Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2022-41040-metasploit-ProxyNotShell — the metasploit script(POC) about CVE-2022-41040. Microsoft Exchange are vulnerable to a server-side request forgery (SSRF) attack. An authenticated attacker can use the vulnerability to elevate privileges. | Kitploit
Tools/GitHubGitHub/taroballzchen/cve-2022-41040-metasploit-proxynotshell
Privilege EscalationExploit FrameworksVulnerability AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHubtaroballzchen/cve-2022-41040-metasploit-proxynotshell

CVE-2022-41040-metasploit-ProxyNotShell

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

the metasploit script(POC) about CVE-2022-41040. Microsoft Exchange are vulnerable to a server-side request forgery (SSRF) attack. An authenticated attacker can use the vulnerability to elevate privileges.

View Repository
351463 years agoReviewed by Kitploit

CVE-2022-41040-metasploit-ProxyNotShell

the metasploit script(POC) about CVE-2022-41040. Microsoft Exchange are vulnerable to a server-side request forgery (SSRF) attack. An authenticated attacker can use the vulnerability to elevate privileges.

preparation POC

git clone https://github.com/TaroballzChen/CVE-2022-41040-metasploit-ProxyNotShell
cd CVE-2022-41040-metasploit-ProxyNotShell
mkdir -p ~/.msf4/modules/auxiliary/scanner/http
cp microsoft_exchange_server_proxynotshell_ssrf.py ~/.msf4/modules/auxiliary/scanner/http/
chmod +x ~/.msf4/modules/auxiliary/scanner/http/microsoft_exchange_server_proxynotshell_ssrf.py
msfconsole

POC usage

set rhosts <vuln ip/host>
set rport <vuln port>
set rssl <default: true for https>
exploit

result

poc

reference

  • https://www.kb.cert.org/vuls/id/915563
  • https://github.com/Vulnmachines/proxynotshell-checker
  • https://github.com/kljunowsky/CVE-2022-41040-POC
  • https://github.com/zan8in/afrog
  • https://github.com/Ph33rr/Exploit
Download Tool