerShell で記述 使用方法 この PoC は有効なユーザー名とパスワードを必要とします。 この PoC は ysoserial.net を使用して、-Command パラメーターで指定したコマンドを含む新しい ViewState を作成します。 このツールがシステムにインストールされていない場合は、こちら からダウンロードしてください。 root@kitploit: PS . .\PSForgot2kEyXCHANGE.ps1 PS...

CVE-2021-26855

CVE-2021-26855 CVE-2021-26855 SSRF simple exploitation golang practice Affected Versions Exchange Server 2013 earlier than CU23 Exchange Server 2016 earlier than CU18 Exchange Server 2019 earlier than CU7 Exploitation Conditions This vulnerability is different from previous Exchange...

CVE-2022-41040

CVE-2022-41040 CVE-2022-41040 nuclei テンプレート 未検証！ 使い方 root@kitploit: git clone https://github.com/numanturle/CVE-2022-41040 cd CVE-2022-41040 nuclei -u https://target -t owa.yaml root@kitploit: GET...

Exch-CVE-2021-26855_Priv

Exch-CVE-2021-26855 ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability...

CVE-2021-26855_PoC

CVE-2021-26855PoC My early SSRF payloads CVE-2021-26855 over Exchange Server 2019... Payload 1 root@kitploit: curl -i -s -k -X $'GET' -H $'Host: ' -H $'User-Agent: alex666' -H $'Connection: close' -b $'X-AnonResource=true;...

Microsoft_Exchange_Server_SSRF_CVE-2021-26855

MicrosoftExchangeServerSSRFCVE-2021-26855 zoomeye dork: app:"Microsoft Exchange Server" Seebugツールボックスとpocsuite3を使用して作成されたスクリプトMicrosoftExchangeServerSSRFCVE-2021-26855.pyを使用し、過去約1年間のデータをスキャンしました： 成功率は約：1500 / 5000 = 30%...

CVE-2021-34473

CVE-2021-34473 CVE-2021-34473 Microsoft Exchange Server リモートコード実行の脆弱性 ProxyShellエクスプロイトの再現 https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/ これはサイバー兵器ではなく、実験的なPoCです...

ProxyShell

ProxyShell CVE-2021-34473 CVE-2021-34473 Microsoft Exchange Server Remote Code Execution Vulnerability. This faulty URL normalization lets us access an arbitrary backend URL while running as the Exchange Server machine account. Although this bug is not as powerful as the SSRF in ProxyLogon, and w...

ProxyLogon

ProxyLogon 用 Python3 ProxyLogonCVE-2021-26855+CVE-2021-27065 Exchange Server RCESSRF-GetWebShell root@kitploit: usage: python ProxyLogon.py --host=exchange.com [email protected] python ProxyLogon.py --host=exchange.com --mails=./mails.txt args: --host: target's address. --mail: exists user's...

CVE-2018-8581

CVE-2018-8581 これはメールレベルの横方向移動および権限昇格の脆弱性です。 通常のメールアカウントのパスワードを入手した後、他のユーザー（ドメイン管理者を含む）のメールボックス受信トレイを委任により乗っ取ることができます。 本エクスプロイトスクリプトは、元のPoCをベースに改良した強化版ワンクリックスクリプトです。関連パラメータを設定後、自動的にターゲットメールボックスの受信トレイに対する委任追加および削除操作を実行し、セキュリティ部門やレッドチームが許可された企業に対して模擬攻撃プロセスを完了できるようにします。...

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...