NotProxyShellScanner

NotProxyShellScanner NotProxyShell（又名 CVE-2022-40140 与 CVE-2022-41082）的 Python 实现。 设置 安装依赖，只需要 python3 和 requests 库。 root@kitploit: pip3 install -r requirements.txt 运行 运行工具有几种选项： root@kitploit: usage: NotProxyShell.py -h -u TARGETHOST -f TARGETHOSTFILE -e EMAIL -d TARGETDOMAIN optional arguments:...

nse-exchange

nse-exchange Nmap NSE 脚本，用于检测 Exchange 漏洞（CVE-2022-41082）。 NSE 脚本检查互联网上最常暴露的服务。这是一个基础脚本，用于检查虚拟补丁是否有效。 示例 由于目前尚无补丁——仅检查了主机是否存在可用的临时解决方法。 简单示例： root@kitploit: nmap -sV -T4 -v --script=http-vuln-cve-2022 scanme.nmap.org 更快速的扫描（大型子网）： root@kitploit: nmap -p443 -T4 -v --script=http-vuln-cve-2022...

LetsDefend-CVE-2022-41082-Exploitation-Attempt

LetsDefend-CVE-2022-41082-利用尝试 🛡️ 事件报告：CVE-2022-41082 利用尝试 📅 日期：2022年9月30日 🕒 时间：上午07:19 🚨 严重性：高 🆔 事件ID：125 📊 详细信息 关键属性| 值 ---|--- 事件ID| 125 事件时间| 2022年9月30日 上午07:19 规则| SOC175 - 请求URL中发现PowerShell 级别| 安全分析师 主机名| Exchange Server 2 目标IP地址| 172.16.20.8 日志来源| IIS 源IP地址| 58.237.200.6 请求URL|...

proxynotshell-IOC-Checker

proxynotshell-IOC-Checker 用于检查 CVE-2022-41040 和 CVE-2022-41082 的 IOC（入侵指标）的 Powershell 脚本，基于社区研究和 Microsoft： GTESC The Sec Master Double Puslar Microsoft Security Resource Center Microsoft Security Blog 随着更多信息的公开，该脚本可能会更新，以包含更多的 IOC。 ⬇️ 下载 root@kitploit: git clone...

vuln-CVE-2022-41082

漏洞-CVE-2022-41082 https 和 http 对于 HTTP： nmap -p80 --script exchange-vuln-check.nse 对于 HTTPS： nmap -p443 --script exchange-vuln-check.nse 将结果保存到文件 nmap -p80 --script exchange-vuln-check.nse -oN results.txt...

NotProxyShellHunter

NotProxyShellHunter 检测 NotProxyShell CVE-2022-40140 & CVE-2022-41082...

http-vuln-CVE-2022-41082

更新后的版本同样支持 HTTPS 检查 exchange-vuln-check.nse 针对 HTTP: nmap -p80 --script exchange-vuln-check.nse 针对 HTTPS: nmap -p443 --script exchange-vuln-check.nse 将结果保存到文件 nmap -p80 --script exchange-vuln-check.nse -oN results.txt http-vuln-CVE-2022-41082 Microsoft Exchange Server 远程代码执行漏洞。 nmap -p --script...

CVE-2022-41082

This repository does not have a README...

Exploit for Deserialization of Untrusted Data in Microsoft

LetsDefend-CVE-2022-41082-Exploitation-Attempt 🛡️ Incident...

Exploit for Deserialization of Untrusted Data in Microsoft

CVE-2022-41082-POC PoC for the CVE-2022-41082 NotProxyShell OW...

Ransomware Hackers Using New Way to Bypass MS Exchange ProxyNotShell Mitigations

Threat actors affiliated with a ransomware strain known as Play are leveraging a never-before-seen exploit chain that bypasses blocking rules for ProxyNotShell flaws in Microsoft Exchange Server to achieve remote code execution RCE through Outlook Web Access OWA. "The new exploit method bypasses...

VulnCheck KEV: CVE-2022-41080

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution...

Metasploit Weekly Wrap-Up

ProxyNotShell This week's Metasploit release includes an exploit module for CVE-2022-41082, AKA ProxyNotShell by DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q, Orange Tsai, Piotr Bazydło, Rich Warren, Soroush Dalili, and our very own Spencer McIntyre. The vulnerability CVE-2022-41082, AKA ProxyNotShell is a...

Microsoft Exchange ProxyNotShell Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft Exchange ProxyNotShell RCE', 'Description' = %q This module chains two vulnerabilities on Microsoft Exchange Server that, when combined...

The Bug Report October 2022 Edition

The Bug Report — October 2022 Edition By Trellix · November 2, 2022 This story was written by Richard Johnson. Do ROP exploits count as jmp scares? Why am I here? Welcome back to the Bug Report: Spooky Edition, and we’ve got bugs crawling out of the walls! Of all the months we do this, we’ve foun...

Two Weeks of Monitoring ProxyNotShell (CVE-2022-41040 & CVE-2022-41082) Threat Activity

The Wordfence Threat Intelligence team has been monitoring exploit attempts targeting two zero-day vulnerabilities in Microsoft Exchange Server tracked as CVE-2022-41040 and CVE-2022-41082, collectively known as ProxyNotShell. These vulnerabilities are actively being exploited in the wild. At the...

Patch Tuesday - October 2022

The October batch of CVEs published by Microsoft includes 96 vulnerabilities, including 12 fixed earlier this month that affect the Chromium project used by their Edge browser. Top of mind for many this month is whether Microsoft would patch the two Exchange Server zero-day vulnerabilities...

Microsoft Issues Improved Mitigations for Unpatched Exchange Server Vulnerabilities

Microsoft on Friday disclosed it has made more improvements to the mitigation method offered as a means to prevent exploitation attempts against the newly disclosed unpatched security flaws in Exchange Server. To that end, the tech giant has revised the blocking rule in IIS Manager from...

Microsoft Exchange Server October 2022 Zero-day Vulnerabilities (ProxyNotShell)

The Microsoft Exchange Server installed on the remote host is potentially affected by multiple zero-day vulnerabilities, dubbed ProxyNotShell: - An unspecified authenticated server-side request forgery SSRF vulnerability. CVE-2022-41040 - An unspecified authenticated remote code execution RCE...

Akamai’s Response to Zero-Day Vulnerabilities in Microsoft Exchange Server (CVE-2022-41040 and CVE-2022-41082)

Akamai Security Research has released web application firewall protections for Microsoft Exchange CVE-2022-41040 and CVE-2022-41082...