安全研究
CVE-2022-41082 Microsoft Exchange RCE：ProxyNotShell 攻击链前置
Thinking
2022-10-04
2 分钟阅读
研究档案
#漏洞分析#代码审计#横向移动
ProxyNotShell 攻击链的 SSRF 前置——CVE-2022-41082 单独存在时只让攻击者打 Exchange 的内部 PowerShell Remoting，但配合 CVE-2022-41040 直接变成全网 RCE。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9257681ce8a226a0cc05eab1af9b0091672db2404dcb3354290bdf33762284a887f5e40a372655766d445e897beb131b60181ad04ee2cfdf52539c23ac03e5bdf49e301053c446a8191a5a4e875f88266224029d4cde869af73d7c10b816b36aca215fd3cb871d72f9e91b496d4355e8819730bd86e5447f966d5de042d8c1335feb4f43808992584e2f077f7679edcc3ebaee642294a3299cf335aeb48adfee3787112c0a20686035baf20572b0005208ee15c81c6ddf974c99089142bde0e63efab8077d74f51fc19b9dd7918da65432fdc48d732a9f48b5d7e8a6f8eb2050456f27aabd024e18b64aa7ad43cc66ef0a67009fd332edb3c34422baab6f8ea8eaaf3a7060f18139691b90641b9b19d00c0f262622ab1c738a535e8c6f76c556b79ffa13116d9d0975ac12b0ea4a9c86501013181d86b80f4b33b34fff645d4345904eecad62c5b00fff1b7df7c047e362c20dd8fa30e5ca4fe0c467ab39fd5acd9b5651ba9ad5fc636815c3a8b9c1806c4653ad14c6a64d1b7474dee94bf34571748e799c5d0e396aa198a7f98452a4dd81ef1e078053ebcfa8bb2becf5e2c5cda641e9582b922952ccfb40c8f1ed8e9831ecbcd5e456209c891b886c113163fce1f7eed2f36af3213cb6372bd18c7d4f74ec60d2173e9d4a1ed3dbea9bf276846c030c758a20829ed0b0e1563939656b37e7ea3a5cb9b95f7e7c744f68275c4e0483bbb2cbc1f931b3870e731909d739608fc1ab9d7e8c84da2d0b1d042e830bcd8460c897b6f59718339774bd8f202d6d027ff7e49b775f2ad8378442d5d6dcd7f3f151c34f291b2e65665bef9daaa672d281116c0ca24565bb70767c299366e4fa22fe3adf2814a9e7598c9fbabae4fa079bf5227ea734fc27a82188a9a5c36c08b8dd42c8d6194c2886ad7d3f145a8d149395c3e980d452821ab87da4d5a65034d9b141a2a530b2419a49ef9884d380116d0703f9ec6d40be5a25438d68bcb5280efbd3f16bd8c815a437471f7351ec873efea84c6fc6798c85b110cfed518b85663d99e8f133b27cf45187cdc787038eca5d463b027e309696f7abc4e5af8e4857b0f1d0fd5fc5408f8de5ca385b94251a2c8f1f1570b920e092181686b7a3411df50c3b4c79d3163185184e1286fd4faa5e5ad90afbc2134d2e5990d75cc8f40568bbbb490d3342674400b413e4159c62b9f89743988b68000e81f69d4885b8fd31b843f7952036ce7b02f88f4bf11d9ea3b125fdc63553fa55c82387c6859473b7dd5f9164fdd2ea67736371b0b88f3e65c5116c442c3561ccd60f63090b6de88a0322514c97d84adc23b2a5679e1e9845f6d15eb263eb407da0f992e55a748220426b0891a797045f161722c3e73328d06ad3e4f915ddacbad6f1faafb49214028302492c889762cc70414eca76a59a6f4a21ca768fa602ce9fb1d209b327b6205c3d1b845a7b85951a29b72635400740aeb827e08c66cff552af1817315fbfc9009e8614d6520e628e6be360c111d34d3ee73b6bace32c09caf80a106d97e50cd931e2d3506f1e4e36d94dd27f84831f16cbf66884cbdb603079568c7d11a4e7b8f5d7f63dac73d48af52736d770f865cd8b85d6ed669ab03135144eec644ded9725f3c25ef24961db78dd24dbe3ee546e3efec0c6db7fd8c9e84eeb126d5dc29c23fe52dbe4103e3feca1e182733df87e26f78b45f513fc98b3f9af3150cb79ceaacb188ce98c8c756dddbf03308b2ba3994ec351f20c834ccd61b12e8568b4c75f903b8f3059b6756130a97b49c0ea9351954166e45739fe3112378bb4e371b702cf5f5b3416d60252bd152db2f8470fa3662cb949fc965af4c80865bdfd85f258fd594d76159ef319c9accdce5b14f1fc770ddd76452a98c816fbd50197bf1173148d04dff3b9114313859bbcd2760006b9f3f49c6f55ba5bb80f2e1c527d019922246828d047cdd4f5fb26389e29f78760cee24b0aba984bdc912722fafcd9a9469031c3cdd824b172e591b4f35a644d5fb99cc0fffbc3a3b97698835642b0496504b05d06806b7d456321050ead01747f17051077c1ef8650769c635cd1cb2f1cf59f1d1ed4fcc47da332faec887c5bc48fcb381a79124fee636dea4e55a91b8d73a80b34a312948c1ad9c8893e9fca69a09ae6ec6f289bdd66fd825f68ab5b50fe61e2c228909ae7d71ce8f8932458302a12315a6e562ef4166056c89c6f1ad049a62578d8027643b6c90e00a6cb0a07cb1bc65c66f244d2600ab4dadf563aa1e832ebdf7f96bf33287e660503f630cd790202ac3a8fd6789c5cd5239fcf084a26b4861ac02a5c398c10beae3f0199567c9c8b6bf20453ab588095457290192e282b10aa57b00830263df80971abe71e432405ddb32acc5763854d3c5cf75ea4009282b708b74b3266d0cc72d51140bbb588a6d7503f5d7b25ccd1c012bf66d381909edb31263daaaca40e7febe49511c232ed8c177d84bfb38e3507a04ed72dc36d499b0d7359d5c093a9a1419f9f02528218bf6741df94216304d918f9738dcdd7942f533c9d8c2a397045e3a2c4bd48a493f5623c3104b80d32f50e477a11cebf68b5f538fc9afe8f9ee18d41138096a1172f1da617dfc65e24bb0c97dda4f6dc7090b2f4830fba57b0c9d8876be7d5143a07082020b5687b082c8dc61435a361adc813bcd1a72d5748d2d923281ddfedf937c93bd4353d2581b9e8b241d67b0744d3bd0220a97d499fb6eb7c51c9d50c04c46e3e95ef6bcbbbdb5870011d9fdb4a701e7cc6aff99ddc1636885ae914afac72f9a3b63f1608c29aa78f75179f64eb7d39c494578af0382efe75cd48799f366a4a9204e018d4fad269211a0208d8b5cb69f5a2abb90cad43168f347c4fa7fb682602ca379582da483506bb2714b499fa99419c2715bcfd90f178cffd3591919a2b9d0d7501158038e0d2fe4378c44c91f26a9d8f1c6521eb0e7255bdccfc48a82c5b4989be53f95ff678cfd5692da37d97fa907e555e496f8077ad1f07a613c1d55e24d299b2d498d0f3bd98122cc7799c59813f0308e6b4185bb6751090c02a9924c9b7687a4b42eaeb8bff2e8295118eeab40286be9940be77e92a5c20dd4e81d03d1471b1d37d4e64313e4b2e49ca6154c2182d94a3bf2b8b12724040f9ad5dfae7f1c1f29990a3213930e788db3ee3409d6fc57b210a369053019ed22a4694330078da42d2cfd30092661d46258d1cf8e4add7eb870b6f7bf2a32da0f1906f5d25d4feedb82833a3b021ad51ef9f62025d788799a546d39a9517b19505f66023d2109a20b5bdc901c12b6ace5d9acd8b9b10721243f320defb2a96c2711a86debe5f2679d74043a8a29054c0a63e9c3bc91df6d9309efe0b309ace3c471cf7d0ce8891745ae8c8d3f31bf25abc1e5cd2fae531be040c379d162ae3221d5253dc0d6fdb1432164db58dda4d10b8577e606748eb994b134b3baba52984a79908e33cafea5d1e3723b89b9c74635420fd7bb1f6c83fe848630200d014003f635dc4f2f5fb2e110d66502860c11623a65a645bb5a407ad1de0f66501a6b1054e1d24ce6e76d8a301d2391fcdfb1873343fab8d6986234a765378e862a5d3865c446440c7d33c96c9e2bc6c3d4ca49e8969e622eb67072b16aea340a75638026e3ffb6c5bf98b1a968ad74495b217e4ecbec8187d469ecafb1bcae7edb25cefd822bd8ed721fa247a62804afc529d2738b377431717a11b6a5e8e4d84c80cbebc5331f5331aac6317d9fd59e11ea6fc75f122fa178bc4bf0362ca67041a4b24113435e5663c51795439f5c2dc30597dfc9ddc4ea303fc3799a767da9cdf471bb325df8919c1656f1a990959c0dccfe67c832557246768a79895021f4cfeb8740d65cfea6224bae30cf5dd8e5b547f5636becd4164ef6f1e7536d77d370560364cba7b41a455da9feb9054e9376d8828f5e7cd6cdd4787548b3965d8281b93726cdf9899a02a7ac4d2f0908ac6dc2e45527c9149cad11dea87702ea418f7831a2bbdbb54e4ce4a0154a882022d24660d86c66ac06134f9968b7b9abbc658a9ed4aa9c6c4f69d5457c33d2d83d8dc7d91d8dde3b8d4da069c998ccca9413763e7cee294e433957ed0090a129fa981737771c9faf3c3c3762ae0d50c55aca9b1a8478d0f1d51fa2f75bb02de0fe832ea537129ea6f618940c4d0906175f4f323f77e7aacf578895b2d4d7f04e8e968e4e899e895b4455a7c8e16498264ff10eb123b6670dbff7e52bb88e15b7c3d3d7deaebe019d442bdf71a4005edad3c68d119c3d35b9fa87c5172b8cab15f40dbb87d5d92f861ba50d200778a6f85b3f45adea537d4520b9c231164486370fb9e7ef0294b37e08a8154ad39a511d135ea4a567b15be691ec377b647af4a1069faa963fb5d4dc845d0a2c015224b03e2c88ab297a32894fd55f6391918dbab8e43b724f6c62031a060cd18be19e8640af3b3983f47c53720f1eab836ade840e9da07f672227e9e7fd542dce366f89cdd2ead90eff5cf2fc8207af525b0de1656ccf81ea8952074130a37342a158c1d7976276a0c28feb7c8daea64f21c5b45d59de3b448766b38ea20365399d0b56f3f9b7f140cb94f5d97d4d48a36f3de90f722e8ce81b00dfaf6d4588b2e7618ff272ac5aba6f3238c9fca4d5c80e1e982e4e3e1c5c00d6c1dc0ff2f7e1d5ddec99d07124a09e41ff1b2c1da8de568b85aa316e9e4aeec41b9218597fffeaf4e581c8730f4ba7ac08b7f102552632183892f2df68c46ca6778c93ac0b05e03a59943ac530251f7d6881b0e5cf3fa3acde62e3f1143baf83a9b8fce300738aa9af04c74482d10e753324fd133108dcadf46765ed993b0b0b9ee8a9d5bce801fd8f0c44599b979b92ec653ceef9087bdba558bf6cce8b589a11a836ca8703ad3146272638e1d36041fa0390df0153b3669a94455975959b193308fd3cd30d34a7a9c03f05d1cde604938d18c5b8601a1a004e1857c32efe87ce64a38b037e155521921451c05597a215d806ef9078d526a77f8c3611acc27eb184435dc3738f7b7b4680fa5413c1e1a2781786b70eb6573e4ff4f8c7d7e1b2cbf8fd57f2db23521e0fee9a8a652e2c53e78dc0dea278ba79ecfb259cb4e8bd27fed01ed2fd64bec03f33b5e864e398e91a099f98191439f91f745575507d36e9516e17fe85cf5bf32e2cd1a14f3bc9f55544bc22d7d218be3ba1795f3aa51881d177a095a4d89860d8cfaccbb44170e1a973876b27766f1848ecd690f941c5ff539f556180e0101e310855c975ae875a9f7a52375d68673e44816664ebb5f4dbd988fe6bb081975ed8682472e18c005dc360d7b8917da8e6f0c160448b63e2a8f07a715391a05f03a0cd5c2743bbab112b43f385d37b7978441a5a594c745fd5bc9fbe967d66cb0c416e43ce6324530ed66d5707fab2dbb729a19af7b38b11fcd727dc0592f7393bb2cf2a163ab4d891bdfc8845169870e0c6b33be936db45297896327d13fd087ea70f87abf8d7728dfde22956a5e5307d68e9ca5d678d64f5b9ec6071a5037974d631cf014ca70c7b95143acc2152dea010a80e0cf6ca8d674ee11ecbda442a0e168a81269544a153128f19f4bc9e903d3d51239287cc8b8d442a01f9bfc8c10d26cce04bb3409112ec2685e30b55023e4a7d0acd238f539e1035f3a20d311b243abe8435800801a3abd00b16ca7cb717b5c924cd838f2b223bc579e2ccb7deb8bca3a462e698e5af9051d0a87fb1d4f9ca632bc6dbd184d9626e27359d9203696d1c8fc5ffb6203ba95292db1e799561749d78962dccb86ff8b994fb2227b500888206f2dab4320423f6e1bd29c286d47fe1337fb42a6410fbd40c0fd3701a7a35a0c37fc9aa03445ae2aa80125aed5454fc3a7d4b28ed466c9000f6ea3e7dd2f97e610f70e03b89f47ea1acd46bad03ff581c53541a419ad27464455b9899fbb086342ade34772cf8d50ae9270206ef0bd6123a3034eb50e785e5dbb80123bf14ddc52edb4c7a9a6a3b9901102d68475851758c71c21a342d190ec277e29ec7cabdb5b0177124e93084664330afbb842b2b7dd40c33e4861cc855bed9d4ee8fe240531cbb059eba3034f2b5d5ee1cf647bfa82ec9737fce8305c8a54081a86b77328449631b1ec545a5f618628ee01b21d1077ec9bcf0924739fd3d286985241685c0c56f0e01603fffa0ff360a0104289c0a34085c76dc4b460f0acffef15748724f54911894170c94e94812e9321c6658ca7bd5ec37c8be6e46b57025a5d5d46e4ef7bdc26713d1b3ddaf54e405eec53b0fe90812dc6b8ba15f9d7dee62850158231f