NtlmRelayToEWS

ntlmRelayToEWS Author: Arno0x0x - @Arno0x0x ntlmRelayToEWS is a tool for performing ntlm relay attacks on Exchange Web Services EWS. It spawns an SMBListener on port 445 and an HTTPListener on port 80, waiting for incoming connection from the victim. Once the victim connects to one of the...

ProxyShell

ProxyShell Install git clone https://github.com/ktecv2000/ProxyShell cd ProxyShell virtualenv -p $which python3 venv source venv/bin/activate pip3 install pypsrp cp wsman.py venv/lib//site-packages/pypsrp/wsman.py Usage python3 exploit.py...

U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks

The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM. The reward is for information leading to h...

CVE-2021-26855

CVE-2021-26855-PoC PoC exploit code for CVE-2021-26855. Original code was developed by https://github.com/GreyOrder. The original repo was deleted shortly after additional features user enumeration etc. were added. Please post a pull request, if you have the latest version. CVE-2021-26855 ssrf...

CVE-2021-26855_PoC

CVE-2021-26855PoC My early SSRF payloads CVE-2021-26855 over Exchange Server 2019... Payload 1 curl -i -s -k -X $'GET' -H $'Host: ' -H $'User-Agent: alex666' -H $'Connection: close' -b $'X-AnonResource=true;...

Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting

Microsoft Exchange Server is vulnerable to a spoofing vulnerability. Be aware this CVE ID is unique from CVE-2021-42305. id: CVE-2021-41349 info: name: Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting author: rootxharsh,iamnoooob severity: medium description: Microsoft Exchange...

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28481 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

Microsoft OWA Exchange Server 2003 - 'redir.asp' Open Redirection

Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access OWA for Exchange Server 2003 SP2 aka build 6.5.7638 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter. id: CVE-2008-1547 info: name:...

CVE-2021-26855

CVE-2021-26855 CVE-2021-26855 SSRF simple exploitation golang practice Affected Versions Exchange Server 2013 earlier than CU23 Exchange Server 2016 earlier than CU18 Exchange Server 2019 earlier than CU7 Exploitation Conditions This vulnerability is different from previous Exchange...

CVE-2022-41040

CVE-2022-41040 CVE-2022-41040 nuclei template Unverified! Usage git clone https://github.com/numanturle/CVE-2022-41040 cd CVE-2022-41040 nuclei -u https://target -t owa.yaml GET /autodiscover/[email protected]/BACKENDAPI?&Email=autodiscover/autodiscover.json%[email protected] HTTP/1.1...

ProxyLogon

ProxyLogon ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability,...

PSForgot2kEyXCHANGE

PSForgot2kEyXCHANGE PoC for Forgot2kEyXCHANGE CVE-2020-0688 written in PowerShell Usage This PoC requires a valid Username and Password. This PoC uses ysoserial.net to create the new ViewState which contains the command you specified on the -Command param. If you don't already have this installed...

CVE-2021-34473

CVE-2021-34473 CVE-2021-34473 Microsoft Exchange Server Remote Code Execution Vulnerability Reproducing ProxyShell Exploit https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/ This is NOT your Cyberweapon just a experimental PoC...

ProxyLogon

ProxyLogon ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability,...

ProxyShell

ProxyShell CVE-2021-34473 CVE-2021-34473 Microsoft Exchange Server Remote Code Execution Vulnerability. This faulty URL normalization lets us access an arbitrary backend URL while running as the Exchange Server machine account. Although this bug is not as powerful as the SSRF in ProxyLogon, and w...

CVE-2020-0688

CVE-2020-0688 A remote code execution vulnerability exists in Microsoft Exchange Server when the server fails to properly create unique keys at install time. Knowledge of a the validation key allows an authenticated user with a mailbox to pass arbitrary objects to be deserialized by the web...

Exch-CVE-2021-26855_Priv

Exch-CVE-2021-26855 ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability...

CVE-2018-8581

CVE-2018-8581 This is a lateral movement and privilege escalation vulnerability at the mailbox level Once you have the credentials of an ordinary mailbox account, it allows you to delegate and take over the inboxes of other users including domain administrators This EXP script is an enhanced...

ruler

Introduction Ruler is a tool that allows you to interact with Exchange servers remotely, through either the MAPI/HTTP or RPC/HTTP protocol. The main aim is abuse the client-side Outlook features and gain a shell remotely. The full low-down on how Ruler was implemented and some background regardin...

CVE-2020-0688-Scanner

CVE-2020-0688-Scanner This script scans an IP/range/CIDR and outputs the Microsoft Exchange Servers and Versions discovered. The specified IP/range/CIDR will be scanned with masscan on port tcp/443. After a successful scan it tries to HTTP GET "/owa/auth/logon.aspx" with curl to grab the Outlook...