ProxyShell

ProxyShell 安装 root@kitploit: git clone https://github.com/ktecv2000/ProxyShell cd ProxyShell virtualenv -p $which python3 venv source venv/bin/activate pip3 install pypsrp cp wsman.py venv/lib//site-packages/pypsrp/wsman.py 用法 root@kitploit: python3 exploit.py...

proxyshell

ProxyShell Exploit de prueba de concepto para Microsoft Exchange CVE-2021-34473, CVE-2021-34523, CVE-2021-31207 Detalles Para obtener información de contexto, lea la publicación del blog que detalla la investigación de Horizon3: https://www.horizon3.ai/news/blog/proxyshell Características No es...

CVE-2021-34473

CVE-2021-34473 CVE-2021-34473 Vulnerabilidad de ejecución remota de código en Microsoft Exchange Server Reproduciendo el exploit ProxyShell https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/ Esta NO es tu ciberarma, solo es un PoC experimental...

CVE-2021-34473-Exchange-ProxyShell

python sendwebshellmail.py https://mail16.echod.com [email protected] 单个获取 python sendwebshellmail.py https://mail16.echod.com crack 批量从mail.txt 读取邮件，进行尝试获取SID token python sendwebshellmail.py https://mail16.echod.com [email protected] send 只发送webshell 草稿邮件 python sendwebshellmail.py...

ProxyVulns

ProxyVulns ProxyLogon Usage: python3 26855.py 1.1.1.1 ProxyOracle root@kitploit: Once a victim clicks this link, evil.com will receive the cookies...

CVE-2021-34473-scanner

CVE-2021-34473-scanner 扫描器用于CVE-2021-34473, ProxyShell, 微软Exchange本地部署漏洞 要逐台测试机器，请使用 scanner-CVE-2021-34473.bat： scanner-CVE-2021-34473.bat mail.exemple.fr 要同时测试多台机器，请使用 mass-scanner 并将要检查的IP/FQDN逐行添加到 servers-to-check.txt 中： mass-scanner-CVE-2021-34473.bat 根据Exchange版本的修补措施： Exchange 2019 CU10 下...

Proxyshell-Scanner

Proxyshell-Scanner escáner nuclei para Proxyshell RCE CVE-2021-34423,CVE-2021-34473,CVE-2021-31207 descubierto por orange tsai en Pwn2Own, que afecta al servidor microsoft exchange. POC Recursos https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html...

ProxyShell-CVE-2021-34473.py

ProxyShell-CVE-2021-34473 Un script sencillo para comprobar ProxyShell...

CTT-Exchange-RCE-v1.0---Microsoft-Exchange-Exploit-CVSS-10.0-CRITICAL-CVE-2021-26855-CVE-2021-27065

CTT-Exchange-RCE-v1.0---Microsoft-Exchange-Exploit-CVSS-10.0-CRITICAL-CVE-2021-26855-CVE-2021-27065 Versión mejorada por CTT del exploit SSRF a RCE de Microsoft Exchange Server ProxyShell/ProxyLogon, otra vulnerabilidad crítica con CVSS 10.0 que afectó a cientos de miles de organizaciones en todo...

ProxyShell_POC

ProxyShellPOC POC para escanear ProxyShellCVE-2021-34523,CVE-2021-34473,CVE-2021-31207 uso: python3 Proxyshell.py ip...

ProxyNotShell-PoC

PoC funcional para CVE-2022-41040 y CVE-2022-41082 también conocido como ProxyNotShell Requisitos: pip install requestsntlm2 requests Uso: root@kitploit: python pocaug3.py Credenciales: Script PoC de ProxyShell de: https://blog.viettelcybersecurity.com/pwn2own-2021-microsoft-exchange-exploit-chai...

Exploit for Unrestricted Upload of File with Dangerous Type in Microsoft

ProxyHell Modernized ProxyShell Exploit CVE-20...

ProxyVulns

ProxyVulns ProxyLogon Usage: python3 26855.py 1.1.1.1 ProxyOracle url Once a victim clicks this link, evil.com will receive the cookies...

BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks

The BlackByte ransomware group continues to leverage tactics, techniques and procedures TTPs that have formed the foundation of its tradecraft since its inception, continuously iterating its use of vulnerable drivers to bypass security protections and deploying a self-propagating, wormable...

MS Exchange Server Flaws Exploited to Deploy Keylogger in Targeted Attacks

An unknown threat actor is exploiting known security flaws in Microsoft Exchange Server to deploy a keylogger malware in attacks targeting entities in Africa and the Middle East. Russian cybersecurity firm Positive Technologies said it identified over 30 victims spanning government agencies, bank...

Free Decryptor Released for Black Basta and Babuk's Tortilla Ransomware Victims

A decryptor for the Tortilla variant of the Babuk ransomware has been released by Cisco Talos, allowing victims targeted by the malware to regain access to their files. The cybersecurity firm said the threat intelligence it shared with Dutch law enforcement authorities made it possible to arrest...

Major Cybersecurity Agencies Collaborate to Unveil 2022's Most Exploited Vulnerabilities

A four-year-old critical security flaw impacting Fortinet FortiOS SSL has emerged as one of the most routinely and frequently exploited vulnerabilities in 2022. "In 2022, malicious cyber actors exploited older software vulnerabilities more frequently than recently disclosed vulnerabilities and...

The five-day job: A BlackByte ransomware intrusion case study

As ransomware attacks continue to grow in number and sophistication, threat actors can quickly impact business operations if organizations are not well prepared. In a recent investigation by Microsoft Incident Response previously known as Microsoft Detection and Response Team – DART of an...

Microsoft Urges Customers to Secure On-Premises Exchange Servers

Microsoft is urging customers to keep their Exchange servers updated as well as take steps to bolster the environment, such as enabling Windows Extended Protection and configuring certificate-based signing of PowerShell serialization payloads. "Attackers looking to exploit unpatched Exchange...

FIN7 Cybercrime Syndicate Emerges as a Major Player in Ransomware Landscape

An exhaustive analysis of FIN7 has unmasked the cybercrime syndicate's organizational hierarchy, alongside unraveling its role as an affiliate for mounting ransomware attacks. It has also exposed deeper associations between the group and the larger threat ecosystem comprising the now-defunct...