CVE-2025-53770-Exploit

📌 SharePoint WebPart Injection Exploit Toolkit 🍕 Exploit tool for SharePoint WebPart Injection via ToolPane.aspx, leading to .NET deserialization and potential remote code execution RCE. Developed by: @GOTOCVE 🌍 Overview This tool exploits a vulnerability in Microsoft SharePoint on-premises that...

CVE-2025-53770

Divine Absolute - CVE-2025-53770 Exploit Tool Overview Divine Absolute is a sophisticated, wizard-driven Python exploit tool targeting CVE-2025-53770 , a critical CVSS 9.8 unauthenticated remote code execution RCE vulnerability in on-premises Microsoft SharePoint Server 2016, 2019, Subscription...

CVE-2025-53770

CVE-2025-53770 This is a scanner for the SharePoint unauthenticated Remote Code Execution vulnerability, assigned CVE number CVE-2025-53770. The code for this was written by reverse-engineering a payload seen in the wild. Use at your own risk, I am not responsible for any negative impact this mig...

CVE-2025-53770-Exploit

CVE-2025-53770-Exploit First, get the VIEWSTATEGENERATOR, VALIDATIONKEY, VALIDATIONALG value from the target SharePoint page: curl -s https://target.com/layouts/15/start.aspx | grep -oP 'VIEWSTATEGENERATOR" value="\K^"+' curl https://target.com/layouts/15/spinstall0.aspx Then, create a PowerShell...

-SOC342---CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-and-RCE

SOC342---CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-and-RCE This is an investigation conducted on the Let's Defend platform, based on a recent SharePoint CVE. Let's take a look. 1. Examine the rule name. Rule names are usually created specifically for the attack to be detected. By examining...

CVE-2025-53770

CVE-2025-53770 This is a scanner for the SharePoint unauthenticated Remote Code Execution vulnerability, assigned CVE number CVE-2025-53770. The code for this was written by reverse-engineering a payload seen in the wild. Use at your own risk, I am not responsible for any negative impact this mig...

cve-2025-53770

CVE-2025-53770 SharePoint Deserialization RCE PoC Critical — Unauthenticated Remote Code Execution via unsafe deserialization in Microsoft SharePoint Server CVE-2025-53770 Description Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an attacker to execute code...

CVE-2025-53770

CVE-2025-53770 – Microsoft SharePoint Server 2019 Unauthenticated RCE via Deserialization Exploit Author: Agampreet Singh Tool: RedRoot https://github.com/Agampreet-Singh/RedRoot Date: August 7, 2025 Tested On: SharePoint Server 2019 v16.0.10383.20020 on Windows Server 2019 CVE-ID: CVE-2025-53770...

CVE-2025-53770-Scanner

🛡️ CVE-2025-53770 SharePoint Vulnerability Scanner A Python-based tool to detect vulnerable Microsoft SharePoint instances affected by CVE-2025-53770 , an insecure deserialization vulnerability triggered via the ToolPane.aspx endpoint. The scanner sends a crafted, compressed ViewState payload to...

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend TL;DR Yo, in this LetsDefend lab I dove into a SharePoint zero-day called ToolShell CVE-2025-53770. Basically, I mimicked a real-world attack where a malicious POST request bypassed auth, ran PowerShell to steal MachineKeySection keys,...

CVE-2025-53770-Scanner

🛡️ Scanner de Vulnerabilidade CVE-2025-53770 no SharePoint Uma ferramenta baseada em Python para detectar instâncias vulneráveis do Microsoft SharePoint afetadas por CVE-2025-53770 , uma vulnerabilidade de desserialização insegura acionada através do endpoint ToolPane.aspx. O scanner envia um...

📄 Microsoft SharePoint Server 2019 16.0.10383.20020 Remote Code Execution

Microsoft SharePoint Server 2019 version 16.0.10383.20020 proof of concept that demonstrates unauthenticated remote code execution by exploiting unsafe deserialization in SharePoint's ToolPane.aspx via the Scorecard:ExcelDataSet control. Exploit Title: Microsoft SharePoint Server 2019 – Remote Co...

The Bug Report - July 2025 Edition

The Bug Report – July 2025 Edition By Jonathan Omakun and Tola Olawale · August 6, 2025 Why am I here? July usually means barbecues, fireworks and pool parties—but this year, it brought something far more explosive: unauthenticated remote code execution, deserialization chaos, and an old-school...