Sploitus

Exploit for Improper Authentication in Microsoft

gitee · 2020-03-07

Exploit Code

MARKDOWN2 lines
## https://sploitus.com/exploit?id=D40DE61F-4CBF-5341-B41D-767C5F0BC531
It is an exploit module targeting Microsoft Exchange Server. The primary CVE ID is CVE-2020-0688. The vulnerability class is a deserialization vulnerability, specifically a TextFormattingRunProperties deserialization vulnerability. The probable entry point is the `exploit.py` script. Notable dependencies include `requests` and `ysoserial.net`. The execution context is a Python script invoked via the command line, with the `ysoserial.exe` command used to generate a malicious ViewState. Preconditions for the exploit include a vulnerable version of Microsoft Exchange Server and a user with an email address privilege. The expected impact is remote code execution.