🎯 Vulnerability scanner for SharePoint servers affected by CVE-2025-53770. Detects unsafe deserialization using ToolPane.aspx with a crafted base64+gzip payload. 🛡️ Developed by Ahmed Tamer.
Proof-of-concept exploit for unauthenticated remote code execution via unsafe deserialization in Microsoft SharePoint Server (CVE-2025-53770), with payload extraction and decoding commands.
A critical zero-auth RCE vulnerability in SharePoint (CVE-2025-53770), now exploited in the wild, building directly on the spoofing flaw CVE-2025-49706.
Unauthenticated remote code execution exploit for Microsoft SharePoint Server 2019 via unsafe .NET deserialization in ToolPane.aspx. Python-based PoC targeting Scorecard:ExcelDataSet control.
Exploit for CVE-2025-53770, a critical SharePoint RCE via authentication bypass and unsafe deserialization, enabling web shell deployment and machine key theft for persistent server compromise.
An activity to train analysis skills and reporting
Step-by-step walkthrough of exploiting CVE-2025-53770 (ToolShell) in a LetsDefend lab, covering RCE, web shell deployment, and incident response analysis.
CVE-2025-53770 - SharePoint
Comprueba si un servidor SharePoint on-premises es vulnerable a CVE-2025-53770
Go-based scanner that detects SharePoint CVE-2025-53770 RCE vulnerability by injecting a harmless marker into the ToolBox widget and verifying its presence in the server response.
Detailed walkthrough of CVE-2025-53770 (ToolShell) SharePoint zero-day exploitation, including RCE analysis, MachineKey exfiltration, payload compilation, web shell deployment, and incident response containment steps.
Unauthenticated Remote Code Execution via unsafe deserialization in Microsoft SharePoint Server (CVE-2025-53770)
Do you really think SharePoint is safe?
Scanner for the SharePoint CVE-2025-53770 RCE zero day vulnerability (fork from hazcod/CVE-2025-53770)
A critical zero-day vulnerability CVE‑2025‑53770 has been actively exploited in the wild against on-premises Microsoft SharePoint Server. Dubbed "ToolShell," this exploit leverages a deserialization flaw (variant of CVE‑2025‑49706, CVSS: 6.3).
Proof-of-concept exploit toolkit for SharePoint ToolPane RCE (CVE-2025-53770) with scanner, payload analysis, and multiple exploitation methods for authorized security testing.
SharePoint WebPart Injection Exploit Tool
Technical analysis and detection guidance for CVE-2025-53770, a critical unauthenticated RCE vulnerability in Microsoft SharePoint Server exploited via ViewState deserialization and stolen machineKeys.
Technical analysis of a SharePoint ToolShell (CVE-2025-53770) exploitation attempt involving RCE, webshell deployment, and MachineKey extraction.
CVE-2025-53770 Mass Scanner
A sophisticated, wizard-driven Python exploit tool targeting CVE-2025-53770, a critical (CVSS 9.8) unauthenticated remote code execution (RCE) vulnerability in on-premises Microsoft SharePoint Server (2016, 2019, Subscription Edition)
C# tool that builds a GZipped, Base64-encoded .NET DataSet payload using LosFormatter to reproduce the SharePoint deserialization RCE chain (CVE-2025-53770).
A deep dive into CVE-2025-49706 — the SharePoint spoofing flaw now exploited in the wild for stealthy web shell deployment and privilege escalation.
Script to generate raw HTTP requests for exploiting CVE-2025-53770, enabling targeted vulnerability testing and proof-of-concept execution.
Marp slide deck detailing CVE-2025-53770, a SharePoint zero-day vulnerability, with modular slides, custom themes, and build scripts for HTML, PDF, and PNG output.
Exploit PoC for CVE-2025-53770 enabling webshell upload to SharePoint, ValidationKey extraction, signed ViewState generation, and remote code execution via reverse or bind shell.
A critical vulnerability in Microsoft SharePoint Server allows unauthenticated remote code execution via deserialization of untrusted data. Microsoft is aware of active exploitation; apply CVE mitigations immediately. Severity: Critical.
Python script to scan SharePoint hosts for CVE-2025-53770 using custom payloads, with optional Burp Suite proxy interception for traffic analysis and vulnerable host logging.
Lab & PoC
Proof-of-concept exploit for CVE-2025-53770 targeting Microsoft SharePoint. Demonstrates the vulnerability for educational and authorized security testing purposes.
Proof-of-concept exploit for CVE-2025-53770, demonstrating exploitation of a web application vulnerability for security testing and validation.
Python script to detect and verify CVE-2025-53770 vulnerability in target systems, enabling rapid security assessment and exploitation validation.
Exploit for CVE-2025-53770, a SharePoint ViewState deserialization vulnerability, enabling remote code execution via crafted payloads.
Agampreet Singh · windows · Aug 11, 2025
