luemmelsec/cve-2023-29357C# proof-of-concept exploit for CVE-2023-29357 targeting SharePoint, with YARA detection rules and detailed usage instructions for security testing.
Recreation of the SharePoint PoC for CVE-2023-29357 in C# with lots of help from ChatGPT.
Build with .Net Version 4.7.2 in Visual Studio 2017
Use NuGet Package manager to install any missing packages
Yara rules for detection below
Usage:
CVE-2023-29357.exe http(s)://yoursharepoint.lol [-v]
Huge shoutout to:
Jang for being very supportive with explainations on exploit steps and his huge writeup:
https://testbnull.medium.com/p2o-vancouver-2023-v%C3%A0i-d%C3%B2ng-v%E1%BB%81-sharepoint-pre-auth-rce-chain-cve-2023-29357-cve-2023-24955-ed97dcab131e
WhiteKnight for his support and the Python exploit:
https://github.com/Chocapikk/CVE-2023-29357
Florian Roth for his immediate efforts to provide YARA rules to help you protect against the usage of the current exploits:
https://twitter.com/cyb3rops/status/1707678149448700270
https://github.com/Neo23x0/signature-base/blob/master/yara/expl_sharepoint_cve_2023_29357.yar