proxyshell

ProxyShell Microsoft Exchange CVE-2021-34473、CVE-2021-34523、CVE-2021-31207 の概念実証エクスプロイト 詳細 背景情報とコンテキストについては、Horizon3 による調査の詳細を記したブログ記事をお読みください： https://www.horizon3.ai/news/blog/proxyshell 特長 メールアドレスを指定する必要はありません Active Directory からメールアドレスを列挙しようとします Active Directory から LegacyDN を列挙しようとします 組み込みメール...

ProxyVulns

ProxyVulns ProxyLogon Usage: python3 26855.py 1.1.1.1 ProxyOracle root@kitploit: Once a victim clicks this link, evil.com will receive the cookies...

CVE-2021-34473

CVE-2021-34473 CVE-2021-34473 Microsoft Exchange Server リモートコード実行の脆弱性 ProxyShellエクスプロイトの再現 https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/ これはサイバー兵器ではなく、実験的なPoCです...

CVE-2021-34473-Exchange-ProxyShell

python sendwebshellmail.py https://mail16.echod.com [email protected] Single retrieval python sendwebshellmail.py https://mail16.echod.com crack Batch read emails from mail.txt and attempt to obtain SID tokens python sendwebshellmail.py https://mail16.echod.com [email protected] send on...

Proxyshell-Scanner

Proxyshell-Scanner escáner nuclei para Proxyshell RCE CVE-2021-34423,CVE-2021-34473,CVE-2021-31207 descubierto por orange tsai en Pwn2Own, que afecta al servidor microsoft exchange. POC Recursos https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html...

CVE-2021-34473-scanner

CVE-2021-34473-scanner CVE-2021-34473、ProxyShell、Microsoft Exchange オンプレミスの脆弱性のスキャナー マシンを1台ずつテストするには、scanner-CVE-2021-34473.bat を使用します: scanner-CVE-2021-34473.bat mail.exemple.fr 複数のマシンを一度にテストするには、mass-scanner を使用し、サーバーを1行ずつ servers-to-check.txt に追加してチェックします: mass-scanner-CVE-2021-34473.bat...

ProxyShell

ProxyShell インストール root@kitploit: git clone https://github.com/ktecv2000/ProxyShell cd ProxyShell virtualenv -p $which python3 venv source venv/bin/activate pip3 install pypsrp cp wsman.py venv/lib//site-packages/pypsrp/wsman.py 使用方法 root@kitploit: python3 exploit.py...

ProxyShell_POC

ProxyShellPOC ProxyShellCVE-2021-34523,CVE-2021-34473,CVE-2021-31207 をスキャンするためのPoC 使用方法: python3 Proxyshell.py ip...

ProxyNotShell-PoC

CVE-2022-41040 与 CVE-2022-41082 的可用的 PoC（又称 ProxyNotShell） 要求： pip install requestsntlm2 requests 用法： root@kitploit: python pocaug3.py 致谢： ProxyShell PoC 脚本来自：https://blog.viettelcybersecurity.com/pwn2own-2021-microsoft-exchange-exploit-chain/ Gtsc 的博客文章...

ProxyShell-CVE-2021-34473.py

ProxyShell-CVE-2021-34473 一个用于检测 ProxyShell 的简单脚本...

CTT-Exchange-RCE-v1.0---Microsoft-Exchange-Exploit-CVSS-10.0-CRITICAL-CVE-2021-26855-CVE-2021-27065

CTT-Exchange-RCE-v1.0---Microsoft-Exchange-Exploit-CVSS-10.0-CRITICAL-CVE-2021-26855-CVE-2021-27065 CTT增强版的Microsoft Exchange Server SSRF到RCE漏洞利用（ProxyShell/ProxyLogon），另一个CVSS 10.0关键漏洞，影响了全球数十万个组织。 🏢 CTT Exchange RCE 漏洞利用 v1.0 基于收敛时间理论（CTT）增强的Microsoft Exchange Server漏洞利用框架 🚨 概述 CTT-Exchange-RCE...

Exploit for Unrestricted Upload of File with Dangerous Type in Microsoft

ProxyHell Modernized ProxyShell Exploit CVE-20...

ProxyVulns

ProxyVulns ProxyLogon Usage: python3 26855.py 1.1.1.1 ProxyOracle url Once a victim clicks this link, evil.com will receive the cookies...

BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks

The BlackByte ransomware group continues to leverage tactics, techniques and procedures TTPs that have formed the foundation of its tradecraft since its inception, continuously iterating its use of vulnerable drivers to bypass security protections and deploying a self-propagating, wormable...

MS Exchange Server Flaws Exploited to Deploy Keylogger in Targeted Attacks

An unknown threat actor is exploiting known security flaws in Microsoft Exchange Server to deploy a keylogger malware in attacks targeting entities in Africa and the Middle East. Russian cybersecurity firm Positive Technologies said it identified over 30 victims spanning government agencies, bank...

Free Decryptor Released for Black Basta and Babuk's Tortilla Ransomware Victims

A decryptor for the Tortilla variant of the Babuk ransomware has been released by Cisco Talos, allowing victims targeted by the malware to regain access to their files. The cybersecurity firm said the threat intelligence it shared with Dutch law enforcement authorities made it possible to arrest...

Major Cybersecurity Agencies Collaborate to Unveil 2022's Most Exploited Vulnerabilities

A four-year-old critical security flaw impacting Fortinet FortiOS SSL has emerged as one of the most routinely and frequently exploited vulnerabilities in 2022. "In 2022, malicious cyber actors exploited older software vulnerabilities more frequently than recently disclosed vulnerabilities and...

The five-day job: A BlackByte ransomware intrusion case study

As ransomware attacks continue to grow in number and sophistication, threat actors can quickly impact business operations if organizations are not well prepared. In a recent investigation by Microsoft Incident Response previously known as Microsoft Detection and Response Team – DART of an...

Microsoft Urges Customers to Secure On-Premises Exchange Servers

Microsoft is urging customers to keep their Exchange servers updated as well as take steps to bolster the environment, such as enabling Windows Extended Protection and configuring certificate-based signing of PowerShell serialization payloads. "Attackers looking to exploit unpatched Exchange...

FIN7 Cybercrime Syndicate Emerges as a Major Player in Ransomware Landscape

An exhaustive analysis of FIN7 has unmasked the cybercrime syndicate's organizational hierarchy, alongside unraveling its role as an affiliate for mounting ransomware attacks. It has also exposed deeper associations between the group and the larger threat ecosystem comprising the now-defunct...