Exploit for Improper Authentication in Microsoft

githubexploit · 2024-05-09

Description

Exploit for improper authentication in Microsoft Exchange CVE-2020-0688 via a GUI tool.

Entry point

Parameterpassword · request body

Path/owa/auth.owa

Authentication request used in exploit to obtain a session for Exchange web interfaces.

Affected Microsoft Exchange Server versions

Microsoft Exchange Server= 2010, 2013, 2016, 2019

All known vulnerabilities by product

Asp.Net Exchange Server

CVSS 9.0 for CVE-2020-0688

9.0

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:LOW

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

61%confidence this exploit runs

Based on 5 file(s) in the source

EPSS Score

100.0%higher than 100.0% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2025-03-03 21:28

Last Seen:2025-09-06 10:33

Reporter:W01fh4cker

Written in:C#

Last commit:2024-05-09

Tags

Improper authenticationMicrosoft ExchangeGraphical interfaceCVE-2020-0688

Other exploits for CVE-2020-0688

Exploit for Improper Authentication in Microsoft

2025-07-27 mirrors_RidterGITEE

Exploit for Improper Authentication in Microsoft

2025-07-06 mirrors_zcgonvhGITEE

Exploit for Improper Authentication in Microsoft

2021-01-04 MrTizGITHUB

Exploit for Improper Authentication in Microsoft

2020-10-29 SLSteffGITHUB

Exploit for Improper Authentication in Microsoft

2020-10-23 zyn3rgyGITHUB

Exploit for Improper Authentication in Microsoft

2020-08-17 murataydemirGITHUB

Background Intelligent Transfer Service Privilege Escalation Exploit

2020-06-12 metasploitZDTRuby

Background Intelligent Transfer Service CVE-2020-0787 - Privilege Escalation

2020-06-12 0daydb.comUNKNOWNRuby

Exploit Code

README24 lines

## https://sploitus.com/exploit?id=67D1AAF7-9286-5A6B-A1E7-60C768C3BE5C
# I. Project Objectives and References

The purpose is simple: recently, I’m planning to rewrite C2 using `C#`. I’m just doing some small projects to practice and to increase my interest in coding. That’s why I thought of converting the tools developed by `zcgonvh` into graphical interfaces. The source code can be found here:  
> https://github.com/zcgonvh/CVE-2020-0688

# II. Usage

Download from the `Release` section:
```
https://github.com/W01fh4cker/CVE-2020-0688-GUI/releases/download/0.0.1-beta/CVE-2020-0688-GUI-V0.0.1-beta.zip
```

## 1. Command Execution
![](https://cdn.jsdelivr.net/gh/W01fh4cker/blog_image@main/image-20240509204513682.png)

## 2. Shellcode Loading
![](https://cdn.jsdelivr.net/gh/W01fh4cker/blog_image@main/image-20240509204334043.png)
![](https://cdn.jsdelivr.net/gh/W01fh4cker/blog_image@main/image-20240509204257478.png)

# III. Related Information

Welcome to follow my official account:
> Focus on publishing technical articles, with a persistent pursuit of technology and an unyielding belief in it. No need for those from the entertainment industry or speculators! ![](https://cdn.jsdelivr.net/gh/W01fh4cker/blog_image@main/zmxa.png)