nomisec
WORKING POC
119 stars
by horizon3ai · remote
https://github.com/horizon3ai/proxyshell
This repository contains a functional exploit for the ProxyShell vulnerability chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) affecting Microsoft Exchange Server. The exploit automates the attack chain, including email enumeration, LegacyDN discovery, and remote code execution via PowerShell remoting.
Classification
Working Poc 95%
Target:
Microsoft Exchange Server (2013, 2016, 2019)
No auth needed
Prerequisites:
Network access to vulnerable Exchange server · Unpatched Exchange Server (pre-July 2021 updates)
nomisec
SCANNER
47 stars
by cyberheartmi9 · remote
https://github.com/cyberheartmi9/Proxyshell-Scanner
The repository contains a scanner for detecting the Proxyshell vulnerability (CVE-2021-34473) in Microsoft Exchange Server. It includes a Python script and a Nuclei template to check for the presence of the vulnerability by sending a crafted HTTP request and checking for specific response headers.
Classification
Scanner 90%
Target:
Microsoft Exchange Server
No auth needed
Prerequisites:
Network access to the target Exchange Server
nomisec
WORKING POC
41 stars
by kh4sh3i · remote
https://github.com/kh4sh3i/ProxyShell
This repository contains a functional exploit for CVE-2021-34473, part of the ProxyShell vulnerability chain affecting Microsoft Exchange Server. The exploit leverages authentication bypass and arbitrary file write vulnerabilities to achieve remote code execution (RCE).
Classification
Working Poc 95%
Target:
Microsoft Exchange Server 2013, 2016, 2019 (various CUs)
No auth needed
Prerequisites:
Network access to vulnerable Exchange Server · Exchange Server with unpatched ProxyShell vulnerabilities
nomisec
WORKING POC
30 stars
by p2-98 · poc
https://github.com/p2-98/CVE-2021-34473
This repository contains a functional exploit for CVE-2021-34473, a vulnerability in Microsoft Exchange Server. The exploit leverages the ProxyShell attack chain to achieve remote code execution (RCE) by abusing the autodiscover endpoint and PowerShell remoting.
Classification
Working Poc 95%
Target:
Microsoft Exchange Server (versions affected by ProxyShell)
No auth needed
Prerequisites:
Network access to the Exchange Server · Exchange Server vulnerable to ProxyShell
nomisec
WORKING POC
17 stars
by je6k · remote
https://github.com/je6k/CVE-2021-34473-Exchange-ProxyShell
This repository contains functional exploit code for CVE-2021-34473, a vulnerability in Microsoft Exchange Server (ProxyShell). The exploit leverages authentication bypass and arbitrary file write to deliver a webshell via crafted email attachments.
Classification
Working Poc 95%
Target:
Microsoft Exchange Server 2013/2016/2019
No auth needed
Prerequisites:
Network access to vulnerable Exchange server · Valid email address for SID token retrieval
nomisec
SCANNER
6 stars
by RaouzRouik · poc
https://github.com/RaouzRouik/CVE-2021-34473-scanner
This repository provides a scanner for detecting CVE-2021-34473, a Microsoft Exchange vulnerability. It includes batch scripts for single and mass scanning but does not contain exploit code.
Classification
Scanner 90%
Target:
Microsoft Exchange Server 2013, 2016, 2019
No auth needed
Prerequisites:
Network access to target Exchange servers
nomisec
SCANNER
2 stars
by ipsBruno · infoleak
https://github.com/ipsBruno/CVE-2021-34473-NMAP-SCANNER
This repository provides an Nmap script to scan for CVE-2021-34473, a vulnerability in Microsoft Exchange Server. It does not include exploit code but offers a detection mechanism via NSE script.
Classification
Scanner 90%
Target:
Microsoft Exchange Server (versions affected by CVE-2021-34473)
No auth needed
Prerequisites:
Nmap installed · Network access to target systems
nomisec
WORKING POC
by Loqueseamevaleverg · poc
https://github.com/Loqueseamevaleverg/ProxyHell
This repository contains a functional exploit for CVE-2021-34473 (ProxyShell), which chains multiple vulnerabilities to achieve remote code execution on Microsoft Exchange servers. The exploit leverages Autodiscover endpoint manipulation, SID leakage, and token forgery to deploy a webshell.
Classification
Working Poc 95%
Target:
Microsoft Exchange Server (versions affected by ProxyShell)
No auth needed
Prerequisites:
valid target email address · network access to Exchange server
nomisec
WORKING POC
by f4alireza · remote
https://github.com/f4alireza/CVE
This repository contains functional exploit code for CVE-2021-34473, a remote code execution vulnerability in Microsoft Exchange Server. The provided scripts encode a malicious payload to bypass security mechanisms and achieve RCE via a crafted HTTP request.
Classification
Working Poc 95%
Target:
Microsoft Exchange Server (ProxyShell vulnerability)
No auth needed
Prerequisites:
Network access to vulnerable Exchange Server · Exchange Server with unpatched ProxyShell vulnerability
metasploit
WORKING POC
EXCELLENT
by Orange Tsai, Jang (@testanull), PeterJson, brandonshi123, mekhalleh (RAMELLA Sébastien), Donny Maasland, Rich Warren, Spencer McIntyre, wvu · rubypocwindows
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb
This Metasploit module exploits CVE-2021-34473, part of the ProxyShell vulnerability chain, to achieve remote code execution on Microsoft Exchange Server by bypassing authentication, impersonating a user, and writing arbitrary files.
Classification
Working Poc 100%
Target:
Microsoft Exchange Server (2013 CU23 < 15.0.1497.15, 2016 CU19 < 15.1.2176.12, 2016 CU20 < 15.1.2242.5, 2019 CU8 < 15.2.792.13, 2019 CU9 < 15.2.858.9)
No auth needed
Prerequisites:
Network access to the Exchange server · A known email address for the organization (optional)
patchapalooza
SCANNER
by learningsurface · remote
https://github.com/learningsurface/ProxyShell-CVE-2021-34473.py
This repository contains a scanner for CVE-2021-34473 (ProxyShell) that checks for vulnerable Microsoft Exchange servers by sending a crafted HTTP request to the autodiscover endpoint and analyzing the response for specific indicators of vulnerability.
Classification
Scanner 90%
Target:
Microsoft Exchange Server
No auth needed
Prerequisites:
Target URL or list of URLs to scan
patchapalooza
WORKING POC
by aravazhimdr · remote
https://github.com/aravazhimdr/ProxyShell-POC-Mod
This repository contains a functional exploit for ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), a chain of vulnerabilities in Microsoft Exchange Server. The exploit merges two existing PoCs to achieve remote code execution (RCE) by leveraging authentication bypass and arbitrary file write vulnerabilities.
Classification
Working Poc 95%
Target:
Microsoft Exchange Server 2016, 2019
No auth needed
Prerequisites:
Network access to vulnerable Exchange server · Valid email address on the target server
patchapalooza
WORKING POC
by Udyz · remote
https://github.com/Udyz/proxyshell-auto
This repository contains a functional exploit for CVE-2021-34473 (ProxyShell), which is a remote code execution vulnerability in Microsoft Exchange Server. The exploit automates the attack chain, including authentication bypass, arbitrary file write, and remote command execution as SYSTEM.
Classification
Working Poc 95%
Target:
Microsoft Exchange Server (2013, 2016, 2019)
No auth needed
Prerequisites:
Network access to Exchange Server · Exchange Server with vulnerable Autodiscover endpoint
patchapalooza
WORKING POC
by dmaasland · remote
https://github.com/dmaasland/proxyshell-poc
This repository contains functional exploit code for CVE-2021-34473 (ProxyShell), demonstrating remote code execution (RCE) on Microsoft Exchange Server. The scripts include enumeration, authentication bypass, and RCE capabilities via PowerShell remoting.
Classification
Working Poc 95%
Target:
Microsoft Exchange Server 2013, 2016, 2019
No auth needed
Prerequisites:
Network access to Exchange Server · Autodiscover endpoint accessible
patchapalooza
WORKING POC
by ktecv2000 · remote
https://github.com/ktecv2000/ProxyShell
This repository contains a functional exploit for CVE-2021-34473 (ProxyShell), which chains multiple vulnerabilities in Microsoft Exchange Server to achieve unauthenticated remote code execution. The exploit follows a multi-stage attack, including SSRF, SID manipulation, and PowerShell remoting to deploy a webshell.
Classification
Working Poc 95%
Target:
Microsoft Exchange Server (2013, 2016, 2019)
No auth needed
Prerequisites:
Network access to the Exchange Server · Valid email address associated with the target