PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The OWASSRF + TabShell exploit chain

blog.viettelcybersecurity.com | blog | #rce | #microsoft | #ssrf | #exploit-chain | #exchange | #owassrf | #tabshell
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Viettel details two MSRC-reported Exchange bugs: OWASSRF, an authenticated SSRF via the X-OWA-ExplicitLogonUser header reaching backend /powershell, chained with TabShell for RCE in the wild.
Published
Collected

Related coverage

blog · blog.viettelcybersecurity.com
Pwn2Own 2021 Microsoft Exchange Exploit Chain
A Viettel researcher recounts his Pwn2Own 2021 Exchange chain: unauthenticated Autodiscover SSRF, PowerShell backend auth bypass, and OAB file write for RCE - the first two duplicated ProxyShell.
vulnerability · volexity.com
Microsoft Exchange Control Panel (ECP) Vulnerability CVE-2020-0688 Exploited
On February 11, 2020, as part of Patch Tuesday, Microsoft released cumulative updates and a service pack that addressed a remote code execution vulnerability found in Microsoft Exchange 2010, 2013, […]
blog · blog.viettelcybersecurity.com
Phát hiện chiến dịch tấn công mới của nhóm APT vào các máy chủ IIS sử dụng mã độc IIS Raid
Viettel's IR team details an APT campaign on a construction firm: ProxyLogon exploitation of Exchange, then the IIS Raid backdoor harvesting OWA credentials and persisting via malicious IIS modules.
blog · blog.viettelcybersecurity.com
NEWS | April 2020 - A remarkable month with various achievements of Viettel Cyber Security
Viettel Cyber Security's April 2020 recap: 48 zero-days in Oracle products, two Microsoft zero-days (CVE-2020-0933, CVE-2020-1022) and two experts named in Microsoft's Q1 researcher leaderboard.
blog · blog.viettelcybersecurity.com
Microsoft triệt phá thành công mạng lưới botnet Necurs
Microsoft and partners in 35 countries disrupted the Necurs botnet, which had infected 9 million machines, by cracking its DGA to predict 6 million future domains and seizing its US infrastructure.
blog · bishopfox.com
Zilliz / Attu | 2.6.5
Bishop Fox disclosed two flaws in Zilliz Attu 2.6.5, the Milvus management UI. An unauthenticated SSRF combined with a regex validation bypass chains into Kubernetes namespace takeover, exposing entire clusters to attackers.
Back