zedocun/sharepoint-toolshell-cve-2025-53770-incident-analysisTechnical analysis of a SharePoint ToolShell (CVE-2025-53770) exploitation attempt involving RCE, webshell deployment, and MachineKey extraction.
This project documents the investigation of a real-world exploitation attempt targeting a SharePoint server using the ToolShell vulnerability (CVE-2025-53770).
The attack demonstrates a full exploitation chain including remote code execution, webshell deployment, and credential data extraction.
The attack began with a suspicious alert indicating exploitation of CVE-2025-53770 targeting a SharePoint server.
An unauthenticated HTTP POST request was sent to the vulnerable SharePoint endpoint:
/_layouts/15/ToolPane.aspx?DisplayMode=Edit
This request contained a large payload and a spoofed referer, indicating exploitation.
The attacker leveraged the IIS worker process (w3wp.exe) to execute an encoded PowerShell payload.
Instead of dropping a binary, the attacker used csc.exe to compile a payload directly on the server.
A malicious ASPX webshell (spinstall0.aspx) was written into the SharePoint directory using cmd.exe.
The attacker executed a PowerShell command to extract ASP.NET MachineKey configuration, enabling potential authentication bypass and persistence.
The webshell file was flagged as malicious by multiple security vendors.
Multiple external IP addresses were observed during the attack, including the payload delivery server.
The attacker achieved remote code execution and deployed a webshell.
Although no further activity was observed, the system must be considered fully compromised.
