PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Pwn2Own 2021 Microsoft Exchange Exploit Chain

blog.viettelcybersecurity.com | blog | #rce | #microsoft | #ssrf | #pwn2own | #exploit-chain | #exchange | #proxyshell
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Viettel researcher recounts his Pwn2Own 2021 Exchange chain: unauthenticated Autodiscover SSRF, PowerShell backend auth bypass, and OAB file write for RCE - the first two duplicated ProxyShell.
Published
Collected

Related coverage

blog · blog.viettelcybersecurity.com
The OWASSRF + TabShell exploit chain
Viettel details two MSRC-reported Exchange bugs: OWASSRF, an authenticated SSRF via the X-OWA-ExplicitLogonUser header reaching backend /powershell, chained with TabShell for RCE in the wild.
research · mccaulay.co.uk
go2shell: Rooting Home Assistant through SSDP
# go2shell: Rooting Home Assistant through SSDP 7 October 20267 October 2026 McCaulayVulnerability Research ## Introduction Home Assistant is one of the most widely deployed open-source home...
research · starlabs.sg
Race Against The Patch: The Evolution of Four Exploit Chains in LiteLLM
How we developed four complete full-chain exploits across four LiteLLM versions in a race against a target that kept getting patched under our feet, in preparation for Pwn2Own Berlin 2026.
vulnerability · horizon3.ai
[CVE-2021-34473] ProxyShell: More Ways for More Shells
In August, Orange Tsai released details and also spoke at BlackHat and DEFCON detailing his security research into Microsoft Exchange. His latest blog post…
vulnerability · volexity.com
Microsoft Exchange Control Panel (ECP) Vulnerability CVE-2020-0688 Exploited
On February 11, 2020, as part of Patch Tuesday, Microsoft released cumulative updates and a service pack that addressed a remote code execution vulnerability found in Microsoft Exchange 2010, 2013, […]
blog · blog.viettelcybersecurity.com
The first step to PWN2OWN - A sad one
A researcher's first find: LAN-side command injection in the NETGEAR RAX30 UPnP service via a malicious SOAPACTION header embedded into a logger command; patched just before Pwn2Own Toronto 2022.
Back