## https://sploitus.com/exploit?id=E63FD2AF-5F3D-58E6-A4CF-907EBDA09E2C
# CVE-2021-26855
CVE-2021-26855 ssrf brute-force attack
Golang exercise
## Affected Versions
Exchange Server 2013 (prior to CU23)
Exchange Server 2016 (prior to CU18)
Exchange Server 2019 (prior to CU7)
## Exploitation Conditions
This vulnerability differs from previous Exchange vulnerabilities. It does not require a logged-in user identity; it allows unauthorized access to internal user resources. Combined with CVE-2021-27065, it enables remote command execution. Required conditions for exploiting this vulnerability:
- The target server has a vulnerability.
- The target Exchange server must be a load balancer, meaning it uses two or more servers simultaneously.
- The target email address must be a domain-based address, not a regular email address. There is a difference between the two.
- The attacker must also identify the fully qualified domain name (FQDN) of the internal Exchange server.
Among these four conditions, the FQDN can be obtained through the ntlm type2 message; the email address can be enumerated directly.
## Usage Instructions
This vulnerability exploitation is facilitated using scripting languages like Ruby and Python. Using Golang for writing scripts is mainly to learn Golang. Therefore, this tool is only a semi-finished product. I will update it when I have time. This tool supports vulnerability detection and user enumeration, and can perform simple email ID and header reading (in fact, it modifies the XML content). For further exploitation, refer to CVE-2021-8581; both involve submitting XMLs. Usage:
```
go run CVE-2021-21978.go -h
```
```
-h string Required, target address or domain name
-U string Optional, list of users to enumerate
-d Optional, download emails
-l Optional, list of emails
-n string Optional, specify the FQDN
-t string Optional, request delay time (default "1")
-u string Optional, specify the target (default "administrator")
```
### Updated Download Function