suricata-rule-CVE-2025-53770

suricata-rule-CVE-2025-53770 Reglas de detección para CVE-2025-53770 root@kitploit: alert http $EXTERNALNET any - $HOMENET any msg: "ET EXPLOIT SharePoint RCE ToolShell CVE-2025-53770"; http.method; content: "POST"; flow: established, toserver; http.uri;...

CVE-2025-53770-Scanner

Escáner CVE-2025-53770 por DanSec Una herramienta de reconocimiento simple y eficaz para identificar una posible exposición a la crítica vulnerabilidad de SharePoint CVE-2025-53770. !Warning Esta herramienta está destinada únicamente a fines de prueba autorizados. El autor DanSec no asume ninguna...

LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell

LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell 简介 我在 LetsDefend 实验室中研究了一个名为 ToolShell CVE-2025-53770 的 SharePoint 零日漏洞。我模拟了一场真实的零日攻击，其中恶意 POST 请求绕过身份验证，运行 PowerShell 窃取 MachineKeySection 密钥，编译 payload.exe，并植入了一个 Web 后门 spinstall0.aspx。我记录了所有操作，分析了行为，并隔离了主机。本 README...

ToolShellFinder

🛠️ ToolShellFinder：CVE-2025-53770 和 CVE-2025-53771 检测 一个用于扫描 IIS 日志的高性能 PowerShell 7+ 脚本，用于检测与 ToolShell 相关的利用迹象，专门针对 Microsoft SharePoint 中的零日漏洞 CVE-2025-53770 和 CVE-2025-53771 。 本脚本是临时拼凑而成，旨在帮助 DFIR 团队、系统管理员和安全专业人员识别 SharePoint 环境中与这些漏洞相关的可疑活动，非常适合偏好原生 PowerShell 的防御者使用。 版本 PS5 正在被版本 PS7 取代 版本...

ToolShell

用于 SharePoint ToolShell 的漏洞利用工具。 博客：https://blog.viettelcybersecurity.com/sharepoint-toolshell/ 使用方法： python exploit.py -u -c 例如： python exploit.py -u http://10.0.1.12/sites/test -c calc @l0gg...

LetsDefend-SOC342-CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-andRCE-EventID-320

🧠 LetsDefend SharePoint 零日分析（ToolShell - SOC342-CVE-2025-53770） 📘 引言 我在 LetsDefend 网络实验室中调查了一个名为 ToolShell（CVE-2025-53770） 的 SharePoint 零日漏洞。 该演练模拟了一次真实世界的零日 RCE 攻击 ：恶意 POST 请求绕过身份验证，执行 PowerShell 窃取 MachineKeySection 密钥，编译 payload.exe，并植入恶意 Web Shell（spinstall0.aspx）。 本 README 记录了攻击过程、取证步骤、遏制措施...

Toolshell_CVE-2025-53770

ToolShell → PoC d'exploitation pour CVE‑2025‑53770 Ce package permet : 1. Téléverser une webshell sur SharePoint 2. Extraire la ValidationKey 3. Générer un ViewState signé 4. RCE via un reverse shell ou un bind shell 🔧 Installation root@kitploit: git clone cd toolshell-exploit pip3 install -r...

SharePoint-ToolShell-CVE-2025-53770-Incident-Analysis

SharePoint ToolShell CVE-2025-53770 事件分析 概述 本项目记录了对一次真实世界利用尝试的调查，该尝试利用 ToolShell 漏洞 CVE-2025-53770 针对 SharePoint 服务器。 该攻击展示了完整的利用链，包括远程代码执行、WebShell 部署和凭据数据提取。 初始访问 攻击始于一条可疑告警，该告警表明存在针对 SharePoint 服务器的 CVE-2025-53770 漏洞利用。 利用请求 一个未经身份验证的 HTTP POST 请求被发送到存在漏洞的 SharePoint 端点：...

cve-2025-53770-research

cve-2025-53770-research 🚨 Ricerca sul threat intelligence e sulla risposta agli incidenti relativa al zero-day RCE "ToolShell" di SharePoint CVE-2025-53770. 🕵️‍♂️ Copre le vulnerabilità di deserializzazione alla radice, le tempistiche di attacco, le metriche di rischio e i playbook difensivi/EDR di...

-SOC342---CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-and-RCE

SOC342---CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-and-RCE Questa è un'indagine condotta sulla piattaforma Let's Defend, basata su una recente CVE di SharePoint. Diamo un'occhiata. 1. Esamina il nome della regola. I nomi delle regole sono solitamente creati specificamente per l'attacco da...

ToolShell-Honeypot

ToolShell-Honeypot SharePoint Zero-Day Ein Docker-basierter Honeypot zur Erkennung und Protokollierung von Exploit-Versuchen gegen Microsoft-SharePoint-Zero-Day-Schwachstellen. Dieser Honeypot dient der frühzeitigen Erkennung und der Bedrohungsanalyse Threat Intelligence, nicht der Simulation ein...

Microsoft SharePoint Server - Authentication Bypass (ToolShell)

Microsoft Office SharePoint Server contains an improper authentication vulnerability that allows unauthorized attackers to perform spoofing over a network. By crafting a POST request to /layouts/15/ToolPane.aspx with a forged Referer header /layouts/SignOut.aspx, attackers can bypass authenticati...

CVE-2025-53770-Checker

CVE-2025-53770-जाँचकर्ता जाँच करता है कि कोई ऑन-प्रिमाइसेस SharePoint सर्वर CVE-2025-53770 के प्रति संवेदनशील है या नहीं गैर-आक्रामक डिटेक्टर SharePoint सर्वर में CVE-2025-53770 भेद्यता के लिए विकास: Division81 Grupo Oruss की एथिकल हैकर्स टीम तकनीकी विवरण CVE-2025-53770 ऑन-प्रिमाइसेस SharePoint क...

sharepoint-toolshell-cve-2025-53770

SharePoint „ToolShell“ RCE-Exploit CVE-2025-53770 Überblick CVE-2025-53770 ist eine kritische Schwachstelle zur Remotecodeausführung RCE in Microsoft SharePoint Server 2016, 2019 und Subscription Edition nur On-Premises, nicht SharePoint Online. Angreifer können die Authentifizierung umgehen und...

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend TL;DR Ehi, in questo lab di LetsDefend mi sono immerso in una zero-day di SharePoint chiamata ToolShell CVE-2025-53770. In pratica, ho replicato un attacco reale in cui una richiesta POST maliziosa bypassava l'autenticazione, eseguiva...

Microsoft SharePoint Server - Remote Code Execution (ToolShell)

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. This vulnerability is part of the ToolShell exploit chain and when combined with CVE-2025-53771 authentication bypass, enables unauthenticated remote code...

The Zero-Day Scramble is Avoidable: A Guide to Attack Surface Reduction

You can't control when the next critical vulnerability drops. You can control how much of your environment is exposed when it does. The problem is that most teams have more internet-facing exposure than they realise. Intruder's Head of Security digs into why this happens and how teams can manage ...

About Remote Code Execution – Microsoft SharePoint “ToolShell” (CVE-2025-49704) vulnerability

About Remote Code Execution - Microsoft SharePoint "ToolShell" CVE-2025-49704 vulnerability. This vulnerability is from the Microsoft's July Patch Tuesday. SharePoint is a web application developed by Microsoft for corporate intranet portals, document management, and collaborative work...

IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response

Threat actors predominately exploited public-facing applications for initial access this quarter, with this tactic appearing in over 60 percent of Cisco Talos Incident Response Talos IR engagements - a notable increase from less than 10 percent last quarter. This spike is largely attributable to ...

Chinese Threat Actors Exploit ToolShell SharePoint Flaw Weeks After Microsoft's July Patch

Threat actors with ties to China exploited the ToolShell security vulnerability in Microsoft SharePoint to breach a telecommunications company in the Middle East after it was publicly disclosed and patched in July 2025. Also targeted were government departments in an African country, as well as...