CVE-2020-0688 PoC — Microsoft Exchange Server 授权问题漏洞

Source

https://github.com/W01fh4cker/CVE-2020-0688-GUI

Associated Vulnerability

Title:Microsoft Exchange Server 授权问题漏洞 (CVE-2020-0688)
Description:Microsoft Exchange Server是美国微软（Microsoft）公司的一套电子邮件服务程序。它提供邮件存取、储存、转发，语音邮件，邮件过滤筛选等功能。 Microsoft Exchange Server 中存在授权问题漏洞，该漏洞源于程序无法正确处理内存中的对象。攻击者可借助特制的电子邮件利用该漏洞在系统用户的上下文中运行任意代码。以下产品及版本受到影响：Microsoft Exchange Server 2010，Microsoft Exchange Server 2013，Micro

Description

GUI Exploit Tool for CVE-2020-0688(Microsoft Exchange default MachineKeySection deserialize vulnerability)

Readme

# 一、项目目的与参考

目的很简单，最近准备再拿`C#`写`C2`，先写点小玩意练练手，提高兴趣。于是我就想到了把`zcgonvh`大佬的工具改成图形化的，源工具链接如下：

> https://github.com/zcgonvh/CVE-2020-0688

# 二、使用

从`Release`处下载：

```
https://github.com/W01fh4cker/CVE-2020-0688-GUI/releases/download/0.0.1-beta/CVE-2020-0688-GUI-V0.0.1-beta.zip
```

## 1. 命令执行

![](https://cdn.jsdelivr.net/gh/W01fh4cker/blog_image@main/image-20240509204513682.png)

## 2. shellcode加载

![](https://cdn.jsdelivr.net/gh/W01fh4cker/blog_image@main/image-20240509204334043.png)

![](https://cdn.jsdelivr.net/gh/W01fh4cker/blog_image@main/image-20240509204257478.png)

# 三、关于

欢迎关注我的公众号：

> 专注于发布技术文章，对技术有执着的追求和不屈的信仰，娱乐圈之流、投机倒把者勿扰。

![](https://cdn.jsdelivr.net/gh/W01fh4cker/blog_image@main/zmxa.png)

File Snapshot


 [4.0K]  /data/pocs/10a54459489c3652c4967a7a11a94b7fce2d5293
├── [4.0K]  CVE-2020-0688-GUI
│   ├── [ 763]  App.xaml
│   ├── [ 333]  App.xaml.cs
│   ├── [ 595]  AssemblyInfo.cs
│   ├── [ 668]  CVE-2020-0688-GUI.csproj
│   ├── [ 414]  CVE-2020-0688-GUI.csproj.user
│   ├── [120K]  ExchangeExploit.cs
│   ├── [5.9K]  MainWindow.xaml
│   ├── [3.8K]  MainWindow.xaml.cs
│   └── [4.0K]  resources
│       ├── [4.2K]  logo.ico
│       └── [ 24K]  profile.png
├── [1.1K]  CVE-2020-0688-GUI.sln
└── [ 977]  README.md

2 directories, 12 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!