cyprianatsyor/toolshell-cve-2025-53770-sharepoint-exploit-lab-letsdefendStep-by-step walkthrough of exploiting CVE-2025-53770 (ToolShell) in a LetsDefend lab, covering RCE, web shell deployment, and incident response analysis.
TL;DR Yo, in this LetsDefend lab I dove into a SharePoint zero-day called ToolShell (CVE-2025-53770). Basically, I mimicked a real-world attack where a malicious POST request bypassed auth, ran PowerShell to steal MachineKeySection keys, compiled payload.exe, and dropped a web shell (spinstall0.aspx). I logged everything, analyzed behavior, and contained the host. This README covers the attack, my steps, and lessons learned.
Lab Overview
Tools Used:
Windows PowerShell
VirusTotal
AbuseIPDB
LetsDefend Log Management
LetsDefend Enpoint Security
LetsDefend Threat Intel
EventID : 320
Event Time : Jul, 22, 2025, 01:07 PM
Rule : SOC342 - CVE‑2025‑53770 SharePoint ToolShell Auth Bypass and RCE
Level : Security Analyst
Hostname : SharePoint01
Source IP Address : 107.191.58.76
Destination IP Address : 172.16.20.17
HTTP Request Method : POST
Requested URL : /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx User-Agent : Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Referer : /_layouts/SignOut.aspx
Content-Length : 7699
Alert Trigger Reason : Suspicious unauthenticated POST request targeting ToolPane.aspx with large payload size and spoofed referer indicative of CVE-2025-53770 exploitation.
Device Action : Allowed
Overview On July 22, 2025, our security monitoring flagged a critical zero-day attack targeting an on-premises SharePoint Server instance named SharePoint01.
CVE Details:
CISA KEV Catalog: Entry published July 20, 2025
Attack Vector: POST request to /ToolPane.aspx endpoint, spoofed referer header, large malicious payload
Source: IP 107.191.58.76, Vultr Holdings, LLC, USA
About SharePoint Microsoft SharePoint is the backbone of enterprise collaboration and document management. It’s essentially a secure, organized cloud-like space for files, workflows, and internal apps.
Core Uses:
Document Management: Versioning, audit trails, file control
Collaboration: Multiple users editing same doc simultaneously
Internal Web Portals: News, updates, HR info, policies
Automated Workflows: Approvals, forms, notifications
Integration: Deeply tied with Teams, Outlook, Office Suite, Power BI
Security Considerations:
Authentication: AD or SSO
Encryption: Data at rest and in transit
Web Parts & Layouts: Can be exploited if misconfigured
Patch Management: Critical to prevent zero-day attacks
CVE-2025-53770 also called ToolShell is a SharePoint zero day exploited in the wild. Its a critical deserialization vulnerability in on-premises Microsoft SharePoint Servers that allows unauthenticated remote code execution (RCE). it chains with other SharePoint flaws (CVE-2025-49704 and CVE-2025-49706) to fully compromise systems It has a CVSS score of 9.8 which means its critical.
They upload malicious web shells like spinstall0.aspx via the ToolPane.aspx endpoint using spoofed referrer headers to bypass authentication.
They extract critical MachineKey values from SharePoint config to generate trusted ViewState payloads for persistent access.
and later deploying ransomware (e.g., the "Warlock" strain) or exfiltrating credentials and setting backdoors.
First public disclosure: July 19, 2025 (Microsoft blog)
Patches released: July 20–21, 2025
Entered CISA’s KEV catalog: July 20, 2025
Analyzed the IP adress of the sender(Sourse IP Address) on VirusTotal
Source IP Address : 107.191.58.76
From this i already know the IP is malicious
Now i have to search the location the IP is from with the help of AbuseIPDB
THis is what i got :
ISP Vultr Holdings, LLC
Usage Type - Data Center/Web Hosting/Transit
ASN - AS20473
Hostname(s) - 107.191.58.76.vultrusercontent.com
Domain Name - vultr.com
Country - United States of America
City - Los Angeles, California
IP Known for hacking, brute-force, web app attack, port scan, DNS poisoning
As a Junior Analyst solveing this how i went about it first i searched for the host on the endpoint security with the name "SharePoint01".
after locating the host, i went to the terminal history, i found a command line
whats happening in the command?
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
→ Launches PowerShell directly from the system directory.
-nop
→ No profile — ignores PowerShell profile scripts to avoid detection or interference.
-w hidden
→ Runs with a hidden window so the user doesn’t see it.
-e
lets decode this