OurSharePoint - CVE-2025-53770 (PoC)

This is a simple C# tool that builds a GZipped, Base64-encoded .NET DataSet payload using a LosFormatter-encoded inner payload. It's designed to help reproduce the SharePoint deserialization RCE chain described in public research.

What it does

You give it a Base64-encoded payload (like one from ysoserial.net), and it:

• Wraps it inside a valid .NET DataSet with a custom XML schema + diffgram
• Serializes the result using BinaryFormatter
• GZips the serialized blob
• Base64-encodes the result and writes it to a .b64 file

References

• https://research.eye.security/sharepoint-under-siege/
• https://github.com/rapid7/metasploit-framework/pull/20409/commits

Usage

First, generate your payload using ysoserial.net:

ysoserial.exe -f LosFormatter -g TypeConfuseDelegate -o base64 -c "cmd /c calc.exe" > nested_gadget.b64

Then run this tool:

OurSharePointBuilder.exe --in=nested_gadget.b64 --out=exploit --a=<random> --b=<random> --c=<random>

This will generate:

• exploit.bin - a raw serialized DataSet
• exploit.b64 - final GZipped and Base64-encoded payload thats ready for us

Also, if you dont specify --a, --b, or --c, the tool generates random lowercase names.

Notes

This tool does not validate or inspect the payload you give it.

If you're testing locally and deserialize manually, it may execute (e.g., pop calc).