-SOC342---CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-and-RCE

SOC342---CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-and-RCE This is an investigation conducted on the Let's Defend platform, based on a recent SharePoint CVE. Let's take a look. 1. Examine the rule name. Rule names are usually created specifically for the attack to be detected. By examining...

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend TL;DR Yo, in this LetsDefend lab I dove into a SharePoint zero-day called ToolShell CVE-2025-53770. Basically, I mimicked a real-world attack where a malicious POST request bypassed auth, ran PowerShell to steal MachineKeySection keys,...

Toolshell_CVE-2025-53770

ToolShell → CVE‑2025‑53770 Exploit PoC This package allows: 1. Upload webshell to SharePoint 2. Extract ValidationKey 3. Generate signed ViewState 4. RCE via reverse/bind shell 🔧 Setup root@kitploit: git clone cd toolshell-exploit pip3 install -r requirements.txt 🤖 Running Upload the webshell Fro...

suricata-rule-CVE-2025-53770

suricata-rule-CVE-2025-53770 Detection rules for CVE-2025-53770 root@kitploit: alert http $EXTERNALNET any - $HOMENET any msg: "ET EXPLOIT SharePoint RCE ToolShell CVE-2025-53770"; http.method; content: "POST"; flow: established, toserver; http.uri;...

ToolShell-Honeypot

ToolShell-Honeypot SharePoint Zero-Day A Docker-based honeypot focused on detecting and logging exploitation attempts against Microsoft SharePoint zero-day vulnerabilities. This honeypot is designed for early detection and threat intelligence, not for simulating a full SharePoint environment or...

sharepoint-toolshell-cve-2025-53770

SharePoint "ToolShell" RCE Exploit CVE-2025-53770 Overview CVE-2025-53770 is a critical remote code execution RCE vulnerability affecting Microsoft SharePoint Server 2016, 2019, and Subscription Edition on-premises only, not SharePoint Online. Attackers can bypass authentication and achieve full...

CVE-2025-53770-Scanner

CVE-2025-53770 Scanner by DanSec A simple, effective reconnaissance tool to identify potential exposure to the critical SharePoint vulnerability CVE-2025-53770. !Warning This tool is intended for authorised testing purposes only. The author DanSec takes no responsibility for misuse or damage caus...

CVE-2025-53770-Checker

CVE-2025-53770-Checker Checks if an on-premises SharePoint server is vulnerable to CVE-2025-53770 Non-intrusive detector of the CVE-2025-53770 vulnerability in SharePoint Server Development: Division81 ethical hacking team of Grupo Oruss Technical Description CVE-2025-53770 is a critical .NET...

ToolShell

Exploit for SharePoint ToolShell. Blog: https://blog.viettelcybersecurity.com/sharepoint-toolshell/ How to use: python exploit.py -u -c Eg: python exploit.py -u http://10.0.1.12/sites/test -c calc @l0gg...

LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell

LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell Introduction I went into a SharePoint zero-day called ToolShell CVE-2025-53770 in the LetsDefend lab. I mimicked a real-world zero-day attack where a malicious POST request bypassed auth, ran PowerShell to steal MachineKeySection key...

ToolShellFinder

🛠️ ToolShellFinder: CVE-2025-53770 & CVE-2025-53771 Detection Microsoft SharePoint में ToolShell से संबंधित शोषण के संकेतों का पता लगाने के लिए IIS लॉग को स्कैन करने के लिए एक उच्च-प्रदर्शन PowerShell 7+ स्क्रिप्ट, विशेष रूप से शून्य-दिवसीय कमजोरियों CVE-2025-53770 और CVE-2025-53771 को लक्षित करती...

SharePoint-ToolShell-CVE-2025-53770-Incident-Analysis

SharePoint ToolShell CVE-2025-53770 Incident Analysis Overview This project documents the investigation of a real-world exploitation attempt targeting a SharePoint server using the ToolShell vulnerability CVE-2025-53770. The attack demonstrates a full exploitation chain including remote code...

cve-2025-53770-research

cve-2025-53770-research 🚨 Threat intel & incident response research on SharePoint "ToolShell" RCE zero-day CVE-2025-53770. 🕵️‍♂️ Covers root-cause deserialization flaws, attack timelines, risk metrics, and defensive EDR validation playbooks. 🛡️ 🕵️ CVE-2025-53770 — SharePoint "ToolShell" Zero-Day...

LetsDefend-SOC342-CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-andRCE-EventID-320

🧠 LetsDefend SharePoint ज़ीरो-डे विश्लेषण ToolShell - SOC342-CVE-2025-53770 📘 परिचय मैंने LetsDefend साइबर लैब में ToolShell CVE-2025-53770 नामक SharePoint ज़ीरो-डे की जाँच की। यह अभ्यास एक वास्तविक दुनिया के ज़ीरो-डे RCE हमले की नकल था जिसमें एक दुर्भावनापूर्ण POST अनुरोध ने प्रमाणीकरण को बायपास...

Microsoft SharePoint Server - Authentication Bypass (ToolShell)

Microsoft Office SharePoint Server contains an improper authentication vulnerability that allows unauthorized attackers to perform spoofing over a network. By crafting a POST request to /layouts/15/ToolPane.aspx with a forged Referer header /layouts/SignOut.aspx, attackers can bypass authenticati...

Microsoft SharePoint Server - Remote Code Execution (ToolShell)

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. This vulnerability is part of the ToolShell exploit chain and when combined with CVE-2025-53771 authentication bypass, enables unauthenticated remote code...

Exploit for Deserialization of Untrusted Data in Microsoft

cve-2025-53770-research 🚨 Threat intel & incident response...

The Zero-Day Scramble is Avoidable: A Guide to Attack Surface Reduction

You can't control when the next critical vulnerability drops. You can control how much of your environment is exposed when it does. The problem is that most teams have more internet-facing exposure than they realise. Intruder's Head of Security digs into why this happens and how teams can manage ...

About Remote Code Execution – Microsoft SharePoint “ToolShell” (CVE-2025-49704) vulnerability

About Remote Code Execution - Microsoft SharePoint "ToolShell" CVE-2025-49704 vulnerability. This vulnerability is from the Microsoft's July Patch Tuesday. SharePoint is a web application developed by Microsoft for corporate intranet portals, document management, and collaborative work...

IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response

Threat actors predominately exploited public-facing applications for initial access this quarter, with this tactic appearing in over 60 percent of Cisco Talos Incident Response Talos IR engagements - a notable increase from less than 10 percent last quarter. This spike is largely attributable to ...